7 Days Before Obama Gives Away Internet & National Security
In one week, President Obama will allow what remains of the United States’ control over the Internet to pass to a California non-profit organization, the Internet Corporation for Assigned Names and Numbers (ICANN). This is a reckless and dangerous decision that has serious national security consequences that have not been fully considered.
Currently, ICANN has a contract with the Department of Commerce’s National Telecommunications and Information Administration (NTIA) to manage the naming and numbering functions associated with the Internet. The most important of these is the assignment of Internet Protocol Addresses (IP Addresses) to domain names. This is called the IANA function — Internet Assigned Numbers Authority. ICANN performs this function pursuant to its contract, then NTIA reviews the assignment, and authorizes Verisign to post the IP Address to the “A server” — the authoritative root zone server that is the “master” file of all IP Addresses. This A server is replicated to all of the other root zone servers globally on a daily basis. This is how a domain name gets online.
Domain Name —> IP Address Assigned —> NTIA Reviews & Authorizes —> Verisign Posts
Thus, the integrity of every IP Address for every domain name on the Internet is under U.S. control and stewardship. The NTIA contract with ICANN expires October 1, 2016. Even though it could be extended for any period through September 2019, upon expiration, President Obama has agreed to let the Department of Commerce hand full control over the IANA functions to ICANN, effectively ceding the last control that the U.S. has over the Internet to an ambitious non-profit organization that will have no ties to the U.S. Government.
To be fair, some people are very much in favor of the transfer. Some claim that getting the government out and transferring all authority to ICANN will help ensure a multi-stakeholder process to Internet governance and shared authority over the Internet. Others claim the transfer will help ensure freedom of expression because giving our control to ICANN will keep the Internet out of the hands of the UN and its International Telecommunications Union (ITU), where Russia and China have been grasping for it. These governance issues, however, have overshadowed the national security considerations and proper attention has not been given to the importance of our control over the IANA function. We don’t need to throw the baby out with the bath water. Solutions can be designed to meet legitimate concerns of users and nation states, while preserving national security interests.
Others, however, believe the transfer is not only a bad idea, it is mad. Currently, the U.S. Government vets and approves every domain name and IP Address on the Internet. When the A server is replicated nightly, it is done following U.S. Government oversight and authority to post the new IP Addresses. Now, think about if the U.S. was engaged in cyberwar — a situation surely to occur. Under this new arrangement, the U.S. may not know if all of the IP Addresses for domain names are legitimate or if they have been manipulated or compromised in some fashion. Moreover, the Government’s — and the private sector’s — ability to get new sites accessible on the Internet would be dependent upon the actions of a non-profit organization which is increasingly multinational. It is also possible that ICANN may fall under the influence of powerful corporations or nation states who do not have U.S. national security interests at the forefront.
In sum, in a cyberwar scenario, the U.S. government may not have control over a very strategic area of its military operations — cyber. Even if it secures military and government domains and IP Addresses, the targets in cyber warfare are likely to be civilian, and the U.S. Government requires private sector infrastructure to operate. Since the Internet underpins our computer systems, electrical grids, communication systems, and other critical infrastructure, our entire civilian society could be at risk: the Internet may not function properly or changes necessary to protect us may not be implemented or made in a timely fashion. I want to be clear that I am not suggesting that ICANN is not to be trusted today. I am simply stating that the Internet is critical to our military operations and civilian society and certainty regarding its operations and changes to its addressing system is a vital national security interest that cannot be cavalierly given away.
ICANN’s own documents describe the U.S. Government’s role this way:
The U.S. Department of Commerce’s National Telecommunication andInformation Administration (NTIA) provides general stewardship ofICANN’s performance of the root zone management function….When a request is made to change any information contained within the root,the details of the request are transmitted by ICANN to NTIA as a recommendationfor implementation in the root. NTIA verifies that ICANN followed establishedprocedure and policy in processing the change request; and then authorizesVerisign and ICANN to implement the change in the authoritative root zone file androot zone database, respectively.
Once the contract expires and NTIA hands authority to ICANN, this cannot be reversed by Congress or a new Administration. Once it is given away, it is gone, just like when you sell your car, you can’t take it back. The U.S. loses control over IANA functions.
In the future, how are we to know that established processes were followed in making such changes? ICANN is certainly not dominated by Americans. Take a look at its board. The current board is highly responsible, and its chairman, Steve Crocker, is a patriot and one of the finest people I know. Well, people come and go, but authority remains. By transferring this authority, we are giving ICANN the authority to make decisions (or not make decisions) important to our national and economic security interests (remember, every U.S. company needs to be on the Internet to make money and conduct its operations).
It is also important to acknowledge that the U.S. Government has failed miserably over the past decade in establishing meaningful stakeholder involvement on Internet governance issues. I agree that other nations should be involved in Internet governance and their input should be meaningful and listened to. It is possible to structure current oversight in such a way that multi-stakeholders are involved. For example, existing U.S. authority could be shared with other governments and stakeholders; the U.S. does not necessarily have to have sole authority. Designing such structures is possible, but not in 7 days.
There also is the consideration that the U.S. developed the Internet and allowed the National Science Foundation to turn it over to four commercial providers on April 30, 1995, but it did not give away the IANA function. This was a retained property interest. Just because there are 3.6 billion Internet users today, it does not mean that the U.S. should no longer retain the IANA function. There should be some measure of respect for the control that the U.S. retained. It is a U.S. Government property interest that is important to national security. The U.S. Government has been a responsible steward of the Internet and ensured that its resources have remained stable and available to people around the globe.
If the U.S. is to give up the IANA function, a clear and certain structure should be developed that ensures multi-stakeholder involvement, as well as protection of U.S. — and every other countries’ — national security interests. ICANN is not a “certain” structure. It is a non-profit organization that is not subject to the international laws and treaties applicable to nation states, diplomatic processes and protocols, or even certain jurisdiction. ICANN currently has offices in Los Angeles, Singapore, and Istanbul.
So, what can be done if the NTIA contract is to expire in only 7 days? President Obama should extend the turnover of IANA functions one year so these national security considerations can be fully debated and a new multi-stakeholder governance approach can be developed. Are you an Internet user? Does your company need the Internet to operate? Is public safety and certainty in military operations important to you and your family in times of warfare? Take some action. Send the President an email at email@example.com. Maybe it will make him think about his legacy.