<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#333333" bgcolor="#ffffff">
<font face="Helvetica, Arial, sans-serif">Norbert has put the 'slippery
slope' scenario quite well.<br>
<br>
I agree that a simple shift from US to another body is not enough. But
since in the discharge of the oversight role, commission is a much
bigger issue than omission, it is certainly better if say 15 other
country reps have to simultaneously agree to an act of commission along
with the US rather than US getting to decide it alone. And that much
better if there is an international law to clearly describe the
oversight role, its procedures and limits, and an international
judicial system to adjudicate whether the concerned body acted as per
the relevant international law. None of this exists at present vis a
vis US's exercise of the oversight role. It just a bunch of people
convinced that US's is a good and benign government. Hardly a good
basis for a global governance system. <br>
<br>
parminder <br>
</font><br>
On Wednesday 13 June 2012 07:05 PM, Norbert Bollow wrote:
<blockquote cite="mid:20120613133508.377E1819F@quill.bollow.ch"
type="cite">
<pre wrap="">David Conrad <a class="moz-txt-link-rfc2396E" href="mailto:drc@virtualized.org"><drc@virtualized.org></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Just a small nit:
On Jun 11, 2012, at 3:32 AM, Norbert Bollow wrote:
</pre>
<blockquote type="cite">
<pre wrap="">John Curran <a class="moz-txt-link-rfc2396E" href="mailto:jcurran@istaff.org"><jcurran@istaff.org></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">For clarity, which USG "oversight role" are we referring to?
</pre>
</blockquote>
<pre wrap="">...
3) review of root zone changes before publication
</pre>
</blockquote>
<pre wrap="">
Currently, outside of internal checks done by Verisign as the Root
Zone Manager, there is no review of root zone changes prior to
publication. DoC's role, as far as I understand it, is to verify
that ICANN, as the IANA function operator, followed the documented
policies and processes in handling a request from a TLD
administrator. Once a change is authorized, the next point (outside
of Verisign) where the change can be reviewed is after it hits the
root servers.
</pre>
</blockquote>
<pre wrap="">
David's nit is of course well justified in that I was indeed imprecise
there -- probably because I'm a bit of a "doubting Thomas" in regard
to the assertion that DoC would routinely, for every root zone change
request, "verify that ICANN, as the IANA function operator, followed
the documented policies and processes in handling a request from a TLD
administrator" -- it will take some serious evidence to convince me
that that role description isn't pure propaganda and not just a facade
for something that is in reality intended to be pure international
power politics. (These doubts are quite independent of the questions
about whether such an intention results in effective power, and
whether or not the resulting situation should be considered to be a
serious problem from the perspectives of people outside the US and
their governments.)
</pre>
<blockquote type="cite">
<pre wrap="">As mentioned in a previous note, I believe this to be a flaw in the
current root zone management system.
</pre>
</blockquote>
<pre wrap="">
Since technical correctness of the resulting zone data is easier to
double-check than procedural correctness, and since I would expect
unintended honest errors on the technical level to likely occur more
frequently than any malicious subversion of the documented policies
and processes for handling requests from TLD administrators, I
agree that there seems to be some kind of flaw here.
In a later posting, David Conrad <a class="moz-txt-link-rfc2396E" href="mailto:drc@virtualized.org"><drc@virtualized.org></a> wrote in
response to a posting of Parminder:
</pre>
<blockquote type="cite">
<pre wrap="">Assume the USG forces Verisign to remove .IN from the root zone. A
query for <anything>.IN will then result in a "name error" response
being returned to the querying resolver (typically operated by
ISPs). With DNSSEC, some cryptographic data is also returned that
allows the resolver to prove (in the mathematical sense) that the
holder of the root zone signing key (Verisign) agrees that the "name
error" should be returned. Without DNSSEC, you still get the "name
error", the resolver just can't prove that's what the holder of the
zone signing key intended.
So, we now have a root zone(provably, if you bother to verify the
DNSSEC data) without .IN in it. Let's say you run an ISP anywhere
in the world. Now, _all_ of your customers that attempt to connect
to any website in the .IN domain will get "name does not exist" in
their web browsers, email programs, bittorrent clients, etc. Your
customers are probably not going to assume it is because the USG
removed the .IN domain, rather they're more likely going to assume
you screwed up somehow and call you to scream at you. After a
sufficient number of calls (which, depending on the scale of your
ISP, will probably be from minutes to hours), you'll most likely fix
the problem for your users by getting a copy of the root zone,
reinserting the .IN data into that copy, and putting that root zone
on your resolvers.
</pre>
</blockquote>
<pre wrap="">
I agree that customers of ISPs in India would indeed assume that
their ISPs have screwed up, and get their ISPs to change their
resolver config in a way that makes them independent of all root
servers which fail to carry the .IN zone.
The situation may well be different outside India. I don't see a
lot of references to .IN domains here in Switzerland. Most people
and companies in India that I have had contact with seem to use
.COM, .NET and .ORG domain names rather than .IN, and it'll be a
lot less obvious to people that it is *their* ISP who should fix
the India domain name issue for them.
And if it doesn't concern India but a smaller and economically
less important country, any pressure on most ISPs outside the
country from their customers will be much weaker still.
But anyway I don't think that "the US might want a ccTLD to suddenly
disappear" is the most appropriate threat model here. I think we
should rather discuss scenarios with some kind of slippery slope,
like e.g. the following:
Suppose that as a first step, the US would demand that all domain
names which are used to host clear instances of child pornography
(sexual abuse of young children which is filmed or photographed
with intentions of criminal enrichment) must be deleted from DNS
within 24 hours of receipt of a notification from an US government
agency. If a TLD registry outside the US doesn't agree, maybe the US
government would demand a root zone change by means of which DNS
queries for that TLD are sent to nameservers that provide a filtered
view of that TLD. Besides the child pornography sites, all other
domains of that TLD would still work. There would not be a big public
outcry because hardly anyone wants to destroy their reputation by
taking the side of child pornography sites.
As a second step, the same principle might get applied to sites of
Islamic extremists who promote violence. Some people would protest,
but in most countries, most ISPs would probably rather disappoint
some potential or actual customers than risk having to defend
themselves in the court of public opinion and in the courts of
law against the accusations of failing to comply with the laws and
of supporting terrorism.
It would probably continue to go downhill from there. All kinds of
ideas are dangerous and threatening to some kinds of politicians:
Some would feel threatened in business interests tied to the
military-industrial complex if any of the groups that advocate
non-violence and anti-militarism achieves great influence. Some
would feel threatened if one of the groups that advocate holiness
in sexual purity and honesty achieves great influence and tells
people not to vote for politicans who don't live according to
these principles. Maybe I am a bit paranoid here, but it doesn't
seem far-fetched to me that in such situations, rabble-rousers
might react with racist, pro-violence slogans to the websites of
such groups, and some of those who are in power might take that as
justification to declare all kinds of strongly moral religious
statements to be too provocative to be allowed on the Internet...
In the above, the references to the US are mainly because it happens
to be the US that appears to have some relevant power. I wouldn't
view "let's give the role of the US to the UN" to be in any way an
improvement with regard to this kind of concerns. The fact that the UN
does some good work in regard to the promotion and protection of human
rights, and also promotes itself in the name of human rights, has not
stopped some UN agencies such as WIPO from putting human rights rather
low on their scale of actual priorities.
So I would suggest that what needs to be done is to work towards
an oversight model that is designed to be as robust as possible
against risks of "slippery slope" scenarios such as the one described
above. The existing international human rights law is a good starting
point IMO. I would say what is primarily missing right now is a global
multistakeholder process to interpret this practically in the
Internet governance context, in a way that results in concrete
recommendations for feasible and effective governmental actions.
Greetings,
Norbert
</pre>
</blockquote>
</body>
</html>