The Status of Dot EU

Christopher Wilkinson
Adviser, Directorate General Information Society
European Commission

Good morning, Ladies and Gentlemen:

It is a privilege to be speaking again at WIPO among so many friends and associates who have worked together during the past four years on the development of international Internet management policies, ICANN and the DNS.

My theme today is the status of the proposal to create a new ccTLD Registry Dot EU, and I will bring you up to date as to where we are. However, it so happens that within the European Institutions and the European Internet Community, things are moving forward currently and anything I say today may well be outdated within a month or so. Indeed, the Member States' experts are meeting in the Council of Ministers tomorrow, the first discussion in the European Parliament Industry Committee is on Tuesday next week and the EC Panel of Participants is meeting on Thursday next week in Brussels. So please don't expect me to give you a definitive or stable report. Watch this space. And by the way, the EC-POP meeting on 1 March is an open, public discussion, that you may each join in should you so wish.

Also, what I have to say today is a personal view of where we stand on several current issues, rather than an official EU position. At this juncture, it is not possible to be more definitive on questions that are the subject of negotiations within the EU Institutions.

I shall start by referring to a few general issues that are influencing the policy environment for ccTLD Registries, in Europe and world-wide. In the Commission we follow closely the discussions that are taking place in ICANN, the ccTLD Constituency and CENTR, even though we cannot be present at all their meetings.

First, the current status of ICANN: ICANN should now be reaching a stable state and the transition from the US Department of Commerce

to ICANN should by now have been completed. For several reasons, this is not yet the case, and I believe that it is incumbent on the Governments, particularly the US and the EU, and on the private sector leadership in this area to analyse where the problems still lie and to find urgent solutions:

• We hope that the new US Administration will find a way to explain to Congress that it is time they allowed ICANN to get on with its job without being called in to testify in hearings on everything that it has been doing.

  In Europe, where by-and-large we just want ICANN to get on with its job. Consequently we would rather see a certain strengthening of ICANN's statutes that would confer a necessary degree of immunity, while re-invigorating ICANN's accountability and transparency.

• Second, in spite of the partial transfer of responsibility from US DOC to ICANN, the fact is that Washington is still exercising more oversight of ICANN than was the case during the era of Dr Jon Postel and IANA. We would urge the new Administration to scale back the current level of oversight to that which is absolutely indispensable to respect US Administrative laws, should they indeed still be applicable. Internet participants outside the United States perceive the current situation as a regulatory irritant.
• Thirdly, European governments recognise the need for a degree of public policy oversight of ICANN, because of the critical function of the Internet for our economies, but this should not, cannot, be exercised unilaterally by the United States. Such oversight should be positive, limited and finite – not open ended, and it must be shared.

At present, however, we seem to have the worst of both worlds: ICANN lacking the necessary degree of autonomy to fulfil its self-regulatory tasks, and the US Government slowly relaxing its role absent any agreed definition of where is the end point, nor the definitive role of the other governments that are critically involved in this process.

ICANN must be global and international. We went to great lengths in 1998 to achieve agreement on the global dimension of Internet management. ICANN's Board and Supporting Organisations are a good deal more representative than they were to begin with. We also welcome the recent appointment of a senior European member of ICANN's staff.

Secondly to recall the basic policy framework within which these developments are taking place.

There has been much discussion recently about the balance in the relationships between ICANN, the GAC, the ccTLD Registries and their national governments. The GAC Principles for ccTLDs envisage an essentially triangular relationship between ICANN, the Registry and the relevant public authority, the essential characteristics of each branch of the triangle are defined: The contractual relationships (or other "communications") between the three parties to the delegation should take account of the GAC guidelines. It has been suggested that in this context, the GAC has "invented" some kind of previously non-existent relationship between the governments and their ccTLDs. I have to recall that this is not so. When the Europeans and particularly the EU Governments bought into the IANA Transition process it was on the basis of the US White Paper, to which we had contributed extensively through the 1997 NTIA public consultation and the March 1998 EU reply to the Green Paper. Allow me to recall that the White Paper says:

"More than 200 national, or country-code, TLDs (ccTLDs) are administered by their corresponding governments or by private entities with the appropriate national government's acquiescence."

It goes on to say, referring to the narrowly defined and restricted role of the public authorities in Internet management:

" . . . Of course, national governments now have, and will continue to have, authority to manage or establish policy for their own ccTLDs."

I think it is fair to say that those statements – whether they represented fact or intention at the time – were a critical part of the overall consensus on the creation of ICANN and its affiliated entities. Had the United States Government said on the contrary that the ccTLD Registries were completely independent of their national governments and/or that the US Government retained direct jurisdiction over the allocation of ccTLD Registries, then it is quite clear to me that we would have been in an entirely different situation. We were not. We are not.

Consequently, I have to say that I was quite surprised to read, a recent statement in the US Congress on behalf of the "Dot CC" Registry to the effect that:

"Unfortunately … governments of foreign countries may be give more control over important policies, including the operation of country code TLDs … [the US] Congress, rather than ICANN, is the appropriate body to make policy regarding such critical issues."

And that:

"… The [US] Senate should direct the DOC to refrain from …recognising rights of foreign sovereigns over top level domains …"

On the contrary, The ICANN Governmental Advisory Committee has, carefully codified guidelines for the appropriate relationships between Governments, ccTLDs and ICANN. These principles that have been published for some time benefited from extensive consultation and discussion, and represent the most light-handed and, at the limit, informal, non-legal, relationships between governments and Registries that could be accepted by all parties concerned. I recall that the US Government was an active participant in that process. The European Governments are not prepared to see those agreed principles lost or diluted through the opposition of a few Registries, and we would be very concerned about any attempt at retrospective rewriting of the US White Paper.

My third point concerns the transparency, reliability and security of Registration Data, generally known as Whois. There is no doubt that in the era of a pervasive Internet and growing electronic commerce, transparency and reliability of Whois information have become increasingly important. There would appear to be no good reason, except the legacy of technical practice for Whois data to be treated differently in ccTLDs and gTLDs (new and old).

There are increasing demands for transparent and reliable registration data, whether to identify infringement or to prevent tax evasion. However, there are clearly some important limits and boundary conditions that have not yet been satisfactorily codified, let alone put into practice. I suggest that:

• There should be a clear distinction in the DNS between potentially commercial and personal or non-commercial domain names and sites. The right to privacy applies to people. There should be parts of the name space where people can enjoy their rights to privacy. That should mean that their registration data must be accurate, up to date and published. It should not be available for unauthorised use, for example through bulk downloads.

  From this point of view, the .name registry proposal is a welcome innovation, and I would urge the national Registries in Europe to think about offering a similar service to the general public. The Commission has proposed that there should be a specific name-space in the Dot EU Registry for individual registrations.

  Needless to say that the beneficiaries of personal or non-commercial registrations would be committing a breach of trust if they use such sites for commercial activities or for illegal or otherwise infringing purposes, and the necessary discipline should be enforceable through the registration contracts.

• The purposes for which DNS registration data can be used must be specified. From my point of view that is limited to contact purposes. That is, the general public and the public authorities have a right to know who lies behind a commercial site, where they are and under which jurisdiction they are conducting their business.
• The entities or persons supplying the data retain their rights to that data and must have the right to "opt-out" to the use of their data for other commercial purposes. In particular, the commercialisation of access to Whois data, without the prior agreement of the data owner, should not be permitted.

I suggest that we need ICANN to establish clear rules in this area, consistent with Privacy law and policy around the world, that are applied by the Registries and Registrars. Otherwise necessary technical transfers of such data will be stymied by conflicting policies in different parts of the world.

This is not an idle hypothesis. On Friday we learnt from the US Press that NSI is offering a data mining service based on the .com, .net and .org databases. By all accounts NSI claims that:

"Taking advantage of our position as a market leader, we have organized our pool of over 15 million registered domain names into a customer database of over 5 million unique customers. Our data service offers access to the key decision-makers behind millions of leading Web businesses . . . We also track the progress of sites through key stages in the dotcom lifecycle, including live or not-live sites, e-commerce status, membership features and more. Want to target only small businesses with live sites?"

They say that they can do it for you, in the interests of employing the information assets of the company, apparently to drive revenue.

Well, I do not think that they should be able to do that. First, they do not have the rights to the data that they are claiming to sell to marketing organisations. Those rights belong to the Registrants, who have never been asked whether they agree. Secondly, Verisign has its own published privacy policy under the Trust-e system. They say:

"You should also be assured that we do not provide or sell information about our customers or site visitors to vendors that are not involved in the provision of VeriSign's public certification and other services."

There would appear to be a contradiction, here.

Thirdly, many TLD Registries are explicitly excluded from entering into any business other than domain name registration. For instance, that is likely to be the case for the Dot EU Registry. A TLD Registry is already a natural monopoly in its market. Even assuming that this data-mining activity is legitimate, many people would regard it as fundamentally anti-competitive for a registry to bundle value added services of this kind in competition with other market players. I suggest that ICANN should begin to look into the concept of a level playing field for the Registry business.

Furthermore, governments and the courts are currently going out of their way to discourage all kinds of illegal and infringing behaviour on the Net, and in that context it just will not do for responsible, trust-worthy Registries to appear to flout privacy and competition policy in this way.

I think it has become urgent for the ICANN and the Registries to consult with the public authorities to determine what such data can be used for and within what constraints.

A third general area of policy that will affect Registries in Europe is the detail of their own ccTLD registration policies. The European Parliament, among others, is beginning to take an interest in how the DNS functions in the Member States. The parliament is considering a Report on Internet Governance that would encourage an open and competitive environment for DNS registrations, and calls on the Member States to coordinate their ccTLD registration policies so that users are handled consistently throughout the EU.

The Commission has encouraged CENTR to develop best-practice guidelines in the interests of reducing the evident disparities between its members' registration policies.

This demand for consistency relates to several key areas that are of interest to users of all kinds:

• Geographical eligibility: under EU internal market policy it is really quite difficult to justify that entities established or resident in one Member State cannot register names in the Registry in another Member State.
• Names of companies, trademarks and products: The registration policies are not consistent. The pros and cons are quite complex, but it is difficult to explain to users why the rules differ so much from one Member State to another. The Commission has received complaints in this area. My understanding is that most EU Registries want to be treated as private-sector entities, in which case they should be able to resolve most of these questions on the basis of consensus-based self-regulation.
• Dispute Resolution policy: There is quite a strong case for a uniform dispute resolution policy to be applied by all EU-based Registries. This should take full account of the ICANN and WIPO policies, but need not incorporate every detail. However, users, particularly users from other Member States should know what policy is going to be applied. This conference is itself a welcome opportunity to raise the level of awareness among ccTLD Registries, and particularly the possible scope and application of the Second WIPO process, currently underway.
• Cybersquatting: This problem is acquiring an increasingly high profile and will no doubt also be referred to in the European Parliament Report and Resolution. I believe that most of the problem arises from two misconceptions in the Registries' current policies:

• First, the idea is gaining currency that the act of registering a name creates some new kind of property right. As far as I can see, it does not. Absent a pre-existing trademark or other right in existing law, registration should create no more than a right to use the name – like a street address or a telephone number.

• Second, Registries that accept bulk registrations on behalf of third parties that have no prior rights to the names and do not intend to use them are I believe inviting unnecessary difficulties. Third party trading and speculation in other peoples' names should be strongly discouraged and if possible prevented through technical means. Needless to say I would have similar reservations about the so-called secondary market in names.

  Meanwhile, the Dot EU Registry will, I expect, implement an active anti-cybersquatting policy.

* * * *

Now, to turn to the Dot EU Proposal more specifically.

Background: The Commission first started working on this concept in mid-1997 with strong interest and support at the time from Euro-ISPA, but it proved to be an up-hill task. There was clearly a need for something in the DNS on the European scale, particularly for the internal market, for small and medium sized enterprises, and for electronic commerce that was already on the horizon. At the time, all other proposals for new TLDs were stymied. The IAHC package was essentially not accepted by the US Government and the NTIA Green paper package was not accepted by the Europeans. The dominance of NSI in the .com market was not acceptable for competition reasons, particularly as it was operating on a commercial basis, and still is. The principle of international management of the DNS had also become an essential element in the picture.

So we set about persuading IANA, ISO and then ICANN about the need for European-level TLDs. Jon Postel deferred to ISO, ISO agreed in principle to .EU in September 1999 and ICANN agreed in principle in September 2000. Hardly Internet speed, but there we are.

The "local Internet Community": We have adopted and adapted the RFC 1591 concept. There is no doubt that there is a local Internet community in Europe. Many of the participants are represented here today. But we recognise that this is not a legally or institutionally identifiable concept, and depends, to a degree, on the optimism and idealism of Jon Postel.

In the absence of a rigorous definition, the Commission has relied on two inter-related benchmarks: open process , so that private sector consultative meetings have been open to all interested parties, and self selection , that is that an interested party is someone who said he or she is interested, without prior rules or filtering.

The European Community Panel of Participants illustrates this process in practice. It is not perfect, but it is the best approximation that we have found to convene the Internet Community in Europe. The principal lacuna is the ability to identify and articulate the interests of the final users, the registrants and the general public. Private individuals and non-commercial users are in practice under-represented; they often do not have the resources, organisation and representativity that other participants tend to enjoy. This is a major justification for the public authorities to maintain a permanent presence and role in Internet Governance.

I make no apology for this. It is a general problem for organisations that would be representative of all their constituencies. For instance, ICANN itself cannot make up its mind whether the interests of the final users are represented by the At Large membership or by the GAC. In Europe, the EU Institutions will have to decide either to take full account of user interests themselves or to find ways of reinforcing user representation within the decision making process, notably within the Dot EU Registry itself.

The Legal Basis for Dot EU:

We decided at an early stage that there would have to be a formal legal basis for the existence of the Dot EU Registry in European Law, particularly for the European Community to exercise its responsibility vis a vis ICANN to designate the Registry Organisation. This was to evacuate, once and for all in this case, the legal issues surrounding the delegation and operation of the Registry. Furthermore we had been informed by the difficult negotiations between the US Government and NSI in 1999 and by the uncertain relationships between ccTLD Registries and their national governments. The Commission proposed that the legal base should be the Articles of the Treaty referring to the promotion of trans-European networks.

The Commission Proposal:

The Commission proposal for a Regulation was adopted at the end of December and now has been published for some time. It was presented to the EC-POP meeting on 11 January. In short, the Commission envisages that the European Union should be responsible for the public policy aspects of the Registry's activities, and the Registry should be responsible for the organisation, administration and management of the Dot EU TLD. The precise scope of public policy issues and management issues is currently under discussion; the Commission proposed that at least, ADR policies and cybersquatting policies should come under the European Union's ambit, whereas most other policy matters could be determined by the Registry after consulting the EU.

Within the EU, the Commission would act after consulting the Member States and the Registry would act after consulting the Commission and other interested parties.

The Registry will be a not-for-profit entity. The Commission would designate the Registry Organisation to ICANN on the understanding that the Registry would fulfil the general criteria required by ICANN, under RFC 1591 as updated by ICP-1 and by the GAC in its ccTLD Principles document. These require notably that the Registry will operate in the general interests of the local and global Internet community.

Finally, the proposal envisages that the Registry would enter into a contract with the Commission, acting on behalf of the European Community, and with ICANN. We envisage that the Registry contract with ICANN would be consistent with the GAC Principles, and in that respect, we are particularly attentive to the current discussions between ICANN and CENTR regarding a standard service contract.

The main lines of the contract between the Commission, acting on behalf of the European Community and the Registry are also foreseen in the GAC Principles. In addition, the contract would specifically reserve to the European Community sufficient escrow and licensing rights in all data bases and computer programs to retain rights to the EU code and to permit re-delegation or reassignment of the TLD Registry in the event of technical or business failure. The delegation of the TLD to the Registry would be for a fixed term, renewable.

Issues under discussion:

As I said in my introduction, it is not possible today to say what the final outcome will be of the policy making process in the EU Institutions and the creation of the Registry and establishing its relations with ICANN and the Commission. It is however clear that the EU Institutions are in a hurry. The Council Presidency has announced a decision of principle in early April, and the Parliament may be able to adopt the regulation in April or early May. This tight schedule depends on the Council and the Parliament reaching agreement on this piece of legislation at the "First Reading".

Last year a number of private sector experts emanating from the EC-POP set up at our initiative an Interim Steering Group to facilitate the preparation of the .EU Registry. Our Report has been published. We identified, I believe accurately, the main issues that have to be decided. I would point to the following:

• The balance of policy making authority between the EU public authorities and the Registry organisation itself. Let's call that the co-regulation issues.
• The balance of power within the EU between the Commission and the Member States. Let's call that the comitology issue.
• The method for selecting and designating the Registry organisation, given that this must both be open and transparent, but that the Registry will also be an unique entity, potentially exercising a natural monopoly and must operate in the interests of all the Internet Community concerned as well.
• Registration policy: The most difficult problems to be resolved would appear to be:

• The scope for prior checking of the accuracy and good faith of registration data, or whether to rely on self-certification and ex-post policing of erroneous or fraudulent data.

• Which categories of words will be available for registration and which words should be reserved, excluded or pre-registered
• Whether certain categories of registrants would be able to register directly in the Second Level, and if so which categories of names would be eligible, e.g. company names
• Which generic Second Level Domains should be created for specific purposes
• Treatment of IPR and other property rights in the Dot EU name space, including the possibility of a sunrise period for trademarks that have already been registered with the European Office for Harmonisation of the Internal Market (OHIM

Although these issues were addressed in the ISG Report, there are now a much larger number of participants in the current policy making process, so we shall see what they all come up with.

* * * *

In conclusion, I believe that ccTLDs in general – not only .EU – still have a lot or work to do to bring themselves up to speed with the expansion of the DNS, electronic commerce and increasing participation by individuals. This is not just a matter of IPR and ADR, although WIPO does have a major role, as we are seeing today.

I believe that organisations such as CENTR and ICANN itself need to put a lot more time resources and management in "levelling up" ccTLDs world-side in international best practice. The Dot EU Registry and the European Commission will be active players in that process.

Thank you for your attention.