A report on the .nz domain name proposes a new approach for administering New Zealand’s unique presence on the internet. This includes a revised set of guiding principles, greater engagement with Māori, and better awareness of cybersecurity and privacy issues.
InternetNZ, which administers the .nz domain name, has released the options report which has been put together by an independent policy advisory panel, chaired by Sue Chetwin, former CEO of Consumer NZ. It is seeking public submissions on the report, which follows a year-long review of the policies that govern the .nz domain name.
Existing .nz guidelines removed or modified
It’s proposed that the seven guiding principles that have to date governed the administration of .nz either be removed or modified.
This includes removing the principle that ‘registrant rights come first’, with the report noting that a more holistic approach can be taken in the domain name space. “It is not clear why registrants’ rights should be prioritised over the rights of the New Zealand public or at least balanced with them,” the report notes.
Another principle destined for the dustbin is ‘low barriers to entry’, which was primarily put in place to promote competition and keep registration fees low. The panel considers that this principle is too narrow, and “may risk impeding the development of a more secure, trust and safe .nz in the next decade and beyond.”
Meanwhile the principle ‘no concern for use’ is likely to be modified to enable more effective policing of how the .nz domain is used in extreme cases. For example, following the terrorist attack on Christchurch mosques in March 2019, InternetNZ was forced to put in place an interim policy to give DNCL (Domain Name Commission) powers to act in an emergency or in exceptional circumstances. “This principle may produce an enabling environment for registrants, who can operate with predictability and stability, and have confidence that DNCL cannot terminate their registration without a legal basis. However, the policy has meant that DNCL cannot act when clear and immediate harm is occurring via a .nz domain name,” the report notes.
It’s also suggested that the ‘first come, first served’ principle be modified and become an operational guideline—as opposed to the more strict ‘operating principle’. This is to recognise that some words shouldn’t be freely available for registration—an example of this could be a Māori tribal or ancestral place name for which the applicant has no entitlement.
Māori engagement emphasised in .nz report
The new set of guiding principles emphasise security, trust, accessibility and innovation, with one of the five principles specifically referencing support for te reo Māori [Māori language] and participation in .nz by Māori.
The report notes that the current .nz policies don’t explicitly reference Te Tiriti [Treaty of Waitangi] and Māori interests nor take into account Māori perspectives. “There is no restriction on Māori-related domain names being used in an offensive way or any provision for resolving disputes in a culturally appropriate way in terms of te ao Māori [Māori world view],” the report notes.
The panel recommends that InternetNZ take active steps to develop ongoing and trusting relationships so it can engage with Māori in the .nz policy-making process. “The panel considers the principal issue in this area is that the .nz policies have been developed without facilitating sufficient participation by Māori. We do not intend to perpetuate this by making substantive recommendations without more extensive engagement with Māori,” the report notes.
InternetNZ acting chief executive David Morrison says that organisation is currently recruiting for a Chief Advisor, Māori. “The decision to hire a Chief Advisor, Māori happened independently of the .nz policy review but the options paper recommendation does work in favour of this decision,” he says.
“We have been developing our understanding of te ao Māori inside the organisation, and relationships with the Māori internet community, for about the last four years. This year the Komiti Whakauru Māori [Māori Engagement Committee of Council] wanted to see these efforts continue and step up in their delivery. To achieve this, they asked for the development of a new role,” Morrison says.
New Zealand is not alone in this area—engagement that ensures the rights of indigenous people in the development of domain name policy has not occurred globally. “The panel has not been made aware of any ccTLD (country-code top-level domain) manager around the world which integrates the perspectives of any indigenous peoples into its policy development and, given the status of Māori and te reo in New Zealand, considers there may be an opportunity for InternetNZ to lead the world in this area,” the report notes.
Cybersecurity and privacy issues need to be prioritised
Despite the increasing number and sophistication of cyberattacks, current policies don’t allow InternetNZ or DNCL to specify minimum security stands on registrars, nor can InternetNZ provide its own security features directly to registrants. In addition, registrars lack incentives to prioritise security.
It’s a global issue, and although the report notes that threat to .nz or its users are low to moderate “the impact would be highly significant”.
Recommendations include incentivising or mandating security practices, and creating security policies that are technology neutral, as opposed to technically specific requirements that may become outdated or too expensive to implement.
Privacy issues are also raised in the report, specifically that registrants’ personal details are “open by default” and can be publicly searchable. “This open-by-default approach to registrant information is an artifact of the early days of the internet, where transparency was thought to achieve the best outcome, upholding accountability and openness by ensuring that the registrant of a domain could be easily identified. But making personally identifiable information (PII) publicly available can facilitate registrant information being used for malicious purposes or deter people from registering a .nz domain name due to privacy concerns,” the report notes.
The current policies may not comply with the new Privacy Act that comes into effect in December 2020, so the panel recommends that steps be taken such as only taking essential information from registrants, and ensuring they are aware of how their information can be accessed.
Additional recommendations for .nz domain names
The report recommends ways to grow and improve the market operation of .nz, which include addressing the flat wholesale fee structure, empowering registrants to improve market performance and improving the regulation of resellers.
According to financial statements on its website, to the year ended 31 March 2020, InternetNZ Group received $10.8 million in registry fees, out of total revenue of $11.4 million. The organisation recorded total expenses of $11.8 million, resulting in a net loss after tax of almost $400,000.
“InternetNZ recorded a net loss in the 2019-2020 financial year due to special funding being provided by InternetNZ to DNCL for US litigation costs against DomainTools and because of an increased investment in capability; for example the hiring of a Chief Security Advisor,” Morrison says, noting there is commentary about the result on its website.
“With the change in the organisation’s structure in 2018, it is difficult to compare previous losses as InternetNZ was previously funded by predetermined dividend payments.”
The number of new .nz domain names had been declining, but there was an uptick of registrations during the recent COVID-19 lockdown, the report notes. “Growth in the overall number of .nz domain names has stalled in recent years. Registrations reached a peak of 719,266 by the end of 2018, but by March 2020 they had fallen to 708,507. In the year April 2019-April 2020, total domain name registrations decreased by 0.65%. There has been a significant uptake in April and May resulting from the COVID-19 lockdown.”