```

[Senate Hearing 109-1152]
[From the U.S. Government Publishing Office]

                                                       S. Hrg. 109-1152

                INTERNET GOVERNANCE: THE FUTURE OF ICANN

=======================================================================

                                HEARING

                               before the

        SUBCOMMITTEE ON TRADE, TOURISM, AND ECONOMIC DEVELOPMENT

                                 OF THE

                         COMMITTEE ON COMMERCE,
                      SCIENCE, AND TRANSPORTATION
                          UNITED STATES SENATE

                       ONE HUNDRED NINTH CONGRESS

                             SECOND SESSION

                               __________

                           SEPTEMBER 20, 2006

                               __________

    Printed for the use of the Committee on Commerce, Science, and 
                             Transportation

                  U.S. GOVERNMENT PRINTING OFFICE
71-638 PDF                WASHINGTON : 2011
-----------------------------------------------------------------------
For sale by the Superintendent of Documents, U.S. Government Printing 
Office Internet: bookstore.gpo.gov Phone: toll free (866) 512-1800; DC 
area (202) 512-1800 Fax: (202) 512-2104  Mail: Stop IDCC, Washington, DC 
20402-0001

       SENATE COMMITTEE ON COMMERCE, SCIENCE, AND TRANSPORTATION

                       ONE HUNDRED NINTH CONGRESS

                             SECOND SESSION

                     TED STEVENS, Alaska, Chairman
JOHN McCAIN, Arizona                 DANIEL K. INOUYE, Hawaii, Co-
CONRAD BURNS, Montana                    Chairman
TRENT LOTT, Mississippi              JOHN D. ROCKEFELLER IV, West 
KAY BAILEY HUTCHISON, Texas              Virginia
OLYMPIA J. SNOWE, Maine              JOHN F. KERRY, Massachusetts
GORDON H. SMITH, Oregon              BYRON L. DORGAN, North Dakota
JOHN ENSIGN, Nevada                  BARBARA BOXER, California
GEORGE ALLEN, Virginia               BILL NELSON, Florida
JOHN E. SUNUNU, New Hampshire        MARIA CANTWELL, Washington
JIM DeMINT, South Carolina           FRANK R. LAUTENBERG, New Jersey
DAVID VITTER, Louisiana              E. BENJAMIN NELSON, Nebraska
                                     MARK PRYOR, Arkansas
             Lisa J. Sutherland, Republican Staff Director
        Christine Drager Kurth, Republican Deputy Staff Director
             Kenneth R. Nahigian, Republican Chief Counsel
   Margaret L. Cummisky, Democratic Staff Director and Chief Counsel
   Samuel E. Whitehorn, Democratic Deputy Staff Director and General 
                                Counsel
             Lila Harper Helms, Democratic Policy Director
                                 ------                                

        SUBCOMMITTEE ON TRADE, TOURISM, AND ECONOMIC DEVELOPMENT

                   GORDON H. SMITH, Oregon, Chairman
TED STEVENS, Alaska                  BYRON L. DORGAN, North Dakota, 
JOHN McCAIN, Arizona                     Ranking
CONRAD BURNS, Montana                DANIEL K. INOUYE, Hawaii
JOHN ENSIGN, Nevada                  JOHN D. ROCKEFELLER IV, West 
GEORGE ALLEN, Virginia                   Virginia
JOHN E. SUNUNU, New Hampshire        JOHN F. KERRY, Massachusetts
JIM DeMINT, South Carolina           MARIA CANTWELL, Washington
DAVID VITTER, Louisiana              FRANK R. LAUTENBERG, New Jersey
                                     BILL NELSON, Florida
                                     E. BENJAMIN NELSON, Nebraska
                                     MARK PRYOR, Arkansas

                            C O N T E N T S

                              ----------                              
                                                                   Page
Hearing held on September 20, 2006...............................     1
Statement of Senator Burns.......................................     1
Statement of Senator McCain......................................    28
Statement of Senator Pryor.......................................    15
Statement of Senator Smith.......................................    36
Statement of Senator Stevens.....................................     1
    Glossary of Internet Governance Terms and Organizations......    37

                               Witnesses

Jones, Christine N., General Counsel/Corporate Secretary, The Go 
  Daddy Group, Inc...............................................    28
    Prepared statement...........................................    31
Kneuer, John M.R., Acting Assistant Secretary for Communications 
  and Information, National Telecommunications and Information 
  Administration, Department of Commerce.........................     2
    Prepared statement...........................................     3
Leibowitz, Hon. Jon, Commissioner, Federal Trade Commission......     6
    Prepared statement...........................................     7
Silva, Ken, Chief Security Officer, VeriSign.....................    23
    Prepared statement...........................................    25
Twomey, Dr. Paul, President/CEO, Internet Corporation for 
  Assigned Names and Numbers (ICANN).............................    18
    Prepared statement...........................................    21

                                Appendix

Smith, Hon. Gordon H., U.S. Senator from Oregon, prepared 
  statement......................................................    47
Response to written questions submitted by Hon. Daniel K. Inouye 
  to:
    Christine N. Jones...........................................    52
    John M.R. Kneuer.............................................    47
    Hon. Jon Leibowitz...........................................    53
    Ken Silva....................................................    54
    Dr. Paul Twomey..............................................    67

 
                         INTERNET GOVERNANCE: 
                          THE FUTURE OF ICANN

                              ----------                              

                     WEDNESDAY, SEPTEMBER 20, 2006

                               U.S. Senate,
      Subcommittee on Trade, Tourism, and Economic 
                                       Development,
        Committee on Commerce, Science, and Transportation,
                                                    Washington, DC.
    The Subcommittee met, pursuant to notice, at 10:05 a.m. in 
room SR-253, Russell Senate Office Building, Hon. Ted Stevens, 
Chairman of the Committee, presiding.

            OPENING STATEMENT OF HON. TED STEVENS, 
                    U.S. SENATOR FROM ALASKA

    The Chairman. Let me start this hearing.
    Senator Smith has been delayed. He will be along. I do 
thank him for scheduling this hearing on ICANN, and we want to 
thank the witnesses for coming to participate.
    We're proud that the Internet was developed with research 
funding from the Department of Defense Advanced Research 
Project Agency to establish a military network. Today, the 
Internet continues to evolve and flourish, mostly through 
private investment. One critical part of the Internet is the 
management of domain names, and ICANN is the nonprofit 
corporation responsible for coordinating the management of the 
technical elements of the domain-name system of the Internet. 
It also oversees the distribution of identifiers used in 
Internet operations.
    When ICANN was created, it was expected to transition into 
a freestanding, financially sound organization by the year 
2000. The Department of Commerce extended this Memorandum of 
Understanding with ICANN several times, and the current MOU is 
set to expire within 1 month. ICANN's current system for 
managing the domain-name system is working, but the feeling is 
that more needs to be done to improve the process and 
transparency. And we're going to look forward to the statement 
of witnesses here today.
    Senator Burns, do you have any comments?

                STATEMENT OF HON. CONRAD BURNS, 
                   U.S. SENATOR FROM MONTANA

    Senator Burns. Well, no, Mr. Chairman, but I would say that 
there's quite a lot of interest in this, and to make sure that 
this moves forward, especially this issue between the two 
entities of ICANN and VeriSign, and make sure that they've got 
the resources for an ever-increasing load that they have to 
handle. I look forward to getting an update. That's the reason 
I'm here today; I want an update on where we are on this 
process, because it's a very tender and--it's a very important 
issue, as far as the operation of the Internet is concerned.
    So, thank you for this hearing, and we might get going to 
the witnesses.
    The Chairman. Yes, we'll reserve the space at the beginning 
of the hearing for Senator Smith's statement that he may wish 
to put in the record.
    Our first witnesses are John Kneuer, the Assistant 
Secretary for Communications and Information of the Department 
of Commerce, and Jon Leibowitz, Commissioner of the Federal 
Trade Commission.
    I assume that it's all right if you start, Mr. Kneuer.

        STATEMENT OF JOHN M.R. KNEUER, ACTING ASSISTANT

         SECRETARY FOR COMMUNICATIONS AND INFORMATION,

          NATIONAL TELECOMMUNICATIONS AND INFORMATION

             ADMINISTRATION, DEPARTMENT OF COMMERCE

    Mr. Kneuer. Thank you. Thank you, Chairman Stevens, Senator 
Burns, for this opportunity to testify before you on the 
progress of ICANN in meeting its obligations under its MOU with 
the Department of Commerce.
    The Department continues to believe that the stability and 
security of the Internet domain name and addressing system can 
best be achieved by transitioning the coordination of the 
technical functions related to the management of DNS to the 
private sector. The vehicle for achieving this goal is the MOU 
between the Department and ICANN.
    The Chairman. Can you pull that mike a little bit toward 
you, please? Thank you.
    Mr. Kneuer. As the Committee will recall, ICANN was formed 
in 1998 in response to the Department of Commerce's call for a 
partner to lead the transition to the private-sector management 
of the DNS. The Department plays no role in the internal 
governance or day-to-day operations of ICANN; however, under 
the terms of the MOU, we offer expertise and advice on the 
transition, and monitor ICANN's performance of the MOU tasks.
    The current MOU was deliberately crafted to permit the 
Department and ICANN to measure progress toward concrete goals 
and objectives. When this current MOU was entered into, in 
September 2003, ICANN had just completed an internal review and 
reform effort. As well, ICANN was in the process of 
implementing the structural and organizational changes that 
would be necessary to complete that process. In the course of 
the past 3 years, ICANN has successfully met many of the MOU's 
date-specific milestones.
    The current MOU expires on September 30, 2006. Over the 
course of the past year, the Department has conducted an 
internal review of its relationship with ICANN. To complement 
the Department's internal review, NTIA initiated a public 
consultation process to obtain views of all interested 
stakeholders in ICANN. We received and analyzed over 700 
written responses from individuals, private corporations, trade 
associations, nongovernmental entities, and foreign 
governments. The public consultation revealed broad support for 
continuing the transition of the DNS to the private sector 
through a continued partnership between the Department and 
ICANN. A majority of interested stakeholders continue to 
endorse the original principles put forth in the DNS 
transition: stability and security, competition, bottom-up 
policy coordination, and broad representation. Equally 
important, the consultation process revealed strong support for 
more specific focus on transparency and accountability, and the 
continued involvement of the Department of Commerce in this 
transition.
    As we approach the end of the term of this MOU, we are 
working with ICANN to negotiate the next phase of our continued 
partnership.
    I would also like to focus briefly on the WHOIS database. 
The U.S. Government continues to believe that ICANN should 
enforce the existing contractual obligations of domain name 
registrars and registries in the collection and maintenance of 
accurate registrant contact data. The Department and other U.S. 
agencies strongly support continued timely access to accurate 
and publicly available WHOIS data. We believe WHOIS data is 
critical to meeting a variety of public policy objectives, 
including those of law enforcement and intellectual property 
concerns.
    In conclusion, the Department continues to be supportive of 
the private-sector leadership in the coordination of the DNS. 
The Department continues to support the work of ICANN as the 
coordinator of these technical functions. Both ICANN and the 
Department agree that preserving the security and stability of 
the Internet DNS is a critical priority that will guide the 
next stage in the transition process.
    Thank you, and I'll be happy to answer any questions.
    [The prepared statement of Mr. Kneuer follows:]

Prepared Statement of John M.R. Kneuer, Acting Assistant Secretary for 
    Communications and Information, National Telecommunications and 
           Information Administration, Department of Commerce
    Mr. Chairman,
    Thank you and the members of the Committee for this opportunity to 
testify on the progress of the Internet Corporation for Assigned Names 
and Numbers (ICANN) under the Memorandum of Understanding (MOU) between 
ICANN and the Department.
    The Administration recognizes the critical importance of the 
Internet to the economic and social well-being of the United States and 
the global community, and is committed to its future growth. The 
Department has been charged with preserving the stability and security 
of the Internet's underlying infrastructure--the domain name and 
addressing system. I am pleased to have this opportunity to share the 
results of our efforts to date, as well as our perspective for the 
future.
The Department's Relationship With ICANN
    The Department continues to believe that the stability and security 
of the Internet domain name and addressing system (DNS) can best be 
achieved by transitioning the coordination of the technical functions 
related to the management of the DNS to the private sector. The vehicle 
for achieving this goal is the MOU between the Department and ICANN. As 
the Committee will recall, ICANN was formed in 1998 in response to the 
Department of Commerce's call for a partner to lead the transition to 
private sector management of the DNS.
    In September 2003, the Department and ICANN agreed to renew the MOU 
for a period of 3 years, with several date-specific milestones and 
broad tasks aimed at guiding ICANN to a stable, independent, and 
sustainable organization. The expectation of the Department was that 
the three-year timeframe would allow ICANN sufficient opportunity to 
formalize appropriate relationships with the organizations that form 
the technical underpinnings of the Internet, secure the necessary 
resources to ensure its long-term independence, improve its mechanisms 
for broad participation by all Internet stakeholders, and continue to 
improve its decisionmaking processes. The Department plays no role in 
the internal governance or day-to-day operations of the organization. 
However, under the terms of the MOU, the Department monitors and 
ensures that ICANN performs the MOU tasks, and offers expertise and 
advice on certain discrete issues.
    As you may recall, this relationship was the focus of much debate 
at last year's United Nations World Summit on the Information Society. 
To provide clarity to this debate, the Administration issued the U.S. 
Principles on the Internet's Domain Name and Addressing System. In this 
set of principles, the Administration reiterated its commitment to 
preserving the security and stability of the Internet domain name and 
addressing system; recognized that governments have legitimate public 
policy and sovereignty concerns with respect to the management of their 
country code top level domains; reaffirmed its support for ICANN; and 
encouraged continued dialogue on Internet governance issues. After much 
discussion and debate, and with your help and support, the 
international community arrived at a consensus on the importance of 
maintaining the stability and security of the Internet, the 
effectiveness of existing Internet governance arrangements, and the 
importance of the private sector in day-to-day operations of the 
Internet.
Measuring Progress
    The current MOU was deliberately crafted to permit the Department 
and ICANN to measure progress toward discrete goals and objectives. 
When this MOU was entered into in September 2003, ICANN had just 
completed an internal review and reform effort, and was well into the 
process of implementing the structural and organizational changes 
called for through that process. In the course of the past 3 years, 
ICANN has successfully met many of the MOU's date-specific milestones, 
which included the following:

   developing a strategic plan addressing administrative, 
        financial and operational objectives;

   developing a contingency plan to ensure continuity of 
        operations in the event ICANN incurs a severe disruption of 
        such operations, by reason of bankruptcy, corporate 
        dissolution, natural disaster or other financial, physical or 
        operational event;

   conducting a review of corporate administrative and 
        personnel requirements and corporate responsibility mechanisms;

   developing a financial strategy to secure more predictable 
        and sustainable sources of revenue;

   improving its processes and procedures for the timely 
        development and adoption of policies related to the technical 
        management of the DNS;

   implementing reconsideration and review processes, including 
        an Ombudsman and commercial arbitration clauses in ICANN 
        contracts;

   developing a strategy for the introduction of new generic 
        top level domains, including internationalized domain names;

   enhancing broader participation in ICANN processes by the 
        global community through improved outreach, regional liaisons, 
        and multilingual communications;

   publishing annual reports on community experiences with the 
        WHOIS Data Problem Reports System, used to report inaccuracies 
        in the submission of WHOIS data by domain name registrants; and

   publishing annual reports on the implementation of the WHOIS 
        Data Reminder Policy, which domain name registrars are required 
        to send to domain name registrants.

    ICANN has also made steady progress toward the MOU's broader tasks, 
including: entering into an agreement with the Regional Internet 
Registries to facilitate the development of global addressing policy, 
and developing and implementing new accountability framework agreements 
with many country code top level domain operators.
WHOIS Policy Development
    I would like to focus briefly on the WHOIS database issue. First, 
the U.S. Government believes that ICANN should enforce the existing 
contractual obligations of domain name registrars and registries for 
the collection and maintenance of accurate registrant contact data. The 
Department and other U.S. agencies \1\ strongly support continued, 
timely access to accurate and publicly available WHOIS data contained 
in the databases of information identifying registrants of domain 
names. We believe WHOIS data is critical to meeting a variety of public 
policy objectives and have been proactively advocating this position at 
ICANN meetings. At the most recent meeting in June 2006, the United 
States formally tabled a statement clarifying our perspective that a 
public WHOIS database is essential to:
---------------------------------------------------------------------------
    \1\ NTIA chairs an interagency ICANN Working Group composed of 
representatives from the Department of Commerce, the Justice 
Department, the Federal Trade Commission, the State Department, the 
Patent and Trademark Office, the Federal Bureau of Investigation, the 
Internal Revenue Service, and the Department of Homeland Security that 
develops and coordinates U.S. positions on issues pending before the 
ICANN Governmental Advisory Committee.

   assist civil and criminal law enforcement in resolving cases 
        that involve the use of the Internet, combat intellectual 
---------------------------------------------------------------------------
        property infringement and theft;

   support Internet network operators responsible for the 
        operation, security and stability of the Internet;

   protect the rights of consumers by facilitating, for 
        example, their identification of legitimate online businesses; 
        and

   assist business in investigating fraud, phishing, and other 
        violations of laws.

    We are continuing to advance our perspective within ICANN, 
including working with other governments to develop more formal public 
policy advice on the purpose and use of WHOIS data.
Future Relationship
    The current MOU expires on September 30, 2006. Over the course of 
the past year, the Department has conducted an internal review of its 
relationship with ICANN. To complement the Department's internal review 
of ICANN's progress under the MOU, the National Telecommunications and 
Information Administration (NTIA) initiated a public consultation 
process to obtain the views of all interested stakeholders. In May 
2006, NTIA issued a Notice of Inquiry on the Continued Transition of 
the Technical Coordination and Management of the Internet Domain Name 
and Addressing System to solicit views on such issues as:

   ICANN's progress in completing the core tasks and milestones 
        contained in the current MOU, and whether these activities are 
        sufficient for transition to private sector DNS management by 
        the scheduled expiration date of the MOU, of September 30, 
        2006;

   Whether the principles underlying ICANN's core mission 
        (i.e., stability, competition, representation, bottom-up 
        coordination and transparency) remain relevant and whether 
        additional principles should be considered;

   Determining whether the tasks and milestones contained in 
        the current MOU remain relevant, and/or whether new tasks would 
        be necessary;

   Assessing whether all key stakeholders are effectively 
        represented and involved in ICANN's activities, and if not, how 
        that could be accomplished; and

   Whether new methods or processes should be considered to 
        encourage greater efficiency and responsiveness.

    NTIA received and analyzed over 700 responses from individuals, 
private corporations, trade associations, nongovernmental entities, and 
foreign governments. NTIA invited a representative sample of these 
interested stakeholders to participate in a public meeting on July 26, 
2006. Representatives from the Regional Internet Registries, the root 
server operators, registrars, registries, country code top level domain 
operators, the Internet Society, the Internet research and development 
community, trademark interests, the user community, the business 
community, and a representative from the Canadian government shared 
their perspectives on the questions NTIA posed to the global Internet 
community. Well over one hundred interested stakeholders participated 
in the public meeting.
    This public consultation process revealed broad support for 
continuing the transition of the coordination of the technical 
functions related to the management of the DNS to the private sector 
through the continued partnership between the Department and ICANN. A 
majority of interested stakeholders continue to endorse the original 
principles put forward to guide the DNS transition--stability and 
security; competition; bottom-up policy coordination; and broad 
representation. Equally important, the consultation process revealed 
strong support for a more specific focus on transparency and 
accountability in ICANN's internal procedures and decision-making 
processes, and the continued involvement of the Department of Commerce 
in this transition.
    As we approach the end of this term of the MOU, we are working with 
ICANN to negotiate the next phase of our continued partnership.
Conclusion
    In conclusion, the Department continues to be supportive of private 
sector leadership in the coordination of the technical functions 
related to the management of the DNS as envisioned in the ICANN model. 
Furthermore, the Department continues to support the work of ICANN as 
the coordinator for the technical functions related to the management 
of the Internet DNS. Both ICANN and the Department agree that 
preserving the security and stability of the Internet DNS is a critical 
priority that will guide/govern the next stage in the transition 
process.
    Thank you and I would be happy to answer any questions that you may 
have.

    The Chairman. Thank you.
    Mr. Leibowitz?

 STATEMENT OF HON. JON LEIBOWITZ, COMMISSIONER, FEDERAL TRADE 
                           COMMISSION

    Mr. Leibowitz. Thank you, Mr. Chairman, Senator Burns. I'm 
pleased to be here in this beautiful, newly renovated hearing 
room on behalf of the Federal Trade Commission.
    I ask that the Commission's written statement be made part 
of the record. My oral testimony reflects my own views, and not 
necessarily the views of any other Commissioner.
    This morning I want to focus my remarks on the importance 
of continued, unrestricted access to WHOIS information. Simply 
put, our ability to protect consumers is being placed at risk 
by a movement within ICANN to limit WHOIS to technical purposes 
only and, thus, prevent law enforcement and the public from 
using this critical resource to identify scammers who operate 
websites.
    Those who want to restrict access to WHOIS databases are no 
doubt sincere in their efforts to protect privacy. I've met 
with them and I know they are. But the irony of their position 
is that any attempt to cabin WHOIS information so narrowly 
could actually jeopardize the ability of the FTC and other law 
enforcement authorities to protect people's privacy by 
stopping, for example, spam, spyware, and identity theft. 
That's an outcome nobody wants.
    Because this is such an important issue, in June the 
Commission sent a delegation to the ICANN meeting in Morocco, 
where we joined with several of our foreign consumer protection 
counterparts to emphasize to ICANN the importance of access to 
WHOIS. We understand that in the wake of that meeting the ICANN 
advisory body is reevaluating its earlier decision.
    Mr. Chairman, we certainly hope so, because the future of 
ICANN is really on the line here. It has to show the leadership 
necessary to properly govern the Internet.
    Having said that, I've met with the ICANN Board, they do 
understand the seriousness of the WHOIS issue, and my strong 
sense is that they're committed to doing the right thing.
    From our perspective at the Commission, access to WHOIS 
databases raises four important considerations: first, law 
enforcement's ability to obtain information about malefactors 
who use Internet websites; second, consumers' ability to know 
who they're dealing with when they engage in e-commerce; third, 
businesses' ability to serve important functions; and, fourth, 
very important individual privacy interests.
    First, law enforcement. The FTC frequently challenges a 
wide variety of Internet-related threats, for example, spam, 
spyware, phishing, deceptive health claims, and get-rich-quick 
schemes. Whether acting to stop fraud or otherwise protecting 
consumers, our investigators need to identify offenders who 
hide behind the electronic shield of the Internet.
    For the past decade, we've used WHOIS databases in 
virtually all of our Internet investigations. In fact, WHOIS is 
often one of the first tools we use to identify wrongdoers.
    Sometimes, we can unmask the bad guys and learn their 
whereabouts from WHOIS databases. And even when scammers 
provide false information--and, sadly, all too often WHOIS 
information is inaccurate--WHOIS data may still provide 
invaluable leads. Con artists sometimes provide the same phony 
information for multiple websites, so WHOIS sometimes enables 
us to link seemingly unrelated scams.
    Second, consumers themselves need to know who they're doing 
business with. This is especially true in an online 
environment. Continued public access to WHOIS data provides 
consumers with essential contact information if an online 
seller fails to deliver goods or services as promised. Consumer 
self-help is vital to ensuring consumer confidence in our 
market economy--and, often, to resolve disputes before they 
reach law enforcement.
    Third, business access to WHOIS data also serves an 
important public policy purpose. Last week, I was on the West 
Coast, meeting with some of our leading Internet companies. 
These companies frequently rely on WHOIS databases to take 
real-time action against phishers and identity thieves who are 
using their brands to target their customers. Impeding 
businesses ability to quickly take down scams will only further 
the risk of serious consumer harm.
    Of course, the FTC is concerned about legitimate privacy 
interests. We have always recognized at the Commission that 
individual noncommercial registrants may require protection 
from public access to their contact information without 
compromising appropriate access by law enforcement. Think, for 
example, of the dissident who needs anonymity. But from our 
perspective, anyone selling a product or engaged in commercial 
activity should have to publicly reveal who they are. It's just 
that simple.
    Mr. Chairman, we do want to thank you for your leadership 
on this issue, also you, Senator Burns. And I think I'm getting 
close to my time limit, so I'm happy to answer any questions, 
with Mr. Kneuer.
    [The prepared statement of Mr. Leibowitz follows:]

        Prepared Statement of Hon. Jon Leibowitz, Commissioner, 
                        Federal Trade Commission
I. Introduction
    Good morning, Mr. Chairman, and members of the Subcommittee, I am 
Jon Leibowitz, a Commissioner of the United States Federal Trade 
Commission (FTC or Commission).\1\ I appreciate the opportunity to 
appear before you today to discuss Internet governance. Specifically, 
my testimony will focus on the importance of continued public and law 
enforcement access to WHOIS databases. Simply put, the FTC is concerned 
that attempts to limit the purpose of WHOIS databases will hinder its 
ability to protect consumers and their privacy.
    As you know, WHOIS databases are information directories containing 
contact information about website operators. The FTC has long 
recognized that WHOIS databases are critical to the agency's consumer 
protection mission, to other law enforcement agencies around the world, 
and to consumers. In fact, 4 years ago, the Commission testified before 
Congress on the importance of improving the accuracy of information in 
WHOIS databases.\2\ Most recently, in July 2006, the Commission 
testified before a subcommittee of the House Committee on Financial 
Services on the importance of preserving public access to WHOIS 
data.\3\
    The Internet Corporation for Assigned Names and Numbers, commonly 
referred to as ICANN, is currently engaged in a policy development 
process that could modify the information that is maintained on public 
WHOIS databases. In April 2006, ICANN's Generic Names Supporting 
Organization (GNSO), the organizational body within ICANN that is 
evaluating the proposed changes to WHOIS databases, voted to limit the 
purpose of WHOIS databases to technical purposes only.\4\
    Because of its concern about preserving access to WHOIS databases, 
the FTC attended the ICANN meeting in Marrakech, Morocco in June to 
highlight the importance of public access to WHOIS databases. On behalf 
of the FTC, I participated in a panel comprised of representatives of 
law enforcement agencies from other countries. I was joined by the 
Chairman of the Independent Post and Telecommunications Authority in 
the Netherlands (OPTA) that enforces anti-spam laws, and a Deputy 
Director of Japan's Telecommunications Consumer Policy Division in the 
Ministry of Internal Affairs and Communications. Together, we 
emphasized the importance of law enforcement access to WHOIS databases 
and encouraged the GNSO to reconsider its decision to adopt the narrow 
purpose definition for WHOIS databases. The Commission understands 
that, in part because of these discussions, the GNSO is re-evaluating 
its decision.
    The FTC is pleased to continue this dialogue today by providing 
this statement on the importance of public WHOIS databases in enforcing 
consumer protection laws and in empowering consumers. First, the 
testimony provides some general background about the FTC. Then, the 
testimony describes how the FTC uses WHOIS databases for its law 
enforcement purposes, discusses the importance of consumer and business 
access to WHOIS data about commercial websites and other legitimate 
uses of WHOIS data, and addresses the privacy concerns that some 
stakeholders have raised about public access to WHOIS databases. The 
statement concludes with some of the FTC's recommendations on how to 
move forward.
II. FTC Enforcement of Consumer Protection Laws
    The FTC is the only Federal agency empowered to enforce both 
competition and consumer protection laws. The principal consumer 
protection statute that the FTC enforces is the FTC Act, which 
prohibits ``unfair or deceptive acts or practices.'' \5\ The FTC Act 
authorizes the FTC to stop businesses from engaging in such practices. 
The FTC also can seek monetary redress and other equitable remedies for 
consumers injured by these illegal practices.
    The FTC has used its authority against ``unfair or deceptive acts 
or practices'' to take action against a wide variety of Internet-
related threats, including Internet auction fraud,\6\ Internet-based 
pyramid schemes,\7\ websites making deceptive health claims,\8\ and 
websites promoting ``get rich quick'' schemes.\9\ More recently, the 
Commission has focused its actions against deceptive claims delivered 
through spam,\10\ ``phishing'' schemes,\11\ and spyware--all violations 
of consumer privacy that WHOIS data help us eliminate.\12\ In many of 
these cases, the FTC has worked cooperatively with its consumer 
protection counterparts across the globe.
    In addition, the FTC has made a high priority of protecting 
consumers' privacy and improving the security of their sensitive 
personal information, both online and offline. The FTC has brought 
several law enforcement actions targeting unfair and deceptive 
practices that involve the failure to protect consumers' personal 
information.\13\ Indeed, as announced earlier this year, the FTC 
created a new Division of Privacy and Identity Protection to address 
specifically the need to protect consumer privacy and the security of 
consumers' personal information.
    The FTC also promotes consumer welfare in the electronic 
marketplace through education, outreach, and advocacy. For example, FTC 
staff provides guidance to businesses advertising and marketing on the 
Internet \14\ and to consumers about what they should look for before 
making purchases and providing information online.\15\
III. How the FTC Uses WHOIS Databases
    FTC investigators and attorneys have used WHOIS databases for the 
past decade in multiple Internet investigations. WHOIS databases often 
are one of the first tools FTC investigators use to identify 
wrongdoers. Indeed, it is difficult to overstate the importance of 
quickly accessible WHOIS data to FTC investigations.
    For example, in the FTC's first spyware case, FTC v. Seismic 
Entertainment, the Commission charged that the defendants exploited a 
known vulnerability in the Internet Explorer browser to download 
spyware to users' computers without their knowledge.\16\ The 
defendants' software hijacked consumers' home pages, delivered an 
incessant stream of pop-up ads, secretly installed additional software 
programs, and caused computers to slow down severely or crash. The 
spyware in this case was installed using so-called ``drive-by'' 
tactics--exploiting vulnerabilities to install software onto users' 
computers without any notice. Using WHOIS data, the FTC found the 
defendants, stopped their illegal conduct, and obtained a judgment for 
millions of dollars in consumer redress.\17\ It is uncertain whether 
the FTC would have been able to locate the defendants without the WHOIS 
data.
    In another matter, the FTC cracked down on companies that illegally 
exposed unwitting consumers to graphic sexual content without 
warning.\18\ The Commission charged seven entities with violating 
Federal laws that require warning labels on e-mail containing sexually-
explicit content. In these cases, accurate WHOIS information helped the 
FTC to identify the operators of websites that were promoted by the 
illegal spam messages.
    Information in WHOIS databases is most useful when it is accurate. 
Indeed, the Commission has advocated that stakeholders work to improve 
the accuracy of such information, because inaccurate data has posed 
significant obstacles in FTC investigations.\19\
    In some instances, though, even inaccurate WHOIS information can be 
useful in tracking down Internet fraud operators. One of the FTC's 
recent spyware cases involved defendants that used free lyric files, 
browser upgrades, and ring tones to trick consumers into downloading 
spyware onto their computers.\20\ Rather than receiving what they opted 
to download, consumers instead received spyware with code that tracked 
their activities on the Internet. In this particular investigation, 
several of the defendants' websites were registered to a non-existent 
company located at a non-existent address. Despite the registrant's use 
of false information, FTC staff was able to link the websites to each 
other because all of the registrations listed the same phony name as 
the administrative contact in the WHOIS databases. Of course, with a 
``narrow purpose'' WHOIS, it is not clear that even such inaccurate 
registration information would be available.
    Having ``real-time'' access to WHOIS data is particularly important 
for a civil law enforcement agency like the FTC. Where a registrar is 
located in a foreign jurisdiction, the FTC often has no other way to 
obtain the information it needs. The FTC cannot, in most cases, readily 
require a foreign entity to provide us with information. Thus, 
particularly in cross-border cases, WHOIS databases are often the 
primary source of information available to the FTC about fraudulent 
domain name registrants.\21\
    In short, if ICANN were to restrict the use of WHOIS data to 
technical purposes only, it would greatly impair the FTC's ability to 
identify Internet malefactors quickly--and ultimately stop perpetrators 
of fraud, spam, and spyware from infecting consumers' computers.
IV. How Consumers Use WHOIS Databases
    Consumers also benefit from access to WHOIS data for commercial 
websites. Where a website does not contain contact information, 
consumers can go to the WHOIS databases and find out who is operating 
the website. This helps consumers resolve problems with online 
merchants directly, without the intervention of law enforcement 
authorities. Indeed, it is crucial that consumers continue to have the 
ability to settle disputes prior to--or instead of--law enforcement 
involvement.
    Consumers do in fact regularly rely on WHOIS databases to identify 
the entities behind websites. FTC staff recently searched the FTC's 
database of consumer complaints, and found a significant number of 
references to the term ``WHOIS.'' These results indicate that when 
consumers encounter problems online, the WHOIS databases are a valuable 
initial tool they use to identify the people with whom they are 
dealing. Consumer access to WHOIS also helps the FTC because it allows 
consumers to gather valuable contact information that they can pass on 
to the Commission--information that might no longer be available by the 
time the agency initiates an investigation because the website 
operators have moved on to different sites or different scams.
    The Organization for Economic Cooperation and Development (OECD) 
has recognized that consumer access to WHOIS data about commercial 
websites serves an important public policy interest. In 2003, the OECD 
Committee on Consumer Policy issued a paper unequivocally stating that 
``[f]or commercial registrants, all contact data should be accurate and 
publicly available via WHOIS.'' \22\ In support of this conclusion, the 
paper states:

        Easy identification of online businesses is a key element for 
        building consumer trust in the electronic marketplace. Because 
        a website has no obvious physical presence, consumers are 
        deprived of many of the usual identifying characteristics that 
        help instill trust in a traditional retailer . . . While the 
        most obvious location for an online business to provide contact 
        details is on the website itself, domain name registration 
        information can serve as a useful compliment [sic].\23\

    This OECD paper represents an international consensus about the 
importance of accurate and accessible WHOIS data for consumers.
V. Other Legitimate Uses of WHOIS Data
    There are other legitimate private users of WHOIS databases--
businesses, financial institutions, nongovernmental organizations, and 
intellectual property rights owners--all of which heavily rely on 
access to accurate WHOIS data. Although the FTC does not represent 
these entities' interests in the WHOIS debate, their use of WHOIS 
databases can help consumers. For example, a financial institution 
concerned about the misuse of its name by ``spoofing'' its website is 
not only protecting its own business interests, but it is also 
protecting its customers from being ``phished.''
    The Red Cross recently explained how it used WHOIS data to shut 
down fraudulent websites that mimicked its website after Hurricane 
Katrina in connection with donation scams.\24\ The simple yet crucial 
point is this: many legitimate uses of WHOIS data by the business 
community and other nongovernmental organizations have an important, 
and often ignored, consumer protection dimension. Their continued 
access to WHOIS information often helps protect consumers from online 
scams and deception.
VI. WHOIS Databases and Privacy
    Concerns about the privacy of domain name registrants have driven 
much of the WHOIS debate. The FTC, a primary enforcement agency for 
U.S. consumer privacy and data security laws, is very concerned about 
protecting consumers' privacy. Thus, the Commission has always 
recognized that registrants engaged in noncommercial activity may 
require some privacy protection from public access to their contact 
information, without compromising appropriate real-time access by law 
enforcement agencies.\25\ The FTC supports the further study of how 
this goal could be achieved. In the meantime, however, at the very 
least, the FTC believes that ICANN should preserve the status quo and 
reject limiting the WHOIS databases to technical uses.
    Restricting public access to WHOIS data for commercial websites 
would deprive the public of the ability to identify and contact the 
operators of online businesses and would contravene well-settled 
international principles. If people want to do business with the 
public, they should not be able to shield their basic contact 
information. The 1999 OECD Guidelines on Electronic Commerce state that 
consumers should have information about commercial websites 
``sufficient to allow, at a minimum, identification of the business . . 
. [and] prompt, easy and effective consumer communication with the 
business.'' \26\ Thus, commercial website operators have no legitimate 
claim for privacy, and the public should continue to have access to 
their WHOIS data.\27\
    Moreover, the existing availability of WHOIS databases can actually 
help enforcement agencies find out who is violating privacy laws and, 
consequently, help prevent the misuse of consumers' personal 
information. For example, WHOIS databases were invaluable in FTC 
investigations in phishing cases where the defendants sought to steal 
sensitive personal and financial information from consumers. In 
addition, the spyware cases discussed earlier also involve serious 
threats to consumer privacy, as spyware can monitor consumers' Internet 
habits and can even retrieve sensitive consumer information, including 
financial information, by logging keystrokes. WHOIS data has helped the 
FTC to stop these privacy violations and, hopefully, will continue to 
do so.
VII. Recommendations
    In light of the FTC's experience in enforcing consumer protection 
laws, the FTC made several recommendations to the ICANN community at 
its meeting in June. This testimony summarizes the recommendations the 
Commission made to the ICANN community and then concludes with a 
recommendation that Congress enact the U.S. SAFE WEB Act, which the 
Senate passed on March 16, 2006.\28\
A. Recommendations to ICANN Community
    The FTC made three recommendations to the ICANN community. First, 
the FTC recommended that the GNSO reconsider and reverse its position 
that the WHOIS databases should be used for technical purposes only. If 
this narrow purpose were to be adopted, the FTC, other law enforcement 
agencies, consumers, and businesses would not be able to use the WHOIS 
databases for their legitimate needs. This would hurt consumers around 
the world and could allow Internet malefactors to violate consumer 
privacy with impunity. The Commission understands that the GNSO is 
currently taking steps to incorporate the input of the FTC and other 
law enforcement agencies into its final recommendation to the ICANN 
Board.
    Second, the FTC encouraged members of ICANN's Governmental Advisory 
Committee (GAC) to continue their outreach with law enforcement 
colleagues in their respective countries to reinforce the serious law 
enforcement and consumer protection implications of losing access to 
WHOIS databases. The Commission is pleased to note that GAC members 
from several countries are undertaking such an effort.
    Third, the FTC recommended that ICANN carefully consider 
improvements in WHOIS databases. For example, as the OECD statements 
referenced above make clear, there is simply no reason to prevent 
access to contact information for a commercial website. The FTC urged 
ICANN to consider additional measures to improve the accuracy and 
completeness of domain name registration information. The FTC is also 
interested in exploring the viability of ``tiered access'' as a 
solution capable of satisfying privacy, consumer, and law enforcement 
interests.\29\ Restricting the purpose of the WHOIS databases does not 
satisfy any of these interests and is a step in the wrong direction. 
Maintaining accessibility and enhancing the WHOIS databases would make 
great strides toward improving the safety and fulfilling the promise of 
the Internet.
B. U.S. SAFE WEB Act
    The FTC has previously recommended that Congress consider enacting 
the U.S. SAFE WEB Act, passed by the Senate on March 16, 2006. The 
Commission continues to recommend enactment of this legislation, which 
would give it additional tools to fight fraud. Even with the current 
access to WHOIS databases, the Commission needs these additional tools. 
If the Commission's access to WHOIS data becomes unavailable, the 
Commission's need for the tools provided by the U.S. SAFE WEB Act 
becomes even more critical.
    The U.S. SAFE WEB Act would make it easier for the FTC to gather 
information about Internet fraud from sources other than WHOIS 
databases. For example, the U.S. SAFE WEB Act would help the FTC obtain 
information and investigative assistance from foreign law enforcement 
agencies. It would also allow the FTC to obtain more information from 
the private sector and from financial institutions about Internet 
fraud. The FTC's ability to obtain information under the U.S. SAFE WEB 
Act is no substitute for real-time, desktop access to WHOIS data. Where 
such data is limited, inaccurate, unavailable, or inapplicable, 
however, having access to a broader range of investigative sources 
about Internet and other cross-border fraud would surely help.
VIII. Conclusion
    In sum, the FTC believes that improvements need to be made to the 
current WHOIS database system and is committed to working with others 
toward a solution. In the meantime, ICANN should ensure that WHOIS 
databases are kept open, transparent, and accessible so that agencies 
like the FTC can continue to protect consumers, and consumers can 
continue to protect themselves. Further, Congress should enact the U.S. 
SAFE WEB Act to provide the FTC with additional tools to fight Internet 
and other fraud. Together, these tools will help ensure that consumers 
are free from deceptive practices that undermine the promise of the 
Internet.
ENDNOTES
    \1\ This written statement reflects the views of the Federal Trade 
Commission. My oral statements and responses to any questions you may 
have represent my own views, and do not necessarily reflect the views 
of the Commission or of any other Commissioner.
    \2\ Prepared Statement of the Federal Trade Commission on ``The 
Integrity and Accuracy of the `WHOIS' Database,'' Before the Subcomm. 
on Courts, the Internet, and Intellectual Property of the Comm. on the 
Judiciary, U.S. House of Representatives, May 22, 2002.
    \3\ Prepared Statement of the Federal Trade Commission on ``Public 
Access to WHOIS Databases,'' Before the Subcomm. on Financial 
Institutions and Consumer Credit of the House Comm. on Financial 
Services, U.S. House of Representatives, July 18, 2006.
    \4\ The GNSO vote is not final. After considering other 
recommendations submitted by the WHOIS Task Force, the GNSO will make 
formal recommendations to the ICANN Board, which has the ultimate 
responsibility for making the final decision on any proposed changes to 
the WHOIS databases.
    \5\ 15 U.S.C. Sec. 45.
    \6\ E.g., FTC v. Silverman, No. 02-8920 (GEL) (S.D.N.Y., filed Aug. 
30, 2004).
    \7\ E.g., FTC v. Skybiz.com, Inc., No. 01-CV-396-AA(M) (N.D. Okla. 
filed Jan. 28, 2003).
    \8\ E.g., FTC v. CSCT, Inc., No. 03C 00880 (N.D. Ill., filed Feb. 
6, 2003).
    \9\ E.g., FTC v. National Vending Consultants, Inc., CV-5-05-0160-
RCJ-PAL (D. Nev., filed Feb. 7, 2006).
    \10\ E.g., FTC v. Cleverlink Trading Ltd., No. 05C 2889 (N.D. Ill., 
filed May 16, 2005) (enforcing the CAN-SPAM Act).
    \11\ E.g., FTC v. _______, a minor, CV No. 03-5275 (C.D. Cal. filed 
2003).
    \12\ E.g., FTC v. Enternet Media, No. CV 05-7777 CAS (C.D. Cal., 
filed Nov. 1, 2005); FTC v. Odysseus Mktg., Inc., No. 05-CV-330 (D.N.H. 
filed Sept. 21, 2005); In the Matter of Advertising.com, FTC Docket No. 
C-4147 (Sept. 12, 2005).
    \13\ E.g., In the Matter of CardSystems Solutions, Inc., FTC Docket 
No. C-4168 (Sept. 5, 2006); In the Matter of DSW, Inc., FTC Docket No. 
C-4157 (Mar. 7, 2006); United States v. ChoicePoint, Inc., No. 106-CV-
0198 (N.D. Ga. filed Feb. 15, 2006); In the Matter of BJ's Wholesale 
Club, Inc., FTC Docket No. C-4148 (Sept. 20, 2005).
    \14\ E.g., ``Advertising and Marketing on the Internet--Rules of 
the Road,'' http://www.ftc.gov/bcp/conline/pubs/buspubs/ruleroad.htm.
    \15\ E.g., ``Consumer Guide to E-Payments,'' ``Holiday Shopping? 
How to be Onguard When You're Online,'' http://www.ftc.gov/bcp/conline/
pubs/alerts/shopalrt.htm, ``How Not To Get Hooked By a Phishing Scam,'' 
http://www.ftc.gov/bcp/conline/pubs/alerts/phishingalrt.htm, and 
OnguardOnline.com (consumer education website providing practical tips 
concerning online fraud and other online threats).
    \16\ FTC v. Seismic Entm't Prods., Inc., No. 04-377-JD, 2004 U.S. 
Dist. LEXIS 22788 (D.N.H. Oct. 21, 2004) (Order of Default Judgment, 
Permanent Injunction and Other Equitable Relief entered Mar. 22, 2006).
    \17\ See News Release, Court Halts Spyware Operations, May 4, 2006, 
http://www.ftc.gov/opa/2006/05/seismic.htm.
    \18\ See News Release, FTC Cracks Down on Illegal ``X-Rated Spam,'' 
July 20, 2005, http://www.ftc.gov/opa/2005/07/alrsweep.htm.
    \19\ See supra notes 2-3. FTC investigators have had to spend many 
additional hours tracking down fraud on the Internet because of 
inaccurate WHOIS data--hours that could have been spent pursuing other 
targets. See also U.S. Government Accountability Office, Report to the 
Subcomm. on Courts, The Internet, and Intellectual Property, House of 
Representatives, ``Internet Management: Prevalence of False Contact 
Information for Registered Domain Names'' (Nov. 2005) (noting that, 
based on a random sample of domain names from the .com, .net, and .org 
domains, 8.65 percent of websites were registered with patently false 
or incomplete data in the required WHOIS contact information fields).
    \20\ FTC v. Enternet Media, No. CV05-7777 CAS (C.D. Cal., filed 
Nov. 1, 2005).
    \21\ The number of cross-border complaints received by the FTC 
continues to rise. In 2005, 20 percent of the complaints in the FTC's 
Consumer Sentinel database had a cross-border component, compared to 16 
percent in 2004, and less than 1 percent in 1995. See www.consumer.gov/
sentinel.
    \22\ OECD, Consumer Policy Considerations on the Importance of 
Accurate and Available WHOIS Data, DSTI/CP(2003)1/REV1 (April 30, 
2003), available at http://www.olis.oecd.org/olis/2003doc.nsf/LinkTo/
dsti-cp(2003)1-final.
    \23\ Id.
    \24\ Red Cross Comment to GNSO WHOIS Task Force Preliminary Report, 
March 14, 2006, http://forum.icann.org/lists/whois-comments/
msg00043.html.
    \25\ See supra notes 2-3.
    \26\ OECD, Guidelines for Consumer Protection in the Context of 
Electronic Commerce (1999), available at http://www.oecd.org/dataoecd/
18/13/34023235.pdf.
    \27\ Consistent with this approach, the European Union's Distance 
Selling Directive requires that European websites selling to consumers 
include the name and address of the website operator. European Distance 
Selling Directive (Directive 97/7/EC), Article 4.
    \28\ Undertaking Spam, Spyware, And Fraud Enforcement With 
Enforcers across Borders (``U.S. SAFE WEB Act''), S. 1608, 109th Cong. 
(2006) (sponsored by Sen. G. Smith, passed by the Senate, Mar. 16, 
2006).
    \29\ Tiered access refers to a system in which different categories 
of stakeholders would get different levels of access to WHOIS 
databases.

    The Chairman. What was the example you used?
    Mr. Leibowitz. Oh, of dissidents. Right. We believe that 
you can make a--at the Commission, you can make a distinction 
between commercial and noncommercial entities. So, if someone's 
selling a product on the Internet, they should have to publicly 
reveal their contact information. All too often, that contact 
information is hidden behind proxy registrations, even for 
commercial entities. And a lot of the time, when someone is a 
scammer or trying to rip off consumers, they deliberately use 
proxy registrations to try to cloak themselves in Internet 
anonymity. It makes it much harder for us to go after these 
malefactors. And that's true for law enforcement agencies in 
the United States and, really, around the world. But we also 
recognize that some people may need some anonymity if they're 
not engaged in a commercial activity. It seems to us that makes 
sense. But this is an issue that needs to be thought through by 
ICANN and by NTIA.
    The Chairman. Thank you very much.
    Mr. Kneuer, I think the $64-billion question is, should 
this agreement be extended? It expires in a month.
    Mr. Kneuer. And I think the short answer is yes, it should 
be extended. We conducted a public consultation over the 
summer. We had more than 700 written comments. We had a public 
forum at the Department of Commerce, where interested 
stakeholders, from governments to private companies to 
registrars and registries, attended. I think that consultation 
reflected broad support for ICANN, that the private-sector 
management of the DNS is clearly the appropriate path forward, 
that ICANN is clearly the appropriate vehicle for that private-
sector management. But I think there was also clear indications 
that--in order for ICANN to be a really lasting and sustainable 
institution, that we need to continue to make more progress on 
issues of accountability and transparency, and the vehicle of 
the MOU to help them through that process is still appropriate.
    The Chairman. How long has the current agreement been in 
place?
    Mr. Kneuer. The current agreement was for 3 years. 
Historically, we have extended these MOUs periodically from 1 
year to 3 years. The 1-year extensions would come up quickly, 
so we made the last one 3 years. I think it would be 
appropriate to consult with ICANN concerning our review of the 
record, to come up with an appropriate time period that clearly 
indicates that we continue to be committed to the transition, 
but, at the same time, provide adequate time for ICANN to make 
some measurable progress on these issues of transparency and 
accountability.
    The Chairman. Have you discussed the length of that MOU, 
the time frame, with your counterparts in other countries?
    Mr. Kneuer. Not in other countries. This is an agreement 
between the Department of Commerce and ICANN.
    The Chairman. But doesn't it have international 
implications?
    Mr. Kneuer. It does have international implications, and I 
speak periodically and fairly regularly with my regulatory 
counterparts in other countries around the world that have 
interest in this. The issue of more governmental involvement in 
ICANN was an issue that was raised at the World Summit on the 
Information Society in Tunisia last year, and the clear answer 
to that was that the continued private-sector model was 
affirmed.
    The Chairman. Well, I've had indications from other 
Senators that when they started to open up and seek a domain 
name, they found that name had already been reserved by someone 
else, but it was for sale to them. Have you looked into that?
    Mr. Kneuer. Not explicitly in that context, but that's 
clearly something that we're happy to work on with you, or your 
staff.
    The Chairman. Mr. Leibowitz, has the FTC gone into that at 
all?
    Mr. Leibowitz. Well, I think, for the most part, this--I 
think it's called ``domain-name tasting'' and ``parking,'' 
where people may sample a domain name without having to pay, or 
may just hold it for a certain amount of time, even if they 
don't use it. They raise some public policy questions for us, 
because, again, a lot of the fraudsters hide behind temporary 
Internet websites. And so it is a concern. We've talked to NTIA 
about it. We've talked to ICANN about it, too. And we know 
that--we know that they're taking this seriously.
    The Chairman. Well, isn't it part of identity theft if 
someone goes and takes my name and registers it as a domain 
name, and then uses that domain name out to--in the world? 
Isn't that identity theft? Why don't you look at that?
    Mr. Leibowitz. Well, we do, and we brought a number of 
cases in this area. I mean, technically, identity theft is when 
they do something bad with your name, like steal your credit 
card information or steal other personal information.
    The Chairman. Well stealing my name is still stealing, 
isn't it?
    Mr. Leibowitz. It's a very legitimate public policy 
concern, and it's something that we have looked at. We've 
brought a bunch of cases against phishers, identity thieves, 
cybersquatters, and other Internet malefactors.
    The Chairman. Thank you.
    Senator Burns?
    Senator Burns. Well, they could have mine.
    [Laughter.]
    Senator Burns. Not very many people have gone through a 
business failure. And I had to go through one, one time. And I 
prayed--something like that.
    But, anyway, how long should we extend this MOU? I mean, 
you're recommending that it be extended. How long should it be 
extended?
    Mr. Kneuer. Well, as I said, we're in discussions with 
ICANN about the appropriate formalization of our relationship, 
going forward, and the period of time. Like I said, we've done 
longer extensions and shorter extensions. I think the important 
thing, at the end of the day, is that we provide enough time 
for ICANN to achieve meaningful progress on these issues of 
accountability and transparency, and, at the same time, we 
don't create, an ``in-perpetuity,'' going forward. I want to be 
cognizant of the fact that this is a transition that we 
undertook, that we intend to complete, but, at the same time, I 
want there to be enough time to be realistic for real change to 
take place.
    Senator Burns. Well, Mr. Kneuer, have they--what milestones 
have they not met to complete this transition?
    Mr. Kneuer. Most of the milestones that ICANN has met were 
with regards to the brick and mortar of putting together an 
institution, having a budget in place, coming up with 
contingency plans, having staffing, making sure that they have 
technical competency and expertise. On the issues of 
accountability and transparency and on having the invested 
support of all of the constituencies that make up ICANN, having 
firm relationships with the root-zone operators, and with the 
regional Internet registries, they've made progress on some of 
these. But the larger thematic of making sure that each of 
those constituencies are confident that ICANN has processes in 
place that are transparent and that there are means for 
accountability, it's those broader thematic developments that I 
think we need to be focused on going forward.
    Senator Burns. OK. I think maybe--that's all the questions 
I have for this panel, Mr. Chairman. We should talk more about 
those milestones and Internet transparency, what's expected by 
the Department, what's expected by us, because we're talking 
about an organization that's very, very important to us.
    So, I thank you for that information.
    Mr. Leibowitz. Mr. Chairman?
    The Chairman. Senator Pryor?
    Pardon me.
    Mr. Leibowitz. I was just going to say, Mr. Chairman, could 
I just come back to a question you asked me? You asked me about 
people who are doing basically bad things to American consumers 
on the Internet. And a lot of those folks are from out of the 
country. And your Committee passed a bill, the U.S. SAFE WEB 
Act, which would allow us to more effectively work with foreign 
law enforcement agencies--really, to protect American consumers 
by sharing information. It has passed your Committee. It passed 
the Senate by unanimous consent, and the House hasn't taken it 
up yet. And anything you can do to help act on this 
noncontroversial bill, which really would help us do the things 
you want us to do, would be really appreciated in the waning 
days of this session and this Congress.
    The Chairman. Thank you for that.
    Senator Pryor?

                 STATEMENT OF HON. MARK PRYOR, 
                   U.S. SENATOR FROM ARKANSAS

    Senator Pryor. Thank you, Mr. Chairman.
    Mr. Leibowitz, let me follow up on that point. It sounds 
like that this Committee and the Senate have acted to try to 
put some tools in your hands that you feel like we need, and it 
sounds like that has a big international dimension to it. Is 
that right?
    Mr. Leibowitz. That's exactly right, Senator.
    Senator Pryor. And I assume one of the real challenges you 
have is the international aspects of the Internet.
    Mr. Leibowitz. Well, of course it is, because at this 
point, right now, we can't share confidential information, by 
law, with our foreign law enforcement sister agencies. It's an 
anomaly in the law and everyone agrees that it should be 
changed. And foreign law-enforcement agencies can't share 
information with us, because it's FOIA-able. So, of course, 
they won't do that. And if we can empower them to help us, I 
think that will be enormously helpful in trying to do the 
things you want us to do and really bringing more cases 
effectively.
    Senator Pryor. Does the Federal Trade Commission have any 
real control over the Internet right now?
    Mr. Leibowitz. No, we do not have control over the 
Internet. We try to bring cases, when we can, against Internet 
malefactors, of course, and we have brought a number of them.
    Senator Pryor. Should it have any control over the 
Internet?
    Mr. Leibowitz. Well, I think we should have the ability to 
effectively prosecute cases. And we can do some of that now, 
but we could be much more effective if this legislation was 
passed. And one of the reasons why we're so concerned about 
this movement within ICANN to limit access to what's now public 
information is that it will make it even more difficult for us 
to find out who the bad guys are. It will be particularly hard 
for us if we have to go to Internet registrars--and there are 
800, I believe, of them, more or less--in foreign countries, 
and they don't have to give us any information, and that 
information isn't available.
    Senator Pryor. Right, OK. And, I'm sorry, you're going to 
have to pronounce your name for me. Is it Kneuer?
    Mr. Kneuer. Kneuer.
    Senator Pryor. Mr. Kneuer, I am very interested in the 
possibility, at least, of setting up a dot-xxx domain. I think 
that--and I may have it wrong, but I think that this would be 
a--an important step to cleaning up the Internet. I have a real 
concern. I have two young children--not that young; sixth and 
seventh grade--and they're just getting, kind of, prime 
Internet-exposure age, and I have a lot of concern about them. 
And I think every parent in America is concerned, or should be 
concerned, about the Internet. And I think the dot-xxx domain 
could be an important step in maybe making the Internet safer 
in a lot--in a lot of different ways for our children and for 
this country, and, really, for the world. But as I understand 
it, NTIA urged ICANN to reject the dot-xxx domain, and I'm 
curious if you know how that happened and why that happened?
    Mr. Kneuer. Thank you, Senator. I absolutely share your 
concern. I've got two small children of my own--too small for 
the Internet, but I constantly worry about what happens when 
they get to be the age of your children, and older.
    ICANN did consider the adoption of a dot-xxx domain name, 
and they ultimately did not adopt that. There was communication 
from NTIA and the Department of Commerce into the ICANN process 
on two fronts with regards to dot-xxx. The first was a 
communication that said, ``As you are examining this, there 
appears to be a great deal of interest from a great deal of 
entities about this, and, as part of your bottom-up 
deliberative process, you should have an opportunity, and 
create an opportunity, for all interested stakeholders to 
express their views.'' So, we wrote a letter asking them to do 
that. Other governments wrote similar letters.
    I wrote a second letter, later, talking about, precisely, 
the potential public policy benefits that would flow from dot-
xxx. If there were to be a dedicated domain, let's make sure 
that there are enforceable steps to make sure that pornography 
is limited to those sorts of sites. And it was simply a factual 
inquiry to say, ``We've heard a list of public policy 
commitments. Are they being made enforceable?''
    As I said, ultimately through the process, dot-xxx was not 
fully adopted, but----
    Senator Pryor. Is that because you just want more time to 
examine the value of dot-xxx?
    Mr. Kneuer. Well, I think it was through--as I said, 
communications we made into the ICANN Government Advisory 
Committee. Other governments made similar inquiries. Large 
numbers of private entities made comments, both in favor of and 
against. I don't believe we ever established a formal position, 
one way or another. Our comments with regards to dot-xxx, which 
are public, were along the lines of process, making sure that 
everybody had an opportunity to weigh in, and then raising 
factual questions about, what would be the potential 
enforcement of these public policy benefits that could accrue 
from dot-xxx?
    Senator Pryor. Will ICANN revisit this in the future?
    Mr. Kneuer. I believe, under ICANN's processes, there are 
periods for reconsideration and review. My understanding is 
they're currently undergoing that with regards to dot-xxx. 
There is a fairly transparent and open application process for 
the establishment of new top-level domains, so I don't believe 
that there is anything that would preclude further 
consideration of whether it is dot-xxx or some other domain 
name.
    Senator Pryor. And that's my last question, that you 
mentioned, transparency and openness and accountability. I 
think both of you have talked about this in your statements and 
in answering questions. What can NTIA do to help improve the 
level of transparency and accountability? What needs to happen 
there?
    Mr. Kneuer. Well, I think that is the function of our MOU. 
The MOU does not create a relationship between the Department 
of Commerce and ICANN that is one of regulator and regulated; 
it is much more of a partnership. This was a U.S. Government 
function that we unilaterally are transferring to the private 
sector. And we have the MOU to help them with that transition 
and to help them develop those processes. So, to the extent 
being dedicated to being a closer observer than perhaps others 
might be, and sharing with them our insights and our views, 
being a sounding board for those sorts of issues, we help them 
work through this transition. So, that would be my expectation 
of what the ongoing relationship would entail, us helping them 
come up with processes that are transparent to the constituent 
membership, and the interested stakeholders so that they 
understand how they can interrelate with ICANN, that all views 
are heard and considered through the bottom-up coordination 
process, and that decisionmaking is accountable.
    Senator Pryor. Thank you, Mr. Chairman.
    The Chairman. Well, thank you very much.
    Pardon me for mispronouncing your name, Mr. Kneuer. I don't 
know whether you want to be ``Knowwer'' or ``Knewer,'' but 
sorry.
    [Laughter.]
    The Chairman. We do appreciate your help and consideration. 
I thank you for your plug for the bill we've passed in the 
Senate, and we still are trying to wait and see whether the 
House will pass that. It passed over here unanimously, so it 
should not be causing any problems over there. We do thank you 
for your help.
    Mr. Kneuer. Thank you, Mr. Chairman.
    The Chairman. Do you have any further questions, Senator?
    Senator Burns. I do not.
    The Chairman. So, we'll turn to panel 2, then. Gentlemen, 
thank you very much.
    Our next panel is Dr. Paul Twomey, President and CEO of 
Internet Corporation for Assigned Names and Numbers; Mr. Ken 
Silva, Chief Security Officer for VeriSign; and Ms. Christine 
Jones, General Counsel and Corporate Secretary for The Go Daddy 
Group.
    We thank you very much for being willing to testify here 
today to help us further understand the situation with regard 
to ICANN.
    Dr. Twomey, would you like to commence, please?

          STATEMENT OF DR. PAUL TWOMEY, PRESIDENT/CEO,

          INTERNET CORPORATION FOR ASSIGNED NAMES AND 
                        NUMBERS (ICANN)

    Dr. Twomey. Good morning----
    The Chairman. Pull the mike toward you, please.
    Dr. Twomey. All right. Thank you.
    The Chairman. Thanks.
    Dr. Twomey. Good morning, Mr. Chairman, and members of the 
Committee. May I say how pleased I am to be--appear again in 
front of your Committee. Thank you for the opportunity to speak 
before the Subcommittee in my role as President and Chief 
Executive of the Internet Corporation for Assigned Names and 
Numbers.
    ICANN is a private-sector organization performing a global 
function, with our main office in Marina del Rey, California. 
ICANN has been recognized by the world community as the global 
authoritative body on the technical and organization means to 
ensure the stability, interoperability of the DNS and the 
distribution of Internet protocol addresses and other unique 
identifiers.
    Since appearing before the Senate Committee on Commerce, 
Science, and Transportation nearly 2 years ago----
    The Chairman. I hate to tell you, but people in the back of 
the room are not hearing you.
    Dr. Twomey. OK, sorry.
    The Chairman. Can you pull the mike toward you, sir?
    Dr. Twomey. There we go. Thank you sir.
    The Chairman. Thank you.
    Since appearing before the Subcommittee nearly 2 years ago, 
ICANN has continued to take great steps forward in solidifying 
its role as the international private-sector entity tasked to 
provide technical coordination of the domain-name system. Since 
its origins in 1998, ICANN has helped secure a stable and 
secure Internet that creates a presumption of universal 
resolvability. ICANN has fostered greater choice, lower costs, 
and better services to DNS registrants, including over 10 
million businesses in the United States alone.
    The Internet requires a stable and secure system of unique 
identifiers if it is to serve the global community efficiently 
and reliably.
    At the core of ICANN's mission is global interoperability 
of a single Internet. ICANN was established to serve the 
Internet community by maintaining the stability and security of 
the Internet's unique identifier system and fostering 
competition, where appropriate, to give Internet users greater 
choice at optimal cost.
    ICANN's successful coordination of its community underpins 
the operation of the global Internet. Each day, the system 
supports an estimated 30 billion resolutions, nearly ten times 
the number of phone calls in North America each day. There are 
currently more than 1 billion users of the Internet. Due to the 
universal DNS resolvability, secured and coordinated by ICANN, 
the Internet addresses resolve in the same way for every one of 
the Internet's global users once online.
    ICANN is entering into six new agreements with gTLD 
registry operators in the last 2 years, including .net, 
.travel, .cat, .jobs, .mobi, and .tel. All the pending 
agreements have set out language with a greater accountability 
to ICANN on security and stability concerns, and also provide 
greater opportunities for ICANN to act in the event of actions 
of registries or such other issues that might arise from 
registry operator actions or practices.
    One particular agreement, the dot-com agreement, is part of 
a larger overall settlement of a longstanding dispute with 
VeriSign over its desire to introduce new registry services. 
That dispute arose with the creation of ICANN and has been 
resolved in a way that would enhance the performance of both 
entities to the benefit of all the users of the Internet.
    ICANN has been engaged in a longstanding and important 
relationship with the U.S. Government and--since ICANN's 
inception. And I note the previous panel's discussion of the 
MOU.
    ICANN continues in its relationship with the U.S. 
Government and has recently entered into a new 5-year 
arrangement for ICANN to manage the Internet, assign names, and 
a numbers authority, IANA function--sorry--the Internet 
Assigned Numbers Authority. Additionally, ICANN and the NTIA 
are in the final stages of discussions which will confirm an 
appropriate continuing relationship toward the transition of 
the coordination of the technical functions related to the 
management of the DNS to the private sector. And this, we 
think, will recognize ICANN's global private-sector role, 
providing technical management of the DNS in a manner that 
provides stability and security, competition, coordination, and 
representation.
    One of the greatest achievements of ICANN has been the 
successful creation, support, and coordination of an ICANN 
community in creation of bottom-up policymaking processes 
supported by various stakeholders involved in the DNS. The 
evolution of this process continues in many ways, but may I 
point to two important recent actions:
    This week, the ICANN Board, having reviewed the comments 
about ICANN and its processes, and particularly issues around 
transparency and accountability that the Committee has already 
mentioned, generated from the Committee during the past year, 
has commenced review of its own guiding principles and is 
publishing, soon, a set of private-sector management operating 
principles which will be offered for public review.
    And last week, the London School of Economics provided 
ICANN--an ICANN-commissioned independent third-party review of 
one of ICANN's key policy development supporting organizations, 
the Generic Name Supporting Organization. The information 
contained in this review will likely result in consideration of 
additional improvements to ICANN's GNSO and supporting 
organization structure. Such ongoing evolution and review is an 
important part of our policy process.
    May I just make some quick notes, then, on the issue of 
WHOIS, to state that ICANN is dedicating resources in this 
operational budget to better enforcement of the existing policy 
we have for WHOIS. There is a process presently underway among 
some of the constituencies of the ICANN process to discuss the 
WHOIS topics, as has been pointed out by previous speakers, but 
there is a long way to go before there would be any change; 
and, if there was any discussion coming from many of the other 
constituencies, there may be no change at all. I'd like to 
point out that all of the people who we're representing here 
today have all had the opportunity, and will continue to have 
the opportunity, to input into that discussion, but, at the 
moment, there is no change to ICANN's WHOIS policy.
    Since 1998, our self-governance model has succeeded in 
addressing stakeholder issues as they appeared and bringing 
lower costs and better services to DNS registrants. One point 
I'd like to particularly point out, partly coming to the 
question from you, Chairman, is that ICANN's uniform domain 
name--Universal Domain-Name Dispute-Resolution Policy has been 
successful and of great value to individuals, businesses, and 
intellectual property holders. The policy enables them to 
assert--in allow them to assert their rights on domain names 
and to bring an online arbitration system for dealing with just 
the sorts of disputes that you pointed out between people who 
should own a particular domain name. The UDRP has resolved more 
than 17,000 disputes over the rights to domain names and has 
proven to be an efficient and cost-effective way of alternate 
dispute resolution.
    If I could just finish my testimony by pointing out that in 
the introduction of new gTLD registries and introduction of 
greater competition amongst registrars, domain-name costs to 
registrants in the lifetime of ICANN have declined by as much 
as 80 to 90 percent, with savings both for consumers as--
consumers and businesses. ICANN looks forward to working 
closely with people giving evidence here, the Committee, and 
others, as we go forward to completing our transition to 
private-sector coordination.
    Thank you.
    [The prepared statement of Dr. Twomey follows:]

    Prepared Statement of Dr. Paul Twomey, President/CEO, Internet 
           Corporation for Assigned Names and Numbers (ICANN)
Introduction
    Good morning, Chairman Smith, and members of the Committee. Thank 
you for the opportunity to speak before this Subcommittee in my role as 
President and CEO of the Internet Corporation for Assigned Names and 
Numbers (ICANN). ICANN is a private sector organization performing a 
global function, with our main office in Marina del Rey, California. 
ICANN has been recognized by the world community as the global 
authoritative body on the technical and organizational means to ensure 
the stability and interoperability of the DNS, and the distribution of 
IP addresses.
ICANN's Role in Internet Governance
    Since appearing before the Senate Committee on Commerce, Science, 
and Transportation nearly 2 years ago, ICANN has continued to take 
great steps forward in solidifying its role as the international 
private sector entity tasked to provide technical coordination of the 
domain name system (DNS).
    The limited and distinct mission of the Internet Corporation for 
Assigned Names and Numbers is clearly set out in Article I of ICANN's 
Bylaws. ICANN:

        1. Coordinates the allocation and assignment of the three sets 
        of unique identifiers for the Internet, which are:

           a. Domain names (forming a system referred to as ``DNS'');

           b. Internet protocol (IP) addresses and autonomous system 
        (AS) numbers; and

           c. Protocol port and parameter numbers.

        2. Coordinates the operation and evolution of the DNS root name 
        server system.

        3. Coordinates policy development reasonably and appropriately 
        as they relate to these technical functions.

    Since its origins in 1998, ICANN has helped secure a stable and 
secure Internet that creates a presumption of universal resolvability. 
ICANN has fostered greater choice, lower costs and better services to 
DNS registrants, including over ten million businesses in the United 
States alone. The Internet requires a stable and secure system of 
unique identifiers if it is to serve the global community efficiently 
and reliably.
    At the core of ICANN's mission is global interoperability of a 
single Internet. ICANN was established to serve the Internet community 
by maintaining the stability and security of the Internet's unique 
identifier systems, and fostering competition where appropriate to give 
Internet users greater choice at optimal cost.
    ICANN's successful coordination of its community underpins the 
operation of the global Internet. Each day this system supports an 
estimated 30 billion resolutions, nearly 10 times the number of phone 
calls in North America per day. There are currently more than one 
billion users of the Internet. Due to the universal DNS resolvability 
secured and coordinated by ICANN, the Internet addresses resolve in the 
same way for every one of the Internet's global users once online.
    ICANN has entered into six new agreements with gTLD registry 
operators (including .NET, .TRAVEL, .CAT, .JOBS, .MOBI, and .TEL) in 
the last 2 years (and has finalized negotiations and is waiting for 
approval of 5 others). All of the pending agreements have set out 
language with a greater accountability to ICANN on security and 
stability concerns, and also provide greater opportunities for ICANN to 
act in the event of actions of registries, or such other issues that 
might arise from registry operator actions or practices., including: 
(a) the .COM agreement (which is currently pending approval by the U.S. 
Department of Commerce) and (b) four other registry agreements for 
.ASIA, .BIZ, .INFO and .ORG (which are subject to review by the ICANN 
Board of Directors during the next ICANN Board Meeting).
    The .COM agreement is part of a larger overall settlement of a 
long-standing dispute with VeriSign over its desire to introduce new 
registry services. That dispute arose with the creation of ICANN and 
has been resolved in a way that would enhance the performance of both 
entities, to the benefit of all of the users of the Internet. ICANN and 
VeriSign Board's have both approved settlement documents that would 
permit the parties to act together in a concerted way to protect the 
overall security and stability of the Internet. Further, if VeriSign 
were ever to act in a manner that is inconsistent with the interests of 
the Internet community, ICANN has built additional mechanisms into the 
agreement to resolve such disputes promptly and effectively.
Continuing Relationship With the United States Government
    ICANN has been engaged in a long-standing and important 
relationship with the U.S. Government since ICANN's inception, which 
has been administered by the U.S. Department of Commerce's NTIA. ICANN 
is about to successfully complete the sixth separate amendment to its 
original Memorandum of Understanding with the DOC.
    ICANN will continue in its relationship with the U.S. Government, 
having recently entered into a new 5-year arrangement for ICANN to 
manage the Internet Assigned Numbers Authority (IANA) function. 
Additionally, ICANN and the NTIA are in the final stages of 
discussions, which will confirm an appropriate continuing relationship 
and will recognize ICANN's global private sector role providing 
technical management of the DNS in a manner that promotes stability and 
security, competition, coordination, and representation.
ICANN's Private-Sector Multi-Stakeholder Model and its Continuing 
        Evolution
    One of the greatest achievements of ICANN has been the successful 
creation, support and coordination of an ICANN Community and creation 
of the bottom-up policymaking process supported by various stakeholders 
involved in the DNS. Since ICANN's creation, the Internet community 
stakeholders, have vigorously discussed and reviewed ICANN's mission 
and values. Accordingly, ICANN has continued to build into a robust 
entity, and has continued to evolve ICANN's multi-stakeholder model, 
which remains encapsulated in ICANN's Bylaws and its Mission and Core 
Values.
    The evolution continues in many ways, but most recently in the 
following actions:

        1. This week, the ICANN Board, having reviewed the comments 
        about ICANN and its processes generated from the community 
        during the past year, has commenced a review of its own guiding 
        principles and is publishing a set of Private-Sector Management 
        Operating Principles (ICANN PSMOPs), which will be offered for 
        public review.

        2. Last week, the London School of Economics provided an ICANN-
        commissioned independent third-party review of one of ICANN's 
        key policy development supporting organizations, ICANN's 
        Generic Name Supporting Organization (GNSO). The information 
        contained in this review will likely result in considerations 
        of additional improvements to ICANN's GNSO and supporting 
        organizational structure.

ICANN's Continuing Accomplishments
    Since 1998, ICANN's self-governance model has succeeded in 
addressing stakeholder issues as they have appeared, and bringing lower 
costs and better services to DNS registrants and everyday users of the 
Internet.
    ICANN has been continuing its efforts to manage and adapt in the 
face of continued and dynamic growth of the Internet. ICANN, with the 
efforts of the ICANN Security and Stability Advisory Committee, has 
worked to make the Domain Name System more resistant to external 
attack.
    ICANN has undertaken significant work in relation to 
Internationalized Domain Names (IDNs) that will enable people across 
the world to interact with the Internet's domain name system in their 
own languages, which will work to avoid the creation of alternate root 
systems. Working in coordination with the appropriate technical 
communities and stakeholders, ICANN's adopted guidelines have opened 
the way for domain registration in hundreds of the world's languages.
    ICANN's Uniform Domain Name Dispute Resolution Policy (UDRP) has 
been highly successful and of great value to individuals, businesses 
and intellectual property holders. The policy enables them to assert in 
allowing them to assert their rights against domain name squatters and 
infringers of intellectual property interests. The UDRP has resolved 
more than 17,000 disputes over the rights to domain names, and proven 
to be efficient and cost effective for those utilizing this alternative 
dispute resolution mechanism.
    After significant study and discussion, and working with the 
accredited gTLD registrars, ICANN developed a domain name transfer 
policy enabling domain name holders to transfer management of their 
domain name from one registrar to another readily. The implementation 
of this policy has been highly successful and has been an important 
step in providing additional registrar market changes and greater 
choice to consumers.
    ICANN continues to introduce new Top Level Domains to give 
registrants right of choice. These include the introduction of seven 
new gTLDs in 2000 and four additional ones so far from the 2004 
sponsored top-level domain name round.
    ICANN re-bid the .NET registry during 2005, resulting in a new 
agreement being executed between ICANN and VeriSign. ICANN has proposed 
five additional gTLD agreements with the registry operators of .ASIA, 
.BIZ, .COM, .INFO, and .ORG. All of the newly proposed registry 
agreements contain new language supporting ICANN's role in the security 
and stability of the DNS.
    The market competition for generic Top Level Domain (gTLD) 
registrations established by ICANN has lowered domain name costs in 
some instances by as much as 80 to 90 percent, with savings for both 
consumers and businesses. Additional detail is provided below.
Registry-Registrar Level Competition
    Since ICANN was founded in 1998, ICANN has entered into many 
private arms-length agreements with registries (that operate the 
generic top-level domains), and with registrars (who are accredited by 
ICANN to sell domain names directly to consumers). Through these 
actions, ICANN has provided a private-sector solution and helped break 
down the monopoly position by a single dominant company, which provided 
both registry and registrar functions to the majority of consumers 
purchasing domain names.
    In 1998, there were only three main generic top-level domain name 
registries (.COM, .NET, and .ORG) from which domain names could be 
purchased by American small businesses. Only one company was running 
all three registries, Network Solutions (which was later acquired by 
VeriSign). Most registrations by small businesses were in .COM.
    There was a single registrar in 1998. That same company that ran 
the registries, Network Solutions, was the only registrar from which a 
consumer could purchase a domain name. The price of a single domain 
name in .COM in 1998, was approximately $90.00 per domain name. The 
.COM Registry still controls a significant amount of the marketplace, 
but now less than 50 percent of the market, including ccTLD operators.
    The price for a .COM registration today depends upon where you 
purchase the name from, but in some instances the price of a domain 
name has been reduced by as much as 90 percent. Today, the price ranges 
from $7 to $35 per domain name. Go Daddy is now the largest registrar, 
displacing Network Solutions, which has been spun out of VeriSign.
    Consumers can choose from over 845 ICANN-Accredited Registrars, 
derived from more than 250 unique business groups (a significant number 
owning interests in multiple registrar companies), located in over 40 
countries.
    Between 2000 and today, 11 new generic top-level domains have 
signed agreements with ICANN. Five of those (.CAT, .JOBS, .MOBI, .TEL 
and .TRAVEL) having signed agreements with ICANN in the last 18 months.
Conclusion
    In conclusion Mr. Chairman, ICANN is committed to its continuing 
role as the private sector steward of a stable and globally 
interoperable Internet, and is committed to fostering competition in 
the domain name marketplace.

    The Chairman. Thank you very much. We will look forward to 
coming back to you with some questions concerning your 
position.
    Our next witness is Mr. Ken Silva, the Chief Security 
Officer for VeriSign.

    STATEMENT OF KEN SILVA, CHIEF SECURITY OFFICER, VeriSign

    Mr. Silva. Thank you, Mr. Chairman.
    My name is Ken Silva, and I serve as Chief Security Officer 
for VeriSign. I also serve as the Chairman of the Internet 
Security Alliance, as well as serving on the Board of Directors 
for the Information Technology--Information Sharing and 
Analysis Center. I'm also an advisor to the Bush 
Administration's National Security Telecommunications Advisory 
Council.
    Internet governance is an important issue today, because 
the Internet is so critical to our national and economic 
security. The technology of the Internet has transformed 
personal communications, banking and finance, government 
processes, and manufacturing. For example, 25 percent of 
America's value moves over our networks each day.
    The United States is not the only country focused on 
Internet governance, however. A number of countries, such as 
China, Cuba, and Syria banded together last year in an attempt 
to shift control of the Internet over to the United Nations or 
the International Telecommunications Union. They did so, 
because they believe the United States has too much control 
over the Internet. Their efforts were not successful, in large 
part due to the outstanding efforts by the State Department and 
the Commerce Department. These countries, however, have not 
given up on their goal. The dramatic rise in usage bears out 
the Internet's importance globally.
    The dot-com bust gave the illusion that the Internet growth 
had slowed down, but, in fact, it has actually grown at a 
remarkable rate. At the height of the dot-com boom in 2000, for 
example, there were roughly 250 million people using the 
Internet. Today, that's about a billion. So, that's about a 
300-percent increase since--over 300-percent increase since 
2000.
    So, there are two questions we would pose today. The first 
is, is the Internet able to meet the growing demands on its 
infrastructure? And the second, is the Internet secure and 
reliable, and will it continue to be so?
    VeriSign's role in supporting the Internet's infrastructure 
gives us a unique perspective on the Internet and these 
questions. VeriSign operates two of the 13 authoritative 
``root'' servers, including the A root. VeriSign also manages 
dot-com and dot-net domain registries.
    So, let's start with the first question. Is the Internet 
able to meet the growing demands of the infrastructure? The 
answer is yes, as long as we continue to promote investment in 
the infrastructure. While users have increased 300 percent 
since 2000, the volume of traffic has increased 1900 percent. 
VeriSign is very proud of the fact that dot-com and dot-net 
systems have had 100 percent up-times 7 years straight. To 
support these functions, VeriSign has invested hundreds of 
millions of dollars in building a global network of computers 
that are a critical component of the Internet's infrastructure. 
VeriSign is not alone in this. There are more than 250 other 
such registries. It is, therefore, essential that a framework 
is in place, for all operators, that drives operational 
excellence so we can meet the demands of the Internet.
    Now to the second question. Is the Internet secure and 
reliable? While the Internet has operated remarkably well, we 
can never get lulled into a false sense of security. What makes 
for good security today is a vulnerability tomorrow. The very 
growth of Internet users, broadband capacity, and the number of 
Internet-enabled devices has created an opportunity for 
hackers, organized criminals, and, even more serious, 
terrorists to attack our networks. Therefore, we must 
continually probe our weaknesses and invest in and strengthen 
our networks.
    Let me give you some historical examples of what I'm 
talking about here.
    In October 2002, the Internet community got a wake-up call 
when 13--all 13 of the DNS root servers came under a heavy 
denial-of-service attack. That attack was viewed at the time as 
the largest attack ever to hit the Internet. It was viewed as a 
national crisis. Dick Clark, at the time, raised a red flag to 
this. There were a number of hearings on this subject, and a 
massive investigation by government to ensure that the root 
server system was secure.
    That attack, unfortunately, in 2002, while it was a massive 
attack and did affect a large number of the root servers, would 
be considered a very weak and feeble attack today. Just a few 
months ago, in January of this year, we observed an attack that 
was ten times that size and was targeted at the dot-com 
servers. We weathered that attack, but 1,500 other websites 
over a 6-week period of time did not bear the attack as well. 
Now, these hackers targeted their victims over a 6-week period 
of time, and they used about 32,000 of what we estimate to be a 
half a million available resources to them. So, that's just 6 
percent of what's available. This could have been much worse, 
and the fact--and, in fact, would have taken down even the 
largest ISPs, had it been directed at any of them.
    The lesson learned there is that we must be prepared 
against these threats. VeriSign, for example, has invested over 
$250 million on the Internet infrastructure, and expects to 
continue to invest significantly in the near-term to strengthen 
against the new, more devastating attacks. To put this 
investment in perspective, VeriSign today can manage 10,000 
times the capacity of Internet traffic that it handled in 2000.
    We must move forward as an industry and a community to 
strengthen the Internet. In the last year, several steps have 
been taken by the community to ensure a strong Internet. 
Progress has been made on introducing internationalized domain 
names and expanding the number of Internet addresses. ICANN has 
also established a framework for registry operators that, one, 
gives ICANN the authority to fire an operator if it fails to 
meet its performance levels; two, provides incentives for 
continued investment; and, three, imposes safeguards for 
consumers. This new framework advances the objective of 
security and stability by ensuring the necessary investment 
into the critical infrastructure.
    To conclude, Mr. Chairman, the last 5 years have brought 
painful lessons on the importance of preparation. We must not 
lose that vigilance, and we must continually take steps to 
strengthen the Internet so it remains reliable and always 
available.
    I thank you for this opportunity to testify.
    [The prepared statement of Mr. Silva follows:]

   Prepared Statement of Ken Silva, Chief Security Officer, VeriSign
    Good morning, Chairman Smith, and distinguished members of the 
Committee. My name is Ken Silva and I serve as Chief Security Officer 
of VeriSign.
    VeriSign operates intelligent infrastructure services that enable 
and protect billions of interactions every day across the world's voice 
and data networks. The company is headquartered in Mountain View, 
California, and it has additional corporate facilities in Virginia, 
Kansas, Washington State and Massachusetts.
    Thank you for the opportunity to testify today. I have a prepared 
statement, which I would request be inserted in the record.
    Internet governance is not a topic that 5 years ago would have been 
the subject of a Congressional hearing. The Internet was still 
relatively new and was not thought of yet as critical to our national 
and economic security.
    We have all witnessed, and learned, a lot over the last 5 years. We 
have had tragic reminders that our critical infrastructure and national 
symbols are targets. We have seen how not adequately preparing for 
events can have disastrous consequences. And we have seen how questions 
of who controls our critical infrastructure, such as the port issue, 
can spark controversy.
    And the United States is not the only country focused on Internet 
governance. In fact, a number of countries such as China, Cuba, and 
Syria last year sought to shift control of the Internet over to the 
United Nations or International Telecommunications Union. They did so 
because they believe the United States has too much control over the 
Internet.
    Their efforts were not successful in large part due to the 
outstanding efforts by the State Department and Commerce Department. 
These countries, however, have not given up on their goal.
    Internet governance is an important issue today because the 
Internet is critical to our national and economic security. The 
technology of the Internet has transformed personal communications, 
banking and finance, government process and manufacturing. Twenty-five 
percent of America's economic value moves over network connections each 
day. If the Internet were to go down for a just few hours, we would 
lose hundreds of millions of dollars of economic activity. If it went 
down for several days, U.S. economic activity would be severely 
curtailed; payrolls would not be met, securities transactions not 
cleared; invoices not paid.
    So whether it's Wal-Mart, the House of Representatives or a soccer 
mom checking e-mail to see if today's practice is still on, we all rely 
on the Internet.
    The dramatic rise of Internet usage bears that out.
    The dot-com bust gave the illusion that Internet growth slowed 
down, but in fact it has grown at a remarkable rate. At the height of 
the dot-com boom in 2000, for example, roughly 250 million people used 
the Internet. Today, according to Internet World Stats, more than 1 
billion users worldwide rely on the Internet, a 300 percent increase 
since 2000.
    So, there are two questions we would pose today:

   Is the Internet able to meet the growing demands on its 
        infrastructure?

   Is the Internet secure and reliable?

    VeriSign's role in supporting the Internet's infrastructure gives 
us a unique perspective on the Internet, and these questions.
    VeriSign operates two of the 13 authoritative ``root'' server 
operation centers that direct Internet traffic, including, at the 
request of the U.S. Commerce Department, the ``A'' Root Server. In this 
server, we maintain the authoritative address list of all Internet top-
level domains. VeriSign also manages the ``dot COM'' and ``dot NET'' 
domain registries. These are the central databases that enable you as 
an Internet user to simply type in a domain name on your computer, such 
as ``verisign.com,'' and connect it over the Internet to the machine 
that hosts the proper website.
    Let's start with the first question: Is the Internet able to meet 
the growing demands on its infrastructure?
    The answer is yes, as long as we continue to promote investment in 
the infrastructure. The explosion of Internet-enabled devices and 
applications--text messaging, music downloads, VoIP, Blackberries and 
device-to-device communications--has created exponential growth in 
Internet traffic far surpassing the increase in users. While users have 
increased 300 percent since 2000, the volume of traffic on .com and 
.net has increased 1,900 percent.
    VeriSign is proud of the fact that the .com and .net systems have 
had 100 percent uptime 7 years straight. To support these functions, 
VeriSign has invested hundreds of millions of dollars into building a 
global network of computers that are a critical component of the 
Internet's infrastructure.
    VeriSign is not alone in this. There are more than 250 domain 
registries in the world--for domains such as .fr for France, .de for 
Germany and what are called generic top-level domains such as .info, 
.org and .biz. All of these domains have registry operators that, like 
VeriSign, must operate and invest in critical infrastructure to keep 
the systems running smoothly.
    It is therefore essential that a framework is in place for all 
operators that drives operational excellence so we can meet the coming 
demands for the Internet, such as broadcast quality video and other 
real-time high-bandwidth applications.
    Now, to the second question: Is the Internet secure and reliable?
    While the Internet has operated remarkably well we can never get 
lulled into a false sense of security. What makes for good security 
today is vulnerability tomorrow. We must continually probe our 
weaknesses and invest and strengthen our networks.
    This very growth of Internet users, broadband capacity and number 
of Internet-enabled devices has created an opportunity for hackers, 
organized criminals and even more serious terrorists to attack our 
networks. Some do so for technical trophies, some for political 
objectives, but today, most bad behavior on the Internet is done for 
financial gain.
    In fact, the very devices and increased bandwidth that make the 
Internet more robust and user friendly are being deployed to compromise 
the Internet. Now that computers are always-on, they are easily 
accessible to hackers and other abusers to hijack. And the increased 
bandwidth and computing power available literally gives hackers more 
ammunition to utilize against the infrastructure:

   Regular PCs are being hijacked to mount these attacks. 
        According to CipherTrust, more than 180,000 PCs are illegally 
        hijacked each day and turned into zombies.

   Hackers are utilizing the computing capacity available to 
        their advantage. While a Jupiter Research report in 2004 found 
        that the typical home needed less than 3 Mbps of bandwidth, 
        that level has steadily grown and given the demands of gaming 
        and video that capacity is expected to grow to 57 Mbps by 2009. 
        That means that hackers will have 19 times the computing 
        capacity available to them in the PCs they hijack in that 
        period.

    Let me give you some historical examples of what types of attacks 
we as a community have experienced.
    In October 2002, the Internet community got a wake-up call when the 
13 DNS root servers, which serve as the heart of the Internet 
addressing system, came under heavy denial of service (DoS) attack. In 
these attacks, the hackers send countless bogus inquiries to domain-
name servers, which are computers that direct Internet traffic. By 
sending phony website requests to these servers, they overload and 
disable them, making websites unavailable.
    These attacks significantly impaired the operations of several of 
the root servers. The industry stepped up, and today an attack of that 
scale and type would be a blip on the radar.
    But hackers never give up innovating. In early January 2006, for 
example, a hacker systematically disabled over 1,500 websites using 
hijacked PCs. In these attacks, the hacker didn't directly attack the 
domain-name servers. Instead, they sent their traffic to a legitimate 
server with a DNS query and a forged source address.
    In this case, the hacker also made the DNS query larger, by a 
factor of 70 times, which amplified the attack and further disabled the 
victims servers.
    These hackers used hijacked PCs to target their victims over a six-
week timeframe. And the scary part is the hacker used a small 
fraction--32,000 of 500,000 PCs (or just 6 percent)--available to them. 
This could have been much worse, but it was still severe enough to 
significantly disrupt the operations of 24 registry operators as well 
as hundreds of businesses.
    These attacks remain under investigation.
    The lesson learned is that we must be prepared against all threats. 
VeriSign, for example, has invested over $250 million in the Internet 
infrastructure and expects to continue to invest tens of millions of 
dollars in the near-term to strengthen it against potential attacks.
    To put that investment in perspective, VeriSign today can manage 
10,000 times the capacity of Internet traffic that it handled in 2000.
Looking Toward the Future
    The Internet is made up of a number of entities that all must work 
together. The root servers serve at the heart of Internet enabling 
Internet traffic to get to the right address, over 250 domain name 
registries around the world ensure that each of the domains is 
operational, service providers such as EarthLink provide service to 
businesses and consumers, and registrars provide the services that 
consumers use to register domain names.
    The task of maintaining the technical coordination of these 
sometimes disparate layers falls on ICANN, which gains its authority 
through a Memo of Understanding, or MOU, with the Department of 
Commerce.
    The Internet community's challenge is to promote innovation so that 
consumers can do more while strengthening the infrastructure.
    In the last year, several steps have been taken by the Internet 
community to ensure a strong Internet. Progress has been made on 
introducing internationalizing domain names and expanding both number 
of Internet addresses available. ICANN has also established a framework 
for registry operators that both rewards strong performance and 
provides incentives for investment and imposes safeguards for 
consumers.
    ICANN has implemented new agreements for the .net and .mobi 
agreements, and proposed new agreements for .com, .info, .biz and .org 
that incorporate these principles. These agreements, for example, give 
the operators flexibility to increase prices while protecting Internet 
users by, in some cases, imposing limits on the levels of increases and 
requiring a six-month notice so consumers could lock in at existing 
prices.
    This new framework advances the objective of security and stability 
by ensuring the necessary investment into the critical infrastructure.
    Finally, the question comes to ICANN itself. At the heart of the 
question is ICANN's independence and what that means for the core 
infrastructure of the Internet. ICANN has taken steps, through its 
registry agreements, to become more financially independent. Under the 
old model, one industry controlled ICANN's budget and that was an 
unhealthy system.
    ICANN has taken steps to get additional funding from the registries 
without conditions, which means it will have more independence.
    To conclude, Mr. Chairman, the last 5 years have brought painful 
lessons on the importance of preparation. The Internet has worked--in 
fact, been taken for granted--because we have stayed a step ahead of 
both the dramatic rise in Internet traffic as well as the nefarious 
efforts to do it harm.
    We must not lose that vigilance and continually take steps to 
strengthen the Internet so it remains reliable and always available.
    Thank you for this opportunity to testify.

    The Chairman. Thank you very much.
    I see Senator McCain is here. Senator, have you got a time-
frame or do you wish to make a statement?

                STATEMENT OF HON. JOHN McCAIN, 
                   U.S. SENATOR FROM ARIZONA

    Senator McCain. Thank you, Mr. Chairman. I just would make 
a brief comment. Thank you for holding this hearing.
    I would point out that since the NTIA published its White 
Paper on the governance of the Internet's naming and addressing 
system, we obviously--our government has aspired to turn over 
the technical management of the DNS to private nonprofit that 
would be committed to several principles.
    I apologize for not being able to stay. I wanted to thank 
the witnesses. This is a very important issue. And one of my 
many concerns is truly making sure that competition and the 
resulting benefits to consumers exists in the DNS.
    And a lot of people don't understand this issue, Mr. 
Chairman, but I think it's a very important one, and I thank 
you for holding this hearing, and I hope we can move forward to 
a resolution to it.
    I thank you, Mr. Chairman.
    The Chairman. Thank you very much.
    We'll next turn to Christine Jones, General Counsel, 
Corporate Secretary, for Go Daddy Group. Glad to have you with 
us.

  STATEMENT OF CHRISTINE N. JONES, GENERAL COUNSEL/CORPORATE 
              SECRETARY, THE GO DADDY GROUP, INC.

    Ms. Jones. Thank you. Good morning, Mr. Chairman, and 
members of the Committee.
    I'm Christine Jones--as you said, General Counsel and 
Corporate Secretary of The Go Daddy Group. We're happy to be 
here with ICANN and VeriSign. We are ICANN's largest benefactor 
and VeriSign's largest customer, so we feel it's only fitting 
that we should be sitting here at the table with them today.
    I'm going to focus my remarks on three principal issues 
that you raised with earlier witnesses: the renewal of the 
Memorandum of Understanding between the Department of Commerce 
and ICANN, the .com Registry Agreement, and the security and 
stability of the Internet.
    The Go Daddy Group is an Arizona corporation. It consists 
of eight ICANN-accredited registrars, including GoDaddy.com, 
our flagship company. When I joined Go Daddy in 2002, it was a 
very small registrar, with well under 100 employees. Today, we 
have over 15 million domain names under management, and we're 
the number-one registrar in the world. That means we register a 
domain name once every 3 seconds or less. And every time we do, 
VeriSign gets another $6 from us. We currently employ over 
1,200 people, and we do not utilize any offshore outsourcing of 
any kind. And we're committed to that.
    I want to talk about the renewal of the Memorandum of 
Understanding. There was a DNS White Paper, which was first 
published in 1998. That paper articulated that principles of 
accountability, competition, private, bottom-up coordination 
and representation, were necessary for guiding the transition 
to private sector of the Internet domain-name system. And we 
believe that those principles still remain relevant today.
    ICANN has made some progress toward achieving some of the 
goals there, but not all of them. Specifically--and this was a 
question that came up with the government witnesses--ICANN has 
not yet achieved the competition goal, nor have they achieved 
this private, bottom-up coordination and representation called 
for even in their own bylaws. And the events of the last 2 
years call into question whether or not ICANN will ever be able 
to accomplish those goals in the future.
    The MOU, which is set to expire next Saturday, should be 
extended, but it should also be modified to stress the need to 
correct these deficiencies and require a clear roadmap from 
ICANN as to how it will regain the confidence of the community 
upon which its existence relies. This Committee's commitment to 
ensuring ICANN appropriately administer that system is vital.
    Private, bottom-up coordination and representation should 
be a guiding principle in the ICANN policymaking process. While 
we have repeatedly urged ICANN to abide by this principle, they 
have chosen, instead, to conduct business behind closed doors 
and without input from the ICANN community. Unfortunately, 
ICANN has yet to commit to--or perhaps they are unable to 
commit to--openness, transparency, and accountability. The 
manner in which the new dot-com agreement was negotiated is a 
relevant example of ICANN and VeriSign getting together off the 
record, creating a mutually beneficial policy, and then boldly 
announcing that they have made a decision without input from 
any of the stakeholders.
    ICANN is responsible for an important public trust. To 
preserve that public trust, it is vital that all stakeholders 
have access to and recognize input into these types of 
discussions. The entire Internet community should be made to 
fully understand the reasons for ICANN's decisions and to have 
effective and unbiased recourse if they have reason to question 
those processes and decisions.
    ICANN's bylaws specifically state--and I'm quoting--``ICANN 
and its constituent bodies shall operate, to the maximum extent 
feasible, in an open and transparent manner and consistent with 
procedures designed to ensure fairness,'' and, ``in carrying 
out its mission as set out in these bylaws, ICANN should be 
accountable to the community for operating in a manner that is 
consistent with these bylaws.''
    Now, despite those provisions, there is no appropriate 
accountability mechanism in place to impartially review ICANN 
Board actions. It doesn't exist. There are two accountability 
and review mechanisms defined in the bylaws. One is called 
``reconsideration,'' and one is called ``independent review.'' 
``Reconsideration'' is basically the Board reviewing itself. 
And ``independent review'' is a mechanism which is entirely 
untested and has never been used.
    We believe there needs to be an independent evaluation of 
how these accountability mechanisms have worked, or will work, 
and the implementation of any adjustments recommended as a 
result of that evaluation should be undertaken before any final 
transition can be contemplated.
    So, we believe the MOU must be revised to include openness 
and transparency as overall guiding principles if we are ever 
to see an effective transition of the Internet DNS management 
to the private sector through ICANN.
    We would be happy to be involved in the process of 
determining appropriate revisions, if that assistance would 
help move the ball forward. We'd be happy to volunteer to be 
involved in that.
    On security and stability, like all of us in this room and 
at this table, Go Daddy believes that the security and 
stability of the Internet is vital. We devote considerable time 
and resources to working with law enforcement on preserving the 
integrity and safety of the Internet by quickly closing down 
websites and domain names engaged in illegal activities. We 
work with law enforcement agencies at all levels and routinely 
assist in a wide variety of criminal and civil investigations. 
We're also quick to respond to complaints of spam and phishing 
and pharming and online fraud, and the subject matter of 
yesterday's hearing, Internet child pornography. And we work 
closely with anti-fraud and security groups such as the Anti-
Phishing Working Group, the Digital PhishNet, the National 
Center for Missing and Exploited Children, and CyberTipline.
    I personally, and this company in general, have made it a 
high priority to use our position as a registrar to make the 
Internet a better and safer place, and we feel very strongly 
about that.
    We recognize that VeriSign also has an important role to 
play in the security and stability of the Internet. They manage 
the entire infrastructure that supports the largest generic 
top-level domain, the dot-com. That's why it's incredible to us 
that ICANN did not include an infrastructure investment 
requirement in the proposed dot-com agreement. In negotiating 
that agreement, VeriSign ensured that their revenue would 
increase, and ICANN ensured that their budget would benefit, 
but who's going to ensure the benefits of the public interest, 
as well? This Committee should insist that the agreement 
between VeriSign and ICANN require VeriSign to invest in 
continued infrastructure in the future.
    VeriSign has over a billion dollars at stake--$1 billion--
if the proposed .com Registry Agreement is not approved. 
Because a substantial portion of that $1 billion comes from Go 
Daddy customers, I'd like to focus on that agreement for a 
minute.
    According to ICANN, 75 percent of all generic top-level 
domains are registered in the dot-com. Dot-com names accounted 
for over 80 percent of the growth in the generic top-level 
domain-name space in 2005. Today, there are over 56 million 
dot-com names registered. One of those is SenatorStevens.com, 
I'm sure. We'll be happy to try to help to track that down, if 
you'd like. That number is projected to grow to over----
    The Chairman. Let me say that was just an example.
    [Laughter.]
    The Chairman. I don't want to get involved in this anymore 
than I already am.
    [Laughter.]
    Ms. Jones. Yes, too late, sir.
    [Laughter.]
    Ms. Jones. OK, so that number is projected to grow to over 
61 million by the end of the year, and to over 350 million--350 
million--dot-com names by the end of 2012. That means VeriSign 
gets this huge windfall, if this agreement is approved.
    The form of presumptive renewal in the proposed agreement 
is simply anticompetitive. The form of renewal eliminates the 
possibility that dot-com could ever be rebid to allow true 
market mechanisms to set the price for dot-com.
    It's important to note that when the dot-net contract was 
rebid last year, it resulted in a price reduction of over 28 
percent, from $6 down to $3.50, a price that was appropriate to 
the then-existing market conditions.
    Other legitimate monopoly companies, such as the Bell 
Companies, for example, must justify their price increases, and 
VeriSign, the monopoly provider, should be required to do the 
same.
    I'd like to thank you, Chairman Stevens and Senator Smith 
and the members of the Committee, for the generous invitation 
to testify today. We agree that the secure future of the 
Internet is paramount to the overall success of our economy, 
and that of the global community, as well. Your commitment to 
bringing attention to this issue is sincerely appreciated.
    Inasmuch as the current agreement between ICANN and 
VeriSign does not expire until November 10, 2007, I 
respectfully request that this Committee direct the NTIA not to 
approve the agreement until such time as it has been reviewed 
in an open and transparent manner by the entire ICANN 
community.
    Thank you.
    [The prepared statement of Ms. Jones follows:]

  Prepared Statement of Christine N. Jones, General Counsel/Corporate 
                  Secretary, The Go Daddy Group, Inc.
Introduction
    Good morning Mr. Chairman and members of the Committee. I am 
Christine Jones, General Counsel and Corporate Secretary of The Go 
Daddy Group, Inc.
    First, I would like to thank you, Chairman Smith, for the kind 
invitation to testify today regarding Internet governance and the 
future of the Internet Corporation for Assigned Names and Numbers 
(ICANN). We are thankful for your attention to this important issue and 
for recognizing that the Internet is a resource significant enough to 
deserve the attention of the U.S. Senate. We agree that its secure 
future is paramount to the overall success of our economy, and that of 
the global community, as well. The future of ICANN rests with the 
public that it was formed to benefit. That community's confidence in 
ICANN has been shaken by the lack of openness and transparency; by the 
apparent unwillingness of the ICANN Board of Directors to be 
accountable to anyone but itself; and, the giant step backward that is 
now being taken by the introduction of anticompetitive registry 
agreements that threaten to undo what progress has been made.
    The Memorandum of Understanding between ICANN and the Department of 
Commerce should be extended and modified to stress the need to correct 
these deficiencies and require a clear roadmap from ICANN as to how it 
will regain the confidence of the community upon which its existence 
relies. This Committee's commitment to ensuring ICANN appropriately 
administer that system is vital.
Background
    The Go Daddy Group, Inc. consists of eight ICANN-Accredited 
registrars, including GoDaddy.com. When I joined Go Daddy in early 
2002, it was a very small registrar with well under 100 employees. 
Today, we have over fifteen million domain names under management, and 
are the number one registrar in the world. That means we register a 
domain name once every 3 seconds or less. Go Daddy is also the largest 
provider of hostnames in the world today. We currently employ over 
1,200 people and do not utilize offshore outsourcing of any kind.
    The Go Daddy Group devotes considerable time and resources to 
working with law enforcement on preserving the integrity and safety of 
the Internet by quickly closing down websites and domain names engaged 
in illegal activities. We work with law enforcement agencies at all 
levels and routinely assist in a wide variety of criminal and civil 
investigations. We are also quick to respond to complaints of spam, 
phishing, pharming, and online fraud and work closely with anti-fraud 
and security groups such as the Anti-Phishing Working Group, Digital 
Phish Net, the National Center for Missing and Exploited Children, and 
CyberTipLine. I personally, and the company in general, have made it a 
high priority to use our position as a registrar to make the Internet a 
better and safer place.
    The Go Daddy Group has been an active supporter of ICANN processes 
for over 5 years. We continue to believe in the validity of the 
transition of management of the Internet Domain Naming System (DNS) to 
the private sector, but we have serious concerns regarding the progress 
of that transition to ICANN.
    The DNS White Paper, first published in 1998, articulated that 
principles of accountability, competition, private, bottom-up 
coordination, and representation are necessary for guiding the 
transition to private sector management of the Internet DNS. We believe 
those principles remain relevant, but our testimony will explain why we 
also believe those principles have not yet been fully accomplished by 
ICANN, and why the events of the last 2 years bring into question 
whether ICANN will be able to accomplish them in the future.
Competition
    Significant progress has been made in regards to competition at the 
registrar level. However, that is only half the equation. The .com 
extension still maintains overwhelming dominance among the generic top 
level domain (gTLD) registries. In addition, the new form of registry 
agreement that has been proposed for the .com registry, as well as the 
other gTLD registries, threatens to further entrench that dominance and 
even negate competition at the registrar level:
Proposed .com Registry Agreement
    It's important to first understand the current metrics involved 
with the .com registry:

   According to the monthly registry reports posted on ICANN's 
        website, .com still accounted for 75 percent of all gTLD 
        registered domain names at the end of 2005, and accounted for 
        over 80 percent of the growth in the gTLD name space during 
        2005.

   The number of registered .com domain names is growing at 
        increasing rates year over year. The .com registry increased by 
        over 16 percent in 2003, over 25 percent in 2004, and almost 34 
        percent in 2005.

   There are over 56 million .com names registered as of the 
        date of this testimony. That represents a 25 percent growth so 
        far in 2006 and projects to 35 percent growth for the year, to 
        over 61 million .com domain names.

   If .com just maintains a 34 percent growth rate over the 
        life of the proposed agreement, it will grow to over 350 
        million domain names by the end of 2012.

   As a result, the incremental revenue from the 7 percent 
        price increases in 4 of the 6 years as allowed in the proposed 
        agreements will provide VeriSign a windfall of over $1.8 
        billion.

   For example, if you go to www.GoDaddy.com and register the 
        domain name www.ChairmanSmith.com, you would pay a maximum of 
        $8.95 per year for that domain name registration. Of that 
        $8.95, by the current .com contract, $6.00 goes to VeriSign, 
        $.25 goes to ICANN as a transaction fee, and the balance of it 
        goes to operating expenses and profit for Go Daddy. Taking this 
        example further, if some portion of the current 56 million .com 
        names are renewed, under the proposed agreement, $6.00 would 
        still go to VeriSign, plus an automatic increase of 7 percent 
        in 4 out of the next 6 years, an increase without price 
        justification. This is an extraordinary profit and these are 
        just the renewals.

    Of course, that windfall will come at the expense of consumers. The 
increasing costs of .com will result in a leveling effect of .com 
retail prices. At the same time, it provides VeriSign a marketing fund 
of gigantic proportions in comparison to its so-called competitors. As 
a public company with a fiduciary responsibility to its shareholders, 
VeriSign will no doubt use these funds to market and innovate at a 
level with which other gTLDs will not be able to compete. Given the 
market power that .com continues to hold, allowing VeriSign this 
windfall is inappropriate for an organization committed to the 
promotion of competition.
    The form of presumptive renewal in the proposed .com agreement is 
also anticompetitive. It substantially allows a perpetual agreement 
unless VeriSign breaches its agreement and fails to cure. It even 
allows for repeated breaches with only monetary fines as the penalty. 
This form of renewal eliminates the possibility that .com could ever be 
re-bid to allow true market mechanisms to set the price for .com. It is 
important to note that when the .net contract was re-bid, it resulted 
in a price reduction of over 28 percent, from $6.00 per .net domain 
name to $3.50. a price appropriate to then existing market conditions.
    In addition, this form of presumptive renewal leaves no way ICANN 
can ever decide to re-bid .com based on VeriSign's performance as a 
steward of the .com name space. Note the four conditions below 
(emphasis ours) under which ICANN could decide not to renew .com under 
Section 25.B of the current agreement. They no longer exist in the 
proposed COM agreement.
    Registry Operator shall be awarded a four-year renewal term unless 
ICANN demonstrates that: (a) Registry Operator is in material breach of 
this Registry Agreement, (b) Registry Operator has not provided and 
will not provide a substantial service to the Internet community in its 
performance under this Registry Agreement, (c) Registry Operator is not 
qualified to operate the Registry TLD during the renewal term, or (d) 
the maximum price for initial and renewal registrations proposed in the 
Renewal Proposal exceeds the price permitted under Section 22 of this 
Registry Agreement.
    Removing the above requirements is particularly alarming given that 
under the proposed agreement, VeriSign is not required to make 
infrastructure investments or demonstrate that such investments are 
being made. What are they going to do with the $1.8 billion windfall? 
How do they intend to accommodate the projected growth of the .com name 
space to over 350 million domain names, an increase of almost 600 
percent over the life of the proposed agreement? It is a serious 
mistake on the part of ICANN to not ensure that appropriate investments 
in infrastructure will be made, especially considering their overall 
mission of the security and stability of the Internet. The .com name 
space is too important to simply assume that a wide open presumptive 
renewal is enough incentive for the registry operator to make 
appropriate investments. The proposed .com agreement must, therefore, 
be refined before it is approved by the NTIA.
Future of New gTLDs
    We believe an effective and objective process for introducing new 
gTLDs is another important change that needs to take place to increase 
competition at the registry level. In fact, that is one of the specific 
tasks set out in section II.C. of Amendment 6 of the Memorandum of 
Understanding under which ICANN currently operates with the Department 
of Commerce:

        8. Continue the process of implementing new top level domains 
        (TLDs), which process shall include consideration and 
        evaluation of:

           a. The potential impact of new TLDs on the Internet root 
        server system and Internet stability;

           b. The creation and implementation of selection criteria for 
        new and existing TLD registries, including public explanation 
        of the process, selection criteria, and the rationale for 
        selection decisions;

           c. Potential consumer benefits/costs associated with 
        establishing a competitive environment for TLD registries; and,

           d. Recommendations from expert advisory panels, bodies, 
        agencies, or organizations regarding economic, competition, 
        trademark, and intellectual property issues.

    Define and implement a predictable strategy for selecting new TLDs 
using straightforward, transparent, and objective procedures that 
preserve the stability of the Internet (strategy development to be 
completed by September 30, 2004 and implementation to commence by 
December 31, 2004).
    A successful process for new gTLDs is an important element for 
introducing competition into the gTLD space. The trickle of new gTLDs 
we have seen so far has done little to change the market power that 
.com has maintained since before the initial publication of the DNS 
White Paper in 1998.
    The Policy Development Process that will ultimately recommend a 
process to fulfill the principles stated in task 8 above was initiated 
by the Generic Names Supporting Organization (GNSO) early in December 
2005. The current timeline calls for these recommendations to be 
presented to the ICANN Board of Directors at the end of this year, a 
best case scenario. It will be well into 2007 before the evaluation of 
the success of any resultant process could even begin to be undertaken.
    We believe fulfillment of this task is crucial to the future of 
ICANN and believe it important not to complete the transition of the 
management of the Internet DNS until a successful and sustainable 
process for the introduction of new gTLD is firmly in place.
    Competition exists at the registrar level only. The .com name space 
continues to overwhelmingly dominate the gTLD domain name market. The 
anti-competitive form of registry agreements being contemplated by 
ICANN and the DOC could very well threaten existing competition even at 
the registrar level. Promoting competition, and doing so successfully, 
needs to remain a core task for ICANN if it is to maintain the support 
of the public it has been formed to benefit.
Private, Bottom-Up Coordination, and Representation
   The principles of private, bottom-up coordination, and 
        representation cannot be fully realized without ICANN's 
        commitment to openness, transparency, and accountability. ICANN 
        is responsible for an important public trust. To succeed, it is 
        vital that all stakeholders have access to those processes;

   Fully understand the reasons for ICANN's decisions as a 
        result of those processes;

   And have effective and unbiased recourse if they have reason 
        to question those processes and decisions.

    Indeed, ICANN's own bylaws state: ``ICANN and its constituent 
bodies shall operate to the maximum extent feasible in an open and 
transparent manner and consistent with procedures designed to ensure 
fairness,'' and ``In carrying out its mission as set out in these 
Bylaws, ICANN should be accountable to the community for operating in a 
manner that is consistent with these Bylaws.''
    ICANN's Articles of Incorporation state that ICANN is a nonprofit 
public benefit corporation and is not organized for the private gain of 
any person. As such, Directors are bound in the bylaws to act in the 
best interests of that public benefit and to do so in an open and 
transparent manner.
    However, a number of examples over the last few years demonstrate 
the failure of the ICANN Board and Staff to follow through on these 
obligations.
The .net Registry Agreement
    The registry agreement that resulted from the .net re-bid was 
executed by ICANN before the final draft was posted for public comment. 
This agreement represented a significant shift in ICANN's policy 
regarding the management of the gTLD DNS and name space. The public 
that ICANN's actions supposedly benefited cried out loud and hard about 
these policy changes without due process within the community. The 
community pointed out several problems with the agreement that they 
believed benefited only the registry and ICANN's corporate structure at 
the community's expense. Ultimately, some minor compromises were agreed 
to by the winning registry, and the ICANN Board publicly apologized and 
committed to do better.
The .com Registry Agreement and Law Suit Settlement
    The ICANN Board's idea of doing better was posting a notice that it 
had reached a settlement agreement with VeriSign to end a long-standing 
lawsuit. While it is true that ICANN posted the settlement agreement 
for public comment, there had been no prior indication of what ICANN 
was doing in this regard, or that it again was considering changes in 
long understood policy in order to settle the suit. In fact, these 
policy changes were the exact same ones that the community had 
complained about in regards to the .net Registry Agreement.
    Once again, as this Committee well knows, the community that ICANN 
was supposedly benefiting by this settlement made its displeasure known 
loud and clear, especially in regards to the unexpected and early 
renewal of .com registry agreement that was part of the settlement. 
Ultimately, minor changes to the .com registry agreement were agreed to 
by ICANN and VeriSign. These changes did little to address the 
overwhelming concerns of the Internet community. Once again, ICANN 
chose to benefit itself at the expense of the public as a whole.
Other Registry Agreements
    Most recently, the ICANN Board posted proposed new agreements (not 
renewals) to the .biz, .info, and .org registry operator agreements. 
Once again, there was no prior notice that, despite the previous 
outrage expressed by the Internet community regarding the .com and .net 
agreements, the ICANN Board was going to implement the exact same 
policy changes in all new gTLD DNS and name space management 
agreements. This belies ICANN's promise to do better and is in direct 
contravention to their obligation to operate an open and transparent 
manner.
    This fact is even more serious as it relates to these proposed new 
agreements. After the .net and .com agreement fiascos, the Generic Name 
Supporting Organization (GNSO), which was appointed by ICANN's bylaws 
for the specific purpose of recommending policy regarding the gTLD DNS 
and name space, initiated a Policy Development Process (PDP) to address 
the concerns raised by the community. It now appears that the ICANN 
Board of Directors no longer believes it is bound by its own bylaws and 
is moving ahead without waiting for the outcome of the GNSO's PDP 
findings. This is yet another poignant example of why the Department of 
Commerce must maintain control over ICANN, even after the current 
Memorandum of Understanding expires on September 30, 2006.
Lack of Appropriate Accountability and Review Mechanisms
    All of the above is exacerbated by the fact there are no 
appropriate accountability mechanisms in place to impartially review 
ICANN Board actions. There are currently two accountability and review 
mechanisms defined in ICANN's bylaws:

   Reconsideration--This is basically the Board reviewing 
        itself. The criteria the process calls for is restrictive and 
        not useful for most instances where affected stakeholders 
        question an action of the Board. In addition, the fact that 
        transcripts or recordings of Board meetings have never been 
        made available make it difficult if not impossible for those 
        affected by Board actions to effectively evaluate whether their 
        concerns or questions meet the criteria of the bylaws.

   Independent Review--This mechanism is entirely untested and 
        has never been used.

    We also invite you to visit ICANN's website and see if you can 
discover how to take advantage of either of these accountability 
mechanisms. It is next to impossible to find anything of substance 
about how to file either a Reconsider Request or a Request for 
Independent Review, or even who the Independent Review agent actually 
is.
    We believe there needs to be an independent evaluation of how these 
accountability mechanisms have worked, or will work, and the 
implementation of any adjustments recommended as a result of that 
evaluation should be undertaken before any final transition can be 
contemplated.
    The interests and support of the community ICANN is supposed to 
benefit is shifting. The World Summit on the Information Society (WSIS) 
and the resultant Internet Governance Forum (IGF) is an outcome of that 
shift. These failures on the part of ICANN to adhere to the principles 
espoused in its own bylaws and Articles of Incorporation are 
accelerating that shift. It is clear that ICANN's Memorandum of 
Understanding with the Department of Commerce must be extended and 
modified. Openness and transparency are only hinted at in the current 
Memorandum of Understanding. We believe the Memorandum of Understanding 
should be revised to include openness and transparency as overall 
guiding principles if we are to ever see an effective transition of the 
Internet DNS management to the private sector through ICANN.
Conclusion
    The future of ICANN rests with the public that it was formed to 
benefit. That community's confidence in ICANN has been shaken by the 
lack of openness and transparency; by the apparent lack of the ICANN 
Board of Directors to be accountable to anyone but itself, and the 
giant step backward that is now being taken by the introduction of 
anti-competitive registry agreements that threaten to undo what 
progress has been made.
    The Memorandum of Understanding between the Department of Commerce 
and ICANN should be extended and modified to stress the need to correct 
these deficiencies and require a clear roadmap from ICANN as to how it 
will regain the confidence of the community upon which its existence 
relies.
    Thank you again, Mr. Chairman, for the opportunity to be heard on 
these important issues. Your commitment, and the commitment of the 
members of this Committee, to bringing attention to issues impacting 
the future of the Internet is sincerely appreciated. I would be happy 
to answer any questions you may have.

    The Chairman. Senator Smith is here, and I do want to yield 
the Chair to him. I've got to say that from my perspective, we 
ought to have a go-lightly approach, because I think the worse 
thing to happen to the Internet would be to have us start 
trying to regulate it from Congress. We have to find a way to 
assist, to make sure that the transparency and responsibility, 
and, really, antimonopoly concepts, are there for someone like 
the FTC or the Department of Commerce to make proper inquiries, 
and, if necessary, deal with it. But I don't think we want to 
start a process of increasing regulation on the Net.
    I do agree, however, that we've got a real difficult 
problem, because we're just back from China, some of us, in 
August, and we've had some conversations over there about the 
Net and about the U.S. domination of the management of the Net. 
We have to find some way to take this to an international forum 
where we can get an agreement that this is a process that the 
governments of the world ought to keep their hands off, but 
ensure it will function through proper transparency and proper 
participation for all users. I don't know how we're going to 
walk down that road, but we're going to continue to have an 
interest in, and pay attention to, and have hearings on, this 
matter to let more and more people express their points-of-
view, and hopefully we might even work up a trip to go to meet 
with some of our counterparts in other governments, 
particularly in the very large governments, such as China and 
India and the very populated countries that want to have more 
of a role in how this process functions in their country. But 
it's a very delicate issue, as far as I'm concerned.
    So, I'm happy to see you back, Mr. Chairman.

              STATEMENT OF HON. GORDON H. SMITH, 
                    U.S. SENATOR FROM OREGON

    Senator Smith [presiding]. Thank you very much, Chairman 
Stevens. And I apologize to all of you for an unavoidable 
emergency, but I'm glad to be here.
    The Chairman. Could I just do one thing? I'd like to place 
in the record, the Glossary of Internet Governance Terms and 
Organizations that was prepared by our staff to help us 
understand the process we have here today.
    Thank you.
    [The information referred to follows:]

         Glossary of Internet Governance Terms and Organizations
------------------------------------------------------------------------

------------------------------------------------------------------------
ccTLD                Country code Top     Two-letter long top-level
                      Level Domain         domain (TLD) used and
                                           reserved for a country or a
                                           dependent territory (.uk for
                                           United Kingdom, .jp for
                                           Japan, etc.)
------------------------------------------------------------------------
DNS                  Domain Name System   Translates domain names into
                                           IP addresses
------------------------------------------------------------------------
gTLD                 Generic Top Level    TLD domains used worldwide,
                      Domain               such as .com, .org, .net and
                                           .info
------------------------------------------------------------------------
ICT                  Information and      General term for the use of
                      Communication        technology in managing and
                      Technology           processing information,
                                           especially in large
                                           organizations
------------------------------------------------------------------------
IANA                 Internet Assigned    Operated by ICANN, oversees
                      Numbers Authority    global IP address allocation,
                                           DNS root zone management, and
                                           other Internet protocol
                                           assignments. The technical
                                           side of ICANN is referred to
                                           as ``the IANA function''
------------------------------------------------------------------------
ICANN                Internet             Oversees a number of Internet-
                      Corporation for      related tasks, including
                      Assigned Names and   managing the assignment of
                      Numbers              domain names and IP
                                           addresses, including the
                                           introduction of new generic
                                           top-level domains
------------------------------------------------------------------------
IGF                  Internet Governance  Created at 2005 WSIS in Tunis.
                      Forum                IGF's first meeting is
                                           scheduled for October 2006 in
                                           Athens
------------------------------------------------------------------------
ITU                  International        International organization
                      Telecommunications   within the U.N. where
                      Union                governments and the private
                                           sector coordinate global
                                           telecom networks and
                                           services; WSIS and IGF (see
                                           below) fall under ITU's
                                           purview
------------------------------------------------------------------------
NGO                  Non Governmental     Group or association that acts
                      Organization         outside of institutionalized
                                           political structures and
                                           pursues matters of interest
                                           to its members
------------------------------------------------------------------------
NTIA                 National             Agency of the Department of
                      Telecommunications   Commerce serving as principal
                      and Information      adviser on telecommunications
                      Administration       policies, including economic
                                           and technological advancement
------------------------------------------------------------------------
Registrar                                 A body recognized by a
                                           registry to sell/register
                                           domain names (GoDaddy,
                                           AfterNic, eNom, etc.)
------------------------------------------------------------------------
Registry                                  A company or organization
                                           maintaining a centralized
                                           database for the TLDs or for
                                           some IP address blocks
------------------------------------------------------------------------
WGIG                 Working Group on     U.N. working group set up
                      Internet             after 2003 WSIS in Geneva to
                      Governance           make proposals for Internet
                                           governance at the 2005 WSIS
                                           in Tunis
------------------------------------------------------------------------
WHOIS                                     Method of querying a registry
                                           or registrar database to
                                           determine the owner of domain
                                           name
------------------------------------------------------------------------
WSIS                 World Summit on      A series of meetings on
                      Information          information and
                      Society              communications, including
                                           Internet governance, under
                                           the purview of the IU and UN
------------------------------------------------------------------------

    Senator Smith. Thank you, sir.
    Senator Burns?
    Senator Burns. Thank you, Mr. Chairman.
    Dr. Twomey, you have a Working Group on Internet Governance 
here from the U.N. What kind of a group is this, and what 
standing does it have with regard to ICANN?
    Dr. Twomey. Thank you, Senator. Good to see you again.
    Senator Burns. Good to see you.
    Dr. Twomey. That working group has actually completed its 
work. It was an input to the U.N.'s World Summit on Information 
Society. It, also, has finished its work. The implications for 
ICANN have not been anything significant, in terms of the need 
to change, although you and Senator Stevens have pointed out 
the international interests, obviously, in some of these areas.
    The U.N. continues to run a--what's called the Internet 
Governance Forum. It's basically, a meeting point for 
discussion. But, in terms of ICANN's own operations now, there 
is--although this is an ongoing area for monitoring, they don't 
have direct effect at all.
    Senator Burns. In other words, they don't have any official 
standing with ICANN, then.
    Dr. Twomey. No.
    Senator Burns. And we heard, in the testimony of Ms. Jones, 
of the 5-day waiting period. Are you doing anything to address 
that? I guess it caused--some problems are created by that 
grace period. Can you address that situation and bring us up--
tell us, kind of, what it is and how it affects your operation.
    Dr. Twomey. Senator, you're pointing out there's a--with 
the registries, some of them have agreements--well, they have 
agreements with registrars which allow for the registration of 
a name, but not for the payment of that name, within--for a 5-
day period. And there is an emerging pattern of people putting 
names in, in day one, and seeing whether there's any value in 
those names, particularly for online advertising, by day five. 
If there's not, they keep it--if there is, they keep it; if 
it's not, they give it back. There are some aspects about this 
that our compliance people are actually looking into, but there 
are also aspects about this which are part of the market 
operating.
    Senator Burns. Do you want to comment on that, Ms. Jones?
    Ms. Jones. Well, we have provided, upon ICANN's specific 
request, detailed information about registrars who are engaged 
in the practice of purchasing--or registering domain names and 
then deleting them before the 5-day grace period expires.
    Senator Burns. Is that term--that's ``tasting''?
    Ms. Jones. We would call that ``domain-name kiting.''
    Senator Burns. Kiting?
    Ms. Jones. Yes. So, it would be like ``check kiting,'' but 
only with a domain name, where you register it and then you get 
a refund before the 5-day grace period ends, so you never have 
to pay for it, essentially. We've provided information, and 
they've assured us that they would investigate further, to the 
openness and transparency discussion that we had earlier. We 
haven't heard anything back from them.
    We would like for the whole entire practice to be 
eliminated. It does appear to be, at least in spirit, a 
violation of the contract that registrars have as a part of 
their accreditation.
    Senator Burns. What is the cost of that registrar? What 
does it cost?
    Ms. Jones. Well, for example, with a dot-com name, it would 
cost $6 to register the name, and then you would get the entire 
$6 back when you cancel the registration within that 5-day 
period. So, it wouldn't cost you anything. And that's the 
insidious part of the whole practice, is that basically you're 
using domain names, and taking them away from other legitimate 
users, without paying for them.
    Senator Burns. OK. I guess--maybe the next question--Dr. 
Twomey said--can you justify doubling your budget in the last 5 
years?
    Dr. Twomey. Well, let me just--to the point just made, 
Senator, I have confirmed, personally, with the CEO of Go 
Daddy, that we are investigating this, and we will investigate 
this particular thing you just referred to----
    Senator Burns. OK.
    Dr. Twomey.--in--within our compliance terms.
    To come to your point about budget, the demands on--for the 
coordination of the DNS to do the sorts of compliance work 
we're talking about just in this conversation, to do many of 
the things that Christine has already raised, and to be able to 
support the large growth of the DNS, has--does require 
additional resources. We have moved to increase that budget. 
That budget process is done, Senator, through a very bottom-up 
process. We have a process of--where we have a strategic plan 
that the community develops. Behind that strategic plan, we 
then develop--there's an operational plan the community all 
responds on, project by project, and, at the end of that 
process, it's actually then calculated how much does it cost us 
to do all these things the community wants us to do? And that's 
the process which has actually driven the increase in the 
budget, as a reaction back to the things that people want to 
do.
    The budget is not a huge amount of money. For this coming 
financial year, it is budgeted for about $33 million. So, 
that's for the coordination of all of these factors coming out 
of that community process.
    I'm very, very conscious of the need for accountability on 
that, and for transparency, and we do have, I think, a very 
accountable and transparent process. I wonder if I might just 
comment on that.
    One of the things that I'm very conscious of, as the 
President of ICANN, is, I think, as an organization, we are 
actually very transparent. But, at the moment, we're suffering 
a little bit of being transparent, like credit card agreements 
are transparent--everything's there, but it's not necessarily 
easy for people to understand what's there. And I think that's 
one of our great tasks, going forward. We need to make it not 
only transparent, but more easy for people to understand what's 
in the material and what's being put forward. And that's one of 
our very high priorities this coming year.
    So, there's a distinction, I think, between being 
transparent and being accessible, and accessibility is one of 
our challenges, at the moment.
    Senator Burns. Well, it seems to me that the matter of 
transparency has surfaced here, and I guess that would--I could 
follow-up--the leverage that the registrars have with regard to 
the process of ICANN and also with regard to their budget, do 
they have any leverage in that?
    Dr. Twomey. Well, Senator, it's a good question. The 
registrars, 2 years ago--well, 18 months ago--constituted the--
by far, the greatest contribution to the ICANN budget. And, at 
the time, they themselves asked us to make an effort to 
rebalance their contribution to ensure that the registrees made 
more contributions. So, in the discussions with the registrees 
concerning their contracts, we have actually moved to change 
the financial flow so that there is more contribution, then, 
from the registrees. We have frozen any increases from the 
registrars on any sort of per-transaction basis, and, indeed, 
we'd look at--they've got proposals in front of us of being 
able to change that and amend it, and we are open to 
alternative sources of revenue. If the registrars put forward 
to us different views, we'd decrease their contributions 
further, as well. So, we are very open to their input about 
ensuring we have a widely balanced budget and sources of 
revenue, and we've been working toward that, quite 
specifically.
    The registry agreements, including the dot-com agreement, 
have terms in there specifically coming out of that 
conversation, to shift the balance of contribution.
    Senator Burns. Thank you, Mr. Chairman.
    The Chairman. Mr. Chairman, if I may----
    Senator Smith. Yes, of course.
    The Chairman. For your information, I've just had a 
discussion with Senator Smith. You know, at times we run into 
subjects we need to know a lot more about. And we've had a 
little habit of calling just for listening sessions. I think, 
assuming the management doesn't change around here after this 
new period we're going to go through here----
    [Laughter.]
    The Chairman.--I would want to hold a listening session and 
get people to come in and just tell us what their function is 
and how they view this arrangement, and how much they think we 
ought to be involved, or ought not to be involved. We ought to 
do some listening on this one before we really react.
    Ms. Jones, I appreciate your comments, and I'm sure that 
Dr. Twomey wants to have some counter-comments. But we used 
that process in approaching the communications bill, and it 
worked very well. And I would like to hold a listening session 
early next year, if that's agreeable to you, Mr. Chairman.
    Senator Smith. Yes, I would heartily agree with that as a 
need, and certainly, I think we should consult Chairman-in-
waiting, Senator Pryor.
    [Laughter.]
    Senator Smith. But obviously it's the kind of thing that we 
all look for more knowledge on.
    The Chairman. Well, I have a feeling Senator Inouye would 
agree.
    Thank you very much. I must go to another meeting.
    Senator Smith. OK. Thank you, Senator.
    Senator Pryor?
    Senator Pryor. Thank you, Mr. Chairman.
    Dr. Twomey--is that how you pronounce your name--Twomey? I 
would like to--I don't know if you heard my last series of 
questions with the previous panel, but I'd like to ask you 
about the dot-xxx domain. And I would like to understand what 
happened. You know, my impression was that dot-xxx had a lot of 
support, that a lot of folks here in this country and around 
the world thought it was a good idea, could be a good 
development. But it didn't happen. So, I'd like to hear ICANN's 
version of the facts there and what happened.
    Dr. Twomey. Senator, ICANN put out, as part of the process 
for introducing more competition among the gTLD space, a round 
of so-called ``sponsored top-level domains,'' top-level domains 
that are sponsored by a community or a particular grouping for 
the use of their own community. We received ten applications. 
One of those applications was for dot-xxx for the community of 
responsible adult-content providers, as they put it. That--our 
processes of--included the posting of these agreements, the 
posting of the comments, and allowed for a lot of public 
comment on those consultations. It also allows for comments 
from our various supporting organizations, and, very 
importantly, allows for--in our bylaws, for the advice of 
public--for the provision of public policy advice from the 
Governmental Advisory Committee on which there are over a 
hundred governments participating.
    As the process continued with those various registries, 
particularly dot-xxx, we received a lot of public comments. We 
received, I would say, over 100,000 comments from various--
online comments from various members of different associations 
in the United States against the dot-xxx. We received various 
comments from people in favor of it. And we did receive 
requests from governments--not just the United States, but a 
number of other governments--asking for more time to allow 
governments to consider the implications of the application. We 
had a meeting in March this year in Wellington, New Zealand, 
and in that meeting the Governmental Advisory Committee put 
forward some advice concerning public-policy issues.
    The Board eventually made a decision based on a number of 
issues that--the reasons for those decisions were made public 
for each of the Board Members. It's not one comprehensive set 
of reasons. But not in a majority--not in a unanimous sense, 
but in a majority sense, most of the Board Members decided that 
the contract, as put before us by the applicant--and at the 
time when the applicant asked us, the applicant not only put 
forward to us a redraft of the contract, but said, ``Please 
vote on this now''--the majority of the board, on the basis of 
that contract, felt that they could not proceed, a number of us 
feeling that some of the provisions in the contract were not 
enforceable.
    So, that's the sort of formal status of the process that 
was followed. It has a lot to do with the nature of the 
contractual language put forward by the applicant, and a lot to 
do with the timing of the request for actually proceeding with 
that vote.
    Senator Pryor. Well, that may actually go to Senator 
Stevens' previous point about, maybe we need to know more about 
this. And maybe this also illustrates one of the problems, at 
least from the outside looking in, with ICANN, is that there's 
not a lot of transparency there, and--at least that's the 
perception. And you all go through this process, and you're in 
New Zealand, and you make this decision, and I guess I don't 
know what it means that parts of the contract are not 
enforceable. What does that mean, ``parts of the contract are 
not enforceable''?
    Dr. Twomey. There were aspects of the contract language 
that was put forward that some Members of the Board--and I 
should let the record speak for itself, Senator. I mean, I--the 
Senate--the record of the ICANN Board meeting is available 
publicly, and the decision was available publicly. And the 
actual wordings of individual Board Members on their rationale 
for decisionmaking is there, available. I--and they felt that 
certain parts of the--being able to--certain language related 
to enforcing all public--all relevant public policy from all 
relevant countries was, sort of, language that some of them 
found it difficult to consider that was enforceable under the 
contract. I give that as an example, but I should point back to 
the record. We actually--and we can--I can--I'm happy to come 
back to you in writing to point out the--that record, point out 
the reasons given by the Board Members who were voting.
    Senator Pryor. Yes, I'd like for you to do that.
    [The documents from the March 25-31, 2006 meeting in 
Wellington, New Zealand are available at http://www.icann.org/
en/meetings/wellington/].
    You said that you had about 100,000 negative responses from 
inside the U.S. Do you know, were those generated by groups or 
were those just----
    Dr. Twomey. They were generated by groups, the--groups like 
the American Family Association and others.
    Senator Pryor. OK. And apparently some asked for more time, 
as well. Has ICANN decided to give this more time, or have you 
just--is this a flat rejection?
    Dr. Twomey. There was extensive period of time additionally 
given to this particular application, at that request. And 
we're--it was the applicant who, themselves, said, ``Please 
move forward with this vote. Please, we'd like you to move it 
to the vote now and make a decision, one way or the other,'' 
when that decision was made.
    Senator Pryor. Has there been any follow-up with the 
applicant to see if they want to make another run at this?
    Dr. Twomey. The applicant has--the process is not 
completed, because we do have two rounds of--two processes for 
review available to the applicant, both a review committee of 
the Board and then an independent review panel, an independent 
arbitrator.
    Senator Pryor. Have that----
    Dr. Twomey. And then----
    Senator Pryor. Has the applicant requested review?
    Dr. Twomey. They have requested--they have requested a 
review--the review is underway--but those two mechanisms are 
still available to the applicant.
    Senator Pryor. OK.
    Mr. Chairman, that's all I have right now. I may have some 
more in writing, but I know we're trying to get to a vote here 
in a few minutes.
    Senator Smith. Well, thank you very much, Senator Pryor. 
And I'll also have some written questions, because of the vote.
    But I do want to ask one, and if you can answer as briefly 
as possible so I can hear your answers, I would appreciate it. 
As you all know, in 2005 the current dot-com registry operator 
won a competitive bid process to continue to operate the dot-
net domain registry. And, with that, the prices have fallen, or 
at least, for dot-net, dropped from $6 to 3.50 through the end 
of 2006. At the same time, lots of security measures, I 
believe, have been put into the system including infrastructure 
investments. The competitive model seemed to work in dot-net, 
but now, the proposed dot-com registry contract apparently 
removes all of that and puts in automatic price increases. And 
I'm just wondering if that's defensible, if that's the right 
thing.
    Dr. Twomey. Senator, I assume that question is to myself, 
but I'll make two observations. I think you're actually 
confusing two agreements. The dot-net agreement is the one 
you're referring to, which----
    Senator Smith. Correct.
    Dr. Twomey. All right. The dot-com agreement--if your 
question is going to the question of rebidding--the dot-com 
agreement process of whether it could be rebid or not was 
decided in 2000 and 2001 by discussions by then-ICANN Board 
Members, the DOC, and VeriSign, and that was a whole set of 
discussions involving, if you like, breaking up the control 
that VeriSign had on dot-com, dot-net, and dot-org, where dot-
org was rebid so that VeriSign could not rebid, dot-net was 
rewritten such that dot-net could be rebid and VeriSign could 
be one of the bidders, and dot-com was agreed would continue 
under dot-com's--under VeriSign's control. That was actually in 
the 2001 contract.
    As the contracts come up for renewal or rediscussion now, 
the ICANN Board does not have any legal freedom to be able to 
change the provision that was in the--already agreed in the 
2001 set of arrangements agreed with the Department of 
Commerce, VeriSign, and the then-ICANN Board. So, the point 
you're--the point you're--it's just to distinguish between 
those two contracts.
    Senator Smith. Correct. Well, thank you for that.
    I guess the question that a lot of people are asking now, 
though, is, what's wrong with bidding out the dot-com? And why 
not let VeriSign win it, if they can, with a competitive bid?
    Dr. Twomey. Well, apart from the question that--the legal 
difficulties that we have already under contract, with that 
particular question, I think there's a second question that the 
ICANN Board is taking very seriously about its responsibilities 
for both competition and also security and stability. The 
introduction of new gTLDs, introduction of new TLDs available 
to compete with dot-com, we think, is a very important part of 
implementing competition. The second point we should make very 
clear is the introduction of new registrars has been a key part 
of the competition for registrants. We now have nearly 800 
registrars, and it's the competition amongst registrars that 
have reduced prices significantly to the end users.
    Indeed, the changes in pricing we saw in dot-net have not, 
on the whole, been passed through to registrants. The 
registrars themselves have taken the benefit of those price 
reductions, not the registrants. And that's the nature of the 
structure of the market, with registrars traditionally 
competing separately.
    So, the question of competition, we think, is very much 
about an introduction of new gTLDs. The Board has also thought 
very carefully about the position put to the--by the various 
registries of their need for certainty for capital investment, 
for the sorts of investments that security and other demands 
are making upon them. And while the board has not moved to 
reduce the provisions in the contract which allow us to 
intervene in the case of people breaching security arrangements 
and being able to move against them, the board has come down, 
on balance, to say there is--they are persuaded by the need to 
have certainty for capital investment as being an important 
part of ensuring security and stability.
    Senator Smith. And is that what justifies the automatic 
price increases?
    Dr. Twomey. Well, that's what's justifying the renewals.
    Ms. Jones. Mr. Chairman, may I be heard briefly on that 
point?
    Senator Smith. Yes.
    Ms. Jones. I'm happy to hear the commitment to additional 
infrastructure spending, but I think the point is, if there is 
going to be a presumptive renewal and an automatic price 
increase built into this contract, there should be some price 
justification. And to your point about the dot-net agreement, 
when that was competitively bid, the price didn't increase by 7 
percent, the price decreased. And that goes to a lot of 
reasons, not just because of economies of scale, but also 
because what we're talking about are commodity products--
bandwidth and hosting and all of the things that all of us buy 
and all of us have to spend money on. We do it, too, with our 
system and our networks. The costs of all of it--you know--
because when you buy a laptop today it costs you one-tenth of 
what it cost 10 years ago. Prices go down. And so, put aside 
for a minute the economies of scale, because we know that 
VeriSign built this huge system that's magnificently scalable, 
and we all admire them for it. Put that aside for a minute. 
Even if we didn't take that into consideration, we still know 
that commodity pricing goes down. And so, there is simply no 
reason, that we can see, to build in a price increase; and if 
they're going to build in a price increase, tell us why.
    Senator Smith. What's the justification?
    Ms. Jones. Why do you need the price increase, and why is 
it so difficult to say it?
    Senator Smith. I mean, you've said my question better than 
I did. But, I mean, I've been in the commodity business, 
myself, and, frankly, economies of scale and commodity pricing, 
such that where there is competition, it doesn't warrant these 
kinds of increases. But, Mr. Silva, maybe you have another view 
of that.
    Mr. Silva. Senator, I'd like to follow up on that, if I 
may.
    Ms. Jones is a very good attorney, and she's representing 
her client very well. OK? But she's not a technologist. OK? 
We're not talking about commodity hardware here. OK? We're 
talking about massively scalable databases. OK? These are very 
complex. Moving data in a disaster-recovery scenario from one 
place to another is significantly more complicated in a 
database that size. Significantly more.
    So, dot-net prices did go down during the rebid process. 
It's a different animal. It's a much smaller zone. It's a much 
smaller problem, quite frankly. OK?
    Now, I will point out that consumers never saw one red cent 
of that reduction in price. OK? Registrars maintained the same 
prices that they were before the price reduction from the 
registry.
    Now, let's--so, first of all, there's no automatic price 
increase at 7 percent. OK? What there is, is the possibility of 
a price increased based on the security and stability needs 
that we have at the time. So, let me----
    Senator Smith. And who will approve the increase?
    Mr. Silva. Well--OK, so there is the--all right, so let's 
think about what happened prior to Katrina. OK? The Army Corps 
of Engineers, for a number of years, attempted to justify cost 
increases to reinforce the levees around New Orleans. OK? For a 
number of years. Sometimes they got some funding, sometimes 
they didn't, but they probably never got all of the funding 
that they wanted.
    Now, when a hurricane started forming out in the tropics, 
and started heading in that direction--OK?--they probably would 
have gotten all the funding that they wanted at that time. The 
problem is, it would have been too late. OK?
    We constantly probe and penetrate our systems, and know 
where their weaknesses are, know where their scalability is, 
and know where it's about to fail. We know better than anyone 
when we have to make that investment, sometimes 3 or 4 years 
out. Sometimes it has to be made in 6 months, sometimes it has 
to be made in 3 months. OK?
    So, there are also consensus policies that are built into 
the agreement--OK?--which continually change the raising of the 
bar for the security standards. OK? This is a very fluid 
requirement. And if we take--for example, 2 years ago, when I 
worked on the NRIC Council, OK, on cybersecurity, we made 150 
recommendations for what companies ought to do to reinforce 
cybersecurity. The following year, we made 250. OK? We will 
never know, at any snapshot in time, what that number's going 
to be, or what it's going to equate to. But we have increased 
capacity 10,000 times. We have 10,000 times the capacity today 
that we had in 2000. OK? And that still is not enough. OK? And 
I can't predict to you what it's going to be in 2012. OK? But 
in terms of cost justification--OK?--this is really--this 
really boils down to security and stability. When we need to 
spend the money, we need to spend the money. OK? And we can't 
go to our competitors and ask them for permission to spend it.
    Senator Smith. Well, please be clear, I'm not saying the 
price increase is justified or not. I'm simply inquiring, 
because I want to make the point to you that this is one of the 
areas of concern. Usually when you have just one provider, you 
have a potential monopoly, and that requires regulation. I'm 
not a regulator.
    Mr. Silva. Right.
    Senator Smith. But I am saying that with a monopoly, 
without regulation, there has got to be some sort of market 
test, and I think people are going to be looking to you to 
justify these levels of increases. And it may be entirely 
warranted. I'm not making a judgment on that. But it is an area 
of real concern.
    Mr. Silva. Right. So, I think, in this particular case--
OK?--that is what is built into the agreement, is a cap on the 
amount that they can, in fact, be raised. OK? So, for 7 years 
they weren't raised at all. OK? Not at all. OK? Even though the 
number of registrations grew at a specific rate--OK?--the 
threats and the volume of traffic that we see, just in normal 
traffic--OK?--security issues aside, the security issues are so 
phenomenally higher, in terms of the volume of activity that we 
see, over what we register as new names--OK?--6 months ago--or, 
excuse me--so, 8 months ago, I would have told you that, yes, 
you know, it's perfectly reasonable, we could probably forecast 
out a couple of years what we would need. And then all of a 
sudden January came, and we got hit with an attack ten times 
larger than anything we would have expected. And I can tell you 
right now that when I briefed the Department of Homeland 
Security, and when I held a classified briefing with the Senate 
Intelligence Committee on exactly what this threat meant, not 
only to our system, but to their systems--OK?--they took this 
very seriously. National Infrastructure Protection Plan calls 
for private industry to make significant investments where they 
control critical infrastructure. We plan on making those 
critical investments. And basically that's what these 
provisions are for, so that when all of a sudden Windows 
VistaTM comes out--and experts have said that that 
could as much as double the amount of DNS traffic--we're able 
to respond to it in a timely fashion.
    Senator Smith. I wish we had more time to go on with this, 
but I'm going to miss a vote if I don't adjourn this hearing. 
I, again, apologize for my delay, and I thank my colleagues for 
proceeding, out of respect for your time. We thank you for your 
contribution to this hearing. And we have more to learn and 
more to do, because this is an enormously important topic.
    So, with that, we thank you and we're adjourned.
    [Whereupon, at 11:30 a.m., the hearing was adjourned.]
                            A P P E N D I X

  Prepared Statement of Hon. Gordon H. Smith, U.S. Senator from Oregon
    I call to order this hearing of the Senate Subcommittee on Trade, 
Tourism, and Economic Development.
    Today's hearing considers Internet governance and the future of 
ICANN.
    In 1997, the Secretary of Commerce was directed by the President to 
privatize the management of the domain name system in a manner that 
increases competition and facilitates international participation in 
its management.
    Soon thereafter the Department of Commerce signed an official 
Memorandum of Understanding recognizing ICANN--the Internet Corporation 
for the Assignment of Names and Numbers, as the new, not-for-profit 
corporation to manage the domain name system.
    Under the terms of the MOU, ICANN has the authority to:

        1. Set policy for, and direct the allocation of, the IP 
        addresses that underlie each domain name.

        2. Oversee the operation of an authoritative root server 
        system,

        3. Set the policies for determining how new top level domains 
        would be added to the root system; and

        4. Coordinate the assignment of the Internet technical 
        parameters needed to maintain the universal connectivity of the 
        Internet.

    The MOU between the Department of Commerce and ICANN expires on 
September 30, 2006 among controversy in the international community.
    Some are suggesting that no single government should have a 
preeminent role in relation to the Internet and are calling for further 
internationalization of Internet governance.
    This would be a mistake. The current system for management of the 
domain name system works. The Secretary of Commerce should maintain 
oversight of ICANN so that ICANN can continue to manage the day-to-day 
operation of the Internet's domain name and addressing system and 
remain responsive to all Internet stakeholders worldwide.
    Today's hearing will examine the management and governance of 
ICANN, including the future of the Domain Name System, recent concerns 
expressed regarding the current ICANN-VeriSign settlement agreement, 
and privacy issues surrounding the ``WHOIS'' database.
    I thank all of our witnesses for rearranging their schedules to 
appear before the Subcommittee and look forward to your testimony.
                                 ______
                                 
  Response to Written Questions Submitted by Hon. Daniel K. Inouye to 
                            John M.R. Kneuer
    Question 1. As part of the settlement of a long-running dispute 
between ICANN and VeriSign, the ICANN Board of Directors approved a new 
dot-corn agreement with VeriSign. Under this settlement, VeriSign will 
be in charge of the dot-com registry until 2012 (with a presumption 
that the agreement will be renewed beyond that date), and will be able 
to raise domain registration fees by 7 percent in four of the next 6 
years. Critics of the settlement assert that the agreement is 
anticompetitive, giving VeriSign a virtually permanent monopoly over 
the lucrative dot-com registry, while also enabling VeriSign to raise 
registration fees without justification.
    Many critics of the settlement agreement argue that the presumptive 
renewal clause would allow VeriSign to hold on to the dot-com registry 
in perpetuity. How do you see ICANN holding the registry operator 
accountable without the strong leverage of awarding the contract to a 
competing operator?
    Answer. Over the course of the past 6 months, I and other Commerce 
Department officials have met with a number of interested stakeholders 
including registrars, Internet service providers, and search engine 
companies with interests in or concerns about the .com Registry 
Agreement. The concerns have largely focused on the impact on 
competition of the proposed price increase for registrations permitted 
by the new agreement and the terms for future renewals of the new .com 
Registry Agreement. The Commerce Department has sought the advice of 
the Antitrust Division of the Justice Department on the competition 
concerns raised.
    It is also important to note that other interested stakeholders 
have advocated that the renewal terms of the proposed agreement benefit 
the security and stability of the Internet domain name system. We have 
also consulted with those Federal agencies with expertise in the areas 
of security and stability on this matter.
    Based on the information that we have gathered, I am confident that 
any decision made by the Department will appropriately balance all of 
these interests to ensure the continued stability and security of the 
Internet domain name system and of promoting the consumer benefits of a 
competitive marketplace.

    Question 2. One of ICANN's primary missions is to promote 
competition. How does a presumptive renewal clause promote competition?
    Answer. As noted above, the Department is reviewing the proposed 
new agreement in its entirety to ensure both the continued stability 
and security of the Internet domain name system and of promoting the 
consumer benefits of a competitive marketplace.

    Question 3. Cybersecurity is a critical mission that all 
organizations struggle with. How can ICANN ensure that the registry 
operators are making the necessary security enhancements to guarantee 
the stability of the domain name system? How can ICANN hold a registry 
operator accountable?
    Answer. Cybersecurity standards are developed by various industry 
organizations, such as the Internet Engineering Task Force (IETF), ISO, 
and IEEE, and adherence to the various standards is voluntary for the 
most part. While ICANN is not a standards organization, it promotes the 
adoption of industry standards through its agreements with registry 
operators to comply with these standards. Registry agreements address 
the technical performance obligations, including compliance with the 
various industry-developed standards, security requirements and outage 
reporting that all registry operators must meet. In addition each 
registry agreement contains a service level agreement which clearly 
sets forth the registry operator's obligation for failure to meet the 
technical performance specifications.

    Question 4. Assuming that NTIA approves the settlement agreement, 
what mechanisms would ICANN have available to ensure that it has 
meaningful control over the service quality or conduct of registry 
operators?
    Answer. Like any commercial agreement between private sector 
parties, the proposed new .com Registry Agreement contains enforcement 
provisions. It also contains quality of service commitments that ICANN 
can enforce under the terms of the agreement.

    Question 5. The settlement agreement allows VeriSign to raise 
domain registration fees by 7 percent in four out of 6 years without 
having to provide a justification. Do you believe that a registry 
operator should be required to publicly justify any price increases?
    If no--Why not? Doesn't a registry operator enjoy a monopoly over 
the pricing for a specific top-level domain?
    If yes--What concerns do you have with the VeriSign settlement that 
would allow it to increase prices by 7 percent four out of 6 years 
without having to provide a justification? How is such a clause not 
anticompetitive?
    Answer. The domain name marketplace is not a regulated one. Prices 
are set based on negotiations between private sector parties. The price 
cap for .com registrations and price adjustments permitted under the 
proposed new .com Registry Agreement were negotiated by ICANN and 
VeriSign.
    Nevertheless, the Commerce Department is aware of the concerns 
raised primarily by the registrar community about the impact of a price 
increase on their industry. We have been in consultation with the 
Antitrust Division on this issue and will be guided by its advice in 
any final decision the Department makes.

    Question 6. Do you think it is reasonable for a registry operator 
to explain to ICANN their reasons for a price increase, and then have 
ICANN approve or reject such a proposal accordingly?
    What criteria is used to evaluate price increases? Specifically, 
under what circumstances would an automatic price increase without 
justification be acceptable?
    Answer. As noted above, the domain name marketplace is not a 
regulated one. Prices are set based on negotiations between private 
sector parties. To introduce government price regulation would be a 
significant departure from the status quo and massive introduction of 
government regulations that does not currently exist into a private 
marketplace.

    Question 7. I understand the Department of Justice's Antitrust 
Division was asked to review the settlement agreement. Can you share 
with us the Division's concerns? How are these concerns being 
addressed? Were there recommendations or suggestions made that are not 
being implemented or considered?
    Answer. During its review of the proposed new .com Registry 
Agreement, the Commerce Department has sought the advice of the 
Antitrust Division of the Justice Department regarding the impact on 
competition of the proposed price increase for registrations permitted 
by the new agreement and the terms for future renewals of the revised 
new .com Registry Agreement. The Antitrust Division has been gathering 
information from the parties, interested stakeholders, and others on 
these issues, to provide its analysis and advice to the Department on 
any competition issues that may be raised by the proposed agreement. We 
expect to rely on this advice to evaluate the potential impact on 
competition of this agreement.

    Question 8. Are you open to bringing together the different 
stakeholders in order to arrive at a solution that will satisfy the 
different parties and still ensure the promotion of competition?
    Answer. In addition to its consultation with the Department of 
Justice's Antitrust Division regarding the competition issues raised by 
the proposed new .com Registry Agreement, I and other Commerce 
Department and Antitrust Division officials have met with a number of 
interested stakeholders, including registrars, Internet service 
providers, search engine companies, among others, with interests in or 
concerns about the agreement. The Commerce Department has also heard 
from a number of stakeholders advocating the benefits of the new 
agreement for the security and stability of the Internet domain name 
system. We have also heard from Members of Congress on both sides of 
the issue. Commerce Department and Antitrust Division officials have 
been gathering information from proponents and opponents of the 
agreement and I am confident that this information will be taken into 
consideration in any final decision that is made.

    Question 9. Transparency has long been a concern with ICANN. Many 
critics argue that the ICANN Board operates behind closed doors, even 
though the organization is charged with developing consensus through a 
``bottom-up'' approach. Can you comment on ICANN's transparency issues? 
How has this improved over the years? How can the organization continue 
to improve?
    Answer. The Department has long considered transparency to be a 
fundamental principle to ICANN's overall mission and function. The 
current Memorandum of Understanding (MOU) was structured to ensure that 
ICANN becomes a sufficiently stable, transparent, representative, and 
sustainable management organization capable of handling the important 
tasks associated with the technical management of the Internet domain 
name system into the future. This MOU also contains specific provisions 
intended to improve transparency, efficiency, and timeliness in the 
consideration and adoption of policies. While ICANN has made several 
improvements in its decisionmaking and policy development processes, as 
well as in internal reviews and evaluations of these processes, I 
believe ICANN is mindful of the need for continual improvement. The 
Department's recent public consultation process has revealed strong 
support from a majority of interested stakeholders for a more specific 
focus on transparency and accountability in ICANN's internal procedures 
and decision-making processes.

    Question 10. The ICANN Board has proposed new contract agreements 
for the operators of dot-biz, dot-info, and dot-org. The contracts for 
dot-biz and dot-info are not up for renewal until next year and dot-org 
isn't to be renewed until 2009. The public was not aware that 
negotiations were taking place until ICANN posted the proposed 
agreements for public comment. Can you comment on ICANN's transparency 
in developing the proposed agreements for the dot-biz, dot-info, and 
dot-org top-level domains (TLDs)?
    One element of the newest proposal is to allow for differential 
pricing of domain names. Can you explain the public policy rationale 
behind allowing a registry to apply a differential pricing scheme for 
specific domain names?
    Is there concern that a registry could limit free speech by 
charging an unreasonable fee to register a domain name critical of 
political party, public figure, or issue?
    Answer. The proposed new registry agreements for the .biz, .org, 
and .info top level domains are commercial agreements between private 
sector parties. As I understand it, under the terms of the existing 
agreements, the parties can mutually agree to amend or enter into new 
agreements. The Department of Commerce has not examined the pricing 
provisions of these agreements. ICANN has posted all three agreements 
for comments from interested stakeholders. I expect ICANN will fully 
consider the interests of all interested stakeholders as it negotiates 
these agreements.

    Question 11. Last year NTIA urged ICANN to reject the creation of a 
dot-xxx top level domain. Under pressure from the U.S. Government, and 
much to the consternation of the international community as a result, 
ICANN ultimately rejected the dot-xxx domain. Can you describe NTIA's 
involvement in rejecting the creation of a dot-xxx top level domain?
    Answer. In June 2005, the ICANN Board of Directors approved the 
initiation of negotiations between ICANN staff and ICM Registry, the 
applicant for the .xxx domain. Beginning in July 2005, ICANN's 
Governmental Advisory Committee (GAC) began to raise questions 
regarding the procedure followed by the Board in reviewing the 
application and its rationale for entering into contract negotiations. 
On August 11, 2005, then-NTIA Assistant Secretary Michael D. Gallagher 
sent a letter to ICANN's Chairman of the Board requesting that ICANN 
take into consideration all comments it received during its 
consideration of this application (see letter to Dr. Vinton Cerf, 
attached).
    In response to the GAC's request for additional information and 
requests from other governments, ICANN released its comprehensive 
Evaluation Report on all of the sponsored top level domain applications 
in November 2005. The ICANN Board elected to defer consideration of the 
.xxx application pending a review of the Report by the GAC.
    The GAC considered the report and additional information during its 
March 2006 meeting in Wellington, New Zealand prior to the ICANN Board 
meeting there. The GAC conveyed its views and concerns to the Board 
through a communique. As part of the process in developing that 
communique, I sent a letter dated March 20, 2006, to the GAC Chairman 
expressing concerns about ICANN's ability to obtain the public policy 
benefits promised by the applicant absent enforceable contract terms in 
the proposed .xxx Registry Agreement (see letter to Mr. Sharil Tarmizi, 
attached).
    On May 10, 2006, the ICANN Board of Directors made a final decision 
to disapprove the pending application from ICM Registry to manage the 
proposed .xxx top level domain.
                              Attachments
  U.S. Department of Commerce--The Assistant Secretary for 
                             Communications and Information
                                  Washington, D.C., August 11, 2005
Dr. Vinton Cerf,
Senior Vice President, Technology Strategy,
MCI
Ashburn, VA.

Dear Dr. Cerf:

    I understand that the Board of Directors of the Internet 
Corporation for Assigned Names and Numbers (ICANN) is scheduled to 
consider approval of an agreement with the ICM Registry to operate the 
.xxx top level domain (TLD) on August 16, 2005. I am writing to urge 
the Board to ensure that the concerns of all members of the Internet 
community on this issue have been adequately heard and resolved before 
the Board takes action on this application.
    Since the ICANN Board voted to negotiate a contract with ICM 
Registry for the .xxx TLD in June 2005, this issue has garnered 
widespread public attention and concern outside of the ICANN community. 
The Department of Commerce has received nearly 6,000 letters and e-
mails from individuals expressing concern about the impact of 
pornography on families and children and opposing the creation of a new 
top level domain devoted to adult content. We also understand that 
other countries have significant reservations regarding the creation of 
a .xxx TLD. I believe that ICANN has also received many of these 
concerned comments. The volume of correspondence opposed to creation of 
a .xxx TLD is unprecedented. Given the extent of the negative reaction, 
I request that the Board will provide a proper process and adequate 
additional time for these concerns to be voiced and addressed before 
any additional action takes place on this issue.
    It is of paramount importance that the Board ensure the best 
interests of the Internet community as a whole are fully considered as 
it evaluates the addition of this new top level domain. Thank you for 
your attention to this matter.
        Sincerely,
                                      Michael D. Gallagher.

        cc: Dr. Paul Twomey

  U.S. Department of Commerce--The Assistant Secretary for 
                             Communications and Information
                                   Washington, D.C., March 20, 2006
Mr. Sharil Tarmizi,
Senior Advisor, Office of the Chairman,
Malaysian Communications and Multimedia Commission;
Chair, Government Advisory Committee of ICANN,
Selangor Darul Ehsan, Malaysia.

Dear Mr. Tarmizi,

    Pursuant to the ICANN Government Advisory Committee (GAC) meeting 
in Vancouver in November 2005, the Department of Commerce has 
undertaken an analysis of the proposed .xxx Registry Agreement to 
determine whether its provisions reflect the commitments made by ICM 
Registry. As you will recall, the ICM Registry presentation to the GAC 
outlined in some detail the anticipated public interest benefits of its 
application for the .xxx top level domain.
    The attached assessment indicates that the key commitments offered 
by ICM Registry to the GAC are not reflected in the provisions of the 
proposed .xxx Registry Agreement. In your capacity as GAC Chair and GAC 
liaison to the ICANN Board, NTIA would appreciate your sharing this 
information with both the GAC and the Board prior to the Wellington, 
New Zealand meeting.
        Sincerely,
                                          John M.R. Kneuer,
                                        Acting Assistant Secretary.

        cc: Mr. Paul Twomey.
Omissions in the Proposed .xxx Registry Agreement
    In its application, supporting materials, and presentation to the 
Governmental Advisory Committee in November 2005, ICM Registry (ICM) 
promised certain public interest benefits as part of its bid to operate 
the .xxx domain. These promises, however, have not been included in the 
proposed .xxx Registry Agreement negotiated with ICANN, and thus, ICM 
is not obligated to provide these public interest benefits. Section 
8.12 of the .xxx Registry Agreement provides in pertinent part: ``This 
Agreement (including its Appendices, which form a part of it) 
constitutes the entire agreement of the parties hereto pertaining to 
the operation of the TLD and supersedes all prior agreements, 
understandings, negotiations and discussions, whether oral or written, 
between the parties on that subject.'' Thus, if ICM is not required to 
provide the public interest benefits by the terms of its registry 
agreement, it is not obligated to do so.
    Below is a sample of the ICM promises that do not appear in the 
proposed .xxx Registry Agreement:
    To Form a Nonprofit Policy Development Entity to Create Rules for 
.xxx. In the .xxx application, ICM stated that it formed a nonprofit 
Canadian entity (International Foundation for Online Responsibility 
(IFFOR)) to develop rules and policies to govern a new .xxx domain. ICM 
Application, Part B, at 2-5, 7-13. The proposed .xxx Registry Agreement 
does not require ICM to form or maintain this nonprofit entity or to 
abide by any .xxx rules it would establish. Instead, the proposed .xxx 
Registry Agreement delegates all policy development authority for .xxx 
to ICM. In fact, the proposed .xxx Registry Agreement provides that the 
IFFOR Board will not be created until the day that the agreement is 
signed and will not be in place until 90 days after signing. See .xxx 
Registry Agreement, Appendix S. Moreover, IFFOR is not a party to the 
proposed .xxx Registry Agreement.
    To Require .xxx Registrants to adhere to Best Business Practices as 
a condition of .xxx registration. ICM promised that IFFOR would develop 
rules to this effect (ICM Application, at 3, 16). There is no 
requirement to do so in the proposed .xxx Registry Agreement and IFFOR 
is not a party to this agreement.
    To Require all .xxx Registrations to be ICRA Labeled. In its 
presentation to the ICANN Government Advisory Committee, November 29, 
2005, ICM promised that it would require all .xxx registrations to be 
labeled according to the Internet Content Ratings Association (ICRA) 
ratings to permit filtering of content. ICM further promised that any 
website that points to a .xxx site must also be ICRA labeled. There is 
no provision in the proposed .xxx Registry Agreement that would 
obligate 1CM to require such labeling.
    To Safeguard Children Online. ICM promised that IFFOR would sponsor 
the development of technology tools and education programs for parents. 
(ICM Application, at 3, 16; The Sponsored .xxx TLD Proposals: Executive 
Summary for the ICANN Board, at 2). ICM also promised that IFFOR would 
fund the participation of independent advocates for children (ICM 
Letter to ICANN, October 9, 2004, at 17). These promises are not 
reflected in ICM's obligations in the proposed .xxx Registry Agreement 
and IFFOR is not a party to this agreement.
    To Combat Child Pornography. ICM promised that IFFOR would provide 
funding and tools to combat online child pornography and to prohibit 
child pornography in the .xxx domain as defined by international law. 
(ICM Application, at 3; ICM Letter to ICANN, August 15, 2005, at 2; 
ICM's Responses to Evaluators' Questions, Question 2). This promise is 
not reflected in ICM's obligations in the proposed .xxx Registry 
Agreement and IFFOR is not a party to the agreement.
    To Implement a WHOIS Compliance Program. In its application (ICM 
Application, at 20-21), ICM promised to document false and inaccurate 
WHOIS data and to implement additional verification processes. This 
promise is not reflected in ICM's obligations in the proposed .xxx 
Registry Agreement.
    To Provide Funds for Global Child Initiatives. ICM promised to give 
IFFOR $10 per .xxx domain name so that IFFOR can make some of this 
funding available for global child advocacy community targeted 
especially to eradicate child pornography. (ICM Memorandum to the ICANN 
Board of Directors, November 2, 2004, revised December 7, 2004, at 5). 
ICM also promised that IFFOR would provide grants to developing 
countries in the area of child online protection. (ICM's Responses to 
Evaluators' Questions, Question 7). There is no obligation in the 
proposed .xxx Registry Agreement for ICM to fund IFFOR or for IFFOR to 
provide this kind of financial assistance to child advocacy groups or 
developing countries. Moreover, IFFOR is not a party to the .xxx 
Registry Agreement.
    To Prohibit Child Exploitation including Requiring Proof of Age of 
Actors Portrayed in Content in .xxx Domain. In its presentation to 
ICANN's Board, April 3, 2005, ICM promised that this prohibition would 
appear as part of its registration agreement with .xxx domain name 
holders. There is no obligation in the proposed .xxx Registry Agreement 
to this effect.
    To Promote Responsible Marketing Practices by Requiring .xxx 
Registrants to Agree to Combat SPAM and Not Use Malicious Codes and 
Technologies (i.e., Spoofing) and other Illegal and Questionable 
Marketing Practices. ICM Presentation to ICANN, April 3, 2005; White 
Paper, Thinking Outside the Porn Box, Annex B, ICM's Intentions. There 
is no obligation in the proposed .xxx Registry Agreement to this 
effect.
                                 ______
                                 
  Response to Written Questions Submitted by Hon. Daniel K. Inouye to 
                           Christine N. Jones
    Question 1. Many of the concerns about the proposed VeriSign-ICANN 
agreement are coming from other registrars. The transfer of the dot-com 
registry to VeriSign would affect other registry services as a whole. 
How do the presumptive renewal and guaranteed price increases included 
in the proposed agreement concern registrars?
    Answer. In the current environment, allowing .com prices to 
increase without cost justification is anti-competitive. .Com still has 
considerable market power making up 75 percent of all registered gTLD 
domain names and 80 percent of the ongoing market share. The price 
increases allowed in the proposed agreement will net VeriSign over $1 
Billion in incremental revenue based on current growth projections, all 
of which will be passed on directly to consumers, registrars' 
customers.
    VeriSign has repeatedly stated that it needs these additional funds 
to ensure the stability and security of the .com DNS. We have no 
problem with that, but ask then that at the very least VeriSign be 
required to demonstrate that need when requesting all price increases, 
and be required to invest a significant portion of the additional funds 
in the .com DNS infrastructure.
    We explain our concerns with the presumptive renewal in our 
response to the next question.

    Question 2. Would the proposed agreement possibly hinder ICANN's 
ability to become an autonomous body by relinquishing a substantial 
amount of control over the dot-com registry?
    Answer. If ICANN's mission continues to include ensuring the 
security and stability of the Internet's Domain Name System (DNS), then 
yes.
    The .com DNS is arguably the most important element of the Internet 
DNS. Yet the proposed agreement basically hands the responsibility of 
the security and stability of the .com DNS entirely over to VeriSign, 
leaving ICANN very little recourse if there are problems. The form of 
presumptive renewal being proposed in the agreement allows VeriSign to 
breach it, even repeatedly, with little more than financial penalties 
as long as they cure the breaches. There is also no requirement for 
VeriSign to invest in the .com DNS infrastructure.
    However, under the current agreement, the conditions of presumptive 
renewal would allow ICANN to make a determination as to VeriSign's 
continued ability to manage the .com DNS and to provide a substantial 
service to the Internet community (Section 25.B). Breaches of the 
agreement and its service level requirements in particular, would 
certainly be a factor in that determination. The current agreement also 
required VeriSign to make substantial investments in the DNS 
infrastructure it was contracted to manage, $200 million to be exact.
    .Com is too important to simply assume that giving VeriSign a 
perpetual renewal without conditions will be incentive enough to ensure 
they continue operating it responsibly, or that they will make the 
necessary infrastructure investments to ensure stable and secure 
operations. ICANN, at a minimum, must allow itself an out to re-bid 
.com if VeriSign fails to continue to meet the conditions as stated in 
25.B of its current agreement, and must require VeriSign to make 
substantial investments in the .com DNS infrastructure.

    Question 3. What concerns would the reduced control over the dot-
com registry and its security measures raise for the registrar 
community?
    Answer. The reduced control, as a result of the strengthened form 
of presumptive renewal, demonstrates an assumption that ICANN is 
making--that VeriSign will continue to qualify as registry operator for 
.com and will continue to invest in its infrastructure appropriately. 
.Com is too important to make such assumptions regardless of VeriSign's 
past performance. Investment requirements, cost justifications for 
price increases, and the potential for eventual re-bid would be far 
more motivating and provide the Internet community better assurance of 
reliable performance of its most important gTLD.
                                 ______
                                 
  Response to Written Questions Submitted by Hon. Daniel K. Inouye to 
                          Hon. Jon Leibowitz *
---------------------------------------------------------------------------
    * The written testimony submitted for the September 20, 2006 
hearing reflects the views of the Federal Trade Commission (``FTC'' or 
``Commission''). However, my responses to these post-hearing questions 
reflect my own views and do not necessarily reflect the views of the 
Commission or of any other Commissioner.
---------------------------------------------------------------------------
    Question 1. What effect would the lack of competition and price 
controls have on competition in the marketplace?
    Answer. Your question raises important issues about the effects of 
anticompetitive conduct and, as I understand it, specifically relates 
to the competitive effects of the proposed settlement agreement between 
ICANN and VeriSign, Inc. (the ``VeriSign Settlement Agreement'' or 
``Agreement'').
    Generally, consumers benefit from unfettered competition in the 
marketplace. Consequently, the FTC seeks to prevent business practices 
that restrain competition--including agreements among competitors to 
limit competition, attempts to monopolize an industry through unfair or 
exclusionary practices, and anticompetitive mergers and acquisitions. 
However, each case requires a careful evaluation of the challenged 
business practice.
    In regard to the competitive implications of the VeriSign 
Settlement Agreement, the Department of Commerce (DOC) and the 
Department of Justice (DOJ) are both already considering this issue. 
Pursuant to agreements among DOC, VeriSign, and ICANN, the VeriSign 
Settlement Agreement is subject to DOC' s approval. DOC has consulted 
with interested stakeholders about the Agreement and has sought DOJ' s 
advice on its competitive effects. I am aware that Senators Hatch and 
Leahy have sent letters to the Secretary of Commerce highlighting the 
goal of open competition and the importance of DOJ' s guidance with 
respect to whether the VeriSign Settlement Agreement has any potential 
anticompetitive effects. I understand that DOC and DOJ are analyzing 
the competitive implications of the Agreement and assessing its effects 
on both stakeholders within the ICANN community and on American 
consumers.

    Question 2. What concerns do the lack of justification behind the 
guaranteed price increases raise for you?
    Answer. Again, my understanding is that your question relates to 
the VeriSign Settlement Agreement, which DOC and DOJ are currently 
reviewing.

    Question 3. Worldwide attention is focused on ICANN and its role in 
Internet governance. Many nations frustrated over the slow progress 
toward ICANN autonomy are proposing individual governance of the 
Internet. How would the proposed VeriSign agreement affect the road 
toward autonomy for ICANN?
    Answer. As your question aptly points out, we need to strike the 
right balance to ensure that ICANN's passage to autonomy progresses as 
quickly as possible--but also responsibly. To this end, DOC has a Joint 
Project Agreement with ICANN to facilitate the transition of the domain 
name system to the private sector. Pursuant to this agreement, DOC 
advises ICANN on how to improve its transparency and accountability. It 
also monitors whether ICANN effectively considers competition interests 
in top-level domain management decisions. As part of its periodic 
review process, DOC will evaluate relevant factors, including, if 
necessary, the effects of the VeriSign Settlement Agreement, when 
considering when to complete the privatization of the domain name 
system.

    Question 4. If ICANN does not make strides toward the goals of 
transparency, bottom-up management, representation, and stability in a 
more timely manner than it has, how do you think this could effect the 
progress made at the World Summit on the Information Society?
    Answer. I agree that transparency, bottom-up management, 
representation, and stability are important goals for ICANN to pursue 
and could help instill increased confidence in ICANN on the 
international stage. One key to ensuring transparency and stability is 
ensuring continued access to WHOIS databases, as the Commission 
advocated in its testimony on September 20, 2006.
    I am aware that the international community is focused on ICANN and 
Internet governance as a result of discussions in the World Summit on 
Information Society--and that relevant stakeholders--including DOC, the 
Department of State, and ICANN--are working hard to try to satisfy all 
relevant interests. As to a specific assessment of the progress ICANN 
has made, DOC continues to monitor ICANN's progress in achieving the 
important goals you have identified.

    Question 5. How would an unstable political environment affect 
domain name system (DNS) security and stability?
    Answer. Preserving the security and stability of the Internet is 
critical. One issue that the FTC advocates as a means of preserving the 
security and stability of the Internet is continued access to WHOIS 
domain name registration data. An unstable political environment could 
lead to a decision not to provide WHOIS data to law enforcement and to 
the public. This would have extremely negative consequences for 
consumers in the United States and elsewhere, who want agencies like 
ours to bring actions against Internet malefactors that attempt to 
defraud them or that threaten their privacy.
                                 ______
                                 
  Response to Written Questions Submitted by Hon. Daniel K. Inouye to 
                               Ken Silva
    This submission is respectfully submitted on behalf of Mr. Silva in 
response to the questions posed by the Senate Commerce Committee 
following the hearing on September 20, 2006.
    For purposes of background to its responses, VeriSign provides the 
following brief summary of the operation of the Internet and the 
functional distinctions between domain name registries and domain name 
registrars.
Background
    The Internet is a network of interconnected computers and computer 
networks. Every computer connected directly to the Internet has a 
unique address. These addresses, which are known as Internet Protocol 
(``IP'') numbers, are necessary for computers to ``communicate'' with 
each other over the Internet. An example of an IP number might be: 
98.27.241.30. Because IP numbers can be cumbersome and difficult for 
Internet users to remember or to use, the IP number system has been 
overlaid with a more ``user-friendly'' system of domain names: the 
Internet domain name system, or ``DNS''. This overlay associates a 
unique alpha-numeric character string--or domain name--with a specific 
IP number.
    Internet domain names consist of a string of ``domains'' separated 
by periods. ``Top-level'' domains, or ``TLDs,'' are found to the right 
of the period and include (among others) ``.com,'' ``.gov,'' ``.net,'' 
and ``.biz,'' which are sometimes referred to as ``generic'' TLDs (also 
known as ``gTLDs''). Other top-level domains are referred to as country 
code TLDs (also known as ``ccTLDs''), and are represented by two-letter 
abbreviations for each country, such as ``.uk'' (United Kingdom) and 
``.ca'' (Canada), and .eu (Europe). gTLDs are functionally equivalent 
to ccTLDs. There are approximately 250 top-level domains, which are 
administered and operated by numerous entities, both in and outside of 
the United States.\1\
    ``Second-level'' domains (SLDs) are those domains immediately to 
the left of the top-level domain, such as ``senate'' in the domain name 
``senate.gov.'', or ``aol'' in ``aol.com.'' There are approximately 100 
million second-level domains currently registered within the various 
TLDs.
    Because domain names are essentially ``addresses'' that allow 
computers connected to the Internet to communicate with each other, 
each domain name must be unique, even if it differs from another domain 
name by only one character (e.g., ``uscourts.com'' is different from 
``uscourt.com'' or ``us-courts.com''). A given domain name, therefore, 
can be registered to only one entity.
    VeriSign acts as the ``registry'' for domain names registered in 
the .com gTLD in accordance with a written agreement with ICANN and 
through its cooperative agreement with the U.S. Department of Commerce. 
Among the other services VeriSign performs as the ``registry'' for the 
.com gTLD, VeriSign maintains the definitive directory that associates 
registered domain names in this gTLD with the corresponding IP numbers 
of their respective domain name servers. The domain name servers, in 
turn, direct Internet queries to resources such as websites and e-mail 
systems. Under the DNS architecture, one given domain name is 
essentially associated by domain name servers with one IP number or 
distinct computer.
    For technological reasons, the uniqueness requirements of the DNS 
architecture described above, mandate that there can only be one entity 
that operates any TLD registry that maintains the authoritative 
database of domain names registered in a particular TLD. Accordingly, 
there can be only one registry operator for .com.
    A domain name is created by an individual or organization that 
registers the domain name and thereby includes it in the registry's 
master database. The individual or organization that registers a 
specific domain name is a ``registrant.'' Registrants do not have 
direct access to the VeriSign registry. Instead, prospective 
registrants must register domain names through any one of over 800 
private companies located in the United States and throughout the world 
that are accredited by, and enter into a Registrar Accreditation 
Agreement with ICANN to act as domain name ``registrars'' for the 
second-level domain names in the .com gTLD. While there can be only one 
registry for each TLD, there are hundreds of registrars and thousands 
of resellers around the world who sell these domain name registrations 
to end users.
    Registrars, not registries, sell domain names to registrants, or 
consumers. There are no restrictions by ICANN or the government upon 
the price for which registrars sell domain name services to 
consumers.\2\ Nearly all domain name registrars that provide domain 
registration services for the .com gTLD also provide domain name 
registration services for other gTLDs and ccTLDs. For example, 
according to its website, GoDaddy.com, one of the largest Internet 
domain name registrars, offers prospective registrants the ability to 
register SLDs in 29 gTLDs and ccTLDs in addition to the .com gTLD. 
Domain name registrars set their own prices for domain name 
registration services and the prices registrants are charged by domain 
name registrars to register a domain name within the same TLD vary 
widely.
    Registrars provide direct services to registrants and prospective 
registrants, such as processing domain name registrations. The VeriSign 
registry has no contractual or other relationship with a registrant. 
This means that VeriSign has no information as to the identity of a 
registrant. Conversely, registrars have a contractual relationship with 
registrants and keep all information regarding the registrants.
    Regardless of the price paid for a domain by an end user to a 
Registrant, the name works the same technically on the Internet. The 
Registries who operate these top level domains are responsible for 
ensuring that queries from around the world to that domain are answered 
(``resolved'') when executed. The volume of these queries is dictated 
by the growth of online users around the world and their increased 
usage of the Internet. Over the last decade, the number of users and 
usage of the Internet has grown at a pace that far outstrips the 
corresponding growth in the number of domain names registered 
worldwide. The ease of use for a user going online (i.e., access to 
broadband and wireless devices that are Internet-enabled), access to 
online content in non-English languages, and the meaningfulness of 
content online are the key drivers of Internet usage. Even during the 
historical slowing of domain name registration sales during the 
``bust'' of the Internet bubble, usage continued to increase.

    Question 1. Security is a significant concern of stakeholders and 
Internet users at large. How do you address concerns about the 
registrar's lack of a disaster recovery plan?
    Answer. The lack of effective disaster recovery for registrars, 
along with the absence of registrar security requirements, is a cause 
for serious concern. Historically, in the absence of stringent security 
requirements for registrars as part of their ICANN Accreditation 
Agreements, registries, such as VeriSign, have been the safety net for 
registrar security deficiencies. Under the current structure of ICANN 
Registrar Accreditation Agreements, registrars have no incentive to, 
and do not, invest in the security or stability of the DNS. 
Accordingly, the work of insuring the operational security and 
stability of the DNS falls to registries in general, and VeriSign in 
particular for .com, through continued and significant investment 
beyond that required in current contracts.
    In light of the lack of infrastructure investments by registrars, 
VeriSign supports adding requirements to the ICANN Registrar 
Accreditation Agreements of registrars to fill the security and 
stability void in those agreements and to establish obligations in the 
Registrar Accreditation Agreements that provide ICANN with the ability 
to address security and stability issues (for example through a 
flexible Consensus Policy provision such as that currently provided for 
in Section 3.1 of the proposed .com Registry Agreement). The Registrar 
Accreditation Agreement is not part of the proposed .com Registry 
Agreement.
    Since the question above explicitly deals with the disaster 
recovery systems of Registrars, we have provided, below, answers 
related to the contractual requirement of data escrow/disaster 
recovery, which is a core component to ensure proper disaster recovery.
    Registrars maintain all personal end-user data related to the sale 
of a domain name which is needed to fully recover the ownership of 
domain. The registries maintain all data related to the technical 
elements of the domain's status and location on the Internet, but no 
personal data. The Registrar Accreditation Agreement, to which all 
ICANN-accredited registrars are parties with ICANN, includes a 
contractual requirement that the registrar maintain an escrow of the 
registrar specific data related to their registrations. (Registrar 
Accreditation Agt., Sect. 3.4).\3\
    A similar obligation exists for the registry operator in the .com 
registry agreement to maintain registry level data as noted above (but 
no personal data). In particular, the registry operator is required to 
establish at its expense a data escrow or mirror site for registry data 
compiled by the registry operator. (Registry Agt., Sect. 3.1(c)(i)).\4\ 
Further specific details of this extensive, structured mirror site 
obligation are set forth in Appendix 1 and Appendix 2 to the .com 
Registry Agreement. In summary, the obligation requires that the 
registry operator establish an escrow account to deposit a complete set 
of all data identified in section 3.1(c)(i) of the .com Registry 
Agreement to the data escrow provider on a daily and weekly basis. The 
data is verified by the escrow provider for completeness, accuracy, and 
format accuracy to avoid any risk of a failure to restore due to data 
corruption. In addition, the schedule, content, format, and procedure 
for escrow may be changed by ICANN as conditions warrant or through 
establishment of Consensus Policies. The intent of the mirror site 
obligation is to encapsulate registry operations and identified data 
into a single escrow file available to a third party for escrow storage 
and recovery.\5\
    VeriSign is compliant with all requirements to provide updates in 
escrow (as explained more fully in response to Question 3). Through a 
time-proven process, it has a verifiable record of delivering 
completeness, correctness and integrity of the data within each escrow 
file. VeriSign completes daily and weekly deposits of reports and meta-
data for all .com domain names.
    Further, VeriSign has a demonstrated record of compliance with its 
escrow obligations and of continual monitoring of related issues. For 
example, VeriSign switched providers of its escrow services in December 
2005 because it became apparent that most large gTLD registrars were 
using the same offsite data storage provider which was regarded as a 
possible single point of failure in the system. VeriSign believed that 
this circumstance created a risk to the community at large and, 
therefore, initiated a community discussion of this risk, and proposed 
a transition in its service to an alternate provider to eliminate the 
overlap. The new provider was reviewed and approved by ICANN before the 
transition was made.
    As explained more fully in response to Question 3 below, the 
proposed .com Registry Agreement also includes other substantial, 
detailed requirements to ensure the secure and stable operation of the 
.com registry, including thorough oversight by and accountability to 
ICANN. For example, the proposed .com Registry Agreement expressly adds 
the further contractual requirement that the registry operator take 
those steps necessary to protect all personal data from loss, misuse, 
unauthorized disclosure, alteration or destruction and includes monthly 
data reporting requirements, together with ICANN audits of such 
reporting. (Registry Agt., Sect. 3.1(c)(ii)).

    Question 2. Does VeriSign have a plan to address these security 
concerns?
    Answer. As explained above, VeriSign acts as the ``registry'' (not 
the registrar) for domain names registered in the .com gTLD in 
accordance with a written agreement with ICANN. Accordingly, as 
explained in response to Question 1, VeriSign does not have control 
over any of the 800 registrars or their disaster recovery plans or 
security or stability deficiencies.
    However, the work of ensuring security and stability to make up for 
this gap falls to the registries. VeriSign regularly conducts failure 
mode analyses on all of the .com registry systems. This includes 
testing to insure the mitigation of risks occurring due to possible 
failures in hardware and software, the network layer, security systems, 
facility-related issues, and environmental factors. As a financially 
sound, U.S.-based, public company, with robust technical capabilities, 
VeriSign has a carefully developed plan for data recovery, including 
provisions for DNS restoration and data retrieval, and provisions to 
facilitate system reconstitution.
    VeriSign believes that the best place to address registrar security 
concerns is through the addition of contractual obligations to the 
Registrar Accreditation Agreements of registrars, such as the inclusion 
of flexible Consensus Policy language such as the provision currently 
included in Section 3.1 of the proposed .com Registry Agreement, which 
gives ICANN the power to address security and other issues. Topics for 
such policies and discussions could include registrar business 
continuity, disaster recovery and periodic accreditation compliance 
audit.

    Question 3. Under the proposed agreement VeriSign has no 
accountability to ICANN regarding security measures. How will VeriSign 
ensure the safety of the DNS?
    Answer. The premise of this question is not based on the facts of 
the proposed .com Registry Agreement as the proposed Agreement not only 
provides substantial accountability to ICANN for insuring the security 
and stability of the registry and DNS, it increases the accountability 
over what is currently called for in existing registry agreements that 
have controlled the operation of the registry during the preceding 8 
years. Under the preceding agreements, VeriSign has maintained 100 
percent availability of the .com TLD for 8 years, an unparalleled 
record in Internet security and stability.
    Under the proposed .com Registry Agreement, VeriSign is 
contractually obligated to maintain 100 percent availability of the DNS 
systems for the .com gTLD. (Registry Agt., (Sect. 3.1(d)(ii), App. 7, 
Sect. 7). In order to meet this obligation, VeriSign must take all 
steps necessary to maintain the secure and stable operation of the DNS. 
In fact, numerous provisions of the proposed agreement are specifically 
directed to insuring compliance with this contractual obligation, 
including by placing particular and detailed obligations on the 
registry operator and providing for ongoing ICANN oversight. The 
following provisions of the proposed agreement, for example, are 
cumulative in their requirements:
    VeriSign is obligated to meet detailed functional and performance 
specifications incorporated into the contract in the form of Appendix 
7. (Registry Agt., Sect. 3.1(d)(ii)). These contract requirements were 
established by experts and standards bodies within the Internet 
community in order to create a secure and stable DNS. The registry 
operator also is required to maintain technical and operational 
records, for inspection and audit by ICANN, sufficient to insure 
compliance with these specifications. (Id.).\6\
    The proposed agreement further provides a process for changes in 
the contractual operational specification or policies affecting the 
registry through the development of Consensus Policies by ICANN, and 
the Internet community, during the existence of the agreement. This 
process for the adoption of Consensus Policies is expressly intended to 
allow for the continual monitoring and updating of policies affecting 
the registry in order to insure ongoing security and stability in 
response to changing conditions. (Registry Agt., Sect. 3.1(b)). 
Pursuant to such provisions, for example, contractual operational 
specifications on the registry operator may be changed during the term 
of the contract as necessary to meet changing conditions affecting the 
security or stability of the DNS or registry database. (Id.). Moreover, 
unlike the existing .com Registry Agreement, or the Registrar 
Accreditation Agreements, the proposed agreement adds important 
flexibility to the process for adopting Consensus Policies by allowing 
the process itself to be changed during the term of the contract 
consistent with the requirements of ICANN's Bylaws.\7\
    Similarly, the proposed .com Registry Agreement provides procedures 
for ICANN to adopt, on an emergency basis, new policies necessary to 
maintain the stability or security of the DNS. (Registry Agt., Sect. 
3.1(a)(i)). The precondition for the exercise of this power by ICANN is 
the determination of the ICANN Board that the change is necessary to 
maintain the security or stability of the DNS. (Id.).\8\ This process 
is an additional oversight and accountability mechanism of substantial 
breadth.
    Therefore, neither the process for the adoption of Consensus 
Policies, nor the contractual specifications intended to address 
security and stability, are frozen in place by the contract. Instead, 
the proposed agreement specifically allows for monitoring and changing 
requirements on the registry operator as necessary to address the 
changing requirements for the security or stability of the DNS. 
(Registry Agt., Sect. 3.1(b)(ii)). These flexible procedures provide 
extraordinary oversight and accountability, including to address new 
security and stability concerns.
    The proposed .com Registry Agreement also substantially expands 
ICANN's oversight, and VeriSign's accountability to ICANN, over changes 
in registry services or new services introduced by the registry 
operator, prior to such changes being implemented. Such oversight 
includes reviews of changing services by DNS experts and public review 
and comment periods. (Registry Agt., Sect. 3.1(d)(iv)). This process 
for assessing changes in registry services has been used by ICANN as a 
model for other new registry agreements, including .net and .mobi, 
among others. There is no comparable process in the existing .com 
Registry Agreement.
    For example, before a change in registry services may be 
implemented by the registry operator, including the introduction of new 
services, information regarding the service and potential security and 
stability implications must be provided to ICANN. ICANN thereafter has 
the right to review the service, including by seeking advice by experts 
on whether the service might have implications for the security or 
stability of the DNS. ICANN further has the right to submit the 
proposed change to a standing panel of experts to conduct a more 
detailed analysis of the service prior to its adoption by the registry 
operator. The panel consists of 20 persons expert in the design, 
management and implementation of complex systems and standards-
protocols utilized in the Internet infrastructure and DNS. In the event 
the proposed change is submitted to the standing panel, the panel shall 
invite public comment on the proposed change. If it is determined that 
the proposed change creates a reasonable risk of an adverse affect on 
security or stability, the registry operator will not implement the 
change.
    The proposed .com Registry Agreement further requires a twice 
annual security and stability review by ICANN of issues regarding 
security and stability affecting the registry. (Registry Agt., 
Sect.3.1(g)). This requirement does not exist in the current agreement.
    The proposed .com Registry Agreement requires the registry operator 
to establish at its expense a data escrow or mirror site policy for 
registry data compiled by the registry operator. (Registry Agt., Sect. 
3.1(c)(i)). The operator is required regularly to deposit into the 
escrow all registry data. The proposed agreement also expressly 
requires the registry operator to take steps to protect all personal 
data from loss, misuse, unauthorized disclosure, alteration or 
destruction. (Registry Agt., Sect. 3.1(c)(ii)).
    In addition to these contractual provisions providing 
accountability, VeriSign also engages in other briefings and security 
activities with ICANN and the Internet community. Currently, VeriSign 
partners with Department of Homeland Security, National Security 
Administration and other governmental parties regularly to brief these 
agencies on the stability and security of the overall DNS and to give 
timely updates and detailed information regarding attacks and their 
impact on the Internet infrastructure. VeriSign considers this sharing 
of information and coordination of data important to the overall 
stability of the DNS.
    VeriSign's technical staff further participates, including by 
holding key positions in Internet standards and security groups, 
including Root Server System Advisory Committee (RSSAC), Security and 
Stability Advisory Committee (SSAC), Internet Engineering Task Force 
(IETF), Internet Security Alliance (ISA), Information Technology--
Information Sharing and Analysis Center (IT-ISAC), National 
Infrastructure Protection Center (NIPC), Network Reliability and 
Interoperability Council (NRIC) and National Security 
Telecommunications Advisory Committee (NSTAC). Such open forums enable 
discussion and development of critical design considerations for 
changes to the architecture of the DNS and Internet, both at the root 
level and the interoperability of third-party systems and applications. 
VeriSign staff has authored numerous RFCs that define the myriad of 
standards, features, and best practices of DNS management, security and 
operations. Through one of these organizations, the IETF, for example, 
VeriSign has initiated, shaped and refined the standards for DNS 
Security Extensions, an important issue in shaping future Internet 
security.
    Therefore, the proposed agreement provides multiple, cumulative 
requirements on the registry operator to insure the stability and 
security of the registry, provide oversight by ICANN, and ensure 
accountability to ICANN.

    Question 4. How will VeriSign justify the costs of improvements to 
security systems without accountability to ICANN?
    Answer. As explained in response to Question 3 above, the proposed 
.com Registry Agreement provides multiple, cumulative requirements on 
the registry operator to insure the stability and security of the 
registry, provide oversight by ICANN, and ensure accountability to 
ICANN. The proposed agreement explicitly requires VeriSign to meet 
detailed specifications and other obligations designed to insure a 
secure and stable .com registry. VeriSign has served as the operator of 
the .com registry since its beginnings in 1992. During this period, 
VeriSign established an unparalleled record in operating a secure and 
stable registry. The proposed .com Registry Agreement not only 
contractually obligates VeriSign to continue to meet that standard, the 
proposed agreement explicitly provides for increased oversight by ICANN 
and the Internet community, through Consensus Policies and other 
provisions, to insure that the operator continues to meet, as it has in 
the past, the changing requirements for security and stability for the 
registry and DNS.
    VeriSign has been a leader in Internet and DNS security throughout 
its tenure as the operator of the .com registry. It has participated in 
industry boards that have helped establish the security and stability 
requirements for the Internet and DNS. VeriSign also has participated 
in government reviews with the Department of Homeland Security and 
National Security Administration, among other governmental security 
organizations, aimed at developing a coordinated security strategy for 
the Internet.
    From the founding of the DNS through today, VeriSign has invested 
hundreds of millions of dollars in creating a secure DNS 
infrastructure, including as the volume of Internet traffic has grown 
10,000-fold during just the years 2000 through present. No other 
operator has ever created or run a registry of this magnitude.
    The express terms of the proposed .com Registry Agreement establish 
substantial and detailed accountability for the operation of the .com 
registry. Moreover, under the proposed agreement, VeriSign is 
contractually obligated to maintain 100 percent availability of the DNS 
systems for the .com gTLD. (Registry Agt., (Sect. 3.1(d)(ii), App. 7, 
Sect. 7). In order to meet this obligation, VeriSign must take all 
steps necessary to maintain the secure and stable operation of the DNS. 
In fact, numerous provisions of the proposed agreement are specifically 
directed to insuring compliance with this contractual obligation, 
including by placing particular and detailed obligations on the 
registry operator and providing for ongoing ICANN oversight as 
explained in response to Question 3. Further, VeriSign's consistent 
performance since the founding of the DNS, a record spanning more than 
a decade, establishes beyond any reasonable doubt that VeriSign is 
motivated to continue to invest in and maintain a secure and stable 
.com registry, a necessity to meet its performance obligations under 
the .com Registry Agreement.
    ICANN has carefully considered the issue of improvements to 
security and stability and the methods to insure investment. Cost-based 
price regulation is complex, costly, and inefficient in the context of 
preemptive investment in the security and stability of the DNS. As a 
result, regulators have been moving away from such strict, command-and-
control regulation. Such regulation would be particularly harmful in 
light of the need for preemptive investment in the security and 
stability of the DNS. The type of investment that needs to be made is 
critical and often unpredictable until after the consequences of an 
attack are known. The type of work that needs to be done requires 
strategic, critical, and preemptive investment that if delayed or 
derailed by cost justification assessment models would come too late to 
have an effect. Setting a reasonable price cap that allows for some 
limited price flexibility, together with the extensive price 
protections in place in the agreement, strikes the right balance 
between providing the incentive and flexibility needed for efficient, 
ongoing, investment to protect security and stability while protecting 
consumers.
    As explained more fully in response to Question 5, those price 
protections include among others, the prohibition on VeriSign from 
discriminating in price among registrars or their customers, the 
requirement that VeriSign give registrars 6 months' notice of proposed 
price increases,\9\ and the requirement to allow registrations for 
terms up to 10 years. This provision was included in the proposed .com 
Registry Agreement specifically to allow registrants to lock in current 
prices for up to 10 years and thereby avoid the impact of any proposed 
price increase even if the registrant choose not to avail themselves of 
competitive alternatives. (Registry Agt., Sect. 7.3(f)).\10\
    ICANN has adopted this carefully considered framework as its model 
for registry operator agreements. In fact, this model already has been 
implemented with respect to the 2005 .net Registry Agreement, over a 
year ago, and the .mobi Registry Agreement.

    Question 5. According to the provisions of the proposed agreement, 
VeriSign can increase prices up to 7 percent in most years, resulting 
in an overall price increase of up to 31 percent in 6 years. The 
proposed agreement includes presumptive renewal and guaranteed price 
increases in most years. How does VeriSign respond to claims of 
creating a monopoly environment?
    Answer. VeriSign appreciates the opportunity to clear up some 
misconceptions about the effects of the proposed .com Registry 
Agreement on competition. This agreement has been subject to an 
extensive and thorough competitive review by the Department of Commerce 
with the assistance of the Antitrust Division of the Department of 
Justice. VeriSign and ICANN have worked in concert with these 
Departments. As a result, the proposed agreement is one which promotes 
the security and stability of the Internet by providing the incentives 
and contractual feasibility to make necessary investments in the .com 
infrastructure. Additionally, the proposed agreement includes specific 
provisions providing for increased oversight by ICANN of services 
provided by the registry, including the adoption of a more efficient 
consultative process with clearer guidelines to allow VeriSign to 
introduce changes to or new registry services that can benefit the 
Internet community and the public, while allowing ICANN to review any 
security, stability and competitive affects of such services prior to 
their introduction.
    Price Increases: It is important to recognize that VeriSign does 
not set the prices that consumers and businesses pay for domain name 
registrations. Those prices are set by hundreds of independent domain 
name registrars, some of whom charge as much as $35 for a domain name, 
while paying VeriSign, the registry operator, only $6 to provide for 
operation of the domain name on the Internet. VeriSign's price to 
registrars for registering .com domain names has been contractually 
frozen at $6 since 1999. The new .com agreement provides VeriSign some 
limited flexibility to raise prices at the registry level but it does 
so under conditions that are tailored to protect registrars and their 
customers by leveraging important market forces.
    The .com registry requires substantial investment in 
infrastructure, and the demands on that infrastructure are ever 
increasing, due to rapidly increasing use of the Internet and the 
growing and more sophisticated attacks on Internet security that were 
described at the hearing. \11\ As explained above, VeriSign has 
invested hundreds of millions of dollars in creating a secure DNS 
infrastructure, including while the volume of Internet traffic has 
grown 10,000-fold during just the years 2000 through present. As the 
registry operator, VeriSign must bear the entire burden of those 
investments, and the only source of funding is the .com registry fees. 
A freeze on those fees would chill incentives and jeopardize the 
ability to fund needed investments.
    The proposed .com Registry Agreement balances the interest in 
removing inflexible price controls against the needs of registrars by 
strictly limiting the amount and rate of price increases by VeriSign as 
well as providing additional safeguards. Thus, VeriSign will only be 
permitted to increase the price of .com registrations by a maximum of 7 
percent and only in four of the six years of a contract term. Thus, by 
the end of 2012, and assuming VeriSign actually takes the maximum price 
increases permitted by the agreement, the cost of a .com domain name 
registration to registrars would be only $7.86.
    Other provisions of the agreement also operate to provide 
safeguards for consumers. While there can only be one operator of the 
.com or any other TLD registry, there is competition among numerous TLD 
registries for the business of domain name registrants. There are over 
250 TLD registries worldwide. Most domain name registrants can choose 
among many generic TLDs (gTLDs) such as .com, .biz, .info, .org, .net, 
and others, and also have choices from among country code TLDs (ccTLDs) 
such as .de, .uk, .jp, .us and many others--including the recently 
introduced .eu for registrants with activity anywhere in the European 
Union. Many domain registrars promote these different TLDs as 
competitive alternatives for their customers. If registrars view .com 
as unduly expensive, they can use pricing and promotion to steer 
registrants to other TLDs. Building on such competitive facts, 
provisions of the proposed .com Registry Agreement leverage competitive 
market forces to protect consumers.
    First, the proposed .com Registry Agreement expressly prohibits 
VeriSign from discriminating in price among registrars or their 
customers. (Registry Agt., Sect. 7.3(e)). \12\ VeriSign cannot charge a 
higher price for renewals of a .com domain name registration than it 
charges for a new registration. It cannot charge U.S. registrants/
registrars a higher price than it charges foreign registrants/
registrars. Seventy five percent of the growth in Internet usage is 
occurring outside the U.S. and it is estimated that over 60 percent of 
all domain name registrations come from non-U.S. registrants. More than 
half the domain names worldwide are registered in TLDs other than .com. 
Thus, the ongoing competition to attract new registrants to .com--
particularly in foreign countries, where .com lags behind ccTLDs and 
where the overwhelming growth in Internet use and domain name 
registration is occurring--will force VeriSign to set its prices for 
all registrants at a level dictated by competitive forces worldwide. At 
the same time, increasing competition from search, keywords and new 
Internet navigation methods constrain domain name pricing.
    Second, the proposed .com Registry Agreement includes a provision 
requiring VeriSign to give registrars 6 months' notice of proposed 
price increases, and to allow registrations for terms up to 10 years at 
the existing price. This provision was included in the agreement 
specifically to allow registrants to lock in current prices for up to 
10 years and thereby avoid the impact of a proposed price increase even 
if they choose not to avail themselves of competitive alternatives. 
(Registry Agt., Sect. 7.3(f)). \13\
    Therefore, while VeriSign for technical reasons must be the sole 
operator of the .com registry, it is not a ``monopoly'' in terms of 
competitive choices to consumers. The provisions of the .com Registry 
Agreement gradually relax the 8-year freeze on VeriSign's pricing, but 
set strict caps on future price increases and include terms that in any 
circumstances would prevent VeriSign from charging a supracompetitive 
price for domain name registrations.
    Strict price controls are strongly disfavored as a matter of public 
policy. Even in cases where firms have dominant market shares, and 
their market position stems in part from governmental grants, price 
controls are often eschewed. \14\ Given the competitive forces at work, 
allowing VeriSign some carefully limited pricing flexibility is plainly 
in the public interest, especially given that unlike most contracts, 
the .com Registry Agreement allows ICANN, through the adoption of 
Consensus Policies, to change the operational performance requirements 
for the registry, or require it to provide new services.
    Presumptive Renewal: The renewal provisions of the proposed .com 
Registry Agreement are virtually identical to the renewal provisions in 
the existing agreement, which were approved by the Department of 
Commerce in 2001. Both require renewal absent a material breach of the 
agreement or other circumstances not present here. The existing 
agreement also specifically provides that this presumptive renewal 
provision ``shall be included in any renewed Registry Agreement.'' 
Consistent with renewal models in other infrastructure industries, 
presumptive renewal is representative of the renewal model ICANN is 
pursuing in its registry agreements generally, as set out in the .net 
and .mobi agreements.
    The 2001 .com Registry Agreement provides that the agreement 
``shall be'' renewed absent a material breach of the agreement. (2001 
Registry Agt., Sect. 25). \15\ With respect to the provision concerning 
a breach of the registry agreement, the existing and proposed 
agreements contain minor differences. Unlike the existing agreement, 
the proposed agreement provides that a neutral arbitrator must 
determine that the registry operator is in breach of the agreement 
before such a dispute over contractual performance may be the basis for 
denying renewal. This change is designed to protect VeriSign from the 
potential loss of its investment in the registry based on a good faith 
disagreement as to whether particular conduct may be within the scope 
of the agreement, or the possible use of a claim of breach to extract 
concessions under the contract. Disagreements regarding the 
interpretation of the registry agreement have arisen between ICANN and 
VeriSign from time to time in the past. The change is thus necessary to 
resolve potential uncertainties in performance of the registry 
agreement. Certainty in the operation of the registry is necessary to 
allow ongoing investment in the DNS infrastructure.
    The proposed .com Registry Agreement also allows VeriSign an 
opportunity to cure a breach, which is a standard term of commercial 
contracts, especially important to contractual certainty in a changing 
environment for contractual performance such as the Internet. The same 
clause has been adopted for this same reason in other registry 
agreements, such as the .net and .mobi Registry Agreements.
    Accordingly, there has been no loss of a previously existing 
opportunity for competitive bidding to replace VeriSign as the operator 
of the .com registry in the absence of material and uncured breach by 
VeriSign.
    The right to renewal of the .com agreement so long as VeriSign 
lives by its terms is an enforceable contract right that VeriSign 
already has. Such a provision is critical in order to allow the 
registry operator to make the ongoing and substantial investment in the 
DNS infrastructure necessary to its stability and security.
    Despite the claims from self-interested opponent registrars, the 
proposed .com Registry Agreement does not make any significant change 
in VeriSign's existing contractual rights to retain its role as the 
.com registry operator so long as it is performing in accord with the 
requirements of the agreement. The explicit terms of the existing 
agreement require that it be renewed upon its expiration and that the 
renewal agreement include a similar provision.
    Presumptive renewal, or a renewal expectancy, is a common feature 
of contracts, licenses and franchises that involve long-term 
investments for some public purpose. Such terms are used in varying 
ways in broadcast, cable, satellite and other communications licenses, 
utility franchises and other similar agreements. Without a renewal 
expectancy, a firm would find it difficult to justify making 
substantial investments that would take a long time to recoup. With 
only a 6-year contract term, and with capped prices, an economically 
rational registry operator would think long and hard about investing 
millions of dollars in new infrastructure and systems to meet emerging 
security threats or to respond to increased demand caused by new 
Internet business models, such as the substantial (and largely 
unremunerated) demands caused by domain name speculators and pay-per-
click advertising businesses. A rational registry operator that did not 
have a secure renewal expectancy might well defer such investments, 
particularly toward the end of the contract term, and then promise to 
make them as part of a renewal bid. Such a framework would undermine 
the security and stability of the DNS. Moreover, renewal expectancy 
provides distinct benefits for consumers in the form of quality of 
service as well as a minimized risk of service disruption due to an 
arbitrary change in an underlying operator that has provided 
satisfactory levels of service.
    VeriSign has been a highly reliable steward of the .com registry 
for over 8 years. It has provided unmatched reliability under the most 
demanding conditions--unlike the problems experienced by firms 
operating even much smaller and less demanding registries. Competition 
from other TLD registries will continue to force VeriSign to keep .com 
competitive. It would be short-sighted to destroy the renewal 
expectancy, there is no competitive reason to do so, and it would be a 
violation of the express terms of the existing registry agreement.

    Question 6. How will the exclusion of competition affect pricing 
elsewhere in the Internet registry market?
    Answer. As the answer to Question 5 demonstrates, the .com 
agreement will not exclude competition. There can be only one registry 
for the .com TLD or for each of the other more than 250 registries 
worldwide. The proposed .com Registry Agreement, therefore, will 
neither eliminate any competition that would otherwise have existed nor 
will it create monopoly power. Rather it carefully regulates the terms, 
including the price, on which VeriSign can provide domain name 
registrations and other registry services to registrars. Within the 
constraints of the proposed agreement, VeriSign's pricing will continue 
to be affected by the competitive pricing and service offerings of 
other competitive registries, particularly as VeriSign seeks to assist 
registrars in penetrating growing geographic markets in Asia, Europe, 
Latin America and the rest of the world, and as the registry competes 
for new domain name registrations in addition to renewal registrations, 
which must be priced in a nondiscriminatory manner. Likewise, 
innovative services from VeriSign will stimulate competition from those 
other registries and benefit domain name registrars and registrants in 
the U.S. and around the world.

    Question 7. What strength is there to the VeriSign claims that not 
renewing its contract will be a detriment to DNS security?
    Answer. Currently, .com is under constant attack from hackers who 
realize the economic devastation that would result if businesses that 
use the Internet to conduct business via IP-based transactions (banks, 
brokerage houses, stock exchanges, online commerce) were to lose the 
ability to connect to one another via the Internet. For example, NASD, 
the London Stock Exchange, Chase Bank and Citibank run on .com name 
servers. Additionally, all of the agencies reliant upon .gov sites are 
reliant upon .com as the resolution provider for all .gov names is 
routed through a .com server. In February 2005, the World Bank 
Operations and Policy Department issued a paper which outlined the 
development of capital markets and eFraud. The paper reviewed several 
case studies of fraud perpetrated upon various financial systems around 
the word. The common component of the study reveals that the world's 
economic models more and more heavily rely upon IP-based transactions. 
While hackers attempt to penetrate these institutions at various 
levels, including the private hardware and software of banks, it is 
important to note that malicious attacks against the core 
infrastructure providers of the DNS are the most malicious way to 
attack the broadest segment of the financial institutions of this 
country. Financial institutions are just one example of a meaningful 
U.S. business sector reliant upon the stability of the DNS.
    As explained in response to Question 5, due to the large ongoing 
investments currently required in the development and maintenance of 
the DNS infrastructure, such uncertainty would negatively impact the 
willingness of registry operators to make the investments necessary to 
guarantee a secure and stable registry, especially toward the end of a 
registry term.
    The express terms of the existing 2001 .com Registry Agreement 
require renewal. More specifically, Section 25 of the agreement 
explicitly provides that the agreement ``shall be'' renewed (absent a 
material breach of the agreement, which is not present here) and that 
this renewal clause shall be included in the renewal agreement. A 
failure to comply with the renewal terms would constitute a breach of 
the registry contract contrary to law. Equally fundamental, a failure 
to comply with such terms, which are included in other registry 
agreements as well as the 2001 .com Registry Agreement, would interject 
damaging uncertainty into the performance of such agreements.
    Furthermore, only VeriSign has demonstrated an ability to operate 
in a secure and stable manner a registry of the magnitude of the .com 
registry, as explained above. ICANN explicitly adopted such a finding 
in November 2005. \16\ Unlike any other registry operator, VeriSign has 
operated the .Com registry, the largest Internet registry, at 100 
percent availability (with no interruption of service) for the last 8 
years. Thus, there would be inherent risks to the security and 
stability of the DNS in failing to renew the agreement (as its express 
terms require) and transitioning the operation of the registry to a new 
and necessarily untested operator.
Endnotes
    \1\ Examples of TLDs available around the world include: .info, 
.org, com, .travel, .mil, .us, .biz, .net, info, .name, .bz, .jp, eu, 
.uk, .de, .kr, .mobi, .asia, .museum, .pro, .jobs, .edu, .gov. Norid, 
the .no registry, has a complete list of worldwide domains at http://
www.norid.no/domenenavnbaser/domreg.html.

    \2\ For example, registrars today offer a .com domain for prices 
from $1.99 to $1,000 within packages and as stand alone sales. Domain 
name registrations are accepted by Registrars from end-users for terms 
of 1 (one) year to one-hundred (100) years. The registrars 
differentiate themselves from one another based upon value added 
services, customer service and some compete upon price. Regardless of 
the registrar model, the registry wholesale price for a .com name, as 
set in the ICANN contract with VeriSign is currently $6.00. This is the 
``wholesale'' rate. The average ``retail'' rate charged for a .com 
domain today is $21.00.

    \3\ The Registrar Accreditation Agreement provides as follows:

        ``3.6 Data Escrow. During the Term of this Agreement, on a 
        schedule, under the terms, and in the format specified by 
        ICANN, Registrar shall submit an electronic copy of the 
        database described in Subsection 3.4.1 to ICANN or, at 
        Registrar's election and at its expense, to a reputable escrow 
        agent mutually approved by Registrar and ICANN, such approval 
        also not to be unreasonably withheld by either party. The data 
        shall be held under an agreement among Registrar, ICANN, and 
        the escrow agent (if any) providing that (1) the data shall be 
        received and held in escrow, with no use other than 
        verification that the deposited data is complete, consistent, 
        and in proper format, until released to ICANN; (2) the data 
        shall be released from escrow upon expiration without renewal 
        or termination of this Agreement; and (3) ICANN's rights under 
        the escrow agreement shall be assigned with any assignment of 
        this Agreement. The escrow shall provide that in the event the 
        escrow is released under this Subsection, ICANN (or its 
        assignee) shall have a nonexclusive, irrevocable, royalty-free 
        license to exercise (only for transitional purposes) or have 
        exercised all rights necessary to provide Registrar Services.''

    http://www.icann.org/registrars/ra-agreement-17may01.htm#3.

    \4\ The .com Registry Agreement Provides as follows:

        ``Data Escrow. Registry Operator shall establish at its expense 
        a data escrow or mirror site policy for the Registry Data 
        compiled by Registry Operator. Registry Data, as used in this 
        Agreement, shall mean the following: (1) data for domains 
        sponsored by all registrars, consisting of domain name, server 
        name for each nameserver, registrar id, updated date, creation 
        date, expiration date, status information, and DNSSEC-related 
        key material; (2) data for nameservers sponsored by all 
        registrars consisting of server name, each IP address, 
        registrar id, updated date, creation date, expiration date, and 
        status information; (3) data for registrars sponsoring 
        registered domains and nameservers, consisting of registrar id, 
        registrar address, registrar telephone number, registrar e-mail 
        address, WHOIS server, referral URL, updated date and the name, 
        telephone number, and e-mail address of all the registrar's 
        administrative, billing, and technical contacts; (4) domain 
        name registrant data collected by the Registry Operator from 
        registrars as part of or following registration of a domain 
        name; and (5) the DNSSEC-related material necessary to sign the 
        .com zone (e.g., public and private portions of .com zone key-
        signing keys and zone-signing keys). The escrow agent or 
        mirror-site manager, and the obligations thereof, shall be 
        mutually agreed upon by ICANN and Registry Operator on 
        commercially reasonable standards that are technically and 
        practically sufficient to allow a successor registry operator 
        to assume management of the TLD. To this end, Registry Operator 
        shall periodically deposit into escrow all Registry Data on a 
        schedule (not more frequently than weekly for a complete set of 
        Registry Data, and daily for incremental updates) and in an 
        electronic format mutually approved from time to time by 
        Registry Operator and ICANN, such approval not to be 
        unreasonably withheld by either party. In addition, Registry 
        Operator will deposit into escrow that data collected from 
        registrars as part of offering Registry Services introduced 
        after the Effective Date of this Agreement. The escrow shall be 
        maintained, at Registry Operator's expense, by a reputable 
        escrow agent mutually approved by Registry Operator and ICANN, 
        such approval also not to be unreasonably withheld by either 
        party. The schedule, content, format, and procedure for escrow 
        deposits shall be as reasonably established by ICANN from time 
        to time, and as set forth in Appendix 1 hereto. Changes to the 
        schedule, content, format, and procedure may be made only with 
        the mutual written consent of ICANN and Registry Operator 
        (which neither party shall unreasonably withhold) or through 
        the establishment of a Consensus Policy as outlined in Section 
        3.1(b) above. The escrow shall be held under an agreement, 
        substantially in the form of Appendix 2, as the same may be 
        revised from time to time, among ICANN, Registry Operator, and 
        the escrow agent.''

    .Com Registry Agt., Sect. 3.1(c)(i); http://www.icann.org/topics/
vrsn-settlement/revised-com-agreement-clean-29jan06.pdf.

    \5\ http://www.icann.org/tlds/agreements/verisign/registry-agmt-
app1-22sep05.pdf; http://www.icann.org/tlds/agreements/verisign/
registry-agmt-app2-22
sep05.pdf.
    \6\ For example, the .com Registry Agreement provides for reporting 
and audit with associated penalties:

        ``Functional and Performance Specifications. Functional and 
        Performance Specifications for operation of the TLD shall be as 
        set forth in Appendix 7 hereto, and shall address without 
        limitation DNS services; operation of the shared registration 
        system; and nameserver operations. Registry Operator shall keep 
        technical and operational records sufficient to evidence 
        compliance with such specifications for at least 1 year, which 
        records ICANN may audit from time to time upon reasonable 
        advance written notice, provided that such audits shall not 
        exceed one per quarter. Any such audit shall be at ICANN's 
        cost.''

    Registry Agt., Sect. 3.1(d)(ii).

        ``Monthly Reporting. Within 20 days following the end of each 
        calendar month, Registry Operator shall prepare and deliver to 
        ICANN a report providing such data and in the format specified 
        in Appendix 4. ICANN may audit Registry Operator's books and 
        records relating to data contained in monthly reports from time 
        to time upon reasonable advance written notice, provided that 
        such audits shall not exceed one per quarter. Any such audit 
        shall be at ICANN's cost, unless such audit shall reflect a 
        material discrepancy or discrepancies in the data provided by 
        Registry Operator. In the latter event, Registry Operator shall 
        reimburse ICANN for all costs and expenses associated with such 
        audit, which reimbursement shall be paid together with the next 
        Registry-Level Fee payment due following the date of 
        transmittal of the cost statement for such audit.''

    Registry Agt., Sect. 3.1(c)(iv).
    \7\ The provision provides as follows:

        ``Consensus Policies.

        (i) At all times during the term of this Agreement and subject 
        to the terms hereof, Registry Operator will fully comply with 
        and implement all Consensus Policies found at http://
        www.icann.org/general/consensus-policies.htm, as of the 
        Effective Date and as may in the future be developed and 
        adopted in accordance with ICANN's Bylaws and as set forth 
        below.

        (ii) ``Consensus Policies'' are those specifications or 
        policies established (1) pursuant to the procedure set forth in 
        ICANN's Bylaws and due process, and (2) covering those topics 
        listed in Section 3.1(b)(iv) below. The Consensus Policy 
        development process and procedure set forth in ICANN's Bylaws 
        may be revised from time to time in accordance with ICANN's 
        Bylaws, and any Consensus Policy that is adopted through such a 
        revised process and covering those topics listed in Section 
        3.1(b)(iv) below shall be considered a Consensus Policy for 
        purposes of this Agreement.

        (iii) For all purposes under this Agreement, the policies 
        identified at http://www.icann.org/general/consensus-
        policies.htm shall be treated in the same manner and have the 
        same effect as ``Consensus Policies.''

        (A) Consensus Policies and the procedures by which they are 
        developed shall be designed to produce, to the extent possible, 
        a consensus of Internet stakeholders, including the operators 
        of gTLDs. Consensus Policies shall relate to one or more of the 
        following: (1) issues for which uniform or coordinated 
        resolution is reasonably necessary to facilitate 
        interoperability, Security and/or Stability of the Internet or 
        DNS; (2) functional and performance specifications for the 
        provision of Registry Services (as defined in Section 
        3.1(d)(iii) below); (3) Security and Stability of the registry 
        database for the TLD; (4) registry policies reasonably 
        necessary to implement Consensus Policies relating to registry 
        operations or registrars; or (5) resolution of disputes 
        regarding the registration of domain names (as opposed to the 
        use of such domain names). . . .
    \8\ That provision states as follows:

        ``Preserve Security and Stability.

        ICANN Temporary Specifications or Policies. Registry Operator 
        shall comply with and implement all specifications or policies 
        established by the ICANN Board of Directors on a temporary 
        basis, if adopted by the ICANN Board of Directors by a vote of 
        at least two-thirds of its members, so long as the ICANN Board 
        of Directors reasonably determines that immediate temporary 
        establishment of a specification or policy on the subject is 
        necessary to maintain the Stability or Security (as defined in 
        Section 3.1(d)(iv)(G)) of Registry Services or the DNS 
        (`Temporary Specification or Policies'). Such proposed 
        specification or policy shall be as narrowly tailored as 
        feasible to achieve those objectives. In establishing any 
        specification or policy under this provision, the ICANN Board 
        of Directors shall state the period of time for which the 
        specification or policy is temporarily adopted and shall 
        immediately implement the Consensus Policy development process 
        set forth in ICANN's Bylaws. ICANN shall also issue an advisory 
        statement containing a detailed explanation of its reasons for 
        adopting the temporary specification or policy and why the 
        Board believes the specification or policy should receive the 
        consensus support of Internet stakeholders. If the period of 
        time for which the specification or policy is adopted exceeds 
        90 days, the ICANN Board shall reaffirm its temporary adoption 
        every 90 days for a total period not to exceed 1 year, in order 
        to maintain such policy in effect until such time as it shall 
        become a Consensus Policy as described in Section 3.1(b) below. 
        If during such 1 year period, the temporary policy or 
        specification does not become a Consensus Policy meeting the 
        standard set forth in Section 3.1(b) below, Registry Operator 
        shall no longer be required to comply with or implement such 
        temporary policy or specification.''

    \9\ ``No price discrimination. Registry Operator shall charge the 
same price for Registry Services subject to this Section 7.3, not to 
exceed the Maximum Price, to all ICANN-accredited registrars (provided 
that volume discounts and marketing support and incentive programs may 
be made if the same opportunities to qualify for those discounts and 
marketing support and incentive programs is available to all ICANN-
accredited registrars).'' Registry Agt., Sect. 7.3(e).

    \10\ ``Adjustments to Pricing for Domain Name Registrations. 
Registry Operator shall provide no less than 6 months prior notice in 
advance of any increase for new and renewal domain name registrations 
and for transferring a domain name registration from one ICANN-
accredited registrar to another and shall continue to offer for periods 
of up to 10 years new and renewal domain name registrations fixed at 
the price in effect at the time such offer is accepted. Registry 
Operator is not required to give notice of the imposition of the 
Variable Registry-Level Fee set forth in Section 7.2(c).'' Registry 
Agt., Sect. 7.3(f).

    \11\ The Shared Registration System (SRS) is the system maintained 
by VeriSign as the .com registry operator that allows multiple 
registrars to register and modify domain names in the registry 
database. That, however, is only one component of VeriSign's 
obligations under the .com Registry Agreement. VeriSign also must 
maintain Domain Name System (DNS) up-time and availability. The DNS is 
what makes the domain name ``work'' as a resource or locator on the 
Internet. Stated another way, the DNS is what enables you as an 
Internet user to simply type in a domain name on your computer, such as 
``verisign.com,'' and connect it over the Internet to the machine that 
hosts the proper website. The receipt of DNS queries or ``look-ups'' 
for a particular domain name is separate from the SRS or its operation. 
Were the DNS to fail, the Internet would not work. Were the SRS to 
fail, traffic would still move over the Internet. Registrars could 
simply not register new domain names. While domain names may be 
registered through the SRS and VeriSign receives $6, that fee also must 
cover resources for processing queries/traffic. Such fee, however, is 
not based on the volume of queries/traffic received. The explosion of 
Internet-enabled devices and applications--text messaging, music 
downloads, VoIP, Blackberries and device-to-device communications--has 
created exponential growth in Internet traffic far surpassing the 
increase in users. While users have increased 300 percent since 2000, 
the volume of traffic on .com and .net has increased 1,900 percent in 
that same period. Domain name registration has not kept pace.

    \12\ ``No price discrimination. Registry Operator shall charge the 
same price for Registry Services subject to this Section 7.3, not to 
exceed the Maximum Price, to all ICANN-accredited registrars (provided 
that volume discounts and marketing support and incentive programs may 
be made if the same opportunities to qualify for those discounts and 
marketing support and incentive programs is available to all ICANN-
accredited registrars).'' Registry Agt., Sect. 7.3(e).

    \13\ ``Adjustments to Pricing for Domain Name Registrations. 
Registry Operator shall provide no less than 6 months prior notice in 
advance of any increase for new and renewal domain name registrations 
and for transferring a domain name registration from one ICANN-
accredited registrar to another and shall continue to offer for periods 
of up to 10 years new and renewal domain name registrations fixed at 
the price in effect at the time such offer is accepted. Registry 
Operator is not required to give notice of the imposition of the 
Variable Registry-Level Fee set forth in Section 7.2(c).'' Registry 
Agt., Sect. 7.3(f).

    \14\ For example, a pharmaceutical company may obtain a patent on a 
drug that is the sole drug approved by the FDA for a particular 
indication. An airline may dominate a hub airport due to a lack of gate 
space or takeoff/landing slots. A franchised cable operator may be the 
sole provider of broadband Internet access in an area where the local 
telephone company cannot feasibly provide DSL service. In none of these 
situations does the government regulate prices.
    \15\ That provision provides as follows:

        ``25. Procedure for Subsequent Agreement

        B. ICANN shall consider the Renewal Proposal for a period of no 
        more than 6 months before deciding whether to call for 
        competing proposals from potential successor registry operators 
        for the Registry TLD. During this 6 month period, ICANN may 
        request Registry Operator to provide, and Registry Operator 
        shall provide, additional information concerning the Renewal 
        Proposal that ICANN determines to be reasonably necessary to 
        make its decision. Following consideration of the Renewal 
        Proposal, Registry Operator shall be awarded a four-year 
        renewal term unless ICANN demonstrates that: (a) Registry 
        Operator is in material breach of this Registry Agreement, (b) 
        Registry Operator has not provided and will not provide a 
        substantial service to the Internet community in its 
        performance under this Registry Agreement, (c) Registry 
        Operator is not qualified to operate the Registry TLD during 
        the renewal term, or (d) the maximum price for initial and 
        renewal registrations proposed in the Renewal Proposal exceeds 
        the price permitted under Section 22 of this Registry 
        Agreement. The terms of the registry agreement for the renewal 
        term shall be in substantial conformity with the terms of 
        registry agreements between ICANN and operators of other open 
        TLDs then in effect, provided that this Section 25 shall be 
        included in any renewed Registry Agreement unless Registry 
        Operator and ICANN mutually agree to alternative language.

        C. In the event that ICANN fails to award a renewal registry 
        agreement to Registry Operator within the 6-month period 
        described above, Registry Operator shall have the right to 
        challenge the reasonableness of that failure under the 
        provisions of Section 15.

        D. In the event ICANN does not award Registry Operator a 
        renewal registry agreement according to Subsection 25(B), ICANN 
        shall call for competitive proposals and Registry Operator 
        shall be eligible, to the same extent as similarly situated 
        entities, to submit a proposal in response to such a call and 
        to be considered for such award.''

    \16\ http://www.icann.org/announcements/announcement-21nov05.htm.
                                 ______
                                 
   Questions Submitted by Hon. Daniel K. Inouye to Dr. Paul Twomey *
---------------------------------------------------------------------------
    * Response to written questions was not available at the time this 
hearing went to press.
---------------------------------------------------------------------------
    Question 1. One of ICANN's overarching principles is to create a 
transparent, ``bottom-up'' consensus driven system of management. Many 
critics argue that ICANN has strayed far away from this principle. What 
response do you have to claims that ICANN does not satisfactorily 
inform the public of its decisionmaking process, such as, in the case 
of the dot-biz, dot-org, and dot-info proposed contract agreements?

    Question 2. How do you respond to critics who note that ICANN has 
yet to substantially involve Internet users? For example, the stalled, 
and ultimately abandoned, attempt to hold open elections.

    Question 3. Is the involvement that the NTIA had on the creation of 
the dot-xxx domain name representative of the decisionmaking process in 
ICANN?

    Question 4. ICANN has been praised for its attention and success in 
the areas of stability and security of the DNS. However, the proposed 
agreement with VeriSign and the general evolution of the Internet has 
raised new concerns. Under the terms of the proposed agreement, ICANN 
and VeriSign are only required to meet to discuss security every 6 
months. Is 6 months often enough to ensure the security of the DNS?

    Question 5. The terms of the proposed VeriSign agreement reduces 
ICANN's power to terminate the agreement. Compared to the 2001 
agreement, how does this weaken ICANN's ability to oversee the dot-com 
registry and maintain the security of the DNS?

    Question 6. Do you think that breaking ties with NTIA's governance 
will make the Internet vulnerable to other governing bodies?

    Question 7. How do you address the concerns of those who feel that 
the MOU should be renewed before the proposed VeriSign agreement is 
approved or denied in order to address security concerns?

    Question 8. The lack of transparency in the ICANN decisionmaking 
system also extends to the budget. How do you address concerns about a 
lack of accountability for the ICANN budget?

                                  

```