ICANN needs to ask more questions about the sale of .ORG
[The selloff of the .ORG domain name registry to a private equity fund is fractally terrible, but it's in danger, thanks to public outcry. My EFF colleague Mitch Stoltz lays out the grotesque contours of the deal and its many deficiencies in this comprehensive overview. -Cory]
Over 21,000 people, 660 organizations, and now six Members of Congress have asked ICANN, the organization that regulates the Internet's domain name system, to halt the $1.135 billion deal that would hand control over PIR, the .ORG domain registry, to private equity. There are crucial reasons this sale is facing significant backlash from the nonprofit and NGO communities who make the .ORG domain their online home, and perhaps none of them are more concerning than the speed of the deal and the dangerous lack of transparency that's accompanied it.
Less than three months have passed from the announcement of the sale-which took the nonprofit community by surprise-to the final weeks in which ICANN is expected to make its decision, giving those affected almost no chance to have a voice, much less stop it. The process so far, including information that the buyer, Ethos Capital, provided to ICANN in late December, raises more questions than it answers. U.S. lawmakers are correct that "the Ethos Capital takeover of the .ORG domain fails the public interest test in numerous ways."
Before any change in who operates the .ORG registry can take place, ICANN, which oversees the domain name system, needs to answer important questions about the deal from those who use .ORG domain names as the foundation of their online identity. Working with the nonprofit community, we're asking ICANN to ask more questions to confirm how the deal will protect .ORG users-questions that are still unanswered. And next week, on January 24th, nonprofits and supporters will protest at ICANN's headquarters in Los Angeles. You can join us to tell ICANN that it must be more than a rubber stamp.
A Dangerous DealThe Internet Society (ISOC)-which has controlled .ORG for the past 16 years-and Ethos Capital are treating the .ORG registry as an asset that can be bought and sold at will. But ISOC didn't pay to acquire the .ORG registry-indeed, PIR, the organization that was founded by ISOC to run .ORG was given $5 million to help it do so. Now, ISOC plans to profit off of the value of the registry by converting PIR into a for-profit LLC in the hands of Ethos Capital.
ICANN delegated the task of running .ORG to ISOC in 2002 because ISOC was best positioned to run the domain for the benefit of nonprofit users. The excess funds from .ORG registration fees that have supported the work of ISOC for the past 16 years were a side benefit, not a sacred entitlement. Rather than an asset, like a building, the registry should be thought of as a public function-like the assigning of street addresses. It should be (and has been) administered in the public interest. But in the hands of private equity, the registry will become something altogether different from what it's been in the past: a tool for making profits from nonprofits.
After the sale, Ethos Capital, having paid $1.135 billion for .ORG to ISOC, will have to recoup that investment on a scale that's expected of a private equity firm. This week, Ethos revealed for the first time that some $360 million of the purchase price will be financed with a loan. The payments on that loan will have to come out of Ethos's profits, so they will probably need to raise more money per year than ISOC currently does. While Ethos could try to simply increase the number of its "customers" for .ORGs, PIR has tried this in the past, and the demand for the domains has remained largely flat. This is no surprise; the nonprofit sector just doesn't grow at exponential rates.
That brings us to the myriad reasons nonprofits have criticized the deal: every other way that Ethos might increase profits is bad news for .ORG users. And these tactics aren't farfetched: every one of them is already delivering profits in other sectors, often while harming domain registrants and their visitors.
Squeezing Profits from Nonprofits Harms Civil Society- The most obvious way to profit from the registry is for Ethos to raise the annual registration fees on .ORG names. Under pressure, Ethos has promised to keep fee increases to 10% per year "on average." But they haven't made that promise legally binding. There won't be any way for .ORG users to challenge future fee increases without changing domain names, an expensive and risky process well-known to any organization or which has had to shift away from a trusted domain. And even more worrisome, Ethos could begin charging different rates for different domains. Other registries already charge considerably higher fees for names they designate as "premium." Ethos could base fees entirely on an organization's ability to pay, essentially holding nonprofits' domain names for ransom.
- Ethos could also engage in censorship-for-profit. As we've described before, other domain registries have made deals with powerful corporate interests, like movie studios and pharmaceutical interests, to suspend the domains of websites, even if that means suppressing truthful information. But .ORGs don't just have corporate interests hoping to control their voices: the world over, including within authoritarian regimes, .ORGs are the home of important critical speech on the Internet. Ethos would have a clear incentive to take down domains at the request of repressive governments, just as governments often demand takedowns of speech on social networks, in exchange for tax or other financial benefits.
- Ethos could sell the browsing data of users who visit .ORGs. The operator of a domain registry can, if it chooses, track every look-up of an address within that domain. Ethos could track visits to nonprofit organizations around the world, perhaps to target advertising on behalf of Vidmob, the advertising company they also own, invading the privacy of everyone who visits .ORG websites.
- Ethos could cut back on the important technical upkeep of the domains. Domain name lookups must be available worldwide, and quickly. Technical failures can mean being unable to connect to a website, or to send and receive email. This doesn't just mean 404s: because the .ORG registry is home to relief agencies, news media, and other groups that provide life-saving services, technical failures could result in actual harm. Aid might not reach people in need during a crisis; news and information could be stopped dead during an emergency. The .ORG registry has had no downtime in over a decade. If that changes, it's not just websites that would be in danger.
In response to public pressure, Ethos has made a loose commitment about future pricing. It has also proposed adding text about acting in the public benefit into the "Certificate of Formation" for the new holding company they're creating. And it's promised to create a "Stewardship Council" to "help guide" the company's management.
But there's no force behind these words. Under corporate law, only the company itself has the power to decide whether it's acting for the public benefit. Putting vague commitments into a "Certificate of Formation" doesn't give the users of .ORG domains any mechanism of enforcement. And a "Stewardship Council" will not be able to override the decisions of the company's owners and management. There's no guarantee that the council will even be informed about what the company is doing. In fact, PIR already has an advisory council-and it wasn't even told that the sale to Ethos was going to happen.
Luckily, there are other options on the table. If the .ORG registry needs to change hands, ICANN must take the time to consider all the alternatives, such as the Cooperative Corporation of dot-org Registrants, and determine which organization will best uphold the commitments that were made when .ORG was last re-assigned, in 2002. Instead of a rushed and secretive vote, ICANN should engage in a careful decision-making process that gives all .ORG registrants a voice in decisions around the registry in the future.
The Benefits Are Vague, At BestIn defending the deal, ISOC's leadership has talked about the good they can do with a $1.1 billion endowment. Those good works, though, don't excuse breaking trust with thousands of nonprofits. Several proponents of the deal, echoing Ethos's talking points, claim that turning .ORG into a for-profit registry will lead to "new products and services" for the .ORG community. No one explains what those would be, though, or what they have to do with maintaining a reliable database of domain names. And there is no benefit at all if these vague opportunities in the future come at the cost of functional, censorship-free websites for millions of nonprofits, associations, and clubs around the world.
ICANN Needs To Ask More QuestionsAs the group that controls the top level of the domain name system, ICANN has the power to stop .ORG from changing hands, and to name a new organization to steward that important resource. Before the deal goes any further, ICANN needs to ask more questions of ISOC and Ethos. We've compiled a handy list.
Anyone who's concerned about selling a public trust for private profit can sign the petition to #SaveDotOrg, which we'll be presenting along with other nonprofits to ICANN in person next week. And if you'll be in the Los Angeles area on Friday, January 24th, come join us at the protest at ICANN's headquarters, organized by EFF, NTEN, and Fight for the Future. Help us tell ICANN: .ORG is not for sale.