IGP Proposal Highlights Global Nature of Digital Security

The Internet Governance Project (IGP) has worked since 2004 to advance the discussion of global internet governance. Its work took a public turn in May when the IGP released a proposal to decentralize authority over domain-name system (DNS) authority.

As DNS evolves to be more secure, in the form of DNS Security Extensions (DNSSEC), a number of issues have been raised. In particular, for DNSSEC to be as secure as possible, the root-zone file must be digitally signed. And, although pieces of the DNS hierarchy can be signed without a signature at the root, that creates “islands” of security—for example, the .se (Sweden) registry is signed, but its root is not. However, the overriding issue may well be deciding which organization or organizations should have the authority to police issues like these.

The Internet Assigned Numbers Authority (IANA), which is operated by the Internet Corporation for Assigned Names and Numbers (ICANN), currently handles root-zone management. ICANN is a public-private partnership affiliated with the U.S. Department of Commerce. According to IGP, it would be too large a job—and unwise—to put the control of all root-zone signatures in the hands of one organization.

IGP proposes that a limited number of root-key operators not affiliated with a government “take responsibility for generating, using, and distributing root-zone key-signing keys and zone-signing keys.” In short, the IGP proposal disperses both responsibility and liability among various organizations that would be free from government influence.

Brenden Kuerbis, operations director for the IGP, which is based at the Syracuse University School of Information Studies, drafted the proposal with IGP partner Dr. Milton Mueller, professor and director of the Telecommunications Network Management Program at Syracuse. “On its face, it is pretty unreasonable to think that a single government, or its agency or contractor, should control the technology that many believe...is a basic requirement for internet security, and can facilitate growth in things like global ecommerce and secure communications,” says Kuerbis.

The United States Department of Homeland Security released a draft for comment last October of a DNSSEC implementation plan that it developed. Although the plan reportedly made no overt mention that the holder of the root-zone key should be a government agency or contractor, many who read the draft came to that conclusion. The DHS is currently revising the plan and is scheduled to release an updated version by late summer. According to a DHS official, “We have not made a final decision on decentralizing DNS authority…we are still looking at options and do not have anything to add to the discussion at this time.”

The DHS plan was discussed at a March ICANN meeting in Lisbon where some expressed concern that too much control in the hands of the U.S. government could lead to abuses. “When we were discussing this, there was some worry that maybe it would lead to potential abuse,” explains Bernard Turcotte, president of the Canadian Internet Registration Authority (CIRA), in reference to discussions at the meeting. “Regardless of what happens,” he says, “there has not been any abuse up to this point.”

One of the primary issues moving forward is that much of the internet growth is in country-code top-level domains (ccTLDs)—.br for Brazil, or .il for Israel, for example. “Why would a multinational company that hosts websites in numerous ccTLDs build DNS Security Extensions-dependent applications, knowing that DNSSEC could be effectively disabled in a ccTLD zone by a single organization that controls DNSSEC-related content in the root-zone file?” asks Kuerbis. “There is just too much risk for companies, not to mention governments, with that approach. These companies already know first-hand how governments can impact the products they can offer,” (such as politically driven censorship in China and other countries).

The proposal has garnered some unofficial support from organizations like CIRA. “It could work perfectly and doesn’t require that anyone has absolute control. Technically it seems sound,” says Turcotte, who explains that although the organization has not made a decision to support the IGP Proposal, CIRA does believe it to be a viable solution.

“In summary, it’s too risky for a single organization to sign the root and too inefficient if the root is not signed. That is why authority for signing the root needs to be decentralized and distributed to nongovernmental organizations,” says Kuerbis. “The internet’s DNS is a global facility; policy concerning it requires broad participation, especially when it comes to matters as important as security.”