Subject: Re: Future of IANA (and IETF)

From: "William Allen Simpson" <[email-masked]>
Date: Tue, 3 Feb 98 18:32:47 GMT

There are rather a large number of responses on this thread, so I will
try to consolidate related answers.

It appears that there is a strong consensus (on this list) that the IANA
function of number assignment maintenance (protocols, IP address ranges,
and such) should be separated from the designation of DNS names and
actual operation of root servers, to protect IANA from legal expenses.

We have long had a separation between our publications editors and our
assignments maintenance.  They have both been done by the same group at
ISI, because they have been getting the job done.  There is no
structural reason that the work could not be distributed to other
groups at any time, at the will of the IAB.

This additional separation would be a decision of the IAB, with
concurrance of ISoc, under the current IAB Charter.  Is the IAB prepared
to recognize a new operational entity, called something other than IANA,
for dealing with assignments in the DNS?  This would require a minor
revision of RFC-1601.

Funding for IANA has always been on a "cost recovery" basis.  The IANA
Charter and Publications Editor Charter should make this explicit.

                                ----

Of course, the operation of root servers has always been a volunteer
activity.  Traditionally, the servers have been selected by IANA from
the volunteer pool.  But they could be selected by some other entity,
should the IAB decide that is the best course.  Again, any funding has
always been done on a "cost recovery" basis (where funding was done at
all).  This should probably be explicitly written down, too.

                                ----

! From: Kent Crispin <[email-masked]>
! Jim's proposal to split the functions of IANA makes a lot of sense.
! The solution is to make the root zone authority a non-profit, and
! to further require that all TLD registries(*) be run on a cost recovery
! basis.
!
There appears to be consensus on an explicit "cost recovery" basis for
this as well.  Would Kent please write a draft charter for this new
organization, that can be discussed with the IAB?  Concrete proposals
are usually easier to understand.

                                ----

Jay Fenello queries:
# >IANA reports to the IAB.  The IAB is the judge of the matter, with
# >appeal to the ISoc.  The IAB appears to be satisfied that rough
# >consensus was achieved, as evidenced by their concurrance and
# >appointments.  No appeal to the ISoc has been published.
#
# How does this description reconcile with:
#
# >>@@@@@ http://rs.internic.net/nsf/nis/sectionM.html
# >>
# >>M.3 IANA Manager and Advisory Panel Chairman
# >>
# >>"Network Solutions proposes Mr. Jon Postel as the IANA Manager and
# >>Chairman of the Advisory Panel for the NREN NIS Manager project. He
# >>will provide services as an employee of USC's Information Sciences
# >>Institute (ISI), subcontractor to Network Solutions."
#
As IAB member Robert Elz notes, someone is confusing funding with
control.   It appears that NSI has flowed some part of its funding
through to IANA, as it should given that it used IANA services.  This is
merely one small portion of the many grants that ISI receives related to
the Internet.

IANA was created long before NSI existed, and Jon Postel was its
progenitor.  See RFC-317 (1972 Mar), RFC-604 (1973 Dec), RFC-717 (1976
Jul), RFC-736 (1977 Nov), etc, etc.  A long unbroken chain, should you
decide to peruse the history.

The IANA was one of the founders of the IAB.

The IAB was one of the founders of the ISoc.

                                ----

> From: Kim Hubbard <[email-masked]>
> I'm assuming that you're saying ARIN serves NANOG because of the 'North
> American' in NANOG's name.  Please keep in mind that ARIN as a regional
> registry is not limited to only serving North America.  We also are the
> regional IP registry for Latin America, Carribean and sub-saharan Africa
> (at least for the time being).  So saying that ARIN is under NANOG is
> inaccurate.
>
> Kim Hubbard
> ARIN
>
If ARIN fails to serve NANOG (the North American Operators), ARIN will
be quickly replaced with something that _does_ serve NANOG.

NANOG has graciously extended its facilities to other areas that have
not yet developed the capacity for operating a number registry.  Many
folks from Carribean, South America, and sub-saharan Africa have long
participated in NANOG.

There seems to be some error in your email address.  It appears to be
coming from Internic, which is no longer your employer.  You need a
divorce from the Internic mindset.

[email-masked]
    Key fingerprint =  17 40 5E 67 15 6F 31 26  DD 0D B9 9B 6A 15 2C 32

---

From: Kent Crispin <[email-masked]>
Date: Tue, 3 Feb 1998 13:01:21 -0800

> are usually easier to understand.

I actually did a draft with a very similar theme some months ago for
the IAHC -- I could dust it off and refurbish it. 

I would like to point out that the fundamental authority for such an
entity comes straight out of rfc1591.  The method of delegation of
authority to subdomains described in 1591 grants monopoly control to
the owner of a zone -- that *includes setting policy for any
subdomains of a zone*.  That is, the "owner" of songbird.com (me) has
absolute control over the policy I apply to subdomains of
songbird.com.  Thus, by extension, the owner of the root zone has
authority to set required policy for subdomains of the root, and thus
can certainly set (and enforce, under penalty of removal from the
root) a policy that TLD registries must be run on a cost-recovery
basis, just as the root zone is.  Past that, subdomains of TLDs can
follow whatever policy the TLD registry sets. 

-- 
Kent Crispin, PAB Chair			"No reason to get excited",
[email-masked]			the thief he kindly spoke...
PGP fingerprint:   B1 8B 72 ED 55 21 5E 44  61 F4 58 0F 72 10 65 55
http://songbird.com/kent/pgp_key.html

---

From: Kim Hubbard <[email-masked]>
Date: Tue, 3 Feb 1998 16:41:18 -0500 (EST)

> be quickly replaced with something that _does_ serve NANOG.

You're absolutely right in that a large part of ARIN's members and customers
are North American and it's imperative that ARIN meets their needs.  What
you're not right in is that ARIN is "under" NANOG/Merit.  ARIN does not
operate under the authority of NANOG.  ARIN gets its authority from IANA.
> folks from Carribean, South America, and sub-saharan Africa have long

True.  What's your point?  

> divorce from the Internic mindset.

Actually I still have a temporary InterNIC account to help with the
transition.   But, I'm curious, what exactly is the Internic mindset
that I should be divorcing myself from?

Kim

---

From: Karl Denninger <[email-masked]>
Date: Tue, 3 Feb 1998 16:34:46 -0600

> follow whatever policy the TLD registry sets. 

And, of course, since the US Government historically has funded the
primary root server and the IANA functionality which support(ed) it, that
means that the US Government gets to set those rules, right?

All according to your own interpretation - not mine.

Be careful what you cite as "support" for your position.

--
-- 
Karl Denninger ([email-masked])| MCSNet - Serving Chicagoland and Wisconsin
http://www.mcs.net/          | T1's from $600 monthly to FULL DS-3 Service
			     | NEW! K56Flex support on ALL modems
Voice: [+1 312 803-MCS1 x219]| EXCLUSIVE NEW FEATURE ON ALL PERSONAL ACCOUNTS
Fax:   [+1 312 803-4929]     | *SPAMBLOCK* Technology now included at no cost

---

From: Kent Crispin <[email-masked]>
Date: Tue, 3 Feb 1998 15:06:13 -0800

On Tue, Feb 03, 1998 at 04:34:46PM -0600, Karl Denninger wrote:
[..]
> means that the US Government gets to set those rules, right?

As has been carefully pointed out, "funding" is not the same as "control".

---

From: Brian E Carpenter <[email-masked]>
Date: Wed, 04 Feb 1998 10:55:55 +0000

Actually Bill I don't see that the consensus for that view
is particularly strong, but it is certainly an approach that
would protect the IETF's operation from extraneous phenomena
if that became essential.

  Brian Carpenter

>-- William Allen Simpson wrote:
>

---

From: [email-masked]
Date: Wed, 04 Feb 1998 12:02:07 -0500

With all due respect to Jon Postel supporters:

>The IAB was one of the founders of the ISoc.

So IANA was responsible for establishing its own
oversight board.  And that oversight board was 
responsible for establishing an organization that 
handles administrative appeals when that board's 
decisions are questioned, and legal shelter in
case of legal liability.

And those entities are the same ones who established 
the IAHC process, and the same ones who wish to give 
oversight to a new body that they have constituted, 
and the same ones that will enjoy a permanent and 
ongoing role in this body.

Isn't there at least one conflict of interest 
in there someplace?

More importantly, isn't this where the "long unbroken
chain" becomes broken.  What happened to Draft Postel.  
Why was it discarded in favour of a "Blue Ribbon Panel."

Throughout history, people have blindly followed great
leaders.  Sometimes Kings, sometimes Popes, sometimes
Presidents, and sometimes Dictators.  And *sometimes*,
these great leaders go off track.  And when they do, 
someone needs to stand up and say:
	"The Emperor has no clothes!"

Regards,

Jay Fenello
President, Iperdome, Inc.  
404-250-3242  http://www.iperdome.com

---

From: Bob Stewart <[email-masked]>
Date: Wed, 04 Feb 1998 12:33:22 -0500

I just can't resist letting my dog get a few bites in this fight.

>With all due respect to Jon Postel supporters:

A meaningless inanity if I ever saw one.

>oversight board.

Why not?  It's like, hey you guys watch over my shoulder and poke me if it
looks like I'm doing something stupid.  Sounds prudent to me.

>Isn't there at least one conflict of interest 

Conflict of interest is often on overblown concern perpetuated by
suspicious people with small minds.  People who are basically honest and
conscientious will be so whether or not it is in their interest.  People
who aren't won't be.  Possible conflict of interest means perhaps a bit
more examination is in order or care must be taken, not that there's some
intrinsic evil at work that must be avoided at all costs.

>	"The Emperor has no clothes!"

And sometimes people have wisely followed good leaders and you have to
wonder just what's on the agenda of those attacking them.  I don't see the
people who were so much involved in presenting us with the present amazing
Internet selfishly feathering their own nests to our detriment.  I do hear
what sounds like a lot of people who smell money and want to grab what they
can for themselves, while prattling piously about rules and regulations and
oversite and avoiding conflicts of interest.  Governments typically have
lots of all of that and are typically misguided, foolish, and often
corrupt.  Rules don't create good and avoid bad in themselves.  Honest
people do that.

I don't trust governments and boards and committees.  I trust individuals
who have a proven record of wise decisions.  We have at least our share of
those and the incredible success of the Internet is proof of that.

C'mon, dog.  We've had our chomp.

	Bob

---

From: Jim Dixon <[email-masked]>
Date: Thu, 5 Feb 1998 09:27:37 +0000 (GMT)

> > ! Jim's proposal to split the functions of IANA makes a lot of sense.

Remember that the proposal is to split IANA into three parts (DNS mgmt,
IP address space management, and everything else) and put firewalls 
between them, the principal objective being to isolate other functions
from the legal threats that swarm around DNS issues.

> > ! to further require that all TLD registries(*) be run on a cost recovery

While I agree that the DNS management function should be non-profit and
that most or all TLD registries should be run on a cost recovery
basis, strictly speaking, neither is required.  The important points are
that the functions should be legally isolated from one another and that
the DNS management function must have enough financial resources to 
withstand serious legal attacks.  Alternatively it could be protected
by appropriate legislation.

--
Jim Dixon                  VBCnet GB Ltd           http://www.vbc.net
tel +44 117 929 1316                             fax +44 117 927 2015

---

From: Kent Crispin <[email-masked]>
Date: Thu, 5 Feb 1998 17:10:54 -0800

> the IAHC -- I could dust it off and refurbish it. 

OK, here's a short draft.  It's a sketch of an I-D -- I will submit it as a 
draft, if there is any interest:

--------------------------------------------------------------------------

INTERNET-DRAFT          Expires June 1998                 INTERNET-DRAFT

Policy Study                                               K. Crispin
Category:  Informational                                   January 1998

	        Characteristics of a Root Zone Registry

                  <draft-ietf-rza-crispin-00.txt>

Status of this Memo

    This document is a submission to the general internet community. 

    This document is an Internet-Draft.  Internet Drafts are working
    documents of the Internet Engineering Task Force (IETF), its
    Areas, and its Working Groups.  Note that other groups may also
    distribute working documents as Internet Drafts. 

    Internet Drafts are draft documents valid for a maximum of six
    months.  Internet Drafts may be updated, replaced, or obsoleted by
    other documents at any time.  It is not appropriate to use
    Internet Drafts as reference material or to cite them other than
    as a "working draft" or "work in progress."

    To learn the current status of any Internet-Draft, please check
    the "1id-abstracts.txt" listing contained in the internet-drafts
    Shadow Directories on:

         ftp.is.co.za (Africa)
         nic.nordu.net (Europe)
         ds.internic.net (US East Coast)
         ftp.isi.edu (US West Coast)
         munnari.oz.au (Pacific Rim)

Terms

    Root Registry (RR) -- the registry for the root zone

    Public Policy Body (PPB) -- a body especially for gathering public
        input into global DNS policies

    Registry -- the database and operational mechanism associated 
        with a TLD

    Registry Management Board (RMB) -- the oversight non-profit corporation
        that is the legal entity responsible for management of registries.

    Registry License Agreement (RLA) -- the contract between the RMB 
        and the RO

    Registry Operator (RO) -- a company or organization that runs a registry

    TLD Charter -- a legal document in the form of a MoU(?) that
        provides the basis for installing a TLD in the Root Registry

The Root Zone Authority (RZA)

    This short Draft describes the characteristics of a Root Zone
    Authority (RZA).  You will see many similarities between many of
    the components described here, and components of the structure
    defined by the gTLD-MoU.  However, these are *components*, and
    there are other, similar organizations that could be seen as
    models.

    The RZA serves three distinct, but related functions:  

      1) It runs the registry for the root zone.

      2) It approves charters for TLDs.  A TLD charter is a legal
      document that defines policies concerning a particular TLD (or
      set of TLDs).  

      3) It issues Registry Licenses.  A registry license is a legal
      document binding the RZA and a Registry Operator 
      (RO).

    The RZA is organized as three parts, corresponding roughly to 
    the three functions:

      1) An operational component, concerned with the technical 
      aspects of running a root zone.  Because DNS will surely 
      evolve, this component will have a long, interesting life, and 
      will be deeply involved in standards activities.  (Call this 
      the "Root Registry" (RR).)

      2) A public input component, concerned with approval of
      Charters, and general RZA policy.  Approval for new TLDs should
      only come after a lengthy period of public debate.  A clear
      model for this is the process in the IETF by which new internet
      standards are approved.  (Call this the "Public Policy 
      Body" (PPB).)

      3) A non-profit corporation component, entrusted with managing 
      registries.  It is this component that contains the legal 
      liability and policy enforcement responsibility.  (Call this 
      the "Registry Management Board" (RMB).)

Root Registry (RR)
 
    The RZA is the top level registry for the DNS.  Like all
    registries, it is a natural monopoly.  The RZA is also a *registrar*
    for the root zone, the only registrar.  That is, the root zone is
    *not* a shared registry.  Again, like all registries, the RZA
    imposes its policies on the subzones it delegates.  These policies
    are enforced through Registry License Agreements, and will be
    described in a later section. 

    As the top level registry the RZA is responsible for maintaining a
    primary nameserver for the root zone.  Operational aspects of this
    function could be subcontracted.  Administrative aspects should
    not be.

    Besides the purely operational aspects, there is an obvious strong 
    necessity that the RZA be completely abreast of all technical and 
    standards developments that will concern DNS.

    The RR would be funded on a cost-recovery basis through fees paid
    by registries, perhaps as described below for the RMB.  Other
    sources of funding (research grants, etc) could be considered, but
    a self-supporting registry would be best. 

Public Policy Body (PPB)

    Policy issues concerning the RZA, including proposed charters for
    new TLDs, are brought to the PPB.  The PPB should have very open
    membership, and work according to rough consensus rules.  In
    detail there are all kinds of different ways this could work --
    imagine the IETF model: someone sees a needs for a new TLD.  They
    talk with their friends, write a proposal for a WG, the WG works
    for a while on a charter, the charter goes through some
    standardization process (including a thorough legal vetting), and
    eventually is approved.  At that point it is given to the RMB,
    which can then let a registry license for that TLD.  Or, they 
    could put together a charter from already existing charters, and 
    try to get that to fly.

    Note that, while I talk of the IETF model, the IETF itself would
    probably not be an appropriate organization to do this.  The
    germane issues are not primarily technical, but rather public
    policy.  The professional expertise most required would probably
    be knowledge of the law.

    Policies concerning the operation of the RZA itself could also be 
    processed through through this forum.

    PPB activities would be mostly voluntary.  Administrative costs 
    should be minimal, and could be funded in a variety of ways.

Registry Management Board (RMB)

    The RMB is the central legal entity of the RZA.  It would be a
    non-profit corporation with a structure similar to the POC, and
    like that proposed in the GP -- with a large board of directors
    chosen across a wide variety of internet stakeholders.  

    The primary purpose of the RMB is oversight of TLD registries. 
    The basic tools for this purpose are TLD charters and Registry 
    License Agreements.  These are described in a later section.

    The RMB is funded through registry license fees.  These fees are 
    part of the costs that a registry sustains, and thus is recovered 
    through the fees that the registry charges registrars.  Thus 
    ultimately the cost of the RMB is born by domain name owners, as 
    part of the cost of running the whole domain name system.

Basic Policies of the RZA

    Non-profit Registries

    Experience has shown that control of a TLD can be a valuable
    economic asset.  This value stems from two facts: first, some
    names are psychologically more appealing; and second, a TLD is an
    intrinsic natural monopoly -- especially after a period of use it
    becomes a significant inconvenience to change domain names, and, 
    potentially, fairly expensive. 

    The high profit potential of a TLD registry makes it worth
    fighting for.  So any model that allows high profit registries
    will also expose the RZA to high stake legal battles indefinitely
    into the future.  The cost of litigation insurance, and litigation
    itself, to the greatest extent possible, is something to be
    avoided. 

    To repeat:  The only way to prevent the RZA from turning into a 
    large expensive cancer on the net is to arrange policy so that it 
    doesn't control the spigots to lots of money.

    Therefore, a fundamental policy of the RZA should be that all
    registries to which it delegates subdomains must be run on a
    non-profit, cost-recovery basis. 

    However, ensuring that registries actually run on a non-profit
    basis is in itself something of a job: regulation also can costly. 
    [Regulation mechanisms will be described a little later.]

    A fundamental difficulty with a non-profit requirement for a
    registry is often posed: why would anyone want to do it if they
    couldn't make money at it? Fortunately, the answer to this is
    easy: Non-profit corporations are not forbidden from paying
    salaries; they can have a CEO that makes good money; and many
    people like working for non-profits. 

    Also, when it gets right down to it, the CORE model, where a
    non-profit registry is run by a consortium of for-profit
    registrars, has a lot to offer. 

    Shared Registries

    The goal is to have hundreds, perhaps thousands, of registrars
    that can register names in any TLD.  Thus, the default policy for
    any TLD registry liscensed by the RZA is that it be required to
    allow any registrar to register names, without prejudice, and that
    the registry support a standard protocol for this purpose.  [With
    suitable justification, the charter for the TLD may specify
    restrictions on registration -- for example, the charter for a
    ".med" TLD might specify that the domain holder must show
    membership in a recognized medical professional society.  But the
    registry must not restrict any registrar that is willing to agree
    to the conditions in the charter.]

TLD Charters and Registry Licenses

    TLD charters and Registry Licenses are rather complex legal
    documents.  I am not a lawyer.  But I think it is safe to say that
    most of the work of implementing something like this proposal will
    be in exploring the legal structure and environment necessary to
    support these documents.

    TLD Charters

    A TLD Charter is essentially a MoU, signed by the RZA, the RO, and
    any registrar that wishes to register names in the TLD.

    It must include at least the following:

       1) A rationale for the TLD

       2) criteria for names and entities that could be registered 
       in it.

       3) measures the registry must take to enforce the above
       standards (which might involve revoking a registrars's 
       permission to register names in the TLD)

       4) measures the registrars must take to enforce the above
       standards (which might include removing a customer from
       the registry.)

       5) some of the conditions that a RO must meet to remain as the RO.

    TLD charters can be quite flexible -- one could imagine a .ham 
    registry run on a completely volunteer basis, with the 
    requirement that all registrants in the .ham domain provide proof of 
    a ham radio license before they can register a name.  Ham radio 
    operators could run free registrars (for-profit registrars could 
    also register in the .ham domain, but there would be little money 
    in it competing against the free amateur registrars).

    Registry License Agreements

    RLAs are a contract between the Registry Operator and the RMB. 
    They must specify the operational requirements the registry
    operator must meet.  (As the .ham example hints, the operational
    requirements need not be the same for every registry.) They must
    specify what happens if the RO can no longer function.  They might
    specify requirements for escrowing the registry database. 
    Certainly they must specify penalties for non-conformance.  They 
    must form the legal underpinings for regulation of registries.

Regulation of registries

    The registries must be regulated; regulation costs money.  As 
    mentioned above, the fundamental base of authority for the 
    regulation is in the Registry License Agreement (RLA).  

    Several things can mitigate the cost of regulation.

    First of all, without too much effort, things can be structured 
    so that end users and registrars actually do most of the 
    policing.  The registries will be required by the RLA to keep 
    public records of all transactions, business operations, and 
    financial condition.  Thus, the RZA does not need to keep a 
    "police" force on hand -- instead it merely needs to have a 
    Registry Review Board that hears complaints against registries.

    Also, one of the advantage of having several non-profit registries
    is that a realistic idea of the cost of running a registry will
    quickly develop, and ones that are seriously out of line will
    stand out. 

    It is true that the range of penalties that the RZA can bring to
    bear against a registry are limited -- the ultimate penalty that
    can used is the penalty of disenfranchisement of the management of
    the registry.  In this extreme case the management of the registry
    is given over to another organization already running a registry
    that is doing a good job, or a new organization that promises to
    do a good job. 

Funding

    The most likely source of funding for the RZA would be yearly fees
    from each registry.  As described above, these fees would be part 
    of the business costs of the registry, and would be recovered 
    through fees the registry would charge to registrars, and 
    therefore ultimately the cost would be born by the users of DNS.

Author's Address

	Kent Crispin
	[email-masked]

	+1 510 886 7410

INTERNET-DRAFT          Expires June 1998                 INTERNET-DRAFT

---

From: Christophe Dupre <[email-masked]>
Date: Wed, 11 Feb 1998 16:54:17 -0500

After carefull reading of your proposed Internet Draft (no, I won't quote it. 
For those who missed it, go check the archives), I have a few issues to raise.

First of all, I'm all for the submission of such a draft for official 
discussion. Now my issues:

1/ Regarding funding of the RZA, your proposition of cost recovery by billing 
the registries of TLD is good. But should this cost-recovery be shared equally 
by all the TLD, or by prorata of the number of SLD ? Equality is the most 
democratic solution, but some TLD will probably generate more traffic than 
others (.COM for example, versus .NET). Also, will the RZA be a secondary name 
server for all the TLD ? only the gTLD as is the case these days ? If so, 
cost-sharing is in order with those TLDs' registry, and such decisions should 
be made before the draft becomes an RFC.

2/ Regarding the performance issue, nowhere in your draft I see reference to 
minimum performance/availlability necessary for one to become a TLD registry. 
Now, this might be decided by the PPB, since they are the policy makers, but 
it's not listed in that group's description. Also, if the main expertise 
necessary required to be a member of the PPB is the knowledge of 
(commercial/international/whatever) law, then that group may not have the 
expertise to determine sound engineering rules of performance requirement. I 
feel that the draft should clearly state whose job it'd be to take those 
decisions, and give minimum performance requirement guidelines, ala RFC2010.
Please note that such guidelines should NOT go overboard (as in the green 
paper), but include ways to remove a registry of its TLD if such minimum 
performance requirements are not met for an extended length of time. It might 
be acceptable for the registry to be down for a day or two because of a 
natural disaster (that's what secondaries are for), but not longer. Due to the 
critical nature of the registry, plans should be made for such an occurence.

3/ gTLDs:
The charter for the new RMB shoudl include some article to force it to take 
action to eliminate those TLD traditionally reserved for the US Government 
(.mil and .gov), in a slow, controlled and painless process, to allow the US 
Government to take its place, as all other governments, in their ccTLD (.us), 
as proposed in the Green Paper.

Please note that I remain availlable for further comments on this I-D.

-- 

Christophe Dupre
Analyste de systemes, 
RISQ inc. ;-)
1801 McGill College, suite 800           Tel: (514) 840-1235, ext 6971
Montreal, QC CANADA                      FAX: (514) 840-1244

"Nous ne sommes pas libres de ne pas etre libres, nous sommes obliges de 
l'etre"  -  Fernando Savater

#include <disclaimer.h>

---

From: Christophe Dupre <[email-masked]>
Date: Wed, 11 Feb 1998 16:54:17 -0500

3/ gTLDs:

-- 

Christophe Dupre
Analyste de systemes, 
RISQ inc. ;-)

#include <disclaimer.h>