Internet Governance in 2023

It’s been an interesting couple of weeks for me in mid-October 2023. I presented in a couple of panels at the 18th Internet Governance Forum meeting, held in Kyoto, Japan, and I also listened in to a couple of sessions in their packed agenda. The following week I followed the presentations at NANOG 89, the meeting of the North American Network Operator’s Group, and listened to a presentation by John Curran, the President and CEO of ARIN, where he gave his impressions of the current state of Internet Governance.

There was a time, some decades ago now, when the Internet was seen as a novel space, unpopulated with the adornments of the physical world. Inhabitants of this new Cyberspace felt that they could define their own terms of engagement, equipped with an eloquent declaration of Independence of Cyberspace.

When the Internet outgrew its academic and research roots and gained some prominence and momentum in the broader telecommunications environment it found itself to be in opposition to many of the established practices of the international telecommunications arrangements and even in opposition to the principles that lie behind these arrangements. For many years, public sector policy makers were being lectured that the Internet was “special”, and for any nation to consider applying the same mechanisms of national telecommunications and domestic trade regulations to the Internet may not wreck the entire Internet, but they would surely isolate the nation from realising the future bounties of this new digital age!

Within this broad category was the notion that conventional means of conducting trade in services was not applicable to the Internet. While an early mantra of “The Internet must be free” quickly foundered when it encountered the pragmatic realities of having to pay the bills, the next mantra of “Don’t tax the Internet” gathered significant momentum. What was meant here was an admonition to governments not to attempt to unduly constrain the flow of data, as such actions would imperil the future value of the Internet and throttle its future from the outset.

But while the Internet might have been “special” in the 1990s, such a characterisation was unsustainable in the longer term. In 2003 and 2005 the United Nations hosted the two-part World Summit on the Information Society (WSIS). It was clear by the time of the millennium that the previous regime of national telephone operators and the treaties that governed the international aspects of this global service were rapidly becoming side-lined, if they had not been side-lined already. The Internet was sweeping all before it and each time it engaged with another sector it appeared to come out of the encounter as a clear victor. The Internet might still be “special”, but by the millennium it was recognised that it was not always special in a good way for everybody!

This WSIS summit was in the context of the emergence of the so-called information society and a recognition of a widening “digital divide” where richer nations were in an obvious position to exploit the possibilities that opened with the combination of abundant computation and communications services and thereby amass further wealth, while poorer nations yet again found themselves on the exploited side of this divide. Far from being a tool to help equalise the inequities in our world by allowing all to access information, education and open global markets for their services, the Internet appeared to be yet another tool to further emphasise and widen this divide between rich and poor.

The United States was a focal point in these discussions. At the time the Internet was still strongly associated with the United States, and the US had spent much of the previous decade both promoting its benefits and profiting from the global revenues flowing into US companies that represented the vanguard of the Internet. This promotion of the Internet and the free flow of information was certainly not without elements of self-interest on the part of the US, as it appeared that the interests of the new corporate behemoths of the Internet and the geo-political and geo-economic aspirations of the US appeared to have much in common.

However, it’s often difficult to tackle the larger picture in these large-scale international forums such as these WSIS meetings, so it was unsurprising to see attention turn to the individual elements that were contained within this picture. One of these elements that became a topic of discussion in its own right was the status of the body that oversaw the Internet’s protocol parameters, including the names and IP addresses, that are used as part of the central core of the Internet. This function, the Internet Assigned Numbers Authority (IANA) was originally part of the US Defence Advanced Research Project Agency’s funded activities. After a few more changes within the US Government’s agency landscape, the responsibility for this function had been shifted to a self-funded mode operated by a private sector entity, ICANN, with some level of US Government oversight remaining in place. This ongoing US role was variously portrayed as a control or as a safeguarding measure. Irrespective of the nature of the motivation, the result was that the National Telecommunications and Information Administration, part of the US Department of Commerce, oversaw a contract between the US government and ICANN regarding the operation of the IANA function.

At times perceptions matter, and the lingering perception here was that the Internet was still seen to be essentially under the control of a single sovereign state, namely the US government.

This unique US role was always going to be a problem for other nations. The international telephone and postal networks were governed by international treaty instruments that had been in place for more than a century. To have a single nation state positioned at the apex of this global Internet structure was, to say the least, controversial. Naturally, this was a major topic in 2003 at the first WSIS gathering. The UN Secretary General at the time, Kofi Annan, convened a Working Group on Internet Governance (WGIG), a grand title which either conflated this topic to an even greater level of prominence or appropriately stated its central importance to the entire set of concerns with the structure of the Internet at the time. Again, opinions vary here. There was no clear consensus coming out of this WGIG activity, and the 2005 WSIS gathering could not reach any form of agreement on this matter.

During the WSIS process the US apparently refused to consider any changes to its pivotal role in the management of the Internet’s protocol parameters and had convinced a number of other national delegations to support their stance, based on an argument that the available alternatives would return the Internet to that same International Telecommunications Union (ITU) sanctioned institutionalised graft and corruption that had bedevilled the international telephone financial settlements.

The WSIS summit eventually agreed on a compromise approach that deferred any determination on this matter and instead decided to convene a series of meetings on the underlying policy principles relating to Internet Governance. Hence, we saw the inauguration of a series of Internet Governance Forum (IGF) meetings. These forums were intended to be non-decisional forums for all stakeholders to debate the issues. Originally intended to be convened for a period of five years, culminating in the fifth IGF meeting in Vilnius, Lithuania in 2010, it has continued with further extensions of its mandate, and the eighteenth IGF will took place in Kyoto in October 2023.

The early days of the IGF were dominated by the question of the need for some form of international regulatory body for the Internet. Many countries voiced the view that the global communications system should not be operated under the aegis of a single national entity, and the best way to coordinate the actions of various national actors was within a framework defined by an international communications treaty organisation, and coincidentally there was such a body with a venerable international pedigree, namely the ITU. The US, and a set of sympathetic national delegations, were having none of this. AT&T had been very successful in selling the proposition in Washington that the financial accounting structures adoptions by the ITU to balance cost and revenues in supporting international telephony amounted to institutionalised financial extortion, where the victim was the US, and AT&T in particular. The US was determined not to allow the Internet to be abused in a similar manner. The US argued that the Internet was a poster child for the flexibility and efficiency of the private sector, and that the private sector should exercise self-governance. If the carriage of the provision of services on the Internet is a market-driven outcome, then what is the role for government intervention? The Internet be regarded as an open marketplace, where the operators of network services competed for revenue from its users, focussing the attention of network service providers on the issues of quality, relevance, and affordability in their efforts to raise revenue from users. As a backstop, the interests of its users are protected by conventional forms of national market oversight, with provisions for regulatory intervention to counter instances of market distortions and abuse.

This essentially economically purist form of market-based disciplines working though competitive pressures to act as the internet’s governance framework has offered us a mixed collection of outcomes. The impetus of Moore’s Law acting on the underlying currency of computational capability was always going to be challenging. When the unit cost of computation and storage halves every two to three years, and the cost of carriage services is subject to a similar decline, it would always be challenging for the public sector to move with a degree of speed and agility to match the technology-induces changes in the digital environment. The private sector faced similar issues, and their response was directed to contain the levels of disruptive pressure bought about by such an intense level of technical disruption through extensive aggregation within the supply side of the market. The incumbents sought to secure their position and control the levels of disruptive pressure by buying out any emerging future forms of competitive disruption before they attained sufficient market presence to threaten the position of incumbents.

This rapid and large-scale aggregation within the Internet and computing industry had three major outcomes. Firstly, the process of aggregation has resulted in a handful of global digital behemoths that completely dominate the space. Their sheer size and ability to sustain a relationship with every individual Internet user far exceeds the capability of the various national and regional public sectors and this places negotiations between these digital giants and such public sector regulators on an extremely unequal footing. Secondly, the massive expansion of digital services into all parts of society has created a level of societal dependence on digital infrastructure that has now reached the point of critical dependence for modern society. The third factor arises from the speed of this expansion. The technologies that we rely on are by no means robust. Indeed, they are highly vulnerable, and certainly not self-healing when damaged. There is a continual stream of reports of various forms of malicious and accidental disruption that have far-reaching impacts on the normal functioning of our world, from financial fraud, infrastructure disruption all the way to interference in domestic elections.

None of these outcomes provide governments with any cause for complacency that this digital transformation is proceeding in a well-ordered and managed manner. Not only are we vulnerable to malicious attacks on the supply chains for food and services, attacks on our infrastructure, including traffic control network, water storage and reticulation and power generation, but now we are having a crisis in confidence over the very nature of truth. The capability of generative language systems to provide entirely plausible untruths, coupled with the enthusiasm on the part these digital behemoths to embrace such systems should make all of us, including our public sector, extremely uneasy.

When we consider the topic of “Internet governance” it is this context that should be used for this consideration.

Internet Coordination and Internet Governance

Despite appearances to the opposite, the Internet is not an unconstrained free-for-all. The network is constructed upon a foundation of coordination to sustain a common foundation of names, or endpoint addresses, of protocol specifications and of course common technical specifications. it is only through a common adherence to these coordination outcomes and suppliers of digital products ensure that their product will interoperate with the rest of the network.

This coordination cannot be undertaken as a set of bilateral arrangements, but has to be undertaken as a multi-lateral arrangement that is applied to all. Over many decades this process has evolved into a collection of open discussions leading to the adoption by consensus of a common framework. In the Internet context this is termed the “Multistakeholder Model” and is visible in the mode of operation of the domain name sector supported by ICANN, in the stewardship of the address system with the operation of the Regional Internet Registries. and development and maintenance of technical standards undertaken by the Internet Engineering Task Force. Similar open processes are used in operational bodies, such as the various Network Operational Groups that operate at both regional and national levels. By developing these common coordinated frameworks in an open consultative fashion using consensus rather than imposed direction, the intention is to arrive at outcomes that are acceptable to all stakeholders. As shown in Figure 1, the scope of these multi stakeholder coordination efforts encompass a diversity of activity domain within the broader Internet ecosystem.

Figure 1 – View of the Internet Ecosystem: from “ICANN’s Role in the Internet Governance Ecosystem“, February 2014

Can we reframe Internet Governance as Multi stakeholder Coordination and just call it all done? Not so fast! There is a definition of Internet Governance from almost two decades ago that I feel it still apposite today. From the World Summit on the Information Society (WSIS) Tunis Agenda, convened on the 18th November 2005, there is the following:
“A working definition of Internet governance is the development and application by governments, the private sector and civil society, in their respective roles, of shared principles, norms, rules, decision-making procedures, and programmes that shape the evolution and use of the Internet.”

In particular, the respective role of government in this context includes the definition of commonly acceptable codes of conduct for individuals and institutions for society, the enactment of laws and regulations that conform to such codes of conduct. It also includes the exclusive use of force to compel adherence to these laws. It also upholds a concept of the management of public resources for the common good. Government roles typically include national defence, which in recent times has expanded from the traditional military role that defends physical assets to the area of protection of digital assets, and defence against various forms of digital threats. In the same vein the governmental role of the provision of public communication services, where the postal and telephone system was operated as a public sector undertaking, has been expended to include digital services using the Internet. These internet services are not typically a server operated by a public sector agency but are operated by private sector entities within a regulatory framework that is usually intended to ensure that Internet services provided by these private sector operators are accessible, functional and affordable. The government’s economic role, which was traditionally associated with oversight of the national currency and the operational of national financial institutions that stabilise the national economy, now extends to e-commerce and the digital economy. Governments also have a role in maintaining a safe and orderly society, ensuring the rule of law and the protection of individual rights. In the context of the Internet this includes measures to protect citizens and business from cybercrime, and empowering law enforcement to operate effectively in the digital realm. Governments need to define individual rights to privacy and freedom of expression on the Internet within the context societal norms that apply in other contexts. Safety also includes the regulation of content and services online to protect minors and others from inappropriate content and harming forms of abusive conduct. That’s a big agenda, and it’s complicated by the observation that geographical borders do not have a clear counterpart in the digital environment, and the ability of one national community to undertake that governmental roles may well be impacted by the positions being take in other realms.

An Internet Governance Scorecard

So, how are we doing so far?

In a word, “badly”.

The online world is replete with all forms of bad behaviours. Vulnerabilities, once exposed, are invariably exploited. Individual businesses and public institutions have fallen as victims to various forms of cyber-attack. Our efforts to respond to such incidents are not exactly reassuring, as the frequency and severity of such incidents appears to completely overwhelm the resources we can amass in response to such incidents.

It appears that we are constructing ever more complex systems whose inner workings are dimly understood if at all. The result is that we field partially tested systems that most likely contain vulnerabilities and leave it to users to be the field testers. Yes, these are complex systems and comprehensive testing of all potential scenarios is prohibitively challenging, but in many cases, it appears that the pre-release checks and tests are more perfunctory than substantive. It seems that much of the supply side is still working to Mark Zuckerberg’s directive to “Move fast and break things!” No matter how good our incident response framework may be, if the supplied materials are faulty in the first place this situation is never going to get any better.

But it gets worse. The rapacious silicon chip manufacturing industry keeps on motivating ever higher volumes of consumption of chips, and we are embedding functionality into billions of consumer devices that are sold as commodity goods. The cyber-defensive capability of these unmanaged devices is non-existent, and the consequences of co-opting such devices into a zombie army are worrisome. We just don’t have answers here.

Our societies are now critically dependent on the continuous operation of the Internet and equally dependant on the ability of the devices that use the network to be impervious to efforts to corrupt their operation. In the face of continual incidents that demonstrate the folly of such levels of dependence, we simply increase court collective dependence as we push more functions into the digital world in the name of economies of operation.

The impacts of these failings in the robustness, safety and security digital ecosystem have concerning ramifications. There is the considerable economic cost of various forms of disruption to the online environment.