Issues With Proposed Changes for ZA Domains

As regular readers of our blog know we are actively engaged in internet and domain name policy both in Ireland and internationally. You also might know that we are a registrar for many domain name extensions from around the world, including the South African *.za domains.

In recent months the South African domain name authority, ZADNA, published draft regulations that will have far reaching impact on the South African domain name eco system and internet. We have attended several meetings in recent weeks with other stakeholders who were also concerned by the implications of the proposals.

The proposed changes are, in our view, quite drastic and have the potential to negatively impact how existing and future registrants of *.za domain names view the ZA namespace.

Our submission to the public consultation is below. Naturally we are approaching this primarily from the perspective of a domain name registrar, however we are also very conscious of the impact that these changes would have on the broader ecosystem.

Here’s our submission:

Sir

We are writing in order to formally file our comments on the proposed registry and registrar licensing regulations.

Blacknight is Ireland’s largest hosting provider and domain name registrar. We are directly accredited with multiple ccTLDs both in Europe and globally, as well as being ICANN accredited.

I have personally been deeply involved with domain name policy development for well over a decade and previously served as Councillor on ICANN’s GNSO Council. I currently sit on the .ie Policy Advisory Committee, the .eu Registrar Advisory Board, Eco’s Names and Numbers Steering Committee and the .us Stakeholder Council.

When reviewing the proposed regulations we approached them primarily from the perspective of a registrar, however we were also conscious of the implications for both the registry and registrants as well as the broader internet eco-system.

While some aspects of the proposed regulations are not problematic, taken as a whole they threaten the future viability of the .za namespace.

We highlight some of the areas we have issues and questions about below, in no particular order:

• Fees.
o There is no indication of how much the license / accreditation will cost. It’s also unclear if this is a one-time fee or an annual fee.
o The level of this fee is critical as it will have implications for competition in the South African market. While very large registrars might be able to write off the fees due to the sheer size of their market share and volumes any fee will need to be low enough as to not deter existing or potential new market entrants.
o The FAQ states that this will be addressed later, however it is a key deciding factor that should be dealt with upfront.
• Licensing Criteria.
o The FAQ makes reference to the annexes, however annexes do not lay out any actual criteria but merely ask questions.
o If ZADNA has specific requirements and criteria that registrars should meet in order to be licensed then these should be listed clearly
• Revocation of license.
o 10 working days to address issues is unreasonably short. While some issues might be easy to fix others could require longer periods of time. We would have expected to see at least a 30 day time period there as well as a more collaborative approach to addressing issues instead of this rather blunt approach.
• Privacy Implications
o The requirement to collect registrant identity data is highly problematic as currently drafted.
o A full data protection impact assessment (DPIA) should be conducted before this is even considered.
 At present there is no indication of who will retain what data and for how long.
 There is no clear purpose laid out for the collection, processing and storing of the data.
o ZADNA should look to what other domain name registries are doing and how they are doing it. What is currently proposed will have a chilling effect on the attractiveness of the ZA namespace for both registrars and registrants.
• Grandfathering of existing domain names
o The aforementioned registrant identity validation and verification should not apply to existing domain names.
o It is completely unreasonable and impractical to expect registrars to validate hundreds of thousands of existing domain names. The cost and time burden involved in doing this would paralyse most registrars and would not bring any substantive benefit to the ZA namespace.
• Access to Registrar Systems
o While we have no issue with the concept of an audit of our compliance with licensing or contractual requirements we do not believe that ZADNA or its agents should have direct access to our systems or those of any other registrar.
o ZADNA should look to how other registries manage the audit function related to registrars.
• Technical and Operational Issues
o There are no details as to how registrars and the registry are to collect and process extra data that is being asked for. This cannot be an afterthought as the choice of the data format will have wide ranging implications for the systems of both registrars and registries.
o Again we would implore ZADNA to look at what other registries are doing as well as how well that is working
• Security Concerns
o In general terms registrars deal with the registry backend provider for all technical and security issues, however ZADNA proposes that it somehow should be inserted into this process. Therefore we must ask:
 What level of certification does ZADNA hold?
 What level of certification does its agents hold?
• Non-South African Registrars
o The current wording of the licensing application asks for details of the applicant’s BBBEE compliance. It should be clarified that this is not a requirement for non-South Africa based entities.
• Other points
o The registrar contract is for 10 years, but the registry contract is for 5.
o The text talks about “zone records” but does not define what is meant by them