Roger Clarke's Web-Site
© Xamax Consultancy Pty Ltd, 1995-2018
|Identity Matters||Other Topics||Waltzing Matilda||What's New|
Notes prepared in support of a seminar for MSc(ECOM) candidates
Version of 4 November 2008
Roger Clarke **
© Xamax Consultancy Pty Ltd, 2008
Available under an AEShareNet licence or a Creative Commons licence.
This document is at http://www.rogerclarke.com/II/HKDNA-0811.html
Domain names are a vital element of the Internet, particularly for such high-volume services as the Web and email. The overall policy for administration of the domain name system is set by ICANN (Clarke 2002). However, the administration of the c. 300 top level domains (TLDs) is delegated to the organisations that are granted control over them. The detailed policies are enormously diverse, and the practices (which are in many cases not compliant with the written policies) even more so.
Domain name choice exists in most countries and regions. In particular, most organisations can choose to have a domain name within their own country-code top level domain (ccTLD, such as .com.au, .net.au or .org.au in Australia), and/or within a relevant generic top level domain (gTLD, in particular, .com, .net, .org or .biz). In some places, an even richer set of choices exists, e.g. an organisation in Barcelona has a choice not only within .es, but also in the sponsored top level domain (sTLD) .cat (for the Catalan language).
The location in which the most choice exists is Hong Kong. In addition to the gTLDs, and its own ccTLD .hk, there is the vast expanse of the host nation China on its door-step, with ccTLD .cn. And the young and virulent brand-name space sTLD .asia, was sponsored by Hong Kong businessmen, and operates out of Hong Kong. Added to that is the progressive adoption of Chinese-character domain names in parallel with the conventional ('ASCII character-set') names.
The administration of the .hk ccTLD represents an interesting, and increasingly complex case study. The purpose of these notes is to provide a brief outline of some salient features.
The .hk domain appears from the IANA entry to have been first delegated on 3 January 1990. The domain was initially administered by the HKU Computer Centre under Dr Ng Nam, and subsequently by an organisational unit referred to as HKNIC, whose technical operations were undertaken by the CUHK Computer Services Centre. The formal delegation was to the Joint Universities Computer Centre Limited (JUCC). (Note that access to the Internet by organisations outside the research community did not become common until 1993 - see for example Clarke 2004) - and hence it was normal in all countries that were connected to the Internet prior to that time for one or more universities to perform the function).
Following the Internet's widespread adoption, a Government consultation paper in 1999 led to the formation of an independent not-for-profit corporation limited by guarantee. It was to manage the .hk domain as a public resource, reflecting the many different interests, and preventing any person or company gaining control and extracting monopoly rents. The transition was achieved by means of JUCC vesting the technical operations in a new company - Hong Kong Domain Name Registration Company (HKDNR). Ownership of HKDNR was then transferred to the new not-for-profit company.
In March 2002, the delegation of the .hk domain was transferred to Hong Kong Internet Registration Corporation Limited (HKIRC). HKIRC's primary authority derives from its recognition by ICANN as the delegate for the domain. In addition, and as a factor in gaining that delegation, it has a Memorandum of Understanding (MoU) with the HKSAR Government.
There are 6 second level domains (2LDs). According to the description provided, each was envisaged as having specific purposes, as follows:
In addition, so-called 'direct allocation' of 2TLDs (such as hku.hk and xamax.hk) is supported. In many ccTLDs of significant size, direct allocation is very limited or not permitted; but HKIRC permits what it refers to as 'generic' domain names, and with a lower level of documentation than is required for domains in the 'more reputable' 2TLDs.
The Registration Agreement and associated Rules include a warranty that the registrant will "not knowingly use the Domain Name in violation of any applicable laws and regulation". The declared registration requirements (current in November 2008, but apparently dating to 2005) appear by international standards to be highly exacting.
HKDNR also offers Chinese-character domain-names within each of the 6 2TLDs and the 'generic' ccTLD. The characters that can be used are a combination of the .cn language table and the .tw language table. The site provides a tool for conversion between Chinese Domain Names and ASCII.
A dispute resolution policy exists. However, it does not appear that any information has been published about the numbers of disputes, their nature, or their outcomes.
According to the company's 2007-08 Annual Report, in late 2008 there are about 170,000 domain names within the .hk ccTLD, including 90,000 in .com.hk, 60,000 'generic' i.e. directly-allocated 2LDs, and 10,000 with Chinese-characters for the subsidiary domain-name (but not yet for the ccTLD or 2TLD, i.e. they are within .hk, .com.hk, etc.).
It is fundamental to corporate governance that each Director represents the company as a whole, and not sectional interests. A Board that comprises representatives of constituencies inevitably faces significant challenges arising from conflicts of interest. It demands considerable commitment from all Directors to the mission of the company, and strong Chairmanship. It is a credit to the Boards in the multiple countries that use this model and that have successfully steered between the shoals and sustained an effective community-managed company.
HKIRC, as constituted in 2002, comprised 13 Directors, all of them representing categories of stakeholder, as follows: Users (6), Service Providers (2), IT Industry (2), Commerce and Industry (1), Tertiary Institution (1), Government (1). Tensions were inevitable, and this appears to have had more than a little negative impact on the company's performance.
One particular source of difficulties was the emergence of the .asia domain. Although this is not actually a direct competitor to .hk, there are competitive aspects (e.g. for skilled staff); and the sponsors of .asia were for a time Directors of HKIRC. Another issue would naturally have been varying opinions about the scale of the financial base needed to secure the company's future. Another may have been the natural preference by user-organisations for easy domain name acquisition and management.
A further potential source of tension has been the retention of all operational activities within HKIRC, specifically within its subsidiary HKDNR. The model adopted in many other countries involves the non-profit community company using a purchaser-provider approach. Under this arrangement, HKIRC would focus on the establishment and maintenance of policies, and possibly the operation of the register, but would stimulate, and exercise control over, a commercial market for the sale and management of domain-names, by licensing companies to perform those functions.
In May 2007, the HKSAR Government issued a Consultation Paper (GCIO 2007). This identified 5 broad models for ccTLD administration (p. 5):
The Government indicated a preference "to retain" the existing model, which is the first of those listed above - "an arms-length, non-profit making organisation" - but with the qualification "in the near term" (p. 6).
However, it signalled an intention to change the governance arrangements, with "a new Consultative and Advisory Panel (CAP) that engages a broad set of stakeholders", such that "the number of directors in the Board can be reduced to allow more effective strategic and operational management" (p. 6). The structure proposed was anything but "arms-length", however. It featured 4 Government appointees and 3 representatives, one each for three constituencies; and the CAP was also to comprise government appointees (Annex pp. 1-2).
In May 2008, controversy arose from a report by McAfee Inc. that "Hong Kong (.hk) soared in 2008 to become the most risky country TLD, with 19 .2 percent of all sites tested rated red or yellow" (McAfee 2008, p. 3), and "Hong Kong (.hk) experienced the most dramatic increase in overall risk this year, increasing 18 .0 percentage points from 1.18 percent to 19.18 percent" (p. 7).
As with most commercial 'research', the 'methodology' (p. 4) is extremely vague, and the analysis and conclusions are highly suspect. Such work would never survive even the most casual review by an academic scholar, and the McAfee Report was criticised in local media (e.g. Mok 2008, Yui Kee 2008a). However, HKDNR was quoted (p. 7) as accepting that an enhancement to the registration process, which brought with it a leap in registration of 76% (p. 8), had made it easy for scammers to acquire .hk domains. It also appears that the apparently exacting registration requirements referred to above were not being applied.
HKDNR stated that it had taken corrective action as early as mid-2007, but this did little to reduce concerns. Indeed, the 2007-08 Annual Report (p. 18), published in the third quarter of 2008, shows that the spike in spam abuse was restricted to May to July 2007, a full year before the McAfee Report was published. Despite its extraordinarily low quality, the McAfee Report attracted media coverage (e.g. Chui 2008a). It caused considerable embarrassment, and perhaps some harm to the .hk 'brand'.
In a response to a question in Legco on 25 June 2008, the Secretary for Commerce and Economic Development in the HKSAR Government stated that, in the second half of 2006, HKIRC had implemented changes to its processes intended to be more user-friendly, which had resulted in the domain becoming highly attractive to spammers and hackers. Action by government regulatory agencies, and changes by HKIRC, had corrected that anomaly, including through the cancellation of more than 14,000 domain names. In short, "the timing of the [McAfee] survey happened to coincide with a brief period in which the .hk domain was being targeted by malicious operators".
The answer to the question in LegCo also stated that "the delegation [of the .hk domain] is made to an entity designated by the authorities of the country or territory concerned". This is not consistent with the procedure specified by ICANN (v9, 2007-10-01). That document states that:
This mis-depiction of the role of governments generally in the delegation of ccTLD administrative powers could be seen as being indicative of a desire on the part of the HKSAR Government to dilute the community self-management aspects of HKIRC and substitute a government authority.
Given that concern existed about the policy and operational activities of the organisation, it might well have been thought appropriate for the government to weigh in, in order to steady the organisation. The government had no formal power to do so, but the threat to withdraw from the MoU would have undermined HKIRC's standing with ICANN; so considerable informal power existed.
An interim administrative arrangement might have been sufficient. But instead even more radical measures were instituted than those that had been foreshadowed in the Consultation Paper in 2007.
During the process, reference was made to the successful arrangements in Australia, through .au Domain Administration Ltd (auDA). The Board composition of AuDA comprises at least 8 and up to 11 Directors:
However, the new model adopted for HKIRC bears only a very limited relationship to the AuDA model. The changes proposed to the Extraordinary Meeting on 23 August 2008 (HKIRC 2008b) were as follows:
A Consultative and Advisory Panel is nominally required under new Article 47A, but it has no power to give directions to the Board, and in any case its members, its terms of reference and timing of establishment are able to be determined by the Government alone.
The proposal was opposed by at least some parties (e.g. Webb-Site.com 2008). The process by which the changes were instituted attracted comment in the media Chui (2008b), and Yui Kee (2008b) was highly critical of it.
Nonetheless, the 13 elected Directors of HKIRC signed its death warrant as a community-managed organisation. From 23 August 2008 onwards, HKIRC can be operated not, as the rhetoric of May 2007 had it, "arms-length from Government", but "as an arm of Government".
In November the new HKIRC was yet to emerge from the rubble of the old one. The Annual General Meeting on 25 September 2008 had deferred not only the election of the new Directors, but also the announcement of the appointed directors. The first round of appointees are therefore yet to be known.
In many countries, ccTLD administration is being successfully performed under the not-for-profit organisation model. Such companies are formed by a community, and the community comprises many interest groups. It is common for the Directors of these companies to be elected by stakeholder groups.
From a governance perspective, it is highly undesirable to have Directors who represent stakeholder groups. They have deep-rooted conflicts between their legal obligation to represent the interests of the company as a whole and their desire to please their constituency. Hong Kong has experienced some difficulties with representative Directors. It is re-constituting the Board, dramatically reducing the influence of user-groups, providing services suppliers with as much representation as all user-groups combined, and providing the Government with effective control of the organisation.
It remains to be seen whether what amounts to a Government takeover of a community organisation will overcome the difficulties created by an insufficiently disciplined representative Board, without creating new tensions, and without enabling Government interference in the operation of a vital community resource, and even outright government dominance of Internet activities in HKSAR.
Chui T. (2008a) '.hk - World's most dodgy domain' The Standard, 5 June 2008, at http://www.thestandard.com.hk/news_detail.asp?pp_cat=30&art_id=66841&sid=19216680&con_type=1
Chui T. (2008b) 'Govt meddling fears hit .hk domain' The Standard, 21 August 2008, at http://www.thestandard.com.hk/news_detail.asp?pp_cat=11&art_id=70535&sid=20270854&con_type=1&d_str=20080821&sear_year=2008
Clarke R. (2002) 'Overview of Internet Governance' Xamax Consultancy Pty Ltd, August 2002, at http://www.rogerclarke.com/II/Governance.html
Clarke R. (2004) 'Origins and Nature of the Internet in Australia' Xamax Consultancy Pty Ltd, January 2004, at http://www.rogerclarke.com/II/OzI04.htmlGCIO (2007) 'Consultation Paper on the Review on Administration of Internet Domain Names in Hong Kong' Government Chief Information Officer, Commerce, Industry and Technology Bureau, May 2007, at http://www.ogcio.gov.hk/eng/pubpress/download/edomainreview.pdf
HKIRC (2008a) 'Annual Report 2007-08' Hong Kong Internet Registry Corporation Ltd, 2008, at https://www.hkirc.hk/pdf/hkirc_oct02.pdf
HKIRC (2008b) 'Notice of Extraordinary General Meeting on 23 August 2008' Hong Kong Internet Registry Corporation Ltd, 31 July 2008, at https://www.hkirc.hk/pdf/general_meetings/egm/2008/Circulars/NoticeEGM2008.pdf
McAfee (2008) 'Mapping the Mal Web, Revisited' McAfee, June 2008, at http://us.mcafee.com/en-us/local/docs/Mapping_Mal_Web.pdf?cid=45044
Mok C. (2008) 'The '.hk' dodgy domain scandal' Computerworld Hong Kong, 8 July 2008, at http://www.cw.com.hk/article.php?type=article&id_article=1885
Webb-Site.com (2008) 'Stop the .HK Takeover', 19 August 2008, at http://webb-site.com/articles/hkirc.htm
Yui Hee (2008a) 'Lies, Damn Lies and the Mean Cyber-Streets of Hong Kong' Yui Kee Newsletter, June 2008, at http://articles.yuikee.com.hk/newsletter/2008/06/a.html
Yui-Kee (2008b) 'Major Changes in Hong Kong's Domain Name Governance' Yui Kee Newsletter, August 2008, at http://articles.yuikee.com.hk/newsletter/2008/08/c.html
Roger Clarke is Principal of Xamax Consultancy Pty Ltd, Canberra. He is also a Visiting Professor in the Cyberspace Law & Policy Centre at the University of N.S.W., a Visiting Professor in the E-Commerce Programme at the University of Hong Kong, and a Visiting Professor in the Department of Computer Science at the Australian National University.
The content and infrastructure for these community service pages are provided by Roger Clarke through his consultancy company, Xamax.
From the site's beginnings in August 1994 until February 2009, the infrastructure was provided by the Australian National University. During that time, the site accumulated close to 30 million hits. It passed 50 million in early 2015.
Sponsored by Bunhybee Grasslands, the extended Clarke Family, Knights of the Spatchcock and their drummer
Xamax Consultancy Pty Ltd
ACN: 002 360 456
78 Sidaway St, Chapman ACT 2611 AUSTRALIA
Tel: +61 2 6288 6916
Created: 1 November 2008 - Last Amended: 4 November 2008 by Roger Clarke - Site Last Verified: 15 February 2009
This document is at www.rogerclarke.com/II/HKDNA-0811.html