Asks U.S. government for cybersecurity reporting carveout for domain registries — Identity Digital

Firm argues that registries and registrars ought to note incidents to ICANN instead of individual governments.

Domain name registry business Identity Digital has asked the U.S. government to create a registry and registrar carveout for cybersecurity incident reporting.

In March 2022, President Biden signed the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA). The law requires covered entities to quickly note cybersecurity incidents and ransom payments to the Cybersecurity and Infrastructure Security Agency (CISA).

In rulemaking, there is a proposed carveout for ICANN, and Identity Digital thinks that registries and registrars ought to also be exempt. The firm reasons these entities ought to note their incidents directly to ICANN rather than to governments.

In its comments to the U.S. government, the firm stated:

…Instead of these piecemeal reporting regimes that apply only to those domain name registries and registrars within their jurisdiction, ICANN, as a global multistakeholder organization that by now maintains a robust compliance program with domain name registries and registrars, is better positioned to establish and monitor domain industry cyber incident reporting. An ICANN-managed reporting scheme would ensure that domain name registries and registrars, wherever they operate, are subject to standardized reporting obligations and maintained by a group with relevant experience and expertise. The reporting under such a program would be tailored to ensure the collection of the information most relevant to the DNS industry and the unique threats it might face…

The firm believes that government reporting requirements like this and the EU’s NIS2 may impact the DNS’s multistakeholder model:

When governments act to directly regulate the DNS, counting domain name registries and registrars, the DNS and the internet become more fractured. The interests of the United States are best served by an open, free, interoperable internet governed by ICANN’s multistakeholder-developed policies and regulations.

The full letter is available here (pdf).