Internet Management: Structured Evaluation Could Help Assess Proposed Transition of Key Domain Name and Other Technical Functions
Highlights
What GAO Found
The National Telecommunications and Information Administration (NTIA) announced that it would transition its oversight of the coordination of certain key Internet technical functions (such as the domain name system) to the global multistakeholder community if a suitable transition proposal were developed. In response, several steps were taken to develop a proposal and address identified risks. The Internet Corporation for Assigned Names and Numbers (ICANN), which operates these technical functions under contract with NTIA, convened stakeholders from technical, government, business, and public interest organizations, among others. These stakeholders formed working groups with the goal to develop a consensus-based proposal they plan to provide to the ICANN board by late fall 2015. The board will then provide the proposal to NTIA. In draft proposals, working groups have proposed new post-transition arrangements to manage identified risks and hold ICANN accountable to the multistakeholder community. For example, stakeholders identified a risk that ICANN could be captured by a particular interest. To address this risk, stakeholders proposed changes that would empower the multistakeholder community to veto board decisions related to ICANN's plans and budget and to remove board members, among other things.
NTIA plans to evaluate the proposal against core goals, such as maintaining the security and stability of the Internet domain name system and the openness of the Internet. However, NTIA has not yet determined how it will evaluate the proposal against the goals. The changes the working groups are considering could create a new organizational environment for the operation of the technical functions, such as new structures, contractual obligations, and governance models for ICANN. Given the extent of these potential changes, GAO identified frameworks for evaluation that could provide tools to guide NTIA's evaluation.
These frameworks incorporate leading practices to help organizations obtain reasonable assurance that their goals and objectives will be met or that they will meet certain requirements. For example, key components of one framework include the organizational environment, risk assessment, and monitoring.
In prior work, GAO has considered such frameworks in relationship to accountability challenges at a variety of organizations. These types of frameworks could help NTIA evaluate whether the transition proposal meets its core goals, and could also be helpful in considering accountability mechanisms that are included in the proposal. For example, one framework's risk assessment component could help NTIA consider the multistakeholder community's efforts to identify and manage risks.
These frameworks are intentionally flexible, so that NTIA could select elements that are applicable to the scope of the proposed transition.
Without a framework as a tool to systematically review the proposal and its various new structures and processes, NTIA may not be assured that its goals for the transition have been fully addressed and embedded over the long term.
Why GAO Did This Study
The U.S. government helped to fund the development of the Internet but since 1997 has envisioned that the coordination of certain Internet technical functions would be managed completely by the private sector. As the Internet has grown, the Department of Commerce's NTIA has contracted with a nonprofit corporation, ICANN, for the operation of these technical functions. In March 2014, NTIA established core goals for a transition proposal and announced that if a suitable proposal could be developed, NTIA would let the technical functions contract expire and transition its oversight role to a global multistakeholder community.
GAO was asked to review implications of NTIA's proposed transition. This report examines: (1) the process of developing a transition proposal and addressing identified transition risks, and (2) NTIA's plans to evaluate a proposal. GAO reviewed NTIA's evaluation plans and identified frameworks for NTIA to use in its evaluation; reviewed transition documents; and interviewed officials from NTIA, other federal agencies assisting NTIA with the proposed transition, and ICANN, as well as stakeholders selected based on their technical, commercial, and academic backgrounds.
Recommendations
GAO recommends that NTIA review relevant frameworks for evaluation and use applicable portions to help evaluate the transition proposal. The Department of Commerce concurred with the recommendation.
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| National Telecommunications and Information Administration | To ensure that NTIA's evaluation of the Internet multistakeholder community's transition proposal fully considers whether the proposal provides reasonable assurance that NTIA's core goals for the transition will be met, the NTIA Administrator should review relevant frameworks for evaluation, such as the Committee of Sponsoring Organizations of the Treadway Commission framework and the International Organization for Standardization quality management principles, and use the relevant portions of the frameworks to help evaluate and document whether and how the transition proposal meets NTIA's core goals. |
In 2015, GAO reported that in response, the Internet Corporation for Assigned Names and Numbers (ICANN) convened stakeholders from technical, government, business, and public interest organizations, among others. These stakeholders formed working groups to develop a consensus-based proposal. NTIA planned to evaluate the transition proposal against core goals, such as maintaining the security and stability of the Internet domain name system, but NTIA had not yet determined how it would evaluate the proposal against the goals. The changes the working groups were considering would create a new organizational environment for the operation of the technical functions, such as new structures, contractual obligations, and governance models for ICANN. Given the extent of these potential changes, GAO identified frameworks for evaluation that could help guide NTIA's evaluation. Without a framework as a tool to systematically review the proposal and its various new structures and processes, NTIA might not be assured that its goals for the transition were fully addressed and embedded over the long term. Therefore, GAO recommended that the NTIA Administrator review relevant frameworks for evaluation and use the relevant portions to help evaluate and document whether and how the transition proposal met NTIA's core goals. In March 2016, the ICANN Board of Directors submitted a transition proposal for NTIA's review. In June 2016, NTIA issued an assessment report of the transition proposal detailing how NTIA implemented GAO's recommendation. NTIA stated that it adopted GAO's recommendation as a tool to supplement its review of the IANA transition proposal. NTIA focused on analyzing the proposal in light of specific areas of one of the frameworks GAO had identified that was developed by the Commission on Sponsoring Organizations of the Treadway (COSO), a voluntary private-sector organization dedicated to improving organizational performance and governance through effective enterprise risk management, among other things. NTIA focused on three portions of the COSO framework as particularly relevant: organizational environment, risk assessment, and monitoring. NTIA included in its assessment a template in which it applied each COSO-based assessment question to the proposals as well as to ICANN's existing practices where appropriate. NTIA made a determination as to whether the practices and/or proposals sufficiently addressed each question. If the practices and/or proposals sufficiently addressed the questions, NTIA provided a justification for that assessment along with citations in support of the justification. NTIA found that the IANA Stewardship Transition Proposal, as well as the entities proposed to be responsible for the performance of the IANA functions, generally adhered to the COSO principles with respect to organizational environment, risk assessment, and monitoring. This evaluation was incorporated into NTIA's final determination that the transition proposal met the criteria necessary to complete the transition of these Internet technical functions to a global multistakeholder community. As a result, NTIA was able to reach and document assurance that its goals for the transition were sufficiently addressed and embedded into the transition proposal. Based on its assessment, NTIA let the contract with ICANN expire on September 30, 2016.
|