New SOW Synopsis 2025-01-17 CLEANED 4pm.pdf

Top Level Domain Registry Management & Maintenance of the .us Domain

Synopsis of New Statement of Work

The National Telecommunications and Information Administration (NTIA) is considering a modernization of the Statement of Work (SOW) for Top Level Domain (TLD) Registry Management and Maintenance requirements of the .us Domain (usTLD). NTIA is seeking industry questions and comments on these updates. The existing and historic .us contracts are available online here. Key issue areas are outlined below, but the following elements of the current contract will likely be retained:

• Contract Type: This is a fixed price, no cost contact. The Contractor will not receive any funding from the United States Government during the performance of the contract.

Contractor consideration will be received through fees provided by applicants for .us domain registrations and other complimentary services.

• Cost/Price: The Contractor shall not charge the United States Government to perform the requirements of this Contract. The Contractor may establish and collect fees from third parties provided the fee levels are approved by the Contracting Officer and are fair and reasonable. The current Schedule of Supplies/Services, summarized below, may be retained or, alternatively, adjusted if a shorter duration is determined to be more appropriate.

• Schedule: A base Period of Performance of two years is anticipated with four additional two-year optional Periods of Performance.

Key Issue Areas:

DNS Abuse: NTIA is considering enhancing the SOW to include more rigorous requirements to prevent, mitigate, and disrupt malicious activity within usTLD, including “DNS Abuse,” which has been recently defined in ICANN contracts as phishing, pharming, botnets, malware, and spam (when spam serves as a delivery mechanism for the foregoing abusive activities).1

Third party access to .us registration data, and registrant data privacy: The current SOW requires the Contractor to “maintain a publicly-accessible, accurate, and up-to-date registration (WHOIS) database for all usTLD registrations.” At present, the registration information of .us registrants (e.g., name, email, physical address, and phone numbers) is published openly on the global

1 Through a series of amendments to its contracts with generic Top Level Domain registries and registrars, ICANN now “requires these parties to take mitigation steps to address well-evidenced DNS Abuse, which, for the purposes of ICANN agreements, is limited to malware, botnets, phishing, pharming, and spam used as a vector for delivering the other forms of DNS Abuse.” New Report: ICANN’s Enforcement of DNS Abuse Mitigation Requirements, ICANN, https://www.icann.org/en/announcements/details/new-report-icanns-enforcement-of-dns-abuse-mitigation-requirements-08-11-2024-en (Nov. 8, 2024).

https://www.ntia.gov/page/us-domain-space#:%7E:text=NTIA%20supervises%20the%20administration%20of,awarded%20to%20Neustar%20in%202019.

https://www.icann.org/en/announcements/details/new-report-icanns-enforcement-of-dns-abuse-mitigation-requirements-08-11-2024-en https://www.icann.org/en/announcements/details/new-report-icanns-enforcement-of-dns-abuse-mitigation-requirements-08-11-2024-en

Internet. NTIA has long supported access to .us registration data by legitimate parties who make legitimate requests. NTIA is exploring ways to enhance registrant data privacy within a registration data access system.

Nexus Requirement: The usTLD is intended to serve the Internet community of the United States and does so through a United States nexus requirement. NTIA is exploring enhancing the enforcement of the nexus requirement.

Kids.us Statutory Obligation: The Dot Kids Act of 2002 (the Act) is “[a]n act to facilitate the creation of a new, second-level Internet domain within the United States country code domain that will be a haven for material that promotes positive experiences for children and families using the Internet, provides a safe online environment for children, and helps to prevent children from being exposed to harmful material on the Internet, and for other purposes.”2 NTIA is exploring how to identify and develop potential uses of the kids.us domain that are consistent with its objective of providing a safe space on the Internet for children.

Multistakeholder consultation on usTLD policy: NTIA is considering requiring enhanced transparency and other adjustments to the current SOW requirement for multistakeholder community engagement in the management of the usTLD, including policy development.

Security: NTIA is considering updates and modernization of the current security commitments including cyber incident reporting.

While NTIA will retain core policy and technical requirements for the usTLD, by modernizing the contract’s SOW, NTIA is inviting input on the above key areas – and other, fresh policy ideas –to enhance the usTLD for the Internet community of the United States.

2 Dot Kids Implementation and Efficiency Act of 2002, Pub. L. No. 107-317, 116 Stat. 2766 (2002).