Nick Wenban-Smith
General Counsel & Head of Stakeholder Relations
On 7 February 2023 the Home Office announced a consultation in relation to the Computer Misuse Act 1990 (CMA). Specific questions are asked, with responses requested by 6 April 2023.
The consultation includes proposals for a new specific power for UK law enforcement agencies (LEAs) to seize, take down or prevent the creation of domain names (and IP addresses) which support criminal activity.
The stated rationale for the creation of this new procedure is that voluntary arrangements currently in place are often ineffective or not available, and that analogous powers exist in the United States and elsewhere across the globe. This new CMA power would therefore bring the UK in step with other countries and allow more effective cooperation with LEAs around the world to more effectively tackle a global problem.
Nominet has for many years cooperated with UK LEAs to ensure that any criminal use of .UK, .cymru and .wales domain names is quickly actioned under our Criminal Practices Policy. This allows UK LEAs to suspend any domain name administered by us within 48 hours upon provision of a certificate confirming criminal use of a domain. This policy has been very effective in practice and is acknowledged by government as representing a strong example of responsible industry co-operation. As disclosed in our annual transparency reports, in the year to 31 October 2022 2,106 domains were suspended. For context, Nominet administers around 11 million domain names.
As part of this work, Nominet also has a pilot project working with a small group of UK LEAs to redirect traffic to domains used in crime to informational landing pages. These link to resources from Action Fraud, the Financial Conduct Authority and the Medicines and Healthcare products Regulatory Agency – and help prevent internet users from becoming the victims of online crime.
Whilst the consultation paper makes it clear that voluntary arrangements such as Nominet’s should “remain the primary means of means of taking down domains that are supporting criminal activity as they provide a fast and effective response”, these proposals are somewhat problematic for Nominet in that should a statutory power exist for LEAs, then Nominet might reasonably be expected to insist that LEAs use that power (which would have a clear basis in law and be subject to judicial supervision).
The new statutory process would inevitably take much longer than 48 hours. The duration of online criminality and potential harm to users may then be considerably longer than at present, a result which would be contrary to Nominet’s public benefit mission. One of the specific consultation questions directly addresses this issue: “Q5: How can voluntary agreements, which are the preferred route for takedowns, be protected?”
We will therefore engage with the Home Office to seek a constructive solution which allows our rapid suspension processes to continue, whilst meeting the government’s stated aims to allow more effective global cooperation to counter criminality online.
In addition, the consultation proposes the introduction of a requirement on Nominet not to register certain defined domain names. The suggestion is that it is possible to predict that a domain name will be created for criminal purposes, for example where it mimics a business or a government department. This is a notoriously complex area in which to legislate, involving freedom of expression and some idiosyncrasies of the English language (for example the domain name princestrust.org.uk contains the word incest). We believe that Nominet’s current process of algorithmic screening of all newly-created domain names and applying additional scrutiny to potentially high-risk names, combined with industry leading dispute resolution processes, effectively tackles this issue and there is no need for a block list of domains which we are not allowed to create.
We would encourage interested stakeholders, including Nominet members and registrars, to read the consultation in detail and to respond to it. If you’d like to share your thoughts with us, please email [email protected]. Nominet’s own proposed response will be discussed with our UK Registry Advisory Council later this month and then published on our website for transparency.
Update: the Nominet response, informed by the UKRAC, can now be found here.