VeriSign has withdrawn a proposed anti-malware policy that was clear and straightforward and aimed at doing good. Unfortunately, it would have placed them in the middle of some very big political messes. This is the problem facing all attempts to govern the internet.\n\tThe Anti-Abuse Domain Use Policy was submitted to ICAAN with the good and reasonable goal of letting VeriSign quickly take down sites harboring malware, launching phishing attacks, or otherwise being used for internet attacks. Specifically it would have let the company deny, cancel or transfer \u00a0"any registration or transaction or the placement of any\u00a0domain name on registry lock, hold or similar status as necessary.\u201d\n\tIt then said that \u201cas necessary\u201d meant:\n\t(a) to protect the integrity, security and stability of the DNS\n\t(b) to comply with any applicable court orders, laws, government rules or requirements, requests of law enforcement or other governmental or quasi-governmental\u00a0 agency, or any dispute resolution process;\n\t(c) to avoid any liability, civil or criminal, on the part of VeriSign, as well as its affiliates, subsidiaries, officers, directors, and employees;\n\t(d) per the terms of the registration agreement,\n\t(e) to respond to or protect against any form of malware (defined to include, without limitation, malicious code or software that might affect the operation of the Internet),\n\t(f) to comply with specifications adopted by any industry group generally recognized as authoritative with respect to the Internet (e.g., RFCs), \u00a0\u00a0\n\t(g) to correct mistakes made by VeriSign or any Registrar in connection with a domain name registration, or\n\t(h) for the non-payment of fees to VeriSign. VeriSign also reserves the right to place upon registry lock, hold or similar status a domain name during resolution of a dispute;\n\tThe problems arise with point (b), which says it will be used to comply with court orders, government rules or requests from governments. \u00a0\n\tFirst, how do you determine jurisdiction on the internet? Can one nation order a site to be shut down that is run from another nation? What happens if China doesn\u2019t like something being put out by a site in Taiwan? If Taiwan objects then someone has to arbitrate. It is hard to imagine that either VeriSign or ICAAN would want that responsibility.\n\tWhat if Germany objects to sites which violate laws around the use of Fascist symbols? What if Iran objects to sites which don\u2019t support the lie that the Holocaust didn\u2019t happen?\n\tWould VeriSign (or any other managing body) have any discretion over what requests from governments it will honor? Whether it did or not, that body would then be responsible for enforcing a lot of morally problematic laws. What if Egypt\u2019s or Libya\u2019s governments had decided Twitter and Facebook and similar sites needed to be taken down to promote public order? There are few if any nations where the government doesn\u2019t view maintaining its power as essential to the public good and will take actions to enforce that.\u00a0\n\tOne possible solution is to restrict access from a geographic area, this would comply with the nation\u2019s laws and allow the site to continue operating. For the sake of the discussion, lets just say this could be done effectively. It is hard to imagine any of the internet managing groups could handle being at the epicenter of the public and political storms some of these actions would cause.\n\t(Neither VeriSign nor ICAAN has responded to requests for comment on this.)\n\tA precise definition of malware could have been used as the determining factor when dealing with government requests. In that case action would only be taken if the request for action also met the criteria to be defined as malware. Unfortunately in order to be useful for this malware would have to be defined so narrowly and technically that it would have to be continually redefined to keep up with technological developments. The policy says malware is \u201cdefined to include, without limitation, malicious code or software that might affect the operation of the Internet.\u201d That is very good and useful way to define it for probably 99 percent of the situations this plan would have encountered. It is the other 1 percent where things get very dicey.\n\tVeriSign\u2019s goal with this policy was a very laudable thing: Making it possible to move quickly against threats to the internet. Unfortunately there are a few situations which would create huge problems out of doing this. None of these problems are new or unique to this plan, of course. For years the internet's managing bodies have muddled through as best they could and done a pretty good job. Soon, if not now, that may not be enough.\n\tI don\u2019t have a solution and neither does the rest of the world. That\u2019s why we have things like the U.N., and numerous international courts (or similar) which deal with issues from the laws of the sea to international trade disputes. We may need something similar for the internet.