The Indian government authorised the Ministry of Electronics and Information Technology (MeitY) and the National Internet Exchange of India (NIXI) to perform Aadhaar authentication on a voluntary basis or carry out Know Your Customer (KYC) verification for those registering .in domains, according to a notification in The Gazette of India.
NIXI is the government-appointed authority responsible for managing .in domains.
Experts told MediaNama that although this authorisation could be seen as a necessity in view of the recent spurt in cyber attacks on India’s critical infrastructure, it may also go against the anonymous and decentralised nature of the internet. They also questioned how the KYC requirement to register .in domains will be enforced. “One can easily open other email ids, and start owning domain names under that,” said Sijo Kuruvilla George, Executive Director of Alliance of Digital India Foundation (ADIF).
What does the KYC requirement notification say?
Besides voluntary Aadhaar authentication, NIXI is allowed to carry out paper-based or email-based KYC verification. “The customer is required to upload or mail the scanned self-attested copies of his documents with the NIXI and the verification of the validity of details submitted shall be done through mobile and email KYC,” read the notification signed by Jaideep Kumar Mishra, Joint Secretary of MeitY.
As per the notification, users can provide scanned self-attested copies of documents such as:
- Bank passbook or post office passbook with photo
- Voter identity card
- Ration card
- Permanent Account Number
- Driving license
- Passport
- Identity Card
- Certificate of identity issued by a gazetted officer or tehsildar on any official letterhead
- Any other document as specified by the Central government
‘Getting to a point where anonymity in Internet is creating unique problems’
“The internet used to have anonymity as the basis of how things used to happen. But having said that, we are getting to a point in time where anonymity itself is creating a lot of unique problems. I think it’s under reasonable grounds for business to disclose the domains that they hold,” George said.
“However, having said that, the internet is a very decentralised construct. So even if you say that you have to disclose everything, there is simply no way you can track everything. One can simply create two, three email ids, and start owning domains,” he added.
George proposed reasonable restriction to the requirement of e-KYC/Aadhaar authentication which does not make every user liable to verification, but something akin to the Information Technology Rules 2021 where significant social media intermediaries, i.e., platforms with more than 5 million users, were subjected to additional compliances such as appointing grievance redressal officers and so on.
‘There may be similar, more regulations on KYC in the coming days’
Nikhil Narendran, partner at law firm Trilegal, alluded to the increasing number of cybercrimes in India behind bringing KYC requirements for .in domain registrations. There has been an increase cyber crimes in India such as online financial frauds and cyber attacks using spoofing by using genuine looking domain names. This is one of the measures that the government has taken to ensure that the entities who take these domain names also have a KYC to trace the down,” Narendran told MediaNama.
“We may see more regulations on KYC, coming in the way of other service providers and users of online services,” Narendran opined.
NIXI’s requirement for bulk registering .in domains is problematic
In December last year, NIXI published an order stating that entities looking to bulk register .in domains will now require approval from the CEO of NIXI. According to the notice, written approval from the CEO is required in the following two scenarios:
- Individual registrants looking to register more than two domains
- Registered accredited company looking to register more than a hundred domains
- Affects not just business but individuals too: “In the long term, I think that this is very problematic in the sense that it works. It does not just affect small businesses, but it also affects the entire internet ecosystem also,” George said. “As an individual, I have more than two .in registrations. Every now and then when I do see an opportunity, I do take up another domain also. This 2 .in domain is extremely restrictive for the individual,” he said.
- Problems manifold for businesses: “The moment you become a business your needs are even higher. The kind of challenges that you have is manifold, which means you will definitely need at least, two or three domains in the same primary business that you have to try and ward off competition. Secondly, one of the ways in which you drive traffic is always through SEO. And one of the biggest determinants of SEO and search visibility is the domain keywords that you get,” George said.
- Self disclosure system would have been better: He also said that the requirement is going to be a bureaucratic burden in terms of compliance. “But more importantly, sometimes speed also matters. What happens is that sometimes a domain would be available, and I would need it right now. I need to pick it up ASAP. So instead of a bureaucratic approval, had it been a self-disclosure sort of a system — like how we do our tax filing right now. Like, I have a requirement to furnish all the shares I have in an unlisted company. It’s cumbersome but it’s still a disclosure format,” he recommended.
- Website flipping will be affected: George pointed out that the requirement would also impact those who ‘flip websites’. Flipping websites is “buying an existing website which is dormant due to various reasons, improving the overall aspects of its, optimizing the website to various search engines and then improving the traffic on the website. After considerable traffic and selling begin, we sell the website at a much higher price than we bought it for,” according to Your Story.
Did the govt do any impact assessment before introducing this?
“There’s going to be an impact on the whole ecosystem in one way or the other. So unlikely that the government would have taken an action alone, without consultation,” Narendran said. Earlier NIXI, while responding to a Right to Information request, said that restrictions on bulk registering was due to ‘national security’ reasons.
MediaNama reached out to NIXI asking whether it had done an impact assessment of the bulk-registering domains requirement, and e-KYC requirements. We also asked NIXI whether it had consulted the law ministry regarding the notifications. However, we did not receive any response. We had also reached out to ICANN who declined to comment.
Restrictions on registering domains in other countries
Canada: “Those wishing to register a .CA domain must comply with Canadian presence requirement,” said Canada’s Internet Registration Authority (CIRA). This means for one to own a website under .CA domain, he/she has to be a resident of Canada.
European Union: Currently, only those residing in or established in the European Union, Iceland, Liechtenstein, or Norway can register a .EU domain name, according to Namecheap.com.
Japan: One can obtain a Japanese country code top-level domain (ccTLD) “.jp” from outside Japan, but he/she must have a business or organisation registered with a physical address in Japan, according to Search Engine Journal.
Also Read:
Have something to add? Post your comment and gift someone a MediaNama subscription.
