ICANN87 GAC Communiqué Sets Out Priorities for a Safer Internet

Governments call for progress on tackling abuse, enabling legitimate data access and protecting users as the domain name space expands

By Nivaldo Cleto*

The official GAC^[i] Communiqué from ICANN87^[ii], released on 26 October, follows up on the discussions held in Bali about security and the expansion of the domain name space. [9]

Having followed the meeting’s discussions, I believe this document helps identify the work that needs to move forward over the coming months. For Brazilian businesses, it is useful to follow how these proposals could improve fraud prevention and incident response.

Understanding the positions of governments

The GAC brings together government representatives and advises ICANN on public policy issues within its mission. Its advice has a specific status under the organization’s Bylaws. The communiqué records the committee’s positions, but publication does not automatically turn every proposal into a contractual obligation. Each issue’s decision and implementation processes need to be followed. [2]

Addressing domains associated with malicious activity

DNS^[iii] Abuse includes practices such as phishing, which deceives people into providing information, and malware distribution. ICANN contracts already impose obligations to address these abuses on registry operators and registrars, the companies that offer domain name registrations. [3]

One policy initiative under development concerns checking other domains associated with accounts involved in actionable abuse reports. Discussions include the criteria, timelines and safeguards for these checks. [4]

The GAC supports cooperation across registrars and implementing this policy before new extensions enter the DNS. [1]

Verifying data before a domain becomes active

Another issue is the debate over the 15-day timeline under existing contractual arrangements for validating and verifying contact information for gTLDs^[iv]. The GAC recommends completing these steps before a new domain becomes accessible through the DNS. Implementation still involves discussions about policy development and contractual amendments. [5]

For anyone relying on the Internet to sell products or serve customers, I see value in reducing opportunities for malicious use at the start of registration. Applying these measures also requires consideration of legitimate users and service providers’ operational capacity.

Organizing legitimate access to registration data

The RDRS^[v] and the future SSAD^[vi] are part of the effort to organize requests for nonpublic registration data. The GAC advocates a permanent system with mandatory participation by all gTLD registrars and effective handling of requests concerning privacy and proxy services. [6]

For urgent requests covered by the policy, the priority is to operationalize authentication of law enforcement requestors and the 24-hour response requirement. Making that requirement effective depends on completing the necessary mechanisms. Responding to a request involves assessing it and does not mean automatic disclosure of the data. [5] [6]

I believe clear procedures help both those investigating an incident and those who must assess a request while protecting the data in their care.

Expanding extensions with consumer protection

The 2026 Round of new gTLDs requires governments to prepare to review applications and use the available participation mechanisms, including comments and early warnings. The Applicant Support Program is also part of this agenda. [7]

In the communiqué, the GAC highlights safeguards for applications linked to public services and regulated sectors, such as healthcare and finance. These assessments may lead to public interest commitments being incorporated into registry agreements. [1]

From a business perspective, I believe a new extension needs to inspire trust. Opportunities to expand brands and services online should come with clarity about the responsibilities of those operating these spaces.

Supporting linguistic diversity and access

The document reports only 21 applications for internationalized domain names, or IDNs^[vii], approximately 1.3% of the total. These figures are preliminary and subject to confirmation after String Confirmation Day in November. [1]

Universal Acceptance, or UA^[viii], aims to ensure that valid domain names and email addresses work across systems regardless of language, script or length. The Bali session addressed the role of governments and the adaptation of digital services. [8]

For a business, this can start with reviewing registration forms and customer service tools. If a system rejects a valid address, it creates a barrier at the very moment a user is trying to engage with the organization.

Following the work after Bali

As a member of the Business Constituency, I believe the business community should follow upcoming consultations and participate in policy implementation. Timelines, responsibilities and the results of the measures adopted all deserve attention.

This is the perspective I bring to following ICANN’s work and sharing my diaries. A business that relies on the Internet has a direct interest in the quality of the rules that support its operation.

*Nivaldo Cleto is an entrepreneur in accounting and digital certification, a member of the Brazilian Internet Steering Committee (CGI.br) representing business users of the Internet, and a member of the ICANN Business Constituency (BC).

Foto – icannphotos