IGF 2024 DC-DNSI Governance Gaps in addressing online harms: NIS2 and Beyond

This session was an expansion of the discussion during IGF 2023 on governance gaps in addressing online harms. Building on the previous year’s insights, the purpose of this year’s session emphasised the impact of emerging regulation, particularly with regards to the NIS2 Directive. The panel explored how industry collaboration within a multistakeholder framework can bridge these gaps with better collaboration and coordination within the industry. The session was structured into two segments: the first around the NIS2 Directive and the difficulty of implementing complex regulation. The second session focused on supporting policymakers by enhancing cross-industry collaboration. Speakers represented diverse sectors, including civil society, technical communities, and the private sector, ensuring a well-rounded exploration of the issues and participation from the audience.

Chris Buckridge, the session’s moderator, introduced the overarching theme by outlining the role of the multistakeholder model in shaping responses to emerging regulation. He emphasised the need for collaborative approaches that bring together diverse perspectives to address the complexities of online harms and their governance. The first segment set the scene by discussing the regulatory landscape and the challenges posed by jurisdictional and governance gaps.

Bertrand de La Chapelle opened the discussion by highlighting the inherent tension between the transnational nature of the internet and the jurisdictional boundaries of national legal systems. He described the challenges of reconciling these differences while preserving the internet’s open and global character. Bertrand introduced the concept of the “Goldilocks rule,” which emphasises the need to balance strong, weak, and fragmented implementations of the NIS2 Directive to avoid creating further governance gaps. He stressed that compatibility amongst laws and coordinated action within the European Union are crucial for effective governance.

Emily Taylor followed with a detailed analysis of the NIS2 Directive, focusing on its implications for the DNS industry, particularly Article 28, which imposes obligations around domain name registration data. The DNS Research Federation has provided a NIS2 Tracker to document the implementation of Article 28 and Emily noted that 23 out of 27 EU member states had missed the transposition deadline, prompting infraction proceedings.  She highlighted the directive’s extraterritorial effects, which disproportionately impact the Global South who may not always have a say in the process. Stakeholders in these regions often lack representation in the regulatory process but are still required to comply with the resulting rules. Emily also emphasised the role of cooperation groups like the NIS2 Cooperation Group in interpreting challenging aspects of the directive and facilitating compliance.

Jean-Jacques Sahel discussed the complexities of online harms and the increasing trend of extraterritorial legislation. He highlighted how countries across the globe, not just in the Global North, are implementing laws with potential impacts well beyond their borders. Jean-Jacques emphasised the importance of conducting impact assessments, encompassing economic, technical, and broader societal effects. He highlighted that a number of legislations relating to the internet have failed to adequately evaluate its implications, particularly on internet infrastructure. He also emphasised the need for governments to adopt a consultative, multistakeholder approach to policy development. Noting the rapid evolution of online harms, Jean-Jacques called for ongoing dialogue amongst industry, governments, technical communities, and consumer groups to better understand the practical realities of addressing these issues. He noted that a basic understanding of existing processes to flag harmful content remains low, and efforts to mainstream multistakeholder participation are necessary to ensure effective governance frameworks.

Keith Drazek from Verisign ended the first segment of the discussion by elaborating on the challenges of the ICANN multistakeholder process and its bottom-up consensus-building approach. He noted that the failure of the ICANN community to deliver satisfactory solutions had led to fragmented regulations and inconsistency is not helpful. Keith called for more efficiency and effectiveness in multistakeholder processes to avoid regulatory overreach and ensure better collaboration.

The second segment shifted focus to practical solutions through industry cooperation. Keith Drazek emphasised the need for greater collaboration across the internet ecosystem, advocating for improved coordination among registries, registrars, hosting providers, and other stakeholders. He highlighted the importance of proactively identifying and mitigating harms and ensuring that industry engagement informs policymaking. This proactive approach can help align regulations with industry realities and capabilities, reducing the risk of fragmented governance.

Jean-Jacques Sahel and other speakers emphasised capacity building as a key strategy for addressing governance gaps, particularly in underrepresented regions. They called for the mainstreaming of multistakeholder approaches at national and regional levels to ensure inclusive and effective governance. Jean-Jacques highlighted the evolving nature of online harms and the need for continuous dialogue between industry, technical experts, and policymakers to address these challenges effectively.

Participants raised critical concerns about the NIS2 Directive, particularly its potential overreach and implications for privacy rights and regulatory consistency. The “Brussels effect” of EU regulations was a recurring theme, with discussions on how extraterritorial laws impact regions like the Global South, where stakeholders often lack a voice in the legislative process. Participants also stressed the importance of sustained dialogue and improved coordination mechanisms to address these challenges.

Another key issue was the need for clarity and alignment in legal frameworks to facilitate effective cross-industry collaboration. Misaligned laws often hinder efforts to combat scams and fraud, creating obstacles for companies attempting to share information in a compliant and efficient manner. Speakers and participants alike emphasised the importance of addressing these barriers through thoughtful legislative design and inclusive consultations.

This session underscored the complexities of addressing online harms through governance and regulation. By examining the impact of the NIS2 Directive and emphasising the importance of collaboration, speakers and participants highlighted actionable strategies for bridging governance gaps. The session concluded with a call for enhanced global coordination, reformed multistakeholder models, and strengthened industry cooperation to ensure a safer and more inclusive internet ecosystem.

The panel offered several actionable recommendations to address the governance gaps discussed during the session. They called for policymakers to engage in broader and more inclusive consultations to ensure regulations like NIS2 are equitable and effective. Speakers emphasised the need for cross-industry frameworks to foster collaboration, particularly in combating scams and fraud. Capacity-building initiatives should be expanded to empower stakeholders in underrepresented regions, ensuring their voices are included in the regulatory process. Finally, multistakeholder models must evolve to become more efficient and responsive, enabling timely and impactful solutions to the challenges posed by online harms.