For several years, SIDN has been one of the few domain registries in the world to have its own notice-and-take-down procedure. The procedure isn't based on a legal obligation, such as hosting firms have. SIDN was actively involved in development of the Dutch Notice and Take Down Code, aimed mainly at hosting firms and, to a lesser extent, internet service providers (ISPs). That led to us deciding to set up a similar system for .nl domain names.
Weighing up the pros and cons
Bringing in the procedure was by no means an obvious move. There were lots of counterarguments. First, there were the technical issues. By disabling a domain name, you aren't actually removing the offending content from the web. That remains on the server and can still be accessed. After all, the domain name is just an aid to finding the content. What's more, caching by ISPs means that many people can still use the domain name for a while after SIDN has disabled it. On the face of it, therefore, taking down a domain name isn't a very effective way of dealing with problematic content.
Another counterargument is that a notice-and-take-down policy casts SIDN in the role of judge and jury, or even the role of internet censor.
Nevertheless, it was apparent to us that situations sometimes arose, where it was clear that content linked to a .nl domain name was illegal or unlawful, but getting it taken down wasn't easy, for practical reasons. Such situations often involved sites hosted abroad – typically in remote countries – and registrants that either didn't exist or were outside the reach of the Dutch authorities.
In such cases, it can be helpful to take down the signpost to the content, even if it's a while before there is any effect. And, yes, that does mean SIDN acting as judge and jury. But our procedure allows us to take on that role only when it's very clear that content is illegal or unlawful. It's also worth noting that SIDN can't look to the government in such situations, because under the current law neither the police nor the courts can order SIDN to disable a domain name.
Ultimate sanction, for very sparing use
In view of all the counterarguments, our procedure explicitly states that taking down a domain name (to be technically precise, removing it from the DNS zone) is something that we will do only in the last resort. So the procedure is in line with the principle underpinning the Notice and Take Down Code, i.e. that offending content should be dealt with as close as possible to the source. In other words, primary responsibility to act lies with whoever put the content on line. If they won't or can't do anything, the onus switches to the website owner, then the domain name's registrant, then the hosting firm, then the registrar and finally SIDN. So, whenever we receive an NTD request, we check whether the requester has first tried all the other links in the chain. If they haven't, we refer them back to the links that they've skipped.
Even if we are convinced that the content is illegal or unlawful, and the requester demonstrates that they've already tried all the other parties in the chain without success, we don't immediately intervene. Before doing anything ourselves, we try contacting the registrant, the registrar and sometimes the hosting firm to see whether we can get them to deal with the problem. Only if they refuse or drag their heels will we delink the name servers.
What happens in practice?
In practice, we very rarely take down a domain name. In 2016, we received thirty-one NTD requests. Only two led to us taking action. In most cases, the content was taken down or other appropriate action taken after we contacted the hosting firm and the registrar.
There are also safeguards. If we decide to take down a name, the registrant can appeal to the Complaints & Appeals Board. However, that has never actually happened yet. If fact, in all the years since we introduced our procedure, only one registrant has even contacted us about a take-down decision. That person acknowledged their error, promised to change the content straight away, and got their domain name reactivated within two hours. Taking the effects of caching into account, it's likely that hardly anyone ever noticed that the domain name was temporarily off line.
In the near future, I'll be writing a follow-up post about SIDN disabling domain names on its own initiative.
