One company on the planet, US-based Afilias, meets the criteria to run Colombia's trendy .co registry – and the DNS world fears a stitch-up

Special report The Colombian government has been accused by its own internet community of fixing a contract so that just one North American company in particular is eligible to operate the .co top-level domain-name registry.

In a tendering process that has become increasingly controversial, the Colombian government’s technology ministry produced a list of technical requirements for overseeing 2.3 million .co domain names. But many are saying that the requirements actively exclude everyone in the market except US-based registry operator Afilias.

While those technical requirements appear to be designed to ensure that only the largest registry operators in the market are eligible, one of criteria even excludes the company that has been running the .co registry for the past 10 years, Neustar: a fact that Neustar itself pointed out.

Despite having migrated more than 50 top-level domains in the past two years, UK-based Centralnic is also ineligible, thanks to a requirement to have, at some point, handled the migration of one million domain names at once.

And, incredibly, even VeriSign – the operator of the world’s largest registry, dot-com – may not eligible because of that requirement to have migrated one million domain names in one go. Other registry operators, including Donuts, which runs over 200 top-level domains, and Nominet, which runs over 13 million .uk names, as well as a number of other registries, are also excluded.

In fact, the technical requirements listed by the Colombian government mean that just a single company on the planet is eligible to run the .co registry, despite it being ranked somewhere between 18 and 24 in global registries in terms of size (depending on whose statistics you go with).

That peculiar situation may not have been a mistake, some are beginning to suspect, given the strange behavior of the South American nation's Ministry of Technology (Mintic) that is running the process.

Superbowl

The fact that the .co contract was reopened for tendering was somewhat surprising given that when the current contract began, roughly 10 years ago in 2009, the .co registry barely existed with just 28,000 domains. Back then, the task of operating the registry was assigned to a Colombian company and a team built around entrepreneur Juan Diego Calle, who built a global brand out of the .co domain, most famously featuring in a number of Superbowl commercials in the US paid for jointly with mega-registrar GoDaddy.

By the time that company – .CO Internet – sold itself to US giant Neustar (which runs over 200 TLDs including .us, .nyc and .biz, and ran the back-end of .co) for $110m in 2014, the registry held more than 1.6 million names. Don't forget, a .co domain was the trendy address to own at one point, like .io and .com.

Neustar has run the registry since with most of the .CO Internet team now Neustar employees and the registry has often been held up as a success story within the industry: .co domains cost double what a dot-com and most other domains cost but thanks to its branding efforts it has a large and loyal customer base.

The current contract contains a provision to extend it for a further 10 years and the internet industry largely expected that to happen. So it came as a surprise when the Colombian government used a meeting of DNS overseer ICANN in November last year to announce a retendering process.

As became clear later, the new Colombian government had been ignoring Neustar’s requests to renegotiate the contract for more than a year – something that clearly infuriated executives at the company and led Neustar to sue the government the day before it gave its presentation at ICANN’s meeting.

Industry insiders have told The Register that the souring of the once close relationship between Neustar and the Colombian government confused them – until they saw the evaluation criteria for the rebid. It was, one source who wishes to remain anonymous told us “custom-built for Afilias.”

To add context, in recent years Afilias and Neustar have been in a fierce two-way battle to pick up registry contracts.

Rebid

In 2016, the operator of the .org registry, PIR, announced it would rebid for the contract to oversee its 10 million names. Afilias had run the day-to-day backend operations of the highly profitable registry for PIR for many years, and Neustar made a forceful bid for the contract among others. In the end, Afilias and PIR won the contract back, though only after cutting a third off its previous bid.

In 2017, Afilias was also announced as the winner of a controversial rebid of the .au registry contract, taking over Neustar’s role. That rebid came amid turmoil at the registry: accusations of unusually large expense accounts, lack of accountability, and political interference. The registry lost two CEOs, a chairman and several board members and an internal member revolt required the Australian government to step in. The decision to open the .au registry contract, covering over three million names, to the lowest-cost bidder was a factor in those problems.

The next year, it was Neustar’s turn to take a contract away from Afilias: it beat the company in a rebid of India’s .in registry in 2018 with over two million domain names. The battle was equally intense with Afilias suing the Indian government and claiming that Neustar “has no experience or technical capability to manage and support IDNs [internationalized domain names] in Indian languages and scripts, and neither does it claim to have prior experience in Indian languages.”

With the two companies fighting tooth-and-nail for any contracts that expired, when Colombia announced it would also open up its .co registry for a rebid, industry observers immediately suspected Afilias had been in the government’s ear.

Very strange

But even with that history, those involved in the .co rebid have been struck over how the tendering has unfolded. It has been a “very strange process,” said one person willing to go on the record, Gerardo Aristizabal. Aristizabal is general manager of the Internet Marketing Center and partnered with Centralnic to bid for the .co registry.

He told The Register he was surprised when he realized that Centralnic – despite being one of the biggest global registry operators – was not eligible under the .co criteria. Even more so when Neustar announced it also wasn’t eligible.

In fact, as those interested in bidding began to realize how restrictive the terms were, one attendee at a meeting in Colombia earlier this month asked the ministry’s representatives bluntly why the entire process appeared designed to give the contract to Afilias. Another asked whether technology minister Sylvia Constain had held any bilateral meetings with Afilias executives in recent months.

The minister denies any impropriety. She told W Radio the process followed guidelines produced by the International Telecommunications Union.

“This is a transparent open process where we are building the process that benefits most I can bring to Colombia, the technical terms that have been included in the tender have been made with the International Telecommunications Union so there are several companies that can participate in this operation,” Constain explained.

When asked who those companies were, Constain said she wasn’t allowed to say because it would violate the principles of the bidding process: an argument that has been met with incredulity. Constain also denied privately meeting Afilias representatives, though at the same time noted she was a member of the internet community and so regularly met people interested in Colombia’s progress on the web.

We have asked Afilias for comment, and will update this story if it gets back to us.

Local concerns

Amazingly, that is not the only thing that has made people suspicious of the process. For one, despite .co being Colombia’s country-code top-level domain, and used extensively by Colombian citizens, there is nothing in the evaluation criteria that gives additional weight to bids from companies with local presences.

That is something that Aristizabal says he and others raised with the ministry, and dropped when it became clear it was not going to even consider adding it as a factor. Others have been surprised that there is no weight given to marketing or community building efforts – especially when a big part of .co’s success has been down to its enormously successful branding and community building efforts among startups, Colombians, and women entrepreneurs.

Instead, the bulk of the evaluation criteria has been built around a lowest-cost model with 70 per cent of the weighting given to bidders’ “economic proposal,” with 19 per cent on technical, 10 per cent on national industry and 1 per cent on handicap workers. The economic proposal contains a lot of complicated looking formula that amount to nothing more than: lowest cost wins.

That low-cost model goes directly against .co’s success (as mentioned previously, it charges double the market rate, roughly $20 per domain per year) but it does closely reflect Afilias’ business model, further raising suspicions that a deal was struck in private.

The Colombian government's comment process produced 21 responses from largely businesses in the nation with 354 comments, resulting in a 126-page summary and response [PDF]: something that the ministry noted “demonstrates the interest aroused by the tender for the operation of the .co domain.”

Most suggested additions to the criteria. As quick examples, website hosting outfit ColombiaHosting complained that there is no weight given to local presence; Centralnic said the one-million-domain-transfer requirement was “unnecessarily restrictive” and “not necessarily proof of capacity and adequate experience for the operation.”

Others, including GoDaddy, raised concerns over the lack of weight given to the marketing and promotion of .co. SpamHaus asked for more focus on domain abuse systems. And so on.

Wrong stats

But adding to a sense that those behind the evaluation process have little to no understanding of their own registry, it also became clear that the ministry has been working from inaccurate statistics taken from an automated stats engine rather than the actual registry figures.

In the technology ministry’s public evaluation documents, the .co registry’s growth is presented as an upward soaring curve, with the one million domain milestone reached in 2016. Whereas in reality, the growth curve is the complete mirror image, with slowing growth after an initial burst of interest and the million-domain point reached five years earlier in 2011. A downward sloping curve is the standard situation for mature internet registries.

In short, if Mintic did in fact carry out an economic analysis of the registry that it has put out for rebid, based on that upward growth curve, then any conclusions it drew would have been entirely incorrect.

There is still a chance that Mintic will revise its criteria to allow companies other than Afilias to become eligible. Despite refusing to agree to any changes made in writing and in person to the first round of public comment, the ministry is expected to put out a revised set of documents later this month that many hope will allow for real competition in the process.

Aristizabal continues to give Mintic the benefit of the doubt, saying that it is possible the relatively new team at the technology ministry simply doesn't understand the market or the reasons behind .co’s success. He is hopeful a public meeting will spark a rethink, especially given the fact the decision to award the .co contract to small, local company .CO Internet a decade ago was, at the time, a bold and unexpected one, but which paid off massively.

Others are less sure. Several large registry operators that have bid for other contracts have stayed away from .co, with one telling us that there was little point trying to win against a “rigged system.” ®