Controlling the Internet

Membership, Legitimacy and InternetNZ

Disclosure of interest. I write this as a member of InternetNZ, although I do not agree with its direction of travel or the way in which it has drifted from its original role. I am also a member of the Free Speech Union.

I formerly taught Law and Information Technology at the University of Auckland Law School, where the domain name system and the issues surrounding Internet governance and control featured strongly, and those issues have been discussed fully in the various editions of my text Internet.law.nz – selected issues. Much of this article draws on matters that were the subject of that course, and which have sharpened as the years and the technology have progressed.

Introduction

The Government now regards the Internet as critical infrastructure. It was not always so. The Internet arrived in New Zealand, and developed here, on an essentially ad hoc basis. Yet at the heart of its operation lies the domain name system — the addressing system without which the Internet could not function at all. The domain name system is therefore itself an essential part of that critical infrastructure, and in New Zealand it is operated, and largely although indirectly controlled, by a charitable incorporated society: InternetNZ.

One further point should be kept in mind throughout. The Internet is no more and no less than a communications system — a means of transporting information in digital form by a variety of modes. It follows that questions about who controls the Internet are, at bottom, questions about the control of information, and they sit in permanent tension with the freedom of expression that democracies value.

On 12 June 2026 the Board of InternetNZ met, and the following item of business was recorded:

“The Board discussed concerns regarding critical infrastructure obligations that may necessitate a future review of membership number and types to provide the Government with assurance that membership has a commitment to the work of InternetNZ, that the organisation is stable, and that the Board has appropriate skills and diversity. Further legal advice is necessary before any formal motions regarding membership can be proposed, the Board will continue to progress this topic as the outcomes of Government cybersecurity evaluations become clearer.”

The minute has prompted concern that InternetNZ may take steps to restrict or modify its membership, or the qualifications for membership, and in doing so compromise the “bottom up” model that has underpinned the management of the Internet from its beginnings.

This article traces how control of the .nz domain name space came to rest with InternetNZ; where the Government sits in that arrangement by way of a Memorandum of Understanding; how InternetNZ is structured and what role its members play; what the Board minute means and what options it opens; and the wider implications for an organisation stewarding critical infrastructure at the very moment the Government is designing a cybersecurity regime for such infrastructure. One point may be made at the outset: to change the rules relating to membership, or the qualifications for membership, the consent of the existing members will be required.

The Delegation: Where InternetNZ’s Authority Comes From

InternetNZ’s authority over .nz derives from no New Zealand statute. It rests on delegation within the global domain name system, backed by community trust rather than government mandate.

InternetNZ holds the delegation for the .nz country code top-level domain (ccTLD), and the guiding basis for the management of ccTLDs is set out in RFC (Request for Comment) 1591. Under RFC 1591, ICANN, acting as the IANA Operator, is responsible for the global DNS functions, including the delegation of country code top-level domains. The technical and administrative authority thus flows from IANA/ICANN, which recognises InternetNZ as the designated manager for .nz in the root zone.

The history is brief. IANA originally delegated the .nz namespace to John Houlker in 1987, with the University of Waikato issuing domain names and maintaining the registry in the early years.

In 1996, Houlker, IANA and the Internet Society of New Zealand (Isocnz) agreed to redelegate .nz to Isocnz — the organisation that later became InternetNZ.

Importantly, this is not ownership in any legal sense. Consistent with RFC 1591, there is no concept of “ownership” in holding a ccTLD delegation. InternetNZ serves at the pleasure of the local Internet community, part of which is its membership, and regards the role as one held in trust on behalf of that community.

This trustee framing is the traditional model for ccTLD managers worldwide, and the delegation could in principle be revoked or transferred if the manager failed to serve the local community. That principle — that InternetNZ’s standing depends entirely on serving the whole of the local Internet community — will recur throughout this article, because it is the foundation on which everything else rests.

In practice, InternetNZ exercises its authority by operating the .nz Register — a single shared registry system managing the registration of .nz domain names — and by setting the .nz Rules that bind registrars and domain holders, with the ordinary laws of New Zealand applying to those rules as matters of contract and consumer law rather than through any dedicated domain-name legislation.

Policy compliance and enforcement is handled through its Domain Name Commission. It is, in essence, a self-regulatory model: authority delegated by IANA/ICANN under RFC 1591, held in trust for the New Zealand Internet community, and implemented through contractual rules governed by New Zealand law, without any Act of Parliament conferring the role.

The Government and the Memorandum of Understanding

In May 2016 InternetNZ signed a Memorandum of Understanding with the Ministry of Business, Innovation and Employment (MBIE) for the management of the .nz domain, under which InternetNZ has a duty to manage the domain in service to the local Internet community.

The MoU sets out the general principles governing the relationship between MBIE and InternetNZ, framing them as two “significantly interested parties.” When it was announced, the Government described it as setting expectations for how InternetNZ would operate the domain in the interests of New Zealand Internet users, establishing a process for dealing with any concerns between the parties, and providing a clear statement of how the relationship should operate.

The MoU is notable for what it does not do: it does not give the Government control. Because ccTLDs have a strong link with a country’s identity and its Internet users, the Ministry is a “significantly interested party” as defined in RFC 1591, and its secondary role is a monitoring one, connected to the Government’s wider position as representative of New Zealand’s citizens.

The instrument formalises a government oversight interest without converting the relationship into regulation. It remains current — the published version has an appendix amended as recently as August 2025, reflecting the 2018 restructure under which InternetNZ delegated aspects of its .nz role to its wholly-owned subsidiary, Domain Name Commission Ltd — and it is a soft-touch instrument, terminable by mutual agreement or on 60 days’ written notice by either party.

Two practical features complete the picture.

First, moderated domains: under the .nz Rules, a Moderator appointed by the Government determines who may register names within .govt.nz and ensures compliance with the Moderation Policy, with similar arrangements for spaces such as mil.nz and parliament.nz. The Government views .govt.nz names as held and managed by the Crown through individual agencies, and accepts the RFC 1591 model under which domain names are licensed rather than sold.

Secondly, international representation: the Government participates in ICANN’s Governmental Advisory Committee, advising ICANN on policy and operations generally, while InternetNZ represents the .nz community directly in ICANN’s ccTLD structures. Beyond the domain space, InternetNZ maintains less formalised working relationships with agencies such as MFAT, DPMC and MBIE, providing input into policy areas including critical infrastructure and emergency regulation.

The overall picture is of a Government that has deliberately chosen a cooperative, multistakeholder arrangement — an MoU plus moderation of its own namespace — rather than legislating or contracting for control of .nz, leaving InternetNZ’s underlying authority resting on the IANA delegation.

InternetNZ: Structure and Membership

InternetNZ is not a company. Its formal legal name is Internet New Zealand Incorporated: an incorporated society and registered charity responsible for managing the .nz domain.

It was established in 1995 (originally as Isocnz) under the Incorporated Societies Act 1908. Incorporation gives it separate legal personality — it can hold property, enter contracts such as the MoU and its registrar agreements, and sue or be sued in its own name — while remaining a member-based, not-for-profit body rather than a shareholder-owned company.

The incorporated society structure is available only to organisations not carried on for the financial gain of members, which fits the community-trustee role.

The legal framework for societies has recently been overhauled. The Incorporated Societies Act 2022 required all existing societies to reregister by 5 April 2026 on pain of ceasing to exist.

InternetNZ undertook a constitutional review to align with the new Act (incorporating recommendations from a 2022 independent review), and at a Special General Meeting on 31 March 2025, 85% of voting members approved the new constitution, which took effect on reregistration.

The new constitution states explicitly that the Society administers the .nz Domain Name Space for the collective benefit of Aotearoa New Zealand and that the domain space is critical national infrastructure.

While the parent body is a society, it operates partly through companies. Domain Name Commission Limited, a wholly-owned subsidiary, manages .nz on its behalf under an operating agreement, with ultimate responsibility remaining with InternetNZ. (A second subsidiary, NZRS, ran the registry until 2018, when its people and services were folded into InternetNZ itself.)

Open membership by design. InternetNZ has long described itself as a non-profit, open membership organisation — a membership-led body welcoming people from all backgrounds, with membership costing $21 and carrying the right to vote on decisions about how the .nz infrastructure is governed, including who its governors are.

Benefits include voting in Board elections and on member motions, event invitations, and participation in its online community. There is no gatekeeping by profession, industry or invitation: anyone who cares about the Internet in New Zealand can apply and pay the subscription.

The constitution establishes three classes — Individual Members, Organisational Members, and Fellows (an honorary class recognising significant contribution) — so companies, ISPs, registrars and community organisations can join alongside individuals. Rights attach to being paid up: an “Eligible Member” is one who has paid the subscription, so a lapsed member loses voting eligibility even if nominally still on the books.

The three-month rule. The most consequential regulatory mechanism is the rule — in place since August 2010 — that membership rights accrue only after three months. Those rights include notice of, attendance, speaking and voting at general meetings, together with voting in Board elections and standing for the Board.

The rule is essentially a safeguard against capture: it prevents a coordinated bloc from joining en masse immediately before a vote and swinging the outcome.

That safeguard was stress-tested in early 2025, when membership more than doubled in a matter of weeks after a Free Speech Union newsletter urged supporters to join and oppose the constitutional rewrite.

Because the new joiners could not vote until they had been financial members for three months, they were unable to vote at the March 2025 SGM (though they could observe by livestream), and the constitution passed with 85% support among those eligible. The episode will recur in this article, because it demonstrated something important: control of a nationally critical asset is, in principle, contestable by any organised group willing to pay small subscription fees and wait ninety days.

The 2022 Act adds a statutory overlay: the society must keep a register of members, consent is required to become a member, and the constitution must set out how people become and cease to be members, along with dispute resolution procedures consistent with natural justice — which InternetNZ’s constitution addresses, with disputes guided by both natural justice and tikanga.

The tension inherent in this model deserves emphasis. Open, low-cost membership is what gives InternetNZ its legitimacy as trustee “at the pleasure of the local Internet community” — but it is also what makes the organisation theoretically vulnerable to entry by any motivated group. The three-month rule and the eligibility framework are the principal tools by which it balances openness against that risk.

Reading the Board Minute

The minute of 12 June 2026 is doing a great deal of work in a few sentences, and it sits at the intersection of everything discussed so far.

What is driving it. The reference to “Government cybersecurity evaluations” is almost certainly the current regulatory reform process. In February 2026 the Government published the New Zealand Cyber Security Strategy 2026–2030, with improving the cyber security of critical infrastructure as a key initiative, and consulted from 27 February to 19 April 2026 on measures to enhance the critical infrastructure system, seeking feedback primarily from owners and operators who would be directly affected.

The discussion document identifies seven essential services, including “telecommunications and data,” and proposes a mix of voluntary and mandatory measures — monitoring, supervision, compliance and enforcement tools, fines, enforceable undertakings, civil and criminal penalties, and at the serious end personal criminal liability for directors of up to $100,000 for a serious breach or $500,000 for a critical one.

The .nz registry and authoritative DNS would very plausibly fall within the telecommunications and data category — and InternetNZ’s own constitution already concedes the point by declaring the domain space critical national infrastructure. Decisions about who will act as regulator have not yet been taken, which explains the Board’s wait-and-see posture.

Why membership is the pressure point. If .nz is formally designated critical infrastructure, the Government’s assurance question becomes: who ultimately controls the operator? For InternetNZ the answer is “whoever the members are” — a body anyone can join for $21, and whose composition, as 2025 showed, can double within weeks.

The three-month rule blunted that episode, but a regulator applying the “fit and proper” or stability expectations common in critical infrastructure regimes would reasonably ask about the vulnerability it exposed.

Hence the Board’s three assurance targets: that membership “has a commitment to the work of InternetNZ,” that “the organisation is stable,” and that “the Board has appropriate skills and diversity.”

The tension it creates. This is the genuinely hard part. InternetNZ’s authority has never rested on statute; it rests on the RFC 1591 trusteeship, reinforced by the MoU duty to manage the domain in service to the local Internet community — and open membership is the very mechanism by which “the local Internet community” expresses itself.

Tighten membership too far — commitment tests, vetting, caps — and InternetNZ risks eroding the legitimacy on which its delegation and MoU standing depend, and inviting the criticism that the leadership is insulating itself from accountability.

Loosen it, and the capture risk that worries the Government remains. The Board is being asked to reconcile a multistakeholder-legitimacy model with a regulated-utility-assurance model.

Why “further legal advice” is genuinely needed. Several constraints bear on any change. Under the 2022 Act the constitution must set out how people become and cease to be members, and amendments require member approval — meaning the existing membership would have to vote, likely by special majority, to restrict future membership rights.

Natural justice obligations, embedded in the constitution alongside tikanga, would constrain any mechanism for refusing or terminating members.

And because InternetNZ is a registered charity, constitutional changes must remain consistent with its charitable purposes and be notified under the Charities Act 2005. (There is also a statutory floor of ten members — hardly the binding constraint here.)

The minute’s caution — no formal motions until legal advice and regulatory clarity — is therefore not boilerplate.

Instructive precedents. Australia’s auDA went through almost exactly this cycle: the Australian Government, using its formal terms of endorsement over .au, required auDA to reform its membership and governance after stability concerns, resulting in a curated membership model and a skills-based board.

Nominet (.uk) faced the inverse: member activism forced out its leadership at a 2021 EGM — a reminder that curated membership does not eliminate member power; it concentrates it.

Together they illustrate the spectrum InternetNZ is navigating, and the auDA example shows how a government can convert informal “assurance” expectations into effective conditions.

New Zealand’s MoU is softer than Australia’s endorsement mechanism, but that softness cuts both ways: it is also the instrument the Government could revisit if it wanted firmer assurance short of legislation.

The Toolkit and Its Costs

It helps to separate the minute’s three assurance targets — commitment, stability, and board capability — because different mechanisms address each, and they carry quite different implications.

Commitment. The mildest tools work on the qualifying path into voting rights rather than on membership itself: extending the three-month rule to six or twelve months; converting it into an engagement-based test (voting rights accruing only after a renewal cycle, attendance at a general meeting, or participation in a consultation); or a probationary “associate” tier under which anyone may join but full voting membership requires time, a track record, or endorsement.

Subscription pricing is a blunter lever — a higher fee filters casual sign-ups but sits uncomfortably with the organisation’s accessibility values and does little against a funded campaign, since $21 multiplied by several hundred is trivial money for a motivated lobby.

The strongest version is qualitative admission criteria — applicants demonstrating alignment with the society’s objects, or admission subject to Board or committee approval. The 2022 Act permits this, since nothing requires admission to be automatic, but it transforms the character of the society: once a committee judges who is sufficiently “committed,” membership stops being self-selecting and starts being curated, and the criteria themselves become contested territory — exactly the fear raised during the 2025 constitution fight, where critics objected to the idea of a nominating committee vetting participation.

Stability. Stability tools work on how member power is exercised rather than on who joins: higher thresholds for constitutional change or board removal; staggered board terms so that no single election can replace a majority; caps on how many members may join within a period, or automatic deferral of voting rights when membership grows anomalously fast — an “anti-surge” rule that generalises what the three-month rule achieved by accident in 2025; and weighted or college-based voting, with separate electoral colleges for individual members, organisational members and the technical and registrar community, so that no single college controls outcomes.

The most structural option is insulation: shifting operational control of the registry further into the subsidiary layer under long-term operating agreements, so that even a captured parent society could not quickly redirect .nz operations.

InternetNZ is already partway there through DNCL, and lengthening the contractual and governance distance between member votes and registry operations is probably the option most attractive to a future regulator, because it provides assurance without touching membership openness at all.

Board skills and diversity. Here the levers are the elected/appointed balance and candidacy criteria. The new constitution already provides for two to three appointed members alongside elected ones; that ratio could shift further toward appointment against a published skills matrix (cybersecurity, infrastructure operations, te ao Māori, finance, public policy).

Candidate eligibility rules — minimum tenure, disclosure requirements, fit-and-proper-style declarations — and a nominations committee assessing (or merely reporting on) candidates against the matrix are the standard toolkit.

The furthest position is a majority-appointed board, which effectively converts the members’ role from electing governors to ratifying them.

The likely landing zone — and the cost. Almost every mechanism above trades legitimacy for assurance to some degree. If reform proceeds, the likely destination is a two-tier structure: broad, cheap, open participation (newsletters, consultations, community fora — the demonstrative “community” for RFC 1591 purposes) sitting beneath a smaller, qualified governing membership whose rights are earned through time or engagement, with a more heavily skills-appointed board above both. That is essentially the auDA trajectory.

But the longer-run implication is identity drift: each step from open society toward curated stakeholder body moves InternetNZ from community trustee toward quasi-regulated critical-infrastructure operator.

Individually the steps are defensible; cumulatively they change what kind of thing InternetNZ is, and they raise a real question about whether the incorporated society form remains the right vehicle at the end of that road — some ccTLD managers have concluded it is not, and restructured entirely. Nor is that necessarily wrong: it is the trajectory most ccTLDs of nationally significant scale have followed.

But it is a constitutional-identity question as much as a compliance one.

There is also a democratic-optics risk specific to timing: membership reform proposed shortly after the leadership survived an entryism attempt will inevitably be read by critics as the incumbents pulling up the ladder, whatever the regulatory rationale. And whatever is proposed, the current members must vote for it.

Much also depends on the shape of the eventual regime. If the legislation imposes obligations at the operational level — security standards, incident reporting, director duties — structural and board-level responses may suffice and membership can stay open.

If the Government instead signals concern about control of the entity itself, membership reform becomes harder to avoid, and that is when the legitimacy trade-off gets sharp.

Is This About Fear of Capture?

Substantially yes — though it is two distinct capture fears layered together.

The first is the one 2025 made vivid: capture of the society by an organised faction exploiting open membership — cheap to attempt, visible in real time, and only weakly deterred by the three-month rule.

The second is the Government’s mirror-image concern: that a designated piece of critical national infrastructure sits under an entity whose ultimate control is contestable for the price of subscription fees and patience. The Board minute reads as an attempt to get ahead of the second before the regulator forces the issue — demonstrating voluntarily that control of .nz is stable, so that the eventual regime does not need to impose harder mechanisms (licence conditions, step-in powers, or a statutory operator model) from outside.

But it would be incomplete to reduce it entirely to capture. The “skills and diversity” limb reflects a separate and genuine problem: a regime contemplating personal criminal liability for directors demands a board competent in security and risk, and popular election from a small general membership does not reliably produce that.

And beneath everything runs an institutional self-preservation logic: InternetNZ’s strongest argument for keeping the self-regulatory, MoU-based model rather than statutory control is that it can credibly assure the Crown on its own initiative. In that sense the membership review is less a retreat from the community model than an attempt to save it in modified form — conceding enough on openness and board composition to keep the delegation, the MoU and the multistakeholder framework intact, rather than losing the whole arrangement to legislation designed for entities that never had members at all.

The Wider Policy Mandate

InternetNZ is not seen — and does not see itself — merely as the manager of the domain name space. It claims a wider policy mandate in the realm of Internet governance, and it was a strong supporter of the Labour Government’s Safer Online Services and Web Platforms proposals and the Christchurch Call.

The question is whether that wider role compromises its fundamental one: overseeing a critical aspect of critical infrastructure. There is a genuine tension here, and a real strategic risk.

The wider mandate is real, and it is not new. InternetNZ has never presented itself as a bare registry operator: its policy functions expressly include Internet governance, .nz Rules development and public policy, and the breadth is inherited from its origins as the Internet Society of New Zealand, founded on the objective of an open Internet that “cannot be captured by any entity for their own ends.”

Most ccTLD stewards do some version of this — surplus from domain fees funding research, grants and advocacy is a standard model. The mandate itself is not a deviation; it is constitutive. The question is really about the content of the advocacy.

On the Safer Online Services proposals, InternetNZ framed the DIA’s discussion document warmly — describing it as “a huge milestone that opens opportunities for making the Internet safer for everyone in Aotearoa” — and actively encouraged Māori participation in the consultation, noting the proposal for a Māori role in the governance of the proposed regulator.

The Free Speech Union submitted on the same document from the opposite direction. Content regulation is precisely the terrain on which the New Zealand Internet community is most divided, and when the steward of shared infrastructure takes a discernible side on the most contested Internet-policy question of the day, some portion of the community for which it claims to hold .nz in trust will conclude that the trustee does not represent them.

The 2025 membership surge was, among other things, that conclusion expressed in subscription fees.

Is the role compromised? InternetNZ’s authority has no statutory floor; it rests entirely on the claim to serve the whole local Internet community, plus the MoU. Legitimacy is its only asset — and legitimacy with the whole community, not a sympathetic half of it.

Three specific risks follow.

First, perceived alignment invites exactly the capture attempts the Board now worries about: a body seen as politically tilted becomes a target for counter-mobilisation, and each cycle of contest destabilises it further.

Secondly, it complicates the Crown relationship across changes of government: an organisation seen as enthusiastic about one government’s regulatory agenda has less credibility as a neutral infrastructure partner for its successor — at precisely the moment the critical infrastructure regime is being designed.

Thirdly, and most structurally, advocacy about content regulation sits uncomfortably close to an entity that operates the technical layer.

The Domain Name Commission’s post-Christchurch “emergency tools” — domain suspension and site-locking — mean the group does possess content-adjacent powers, and critics during the constitution debate explicitly feared a body “setting itself up as internet judge and jury.”

Once the steward of the pipes is perceived as having opinions about what should flow through them, the neutrality claim that justifies its monopoly weakens.

There are counterarguments, and they deserve a fair hearing.

The registry itself has stayed content-neutral: InternetNZ’s consistent line through the constitution fight was that the rules governing the domain name system were not changing, and that any move affecting content would require public consultation.

The .nz Rules remain a first-come, first-served, viewpoint-neutral licensing system; the constitution, as InternetNZ notes, sets the governance framework, not the technical operation of .nz; and DNCL’s role adds a structural layer between policy advocacy and registry decisions.

As to Te Tiriti, the centering followed a specific institutional event — the 2022 independent review commissioned after two Māori council members resigned over the organisation’s slow response to content inciting violence against Māori — and can be characterised as a response to a governance failure and to obligations as a New Zealand charity rather than as ideological positioning; Treaty frameworks are operated by institutions across the spectrum, including the Crown itself.

And the members ratified the direction 85–15 among those eligible to vote. It must equally be said, however, that Te Tiriti-centred governance is itself a contested political judgment in New Zealand at present, not a neutral description.

To sum up: the wider policy mandate does not inherently compromise the fundamental role — Internet governance advocacy is part of what a ccTLD trustee in the multistakeholder tradition exists to do, and the registry’s operational neutrality appears intact.

But the manner of its exercise has created a perception problem that is strategically corrosive regardless of whether the underlying criticism is fair, because a community trustee cannot afford to be seen as a faction.

The organisations that have navigated this best — auDA again being instructive — have drawn a bright, visible line: the registry function run with strict neutrality and ring-fenced governance, while policy advocacy is either narrowed to infrastructure-layer issues (openness, security, resilience, DNS abuse) where the community broadly agrees, or clearly separated from the stewardship function.

Advocacy on content regulation, where the community fundamentally disagrees, is the layer most costly to occupy.

The deeper irony is that the perception of political alignment and the fear of capture are the same problem seen from opposite ends. The organisation is contemplating tightening membership to prevent capture by its critics, while its critics mobilised precisely because they saw the organisation as already captured by a worldview. Both sides are, in effect, disputing who “the local Internet community” really is. An entity whose entire legal authority rests on serving that community undivided has a strong institutional interest in making that question boring again — and the surest way to do so is for the .nz role to be so conspicuously neutral, and so clearly insulated from the policy arm, that neither the Government nor any faction feels the need to contest it.

What If the Government Withdrew from the MoU?

Could InternetNZ’s legitimacy be compromised if the Government changed or withdrew from the Memorandum of Understanding? The answer turns on a distinction between authority and legitimacy that runs through everything InternetNZ does.

Withdrawal would not remove InternetNZ’s authority. The MoU is not the source of its control over .nz: the delegation comes from IANA under RFC 1591, and the MoU is expressly an agreement between two “significantly interested parties” — a statement of principles for the relationship, not a grant of power, and deliberately fragile in its termination terms. The day after withdrawal, InternetNZ would still hold the delegation, still operate the Register, and still have contracts with every registrar. Nothing operational would change.

But legitimacy is a different matter, and withdrawal would damage it significantly. Domestically, the MoU is the Crown’s standing endorsement that the self-regulatory model is working. Withdrawal would be the Crown formally signalling that it no longer has confidence that InternetNZ manages .nz in service to the local Internet community — or at least that it wants a different arrangement.

For an organisation whose entire claim rests on community trusteeship rather than statute, losing the endorsement of the community’s elected government would be a serious wound: it would embolden internal critics, unsettle registrars and large domain holders, and place every governance controversy under a harsher light.

Internationally is where it would bite hardest. In the ICANN/IANA framework, governments occupy a privileged position with respect to their own ccTLDs. The GAC’s 2005 Principles on ccTLDs articulate the view that ultimate public policy authority over a country’s ccTLD rests with the relevant government, and IANA’s practice in delegation and redelegation decisions weighs the views of the territory’s government heavily alongside those of the local community.

A ccTLD manager operating with documented government support is close to unassailable; one operating after a public withdrawal of that support is structurally exposed. Redelegations away from incumbent managers are rare and IANA is cautious — it requires evidence of the local community’s views, not just the government’s — but the historical direction of travel is consistent: where governments have seriously contested a ccTLD arrangement, the arrangement has eventually changed.

South Africa legislated a statutory .za authority; Australia used its formal endorsement power to force root-and-branch reform of auDA; the United Kingdom took reserve statutory powers over .uk in the Digital Economy Act 2010 permitting intervention if the registry fails in specified ways. New Zealand’s MoU is the soft end of that spectrum — which means that withdrawing from it would be the natural first step on the path toward any of the harder models.

The critical infrastructure reform changes the calculus fundamentally, because it is exactly the vehicle through which a harder model could arrive. If .nz is designated within scope — and InternetNZ’s own constitution, by calling the domain space critical national infrastructure, makes exclusion awkward to argue — several consequences follow regardless of what happens to the MoU.

First, the relationship inverts: a peer-to-peer instrument between two interested parties, with a mutual concerns process, is replaced by regulator and regulated entity, with obligations flowing one way and backed by penalties. The Government would not need to “withdraw” from the MoU to change the power balance; the legislation would do it automatically, and the MoU would either be updated to reflect the new reality or quietly lapse into irrelevance.

Secondly, the assurance question stops being voluntary: everything the Board minute contemplates — membership stability, board skills — becomes potentially examinable by a regulator rather than offered as goodwill, and a regime imposing personal criminal liability on directors implicitly demands governance arrangements capable of bearing it. That is leverage over InternetNZ’s internal structure that no MoU ever provided.

Thirdly, and most consequentially, legislation could restructure the arrangement itself, along a spectrum: designation of InternetNZ as a critical infrastructure operator with security obligations (the lightest option, leaving the delegation model intact); statutory reserve or step-in powers over .nz on the UK model (the model persists, but under an explicit sword); through to a statutory licensing or authority model on the .za pattern, under which the self-regulatory era simply ends.

Which end of the spectrum eventuates depends substantially on whether the Government trusts the incumbent — which is what makes the MoU, and the confidence it embodies, strategically precious to InternetNZ even though it is legally slight.

The synthesis is this. Withdrawal would compromise legitimacy not by revoking anything, but by removing the domestic anchor of a legitimacy structure that has no other formal foundation, at the precise historical moment when the Government is building statutory machinery that could replace the informal model entirely.

The MoU functions less like a contract and more like a certificate of confidence, and its real value is preventative: as long as it stands, the Government has an agreed channel for concerns and no need to reach for harder instruments. Its withdrawal would not be the injury itself; it would be the diagnosis that the injury is coming.

That is why the Board’s current posture — proactively offering assurance on stability, membership commitment and board capability before the regulatory design settles — is best understood as an effort to keep the relationship on MoU terms. The realistic goal is not avoiding critical infrastructure obligations, which are almost certainly coming for the registry function in some form. It is ensuring that when the regime lands, InternetNZ is treated as a trusted operator to be regulated lightly within the existing delegation model, rather than as a governance risk to be restructured around. The MoU surviving, in updated form, alongside the new regime would itself be the signal that the community-trustee model has been preserved; its disappearance without replacement would signal the opposite.

Conclusion

These are troubled times for InternetNZ. There has been genuine disquiet about the direction it has taken, and the very fact that an organisation whose legitimacy has always depended upon open membership is now contemplating a review of that membership must give cause for concern.

My own view is that InternetNZ would be better advised to concentrate on what it was entrusted to do: the stewardship of the domain name space. It has a proper role in developing policy and offering advice, but it should take care never to align itself with contested or extreme positions. A trustee for the whole community cannot afford to be, or even to appear to be, a partisan for part of it.

The risk it runs is that the Government steps back from the Memorandum of Understanding and absorbs oversight of this critical infrastructure into some new and as yet undefined — perhaps as yet unimagined — regulatory structure, though one may be confident the bureaucrats, especially in the DIA, have not been idle in imagining it.

That would be a tragedy for the Internet in New Zealand. The strength of InternetNZ was always its complete independence: it was, at least until it ill-advisedly associated itself with the Christchurch Call, genuinely apolitical. The perception now is that it may no longer be so. If InternetNZ is to recover the widespread credibility and support it once commanded, it would do itself — and the Internet — a considerable service by returning to what it does best, and reassuming that apolitical position.