Colombia accused of rigging .co contract for dot-org provider Afilias – is this document a smoking gun?

Analysis Suspicions have grown deeper that a lucrative contract to run Colombia’s .co registry was rigged to favor US-based operator Afilias, thanks to unusual references in one of the South American government’s official documents.

The contract for trendy dot-co – beloved by startups and the like worldwide – is out for tender, and Colombia’s IT ministry, MinTIC, has published the minimum technical requirements bidders must meet to be considered. However, as we reported last month, those requirements were so strict they excluded every registry operator in the world save one: Afilias.

Other companies in the market, including the one that has run .co for the past decade, Neustar, have cried foul, with some accusing the IT ministry of working behind-the-scenes with Afilias to make sure it bags the contract.

The Register took a closer look at the contract's requirements, and spotted references to Afilias-specific operations, suggesting the paperwork was tailored for the US-based company. MinTIC and Afilias have denied any suggestion of collaboration.

What's that doing in there?

On the rebid microsite that MinTIC set up for the tendering process, a key document is Technical Appendix 1 [docx], supplied in English, that outlines various thresholds and service levels that need to be met by any successful bidder.

Digging into the document, the term “Public Interest Registry” appears no less than five times in three of the key criteria. Public Interest Registry (PIR) is the organization that runs the .org registry, and for which Afilias has provided the technical backend since 2002. The references to PIR within the technical requirements suggest the Colombian government was supplied details of Afilias’ contract, including requirements and service levels, with PIR.

There is no logical or legitimate reason for “Public Interest Registry” to appear within the technical requirements for the .co registry. As such, its repeat appearance suggests that the organization's name was not removed prior to the Colombian government publishing the rebid documentation.

PIR is involved in its own controversy with the proposed sale of the .org registry for $1.1bn to a private equity company; a decision that even California’s attorney general is suspicious of and has asked for more information about.

Back to .co, and it would have been more logical for the Colombian government to request the technical requirements of its own top-level-domain registry from the company that has run it for the past decade: Neustar. Neustar confirmed to The Register that it was "not consulted by MinTIC on any technical or other requirements relating to the pending process."

That is not the only unusual aspect of the rebid. As we previously noted, MinTIC’s own figures for the growth of the .co registry, which it published in its public tender, are completely wrong.

Damn statistics

Rather than asking Neustar for the real statistics – which show rapid growth following by a slow-down in registration figures, as is normal in mature internet registries – MinTIC used figures from a third-party site that guesses registration figures over time, and showed the complete opposite trajectory: a gradual accelerating growth in domain registrations.

As for ties to Afilias, the company and Colombia’s IT minister Sylvia Constaín have repeatedly denied meeting in private to discuss the .co bid. But there is no doubt that Constaín has personally met Afilias CTO Ram Mohan – the man who would be in the best position to discuss registry technical requirements – because the ministry’s own Twitter feed shows Constaín sat next to him at a roundtable meeting in May last year. Why did a senior executive from a US-based internet infrastructure outfit with no obvious business in Colombia attend a roundtable in Bogota, and how did he come to be seated next to the minister?

La ministra TIC @ConstainSylvia participa en Concordia Americas Summit #Concordia2019, la cumbre emblemática de @ConcordiaSummit en América Latina, que aborda de manera inclusiva e integral los problemas que aquejan a la región. pic.twitter.com/1IIHcsssTx

— Ministerio TIC (@Ministerio_TIC) May 13, 2019

It is likely no coincidence that for the past four years Afilias and Neustar have been engaged in a global battle to take registry contracts off one another. In 2016, Neustar made an aggressive bid for Afilias's .org registry agreement, which had been put up for re-tender. Afilias kept hold of the contract, but only after slashing its fee by a third.

And again

The next year, Afilias did the same for Neustar's contract with Australia's .au registry and won it. Then in 2018, Neustar took India's .in contract away from Afilias after another bruising battle in which Afilias sued the Indian government and claimed that Neustar “has no experience or technical capability to manage and support IDNs [internationalized domain names] in Indian languages and scripts.”

With top executives at both companies targeting the others' contracts, in hindsight it was inevitable that Afilias would go all-out to win the .co contract from Neustar when its initial ten-year term was up. The question is: how far did it go?

That decision to open the .co registry for rebidding, incidentally, was far from a given as the current contract includes the expectation that the current operator, Neustar, would continue its role – a fact that came out after Neustar sued the Colombian government on the same day that it formally announced the decision to retender.

Afilias was clearly champing at the bit to take the .co address space away from its arch rival: an article in the Colombian press, published more than a month before the process was announced, saw Afilias’ chief business officer Keith Lubsen talking in length about why Colombia should open up .co and why Afilias would be a better choice than the current operator. In it, he spoke about the government's frustrations with the existing contract; something that presumably he would only know about through direct communication with the ministry.

And adding to the sense that the numerous connections between Afilias and the IT minister may be edging into scandal, Colombian journalists have said Constaín is expected to leave her job soon. This follows a radio interview last month in which she was quizzed about her connections to Afilias and was criticized for her ambiguous and defensive responses.

Conflicted

If Afilias is found to have supplied MinTIC with its technical requirements and failed to disclose that fact, it could be ruled out of the process altogether.

A separate contractual document includes a clause on conflicts of interest and notes that anyone “who under any circumstance find themselves in situations of conflict of interest with the MinTIC, which affect or put at risk the principles of public contracting, will not be able to participate in this Bidding and, therefore, their Proposals will not be subject to evaluation, nor will be Awardees.”

One part of that contract says that “those who have been consultants or advisers for the structuring of this Selection Process or of any study contracted on the occasion thereof” are included. It could be argued that supplying requirements that are used to define who is eligible to run the contract, and which end up excluding almost every company in the market, is equivalent to “acting as an adviser.”

We asked Afilias whether it had supplied any technical requirements to MinTIC and, separately, whether any Afilias executives had met privately with the IT minister. In its response, Afilias, combined those two questions into a single reply: “We have not met with the technology minister or the technology ministry in private to provide advice or documents regarding the .co tender.”

We have asked for clarity on whether Afilias has supplied technical requirements to the Colombian government outside of a private meeting with MinTIC. ®