The Rise of State Run Registries Security Assurances or Political Leverage

The past decade has seen a quiet but notable shift in the governance of the internet’s naming infrastructure: the growing number of country-code top-level domains (ccTLDs) and even some generic extensions being managed directly or indirectly by state-run entities. What was once largely the domain of independent operators, academic institutions, or quasi-private foundations has, in many jurisdictions, been brought under direct governmental control. The motivations for this trend vary. Some governments frame it as a matter of national security, ensuring that their digital identity space is managed in accordance with local laws and resilient against foreign influence. Others present it as an effort to strengthen the economic value of their national namespace, aligning domain policy with broader digital transformation strategies. Yet beneath the rhetoric, critics warn that state control over registries can be wielded as a tool of political leverage, enabling governments to exert influence over online expression, commerce, and the cross-border flow of information.

The model of state-run registries is not entirely new. From the early days of the internet, some ccTLDs—such as .cn for China—were overseen by state-affiliated organizations, reflecting both the centralized nature of their telecommunications sectors and their preference for sovereign control over national internet resources. What is new is the expansion of this model beyond authoritarian or tightly regulated internet environments to include democracies and middle-income countries that previously left registry operations in the hands of independent bodies. In some cases, the change has been prompted by cybersecurity incidents or fears of foreign interference, leading policymakers to view the registry as a critical infrastructure asset on par with telecommunications networks, energy grids, and transportation systems.

Supporters of the state-run approach emphasize its potential to deliver security assurances that private or foreign-controlled operators cannot guarantee. Governments can mandate compliance with national data protection laws, ensure that registry data is stored domestically, and integrate registry operations into broader national cybersecurity frameworks. This domestic control can facilitate faster responses to cyber incidents, such as takedowns of phishing or malware sites, without the delays of cross-border coordination. In the context of geopolitical tensions and cyber conflict, proponents argue that it is prudent for states to reduce dependency on external actors whose priorities may not align with national interests.

Yet the very same mechanisms that enable faster enforcement against cybercrime can also be deployed against political dissent, independent journalism, and civil society. A registry under state control is not just a technical operator; it becomes an enforcement point for content regulation and surveillance. Unlike hosting providers, which can be changed relatively easily, the registry is the authoritative source for whether a domain name exists and resolves. This gives governments a powerful lever: they can suspend or delete domain names that host undesirable content without going through the more cumbersome process of securing court orders against individual site operators. In countries with weak rule of law or politicized judicial systems, the potential for abuse is substantial.

This dual-use nature of registry authority has become particularly evident in cases where governments have pressured registries to act against foreign or domestic political actors. In some jurisdictions, domains belonging to human rights organizations or independent media outlets have been suspended under the guise of “national security” or “public order” violations, even when no clear evidence of criminal activity exists. The opacity of registry decision-making, combined with limited avenues for appeal, means that such actions often occur without meaningful oversight. The international community has few mechanisms to challenge these moves, as ccTLDs are generally recognized as sovereign assets under the purview of their respective countries.

There is also an economic dimension to the rise of state-run registries. Governments increasingly view ccTLDs as digital real estate with substantial revenue potential. By setting registration policies, pricing structures, and marketing strategies, they can turn the national namespace into a profit center. This can incentivize more aggressive enforcement of trademark claims or content regulations if doing so aligns with commercial goals or political interests. At the same time, state control can be used to restrict foreign competition or to prioritize domestic registrars, raising questions about market fairness and compliance with international trade norms.

The international governance environment offers little consensus on where the line should be drawn between legitimate sovereign control and politically motivated interference. ICANN’s remit does not extend into the internal policy decisions of ccTLD operators, and appeals to multilateral forums like the International Telecommunication Union have yielded no binding rules. As a result, the balance between security assurances and political leverage is determined almost entirely by domestic governance norms and the political culture of the country in question.

The rise of state-run registries thus sits at the intersection of internet governance, cybersecurity, and human rights. In the best-case scenario, they can serve as pillars of resilience, protecting the integrity of national digital infrastructure and aligning domain policy with the public interest. In the worst-case scenario, they become instruments of centralized control, used to silence dissent, limit competition, and entrench political power. For global internet governance, the challenge is to recognize that these two possibilities often coexist in the same institutional structure and that the difference between assurance and leverage may depend less on technical architecture than on the principles of governance and accountability that surround it. As more countries bring their registries under direct state control, the question will not simply be whether they can operate them securely—it will be whether they can do so without sacrificing the openness and pluralism that have long been hallmarks of the internet.

The past decade has seen a quiet but notable shift in the governance of the internet’s naming infrastructure: the growing number of country-code top-level domains (ccTLDs) and even some generic extensions being managed directly or indirectly by state-run entities. What was once largely the domain of independent operators, academic institutions, or quasi-private foundations has, in…