WASHINGTON, July 9 — The shift is quietly reshaping how the internet is run. For years, internet governance has been a patchwork of policies, technical standards, and multi-stakeholder bodies, but the trend underneath is a steady move toward formalised, legally enforceable rules. From domain name management to data protection, the architecture of the online world is being rewritten.
The Internet Corporation for Assigned Names and Numbers, or ICANN, was formed in 1998 to manage the internet’s foundational plumbing — domain names and IP addresses. That technical coordination role has made ICANN a central player in governance debates, though its mandate is narrowly focused on the identifier systems that make the web work.
The World Summit on the Information Society, held in two phases in 2003 and 2005, pushed governance discussions further by establishing the Internet Governance Forum in 2006. The IGF remains a key venue for global policy dialogue, but it has no binding authority — a feature that some advocates now argue is a weakness. ## The security dimension Cybersecurity threats have grown alongside the governance structures meant to manage them.
The Morris worm in 1988 infected a significant portion of the early internet — at the time, about 10% of connected machines. The ILOVEYOU virus in 2000 caused massive financial damage, with losses estimated at $15 billion.
More recently, the WannaCry ransomware attack in May 2017 spread across 200,000 computers in 150 countries, demonstrating how quickly a single piece of malicious code can cascade across borders. Data breaches have added another layer of urgency. Yahoo disclosed in 2016 that a 2013 breach had compromised 3 billion accounts — one of the largest such incidents on record.
The scale of exposure forced regulators and companies alike to rethink how user data is stored, shared, and protected. ## Regulatory responses The United States enacted the Cybersecurity Information Sharing Act in 2015, a law designed to encourage private companies to share threat data with the government. The European Union took a different approach with the General Data Protection Regulation, which took effect in May 2018. GDPR imposes fines up to 4% of a company’s global revenue for non-compliance, giving it real teeth.
The regulation has become a global benchmark, influencing data protection laws in other jurisdictions. The numbers around cybercrime are staggering.
As of 2024, Cybersecurity Ventures projected that annual cybercrime costs would reach $10.5 trillion by 2025. That figure encompasses everything from ransomware payments to lost productivity and remediation expenses. Watch this space — the financial stakes are only rising. ## What’s changing The trend underneath all of this is a shift from voluntary coordination to legally binding frameworks.
ICANN’s technical role remains essential, but the conversation has moved beyond domain names and IP addresses. The IGF continues to provide a forum for discussion, but the real action is in national and regional legislation — GDPR, CISA, and similar laws that carry enforcement mechanisms.
The question now is whether the existing governance model can keep pace. The internet was built on principles of openness and distributed control, but the threats it faces — from ransomware to massive data breaches — demand coordinated responses. The governance structures that emerged in the late 1990s and early 2000s may not be sufficient for the challenges of the next decade.
What to watch next: how the tension between national sovereignty and global coordination plays out. Countries are increasingly asserting control over their digital borders, while the internet’s technical infrastructure remains inherently transnational. The balance between those forces will define the next phase of internet governance.
