News, events & blog

When You Can No Longer Believe Everything Online, How Do We Build Trust?

Although each meeting had a different focus, one common question stood out to me: how can we build and maintain trust in an online world where technology is developing faster than our ability to understand and regulate its risks?

In the domain industry, this means knowing who is behind a domain name. In European policymaking, it means finding the right balance between security, innovation and fundamental rights. For everyday internet users, however, the question can be much more personal: how can you be sure that the person you are communicating with online really is who they claim to be?

CENTR BoP Working Group Meeting in Ljubljana: Should a Domain Registry Know Its Customer?

One of the main topics at the CENTR Business & Operations Working Group meeting in Ljubljana was registrant data verification and identity verification. The EU's NIS2 Directive has placed greater importance on the accuracy and reliability of domain registration data, but the practical approaches taken by registries still vary considerably.

For example, the Belgian registry presented its cooperation with a national authentication service, which allows Belgian users to be identified through the country's digital identity infrastructure. The Slovenian registry, meanwhile, has implemented a registrant verification solution based on an EPP extension, following the model developed by the Austrian registry nic.at.

It was also interesting to compare the approaches taken by Germany and Switzerland. The German registry DENIC has developed a model where, similarly to .ee, identity verification is carried out by the registrar, which then sends confirmation of the verification to the registry through a separate technical interface. The Swiss registry, however, highlighted an important legal limitation: a registry cannot always independently determine whether a submitted document is forged or whether a registrant really is who they claim to be. In their view, such matters are both important and complex, and should be handled by the competent authorities.

Another question raised during the discussions was whether a domain name should become active before the registrant's personal data has been verified, or only after successful verification. Some registries allow a domain to be activated first and verify the registrant's details later using a risk-based approach. Others, including Estonia, have chosen a stronger preventive approach, where the data must be correct and the registrar must verify the registrant's identity before the domain is activated.

For me, it is important that domain abuse can be prevented before a domain is put into use, but identity verification should not make registration complicated or time-consuming. Estonia's experience shows that strong identity verification and user-friendliness can work well together. The sooner we know who is behind a domain, the better we can prevent abuse rather than simply deal with its consequences.

Another particularly interesting presentation in Ljubljana came from Montenegro's .me registry, which introduced its AI-powered domain search. Instead of searching for a specific domain name, users can simply describe their business or idea, and AI suggests suitable names. The results were interesting too: AI search was associated with 5,583 domain registrations, compared with 2,714 through traditional search. It made me wonder whether, in the future, we will stop searching for domain names ourselves and instead let AI create a suitable digital identity for our ideas. In any case, it is an exciting solution from the .me registry.

And sometimes the domain market is influenced by completely unexpected developments. For example, the popularity of Slovenia's .si domain increased sharply after Donald Trump began using the term superintelligence (SI) when talking about artificial intelligence. As a result, the total number of .si domains passed the 200,000 mark in just one month. During its presentation, the Slovenian registry joked that it was not sure whether to thank Trump or not, as the unexpected registration boom had put its systems under pressure and made normal processes slower and much more labour-intensive.

The Ljubljana meeting showed how quickly the domain industry is changing and how important it is for registries to adapt to new technologies and unexpected developments. Increasingly, we need to think not only about maintaining or growing the number of domains, but also about the usability, security and quality of our services.

CENTR General Assembly in Brussels: How Do You Know That I Am Really Me?

While in Ljubljana we discussed how registries can verify registrants' identities, at the CENTR General Assembly in Brussels I had the opportunity to present eeID, the identity verification solution developed by the Estonian Internet Foundation, which offers a practical answer to this challenge.

I started my presentation with a simple question: how do you know that I am really me? 

If I were standing in front of you and showed you my passport, you could verify my identity quite easily. But what about online? In Estonia, we are used to digital identity simply working. We use our ID cards, Mobile-ID and Smart-ID without giving them much thought. But the internet is not limited to Estonia.

 When we opened .ee domain registration to the whole world in 2016, we faced the question of how to verify a registrant from Australia or Argentina, for example. Initially, one of the solutions we used was identity verification through PayPal. However, around 2020, it became clear that this no longer met our expectations and that we needed a stronger, more reliable solution. Even within Europe, things were not simple, as eIDAS did not work for the private sector, and integrating separately with each country's national solution at registry level seemed complicated and expensive.

This brought me to the part of my presentation where I explained how these challenges led to the development of our own eeID identity verification solution. Its principle is simple: one integration, multiple trusted identity verification methods. Through eeID, an Estonian customer can be verified using Smart-ID, a Swedish customer using Freja+, or an Australian customer through Veriff's video identification service. They can then log in without a password using a passkey. My main message was that every company needs to know who its customer is, but not every company needs to become an identity verification expert to do so.

Another of the most interesting presentations in Brussels for me was the overview of developments in EU regulation and CENTR's plans for 2027. What stood out in particular was just how many different laws and initiatives currently affect the domain industry. Alongside NIS2, attention is also being given to the revision of the European cybersecurity framework (Cybersecurity Act 2.0), digital sovereignty, the prevention of online fraud and consumer protection. All these developments may directly or indirectly affect registries and registrars, raising the question of how to make the internet safer without placing excessive obligations on the industry.

CENTR's own future direction was also interesting. In 2027, CENTR plans to strengthen its policy team and move beyond simply monitoring regulations towards taking a more active role in shaping them. To achieve this, it aims to strengthen cooperation with EU policymakers, involve more member registries and invest in joint research and practical solutions.

For me, the CENTR General Assembly reinforced one important idea: the domain industry should not simply wait to see what rules are imposed on it. Instead, we should use our knowledge and experience to help shape regulations that are practical and proportionate.

CyberChess: When You Can No Longer Trust Even Your Own Eyes

CyberChess in Riga brought the whole topic of identity and trust into a very different, much more personal context for me.

Have you ever thought that you might be communicating online with someone you think you know, but who does not actually exist? Or worse, that you might never even find out you have been the victim of a scam? That was the unsettling thought I had while listening to cybersecurity expert Kerry Tomlinson's presentation on deepfakes.

In her presentation, she showed very clearly how AI-powered scams, including those involving celebrities, can begin with a completely innocent conversation. Using fake photos, videos and voices, scammers gradually build trust until the victim can no longer tell what is real and what is not. This made me think particularly about young people growing up in a world where they cannot always trust their own eyes and ears. I highly recommend watching Kerry Tomlinson's presentation, which was definitely one of the most memorable talks of the entire conference for me.

At CyberChess, I also had the opportunity to take part in the "WWW of Regulations" panel discussion alongside representatives from ICANN, WIPO, Latvia and Lithuania. We discussed the growing number of European regulations, the risk of overregulation and the future of the domain industry. During the panel, I made a rather bold prediction: in ten years, identity verification may become a standard mandatory part of every domain registration. 

Could NIS3 bring this about? Perhaps, but the development from NIS1 to NIS2 already shows how quickly regulatory expectations can change in Europe. We therefore discussed how registries should no longer wait for the next directive to tell them what to do. Estonia's eeID is a good example of how the industry can develop practical solutions before regulation requires them. My main message was that if we do not take part in shaping regulations ourselves, someone else will do it for us. As registries, we understand the possibilities and limitations of the DNS ecosystem, and we should use that knowledge not only to comply with legislation, but also to help develop sensible and proportionate rules.

Three Meetings, One Common Question: Who and What Can We Trust Online?

The meetings in Ljubljana, Brussels and Riga showed me how different paths can lead us to the same question about the internet: how do we build and maintain trust? 

In Ljubljana, we discussed registrant identity verification, artificial intelligence and domain quality. In Brussels, I presented eeID, a solution that helps build trust across borders. And in Riga, we discussed regulations and cyber scams that challenge even our ability to trust our own eyes and ears.

For me, one idea connected all three meetings: trust does not happen automatically online. It must be built deliberately through technology, cooperation, awareness and sensible rules. As key players in the DNS ecosystem, we in the domain industry have an important role and responsibility in helping to create a safer and more trustworthy internet. The question is whether we help shape the future of the internet ourselves or wait for someone else to decide it for us. 

As an optimist, I hope, and continue working in the domain industry to make sure, that we build this trustworthy internet together.