Home / Blogs

The Multi-Stakeholder Mirage: How Internet Governance Turned Attendance Into Mandate

The multi-stakeholder model began as a compromise, not a constitution. It gave the Internet a way to avoid state monopoly, corporate monopoly, and intergovernmental bureaucracy at the same time. That was useful. But the model’s usefulness has hidden a harder question: who actually authorizes binding decisions?

That is the multi-stakeholder mirage. The stakeholders are real; the mandate is not. A stakeholder is affected by a decision. A principal authorizes one. A model that cannot separate those two categories does not solve legitimacy. It makes legitimacy appear where no authorization exists.

The model survives because it borrows from three different histories. From the IETF, it borrows the prestige of rough consensus and running code. From ICANN, it borrows the private-law settlement that kept names and numbers outside direct government operation. From WSIS and the IGF, it borrows the diplomatic vocabulary of governments, private sector, civil society and technical actors sitting in the same room. Each source is real. None creates a global electorate.

The arithmetic exposes the defect. ICANN’s At-Large Advisory Committee has fifteen members and is described in ICANN’s bylaws as the primary organizational home within ICANN for individual Internet users. Fifteen people can advise on user interests. They cannot represent billions of users.

ICANN’s corporate structure is also more honest than the rhetoric around it. ICANN has sixteen voting directors, no ordinary corporate members, and an Empowered Community that is not itself a corporate member. That may be workable governance for a corporation. It is not popular sovereignty.

The meeting numbers show the same gap. ICANN85 had 2,195 attendees, including 1,517 in person and 678 virtual participants. Its average in-person attendance per session was 47. A room of 47 people may be useful for discussion. It is not a mandate.

The same problem appears in the RIR world. APNIC60 reported 451 in-person attendees, 60 online-only participants, 40 economies represented, 127 APNIC member organizations represented, and three policy proposals reaching consensus. That is useful operational data. It is not regional authorization.

Formal voting does not cure the problem. RIPE NCC’s May 2025 GM had 1,039 actual votes from 19,713 eligible members, a turnout of 5.3%, according to RIPE Labs. Those votes matter inside the association. They do not become a public mandate over the economic destiny of number resources.

Nor does the IGF solve the execution-layer problem. A permanent forum is still a forum. Governments may receive a standing microphone, but numbers, registry records, RPKI, reverse DNS, transfer recognition, portability and failover remain elsewhere. A microphone is not a lever.

This matters because IPv4 scarcity changed the object being governed. Number resources are no longer low-value administrative tokens. They are scarce, leased, transferred, financed, litigated and operationally embedded assets. The database record now affects capital value, business continuity, customer contracts, routing credibility and security assertions.

A consultation model cannot govern capital without principal authorization, liability and exit. This is the point developed in Running-Code Primacy: the registry layer should be interpreted only as far as running networks require. It should protect uniqueness, accuracy, proof of control, security assertions, transfer records, auditability and continuity. It should not decide commercial morality, customer geography, leasing, financing, regional loyalty or business model.

The missing principal is the operator. The operator signs customer contracts, deploys routers, pays transit, announces prefixes, answers regulators and carries uptime obligations. When registry policy delays a transfer, impairs RPKI, suppresses asset value or creates uncertainty, the operator bears the cost. A policy room may advise operators. It cannot become them.

The economic damage is also real. Registry discretion raises transaction costs, weakens collateral value, suppresses liquidity and increases the cost of capital. Restrictions defended in the name of poorer networks often produce the opposite result: illiquidity, delay, hidden process costs and dependence on institutional favour. That is the Poverty Penalty.

The answer is not government takeover. States can censor, politicize and fragment infrastructure. But rejecting state monopoly does not validate private chokepoint sovereignty. The better answer is thinner common layers, operator-first continuity, portability, failover, liability symmetry and replaceable administration.

This is why transition layers matter. BTW.Media makes registry-side risk visible as reality, not advocacy. LARUS and LARUS One address continuity and network identity. i.LEASE treats IPv4 transactions as execution under registry-layer uncertainty. NRS creates coordinated protection for resource holders who should not have to face registry risk alone.

Recent RIR crises should therefore be treated as stress tests, not as the centre of the argument. They show what happens when registry discretion collides with live assets, ordinary courts, missing portability and institutional self-preservation. The lesson is structural: protect the ledger, not the gatekeeper.

The fix is not to abolish participation. It is to demote it. Participation should be evidence, not authority. Consensus should be technical judgment, not sovereignty. Community should be description, not principal.

The Internet should stop asking only who was in the room. It should ask who can bind the party bearing the loss. Let stakeholders speak, engineers define technical invariants, operators decide what they operate, states handle public law, markets price scarce assets, courts resolve disputes and registries record. But do not let a process call itself the people. Do not let a policy room become a legislature. Do not let a database become a throne.

That was the multi-stakeholder model’s lie. Not that stakeholders did not exist. They did. The lie was that their existence created one administrator’s mandate.

For full article visit https://heng.lu/the-multi-stakeholder-mirage-how-the-multi-stakeholder-model-turned-attendance-into-mandate/

NORDVPN DISCOUNT - CircleID x NordVPN
Get NordVPN  [74% +3 extra months, from $2.99/month]
By Lu Heng, Founder & CEO at LARUS Limited

Filed Under

Comments

MSHM: Participation and Legitimacy Pari Esfandiari  –  Jul 6, 2026 10:16 AM

Whether or not one agrees with the article’s broader conclusions, it raises an important question that Internet governance cannot avoid: what distinguishes participation from legitimacy?

Participation broadens perspectives, enriches deliberation, and strengthens the quality of decision-making. But participation alone does not confer legitimacy. Legitimacy also depends on meaningful representation, accountability, transparency, procedural fairness, and clearly defined institutional authority.

The challenge, therefore, is not whether the multistakeholder model is legitimate or illegitimate, but how its institutions can continually strengthen the foundations of that legitimacy. In global Internet governance, where no single sovereign authority exists, legitimacy is not simply granted—it must be continuously earned through inclusive, accountable, and effective governance.

The multistakeholder model remains one of the most valuable innovations in Internet governance. Its long-term success depends not merely on who participates, but on how institutions ensure that participation translates into trusted, accountable, and legitimate outcomes.

MSHM: Running Code Is the Limit Lu Heng  –  Jul 6, 2026 5:43 PM

Pari, I agree with the distinction between participation and legitimacy. But I would frame the challenge differently.

The question is not how the multistakeholder model can keep seeking a larger legitimacy until participation translates into mandate. That is exactly the dangerous move. It is how a useful method of consultation becomes an institutional claim to govern absent principals.

The Internet’s original technical legitimacy was narrower. Consensus mattered because it was disciplined by running code, implementation, and adoption. It was not a general source of political authority. It did not mean that participation in a room, mailing list, or policy process could bind operators, resource holders, users, or states beyond the technical invariants that the running Internet actually requires.

So the task is not to make participation more sovereign. The task is to restrain participation to what it really is: input, expertise, objection, and technical deliberation. It is valuable when it helps define narrow rules for uniqueness, interoperability, registry accuracy, security assertions, transfer records, and operational continuity. It becomes dangerous when it expands into commercial morality, asset governance, regional sovereignty, or authority over operators who bear the loss.

That is why I do not think the right question is whether the multistakeholder model is legitimate or illegitimate in the abstract. The right question is: what does running code require this institution to decide centrally?

If the answer is uniqueness, security integrity, registry accuracy, or operational continuity, then a narrow technical rule may be justified. If the answer is fairness, community preference, regional interest, business model, leasing, pricing, or capital movement, then the rule should not be converted into mandatory authority through multistakeholder language.

Participation should improve technical judgment. It should not manufacture sovereignty. The danger begins precisely when institutions try to “earn” bigger legitimacy by turning participation into trusted authority over things participation was never authorized to govern.

A room is not a mandate. Consensus is not ownership. A policy process is not a principal. The multistakeholder model remains useful only if it accepts that limit.

Comment Title:

  Notify me of follow-up comments

We encourage you to post comments and engage in discussions that advance this post through relevant opinion, anecdotes, links and data. If you see a comment that you believe is irrelevant or inappropriate, you can report it using the link at the end of each comment. Views expressed in the comments do not represent those of CircleID. For more information on our comment policy, see Codes of Conduct.

CircleID Newsletter The Weekly Wrap

More and more professionals are choosing to publish critical posts on CircleID from all corners of the Internet industry. If you find it hard to keep up daily, consider subscribing to our weekly digest. We will provide you a convenient summary report once a week sent directly to your inbox. It's a quick and easy read.

Related

Topics

Brand Protection

Sponsored byCSC

Domain Names

Sponsored byVerisign

DNS

Sponsored byDNIB.com

IPv4 Markets

Sponsored byIPv4.Global

DNS Security

Sponsored byWhoisXML API

Cybersecurity

Sponsored byVerisign

New TLDs

Sponsored byRadix