Government domains protect Tribal Governments and citizens yet less than 12% use them

It's something you do everyday, you want to visit a website so you type the name of the site into the address bar and then (if you are really old school) you might add the domain. But did you know that these domains mean something?

For example, nativesintech.org uses the .org domain. This is intended to show that we are an organization. Although in other cases, domains are oftentimes co-opted. Tech companies like to use the .io domain, which stands for British Indian Ocean Territory, because the “io” refers for Input/Output. A commonly used term to refer to side-effects that happen within programs like writing to a file. There are many other domains that are co-opted like this to either reflect the type of industry the website represents or to be used as play-on words.

Just like the .io domain is used by those other than the British Indian Ocean Territory, the .org domain can be used for people or groups that aren’t organizations. Anyone can buy a .org domain, as long as it’s available, and there are no checks to see whether the owner of the domain is a group, organization, non-profit, or any other type of association. The same goes for  a .com domain, the “.com” means company.

It’s quite easy to spoof an organization or company by squatting on a domain where only a few letters are different. This allows anyone to pass as the legitimate entity a user expects to interact with via email or searching the web. You may have even been the victim of this deception and never even noticed. It’s not always harmful to users though and there are many high profile cases where this was done to parody a group or corporation.

However, many cases of spoofed websites are part of social engineering tactics used by hackers to pose as an organization in order to gain access to sensitive information. It's possible this has already happened to tribal governments that have limited capacity to train and prevent such actions from happening. However, there is one thing that they can do in order to prevent this kind of hack: register for a .gov, or -nsn.gov, domain.

The -nsn.gov domain, although it looks strange, is intended specifically for tribal governments. This is because “nsn” means Native Sovereign Nation. Unlike the .org domain, a .gov domain cannot be purchased on the open market. They are free for tribal governments but require an authorized letter from a government body to obtain one. However, when it comes to governments using a .gov domain the numbers don't look good.

The National Congress of American Indians hosts a Tribal Nations directory which includes information like the name, region, address, and website of many, if not all, tribal governments. Our recent analysis of this directory found that out of 629 listed governments, of which 568 are federally recognized, only 353 of them have websites. Of those that do have websites, only 62 use a .gov domain. This means that approximately 11% of tribal governments use and operate a .gov website and less than 20% of tribal governments that operate a website do so with a .gov domain.

Smaller tribal governments with few IT resources may not know that the .gov domain even exists, instead opting to go with more commonly used domains: .org, .com, and .net. Larger tribal governments could have non-Native IT directors who may view the governments they serve as governments by name only. This may be resolved by simple training and increased understanding that we are sovereign governments. We never ceded our sovereignty to any foreign power, not even the so-called United States, and we must remain vigilant to protect our sovereignty and our community from external threats. So while it’s somewhat ironic that we must depend on the US Government to provide us with a domain registration service, we hope this is something tribal governments can do themselves in the future.

The usage of the .gov is a small but significant thing our governments can do to protect themselves and their communities from one of many types of social engineering attacks that happen to even the most tech savvy people. The more governments use the ecosystem of secure domains, the more confident we can be in the communication we have across them. If you want to encourage your tribal government to use a .gov domain then tell them to visit https://get.gov/registration/requirements/#tribal-domains.

Take Action

If this pertains to your tribal government's website and concerns you, we've provided an e-mail template below that you can use to email your government representative:

Dear Tribal Government Representative,

I am writing to you today to inform you about the need for our tribal government to take action and migrate the government’s existing domain over to a .gov, or a -nsn.gov, domain.

As discussed in a recent article by Natives in Tech, less than 12% of tribal governments operate a .gov domain, which allows bad actors to use common social engineering tactics to potentially scam citizens. In addition, not utilizing a .gov domain undermines our inherent sovereignty with other governments throughout the world.

I encourage you to pass legislation that fixes this lingering issue and that finally allows us to be recognized as sovereign governments across the digital sphere.

To read more about this issue please read Natives in Tech’s article: https://blog.nativesintech.org/dot-gov-domains/.

To file for a .gov, or -nsn.gov, domain visit: https://get.gov/registration/requirements/#tribal-domains.

Sincerely,

Concerned Citizen