A few comments from the AUSCERT point of view.

>Having said that, I have always wondered about viable ways of
>long-term funding for AUSCERT et al because AUSCERT is one of the few
>remaining net-services that has no natural revenue base.

Most people would be aware, although we have been a little quiet, that
AUSCERT is in process of changing to a subscription based service. It is
likely that AUSCERT will be set up as a company, limited by shares,
probably owned by the three initiating universities, in the near future.
The Articles of Association will address the issue of 'not for profit'. We
believe that to retain credability and our no commerical bias position it
is essential to remain not for profit. It has been recommeded that the
Board of Directors be selected from a wide industry base to not only
enhance the management structure of AUSCERT but also to further the need
for accountability to its clients.

We have begun a marketing campaign, not that I mention this here as part of
that campaign (but if you haven't received info yet please let us know). We
derived a list of commercial customers from the AUNIC and the number of
domains doesn't come to anyhting like 10,000 which was interesting. It was
closer to 4,000 and by time duplicates (organisations names) are eliminated
its well under 1,000 organisations.

Perhaps someone can shed some light on why this difference. But it
certainly makes a difference when building a revenue model. The revenue
model for auscert was well aired earlier this year and will be in the
future. In my opinion this security function and the dns registration
process are not value added services but infrastructure at this time (maybe
this will change in the future).

My vote would be to have this operate as a not-for-profit venture at this
point in time; ISOC-AU cum AUNIC or similar would seem eminently suitable
for ALL registrations.

I haven't raised the following point before since AUSCERT was waiting to
see what the outcome of the address registration debate would be but:
It would certainly be nice for ASUCERT to either have access to such a
client list at the time of registration or have the registering authorities
include information about AUSCERT.

Part of the registration fee for AUSCERT is also a possibility although we
see that our client base is larger than the Internet.

As a final note: The financial model built for AUSCERT was extremely
conservative (after all we are currently part of a univeristy!). I guess
most have now seen the subscription pricing matrix. The greater and faster
the uptake the lower will be the subscriptions in the future. So any
suggestions as to how to increase the uptake, particularly in the
commercial sector would be appreciated (sorry can't help wandering off the
point).

>One could argue that that is their business. Especially if the
>non-exclusive nature of the delegation turns into reality with
>multiple organizations providing competing services. Mind you, with
>just 10,000 odd domains served in .com.au that doesn't leave a lot of
>annual revenue to distribute amongst multiple competing entities.
>
>Personally I think that delegation to two separate entities would have
>made the situation much less divisive, but would it have been viable
>at this stage?
>
>> 4. What will happen to financial surpluses generated by this activity?

Knowing the financial status of most academic departments these days I
would suggest that the UM regareds this as a profit making enterprise.

>
>Again, if it's a competing commercial entity (and of course it isn't
>competing yet) then a profit is what they need to have to stay in
>business.
>
>[ This may seem like a side-track, but bear with me ]
>

>A commercial AUNIC service strikes me as perhaps the most likely way
>of taking a slice of the revenue to fund them. It *would* have been
>great if the delegation had been done (or could be changed to be done)
>with a proviso that some percentage or flat-rate per domain (say
>$10ish) was provided as funds for AUSCERT.
>
>The summary? If there are multiple, competing .com.au service
>providers that are constrained to send some revenue to AUSCERT, then
>IMHO their accounts and surpluses are their own business.
>
>[ Why is it not a side-track? Because the AUNIC services are one of
>the few services which pretty much all .au Internet users/ISPs must
>use, therefore it makes some sense to have that revenue stream fund
>essential net services that have no natural revenue base, such as the
>.au name servers, AUSCERT, etc. So where you read AUSCERT above,
>convert that to essential net services with no natural revenue base.]
>
>
>Regards.

---------------------------------------------------------
Graham Rees                    EMail: G.Rees§cc.uq.edu.au
Acting Director                  Tel: + 61 7 3365 4143
Prentice Centre                  Fax: + 61 7 3365 4477
The University of Queensland
Queensland 4072
---------------------------------------------------------