Robert J. Domanski’s Who Governs the Internet is an ambitious attempt to provide coherence to the question of governance in a seemingly ungoverned, unbound, and amorphous space. Utilizing a historical institutionalist approach, he broadly constructs a model of the Internet to aid both scholars and policymakers to “better understand various Internet policy issues.” The model demarcates four “layers” of the Internet, consisting of the physical infrastructure, the protocols, the applications, and the content.

These four layers, he argues, make up a “political architecture” of who has power and authority on the Internet (p. 8). He deconstructs each of the layers to reveal the relevant actors, which methods or policies they use to implement decisions, and how those decisions are taken up downstream. Domanski then applies his framework to a case study of the U.S. national cybersecurity policy since the 2001 terrorist attacks. This particular study, he claims, is a “meaningful test case” because it covers an issue of “vital importance” with consequences for “national and global economies” as well as being a “highly complex and technical political” issue area (p. 113).

The book’s strengths lie in Domanski’s historical tracing of communications regulation policy. If one seeks to understand the historical underpinnings of U.S. communications regulations and how these have played into the early framing of U.S. Internet governance, then this monograph is a helpful guide. Moreover, his knowledge of the internal workings and practices of protocol management is extremely helpful for anyone wanting to understand not merely how data is moved from one place to another, but how decisions over the structure of various protocols are made.

Indeed, I would suggest that this book succeeds in its general aim of claiming that the Internet is subject to governance. There are various foci where decisions are made, and those decisions affect the abilities of users to act in cyberspace. Where Domanski’s arguments are weaker, however, are at the conceptual underpinnings of his framework and its application to his case study.

In particular, from a theoretical perspective, the differences between influence, governance, and authority are quite opaque. These concepts are traditionally very distinct, and in Domanski’s case, all somewhat dependent on his formulation of what a policy is, but he provides no definition of “policy,” and so the conceptual differences between these concepts are unclear. In some circumstances he refers to explicit policies formulated by governments, such as laws, executive orders, or various corporate prerogatives. At other points, he describes them as merely the “result of a decision-making process” (p. 62). Given that the Internet is an assemblage of various subnetworks linked together through various information communications technologies, there are a plethora of actors acting in a myriad of ways. Without a clear defining line, the concept becomes overstretched so that anything becomes a policy.

This oversight then has serious implications for his concept of governance. For example, his definition of governance is “the practical exercise of decision-making authority through a demonstrated ability to create policies that constrain or enable behavior with intentional effects” (p. 7). The important consideration seems to be, then, on the authority to make policies that affect the abilities of others to act on the Internet. Yet it is unclear by what mechanisms the broad set of actors identified gains this “authority.” He rightly notes that “who has influence versus who has authority is a critical distinction” (p. 7), though he often runs them together (p. 87).

The result is that we are left uncertain as to what governance actually entails because we are uncertain what constitutes a policy and who has the authority to make it. Typically, authority is often thought to have two distinct meanings: One can be “an” authority, such as an expert on some topic, or one can be “in” authority, where the role or institutional arrangements give a person certain powers, rights, and obligations to affect the rights of others. For Domanski, the challenge is to show how authority is generated at each of the layers, and thus how “governance” follows. Yet he notes that individuals can be authorities, can implement policy, and can thus govern (p. 87). But he does not want to grant this, admitting later that his real interest is only in aggregated effects for the “average Internet user” (p. 87). Governance then either includes everything and everyone, or it includes only a certain subset of actors, but there is no nonarbitrary way to distinguish between the two.

Additionally, I would flag that many of the book’s examples of particular policies regarding Internet governance come from the U.S. perspective. While it is certainly true that the Internet emerged from the United States, and that U.S. companies continue to play a very large role in providing infrastructure, applications, and content, the Internet is a global entity. For instance, the 2014 European Court of Justice’s ruling where the Court ruled that the European Union’s (EU) laws had jurisdiction over non EU companies, even if the content (data) is located on servers outside of the EU Member State, would be primary international case. The “right to be forgotten” and “a right to erasure of personal data” (given certain conditions) are more germane to the global reach of content and content regulation. If we want to make explicit the power relations inherent in Internet governance, it would seem that expanding his examples throughout the text to include non-U.S. or non-Western cases would support the argument better.

Also surprisingly absent from the book is discussions of metadata. Given that the forefront of Internet policy work is asking questions about who “owns” this data, how it is shared, by whom, and for what purpose, it was unfortunate to not see these types of issues addressed. Metadata, if considered, may also confound Domanski’s four-layered conceptual framework because regulation cannot happen at the discrete layers. Moreover, the book also fails to mention encryption, securing protocols, or trust certificates and trust authorities.

Finally, Domanski’s case study is also problematic from an Internet governance perspective. This is primarily the case because he does not actually apply his framework to this case. While the historical tracing of the U.S. cybersecurity national strategy is informative and enlightening, the reader is left wondering how the governance portion and the four layers applies. A more worrying implication of this case, however, is that he implicitly equates the securing of national networks (running and monitoring critical infrastructure) against cyberattacks with Internet governance. Cybersecurity experts often take great pains to separate these two issues, especially given the vast majority of damage that occurs through information communication technologies involves cybercrime. Hacktivism and espionage make up fewer threats, and “cyberwar” even less.

Ultimately, Domanski’s arguments are insightful, but I would argue that they are primarily useful from a historical perspective. The book’s strengths lie in identifying the various actors at play, as well as how their decisions shape or affect individual behavior on the Internet. One should, however, approach the argument with some caution. While Domanski wants to admit that various other agents, such as engineers, firms, and civil society, hold power because of their ability to affect change on the Internet, his case study and choice of examples tell us otherwise. Since most of his examples come by way of state enacted policies, laws or regulations, as well as focus strongly on aspects of state security, political power—and not decision-making processes—is the ultimate referent on good or “authoritative” policy. While this conclusion may seem to contradict his intentions, his choice of methodology cannot help but admit of it.