Tokelau’s Struggle: From Internet Pioneers to Global Cybercrime Hub due to ccTLD vulnerabilities.

In the late ’90s, Tokelau, a remote Pacific Island with a population of 1,400, found itself thrust into the world of the internet when entrepreneur Joost Zuurbier proposed managing its country-code top-level domain (ccTLD) .tk. The deal allowed users to register free domains in exchange for hosting ads, a model pioneered by Zuurbier’s company, Freenom.

Initially seen as a win-win, Tokelau benefited from the revenue generated, increasing its Gross Domestic Product by more than 10%, enabling the establishment of internet cafés and improving connectivity. However, the unforeseen consequence was that .tk became a haven for cybercriminals, spammers, and phishers due to the free domain registration model.

Tokelau, unaware of the dark side of .tk, faced reputational damage as it gained the title of the global capital of spam. Critics argued that the model of giving out free domains was flawed, attracting criminals who exploited the anonymity provided by .tk

As Tokelau’s international standing suffered, concerns about its sovereignty emerged. The abuse of .tk domains attracted attention, with allegations ranging from cybersquatting to extremist activities. Despite attempts to address the issue, Zuurbier failed to clean up .tk, leaving Tokelau grappling with its tarnished image.

Similar stories unfolded across the Pacific, where small island nations faced challenges with their domains. Some managed to turn their domains into economic assets, but others, like Tokelau, became unwitting hosts to cybercrime and intellectual property abuse.  Further afield, Freenom also took on responsibility for running the ccTLD registries for Central African Republic (.cf), Gabon (.ga), Equatorial Guinea (.gq) and Mali (.ml).

In 2022, legal actions against Freenom signalled the start of a process to drive accountability. Courts in the Netherlands, where the company was legally based, found Freenom in violation of reporting rules, and Meta sued the company for damages related to cybersquatting and phishing on .tk domains. As a result, .tk registrations were halted in January 2023. Today, Freenom is on the brink of collapse, according to a recent report by MIT Technology Review, the company has lost all four of its African ccTLDs, and Tokelau is seeking to take back control of it from Freenom. It seems likely that Freenom will also lose its gTLD registrar accreditation from ICANN in the very near future.

This shift impacted cybercriminal groups relying on .tk, forcing them to adapt and potentially reduce the scale of their operations. While the media suggested Tokelau made millions from .tk, the reality, according to Tokelau’s officials, was very different.

The abuse of .tk has become a matter of national concern for Tokelau, affecting discussions about its political future. With a referendum on its future is planned for 2025, the cleanup of .tk is viewed as essential for any serious bid for sovereignty.