April 2018 - ALAC - lists.icann.org

Re: [ALAC] [Accred-Model] Comment - Alan Greenberg
by Holly Raiche April 22, 2018

April 22, 2018

Alan I see a lot wrong with it - and I see a lot that I disagree with in Jonathan’s first draft. I have been tied up teaching, but finally have a bit of time to put my thoughts down - and I decidedly do NOT think the IPC/BC is a great model. For a very different view, read the NCSG response- attached. So PLEASE - give people at least a bit more time to look at what Jonathan’s response - and mine. Holly On 21 Apr 2018, at 8:20 am, Alan Greenberg <alan.greenberg(a)mcgill.ca> wrote: > This comment has been circulated within the ALAC and At-Large, but there has not been sufficient time to decide to what extent if it fully accepted. As such, it is being submitted here purely on my personal behalf. > > =============== > > There has been significant community comment that this proposal was originally (and to some extent still is) a creature of the BC. > > I APPLAUD that the BC/IPC have taken the initiative to do this! I and many of us have been saying for several months (certainly starting before the Abu Dhabi meeting) that the accreditation model is an absolute key to moving forward. > > The BC/IPC have done something and put it down on paper. Bravo! > > I think this model is a great start. > > I see problems with it, but we need to start the discussion somewhere. What do I see as problematic? > I think the provision to give access to "All users", while it would be nice for me personally, is more than a bit loose. We are going to need something MUCH stronger to grant access over and above the other accredited channels. > A single tier is not sufficient. There should be more granularity based on the uses. Perhaps we could start with this single and improve later, but my preference would be to use the use-cases we have already built to provide more than one few tier (ie more than just a) thin WHOIS, or b) ALL of the data.) > I look forward to the work that the document says the SSAC is doing regarding credentialization. > I STRONGLY support the comments from the Anti-Phishing Working Group (APWG). These comments make the model more effective and implementable. The only one I find possible questionable related to funding the accreditation process. Although I would prefer that it is an integral part of the DNS and WHOIS (and thus funded by ICANN through its normal sources), I would not want to see implementation delayed over this issue. > _______________________________________________ > Accred-Model mailing list > Accred-Model(a)icann.org > https://mm.icann.org/mailman/listinfo/accred-model

4 5

Re: [ALAC] [NA-Discuss] Fwd: [Ccwg-auctionproceeds] ADOBE CONNECT – WHAT NEXT? - ICANN Blog By Ash Rangan
by Javier Rua April 21, 2018

April 21, 2018

“I want my AdobeC!!!!” (shouted like “I want my MTV!!!”) Javier Rúa-Jovet +1-787-396-6511 twitter: @javrua skype: javier.rua1 https://www.linkedin.com/in/javrua > On Apr 21, 2018, at 10:16 AM, Marita Moll <mmoll(a)ca.inter.net> wrote: > > I totally agree. My experience with webex and zoom have not been great. There have been audio problems requiring use of both phone and computer interface (to see the slides) -- which causes all kinds of extra work for staff and chairs and sometimes feels like enhanced teleconferencing for the participants. Neither platform is very intuitive and people, myself included, seem to have trouble figuring how to do basic things like mute/unmute, raise hand, etc. > > So I would be very happy to see a return to Adobe as our basic platform although I don't know whether "hardened" Adobe will look a bit different. > > My hat is off to staff and meeting chairs who have been struggling with this change. > > Marita Moll > >> On 4/21/2018 6:47 AM, Holly Raiche wrote: >> I, for one, would be happy to go back to Adobe - I have had real difficulties with webex - I just couldn’t access it. And I miss having the visibility of the text, the sound of the speaker and the availability of chat (both public and private >> >> Holly >>> On 21 Apr 2018, at 4:20 am, Judith Hellerstein <judith(a)jhellerstein.com> wrote: >>> >>> Hi All, >>> >>> Very interesting blog by Ash Rangan. Forwarding this email widely so others could read it and discuss it. >>> >>> Best, >>> Judith >>> >>> Sent from my iPad >>> judith(a)jhellerstein.com >>> Skype ID:JudithHellerstein >>> >>> Begin forwarded message: >>> >>>> From: Nathalie Peregrine <nathalie.peregrine(a)icann.org> >>>> Date: April 20, 2018 at 2:16:27 PM EDT >>>> To: "ccwg-auctionproceeds(a)icann.org" <ccwg-auctionproceeds(a)icann.org> >>>> Subject: [Ccwg-auctionproceeds] ADOBE CONNECT – WHAT NEXT? - ICANN Blog By Ash Rangan >>>> >>>> Dear all: >>>> >>>> Please take a look at this blog on Adobe Connect. And note the request: >>>> >>>> Before we make these changes, we want to hear from you. What do you think? Please submit your thoughts on this contemplated move before May 2nd here: RP-tool(a)icann.org >>>> >>>> Best regards, David >>>> >>>> >>>> https://www.icann.org/news/blog/adobe-connect-what-next[icann.org] >>>> >>>> ADOBE CONNECT – WHAT NEXT? >>>> As you know, the ICANN organization took down its Adobe Connect service midway through the ICANN61 meeting in response to reported issues[icann.org] with this service. Concurrently, we began to conduct our own forensic analysis of the reported incident and began working with our Adobe cloud service provider, CoSo Cloud LLC, and through them with Adobe to learn more. Shortly thereafter, we rolled out instances of Zoom and WebEx for the community to support remote participation (RP) and collaboration. Here's where we are now: >>>> >>>> The Forensics Investigation >>>> With respect to our forensics work, we received application logfiles from CoSo Cloud, going back for a period of one year. ICANN Engineering and Security teams have examined these application log files and the results of our investigation clearly show "fingerprints of incursion" by the researcher who reported the issue. We were unable to find any other indication that anyone else either identified or exploited this issue. Thanks to the person who found the bug again. >>>> Working closely with CoSo Cloud, we were able to recreate the reported issue, and understand the conditions required to trigger it. This information has been communicated to Adobe, and Adobe is working on a software fix to address the root cause of the issue. >>>> We have also been working with CoSo on options to re-enable Adobe Connect in the shorter term. We have determined there are two viable paths to accomplish this goal. They are: >>>> Deploy a hardened configuration to eliminate "man-in-the-middle" exploitations by encrypting relevant traffic, or >>>> Implement a programmatic fix from CoSo Cloud to substantially reduce the window during which the issue can be exploited. >>>> With respect to the first option, we attempted to hack the hardened configuration in a test environment last week, and were not able to do so over the course of 7 hours. Separately, CoSo Cloud and Adobe conducted similar tests and confirmed that this configuration is protected from exploitation of the issue. >>>> >>>> Community Feedback and Next Steps >>>> For the last three weeks, we have been gathering limited feedback regarding users' experiences with WebEx and Zoom. So far, we have input from about 200 people, including ICANN org meeting organizers and the ICANN community. Our analysis of this feedback indicates a desire to revert back to an Adobe Connect, providing the security of the service is ensured. >>>> Accordingly, we would like to propose the following plan to the broader community for consideration: >>>> We would like to restore Adobe Connect services with both the new hardened configuration and the programmatic fix discussed above. Our intent would be to restore service by 3 May. This would allow us to use Adobe Connect during several upcoming events including the Board Workshop, the GDD Industry Summit, and ICANN62. >>>> Once Adobe releases a new version of the software with a fix for this issue from their perspective, and provides assurance the update has been adequately tested, we will move toward that release of Adobe Connect in a prudent manner, with the help of CoSo Cloud. >>>> >>>> We believe that this approach will ensure the security of our content, and of our community interactions, while also enabling our community to use the collaboration tools of their choice. >>>> >>>> Before we make these changes, we want to hear from you. What do you think? Please submit your thoughts on this contemplated move before May 2nd here: RP-tool(a)icann.org >>>> >>>> Meanwhile, we will continue to offer WebEx and Zoom for RP and collaboration purposes. We will also continue to follow industry developments, including the research ALAC is doing on the RP and collaboration space, to ensure we are using secure and cost-effective tools that are appropriate for our needs. >>>> >>>> I look forward to your comments! >>>> >>>> >>>> >>>> David A. Olive >>>> Senior Vice President >>>> Policy Development Support >>>> Internet Corporation for Assigned Names and Numbers (ICANN) >>>> >>>> >>>> _______________________________________________ >>>> SOAC-Leaders-ICANNMeeting-Planning mailing list >>>> SOAC-Leaders-ICANNMeeting-Planning(a)icann.org >>>> https://mm.icann.org/mailman/listinfo/soac-leaders-icannmeeting-planning >>>> _______________________________________________ >>>> Gnso-igo-ingo-crp mailing list >>>> Gnso-igo-ingo-crp(a)icann.org >>>> https://mm.icann.org/mailman/listinfo/gnso-igo-ingo-crp >>>> _______________________________________________ >>>> gnso-rpm-wg mailing list >>>> gnso-rpm-wg(a)icann.org >>>> https://mm.icann.org/mailman/listinfo/gnso-rpm-wg >>>> _______________________________________________ >>>> Ccwg-auctionproceeds mailing list >>>> Ccwg-auctionproceeds(a)icann.org >>>> https://mm.icann.org/mailman/listinfo/ccwg-auctionproceeds >>> _______________________________________________ >>> ALAC mailing list >>> ALAC(a)atlarge-lists.icann.org >>> https://atlarge-lists.icann.org/mailman/listinfo/alac >>> >>> At-Large Online: http://www.atlarge.icann.org >>> ALAC Working Wiki: https://community.icann.org/display/atlarge/At-Large+Advisory+Committee+(AL… >> >> >> >> ------ >> NA-Discuss mailing list >> NA-Discuss(a)atlarge-lists.icann.org >> https://atlarge-lists.icann.org/mailman/listinfo/na-discuss >> >> Visit the NARALO online at http://www.naralo.org >> ------ > > ------ > NA-Discuss mailing list > NA-Discuss(a)atlarge-lists.icann.org > https://atlarge-lists.icann.org/mailman/listinfo/na-discuss > > Visit the NARALO online at http://www.naralo.org > ------

1 0

Fwd: [Accred-Model] Comment - Alan Greenberg
by Holly Raiche April 21, 2018

April 21, 2018

And, I would add, let everyone have a final chance to view the statements. And I’m not sure why it is too late - Evin said the deadline was the 20th Holly Begin forwarded message: > From: Holly Raiche <h.raiche(a)internode.on.net> > Subject: Re: [Accred-Model] Comment - Alan Greenberg > Date: 21 April 2018 9:52:53 am AEST > To: Alan Greenberg <alan.greenberg(a)mcgill.ca> > > Please see what I have just done > > On 21 Apr 2018, at 9:50 am, Alan Greenberg <alan.greenberg(a)mcgill.ca> wrote: > >> Holly, I don't set the deadlines. Regarding Jonathan's posted comment on the Article 29 letter, we can tell them to withdraw it if there is a consensus to do so. >> >> Regarding my comment, I said there was no agreement in the ALAC and posted it on my own behalf. I have since been told it was submitted to late and will not be considered for this pass. >> >> The NCSG statement does not talk about the model as such but the basis for its existence. It ignores the phrase "or ny a third party" in Article 6, section 1e of the Regulations which allow the needs of a third party to be considered, and it PRESUMES that the privacy needs with out-weigh the needs for access to provide for the safety and security of the Internet. That is a presumption that I do not agree with. The NCSG strongly objects to a model originating in the BC/IPC. I on the other hand welcome ANYONE working on such a model and specifically would welcome it being transferred to the community as a whole if there were any interest. >> >> Alan >> >> >> At 20/04/2018 06:32 PM, Holly Raiche wrote: >> >>> Alan >>> >>> I see a lot wrong with it - and I see a lot that I disagree with in Jonathanâ€™s first draft. I have been tied up teaching, but finally have a bit of time to put my thoughts down - and I decidedly do NOT think the IPC/BC is a great model. For a very different view, read the NCSG response- attached. So PLEASE - give people at least a bit more time to look at what Jonathanâ€™s response - and mine. >>> >>> Holly >>> >>> >>> On 21 Apr 2018, at 8:20 am, Alan Greenberg <alan.greenberg(a)mcgill.ca > wrote: >>> >>>> This comment has been circulated within the ALAC and At-Large, but there has not been sufficient time to decide to what extent if it fully accepted. As such, it is being submitted here purely on my personal behalf. >>>> >>>> =============== >>>> >>>> There has been significant community comment that this proposal was originally (and to some extent still is) a creature of the BC. >>>> >>>> I APPLAUD that the BC/IPC have taken the initiative to do this! I and many of us have been saying for several months (certainly starting before the Abu Dhabi meeting) that the accreditation model is an absolute key to moving forward. >>>> >>>> The BC/IPC have done something and put it down on paper. Bravo! >>>> >>>> I think this model is a great start. >>>> >>>> I see problems with it, but we need to start the discussion somewhere. What do I see as problematic? >>>> I think the provision to give access to "All users", while it would be nice for me personally, is more than a bit loose. We are going to need something MUCH stronger to grant access over and above the other accredited channels. >>>> A single tier is not sufficient. There should be more granularity based on the uses. Perhaps we could start with this single and improve later, but my preference would be to use the use-cases we have already built to provide more than one few tier (ie more than just a) thin WHOIS, or b) ALL of the data.) >>>> I look forward to the work that the document says the SSAC is doing regarding credentialization. >>>> I STRONGLY support the comments from the Anti-Phishing Working Group (APWG). These comments make the model more effective and implementable. The only one I find possible questionable related to funding the accreditation process. Although I would prefer that it is an integral part of the DNS and WHOIS (and thus funded by ICANN through its normal sources), I would not want to see implementation delayed over this issue. >>>> _______________________________________________ >>>> Accred-Model mailing list >>>> Accred-Model(a)icann.org >>>> https://mm.icann.org/mailman/listinfo/accred-model >>> >>> X-Microsoft-Exchange-Diagnostics: >>> 1;YTOPR01MB0396;27:PKJyDSpsleGA7L6y7RiwBWziWgjRyLKmjJE77denCviuJRonQvhayYu4Jsewrfvt4fIHBqSNNWOBEgH6tcsIpx/yB9IZo4nij6rTRL0swEKjjZoAA+vJDEXnuDHQVhGx >>> X-Microsoft-Antispam-Message-Info: >>> t7CF4QknGdnCrBtkrn++DCPtIcMwWyxRraaDjbfhq11S3RQdLImsQGC2GtWCSFDrPmNQZou5n5JOlIuZQTOUBeQ6sQP2XaMw7THt/ZDwIDenl+SOx7PZdl8RT4FTdnfTp/o4mTusjq+jfUg8j0l7XQ8HEt8bxT5NHcOqaTSTYFtk/vpY7ogBepV2zUJGrYg40WdJ0o25loPiwyTUj8HJYbr2Fe+CKcEgU+hnYA8On9dj3/MLRrpl2k68WmjhHUAAbq7D+I0Zd3qoD7VB+giyXyNE7P9Pbc8O9hhUzK5L7ztLe5U+grXCSXN8QwH8x0SK7zdFFWywE/MuzgZaGBNAXe2gFr/MWGrv8LmqxMBBFuJzm0dOX+uV77Xdy2Hd9atmu+cU98j8e/5nhFGPnSPEGXWnQK8s2eN7feivbEPsxoZl2a1LBTOAfi0iFxUxh5s5H/THLm7kN3GI29E6blMhZA== >>> Content-Type: application/vnd.openxmlformats-officedocument.wordprocessingml.document; >>> name="NCSG Comments to Draft IPC_BC Purpose Statement Final.docx" >>> Content-Description: NCSG Comments to Draft IPC_BC Purpose Statement >>> Final.docx >>> Content-Disposition: attachment; >>> filename="NCSG Comments to Draft IPC_BC Purpose Statement Final.docx"; >>> size=36187; creation-date="Fri, 20 Apr 2018 22:33:49 GMT"; >>> modification-date="Fri, 20 Apr 2018 22:33:49 GMT" >>> Content-ID: <ED1DF51241BD3343915D6F3ABE3B1724(a)CANPRD01.PROD.OUTLOOK.COM> >

2 1

ALAC Response to Accreditation Model - due date 20 April
by Holly Raiche April 18, 2018

April 18, 2018

Folks We are fast running out of time to develop any kind of response to the accreditation model, even though the deadline for a response has been extended to this Friday. And in the interim, ICANN has received advice from Article 29 on the Interim model. (Article 29 is an advisory Group made up of a data protection authority from each EU member state). Their letter to ICANN, and Marby’s response, are on the home page of ICANN - and for those interested in the issue, I highly recommend reading both. Clearly, the implications of the Article 29 letter are that the Interim Model that we did comment on still raises concerns with them. Those concerns fall under the headings: Breadth of purpose - saying the proposed purposes are too widely drawn the link of purpose to processing - again, because the Whois data has been used does not qualify it as a purpose publication of the data must be linked to the original (and narrowly defined) purpose any access should be limited - not blanket access discussion about the length of retention of data discussion about the transfer of data Accreditation (particularly important in this context) - should only be for legitimate purpose, limited to the original purpose, not blanket access, and under limited conditions Below, I have copied in an email from Scott Hollenbeck, a long standing member of ICANN and one of those involved in the development of the RDAP (access protocol that would allow gated access to registration data) - simply because he has been involved in this issue for a long time and shows he has already worked on a technical solution to this issue - how access to data could work under GDPR. I will try to attend as much as possible of the capacity building webinar on this issue, but have been scheduled to attend an all-day course in the Sydney CBD so may have to miss some of the discussion. I imagine Tom will be very up to date on these issues, but I would like to have been attending the whole of the webinar myself In any case, if at all possible, we should be saying something. Quite apart from the original contribution from the IPC/BC model, the NCSG and Registrars have also made comments (largely challenging the IPC/BC model). I hope we are the one constituency that doesn’t make comments - although I realise that agreement on what to say will be difficult at the best of times. And if it isn’t too late - maybe put this issue on the ALAC policy page - and with it, links to the Article 29 letter, Marby’s response, the registrars’ response and the NCSG response (and any others I have missed - I have copies if that helps) Holly >>> >>> Hi all. >>> >>> After reading the Article 29 WP letter to ICANN >>> (awbs://www.icann.org/en/system/files/correspondence/jelinek-to-marby- >>> 11apr18-en.pdf), I started envisioning what process and system could >>> achieve GDPR compliance. What I came to is a token-based system, which >>> would work like this: >>> - Every request is analyzed by a human at an "RDS Clearinghouse". Each >>> request can be for a single data element (like "owner of domain X") or to >>> multiple data elements (like "domains owned by the same owner of domain >>> X"), but requests for multiple data elements are only foreseen to be >>> processed by contracted parties with "Search WHOIS" contract requirements. >>> - Clearinghouse issues a token with query parameters, data elements >>> authorized for response, identity of authorized party, reason for >>> authorization, validity (probably in the order of days), also informing >>> which endpoint to go to. >>> - Authorized party uses that token to access that endpoint, managed by the >>> party with most data about that element (usually a registrar). >>> >>> Note that is not a replacement for credentialing; credentials would still >>> be necessary to get tokens. This is also orthogonal to discussions like >>> which use cases are legitimate or not, GDPR-compliant or not etc.; it's >>> just a more granular approach to authorization that looks more inline with >>> privacy-oriented guidelines including but not limited to GDPR. >> >> Rubens, at a high level you just described how OpenID and OAuth work, except for the "Every request is analyzed by a human" part. > > Scott, > > I believe you are right, although most OAuth models I saw were not that granular to the point of saying "example.TLD, owner, e-mail address, valid until April 20 2018". That's not an OAuth limitation though, just common usage, and it probably could be made to work like this. > And some level of asynchronous communications could even make way for a quick look human analysis. > > > Rubens I have this very model, with human involvement, up and running right now as part of the gTLD RDAP Pilot. All of the attributes you mentioned can be encoded as OAuth claims. The model is described in an Internet-Draft that I first wrote in 2015. Just search for “draft Hollenbeck RDAP OpenID” using your favorite search engine.

6 13

Re: [ALAC] ALAC Response to Accreditation Model - due date 20 April
by Alan Greenberg April 17, 2018

April 17, 2018

I have added my initial comments to the Wiki (https://community.icann.org/x/WwAFBQ) and include them here for your convenience. I will develop this into a statement (likely complete mid-day Thursday) that I will submit on my own behalf. If anyone supports this, I will be glad to include others. Alan ==================== I have not had the time to do a very thorough analysis but I do have several comments based on my review of the document and related to Holly's comments. I agree that this work to date is a creature of the BC/IPC and the parties that have commented to date. I APPLAUD that. I an many of us have been saying for several months (certainly starting before the Abu Dhabi meeting) that the accreditation model is an absolute key to moving forward. In fact, some of you may recall that in answer to the Board's question to us about do we have any suggestions to mitigate the problems associated with GDPR, the ALAC answered YES. The answer was that we need to stop working in slow steps and start parallel efforts on all aspects of the problem, the most important being the accreditation model. We were ignored. The BC/IPC have done something and put it down on paper. Bravo! Holly has pointed out that we can only collect data that we need. Correct. But my interpretation of our mission is to provide a reliable trusted DNS. To do that we MUST ensure that those who help ensure that the DNS meets that target have access to the tools (and data) that they need to do their jobs. That IS our business!!! If we do not ensure that necessary data is collected, it can never be used by those with legitimate need. We need to state that clearly. Ultimately if I understand the process, it may be the courts that decide whether our rationale for collecting data is sufficiently strong to out-weight the privacy aspects. That brings us to the accreditation model, since WHO can get access to WHAT data is critical to us making that argument. I think this model is a great start. I see problems with it, but we need to start the discussion somewhere. What do I see as problematic? * I think their provision to give access to "All users", while it would be nice for me personally, is more than a bit loose. We are going to need something MUCH stronger to grant access over and above the other accredited channels. * I agree with Holly that a single tier is not sufficient. There should be more granularity based on the uses. Perhaps we could start with this single and improve later, but my preference would be to use the use-cases we already built (and how we spent the first many months of this project) to provide a few tiers. * I look forward to the work that the document says the SSAC is doing regarding credentialization. * I STRONGLY support the <https://community.icann.org/download/attachments/84213851/APWG-GDPR-Accredi…>comments from the Anti-Phishing Working Group (APWG). These comments make the model more effective and implementable. At 17/04/2018 04:06 PM, Alan Greenberg wrote: >I said *I* would try to add some comments tonight. Add to what you >had said (on Wiki now that it is there). Still hope to but time running out. > >To be clear, it IS *OUR* job to make sure that the DNS is safe and >reliable. That is our only job! Law enforcement, or anyone else that >can justify their need can get data only if we first collect it. > >But that is not relevant to the accreditation model as Scott says. > >At 17/04/2018 07:13 AM, Holly Raiche wrote: >>Hi Alan >> >>When you say ?we can add some comments tonight? my questions are >> * what comments? >> * and add to what? >>There is no link on the policy page to the accreditation model. >> >>And next - I?d have to differ on your views. Article 29 starts >>from basic privacy principles - as followed in over 100 countries >>around the globe with data protection regimes. First basic >>principle: only collect personal information that is necessary to >>do YOUR job. You don?t collect information you don?t need. Next >>principle: You tell the data subject why you need their personal >>information, and the circumstances in which that information will >>be shared. It is to THAT limited use and disclosure that people >>consent to giving their personal information. And it is in those >>LIMITED circumstances in which personal information is >>disclosed. The fact that others may want access is irrelevant. >> >>So that right away limits who gets information - and in limited >>circumstances only. >> >>In almost every data protection regime, law enforcement will be a >>circumstance in which personal information is made available. But >>again - not blanket permission, but in circumstances where there is >>a reasonable chance that illegal/harmful activity is or has taken >>place. And a further read suggests that access would also be given >>to Government/government authorised authorities as well. Two >>examples in Australia would be ASIC, our prudential regulator, and >>the ACCC, our competition and consumer watchdog. So the category >>of law enforcement probably extends to other regulatory/enforcement >>agencies - again, in situations where harm is suspected/occuring. >> >>So - far from having an outstanding lack of knowledge about the >>Internet and ICANN, Article 29 know exactly what is going on. And >>it is what now amounts to unlawful release of personal information >>- and not just in the EU. >> >>If there is to be any even slightly middle ground, it will be close >>to the model that Scott has already tested - access is possible, >>but to specific, accredited people and for specific >>situations. And it is in THAT context that the DNS will be >>protected. (and, as the cyber security advisor to our Prime >>Minister said, when asked how to make the Internet safe, replied >>that it isn?t possible to make it safe, only safer.) >> >>Holly >> >> >> >> >> >> >>On 17 Apr 2018, at 4:58 pm, Alan Greenberg >><<mailto:alan.greenberg@mcgill.ca>alan.greenberg(a)mcgill.ca > wrote: >> >>>Holly I have been travelling and am ties up in meetings all day >>>(Brussels time), but I hope to add some comments later tonight. >>> >>>I caution care in interpreting the Article 29 letter. Despite some >>>valid concerns, it shows an astounding lack of knowledge of the >>>Internet and ICANN's mission. As a prime example is their advice >>>to just focus on our own business and not that of others such as >>>law enforcement or those combatting cyber issues. Our mission is >>>to protect the DNS and that includes making it reliable and safe. >>>But we do not have the ability to do that ourselves and thus must >>>provide the tools for others to do that. If we fail, we are NOT >>>carrying out our mission. >>> >>>This will get more interesting in coming weeks. >>> >>>Alan >>> >>> >>> >>>At 16/04/2018 07:58 PM, Holly Raiche wrote: >>> >>>>Folks >>>> >>>>We are fast running out of time to develop any kind of response >>>>to the accreditation model, even though the deadline for a >>>>response has been extended to this Friday. And in the interim, >>>>ICANN has received advice from Article 29 on the Interim model. >>>>(Article 29 is an advisory Group made up of a data protection >>>>authority from each EU member state). Their letter to ICANN, and >>>>Marby?s response, are on the home page of ICANN - and for those >>>>interested in the issue, I highly recommend reading >>>>both. Clearly, the implications of the Article 29 letter are >>>>that the Interim Model that we did comment on still raises >>>>concerns with them. Those concerns fall under the headings: >>>> * Breadth of purpose - saying the proposed purposes are too >>>> widely drawn >>>> * the link of purpose to processing - again, because the >>>> Whois data has been used does not qualify it as a purpose >>>> * publication of the data must be linked to the original (and >>>> narrowly defined) purpose >>>> * any access should be limited - not blanket access >>>> * discussion about the length of retention of data >>>> * discussion about the transfer of data >>>> * Accreditation (particularly important in this context) - >>>> should only be for legitimate purpose, limited to the original >>>> purpose, not blanket access, and under limited conditions >>>> >>>>Below, I have copied in an email from Scott Hollenbeck, a long >>>>standing member of ICANN and one of those involved in the >>>>development of the RDAP (access protocol that would allow gated >>>>access to registration data) - simply because he has been >>>>involved in this issue for a long time and shows he has already >>>>worked on a technical solution to this issue - how access to data >>>>could work under GDPR. >>>> >>>>I will try to attend as much as possible of the capacity building >>>>webinar on this issue, but have been scheduled to attend an >>>>all-day course in the Sydney CBD so may have to miss some of the >>>>discussion. I imagine Tom will be very up to date on these >>>>issues, but I would like to have been attending the whole of the >>>>webinar myself >>>> >>>>In any case, if at all possible, we should be saying >>>>something. Quite apart from the original contribution from the >>>>IPC/BC model, the NCSG and Registrars have also made comments >>>>(largely challenging the IPC/BC model). I hope we are the one >>>>constituency that doesn?t make comments - although I realise that >>>>agreement on what to say will be difficult at the best of times. >>>> >>>>And if it isn?t too late - maybe put this issue on the ALAC >>>>policy page - and with it, links to the Article 29 letter, >>>>Marby?s response, the registrars? response and the NCSG response >>>>(and any others I have missed - I have copies if that helps) >>>> >>>>Holly >>>> >>>> >>>> >>>> >>>> >>>>>>> >>>>>>>Hi all. >>>>>>> >>>>>>>After reading the Article 29 WP letter to ICANN >>>>>>>(<awbs://www.icann.org/en/system/files/correspondence/jelinek-to-marby-> >>>>>>>awbs://www.icann.org/en/system/files/correspondence/jelinek-to-marby- >>>>>>>11apr18-en.pdf), I started envisioning what process and system could >>>>>>>achieve GDPR compliance. What I came to is a token-based system, which >>>>>>>would work like this: >>>>>>>- Every request is analyzed by a human at an "RDS Clearinghouse". Each >>>>>>>request can be for a single data element (like "owner of >>>>>>>domain X") or to >>>>>>>multiple data elements (like "domains owned by the same owner of domain >>>>>>>X"), but requests for multiple data elements are only foreseen to be >>>>>>>processed by contracted parties with "Search WHOIS" contract >>>>>>>requirements. >>>>>>>- Clearinghouse issues a token with query parameters, data elements >>>>>>>authorized for response, identity of authorized party, reason for >>>>>>>authorization, validity (probably in the order of days), also informing >>>>>>>which endpoint to go to. >>>>>>>- Authorized party uses that token to access that endpoint, >>>>>>>managed by the >>>>>>>party with most data about that element (usually a registrar). >>>>>>> >>>>>>>Note that is not a replacement for credentialing; credentials >>>>>>>would still >>>>>>>be necessary to get tokens. This is also orthogonal to discussions like >>>>>>>which use cases are legitimate or not, GDPR-compliant or not etc.; it's >>>>>>>just a more granular approach to authorization that looks more >>>>>>>inline with >>>>>>>privacy-oriented guidelines including but not limited to GDPR. >>>>>> >>>>>>Rubens, at a high level you just described how OpenID and OAuth >>>>>>work, except for the "Every request is analyzed by a human" part. >>>>> >>>>>Scott, >>>>> >>>>>I believe you are right, although most OAuth models I saw were >>>>>not that granular to the point of saying "example.TLD, owner, >>>>>e-mail address, valid until April 20 2018". That's not an OAuth >>>>>limitation though, just common usage, and it probably could be >>>>>made to work like this. >>>>>And some level of asynchronous communications could even make >>>>>way for a quick look human analysis. >>>>> >>>>> >>>>>Rubens >>>> >>>>I have this very model, with human involvement, up and running >>>>right now as part of the gTLD RDAP Pilot. All of the attributes >>>>you mentioned can be encoded as OAuth claims. The model is >>>>described in an Internet-Draft that I first wrote in 2015. Just >>>>search for ?draft Hollenbeck RDAP OpenID? using your favorite search engine. >>>>Content-Type: text/plain; charset="us-ascii" >>>>Content-Transfer-Encoding: 7bit >>>>Content-Disposition: inline >>>>X-Microsoft-Exchange-Diagnostics: >>>> >>>>1;YTOPR01MB0396;27:E+eV2ZOSHNubNtVECuy/VM/L0xhmfXbZcuSQZbzTXSXqae7LUG8EA97rPf+2WwLbTntAgo7cpRKp5nw8d8T6ebvY8Vy/iFaEy7AJW3LXmiMa8o52Hh4X6vuxt8b9Dc+H >>>>X-Microsoft-Antispam-Message-Info: >>>> >>>>mbIfSQV0+eZC39ENiUAspKdQkF0+JSTZwhHzgGzIJcnMTMtI1YFjxfAYUWl5x8Xsb0hCkvQc7VzC4AbTCpUbUGRQU6RcE5UUx1wEGk3WXKVvz27yXSf3osNfP8UwExDIUIL1xB46d04FaxAvbFZx3V7Y2ZVoGnlOF9jsJrXvgUSoJT4DsABV8smZdk4vNHRjunBYHmX/Uyc08KK5W5zM0fDRY7NEhuy8gp+3GzVz4A/5TqlICRbEqPiDy4iZWnOAaPiE4ELCAfZPmhMusibjqJno9CcaR04f9ovSYOL+LGRVBVtQ1M9b/SxTHtnAjl+ENjnGKfOC/j1+ryUspB55Z6d0P1zabIZYAwo87l1z4xMWzu3tmPExSwczo7sS129laKLyfrpQKQl6gt36u0ia78/RPd+UH+swgobcmXrp+pNPCIV60r6mKu9CLHxwfljZtI62wcXHykdzvBpIoyKjBQ== >>>> >>>>_______________________________________________ >>>>ALAC mailing list >>>><mailto:ALAC@atlarge-lists.icann.org>ALAC(a)atlarge-lists.icann.org >>>>https://atlarge-lists.icann.org/mailman/listinfo/alac >>>> >>>>At-Large Online: http://www.atlarge.icann.org >>>>ALAC Working Wiki: >>>>https://community.icann.org/display/atlarge/At-Large+Advisory+Committee+(AL… ) >Content-Type: text/plain; charset="us-ascii" >Content-Transfer-Encoding: 7bit >Content-Disposition: inline >X-Microsoft-Exchange-Diagnostics: > >1;YTOPR01MB0396;27:h8Wpez2dvY2XET3Ia5h4qAquPuwzm9VE+f0o9jAx4u4JqdcaeoFZrcLq85n2mYD3F4D2JBZ3d82Dv7LQjy5P6IxhefwMl889OIqCzWY/L0tSlen3d//E+BIL29ZiuFwf >X-Microsoft-Antispam-Message-Info: > >hY7ED33x23ZkuHwojyFbo9fT4+q8fh7UeaasB8GnDHvh0BflWaNXsKsfMieZOnBdYbD+6BGXeHDMiXHJ4CDj98J676LIfAnkqt5z4g81tEHWJeDXO46Rto11D8dDGA4rxI/gjrCwmWqpqYSFxjr5NSqyxKmG3FmUIfJkbMQ2MCGUw+UiodOO00BPDdel1hHHnTKdSFJh8jGtpFMe8Lki/O10iRkZbOfd3AjshkUl4bg= > >_______________________________________________ >ALAC mailing list >ALAC(a)atlarge-lists.icann.org >https://atlarge-lists.icann.org/mailman/listinfo/alac > >At-Large Online: http://www.atlarge.icann.org >ALAC Working Wiki: >https://community.icann.org/display/atlarge/At-Large+Advisory+Committee+(AL…

1 0

2018 ALAC Monthly Call schedule for the rest of the year
by ICANN At-Large Staff April 16, 2018

April 16, 2018

Dear All, Please find attached a schedule for the 2018 ALAC Monthly calls for the rest of the year, to include corresponding local times across the time zones (regions observing DST taken into account). Please confirm whether you see any major issue with any of the dates & times suggested. Note the times of 04:00, 12:00 and 21:00 UTC were established a while back. These times were the result of a Doodle poll. By rotating, we all share the pain with some inconvenient times. Hopefully we can continue with these times. Thank you. Kind regards, Gisella —————— Gisella Gruber Manager, Operations Support, ALAC-At-Large Internet Corporation for Assigned Names and Numbers (ICANN) Email: gisella.gruber(a)icann.org<mailto:gisella.gruber@icann.org> Tel: +44 7545 334 360<tel:+44%207545%20334360> Skype ID: gisella.gw[gisella.gw]<https://urldefense.proofpoint.com/v2/url?u=http-3A__gisella.gw&d=DwMFaQ&c=F…> One World, One Internet

2 1

Re: [ALAC] 2018 ALAC Monthly Call schedule for the rest of the year
by Vanda Scartezini April 16, 2018

April 16, 2018

I believe is the best we can do to allow all regions to have a call in a comfortable time. Best to all. Vanda Scartezini Polo Consultores Associados Av. Paulista 1159, cj 1004 01311-200- Sao Paulo, SP, Brazil Land Line: +55 11 3266.6253 Mobile: + 55 11 98181.1464 Sorry for any typos. From: ALAC <alac-bounces(a)atlarge-lists.icann.org> on behalf of ICANN Staff <staff(a)atlarge.icann.org> Date: Monday, April 16, 2018 at 10:55 To: 'ALAC List' <alac(a)atlarge-lists.icann.org> Subject: [ALAC] 2018 ALAC Monthly Call schedule for the rest of the year Dear All, Please find attached a schedule for the 2018 ALAC Monthly calls for the rest of the year, to include corresponding local times across the time zones (regions observing DST taken into account). Please confirm whether you see any major issue with any of the dates & times suggested. Note the times of 04:00, 12:00 and 21:00 UTC were established a while back. These times were the result of a Doodle poll. By rotating, we all share the pain with some inconvenient times. Hopefully we can continue with these times. Thank you. Kind regards, Gisella —————— Gisella Gruber Manager, Operations Support, ALAC-At-Large Internet Corporation for Assigned Names and Numbers (ICANN) Email: gisella.gruber(a)icann.org<mailto:gisella.gruber@icann.org> Tel: +44 7545 334 360<tel:+44%207545%20334360> Skype ID: gisella.gw[gisella.gw]<https://urldefense.proofpoint.com/v2/url?u=http-3A__gisella.gw&d=DwMFaQ&c=F…> One World, One Internet

1 0

URGENT: Community Onboarding Program
by Alan Greenberg April 13, 2018

April 13, 2018

There will be a Community Onboarding Program at ICANN62 in Panama. We have a choice of having ONE mentee and ONE mentor (both of whom will receive travel support), or TWO mentees and One mentor who is already funded to attend the meeting. I am asking each RALO Chair, in consultation with their RALO leadership team and their three ALAC Members to identify possible mentees and mentors. This is a Policy Meeting, so mentees should have a good grasp of ICANN already, and be prepared to participate and learn from all of the discussions going on. The Mentor should be someone who is prepared to spend time with the mentees and help them understand what is happening. A with the COB program last time, the ALAC Appointee Selection Committee will make the selections. To be clear, I am looking for from each RALO Chair, sent to me and staff: 1. A preference for whether we should have 2 mentees and an already funded mentor, or one mentee and a mentor who will be funded to attend just as a mentor. If we select the former, we need to be really sure the mentor will take the responsibility seriously. A person dedicated to that task may take it more seriously, but that implies just one mentee. 2. Suggestions for good mentee(s) 3. Suggestions for good mentors, both already funded and not yet funded. 4. In all cases, there should be a brief background and/or rationale if the people are not very well known to us. And please brief your AASC members on your candidates (see https://community.icann.org/x/VwebAw for membership list). You should verify with anyone you are suggesting that they are able to travel to the Panama meeting. For the record, at ICANN 61, we had two COB mentees, one from APRALO and one from LACRALO. The deadline for submission of names is Sunday, 22 April 2018 at 16:00 UTC. Alan

2 1

Community OnBoarding Program
by Alan Greenberg April 12, 2018

April 12, 2018

We never got to this on the meeting today. I have asked a qualifying question about whether we can have 2 mentees (and one already funded mentor) or only 1 mentee and 1 mentor as prescribed in the program. Hopefully we will have an answer tomorrow and can decide how to proceed. Alan

2 1

Fwd: [fin-comm] Reserve Fund replenishment: public comment period closes on 25 April
by León Felipe Sánchez Ambía April 12, 2018

April 12, 2018

Dear all, The public comment period is close to the end in this very important topic. I hope you are able to comment on the relevant issues for the At-Large community. Kind regards León Enviado desde mi iPhone Inicio del mensaje reenviado: > De: "Xavier J. Calvez" <xavier.calvez(a)icann.org> > Fecha: 12 de abril de 2018, 11:08:08 a. m. CDT > Para: community-finance <community-finance-bounces(a)icann.org> > Cc: BFC <fin-comm(a)icann.org>, Shani Quidwai <shani.quidwai(a)icann.org> > Asunto: [fin-comm] Reserve Fund replenishment: public comment period closes on 25 April > > Dear all, > Just a quick reminder that the public comment period on the suggested approach to replenish the Reserve Fund closes in 13 days on the 25th of April. We look forward to a lot of comment and input on this important topic. See below the link to the public comment page. > > https://www.icann.org/public-comments/reserve-fund-replenishment-2018-03-06… > > Thank you. > > Best, > > Xavier > > Xavier Calvez > ICANN – SVP & CFO > 12025 Waterfront Drive, Suite 300 > Los Angeles, CA 90094 > Phone: 310-301-5838 > Mobile: 805-312-0052 > Fax: 310-957-2348 > > _______________________________________________ > fin-comm mailing list > fin-comm(a)icann.org > https://mm.icann.org/mailman/listinfo/fin-comm

1 0