October 2007 - At-Large - lists.icann.org

List Posting tone and behaviour
by Jacqueline A. Morris Oct. 18, 2007

Oct. 18, 2007

Dear All The tone and content of some messages recently have stretched the limits of acceptable behavior on this list. May I remind you all of Rule 22.8 and 22.9 as follows, which explicitly prohibit: 22.9 Unprofessional commentary, regardless of the general subject, 22.10 Postings libellous being used to abuse, harass, stalk, or threaten others, We appreciate that some may feel strongly and get passionate about the topics, but we do not want to have to sanction anyone for their posts. So please, tone it down ASAP. Many of our colleagues are very offended by this behavior. Sincerely Jacqueline A. Morris ALAC Chair No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.5.488 / Virus Database: 269.14.13/1075 - Release Date: 10/17/2007 09:38

3 2

Domain Hijacking: It's becoming an everyday event
by Danny Younger Oct. 18, 2007

Oct. 18, 2007

http://www.dnforum.com/f26/domain-hijacker-prowl-thread-254944.html Today I had 150+ of my domains hijacked out of my godaddy account, a couple of the names I have listed here for sale. Godaddy is working with their fraud dept., My Lawyer, The FBI, and other organizations to correct the situation and to prosecute the party involved. They used multiple IP addresses when accessing my godaddy account and have also hijacked other domains recently from what I gather after talking to godaddy. They used an email address noobcash at yahoo dot com I searched it on google and got a hit that led to funytube dotcom - I did a whois on that domain and it is the same name that they used to steal my portfolio hosted with godaddy. see info like name used, where they host that domain etc.. http://whois.domaintools.com/funytube.com I have 2 possible leads to who it may be or may be involved. There is major damage done so far and more to come if not corrected tonight before the start of the business week. I want to let everyone know that is a DNF member to be very careful when dealing with people on any forum. I have never shared my passwords or anything knowinly and think I am pretty savvy enough to keep my accounts safe. No one is safe. Frequently change all of your passwords for your portfolio and watch for spyware, viruses, etc... Don't cross use your passwords, Like your DNF accound log-in shoudl be unique to DNF etc... If you have a very expensive portfolio liek I do (did and better get back fast) then you should use many levels of protection. If you think you are at risk be very very careful. This is a nightmare to say the least. I hope godaddy steps up and fixes this issue fast. I stand to loose a lot of money per day in incoming business from my sites (not all profit) but a couple days down will really piss me off. Anyway if anyone else has had an experience with this I invite feedback and support. The domains affected have already lost $$ and I live click to click to support my 6 kids and lifestyle. Be on the lookout. Anyway I am sure godaddy will see the scam here at hand - and reverse the domain disaster. I just hope they do it before all the names resolve to a new host of the domain bandit's choice and screw up some of my business. I have 3 main sites I use for most of my bread and butter. the three sites have a combo of about 95,000 members I plan on changing to another regist. after all of this and also replacing my main pc with a fresh one and updating all of my passwords and such... Hope I dont lose many customers.. William PS any domains I have listed on DNF are on pause as some of them (most) are in this web of Sh&t. Danny's note: Two years ago the SSAC issued 10 recommendations to deal with hijackings... have a look and see how many have been implemented (here's a clue, it's not a high number): http://www.icann.org/announcements/hijacking-report-12jul05.pdf __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

The Downside To UltraCheap Registrars
by Danny Younger Oct. 18, 2007

Oct. 18, 2007

>From Michele Neylon's blog: "Some domain registrars only USP (unique selling point) is price. I've mentioned the issues with DirectI's pricing structures in the past. With the price increase this week I was more or less expecting there to be some kind of backlash, but I wasn't expecting this: All the Pending gTLD Transfer Orders (i.e. orders that haven't yet been executed) throughout your Reseller Chain will be canceled by the system on 12th October, 2007. These orders can be placed again by you / your Customers from 13th October onwards. Also, the Transfer Orders that are currently in status 'Awaiting Admin Contact approval' will also be canceled by the system. These again, can be placed by you / your Customers from 13th October onwards. Domain transfers can be painful enough in the best of circumstances (clients providing incorrect EPP keys, ignoring emails etc., etc.) but this is a bad joke! DirectI's pricing strategy was going to cause issues, but this might be the beginning of the end for some of their resellers. This kind of mess will cost a lot of people money and business." http://www.isquattedyour.eu/2007/10/11/the-downside-to-ultracheap-registrar… hmmm... perhaps the ALAC can propose a solution and post it to raa-consultation[at]icann.org unless of course, they enjoy the status quo... __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 2

ccNSO Resolutions on IDN issues
by Danny Younger Oct. 18, 2007

Oct. 18, 2007

Published on 15 October: http://ccnso.icann.org/about/minutes/resolutions-idn-from-ccnso-council-02o… __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

Revised List of Candidates
by Nick Ashton-Hart Oct. 18, 2007

Oct. 18, 2007

Dear All: Upon research I find that despite all the seconding that has been going on for the various positions, seconds are not actually required, only nomination and acceptance of nomination. My apologies in particular to Robert, Jonathan, and Wolfgang. The current list is therefore as below: Nominations for Officer Positions 2007/8 Nominations Received and seconded on or before the 14th October 2007 deadline ALAC Committee Officers Chair Cheryl Langdon-Orr (accepted) Vice Chair Vanda Scartezini (accepted) Sebastien Bachollet (accepted) Robert Guerra (accepted) Rapporteur No nominations Liaisons GNSO Liaison Alan Greenberg (accepted) ccNSO Liaison Jacqueline Morris (accepted) Adam Peake (declined) Vittorio Bertola SSAC Liaison Robert Guerra (accepted) IDNs Xue Hong (accepted) WHOIS None proposed Working Groups IDNs WHOIS No nominations Registrant/Registrar Relations No nominations IPv4 – IPv6 Migration No nominations New GTLDs No nominations Ad-Hoc Positions Special Adviser on Internet Governance Policy Jonathan Zittrain Wolfgang Kleinwachter -- Regards, Nick Ashton-Hart Director, At-Large ICANN Main Tel: +33 (450) 40 46 88 USA Tel: +1 (202) 657-5460 Fax: +41 (22) 594-85-44 Mobile: +41 (79) 595 54-68 email: nick.ashton-hart(a)icann.org Win IM: ashtonhart(a)hotmail.com / AIM/iSight: nashtonhart(a)mac.com / Skype: nashtonhart Online Bio: https://www.linkedin.com/in/ashtonhart

12 13

ISPCP Statement on WHOIS
by Danny Younger Oct. 18, 2007

Oct. 18, 2007

The ISPCP is pleased to submit this statement on WHOIS, in response to the Staff overview on the activities of the Whois Task Force and the Whois Working Group. Firstly we would like to thank the ICANN staff for this report, which contributes to presenting a complex debate in a summarized and organized fashion. The ISPCP has followed the debate on WHOIS, throughout the proceedings involving both the WHOIS Task Force and the WHOIS Working group, with close interest and active participation. The issues that have been debated and re-debated over several years tend to expose some rather inevitable conclusions: Registrant data is not validated, and thus any registrant can furnish false information for WHOIS purposes. Thus in a significant percentage, the concerns on privacy refer to inaccurate data sets, since no validation is conducted on the information submitted. Validation of data has not been attempted partly because of the stated costs borne by registrars. Registrants concerned about personal data privacy, have the option of buying the service of private registration (proxy service) from a registrar, thus concealing their own registrant data. Registrants can also find shelter for their data privacy under their own national laws, in many instances, by registering a domain in their own ccTLD registry. The OPOC solution does not, in its current form, address the substantial concerns raised by the ISPCP and broadly throughout the Internet community, including who gets access to registrant data, OPOC responsibilities and other practical details. There has not been a sufficient review of other possible alternatives such as the special circumstances proposal or tiered access models both of which limit some but not all access to Whois data. These proposed models would benefit from the same in depth discussion awarded to the OPOC solution, and may bear more productive results. The discussions of the WHOIS Working Group served to highlight considerable input, from sectors normally involved with pursuing and counteracting cybercrime activities, which invariably use websites to trap their victims, and thus require immediate investigative action. The ISPCP believes cybercrime, is a very significant threat to Internet users (including domain registrants) and has a substantial negative impact to the security and stability of the Internet. Cybercrime, in its many varied forms, including predatory behavior against minors, financial and consumer fraud and identity theft pose a very real and direct threat to individual privacy and to national sovereignty when a primary tool used for detection and prevention of such crimes is removed from legitimate users and law enforcement authorities. The discussions of the WHOIS Working Group failed to come up with consensus solutions to some basic and practical concerns: - How can quick and efficient response to anti-cybercrime data gathering be ensured from an OPOC? - What parties have access to the hidden data? - Who decides which parties have access to the hidden data? - Who pays for the costs involved in providing access to hidden data? Finally, there are various issues pertaining to an implementation of the OPOC model, as reflected in the Staff report, that are far from achieving consensus support. In this context, the ISPCP believes that promoting a GNSO resolution to move OPOC to an implementation phase, is not appropriate and fails to consider the very broad set of concerns raised by the community at large. . Thus we would like to re-state certain considerations that our constituency has submitted in the past, namely: ISPCP Uses of Whois Data 1. to research and verify domain registrants that could vicariously cause liability for ISPs b/c of illegal, deceptive or infringing content. 2. to prevent or detect sources of security attacks of their networks and servers 3. to identify sources of consumer fraud, spam and denial of service attacks and incidents 4. to effectuate UDRP proceedings 5. to support technical operations of ISPs or network administrators The members of the ISPCP constituency continue to depend on WHOIS for the actions listed above, and in the course of our last meetings, have expressed their concerns on potential changes that could hinder their ability to perform these actions in a timely and effective manner. Public statements, including this one on whois, are developed through a bottom-up, participant-led process. In the case of this statement, the ISPCP has used its long-established drafting and editing process for drafting, editing and vetting the document. __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

Registry Statement on WHOIS
by Danny Younger Oct. 18, 2007

Oct. 18, 2007

Statement of the gTLD Registries Constituency on the final WHOIS Task Force Report The following statement is provided by the gTLD Registries Constituency (RyC) in response to the motion approved by the GNSO Council on 6 September, 2007 instructing the representatives of the constituencies to solicit comments regarding the issue under consideration. The information is grouped as follows: I. General Information about the RyC II. Background Information about the development of the Comments III. Comments of the RyC IV. Method for Reaching Agreement on RyC Position V. Impact on Constituency VI. Time Period Necessary to Complete Implementation I. General Information Name of organization: GNSO gTLD Registries Constituency Contact Person: David W. Maher, Chair Contact email address: dmaher[at]pir.org Number of official members of the organization: 15 Estimated number of potential eligible members of the organization: 16 Number of members that participated in developing this input: 11 II. Background Information about the development of the comments The RyC comments included in this document were developed and adopted by constituency members via participation in the constituencys online mailing list and teleconference calls. All members and potential members of the constituency were encouraged to participate. Drafts of the comments were distributed via the constituency email list, which is open to all members and potential members. Participants were then asked to propose possible edits and to communicate whether or not they agree with the comments and edits. In the end, only statements for which there was consensus support were included in this document. III. Comments The RyC previously filed comments with the GNSO on January 15, 2007 on the draft Preliminary Task Force Report on Whois Services1. The final WHOIS Task Force Report of 12 March, 2007 is posted at http://gnso.icann.org/issues/whois-privacy/whois-services-final-tf-report-1…. As reported by the GNSO Secretariat, "Following completion of the Task Force Report and public comment period, on 28 March the GNSO Council issued a resolution creating a WHOIS Working Group to examine three issues and to make recommendations concerning how current policies may be improved to address these issues: 1. to examine the roles, responsibilities and requirements of the OPOC, and what happens if they are not fulfilled; 2. to examine how legitimate interests will access unpublished registration data; and 3. to examine whether publication of registration contact information should be based on the type of registered name holder (legal vs. natural persons) or the registrant's use of a domain name." The Working Group was neither able to reach consensus on these issues, nor to make recommendations concerning how current policies may be improved. There are several motions pending before the GNSO Council, all recognizing the lack of consensus and varying widely in proposals for a way forward. RyC believes that a decent respect for registrants interests in protection of personal privacy demands a change in the type of data published in the WHOIS service. There is, of course, a difference between the types of data collected by registrars, and the types of data published in the WHOIS service. RyC generally supports the concepts underlying the Registrar Constituencys OPoC proposal (although there are some practical concerns addressed below). Registrars have their own business needs for collection of registrant data, and should be able to make decisions primarily based on these needs and on the legal requirements of the jurisdictions where they operate. RyC strongly believes that there is no acceptable reason for publication of an individuals personal data such as home address, phone number or email address, whether by a registry or registrar unless that individual freely and explicitly gives consent to such publication. To the extent that such data is needed for law enforcement purposes or for the resolution of conflicts such as intellectual property, the appropriate means to meet these needs should be a tiered access process. RyC acknowledges that a tiered access model presents some policy implementation challenges but believes that it would be very worthwhile to confront those challenges in a constructive and diligent manner. As stated above, RyC generally supports the underlying concepts of the OPoC proposal. There are, however, special needs of some registries that are not addressed by OPoC. Sponsored registries, including .aero, .cat, .coop, .jobs, .museum and .travel must be able to determine the eligibility of registration applicants. The OPoC proposal does not adequately deal with these needs, but this can be remedied without sacrifice of the general concept that the collection of data should be based primarily on business needs, local law, and the need to escrow data, while the publication of data should be consistent with protection of personal privacy and local law. With respect to publication of data by registrars, RyC supports that portion of the current OPoC proposal, as follows: Accredited registrars will publish three types of data: 1) Registered Name Holder 2) Country and state/province of the registered name holder 3) Contact information of the OPoC, including name, address, telephone number, email. Also published by the registrar: date of initial registration of the domain name (creation date) expiry date, registry level data as follows: registered name, sponsoring registrar, URI of the authoritative Whois server, authoritative names associated with the registration, and status of the registered name (e.g. lock, hold, expired). With respect to publication of data by the unsponsored registries, RyC also supports the OPoC position, as follows: Registry data published is limited to: registered name identity of sponsoring registrar (i.e. registrar name, registrar IANA identification number, URL of authoritative Whois server) name server hostnames and corresponding IP addresses associated with the name status of the registered name (e.g. lock, etc.) and possibly the creation and expiry dates of the name. RyC believes that the sponsored registries should be free to determine what data should be collected for their specific needs and also to determine whether any data, beyond that listed above should be published. RyC offers the following comments on the three issues specified in the resolution creating the WHOIS Working Group: 1. " the roles, responsibilities and requirements of the OPOC, and what happens if they are not fulfilled;" 2."to examine how legitimate interests will access unpublished registration data;" The OPoC proposal in its present form does not deal with the question of access to unpublished Whois data nor did the Whois Working Group reach adequate agreement in this regard. This question must be answered in sufficient detail to provide policy direction regarding what, when, how and to whom unpublished Whois data must be released by the OPoC. Until that is done, the OPoC proposal provides a solution for accommodating privacy concerns, but does nothing to deal with the legitimate needs of access for unpublished Whois data. The RyC believes that the question of access can be dealt with separately and most appropriately by a tiered access mechanism to be developed. The RyC proposes that the GNSO Council, or the ICANN Board, take appropriate steps to encourage the parties at interest to negotiate and develop such a mechanism. 3. " whether publication of registration contact information should be based on the type of registered name holder (legal vs. natural persons) or the registrant's use of a domain name." The RyC believes that the appropriate distinction should be based on whether the name holder is a natural person with an inherent right to privacy of personal data. The RyC does not believe that there is a practical test for determining what types of use might qualify for privacy protection. IV. Method for Reaching Agreement on RyC Position RyC drafted and circulated via email a constituency statement, soliciting input from its members. RyC members suggested edits and additions to the draft which were subsequently incorporated into the final constituency statement. The statement was adopted by affirmative vote of 11 of the 15 registries. V. Impact on Constituency Adoption of the positions advocated by RyC would assist the members of the RyC in fulfilling their legal obligations in their respective jurisdictions, and would be of significant benefit through lifting burdensome contractual requirements. The impact of WHOIS changes is larger for thick registries than it is for thin, and the impact on sponsored registries can be more significant than on unsponsored registries. Any major changes would likely have considerable impact on registries and especially on registrars, in time, money and resources. VI. Time Period Necessary to Complete Implementation Completion of the OPoC proposal (or for that matter any tiered access proposal) to deal with policy and procedures to support access to non-published WHOIS data could involve considerable effort because questions must be answered prior to implementation such as the following: Who decides who gets access? How are requests for access authenticated? To whom should access be given? Who provides access? How would access be given? In addition, implementing a tiered access system would probably involve all registries and registrars migrating from the current WHOIS protocol to the IRIS protocol, a process that would undoubtedly take considerable time. RyC suggests that the time spent in addressing the above and finding a workable tiered access solution is a step in the right direction and such activity presents __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

Business Constituency Statement on WHOIS
by Danny Younger Oct. 18, 2007

Oct. 18, 2007

Statement of the Commercial and Business Users Constituency, regarding WHOIS, October-2007 On 6 September 2007, the GNSO Council approved a motion requesting constituency statements regarding reports by the WHOIS Task Force, WHOIS Working Group, and Staff Overview. Statements were requested by October 4, 2007. In response, the Commercial and Business Users Constituency (BC) submits a two-part statement. First, the BC re-submits its statement of concerns with the Operational Point of Contact (OPOC) proposal, as published in the Final Task Force Report on Whois Services, 16 March 2007 (see excerpt below). The BC is resubmitting its previous position because the concerns raised earlier this year remain relevant to the current WHOIS discussion. Moreover, BC membership believes that most questions raised regarding OPOC were not sufficiently resolved within the WHOIS Working Group, notwithstanding the remarkable efforts invested by Working Group participants. Second, the BC has adopted the following position regarding the Final Outcomes Report of the WHOIS Working Group 2007 : The BC does not consider the Final Outcomes Report of the WHOIS Working Group an adequate basis for implementation of the OPOC proposal. The BC has devoted considerable resources and time to understand the extent of privacy concerns raised with regard to the WHOIS service. While there has been extensive discussion and debate over positions and views, we still have insufficient fact-based information upon which to evaluate proposed changes to WHOIS. With respect to whatever information and analysis has been compiled thus far, the BC does not see sufficient justification for abandoning or changing the current WHOIS service. We still lack data on the characteristics of registrants, how WHOIS data is being used, and how misuses of WHOIS may be affecting registrants. The BC believes that any changes to Whois Services should not be considered until the completion of four studies recommended in Section 8 of the Working Group Final Outcomes Report (Section 8 shown below, from http://gnso.icann.org/drafts/icann-whois-wg-report-final-1-9.pdf ) Moreover, the BC believes the recommended studies should be conducted in three phases. The benefit of a phased approach is to reduce demands on ICANN resources in the event that early studies show that subsequent studies could be eliminated or more tightly targeted. We propose phasing these studies as described below: Phase One Studies In the first phase, ICANN staff should proceed with the fourth study recommended by the Working Group Final Outcomes Report: Information on gTLD registrants and registrations and the use and misuse of WHOIS data. This study is consistent with a study proposed earlier by the GAC. It should go beyond the June 2007 ICANN SSAC study on spam in order to document all specific misuses of WHOIS data. In addition, the BC recommends that this first phase include a review and analysis of proxy services presently available. That should include an analysis of the extent and characteristics of users who avail themselves of proxy services, and an evaluation of how proxy vendors are responding to requests to relay communications and reveal information about registrants. Expert resources should be used for the development of the study. Study results from this initial phase should be published for review and consideration by Council and the ICANN community. Phase Two Studies A second phase of studies would be needed if the first phase reveals that there is significant misuse of WHOIS data. In the second phase, ICANN staff would proceed with the cost-related studies recommended in the Working Group Final Outcomes Report: costs to implement the verification and consent proposals described in sections 2.4 and 2.5; costs to implement the Request/compliance issues of section 4; costs to implement the Access options described in section 6; marginal costs to implement a new fee-based system for Accessors compared with recovering additional costs from user fees using existing systems; Study results from this second phase should be published for review and consideration by Council and the ICANN community. Phase Three Studies If the phase two cost studies reveal costs that are justified in order to remedy the documented misuse of WHOIS data, ICANN staff should proceed with a third phase of studies. This third phase should combine the two remaining studies recommended in the Working Group Final Outcomes Report: data privacy issues arising from the self-declaration of Accessors in the Access proposal described in section 6 of the Working Group Final Outcomes Report. This should include an analysis of ex-post review mechanisms; mechanisms for a practicable, cost-effective, globally scaleable means of authenticating Accessors as described in section 6. This should include authentication of any parties with a legitimate interest in the data Study results from the third phase would inform implementation planning for any mechanisms to restrict access to WHOIS data. __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

Registries Consultation on the ICANN Strategic Plan
by Danny Younger Oct. 18, 2007

Oct. 18, 2007

As requested at http://www.icann.org/planning/consultation-stratplan-2008.htm, the gTLD Registry Constituency (RyC) of the Generic Names Support Organization submits these comments to ICANN as part of the Initial Consultation for the June 2008 - July 2011 Strategic Plan. The comments are provided following each of the four questions asked. 1. What are the major factors that will affect the DNS over the next three to five years? a. The introduction of new TLDs It is quite likely that the process for introducing new gTLDs will be implemented in 2008; that process will eventually, if not at the same time, include new IDN gTLDs. It can also be expected that IDN ccTLDs will be introduced in 2008 or shortly thereafter. It is reasonable to predict that both of these happenings will result in significant changes in the size of the root zone file and in the use of domain names globally. While this will result in better meeting the needs of non-English speakers around the world, care must be taken to ensure that security and stability of the DNS will not be harmed and that new TLDs are introduced in a controlled manner. First item mentioned in the registry constituency paper is introduction of new TLDs. How should ICANN configure itself to ensure the best implementation success? What is success? Timely, predictable, objectively measured process. Look at xxx: The process went on too long, and left many unhappy. There will be some profoundly offensive names applied for in the new gTLD process; there should be a quick process to reject these; for others, there should be an orderly and efficient process to get them into the root. One way ICANN could change is to staff the new gTLD process to the level necessary for success. ICANN policy can appear to be driven by parties with specific interests. The GNSO review should include a look at eliminating any influence of special interests. For example, see the very strong statement by business constituency that primarily looks at intellectual property. Cybersquatting concerns, which are of course valid, may be inappropriately dominating others, for example. It is important that narrow interests dont delay the rapid completion of the new gTLD process. There appears to be a convergence of new gTLDs proposal timing with the timing of IDN consideration. There is still a lot of work to do on IDNs and that it has to be done right. It may need to be done rapidly, but it must be done right. Preparation is important as well as setting appropriate expectations. Policy development of IDNs by the ccNSO should not delay the gTLD process. b. The growth in the frequency and sophistication of online cyber attacks ICANNs primary mission is to ensure the security and stability of the Internet infrastructure, a main component of which is the DNS. Malicious and unintended attacks on the DNS will continue to grow in number and complexity, affecting DNS and Internet service providers. ICANN should not engage in content control. For example, ICANN should not have a content-oriented role in spam control. Spam is becoming a menace, and there might be solutions to it as a technical issue. SSAC is on the right track in looking at spam. ICANN needs to encourage service providers to find a way to fend off phishing and other attacks. DNSSEC might also be a useful tool in the security arsenal. Registrars have been formed that are associated with a lot of registrations generating spam. Bad actor registrars dont respond to registry requests for information and action. ICANN could put registrar agreements in place that address these issues, i.e. put in place the right legal framework to restrict bad actor behavior by registrars. Over the next year, ICANN should make it a goal to enhance communication with the ISP community. Does ICANN have a way to notify ISPs of what is going on? Proactively engaging ISPs could be a way of ending problems quicker. Over the last few months there has been an apparent increase in undesirable behaviors by some registrars. For example, there appear to be entities that are, in effect, leasing ICANN accreditation. These types of practices make abuse simpler. There is real concern that the Internet community is approaching a breakdown in the email system with the high volume of fraudulent email. One aspect of fixing this problem might be for registries to share information with ICANN regarding abuses so that ICANN can be more proactive in finding solutions. 2. What are the major issues facing ICANN over the next three to five years? a. The uncontrolled spread of IDN.IDNs outside the root The internationalization of the DNS is proceeding at a pace that has outstripped ICANNs plans to deal with the issues raised by the use of IDNs. Throughout the world, domain names in the format IDN.IDN are being registered in ever-increasing numbers in a variety of scripts. These top-level domains are not in the ICANN administered root and are not presently globally operable. However, they are in such widespread use that they pose a risk to the fundamental concept that the Internet is and must continue to be globally interoperable. ICANN urgently needs a plan to ensure that the user demand for IDN.IDNs is met without fragmenting the Internet. The alternative is separate Internets, each in its own script. In effect, China has implemented what amounts to an alternate root. A commercial operator in Israel is specifically implementing an alternate root. The Arabic-speaking world is also moving in this same direction. There is a real sense of urgency to make progress towards an implementable IDN policy, and production IDN implementations. ICANNs current activities dont yet address the level of urgency. On the other hand, some view that implementing IDN policy correctly is the most important thing. A key gTLD registry concern is that cc registries are not advantaged in the IDN TLD process. The Arabic speaking community has recruited 22 ccs to participate in an IDN experiment. Magnitude of what they are doing is significant. Really extends beyond a test. This test effort may position this group to demand IDNs. Creating a script table for Arabic-script languages is important, and there is a political reality that key players such as Middle East Arabic-speaking states and Iran may take preemptive action. This is important for ICANN to resolve. b. The impact of the domain name secondary market The secondary market for Internet domain names has grown beyond anything envisioned by most people as recently as several years ago. There are new uses of domain names, new business models and new ways to work around ICANNs policies and procedures. As a result, domain names are increasingly unavailable for their originally intended uses. In addition, there are new concerns about cybersquatting and the protection of intellectual property rights. The secondary market has developed in a way that the DNS is being used in unforeseen ways.contrary to the best interest of the Internet users. Registries and registrars have a responsibility to be able to handle these problems. A key issue is the grace period. Use something like the PIR pricing to reduce improper registrations. c. The Whois situation - The Whois controversies have simply gone on too long. It should not have taken seven years to understand that there is no consensus on how to protect individual privacy. ICANN should adopt a plan looking forward to a compromise that maximizes protection of personal privacy while recognizing that there is a public interest in limited and controlled access to data by law enforcement and other qualified bodies. d. Continual improvement to policy development processes ICANN has taken important steps to refine its policy development processes, but it still has a long way to go. It is critical that the completed and pending Supporting Organization and Advisory Committee reviews be used to achieve improvements in this area. Commissioning reviews is inadequate if there are no meaningful changes. Also, change should be viewed as a continuum, not as a routine to be performed every few years. Note: Due to time constraints, the topics below were not discussed. 3. What are the most important issues for the ICANN community to discuss over the next three to five years? a. All of the above 1.a, 1.b, 2.a, 2.b, 2.c, 2.d. b. ICANNs mission versus community demands - How does ICANN maintain a balance between its limited mission and ongoing demands for involvement outside of that mission? There are security and stability issues posed by the unchecked growth of fraudulent activities such as phishing-pharming. ICANN should recognize that there may be areas where it can act within its mandate, and it should consider whether there are other venues where issues outside of ICANNs mandate can be handled (e.g., spam and consumer protection). 4. What should be ICANNs priorities for the next three years? a. Security and stability of the Internet should always be the #1 priority. b. Providing a ubiquitous IDN.IDN domain name experience for as many non-English speakers as possible should be a high priority. This should include both gTLD and ccTLD users, without favoring either group. ICANN should take steps to minimize name confusion and ensure that dispute resolution processes are as simple as possible. c. Significant improvements in policy development processes should be made in all ICANN supporting organizations and advisory committees separately and in their interaction with one another. __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

ISPCP Consultation on the ICANN Strategic Plan
by Danny Younger Oct. 18, 2007

Oct. 18, 2007

ISPCP comments to ICANN Strategic Plan Draft notes from conference call 19 September 2007, Olof Nordling ISPCP: Tony Holmes, Mark McFadden ICANN: Doug Brent, Kurt Pritz, Denise Michel, Olof Nordling Following an introduction by Doug on the planning process, aiming for a draft Strategic Plan for discussion in LA and adoption in December, and an introduction by Tony on the ISPCP internal consultations, the dialogue focused on the recently published Issues Document and with ISPCP comments as follows, in the order of the listed issues: 0. General 0.1 The issues captured are many and call for priority setting, both in order to appropriately concentrate the efforts and to deflect future potential criticism of ICANN for not achieving all goals. 0.2 The ISPCP suggests that the issues be divided into two groups, with internal and external focus, respectively, since the target audiences and resource requirements differ considerably between these two groups. (This approach proved helpful to the ISPCP itself when suggesting priorities) 0.3 Within these groups, the issues should be prioritized in the strategic plan and these priorities should be mirrored for the corresponding actions in the operating plan. 1. IDNs 1.1 This issue is to be considered external and has the potential to become one of the biggest successes of ICANN, both technically and politically. It should have the highest priority. 1.2 Visibility should be added on how issues will be addressed across both IDN gTLDs and ccTLDs. Outreach to application developers is highly recommended in order to avoid a recurrence of similar problems as when gTLD strings longer than three characters were introduced - when the ISPs had to deal with many complaints for malfunctions emanating from omissions by application providers. 2. New gTLDs 2.1 This issue is external (with a considerable internal component), with highest priority and deserves more than a couple of lines in the text, although it is recognized that the issue is inextricably linked with 1 above and that there is very much substance behind the summary lines. 2.2 When introducing new gTLDs, there will be a need to gradually build on experience and a constant review process should be highlighted here, as envisaged in the New gTLD implementation plan. Text from the PDP could well be used to bolster this section of the strategic plan on this and other aspects. 3. Security 3.1. ICANN has a primary role regarding security in infrastructure and this is to be considered as an internal issue of high priority. High priority should be given to formalizing the relationship with the root server operators and a security component should be a part of this. 3.2 Regarding DNSSEC, it is clear that the root zone should be signed, but this is rather an operational aspect. It is more important is to take a holistic perspective to infrastructure protection, where DNSSEC is just one tool. A roadmap mirroring such an approach could be introduced. 3.3 Security in the application layer, including child protection etc., is not a primary role for ICANN and this should be given low priority. However, further clarity on this is needed, for example in the operational plan, before ISPCP can give a final verdict. There may be justified cases, for example special treatment of IDN aspects in line with 1.3 above. 4. Capacity building 4.1 This is an external issue, where ICANN has a part to play, but not a leading role, and it should not be given top priority. ISPCP support for the approach will depend on how details are reflected in the operational plan. 5. IPv4 vs IPv6 5.1 This is an issue that should be commercially driven and where the locus of the policy discussions is with the RIRs, not with ICANN. ICANNs role is informational and operational, for IANA. Although this is not a strategic issue as such for ICANN, it deserves to be mentioned in the strategic plan, with a low priority. 6. Participation 6.1 The ISPCP is supportive of fellowship programs and similar approaches to facilitate participation, based on recent experiences. 6.2 ICANN regional meetings would easily lead to duplication of efforts and do not enjoy the ISPCPs support, unless performed in partnership with regional entities for building bridges to other stakeholders. The ICANN meeting schedule is heavy enough as it is and should not be expanded. 6.3 Participation is regarded as an internal issue and should be given medium priority, while excluding regional meetings, see 6.2. 7. Policy processes 7.1 This is considered an internal issue of high priority. Progress should be sought in an evolutionary way, rather than a revolutionary. This view applies to the GNSO improvement efforts as well as to the wider ICANN context. Broader involvement across SOs and ACs is desirable and developing, but it is uncertain whether the current structures for such involvement are the right ones. 8. Risk management 8.1 This is an internal issue of medium priority where it is recognized that ICANN has taken much appreciated strides recently. The focus should now be on building on the successes in that regard. 9. Accountability 9.1 This issue is of an internal nature and calls for careful priority setting. Focus should be on pursuing the issues identified by the Presidents Strategy Committee as requiring modifications of Bylaws or procedures. 10. Independence 10.1 This is an internal issue of medium importance, where the ISPCP supports ICANNs move towards independence while highlighting the need for having clear metrics for the steps forward. Reference is also made to the Presidents Strategy Committees good work on this topic. A vision of how to make measured progress in the JPA is desirable as a basis for continued community discussion. 10.2 The issue calls for skilful wording and handling when setting targets in the strategic and operational plan. It should be noted that the heat on this issue can be reduced as a direct consequence of ICANN progress on other issues with high priority. Concluding words The call concluded with some further thoughts on the external/internal division, agreements on immediate steps and invitations to continued mutual consultations. __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0