May 2008 - At-Large - lists.icann.org

Re: [At-Large] SSAC - May teleconference Notes
by Jeffrey A. Williams May 14, 2008

May 14, 2008

Robert and all, This is by no means a new or "Emerging" security issue as it has been going on for nearly a decade now. However I am sure it may be a new issue or an "Emerging" security problem to the SSAC. But given that only very recently ICANN.ORG DNS was cleaned up and is no longer a spam machine, I am not all that surprised that this issue is only now becoming recognized to ICANN and the SSAC. I must however admit that I am surprised the Wired is so far behind the security curve... -----Original Message----- >From: Robert Guerra <lists(a)privaterra.info> >Sent: May 13, 2008 9:14 AM >To: At-Large Worldwide <alac(a)atlarge-lists.icann.org> >Subject: [At-Large] SSAC - May teleconference Notes > >Dear colleagues: > > >SSAC's May teleconference featured an invited guest - Dan Kaminsky - >who presented a 1hr presentation on his recent report that ISPs' Error >Page Ads Let Hackers Hijack Entire Web. (see article @ wired magazine >below) > >The issue - there is a growing trend in which ISPs subvert the DNS , >primarily non existent subdomains - for their own commercial purposes. >The subversion, ISP injection - known as son of sitefinder by some - >is problematic as it introduces many security issues - such as cross >scripting vulnerabilities. A discussion - a Q&A followed between SSAC >members and Dan. > >In terms of ALAC, let me recommend that we cooperate with SSAC on this >emerging security issue that affects users everywhere. > >regards > >Robert >--- > > >http://blog.wired.com/27bstroke6/2008/04/isps-error-page.html > >ISPs' Error Page Ads Let Hackers Hijack Entire Web, Researcher Discloses > >Seeking to make money from mistyped website names, some of the United >States' largest ISPs instead created a massive security hole that >allowed hackers to use web addresses owned by eBay, PayPal, Google and >Yahoo, and virtually any other large site. > >The vulnerability was a dream scenario for phishers and cyber >attackers looking for convincing platforms to distribute fake websites >or malicious code. > >The hole was quickly and quietly patched Friday after IOActive >security researcher Dan Kaminsky reported the issue to Earthlink and >its technology partner, a British ad company called Barefruit. >Earthlink users, and some Comcast subscribers, were at risk. > >Kaminsky warns that the underlying danger lingers on. > >"The entire security of the internet is now dependent on some random >ad server run by some British company," Kaminsky said. > >At issue is a growing trend in which ISPs subvert the Domain Name >System, or DNS, which translates website names into numeric addresses. > >When users visit a website like Wired.com, the DNS system maps the >domain name into an IP address such as 72.246.49.48. But if a >particular site does not exist, the DNS server tells the browser that >there's no such listing and a simple error message should be displayed. > >But starting in August 2006, Earthlink instead intercepts that Non- >Existent Domain (NXDOMAIN) response and sends the IP address of ad- >partner Barefruit's server as the answer. When the browser visits that >page, the user sees a list of suggestions for what site the user might >have actually wanted, along with a search box and Yahoo ads. > >The rub comes when a user is asking for a nonexistent subdomain of a >real website, such as http://webmale.google.com, where the subdomain >webmale doesn't exist (unlike, say, mail in mail.google.com) In this >case, the Earthlink/Barefruit ads appear in the browser, while the >title bar suggests that it's the official Google site. > >As a result, all those subdomains are only as secure as Barefruit's >servers, which turned out to be not very secure at all. Barefruit >neglected basic web programming techniques, making its servers >vulnerable to a malicious JavaScript attack. That meant hackers could >have crafted special links to unused subdomains of legitimate websites >that, when visited, would serve any content the attacker wanted. > >The hacker could, for example, send spam e-mails to Earthlink >subscribers with a link to a webpage on money.paypal.com. Visiting >that link would take the victim to the hacker's site, and it would >look as though they were on a real PayPal page. > >Kaminsky demonstrated the vulnerability by finding a way to insert a >YouTube video from 80s pop star Rick Astley into Facebook and PayPal >domains. But a black hat hacker could instead embed a password- >stealing Trojan. The attack might also allow hackers to pretend to be >a logged-in user, or to send e-mails and add friends to a Facebook >account. > >Earthlink isn't alone in substituting ad pages for error messages, >according to Kaminsky, who has seen similar behavior from other major >ISPs including Verizon, Time Warner, Comcast and Qwest. Earlier this >month, Network Solutions, one of the net's largest domain name >registrars, was caught creating link farms on nonexistent subdomains >of websites owned by its own customers. > >DNS expert Paul Vixie, who is the president of the nonprofit Internet >Systems Consortium, says the problem Kaminisky found isn't with the >core internet protocols, which he could fix, but instead is a "problem >exacerbated by inappropriate monetization of certain DNS features." > >Vixie compared this ISP behavior to Verisign's 2003 Site Finder >project, which it unilaterally launched in September 2003 and then >shut down a month later. > >In that case, VeriSign, which controls the sales of .com and .net top- >level domains through a contract with the U.S. government, began >directing users who mistyped domains names to its own servers, where >it presented paid search results. > >The move outraged the technical community and eventually led to an >ICANN commission report (.pdf) condemning the practice and an >unsuccessful VeriSign lawsuit against ICANN. > >"Sitefinder showed that [Non-Existent] domain re-mapping is bad for >the community," Vixie said. "This would be an example of why it is bad." > >While Barefruit fixed the immediate JavaScript hole, the underlying >problem -- that large ISPs are ignoring a core internet practice to >make money and pretending to be sites that don't exist -- means every >site on the net remains vulnerable in ways they have no control over, >according to Kaminsky. >Inject_facebook_pre >Kaminsky said he'd talked this week to many internet companies who >were pissed, though not at him. > >"I can't secure the web as long as ISPs are injecting other content >into web pages," he said. > >The hole shows the risks of allowing ISPs to violate Net Neutrality >principles that seek to keep the internet a series of dumb pipes, >according to Kaminsky. > >"There's no contractual obligation for ISPs not to change content and >inject ads," Kaminsky notes. > >For its part, Earthlink says the Barefruit ad pages are useful to users. > >"We offer DNS error functionality for our customers through Barefruit >to enhance our users' experience, and we work closely with Barefruit >to provide a safe and convenient way for them to find the destination >they're looking for online," Earthlink spokesman Chris Marshall said >via e-mail. "We believe that the service provides a positive >experience for our Internet users."Inject_facebook_post > >Barefruit echoes the sentiment. > >"Barefruit endeavors to ensure online security while providing an >improved internet user interface by replacing unhelpful and confusing >error messages with alternatives relevant to what the user was >seeking," Barefruit's Dave Roberts said via e-mail. > >For Vixie, however, the issue is simple. > >"I really feel if someone goes to a website that does not exist, they >ought to see an error message," Vixie said. > >Earthlink customers who do not wish to use the service can instead use >different Earthlink DNS servers. Anyone can also use OpenDNS, a start- >up that also provides ad pages on domains that don't resolve, but does >so without pretending to be the other site. > >The news of the massive security breach by compromising net neutrality >for profit comes just two days after the Federal Communication >Commission held a hand-wringing public forum at Stanford University >over whether it should punish Comcast for its violation of standard >internet practices. The broadband provider was caught sending fake >packets to its users in order to reduce the bandwidth consumed by peer- >to-peer applications. > >Kaminsky is demoing the hole publicly on Saturday at the Toorcon >security conference in Seattle. > >Kaminsky, a well-respected security expert, is perhaps best known for >cleverly proving that a spyware rootkit Sony included on music CDs >infected computers in more than half a million computer networks in >2005. > >_______________________________________________ >ALAC mailing list >ALAC(a)atlarge-lists.icann.org >http://atlarge-lists.icann.org/mailman/listinfo/alac_atlarge-lists.icann.org > >At-Large Official Site: http://atlarge.icann.org Regards, Spokesman for INEGroup LLA. - (Over 281k members/stakeholders strong!) "Obedience of the law is the greatest freedom" - Abraham Lincoln "Credit should go with the performance of duty and not with what is very often the accident of glory" - Theodore Roosevelt "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== Updated 1/26/04 CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of Information Network Eng. INEG. INC. ABA member in good standing member ID 01257402 E-Mail jwkckid1(a)ix.netcom.com My Phone: 214-244-4827

1 0

April SSAC meeting - short summary
by Robert Guerra May 13, 2008

May 13, 2008

As posted @ April ALAC skype channel... April 8 - 10:58 AM (Toronto time) let me share some comments from the ssac call - there are IDN issues related to whois. not only in contact info, but idn info in name server info. hard to comment, as no clear definition of exact purpose of whois. SSAC will develop a issues report draft, to be circulated in SSAC, and then out to the larger community next SSAC meeting scheduled for May 13, 11:30 NY Time. regards Robert

2 1

Re: [At-Large] House Leaders Urge Preservation Of ICANN Role (US)
by Dessi Pefeva May 13, 2008

May 13, 2008

Dear Robert and all, I have been following the ALAC activities from the Easteuropean perspective for quite a while, and here are some remarks on your mail and on Milton Mueller's posting. I have to tell you that you may find my language quite strong, but it is only because I've been following the discussion on the web, and we have had similar discussions during the IGF and the ICANN meetings I attended. And it seems all the discussions are falling into the same routine, usually driven by people from the USA. > That being said, I do have an issue with the congressional statement > as it seemed to indicate that ICANN was supportive of freedom of > expression. I would disagree, as board and GNSO decisions seem to more > limit speech then anything else. Triple X being one example , wanting > to censor IDN domain names another.. I would disagree with you here, as the spirit in which we work is everything else, but mainly freedom of expression. All items discussed are on mailing lists, in scripts, web-casted, recorded. I doubt the US Congress is so open, as ICANN is. The Bulgarian Parliament is not so open, as we are. At the EURALO we discuss every item, we argue, we exchange e-mails, and no one so far has asked me to not say something. > The U.S. Congress and "free speech principles on the Internet" [cough] I understand the irony that an American is not happy with the free speech principles on the Internet, as it is widely known the Americans are very good in criticizing their own country - probably because they enjoy the very free speech principles Mr. Mueller is complaining about. For what is worth, in Bulgaria we don't have that many freedoms of access to information and freedom of expression as you do, in the US. And we are a member of the European Union, but some habits die hard. > expression be written into ICANN's constitution. The most recent > reiteration of this call came in 2006, from the Internet Governance > Project during a review of ICANN's status. It is interesting that Mr. Mueller is using his own blog and such an important issue to only promote his own project. > In each case, Commerce has > either ignored or in some cases explicitly rebuffed these calls for > recognition of free speech as a part of ICANN's mandate. Perhaps here one may ask whether this fact is not evidence that the position, expressed, have not deserved being ignored. > Those prohibitions would be unconstitutional in the U.S. Perhaps it is good to note that ICANN is not founded for the sake of following the US Constitution, but actually to serve the whole Internet community. That, we have to remind Mr. Mueller and other Americans on this list, means the US has been in the minority for long time now, as the number of users world-wide long time ago is more than the number of users in the USA. If we are all to follow the US Constitution, perhaps we should be allowed to carry guns at the IGF and shoot each one in self-defense? > groups seeking to prevent the world from recognizing the existence of > adult content on the Internet, If I remember correctly ICANN was and is not in the business of recognizing existence of content - be that adult or not. We have had discussions at ISOC-Bulgaria, and on different issues around the Internet, and we have reached to a conclusion that sometimes the biggest enemies of the freedoms on the Internet are the... Americans themselves. I don't mean ALL Americans, but certainly there are people who, under the 1st Ammendment protection are causing more problems for the global Internet community, than any other countries could do, even if they wanted to. Just one more observations, related to some of the other statements I've read, and this is a position we share at ISOC-Bulgaria, too: the IGF is not a decision-body. It is a FORUM, and as such provides space for discussions. But to claim it is the alternative of ICANN means lack of knowledge of the outcome of the WSIS. We at ISOC-Bulgaria have quite a good experience in dealing with the issues around Internet governance. We want to engage in a discussion which is substentitive, and not including self-promotion materials and views. And, hopefully, including more opinions from OUTSIDE of the United States. Kind regards, Dessi Pefeva ISOC - Bulgaria > From: *Robert Guerra* <lists(a)privaterra.info > <mailto:lists@privaterra.info>> > Date: Mon, May 12, 2008 at 10:55 AM > Subject: Re: [At-Large] House Leaders Urge Preservation Of ICANN Role (US) > To: At-Large Worldwide <alac(a)atlarge-lists.icann.org > <mailto:alac@atlarge-lists.icann.org>> > > > That congress and/or USG will give up their control (albeit indirect) > of ICANN - indeed, is something I don't think we'll see unless there > is a significant shift in US cybersecurity policy. Don't think that > will change under a new US administration .. > > That being said, I do have an issue with the congressional statement > as it seemed to indicate that ICANN was supportive of freedom of > expression. I would disagree, as board and GNSO decisions seem to more > limit speech then anything else. Triple X being one example , wanting > to censor IDN domain names another.. > > What do ALS's and ALAC members think about this? As for others, > Milton Mueller (from NCUC) has posted a new blog entry the topic. You > can find it @ the URL below. > > regards > > Robert > --- > > http://blog.internetgovernance.org/blog/_archives/2008/5/11/3685901.html > > The U.S. Congress and "free speech principles on the Internet" [cough] > > > A subcommittee of the U.S. Congress on Telecommunications and the > Internet has expressed opposition to any move by the Commerce > Department to alter its unilateral oversight of ICANN. The letter > comes in response to growing lobbying, from ICANN and others, > regarding the future of Commerce oversight and ICANN's independence. > Representative Edward J. Markey, the supposedly liberal Democrat from > Massachusetts who chairs the Subcommittee, was joined by rightwing > conservative Charles Pickering and 14 other members of the committee > in the May 6 statement. The members expressed their opposition to "any > change that threatens the important U.S. role in promoting U.S. > commercial and free speech principles on the Internet," and implied > that free speech principles would be threatened if NTIA "abandoned" > its role "now or in the near future." > > The subcommittee members who drafted and signed this statement are > badly misinformed -- about ICANN, freedom of expression, NTIA > oversight, and global Internet governance. These issues are far too > important to be left to political posturing, so we attempt here to set > the record straight. > > It is important for U.S. policy makers to let go of the idea that U.S. > oversight has anything to do with preserving and protecting freedom of > expression on the Internet. Commerce has since 1997 repeatedly refused > to incorporate freedom of expression as a principle guiding the ICANN > regime, despite numerous calls for it to do so in public comment > sessions. The earliest of these calls came in 1997, during the > drafting of the Green Paper leading to ICANN's creation, when the > principles guiding the regime were first being formulated. EFF, the > Domain Name Rights Coalition and many individuals asked that free > expression be written into ICANN's constitution. The most recent > reiteration of this call came in 2006, from the Internet Governance > Project during a review of ICANN's status. In each case, Commerce has > either ignored or in some cases explicitly rebuffed these calls for > recognition of free speech as a part of ICANN's mandate. > > And so the concept of freedom of expression is conspicuously absent > from any of the Memoranda of Understanding, contracts, or agreements > that make up the ICANN regime. Commerce has urged ICANN to do many > things -- protect trademarks, override privacy concerns to provide open > access to domain name registrants' personal identification data, and > promote competition -- but it has never once urged it to respect, or > even pay attention to, freedom of expression. > > But Commerce is guilty of more than crimes of omission. The > Department's role in ICANN's oversight has in at least two cases been > actively inimical to freedom of expression. In the latest round of > policy formation for new top level domains, the U.S. Commerce > Department has found itself on the same side as authoritarian > governments in supporting severe regulation of words or concepts that > can be used as top level domain names. The "Public Policy Principles" > for new top level domains developed by ICANN's Government Advisory > Committee (GAC) has insisted that new gTLDs give governments a blank > check to control and veto the use of any country, territory, or place > names," and any "terms with national, cultural, geographic and > religious significance." Those prohibitions would be unconstitutional > in the U.S. Yet, following GAC's lead, ICANN's policies go even > further and give the new TLD process the power to censor all new TLD > proposals to make sure that they don't contain "insensitive" or > "offensive" words or violate "standards of morality and public order." > Indeed, in an earlier incarnation the GAC policy principles would have > allowed any government in the world to veto a new TLD proposal for any > reason. The U.S. delegation did not object to these proposals. And > have we forgotten that in 2004-5, under pressure from conservative > groups seeking to prevent the world from recognizing the existence of > adult content on the Internet, the Commerce Department used its > authority over ICANN to reverse an ICANN decision to create a .xxx top > level domain to identify such content. Where, oh Congresspersons, are > those "free speech principles" you are seeking to protect by > perpetuating U.S. oversight of ICANN? > > The U.S. Commerce Department is the home of the Patent and Trademark > Office, which administers and promotes intellectual property. It works > closely with trade policy officials to promote American products and > services and to extend copyright and patent protection globally. It > deals with spectrum allocation for the federal government. It has no > interest in freedom of expression. Commerce, like all U.S. agencies, > is subject to the First Amendment and other constitutional > constraints. But the ICANN regime can be considered a form of policy > laundering designed to minimize or short-circuit those constraints. By > delegating Internet resource assignment and policy functions to a > private corporation, the applicability of First Amendment constraints > to ICANN is by no means clear. Whether an ICANN action that censors > expression constitutes private action or state action is murky, and > has not been tested in any court. If they truly are concerned about > these issues, why aren't these Congresspeople calling for NTIA to > affirm its commitment to free speech principles? > > The Markey statement is disappointing in its attempt to exploit > nationalist sentiment, for example its professed shock at the idea > that ICANN might move its headquarters to some other country. It is > easy to pretend as if the threat to Internet freedom comes from > "foreigners." But what if the real threat comes from within? An honest > elected representative would recognize at least the possibility of that. > > Whatever motivated this statement, it almost certainly was not freedom > of expression. And that is what is most damnable about it. > Subcommittee members should show more respect for the U.S. > Constitution they are sworn to uphold, and refrain from using freedom > of expression as a cover for less lofty political and economic > concerns. One can only wonder which business interest lobbyists made > the investments in legwork and dollars required to get this statement. > Was it the trademark and copyright interests worried that a liberated > ICANN might make some concession to privacy in Whois? Or registrars > steamed over VeriSign's bargain with ICANN over the regulation > of .com? Shadowy national security interests? It could be any one of > these or any combination. But it wasn't anyone concerned about freedom > of expression. > > In an interesting development, Markey's letter tries to force the hand > of Commerce. It asks the Commerce Department to respond to the > following questions by the close of business two weeks from May 6: > > "1. Does the Department of Commerce intend to continue its oversight > role of ICANN to ensure the stability and security of the core > Internet infrastructure? > 2. In what way does the Department intend to continue that role? > 3. Does the Department intend to ensure that the key facilities of the > root server system continue to be housed in the United States? > 4. The Chairman of ICANN said in February 2008, at the Department's > public meeting, "Among the respondents there were concerns expressed > that ICANN will leave the United States and seek broad immunities from > legal process by third parties or contracting parties. Let me be loud > and clear on this. That will not happen. The U.S. for historic and > practical reasons will remain ICANN's headquarters." How does the > Department intend to ensure that ICANN fulfills this commitment? " > > From a Democratic Party point of view, this attempt to force Commerce > to declare now whether it will make some change in its oversight > arrangements is a really stupid thing to do. It invites one of the > most conservative, unilateralist and internationally disrespected > Republican administrations in U.S. history to make a commitment that > will extend well into the administration of the next President. > Posted to: > > > _______________________________________________ > ALAC mailing list > ALAC(a)atlarge-lists.icann.org <mailto:ALAC@atlarge-lists.icann.org> > http://atlarge-lists.icann.org/mailman/listinfo/alac_atlarge-lists.icann.org > > At-Large Official Site: http://atlarge.icann.org

1 0

SSAC - May teleconference Notes
by Robert Guerra May 13, 2008

May 13, 2008

Dear colleagues: SSAC's May teleconference featured an invited guest - Dan Kaminsky - who presented a 1hr presentation on his recent report that ISPs' Error Page Ads Let Hackers Hijack Entire Web. (see article @ wired magazine below) The issue - there is a growing trend in which ISPs subvert the DNS , primarily non existent subdomains - for their own commercial purposes. The subversion, ISP injection - known as son of sitefinder by some - is problematic as it introduces many security issues - such as cross scripting vulnerabilities. A discussion - a Q&A followed between SSAC members and Dan. In terms of ALAC, let me recommend that we cooperate with SSAC on this emerging security issue that affects users everywhere. regards Robert --- http://blog.wired.com/27bstroke6/2008/04/isps-error-page.html ISPs' Error Page Ads Let Hackers Hijack Entire Web, Researcher Discloses Seeking to make money from mistyped website names, some of the United States' largest ISPs instead created a massive security hole that allowed hackers to use web addresses owned by eBay, PayPal, Google and Yahoo, and virtually any other large site. The vulnerability was a dream scenario for phishers and cyber attackers looking for convincing platforms to distribute fake websites or malicious code. The hole was quickly and quietly patched Friday after IOActive security researcher Dan Kaminsky reported the issue to Earthlink and its technology partner, a British ad company called Barefruit. Earthlink users, and some Comcast subscribers, were at risk. Kaminsky warns that the underlying danger lingers on. "The entire security of the internet is now dependent on some random ad server run by some British company," Kaminsky said. At issue is a growing trend in which ISPs subvert the Domain Name System, or DNS, which translates website names into numeric addresses. When users visit a website like Wired.com, the DNS system maps the domain name into an IP address such as 72.246.49.48. But if a particular site does not exist, the DNS server tells the browser that there's no such listing and a simple error message should be displayed. But starting in August 2006, Earthlink instead intercepts that Non- Existent Domain (NXDOMAIN) response and sends the IP address of ad- partner Barefruit's server as the answer. When the browser visits that page, the user sees a list of suggestions for what site the user might have actually wanted, along with a search box and Yahoo ads. The rub comes when a user is asking for a nonexistent subdomain of a real website, such as http://webmale.google.com, where the subdomain webmale doesn't exist (unlike, say, mail in mail.google.com) In this case, the Earthlink/Barefruit ads appear in the browser, while the title bar suggests that it's the official Google site. As a result, all those subdomains are only as secure as Barefruit's servers, which turned out to be not very secure at all. Barefruit neglected basic web programming techniques, making its servers vulnerable to a malicious JavaScript attack. That meant hackers could have crafted special links to unused subdomains of legitimate websites that, when visited, would serve any content the attacker wanted. The hacker could, for example, send spam e-mails to Earthlink subscribers with a link to a webpage on money.paypal.com. Visiting that link would take the victim to the hacker's site, and it would look as though they were on a real PayPal page. Kaminsky demonstrated the vulnerability by finding a way to insert a YouTube video from 80s pop star Rick Astley into Facebook and PayPal domains. But a black hat hacker could instead embed a password- stealing Trojan. The attack might also allow hackers to pretend to be a logged-in user, or to send e-mails and add friends to a Facebook account. Earthlink isn't alone in substituting ad pages for error messages, according to Kaminsky, who has seen similar behavior from other major ISPs including Verizon, Time Warner, Comcast and Qwest. Earlier this month, Network Solutions, one of the net's largest domain name registrars, was caught creating link farms on nonexistent subdomains of websites owned by its own customers. DNS expert Paul Vixie, who is the president of the nonprofit Internet Systems Consortium, says the problem Kaminisky found isn't with the core internet protocols, which he could fix, but instead is a "problem exacerbated by inappropriate monetization of certain DNS features." Vixie compared this ISP behavior to Verisign's 2003 Site Finder project, which it unilaterally launched in September 2003 and then shut down a month later. In that case, VeriSign, which controls the sales of .com and .net top- level domains through a contract with the U.S. government, began directing users who mistyped domains names to its own servers, where it presented paid search results. The move outraged the technical community and eventually led to an ICANN commission report (.pdf) condemning the practice and an unsuccessful VeriSign lawsuit against ICANN. "Sitefinder showed that [Non-Existent] domain re-mapping is bad for the community," Vixie said. "This would be an example of why it is bad." While Barefruit fixed the immediate JavaScript hole, the underlying problem -- that large ISPs are ignoring a core internet practice to make money and pretending to be sites that don't exist -- means every site on the net remains vulnerable in ways they have no control over, according to Kaminsky. Inject_facebook_pre Kaminsky said he'd talked this week to many internet companies who were pissed, though not at him. "I can't secure the web as long as ISPs are injecting other content into web pages," he said. The hole shows the risks of allowing ISPs to violate Net Neutrality principles that seek to keep the internet a series of dumb pipes, according to Kaminsky. "There's no contractual obligation for ISPs not to change content and inject ads," Kaminsky notes. For its part, Earthlink says the Barefruit ad pages are useful to users. "We offer DNS error functionality for our customers through Barefruit to enhance our users' experience, and we work closely with Barefruit to provide a safe and convenient way for them to find the destination they're looking for online," Earthlink spokesman Chris Marshall said via e-mail. "We believe that the service provides a positive experience for our Internet users."Inject_facebook_post Barefruit echoes the sentiment. "Barefruit endeavors to ensure online security while providing an improved internet user interface by replacing unhelpful and confusing error messages with alternatives relevant to what the user was seeking," Barefruit's Dave Roberts said via e-mail. For Vixie, however, the issue is simple. "I really feel if someone goes to a website that does not exist, they ought to see an error message," Vixie said. Earthlink customers who do not wish to use the service can instead use different Earthlink DNS servers. Anyone can also use OpenDNS, a start- up that also provides ad pages on domains that don't resolve, but does so without pretending to be the other site. The news of the massive security breach by compromising net neutrality for profit comes just two days after the Federal Communication Commission held a hand-wringing public forum at Stanford University over whether it should punish Comcast for its violation of standard internet practices. The broadband provider was caught sending fake packets to its users in order to reduce the bandwidth consumed by peer- to-peer applications. Kaminsky is demoing the hole publicly on Saturday at the Toorcon security conference in Seattle. Kaminsky, a well-respected security expert, is perhaps best known for cleverly proving that a spyware rootkit Sony included on music CDs infected computers in more than half a million computer networks in 2005.

1 0

Re: [At-Large] Middle East & North Africa Outreach
by Jeffrey A. Williams May 13, 2008

May 13, 2008

Robert and all, Thank you Robert for you kind offer. There are to our knowledge no REAL internet governance experts that are natives to the region to which you refer. There are however a significant number of phishers, spammers, and hackers associated with several terrorist organizations that may claim to be internet governance experts that are indiginious to the region of which you speak. I don't believe these folks would be very helpful, but would be of interest to the relevant LEA's seeking at this time to bring these individuals into a, shall we say a "More controled enviroment". -----Original Message----- >From: Robert Guerra <lists(a)privaterra.info> >Sent: May 12, 2008 9:31 AM >To: At-Large Worldwide <alac(a)atlarge-lists.icann.org> >Subject: [At-Large] Middle East & North Africa Outreach > > >Looking ahead towards the fall ICANN meeting in Egypt - I would like >to know if any outreach is being planned or envisioned to internet >users in the middle-east and north africa. > >If not, suffice it to say that I am in touch with a rather extensive >network of internet governance experts, internet users - bloggers and >internet saavy organizations in the region that could be interested in >attending the meeting and engaging us. > >regards, > >Robert >--- >Robert Guerra <rguerra(a)privaterra.org> >Managing Director, Privaterra >Tel +1 416 893 0377 > > > > > >_______________________________________________ >ALAC mailing list >ALAC(a)atlarge-lists.icann.org >http://atlarge-lists.icann.org/mailman/listinfo/alac_atlarge-lists.icann.org > >At-Large Official Site: http://atlarge.icann.org Regards, Spokesman for INEGroup LLA. - (Over 281k members/stakeholders strong!) "Obedience of the law is the greatest freedom" - Abraham Lincoln "Credit should go with the performance of duty and not with what is very often the accident of glory" - Theodore Roosevelt "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== Updated 1/26/04 CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of Information Network Eng. INEG. INC. ABA member in good standing member ID 01257402 E-Mail jwkckid1(a)ix.netcom.com My Phone: 214-244-4827

3 3

Re: [At-Large] Recent GNSO actions
by Jeffrey A. Williams May 13, 2008

May 13, 2008

Alan and all, Well so again the GNSO punted! How typical, how utterly sad, and a demonstration of unable to either make a difinitive decision in a timely manner or so out of touch with the relevant issues that their leadership acumen is grossly in question... But, thank you Alan for passing this predictable information along anyway. -----Original Message----- >From: Alan Greenberg <alan.greenberg(a)mcgill.ca> >Sent: May 12, 2008 8:04 PM >To: At-Large <alac(a)atlarge-lists.icann.org> >Cc: alac-internal <alac-admin(a)icann.org> >Subject: [At-Large] Recent GNSO actions > >There was a GNSO meeting on May 8, with several substantive actions, >some of which could require ALAC involvement. > > >FRONT RUNNING > >You will recall that Danny Younger drafted a letter to the Board >requesting that the Board take immediate action regarding Front >Running - the practice of learning that someone is thinking about >registering a domain name and then registering it first. The >information could be the result of a registrar being asked if a name >is available and then being registered by that registrar, or by other >more circuitous or nefarious means. Following drafting of the letter, >and prior to its being forwarded to the Board, it was supported by >the NARALO and then the ALAC. > >The Board effectively decided that the issue did not require their >immediate action and requested that the GNSO investigate and take >appropriate action. > >The GNSO Council decided that more information was needed to >delineate the problem, understand whether there are existing rules >that can be used to curb the practice, and understand what effect the >recent Domain Tasting recommendation would have on the practice (by >restricting the used of the AGP, it may effectively stop this purely >speculative registration of domains). At the same time, there was a >strong feeling that the issue should not be ignored or postponed indefinitely. > >The following motion was passed by Council: > >>Motion 1 Front Running >>====================== >> >>Create a drafting team to look at questions such as: >> - How is the problem defined? >> - How prevalent is the problem? >> - Will the measures relating to domain tasting affect front running? >> - Are there rules within the RAA that can be used? >> >>The goal is to bring a recommendation to the Council on whether to >>request an Issues Report or more extensive research effort and to >>define the terms of the report. >> >>This team should bring its report in time for deliberations in Paris >>by 7 June 2008 or sooner if possible. >> >>Team is open to constituency members. Liaisons are invited to participate >> >>The motion carried unanimously by voice vote. > >I presume that the work will be primarily e-mail, although there may >be some conference calls. I will be happy to work with the drafting >team on this, but I will be somewhat unavailable for conference calls >after May 29th. If anyone else has a strong interest and knowledge of >this, I would be happy to suggest to the GNSO that this person >augment or replace me. > > > >FAST FLUX > >Fast Flux is a process whereby the DNS entry for a domain name is >changed at a very high rate. Typically this is used by phishers to >make it virtually impossible for a deceptive web site to be taken >down, because there are in fact many such sites, making take-down >actions very difficult or impossible. > >The SSAC issued a report on Fast Flux in January 2008. It identified >a number of actions that might help reduce the practice. These >actions included some that might be within the scope of GNSO policy >(and others that were not). The GNSO requested an Issues Report from >staff in March (an Issues Report is the first step in the ICANN >By-Law mandated GNSO policy development process). > >There was a feeling on Council that this issue should be addressed >with some urgency, but some councillors were a bit worried that the >issues report (in line with the SSAC Advisory Report) did not clearly >identify what actions were within GNSO scope, and that this >differentiation should be done prior to starting a Policy Development >Process (PDP). Ultimately the following motion was made and passed, >which incorporated the identification of within-scope issues as its >first stage. > >>Motion 2 Fast Flux >>================== >> >>Whereas, "fast flux" DNS changes are increasingly being used to >>commit crime and frustrate law enforcement efforts to combat crime, >>with criminals rapidly modifying IP addresses and/or nameservers in >>effort to evade detection and shutdown of their criminal website; >> >>Whereas, the Security and Stability Advisory Committee has reported >>on this trend in its Advisory SAC 025, dated January 2008: >>http://www.icann.org/committees/security/sac025.pdf/ >> >>Whereas, the SSAC Advisory describes the technical aspects of fast >>flux hosting, explains how DNS is being exploited to abet criminal >>activities, discusses current and possible methods of mitigating >>this activity, and recommends that appropriate bodies consider >>policies that would make practical mitigation methods universally >>available to all registrants, ISPs, registrars and registries, >> >>Whereas, the GNSO resolved on March 6, 2008 to request an Issues >>Report from ICANN Staff, to consider the SAC Advisory and outline >>potential next steps for GNSO policy development designed to >>mitigate the current ability for criminals to exploit the NS via >>"fast flux" IP and/or nameserver changes; >> >>Whereas, the ICANN Staff has prepared an Issues Report dated March >>25, 2008, >>http://gnso.icann.org/issues/fast-flux-hosting/gnso-issues-report-fast-flux…, >>recommending that the GNSO sponsor additional fact-finding and >>research to develop best practices guidelines concerning fast flux >>`hosting, and to provide data to assist policy development and >>illuminate potential policy options.; >> >>Whereas, ICANN should consider whether and how it might encourage >>registry operators and registrars to take steps that would help to >>reduce the damage done by cybercriminals, by curtailing the >>effectiveness of these fast flux hosting exploits. > >>The GNSO Council RESOLVES: >> >>To initiate a Policy Development Process uniquely on the issues >>deemed in scope in the Issues report. >> >>Motion carried with 8 votes in favour out of 20 votes present, >>exceeding the Bylaws minimum threshold of 'more than 33% of the >>Council members present' (Bylaws, AnnexA, Section 3.c)" >> >>8 votes in favour: >>Philip Sheppard, Bilal Beiram, Mike Rodenbaugh, Ute Decker, Kristina >>Rosette, Tony Holmes, Tony Harris, Avri Doria (one vote each) >> >>12 votes against: >>Robin Gross, Norbert Klein, Carlos Souza, Olga Cavalli (one vote each) >>Tim Ruiz, Jordi Iparraguirre, Edmon Chung, Chuck Gomes, >>Greg Ruth, Adrian Kinderis dropped off call at the time of the vote. >> >>Absent: Cyril Chua, Tom Keller, Jon Bing > >Following this, the GNSO needed to decide which of the By-Law >mandated mechanisms to use to address the PDP. The first motion was >to create a Task Force. This motion failed (presumably not because >the issue was unimportant, but rather because the structure of a >formal Task Force was too limiting). > >Vote summary: >-8 votes in favour: Philip Sheppard, Mike Rodenbaugh, Ute Decker, >Kristina Rosette, Tony Holmes, Tony Harris, Greg Ruth, Avri Doria >(one vote each) >-12 votes against: Robin Gross, Norbert Klein, Carlos Souza, Olga >Cavalli (one vote each), Tim Ruiz, Jordi Iparraguirre, Edmon Chung, >Chuck Gomes (two votes each) >-Bilal Beiram, dropped off at time of vote >-Absent: Tom Keller (two votes) Cyril Chua, Jon Bing (one vote each) > >In its place, a working group will be formed. > > >>Motion 3 >>=========== >> >>Whereas the motion to initiate a Task Force Failed >> >>Resolved the Council will create a working group to fulfill the >>requirement of the PDP. A charter for that working group will be >>presented to the council by 22 May 2008 for approval at the 29 May >>2008 meeting. The schedule for the constituency reports and the >>public comment will be included in that charter. > >Although not a formal constituency, presumably the ALAC will be able >to submit a Constituency Report if we desire, and to participate in >this working group. If we plan to do this, we should start sooner >rather than later. > >INTER-REGISTRAR TRANSFER POLICY > >The Inter-Registrar Transfer Policy (IRTP) is an existing consensus >policy under review by the GNSO. A working group looked at the policy >last year, and identified a number of ways that the policy could be >improved. One of the ones deemed most important was related to the >reasons for denial or transfer, and there is an ongoing PDP >addressing this. The remaining issues were prioritized. It was felt >that to attempt to address all of the issues in a single PDP would be >to large (and too long) and effort, and would put too much work on a >single group. > >Accordingly it was decided to break the issues in to six groups and >address them in five manageably-sized PDPs (and take no immediate >action on those in the sixth group). > >The full motion is attached (it includes a table that would not be >handled well by e-mail). The motion passed unanimously. > >Alan Regretful Regards, Spokesman for INEGroup LLA. - (Over 281k members/stakeholders strong!) "Obedience of the law is the greatest freedom" - Abraham Lincoln "Credit should go with the performance of duty and not with what is very often the accident of glory" - Theodore Roosevelt "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== Updated 1/26/04 CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of Information Network Eng. INEG. INC. ABA member in good standing member ID 01257402 E-Mail jwkckid1(a)ix.netcom.com My Phone: 214-244-4827

1 0

Recent GNSO actions
by Alan Greenberg May 13, 2008

May 13, 2008

There was a GNSO meeting on May 8, with several substantive actions, some of which could require ALAC involvement. FRONT RUNNING You will recall that Danny Younger drafted a letter to the Board requesting that the Board take immediate action regarding Front Running - the practice of learning that someone is thinking about registering a domain name and then registering it first. The information could be the result of a registrar being asked if a name is available and then being registered by that registrar, or by other more circuitous or nefarious means. Following drafting of the letter, and prior to its being forwarded to the Board, it was supported by the NARALO and then the ALAC. The Board effectively decided that the issue did not require their immediate action and requested that the GNSO investigate and take appropriate action. The GNSO Council decided that more information was needed to delineate the problem, understand whether there are existing rules that can be used to curb the practice, and understand what effect the recent Domain Tasting recommendation would have on the practice (by restricting the used of the AGP, it may effectively stop this purely speculative registration of domains). At the same time, there was a strong feeling that the issue should not be ignored or postponed indefinitely. The following motion was passed by Council: >Motion 1 Front Running >====================== > >Create a drafting team to look at questions such as: > - How is the problem defined? > - How prevalent is the problem? > - Will the measures relating to domain tasting affect front running? > - Are there rules within the RAA that can be used? > >The goal is to bring a recommendation to the Council on whether to >request an Issues Report or more extensive research effort and to >define the terms of the report. > >This team should bring its report in time for deliberations in Paris >by 7 June 2008 or sooner if possible. > >Team is open to constituency members. Liaisons are invited to participate > >The motion carried unanimously by voice vote. I presume that the work will be primarily e-mail, although there may be some conference calls. I will be happy to work with the drafting team on this, but I will be somewhat unavailable for conference calls after May 29th. If anyone else has a strong interest and knowledge of this, I would be happy to suggest to the GNSO that this person augment or replace me. FAST FLUX Fast Flux is a process whereby the DNS entry for a domain name is changed at a very high rate. Typically this is used by phishers to make it virtually impossible for a deceptive web site to be taken down, because there are in fact many such sites, making take-down actions very difficult or impossible. The SSAC issued a report on Fast Flux in January 2008. It identified a number of actions that might help reduce the practice. These actions included some that might be within the scope of GNSO policy (and others that were not). The GNSO requested an Issues Report from staff in March (an Issues Report is the first step in the ICANN By-Law mandated GNSO policy development process). There was a feeling on Council that this issue should be addressed with some urgency, but some councillors were a bit worried that the issues report (in line with the SSAC Advisory Report) did not clearly identify what actions were within GNSO scope, and that this differentiation should be done prior to starting a Policy Development Process (PDP). Ultimately the following motion was made and passed, which incorporated the identification of within-scope issues as its first stage. >Motion 2 Fast Flux >================== > >Whereas, "fast flux" DNS changes are increasingly being used to >commit crime and frustrate law enforcement efforts to combat crime, >with criminals rapidly modifying IP addresses and/or nameservers in >effort to evade detection and shutdown of their criminal website; > >Whereas, the Security and Stability Advisory Committee has reported >on this trend in its Advisory SAC 025, dated January 2008: >http://www.icann.org/committees/security/sac025.pdf/ > >Whereas, the SSAC Advisory describes the technical aspects of fast >flux hosting, explains how DNS is being exploited to abet criminal >activities, discusses current and possible methods of mitigating >this activity, and recommends that appropriate bodies consider >policies that would make practical mitigation methods universally >available to all registrants, ISPs, registrars and registries, > >Whereas, the GNSO resolved on March 6, 2008 to request an Issues >Report from ICANN Staff, to consider the SAC Advisory and outline >potential next steps for GNSO policy development designed to >mitigate the current ability for criminals to exploit the NS via >"fast flux" IP and/or nameserver changes; > >Whereas, the ICANN Staff has prepared an Issues Report dated March >25, 2008, >http://gnso.icann.org/issues/fast-flux-hosting/gnso-issues-report-fast-flux…, >recommending that the GNSO sponsor additional fact-finding and >research to develop best practices guidelines concerning fast flux >`hosting, and to provide data to assist policy development and >illuminate potential policy options.; > >Whereas, ICANN should consider whether and how it might encourage >registry operators and registrars to take steps that would help to >reduce the damage done by cybercriminals, by curtailing the >effectiveness of these fast flux hosting exploits. >The GNSO Council RESOLVES: > >To initiate a Policy Development Process uniquely on the issues >deemed in scope in the Issues report. > >Motion carried with 8 votes in favour out of 20 votes present, >exceeding the Bylaws minimum threshold of 'more than 33% of the >Council members present' (Bylaws, AnnexA, Section 3.c)" > >8 votes in favour: >Philip Sheppard, Bilal Beiram, Mike Rodenbaugh, Ute Decker, Kristina >Rosette, Tony Holmes, Tony Harris, Avri Doria (one vote each) > >12 votes against: >Robin Gross, Norbert Klein, Carlos Souza, Olga Cavalli (one vote each) >Tim Ruiz, Jordi Iparraguirre, Edmon Chung, Chuck Gomes, >Greg Ruth, Adrian Kinderis dropped off call at the time of the vote. > >Absent: Cyril Chua, Tom Keller, Jon Bing Following this, the GNSO needed to decide which of the By-Law mandated mechanisms to use to address the PDP. The first motion was to create a Task Force. This motion failed (presumably not because the issue was unimportant, but rather because the structure of a formal Task Force was too limiting). Vote summary: -8 votes in favour: Philip Sheppard, Mike Rodenbaugh, Ute Decker, Kristina Rosette, Tony Holmes, Tony Harris, Greg Ruth, Avri Doria (one vote each) -12 votes against: Robin Gross, Norbert Klein, Carlos Souza, Olga Cavalli (one vote each), Tim Ruiz, Jordi Iparraguirre, Edmon Chung, Chuck Gomes (two votes each) -Bilal Beiram, dropped off at time of vote -Absent: Tom Keller (two votes) Cyril Chua, Jon Bing (one vote each) In its place, a working group will be formed. >Motion 3 >=========== > >Whereas the motion to initiate a Task Force Failed > >Resolved the Council will create a working group to fulfill the >requirement of the PDP. A charter for that working group will be >presented to the council by 22 May 2008 for approval at the 29 May >2008 meeting. The schedule for the constituency reports and the >public comment will be included in that charter. Although not a formal constituency, presumably the ALAC will be able to submit a Constituency Report if we desire, and to participate in this working group. If we plan to do this, we should start sooner rather than later. INTER-REGISTRAR TRANSFER POLICY The Inter-Registrar Transfer Policy (IRTP) is an existing consensus policy under review by the GNSO. A working group looked at the policy last year, and identified a number of ways that the policy could be improved. One of the ones deemed most important was related to the reasons for denial or transfer, and there is an ongoing PDP addressing this. The remaining issues were prioritized. It was felt that to attempt to address all of the issues in a single PDP would be to large (and too long) and effort, and would put too much work on a single group. Accordingly it was decided to break the issues in to six groups and address them in five manageably-sized PDPs (and take no immediate action on those in the sixth group). The full motion is attached (it includes a table that would not be handled well by e-mail). The motion passed unanimously. Alan

1 0

Re: [At-Large] House Leaders Urge Preservation Of ICANN Role (US)
by Jeffrey A. Williams May 13, 2008

May 13, 2008

Robert and all, Indeed as you state it, your correct. However the MOU requires open and transparent participation. Ergo again, Milton's statement is exactly correct as he stated it. As such, it would seem wise, prudent, and ethically advisable that freedom of expression should not be in any way abridged as defined by the US constitution and the international rights convention if ICANN is ever going to achieve it's mission. -----Original Message----- >From: Robert Guerra <lists(a)privaterra.info> >Sent: May 12, 2008 9:13 AM >To: At-Large Worldwide <alac(a)atlarge-lists.icann.org> >Subject: Re: [At-Large] House Leaders Urge Preservation Of ICANN Role (US) > > > > >On 12-May-08, at 11:54 AM, Evan Leibovitch wrote: > >> Robert Guerra wrote: >>> That being said, I do have an issue with the congressional statement >>> as it seemed to indicate that ICANN was supportive of freedom of >>> expression. I would disagree, as board and GNSO decisions seem to >>> more >>> limit speech then anything else. Triple X being one example , wanting >>> to censor IDN domain names another.. >>> >> In other words, ICANN _does_ support freedom of expression ... to the >> same extent as the US government does. ;-) >> >I would disagree . There are no references to Freedom of expression >in the ICANN bylaws. > >I am raising the issue, as I'd like to know where At-Large stands on >stronger protections related to freedom of expression. Personally, >it's an issue I would like the At-Large summit to address.. > >regards > >Robert > >_______________________________________________ >ALAC mailing list >ALAC(a)atlarge-lists.icann.org >http://atlarge-lists.icann.org/mailman/listinfo/alac_atlarge-lists.icann.org > >At-Large Official Site: http://atlarge.icann.org Regards, Spokesman for INEGroup LLA. - (Over 281k members/stakeholders strong!) "Obedience of the law is the greatest freedom" - Abraham Lincoln "Credit should go with the performance of duty and not with what is very often the accident of glory" - Theodore Roosevelt "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== Updated 1/26/04 CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of Information Network Eng. INEG. INC. ABA member in good standing member ID 01257402 E-Mail jwkckid1(a)ix.netcom.com My Phone: 214-244-4827

1 0

Re: [At-Large] House Leaders Urge Preservation Of ICANN Role (US)
by Jeffrey A. Williams May 12, 2008

May 12, 2008

John and all, Odd, I thought that Milton's quoted statement that you took exception with John, was percisely accurate given the known and documented history of ICANN thus far. I don't think anyone is expecting perfection from ICANN, but given the history of public input and access to same without restriction of any sort is significantly lacking and selective censorship has been a regular practice on ICANN forums such as this one. This I believe, and should be clear is what Milton was referring to. -----Original Message----- >From: John Levine <johnl(a)iecc.com> >Sent: May 12, 2008 10:24 AM >To: Evan Leibovitch <evan(a)telly.org> >Cc: At-Large Worldwide <alac(a)atlarge-lists.icann.org> >Subject: Re: [At-Large] House Leaders Urge Preservation Of ICANN Role (US) > >> In other words, ICANN _does_ support freedom of expression ... to the >> same extent as the US government does. ;-) > >As so often happens, Milton collects a lot of interesting facts, then >utterly fails to understand what they mean. > >The most important thing that ICANN has done to support freedom of speech >has been to make domain names almost completely disconnected from whatever >the names are used for and cheap enough that the price of a domain is >insignificant compared to all the other stuff you need to publish on the >net. With remarkably few exceptions, you can register a domain name in >any GTLD and use it for whatever you want. Sure, it's not perfect, and >you don't have to tell me that the UDRP is tilted toward trademark owners, >but if you look at the number of UDRP actions compared to the number of >domains, for the vast majority of domain owners it's a non-issue. > >The .XXX foofaraw is a meaningless sideshow. The pornographers for whom >it was putatively created have been notably unenthusiastic about it, and >the absence of .XXX doesn't seem to have presented much of a bar to >publishing more porn than you could look at in a hundred lifetimes. > >R's, >John > >_______________________________________________ >ALAC mailing list >ALAC(a)atlarge-lists.icann.org >http://atlarge-lists.icann.org/mailman/listinfo/alac_atlarge-lists.icann.org > >At-Large Official Site: http://atlarge.icann.org Regards, Spokesman for INEGroup LLA. - (Over 281k members/stakeholders strong!) "Obedience of the law is the greatest freedom" - Abraham Lincoln "Credit should go with the performance of duty and not with what is very often the accident of glory" - Theodore Roosevelt "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== Updated 1/26/04 CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of Information Network Eng. INEG. INC. ABA member in good standing member ID 01257402 E-Mail jwkckid1(a)ix.netcom.com My Phone: 214-244-4827

1 0

House Leaders Urge Preservation Of ICANN Role (US)
by Robert Guerra May 12, 2008

May 12, 2008

Not sure i've seen this on any of the ICANN related lists yet.. would At-Large be interested in commenting on or before the June meeting in Paris? (US Congress) House Leaders Urge Preservation Of ICANN Role http://techdailydose.nationaljournal.com/2008/05/house_leaders_urge_preserv… Posted on May 6, 2008 (US Congress) House Energy and Commerce Committee Chairman John Dingell and ranking member Joe Barton joined 14 other colleagues on Tuesday in sending a letter to Commerce Secretary Gutierrez praising the administration's continued oversight of the international entity charged with administering the Internet. The lawmakers also asked the Commerce Department to comment on the possibility of an overseas relocation of the Internet Corporation for Assigned Names and Numbers, which is currently based in Marina Del Ray, Calif. Rumors have swirled in recent years that some foreign government and industry stakeholders want ICANN's headquarters to move to Brussels. The concern comes as ICANN's leaders gradually try to transition the coordination of technical functions of the Web to the private sector. "Any change that threatens the important U.S. role in promoting U.S. commercial and free speech principles on the Internet can only hurt the consumers and businesses that count on this network every day," they wrote. The letter requests a response to a handful of questions about ICANN's future within two weeks time. While ICANN remains the "best option for reaching consensus in an increasingly divided world," members said the organization should ensure transparency and promote greater accountability in its operations. ICANN constituents meet several times a year and their next meeting is scheduled for June 22-26 in Paris, France.

5 9