April 2010 - Bc-gnso - lists.icann.org

Assessing the "Domain Name Exchange" service proposed by VeriSign
by Steve DelBianco April 12, 2010

April 12, 2010

BC Members: On April 5, VeriSign (operator of .com, .net, and .name) proposed a new registry service called "Domain Name Exchange." VeriSign¹s proposal and QA& is posted at http://www.icann.org/en/registries/rsep/verisign-dnex-05apr10-en.pdf Here¹s how VeriSign describes the service: > Based on ongoing discussions with registrars who represent diverse business > models and market segments, VeriSign has developed the concept for the Domain > Name Exchange Service to allow a registrar to repurpose a domain name > registration that has significant time remaining until expiration. Today > when a registrant terminates a package of services from a registrar after, for > example, an introductory 1 or 3 month period, the registrar is forced to > recoup the investment in the associated domain via monetization or the > secondary market. The domain exchange will allow a registrar to offer another > registrant a package that sits on top of that same registration using a new > domain. > The Domain Name Exchange Service is an optional service that is designed to > provide registrars and registrants with an effective and efficient way to > manage domain name registration terms for domain names that are no longer > needed. > For many website hosting service providers, the registration of a domain name is a secondary service. For example, the European registrar 1and1 offers web hosting with ³free domains included² ( http://1and1.eu ) in order to attract new clients to establish their online presence. Domain Exchange lets 1&1 re-use the registration if a client wants to drop the website and domain after just a few months. Registrars would pay around 1.5x the cost of a regular annual registration in order to get the Exchange option, and they could exchange once per month. Perhaps there will be significant demand for this service from registrars who have lots of turnover with hosting clients. Domain Exchange is being proposed only for .net domains, but VeriSign may propose it for .com at some point. And that¹s where several BC officers are already raising concerns that Domain Exchange could be a new form of ³domain tasting² that would lead to even more cyber-squatting and typo-squatting. ³Domain tasting² is a loaded term in ICANN circles. ³Tasting² is how domainers test a domain name to learn whether type-in traffic generates enough advertising revenue to cover costs of registering the domain. The names typically tasted were generic words and phrases (like SpringCleaning.com or SpringFashions.com) that some users might guess at by entering the URL ( instead of going thru a page-ranked search engine). Domainers make money on these domain names by ³parking² a page with ads for related products and services. The parked pages that result from tasted names are objectionable in the way that highway billboards are objectionable, but there¹s nothing illegal about monetizing domain traffic with advertising. Moreover, several BC members are domainers who monetize traffic this way, and other BC members providing online advertising services to support the trade. But nothing infuriates BC members and Internet users more than tasting or parking domains that involve trademarked terms or typographical variants designed to deceive users. Cybersquatting and typosquatting could increase if a new service makes it easier to discover domain names that mislead users into thinking they have landed on a page belonging to a known business or organization they intended to reach. Domainers discovered they could taste traffic for 5 days for zero cost by using the Add Grace Period (AGP) that has always been offered by registrars and registries. That led to rampant tasting in domains like .com. The ICANN community, incl many in the BC, pushed ICANN to end the practice of free tasting thru abuse of the AGP privilege. Using the policy development process, ICANN effectively eliminated free AGP tasting in 2009 (http://www.icann.org/en/tlds/agp-policy-17dec08-en.htm ) Question is, will a new Domain Exchange service increase the incidence of trademark and typographical squatting? I asked my friends at VeriSign (a NetChoice member) about this concern, and here¹s what I learned: Domain Exchange is not going to replace the free and unchecked tasting that was done with AGP before 2009. First, a domain 'taster' has to actually buy a 1-year registration to be able to use domain exchange at 11 monthly intervals. That¹s cheaper than buying a dozen registrations, but its not free. Second, it would take a year just to 'taste' a dozen names for ad traffic. Still, VeriSign acknowledges that some parties may see Domain Exchange as a way to ³taste² and then register names that infringe on trademarks. So VeriSign is offering additional IP protection tools described in their proposal, such as limitations on exchanges, free reporting on exchanged names, and the WhoWas service (a permanent record of historical Whois). VeriSign is open to suggestions from the BC (and IPC) about other tools that would minimize use of Domain Exchange for TM infringement or other illegal purposes. They¹re also prepared to answer questions in a direct dialogue with our members if that¹s easier and quicker than using the public comment process described below. So let¹s begin internal discussions on BC List, with an intent to send concerns and questions to staff, to VeriSign, and eventually in ICANN public comments. Finally, a word about the ICANN process for review and approval of new registry services: > > ICANN evaluates new registry services thru its Registry Service Evaluation > Process (RSEP). ICANN staff has 15-days to make a "preliminary determination" > whether this Registry Service requires further consideration by ICANN because > it could raise significant issues with Security & Stability or competition. > There¹s no official comment period during these 15 days, but BC members can > always explain concerns to staff. See RSEP at > http://www.icann.org/en/registries/rsep/rsep.html > > If ICANN determines that the service might raise significant Stability or > Security issues, it goes to the Registry Services Technical Evaluation Panel > and simultaneously invites public comment on the proposal (2nd chance to > comment). This panel has 45 days to do a written report regarding the > proposed service effect on Security or Stability. > > ICANN¹s Board then posts the report for public comment (3rd chance to > comment), and the Board has 30 days to reach a decision. ³In the event the > ICANN Board reasonably determines that the proposed Registry Service creates a > reasonable risk of a meaningful adverse effect on Stability or Security, > Registry Operator will not offer the proposed Registry Service.² > > So there are 2 or 3 chances to comment over a period of 45 days (or 90 days if > the panel raises S&S concerns).

8 10

BC Draft Position on New TLD Registry Agreement Amendments DAG v3
by Ron Andruff April 6, 2010

April 6, 2010

Dear Fellow Members, Please find the draft BC position on new TLD Registry Agreement Amendments attached. This draft position is open for discussion/amendment through April 1st, 2010. Thanks to Jon Nevitt for carrying the ball on this one! Kind regards, RA Ronald N. Andruff President RNA Partners, Inc. 220 Fifth Avenue New York, New York 10001 + 1 212 481 2820 ext. 11

9 15

Prior CBUC Position Statement on VI
by berrycobb＠infinityportals.com April 6, 2010

April 6, 2010

Hi all, In our last constituency call, I recall someone (maybe Philip?) mentioning that the BC had submitted a formal position statement on Vertical Integration in prior years. 1. Is this true, or am I hallucinating? 2. If true, can someone provide the link to it? I cannot find it on the BC web site nor ICANN's site. Please advise. Thank you. B Berry Cobb Infinity Portals LLC 866.921.8891

2 1

FW: [gnso-vi-feb10] Announcement -- constituency statements
by Ron Andruff April 4, 2010

April 4, 2010

Dear members, Clearing mail on the VI WG list and saw this from our member and Co-chair of the VI WG, Mikey O'Connor. Pursuant to the string below, please note constituency statements are now welcome. FYI, Berry Cobb, Mike Rodenbaugh, Jon Nevett, Jarkko Ruuska, Mikey O'Connor, and Michael Palage are all members of this working group, along with myself. Kind regards, Ronald N. Andruff President RNA Partners, Inc. 220 Fifth Avenue New York, New York 10001 + 1 212 481 2820 ext. 11 -----Original Message----- From: owner-gnso-vi-feb10(a)icann.org [mailto:owner-gnso-vi-feb10@icann.org] On Behalf Of Mike O'Connor Sent: Thursday, April 01, 2010 4:11 PM To: Gnso-vi-feb10(a)icann.org Cc: Glen de Saint Géry Subject: [gnso-vi-feb10] Announcement -- constituency statements hi all, here's an announcement of the opening of Constituency Statements for the VI working group. please circulate it as appropriate. thanks, mikey

1 0

ICANN News Alert -- The Accountability and Transparency Affirmation Review Team
by Marilyn Cade April 2, 2010

April 2, 2010

Dear BC members During the recent Kenya ICANN meeting, one of the side events which your CSG representatives -- Sarah Deutsch and Marilyn Cade-- participated in [with other CSG reps] was the development of the process to select the nominee from the SG into the process that would then lead to the 'endorsed' candidates for the 'selectors' -- the Chair of ICANN and the Chair of the GAC, to select the final panel of participants. All BC members thank the BC members who were willing to stand for nomination to the Review Panel on Accountability and Transparancy. We were privileged to have more than one BC member who volunteered for the selection process. The CSG endorsed one of the candidates put forward from the three commercially oriented constituencies, after an internal discussion within the CSG. Our endorsed candidate was indeed selected to the Panel. The 'news' is pasted below regarding the Panel's selection. We will be discussing how the BC/CSG can support the work of the Panel at the Brussels meeting, once we are informed of the Review Panel's processes. The future process for the next three panels is not determined, and it is my plan to ask the CSG representative, Sarah Deutsch, to help to define improvements to the process used on this 'selection', to ensure that the BC's interests are represented. This may mean that a process that relies on the SGs, rather than the gTLD Policy Council, could emerge for the future review panels. We have time and will ensure that all BC members participate in the discussion of processes for the next three Review Panels. This panel's overall selection process was regrettably driven by deadlines that gave the community limited flexibility. However, we are fortunate that the outcome -- selection of the panel -- reflects the BC's input. Marilyn CadeBC ChairAlternate to CSG for BC From: ICANN News Alert [mailto:communications@icann.org] Sent: Friday, April 02, 2010 3:54 PM To: Metalitz, StevenWe are Subject: ICANN News Alert -- The Accountability and Transparency Affirmation Review Team News Alert http://www.icann.org/en/announcements/announcement-02apr10-en.htm The Accountability and Transparency Affirmation Review Team Selected Members 2 April 2010 ICANN publishes today the names of the Accountability and Transparency Review Team members selected by the two Affirmation-mandated Selectors: Peter Dengate Thrush, Chair of the ICANN Board, and Janis Karklins, Chair of the GAC. Sign up for ICANN's Monthly Magazine This message was sent from ICANN News Alert to met(a)msk.com. It was sent from: ICANN, 4676 Admiralty Way, Suite 330 , Marina del Rey, CA 90292-6601. You can modify/update your subscription via the link below. Email Marketing by Manage your subscription

1 0

POSTED: Business Constituency comments on process for Amending TLD Agreements
by Steve DelBianco April 1, 2010

April 1, 2010

BC comments on TLD agreements are now posted to ICANN website. See http://forum.icann.org/lists/gtld-amend-15feb10/msg00003.html and also shown below. Thanks again to Jon Nevett and Ron Andruff for leading on this. ------------- Attached are consensus comments of the Commercial & Business Users Constituency (BC), regarding the Process for gTLD Registry Agreement Amendment. The BC believes that neither the ICANN staff nor the Board should be able to amend registry agreements without community involvement and input from registry operators. All changes - regardless of the issue -- must be transparent and exhibit the appropriate level of accountability to the community. For issues within the picket fence, there is an existing Policy Development Process that carries the power to change all registry and registrar agreements. As described in current and proposed registry contracts, the picket fence includes most conceivable ways that community and BC members would need to control registry practices. ICANN needs to strike a balance in the manner in which registry agreements are amended. In the BC¹s view, neither the current ICANN proposal nor the RySG proposal succeeds in doing so yet. Our rapporteurs for these comments were Ron Andruff and Jon Nevett.

1 0

RE: [bc-gnso] Additional info for Whois Studies discussion at 1-AprGNSO Council Meeting
by Marilyn Cade April 1, 2010

April 1, 2010

excellent additional background to why WHOIS is so important to business users. > Subject: Re: [bc-gnso] Additional info for Whois Studies discussion at 1-AprGNSO Council Meeting > Date: Thu, 1 Apr 2010 08:56:29 -0600 > From: randerson(a)waltonglobal.com > To: marilynscade(a)hotmail.com; sdelbianco(a)netchoice.org; zahid(a)jamilandjamil.com; icann(a)rodenbaugh.com > CC: bc-gnso(a)icann.org > > > An accurate and readily accessible WHOIS is certainly important to more than only businesses regarding trademark infringement. > > An accurate and accessible WHOIS is important to consumers with respect to protection. And recourse from online fraud and theft. > > An accurate and accessible WHOIS is important to individuals and business with respect to protection from defamation. > > An accurate and accessible WHOIS is important to parents and children with respect to transparency and the ability to see who's what with regard to the websites children use. > > An accurate and accessible WHOIS is important to civil society with respect to the transparency of published news and views. > > I always find it puzzling that a small number of people preoccupied with privacy over all else are able to convince the wider community that to forego the virtues of transparency and accountability. There are better ways to fight spam than by hiding or misrepresenting the identity of web publishers. And if you desire anonymity, don't publish a website. > > Two of my children have been ripped off by online vendors hiding being fake data. Our firm has been defamed by a website whose publisher hides being privacy and fake WHOIS data. ICANN should not be tolerating this dysfunction. > > > > > cheers/Rick > > Rick Anderson > EVP, InterBorder Holdings Ltd > randerson(a)interborder.ca > cell (403) 830-1798 > > > ----- Original Message ----- > From: owner-bc-gnso(a)icann.org <owner-bc-gnso(a)icann.org> > To: Steve Delbianco <sdelbianco(a)netchoice.org>; Zahid Jamil <zahid(a)jamilandjamil.com>; Mike Rodenbaugh <icann(a)rodenbaugh.com> > Cc: Bc GNSO list <bc-gnso(a)icann.org> > Sent: Thu Apr 01 08:14:05 2010 > Subject: Re: [bc-gnso] Additional info for Whois Studies discussion at 1-AprGNSO Council Meeting > > > While I support Steve's "thesis", I wouldn't refer to the GAC, who has worked productively with business and law enforcement as "giants", however. > > I do support that policy has to be supported by informed data /research and these studies should receive the funding needed. The amount proposed is indeed small compared to the overall budget and will jelp to inform policy making. > > I would have suggested a higher amount for the initial authorized budget-- but getting two studies authorized for this budget year is a start on the right direction. > > WHOIS is important to all Business users, and for more than trademark collision issues. > > The delay in undertaking the studies is already a serious challenge since further understanding of existing issues is important to also inform the new gTLD and IDN programs. > > > Sent via BlackBerry by AT&T > > -----Original Message----- > From: Steve DelBianco <sdelbianco(a)netchoice.org> > Date: Thu, 1 Apr 2010 13:13:10 > To: <zahid(a)jamilandjamil.com>; <icann(a)rodenbaugh.com> > Cc: <bc-gnso(a)icann.org> > Subject: [bc-gnso] Additional info for Whois Studies discussion at 1-Apr > GNSO Council Meeting > > Mike and Zahid -- I predict you will encounter resistance today to the Study on Whois Misuse ($150K). If I were there, I would offer this: > > Milton Mueller, Robin Gross and the NCUC had for years claimed that people suffered harm and harassment BECAUSE their data was displayed in Whois. It was just an assertion with no data support, but it was their main argument against Whois. > > That's why I suggested study #1 and Claudio of INTA suggested studies 14 and 15. We wanted some data to know if significant harm comes from Whois. It's probable that a few harassment cases came from Whois but I am confident it won't be material or significant, and we can show that there are other sources where email addresses could be obtained. (See below for what Liz Gasster and Lorrie Cranor had to say about the misuse studies) > > I've already mentioned the AoC review of Whois that's coming next year. And then there's the GAC. In their Whois letter (http://www.icann.org/correspondence/karlins-to-thrush-16apr08.pdf) the GAC explicitly calls for misuse data: > > The goal should be to initially compile data that provides a documented evidence base regarding: ... the types and extent of misuses of WHOIS data and what harm is caused by each type of misuse, including economic, use of WHOIS data in SPAM generation, abuse of personal data, loss of reputation or identity theft, security costs and loss of data. > > There's a lesson I learned during the Microsoft case: "Don't moon the giant." This study is $150K out of a $70M annual budget and that's a small price to pay to avoid mooning the giants of GAC and USG. > > Just my two cents. > --Steve > > > Below is the early analysis from the esteemed Lorrie Cranor of ATT and W3C. Lorrie concluded it might be helpful though she thought it would be inexpensive. > > WHOIS misuse studies > Four proposals (suggestions #1, #14, #15 and #21) suggest that ICANN study misuse of WHOIS data to determine the connection, if any, between WHOIS and illegal activities. These studies will help establish the extent and nature of problems caused by unprotected WHOIS data. > Study Suggestion Number 1: (DelBianco) 1) Gather data on WHOIS misuse from consumer protection bureaus and other entities who maintain data on misuse incidents reported by registrants and 2) survey a random sample of registrants in each gTLD and selected ccTLDs. > Study Suggestion Number 14: (INTA) Create a set of new email addresses, use half of them to register domain names, and monitor all for spam for 90 days to determine how much WHOIS information contributes to spam. > Study Suggestion Number 15: (INTA) Create a set of new email addresses, use them to register new domain names at registrars that allow and disallow port 43 WHOIS queries, and monitor all for spam to determine the extent to which port 43 WHOIS queries contribute to spam. > Study Suggestion Number 21: (Kleiman) Survey registrars and human rights organizations to determine how WHOIS is being used in ways that seem to have no bearing on the security and stability of the DNS. > > 1 and 21 propose to survey registrars and other parties who may keep records of misuse incidents. 1 also proposes a survey of registrants. These proposed studies may shed some light on the extent and type of misuse of WHOIS data. However, it will be difficult to gather representative data as not all cases of abuse are reported. In addition, it is not always possible to confirm that misused data was obtained from WHOIS, as this information may be available form other sources. A registrant survey is likely to receive disproportionate responses from registrants who believe their WHOIS information has been abused. Nonetheless, the above studies may result in useful qualitative data about the nature of misuse and provide a rough quantitative estimate of the extent of misuse. Surveying those who already keep track of abuse incidents is likely to be a relatively low- cost approach. The registrant study is likely to be more expensive if done on a large scale, and seems less likely to result in useful data. > > 14 and 15 focus specifically on spam and propose studies in which new email addresses are created and used to register domains to determine how much WHOIS information contributes to spam. 15 compares the amount of spam received as a result of registering a domain at registrars that allow and prohibit port 43 WHOIS queries. These studies should results in fairly accurate quantitative data. However, 14 is quite similar to the October 2007 SSAC study "Is the WHOIS service a source for email addresses for spammers?" and would not likely contribute new information. If port 43 queries are of interest from a policy perspective, study 15 should provide reliable data to inform that discussion. > > > > On 3/31/10 5:43 PM, "Steve DelBianco" <sdelbianco(a)netchoice.org> wrote: > > Mike & Zahid -- > > You asked for some BC membership views on the Whois studies that will be discussed at your Council meeting tomorrow (1-Apr). See below and attachment. Hope this helps. > > Your agenda shows potential actions on Whois studies: > 3.4.1 Review and assess cost and feasibility estimates for the studies > 3.4.2 Decide whether to pursue any of the studies and, if so, which ones > 3.4.3 Provide input into the FY11 budget process > 3.5 How should we accomplish the above? > . Should we form a drafting team to develop recommendations for consideration in our next meeting? > . Note that a final budget has to be finished by 17 May and there are currently no funds budgeted for Whois Studies > > My recommendations: > > Let's proceed with the Misuse and Registrant Identification studies. > > The Misuse and Registrant ID studies are likely to generate data that would affect policy decisions and compliance work. These 2 studies are not going to stop the long-standing disagreements between passionate parties on either side, but that's not the point of doing studies. Remember the debate over domain tasting? Fact-based data on the number of deletes with the AGP were astounding, and helped us enact a policy change. The data did not make everyone agree on whether domain tasting was harmful. But facts showed a hugely prevalent use of AGP that was outside its original purpose, and that moved us to a new consensus policy. > > We'll certainly use study data when setting policy and compliance standards, especially with so many new TLD operators coming online next year. > > Moreover, the Affirmation of Commitments (9.3.1) requires ICANN to "organize a review of WHOIS policy and its implementation to assess the extent to which WHOIS policy is effective and its implementation meets the legitimate needs of law enforcement and promotes consumer trust". The Misuse and Registrant data studies will be essential for that review. > > We will also want to have these study results on hand so they can be compared with study results after new TLDs are operating for one year, as required by the Affirmation of Commitments item 9.3 > > > Let's go right to the core issue of Money. Consider this discussion that happened during Council meeting in Nairobi: > Liz Gasster described some study proposals as "expensive" and then Stefane and Wolf commented on the costs and budget constraints. > > I intervened to say that the lack of fact-based studies has itself been very expensive over several years of time & travel on the part of dozens of community members. Those costs will continue unless/until we have facts at hand to make policy decisions. > > Marilyn made a similar point about need for fact-based analysis. > > Bruce Tonkin recommended that Council budget a lump sum for studies, then decide how to spend it. Don't budget each specific study, he said. > > I believe Bruce Tonkin is right. Council should ask for a budget of $XXX,XXX in FY 2011 for a general category of Whois studies. Since we need a budget number now, I'd say $360,000, to cover the misuse and registrant studies ($150K each) plus a 20% contingency. > > Next steps: I would ask staff to begin negotiating with the two 'superior' bidders on detailed workplan for their studies. Staff should start by asking bidders to review: > > The 4-Mar-2009 Council resolution on Whois studies, including the original rationale for each hypothesis, etc. > > The Affirmation of Commitments, items 9.3 and 9.3.1 > > Staff should also show the bidders any Whois-related items in the Draft Applicant Guidebook. > > Superior Bidders can then prepare detailed study workplans that policy staff can analyze and present to Council later this year. > > > Note: The Staff report (page 7) mentions the Whois Accuracy report, and asks whether "barriers to accuracy" provide useful insights to policy. > > I would answer, "Accuracy is something we aspire to; whereas inaccuracy is a contract compliance problem." > > Let's set high aspirations to require accurate Whois data for registrants, even if we know that lots of data is inaccurate today. After all, registrars manage to gather credit card information that's sufficiently accurate to ensure they get paid. Let's find ways to ensure they apply the same diligence in collecting and validating public Whois data. > > (Note: Susan Kawaguchi of Facebook volunteered to draft BC comments on Whois Accuracy report. Those aren't due until 15-Apr) > > Whois Studies Reports and resources: > https://st.icann.org/gnso-council/index.cgi?whois_discussion# > http://gnso.icann.org/issues/whois/whois-studies-report-for-gnso-23mar10-en… > Presentation Slides: http://gnso.icann.org/correspondence/whois-studies-presentation-01apr10-en.… > > -- > Steve DelBianco > Executive Director > NetChoice > http://www.NetChoice.org and http://blog.netchoice.org > +1.202.420.7482 > > > > > This e-mail message and any attachments may contain confidential and/or privileged information intended only for the addressee. In the event this e-mail is sent to you in error, sender and sender’s company do not waive confidentiality or privilege, and waiver may not be assumed. Any dissemination, distribution or copying of, or action taken in reliance on, the contents of this e-mail by anyone other than the intended recipient is prohibited. If you have been sent this e-mail in error, please destroy all copies and notify sender at the above e-mail address. > > Computer viruses can be transmitted by e-mail. You should check this e-mail message and any attachments for viruses. Sender and sender’s company accept no liability for any damage caused by any virus transmitted by this e-mail. Like other forms of communication, e-mail communications may be vulnerable to interception by unauthorized parties. If you do not wish to communicate by e-mail, please notify sender. In the absence of such notification, your consent is assumed. Sender will not take any additional security measures (such as encryption) unless specifically requested.

1 0

Re: [bc-gnso] Additional info for Whois Studies discussion at 1-AprGNSO Council Meeting
by Marilyn Cade April 1, 2010

April 1, 2010

While I support Steve's "thesis", I wouldn't refer to the GAC, who has worked productively with business and law enforcement as "giants", however. I do support that policy has to be supported by informed data /research and these studies should receive the funding needed. The amount proposed is indeed small compared to the overall budget and will jelp to inform policy making. I would have suggested a higher amount for the initial authorized budget-- but getting two studies authorized for this budget year is a start on the right direction. WHOIS is important to all Business users, and for more than trademark collision issues. The delay in undertaking the studies is already a serious challenge since further understanding of existing issues is important to also inform the new gTLD and IDN programs. Sent via BlackBerry by AT&T -----Original Message----- From: Steve DelBianco <sdelbianco(a)netchoice.org> Date: Thu, 1 Apr 2010 13:13:10 To: <zahid(a)jamilandjamil.com>; <icann(a)rodenbaugh.com> Cc: <bc-gnso(a)icann.org> Subject: [bc-gnso] Additional info for Whois Studies discussion at 1-Apr GNSO Council Meeting Mike and Zahid -- I predict you will encounter resistance today to the Study on Whois Misuse ($150K). If I were there, I would offer this: Milton Mueller, Robin Gross and the NCUC had for years claimed that people suffered harm and harassment BECAUSE their data was displayed in Whois. It was just an assertion with no data support, but it was their main argument against Whois. That's why I suggested study #1 and Claudio of INTA suggested studies 14 and 15. We wanted some data to know if significant harm comes from Whois. It's probable that a few harassment cases came from Whois but I am confident it won't be material or significant, and we can show that there are other sources where email addresses could be obtained. (See below for what Liz Gasster and Lorrie Cranor had to say about the misuse studies) I've already mentioned the AoC review of Whois that's coming next year. And then there's the GAC. In their Whois letter (http://www.icann.org/correspondence/karlins-to-thrush-16apr08.pdf) the GAC explicitly calls for misuse data: The goal should be to initially compile data that provides a documented evidence base regarding: ... the types and extent of misuses of WHOIS data and what harm is caused by each type of misuse, including economic, use of WHOIS data in SPAM generation, abuse of personal data, loss of reputation or identity theft, security costs and loss of data. There's a lesson I learned during the Microsoft case: "Don't moon the giant." This study is $150K out of a $70M annual budget and that's a small price to pay to avoid mooning the giants of GAC and USG. Just my two cents. --Steve Below is the early analysis from the esteemed Lorrie Cranor of ATT and W3C. Lorrie concluded it might be helpful though she thought it would be inexpensive. WHOIS misuse studies Four proposals (suggestions #1, #14, #15 and #21) suggest that ICANN study misuse of WHOIS data to determine the connection, if any, between WHOIS and illegal activities. These studies will help establish the extent and nature of problems caused by unprotected WHOIS data. Study Suggestion Number 1: (DelBianco) 1) Gather data on WHOIS misuse from consumer protection bureaus and other entities who maintain data on misuse incidents reported by registrants and 2) survey a random sample of registrants in each gTLD and selected ccTLDs. Study Suggestion Number 14: (INTA) Create a set of new email addresses, use half of them to register domain names, and monitor all for spam for 90 days to determine how much WHOIS information contributes to spam. Study Suggestion Number 15: (INTA) Create a set of new email addresses, use them to register new domain names at registrars that allow and disallow port 43 WHOIS queries, and monitor all for spam to determine the extent to which port 43 WHOIS queries contribute to spam. Study Suggestion Number 21: (Kleiman) Survey registrars and human rights organizations to determine how WHOIS is being used in ways that seem to have no bearing on the security and stability of the DNS. 1 and 21 propose to survey registrars and other parties who may keep records of misuse incidents. 1 also proposes a survey of registrants. These proposed studies may shed some light on the extent and type of misuse of WHOIS data. However, it will be difficult to gather representative data as not all cases of abuse are reported. In addition, it is not always possible to confirm that misused data was obtained from WHOIS, as this information may be available form other sources. A registrant survey is likely to receive disproportionate responses from registrants who believe their WHOIS information has been abused. Nonetheless, the above studies may result in useful qualitative data about the nature of misuse and provide a rough quantitative estimate of the extent of misuse. Surveying those who already keep track of abuse incidents is likely to be a relatively low- cost approach. The registrant study is likely to be more expensive if done on a large scale, and seems less likely to result in useful data. 14 and 15 focus specifically on spam and propose studies in which new email addresses are created and used to register domains to determine how much WHOIS information contributes to spam. 15 compares the amount of spam received as a result of registering a domain at registrars that allow and prohibit port 43 WHOIS queries. These studies should results in fairly accurate quantitative data. However, 14 is quite similar to the October 2007 SSAC study "Is the WHOIS service a source for email addresses for spammers?" and would not likely contribute new information. If port 43 queries are of interest from a policy perspective, study 15 should provide reliable data to inform that discussion. On 3/31/10 5:43 PM, "Steve DelBianco" <sdelbianco(a)netchoice.org> wrote: Mike & Zahid -- You asked for some BC membership views on the Whois studies that will be discussed at your Council meeting tomorrow (1-Apr). See below and attachment. Hope this helps. Your agenda shows potential actions on Whois studies: 3.4.1 Review and assess cost and feasibility estimates for the studies 3.4.2 Decide whether to pursue any of the studies and, if so, which ones 3.4.3 Provide input into the FY11 budget process 3.5 How should we accomplish the above? . Should we form a drafting team to develop recommendations for consideration in our next meeting? . Note that a final budget has to be finished by 17 May and there are currently no funds budgeted for Whois Studies My recommendations: Let's proceed with the Misuse and Registrant Identification studies. The Misuse and Registrant ID studies are likely to generate data that would affect policy decisions and compliance work. These 2 studies are not going to stop the long-standing disagreements between passionate parties on either side, but that's not the point of doing studies. Remember the debate over domain tasting? Fact-based data on the number of deletes with the AGP were astounding, and helped us enact a policy change. The data did not make everyone agree on whether domain tasting was harmful. But facts showed a hugely prevalent use of AGP that was outside its original purpose, and that moved us to a new consensus policy. We'll certainly use study data when setting policy and compliance standards, especially with so many new TLD operators coming online next year. Moreover, the Affirmation of Commitments (9.3.1) requires ICANN to "organize a review of WHOIS policy and its implementation to assess the extent to which WHOIS policy is effective and its implementation meets the legitimate needs of law enforcement and promotes consumer trust". The Misuse and Registrant data studies will be essential for that review. We will also want to have these study results on hand so they can be compared with study results after new TLDs are operating for one year, as required by the Affirmation of Commitments item 9.3 Let's go right to the core issue of Money. Consider this discussion that happened during Council meeting in Nairobi: Liz Gasster described some study proposals as "expensive" and then Stefane and Wolf commented on the costs and budget constraints. I intervened to say that the lack of fact-based studies has itself been very expensive over several years of time & travel on the part of dozens of community members. Those costs will continue unless/until we have facts at hand to make policy decisions. Marilyn made a similar point about need for fact-based analysis. Bruce Tonkin recommended that Council budget a lump sum for studies, then decide how to spend it. Don't budget each specific study, he said. I believe Bruce Tonkin is right. Council should ask for a budget of $XXX,XXX in FY 2011 for a general category of Whois studies. Since we need a budget number now, I'd say $360,000, to cover the misuse and registrant studies ($150K each) plus a 20% contingency. Next steps: I would ask staff to begin negotiating with the two 'superior' bidders on detailed workplan for their studies. Staff should start by asking bidders to review: The 4-Mar-2009 Council resolution on Whois studies, including the original rationale for each hypothesis, etc. The Affirmation of Commitments, items 9.3 and 9.3.1 Staff should also show the bidders any Whois-related items in the Draft Applicant Guidebook. Superior Bidders can then prepare detailed study workplans that policy staff can analyze and present to Council later this year. Note: The Staff report (page 7) mentions the Whois Accuracy report, and asks whether "barriers to accuracy" provide useful insights to policy. I would answer, "Accuracy is something we aspire to; whereas inaccuracy is a contract compliance problem." Let's set high aspirations to require accurate Whois data for registrants, even if we know that lots of data is inaccurate today. After all, registrars manage to gather credit card information that's sufficiently accurate to ensure they get paid. Let's find ways to ensure they apply the same diligence in collecting and validating public Whois data. (Note: Susan Kawaguchi of Facebook volunteered to draft BC comments on Whois Accuracy report. Those aren't due until 15-Apr) Whois Studies Reports and resources: https://st.icann.org/gnso-council/index.cgi?whois_discussion# http://gnso.icann.org/issues/whois/whois-studies-report-for-gnso-23mar10-en… Presentation Slides: http://gnso.icann.org/correspondence/whois-studies-presentation-01apr10-en.… -- Steve DelBianco Executive Director NetChoice http://www.NetChoice.org and http://blog.netchoice.org +1.202.420.7482

1 0

Whois Studies discussion at 1-Apr GNSO Council Meeting
by Steve DelBianco April 1, 2010

April 1, 2010

Mike & Zahid -- You asked for some BC membership views on the Whois studies that will be discussed at your Council meeting tomorrow (1-Apr). See below and attachment. Hope this helps. Your agenda shows potential actions on Whois studies: > 3.4.1 Review and assess cost and feasibility estimates for the studies > 3.4.2 Decide whether to pursue any of the studies and, if so, which ones > 3.4.3 Provide input into the FY11 budget process > 3.5 How should we accomplish the above? > Should we form a drafting team to develop recommendations for > consideration in our next meeting? > Note that a final budget has to be finished by 17 May and there are > currently no funds budgeted for Whois Studies My recommendations: Let¹s proceed with the Misuse and Registrant Identification studies. > The Misuse and Registrant ID studies are likely to generate data that would > affect policy decisions and compliance work. These 2 studies are not going to > stop the long-standing disagreements between passionate parties on either > side, but that¹s not the point of doing studies. Remember the debate over > domain tasting? Fact-based data on the number of deletes with the AGP were > astounding, and helped us enact a policy change. The data did not make > everyone agree on whether domain tasting was harmful. But facts showed a > hugely prevalent use of AGP that was outside its original purpose, and that > moved us to a new consensus policy. > > We¹ll certainly use study data when setting policy and compliance standards, > especially with so many new TLD operators coming online next year. > > Moreover, the Affirmation of Commitments (9.3.1) requires ICANN to ³organize a > review of WHOIS policy and its implementation to assess the extent to which > WHOIS policy is effective and its implementation meets the legitimate needs of > law enforcement and promotes consumer trust². The Misuse and Registrant data > studies will be essential for that review. > > We will also want to have these study results on hand so they can be compared > with study results after new TLDs are operating for one year, as required by > the Affirmation of Commitments item 9.3 Let¹s go right to the core issue of Money. Consider this discussion that happened during Council meeting in Nairobi: > Liz Gasster described some study proposals as "expensive" and then Stefane and > Wolf commented on the costs and budget constraints. > > I intervened to say that the lack of fact-based studies has itself been very > expensive over several years of time & travel on the part of dozens of > community members. Those costs will continue unless/until we have facts at > hand to make policy decisions. > > Marilyn made a similar point about need for fact-based analysis. > > Bruce Tonkin recommended that Council budget a lump sum for studies, then > decide how to spend it. Don't budget each specific study, he said. > > I believe Bruce Tonkin is right. Council should ask for a budget of $XXX,XXX > in FY 2011 for a general category of Whois studies. Since we need a budget > number now, I¹d say $360,000, to cover the misuse and registrant studies > ($150K each) plus a 20% contingency. > Next steps: I would ask staff to begin negotiating with the two superior¹ bidders on detailed workplan for their studies. Staff should start by asking bidders to review: > > The 4-Mar-2009 Council resolution on Whois studies, including the original > rationale for each hypothesis, etc. > > The Affirmation of Commitments, items 9.3 and 9.3.1 > > Staff should also show the bidders any Whois-related items in the Draft > Applicant Guidebook. > > Superior Bidders can then prepare detailed study workplans that policy staff > can analyze and present to Council later this year. Note: The Staff report (page 7) mentions the Whois Accuracy report, and asks whether ³barriers to accuracy² provide useful insights to policy. > > I would answer, ³Accuracy is something we aspire to; whereas inaccuracy is a > contract compliance problem.² > > Let¹s set high aspirations to require accurate Whois data for registrants, > even if we know that lots of data is inaccurate today. After all, registrars > manage to gather credit card information that¹s sufficiently accurate to > ensure they get paid. Let¹s find ways to ensure they apply the same > diligence in collecting and validating public Whois data. > > (Note: Susan Kawaguchi of Facebook volunteered to draft BC comments on Whois > Accuracy report. Those aren¹t due until 15-Apr) Whois Studies Reports and resources: > https://st.icann.org/gnso-council/index.cgi?whois_discussion# > http://gnso.icann.org/issues/whois/whois-studies-report-for-gnso-23mar10-en…> f > Presentation Slides: > http://gnso.icann.org/correspondence/whois-studies-presentation-01apr10-en.… -- Steve DelBianco Executive Director NetChoice http://www.NetChoice.org and http://blog.netchoice.org +1.202.420.7482

1 1

Comments from Marilyn Cade: Another Last Call: BC Position - Baseline Registry Operations Report
by Marilyn Cade April 1, 2010

April 1, 2010

Barry, Steve, Thanks Barry, for your work on this. I have a couple of suggestions, and point out a couple of editorial changes that you will want to make. I provide several suggestions ,and put into bold some of the key words/and new proposed language to try to make this easier to understand and follow. Overall great job. A few critical changes proposed. For the longer term, I know that there are other discussions to be had about a 'template' or 'templates' for BC policy positions and, I do hope that you will play a leadership role in that process. On the substance of this comment, I would suggest that you change the legend on some of the elements to !. For instance, although the category: "Reserves" says no comment, actually the BC does have a comment. Capital Expenditures: says no comments, but does offer a very important comment. Continuity Planning, legend says no comment, but we do have a comment. I'd just suggest changing the legend to "!", and editing out the /NO comment on those issues. Finally, I wanted to call your attention and others to the need to have a category that is 'brands related gTLD registry'. Youcould add a footnote to 'registry population', noting that there may be a category of registries that are operated by a brand holder, for their subscribers, or employees, and that this category is not addressed, to date, in ICANN's work. In the Survey Demographics section. The first bullet point needs to have an edit in the last reference to the ccTLDs. it should read "..... under different contractual obligations to ICANN than ccTLDs. I think you mean ... "than gTLDs". Discussion Point: I spent a good deal of time studying ccTLDs when I was chairing the first WHOIS Task Force. The working methods of the cc's are indeed a good barometer for learning. Sometimes this is not well understood by business users who primarily register in cc's defensively. And, there are other factors that limit the exposure of business users to the ccTLD managers -- e.g. while we once held dialogues with the cc's that has gone by the wayside and the primary focus is on the gTLDs. And, then the reality is that the gTLDs registries often believe that they are the 'rightful choice' for back engines for future gTLDs and even for ccTLDs. As BC, we need to agnostic about business preferences. Business uses can register in either gTLDs or ccTLDs and need to have a broadened understanding of the role and activities of the ccTLDs for many reasons. I'd propose that we soften the comments about the cc's. For instance, I disagree with the proposal that the review of cc's be limited to those ccTLDs that mimic gTLDs -- I do not agree. That would eliminate .de; .uk, and .ca, and .cn, for example, all of which are large and complex ccTLDS, often more complex and technically sophisticated than many of the smaller gTLDs. A few cc's are marketed as 'global' TLDs, and that has disconcerted, or annoyed some gTLD registries. That is a perspective of gTLD registries that may not not actually serve the broader global business user communities' interest. For instance, if you are a small Kenyan business, you may both prefer to register in .ky and find advantage in doing so. You may also want to register in a gTLD as well, however. Global business users are registering in ccTLDs in many cases to have identity in the country they are doing business in. Understanding cc's practices is a 'good thing'. I'd prefer to strike the statement "Perhaps ccTLDs that mimic a gTLD should be chosen'. Instead, I'd propose that the BC statement read: The CBUC supports the inclusion of ccTLDs in this study and is interested in ensuring that the sample is fully representative of different practices and models, including analyzing different 'sizes" of cc TLD registries. In your bullet about slide 4, the language seems to need some editing. Finally, I do not support ICANN's outsourcing of compliance, and I suggest that the BC should not support that. The present position offered could be strengthened by changing the statement to proposed new statement: "Enforcement and compliance should remain a primary function of ICANN itself. Outsourcing of such functions may create vulnerabilities for ICANN to fulfull its core responsibilities and any proposed outsourcing should be carefully studied, and the subject of further public comment before proceeding with any such initiatives. ICANN may be proposing an initial cost savings approach that will ultimately harm the registrants and limit ICANN's ability to fulfill its core responsibilities. " Technical and Network Architecture: This BC statement could use the same footnore reference mentioned above regarding brands registries. > Date: Tue, 30 Mar 2010 18:57:58 -0400 > Subject: [bc-gnso] Another Last Call: BC Position - Baseline Registry Operations Report > From: sdelbianco(a)netchoice.org > To: bc-GNSO(a)icann.org > > Another Last Call before closing on a BC comment. > > Attached is the draft BC position regarding the report on Baseline Registry > Operations. > > Berry Cobb circulated the draft back on 23-Mar (see below). I¹ve signaled > my agreement. > > Absent objections by COB tomorrow, we will file as consensus BC comments on > 1-Apr-2010. > > --Steve > > On 3/23/10 3:16 AM, "Berry Cobb" <berrycobb(a)infinityportals.com> wrote: > > BC, > > Attached is the first draft of the CBUC position statement for the Baseline > Registry Operation report released by ICANN. Overall, I feel KPMG performed > well and provided meaningful views of the data. It is ashamed that more > participants were not a part of the sample data. > > My Registry operations experience is limited, so I ask the BC team to take a > strong look at the report and the initial comments I provided. I especially > invite our members that have direct Registry operations experience > to enhance our position about this study and its future use by the gTLD > Evaluation teams. > > This material is sure to have a direct impact to the next Draft Applicant > Guidebook version 4 to be released just prior to Brussels. In a > quick review, the following are what I believe to be sections of the DAGv3 > where this study could influence the Application Evaluation Criteria, or > the Application Process both of which will be used by the gTLD Evaluation > teams. > > 1.2.2 Required Documents for Application > 1.4.2 Application Form > 2.1.2 Applicant Reviews > 2.1.3 Registry Services Review > 2.2.1 Technical/Operational or Financial Extended Evaluation > 2.2.2 DNS Stability Extended Evaluation > 2.2.3 Registry Services Extended Evaluation > > The comment period closes April 1st, so I ask for your quick > turn-around. As Steve DelBianco eluded to in our last BC call, there are a > large number of comment period closings converging at once. I thank you for > your quick response. I will compile all feedback and incorporate changes on > 3/30/2010. > > > Berry Cobb > Infinity Portals LLC > San Jose, CA > mailto:berrycobb@infinityportals.com > http://infinityportals.com <http://infinityportals.com/> > 866.921.8891 > >

2 2