- Bc-gnso - lists.icann.org

Policy Calendar for 13-Jun-2023 BC Open Meeting at ICANN77
by Steve DelBianco June 12, 2023

June 12, 2023

Here’s the Policy Calendar for the BC Open meeting at 10:45 local time on 13-Jun at ICANN 77 (also in attachment “policy calendar.pdf”) Channel 1. BC participation in ICANN Public Comment process: On 12-Jun we will file the attached comment on the NomCom2 Review<https://www.icann.org/en/public-comment/proceeding/bylaws-amendments-and-do…>, thanks to Tola and Lawrence for the attached comment. On 31-May we US Government’s NTIA proposal for new restrictions on .US WHOIS access<https://www.ntia.doc.gov/sites/default/files/publications/ustld_whois_feder…>. The reason is to harmonize .US policy with GDPR-imposed limits on WHOIS in other TLDs. Thanks to Mason Cole for drafting. On 25-May we commented<https://cbu.memberclicks.net/assets/docs/positions-statements/2023/2023_05M…> on the proposed renewal of the .NET registry agreement<https://www.icann.org/en/public-comment/proceeding/proposed-renewal-of-the-…>. Thanks to Margie, Zak, and Steve for drafting. Selected ICANN Public Comments<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_public-2…> and other opportunities for the BC to comment: 1. Phase 1 Initial Report on the Internationalized Domain Names (IDN) EPDP (comment page<https://www.icann.org/en/public-comment/proceeding/phase-1-initial-report-o…>). Comments close 19-Jun. The PDP WG seeks input on prelim recommendations<https://itp.cdn.icann.org/en/files/internationalized-domain-names-idn/phase…> Thanks to Ching Chiao for drafting our comment. Steve circulated Ching’s draft on 29-May, incl Ching’s report from the ICANN webinar, and discussion of prior BC positions. Let’s discuss any remaining edits at our 13-Jun meeting. 2. ISPCP constituency charter amendments (comments page<https://www.icann.org/en/public-comment/proceeding/ispcp-constituency-chart…>). Comments close 26-Jun. See their proposed amended charter<https://itp.cdn.icann.org/en/files/policy-development/amended-ispcp-constit…>. Thanks to Zak for drafting the attached BC comment. Let’s discuss at our 13-Jun meeting 3. PTI/IANA Governance Proposal. (comments page<https://www.icann.org/en/public-comment/proceeding/pti-iana-governance-prop…>). Comments close 5-Jul. PTI Bylaws amendments include: Modify timing for initial delivery of PTI Operating Plan & Budget, to a 90-day window. Moving PTI from a 4-year strategic planning cycle to a 5-year strategic planning cycle, to align with ICANN’s 5-year strategic planning. In Nov-2022 we commented<https://cbu.memberclicks.net/assets/docs/positions-statements/2022/2022_11N…> on the FY2024 PTI budget, thanks to Crystal Ondo, Rajiv Prasad, and Margie Milam. Thanks to Rajiv for volunteering to draft this BC comment. 4. Amendments to the Base gTLD RA and RAA to Modify DNS Abuse Contract Obligations<https://www.icann.org/en/public-comment/proceeding/amendments-base-gtld-ra-…>. Comments close 13-Jul. These draft agreements were published<https://www.icann.org/en/announcements/details/amendments-to-the-base-gtld-…> last week, incl this new obligation for Registrars: “When Registrar has actionable evidence that a Registered Name sponsored by Registrar is being used for DNS Abuse, Registrar must promptly take the appropriate mitigation action(s) that are reasonably necessary to stop, or otherwise disrupt, the Registered Name from being used for DNS Abuse. Action(s) may vary depending on the circumstances, taking into account the cause and severity of the harm from the DNS Abuse and the possibility of associated collateral damage.” We need volunteer(s) to draft a BC comment, and we should discuss during ICANN77. 5. See Draft Framework<https://community.icann.org/display/GFDOCG/Draft+Framework+for+Closed+Gener…> for closed generic gTLDs. Comments will close 15-Jul and we expect a(n) (E)PDP. GNSO, GAC, and ALAC drafted “a workable framework to identify and handle closed generic applications for the immediate next round of new gTLDs”. The framework discussion will focus on options other than the two endpoint positions (i.e. no closed generics at all; closed generics without restrictions) Prior BC positions on closed generic go back to our comments during the 2012 round of gTLD expansion. To summarize: The BC would be concerned about consumer deception and competitor exclusion if a single competitor in an industry manages a closed TLD where the TLD string is closely identified with the industry. For example, say a travel company or a hotel chain runs .HOTELS as a closed TLD -- not allowing competitors to register second level names, while also controlling content on domains such as search.hotels, eco.hotels, family.hotels, best.hotels, cheap.hotels, luxury.hotels, etc. It’s easy to see how the TLD owner could bias content and search results on those consumer information sites, without consumers being fully aware. The draft includes this principle, relevant to prior BC position: “Purpose og gTLD must not be to solely exclude other parties from using the gTLD or to serve the applicant’s own commercial interests” On 25-May Council discussed the draft scope<https://gnso.icann.org/sites/default/files/policy/2023/draft/draft-policy-v…> of subsequent policy work to inform preparation of the timeline for this work. 6. NIS2, followed closely by Andrew Bennett, Nik Lagergren, and Marie Pattullo. In The Hague we talked with MEP Bart Groothuis<https://en.wikipedia.org/wiki/Bart_Groothuis> about NIS2 and next steps. NIS2 final text<https://www.europarl.europa.eu/doceo/document/A-9-2021-0313-AM-281-281_EN.p…> approved by European Parliament on 10-Nov, and by Council on 28-Nov. final text published on 27-Dec<https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=OJ:L:2022:333:FULL&…> (p.82), giving 21-months for Member States to transpose into national law. BC will advocate for strong transposition by Member States. Channel 2. Support for discussion and votes of our representatives on GNSO Council Marie Pattullo and Mark Datysgeld are our GNSO Councilors. Previous Council meeting was 25-May. See . Agenda<https://community.icann.org/x/yoBXDg>, Audio Recording<https://icann.zoom.us/rec/play/9Xe19OH79-nipAAgK39Fem3ghqWjneuD2DDB-rlfazSt…>, Transcript<https://gnso.icann.org/sites/default/files/policy/2023/transcript/transcrip…>, Zoom recording<https://icann.zoom.us/rec/share/7pSQ37mSB5wGz8-msQS2PDpzhQ6VdJQISm2SYmWKwfF…> Council did not vote on any resolutions. Council discussed ICANN Board request for<https://www.icann.org/en/system/files/correspondence/sinha-to-ducos-26apr23…> GNSO Council views on the issue of NomCom rebalancing. The ICANN community has been discussing the issue of rebalancing the NomCom for over 10 years, and the ICANN Board resolved to engage with the ICANN community to better understand community views on the rebalancing. Specifically, the Board is seeking input on the following questions: 1. What does it mean to have a balanced NomCom at a point in time? For example, what criteria would you apply to measure or assess whether the NomCom is balanced? And further, how can one test whether or not the NomCom is balanced? 2. Do you support the view that the current composition of the NomCom needs to be rebalanced? Please explain why or why not. 3. How frequently does the balance need to be measured or assessed? 4. How do you suggest that the NomCom’s composition be rebalanced? 5. Who should conduct this work, and how should it be conducted? 6. How would your community group prioritize consideration of this issue within your planning efforts? Here, the Council will discuss the questions from the Board and determine whether it would like to provide input. Council discussed the draft scope<https://gnso.icann.org/sites/default/files/policy/2023/draft/draft-policy-v…> of subsequent policy work on closed generics in next round. Council received an update from EPDP Phase 2 small team on progress defining the success criteria of the RDRS.<https://gnso.icann.org/sites/default/files/policy/2023/draft/draft-rdrs-pro…> Next Council meeting is 14-Jun at ICANN 77 at 17:45 UTC/ 13:45 Washington time. Agenda<https://community.icann.org/x/zIBXDg> includes: Item 3: Motion to Commemorate Pam Little Item 4: Timelines for SubPro. Council will acknowledge the work plans and timelines for: the pending recommendations, IDNs EPDP Phase 2, and closed generics EPDP Item 5: DNS Abuse small team discussion Item 6: Discuss Whois Accuracy scoping team recommendations. Item 7: we’ll have another go at the GNSO Town Hall experiment<https://community.icann.org/display/gnsocouncilmeetings/Final+Proposed+Agen…>. It’s an opportunity to raise any topic or input on GNSO work. In addition, Council wants to hear how to address the recent trend of attrition in GNSO Working Group participation - a topic that was also discussed during the recent GNSO Policy Webinar. Other Council activities: 1. Transfer Policy Working Group. (Zak Muscovitch and Arinola Akinyemi). Working Group looking at Early Input on these topics: (see BC input<https://cbu.memberclicks.net/assets/docs/positions-statements/2023/2023_04A…>) 1. Transfer Emergency Action Contact (TEAC) 2. Transfer Dispute Resolution Policy (TDRP) 3. ICANN-approved Transfers 4. Items raised in the Expedited Policy Development Process Recommendation 27, Wave 1 Report Working Group is deliberating a transfer reversal policy proposed by a WG member (See Transfer Reversal Gap Analysis<https://docs.google.com/document/d/1Mq-Zu-fTdu4xrI1h1YPB1ITGRTxAp2gKzef7cTk…>). The latest Transfer Policy issue is a registrant-initiated transfer dispute mechanism. There has been considerable resistance to even the WG recommending in its report, that GNSO consider establishing a PDP to evaluate the feasibility of this despite us and the At Large forcefully making the case. 2. GNSO Guidance Process (GGP). (Lawrence Olawale-Roberts). See main wiki page<https://community.icann.org/display/GGPGIRFAS/GNSO+Guidance+Process+%28GGP%…>, Members and Alternates<https://community.icann.org/display/GGPGIRFAS/Members+and+Mailing+List>. BC member Segunfunmi Olajide is an observer. 3. DNS Abuse small team. Mark Datysgeld serves as co-lead. CPH representatives met with ICANN Org for negotiations on RAA and RyA amendments to address DNS Abuse. (Sally’s letter<https://www.icann.org/en/system/files/correspondence/costerton-to-heineman-…>). To inform that negotiation, Mason drafted and sent this letter<https://www.icann.org/en/system/files/correspondence/cole-et-al-to-sinha-co…> from BC, IPC, and ALAC on 23-Jan On 27-Mar the Board responded<https://www.icann.org/en/system/files/correspondence/sinha-to-cole-et-al-27…> to our 23-Jan letter<https://www.icann.org/en/system/files/correspondence/cole-et-al-to-sinha-co…>. On 29-May, new draft agreements were published<https://www.icann.org/en/announcements/details/amendments-to-the-base-gtld-…> for public comment. 4. Registrant Data Request System (RDRS), formerly known as SSAD Light BC and IPC voted No on building SSAD, because we did not see value unless there was significantly likelihood of getting disclosures when we requested with legitimate purposes. Steve is on Council small team<https://community.icann.org/pages/viewpage.action?pageId=186779415> on SSAD ODA<https://www.icann.org/en/system/files/files/ssad-oda-25jan22-en.pdf>, to review a“ticketing system” without obligations for use or for disclosure. On 13-Sep ICANN staff released a design paper<https://www.icann.org/en/system/files/files/whois-disclosure-system-design-…>. Highlights: ICANN org says development over nine months; development and two-year maintenance would be $100,000 · It does not include accreditation of the requestors; No fees to the requestor. · There is no obligation for automated processing of requests by contracted parties. See Council’s 17-Nov letter to the Board<https://www.icann.org/en/system/files/correspondence/ducos-to-sinha-17nov22…>. In Feb-2023 Board directed<https://www.icann.org/en/board-activities-and-meetings/materials/approved-r…> ICANN org to develop the System. On 11-Mar-2023 the small team held a session in Cancun to hear about progress from Org’s development team. The system is now named Registration Data Request Service Steve asked for the data model, up-front. To include images of screenshots submitted with requests. Suggested batch request feature from vendors like AppDetex and Fairwinds Steve said: Usage has 2 dimensions: Quantity of requests & responses Quality of requests & responses (origin, reason, detail, registrar, domain name, etc.) Becky said board wants to know what we hope to learn from this experiment. Will we learn what we need to determine next steps? Is SSAD fit-for-purpose? Did this make it easier for users to submit requests and for registrars to process those requests? On 19-Apr staff released their data model, which does include the detail the BC requested. But Steve objected to staff statement that it would not make detailed results available for our analysis, noting the design paper<https://www.icann.org/en/system/files/files/whois-disclosure-system-design-…> and addendum<https://gnso.icann.org/sites/default/files/policy/2022/correspondence/ducos…> indicate access to data, even for non-participating registrars. On 7-May small team call, Steve lamented staff reversing their commitment to make data available. Staff and RrSG said they assumed “data” was just the reported aggregates and metrics. Steve said the BC will look at reasons for disclosure denial, and compare those reasons to the new legal basis given in NIS2 Steve Crocker said researchers will want to do reverse lookups. Should be among success criteria. Sarah Wyld said that’s out of scope On 15-May call, Sara Wyld said: “If the data is “protected” (via P/P service) then only P/P data will be sent in response to the RDRS request. This is the same data as is available publicly. If the underlying data is required, that needs due process (warrant, subpoena, etc) and is not part of the RDRS at all. Due process requests are outside the scope of the RDRS, as is disclosure of data underlying a P/P service” On May 16 and 17 ICANN held webinars on the RDRS<https://www.icann.org/en/announcements/details/icann-to-showcase-early-deve…>. Demo was good. They are very far along with this. On 25-May Council received an update from EPDP Phase 2 small team on progress defining the success criteria of the RDRS.<https://gnso.icann.org/sites/default/files/policy/2023/draft/draft-rdrs-pro…> 5. Subsequent Rounds of gTLD expansion (SubPro) There will be an Implementation Review Team (IRT) for SubPro. We need volunteers to represent the BC, naming one representative and one alternate. Thanks to Imran Hossen for volunteering as BC rep. And thanks to Ching Chiao for volunteering as alternate. 6. Statement of Interest (SOI) exemption proposal<https://docs.google.com/document/d/1WvDU-dmKXF1LY0iXJCWes0B6_JilEWcA/edit.>: (see slides<https://community.icann.org/download/attachments/240617757/CCOICI%20-%20Exe…>). The CCOICI found 0.03% members were using the exemption. This limited use led to conclusion that the requests for removal of the exemption language did not seem to be in response to a current issue but potential future situations. CCOICI also noted that tightening of the exemption language, by providing further specificity as to what qualifies as a ‘representative’ may have even further reduced its use in these efforts. Channel 3. Supporting discussion/voting on matters before the Commercial Stakeholders Group (CSG) Tim Smith is the CSG Liaison for the BC. Board Seat 14. CSG and NCSG ExComm will meet Thursday morning discuss common interests and to build a better understanding of each other’s priorities. This will pave way for broader discussion on Board seat 14 and future candidacies. IFR Representative. In April, the ICANN Office of the Chief Technology Officer (OCTO) notified CSG ExComm of a Request for Appointment of Members and Liaisons to the Second IANA Naming Function Review (IFR)<https://www.icann.org/en/system/files/correspondence/bryce-to-reynoso-et-al…> The IFR is an accountability mechanism required by ICANN’s Bylaws to ensure that Public Technical Identifiers (PTI) meets the needs and expectations of its naming customers. The IFR team is mandated to review PTI's performance of the IANA naming function against the requirements set forth in the IANA Naming Function Contract and the IANA Naming Function Statement of Work. Required is one representative to be appointed by CSG. There has been no discussion on this within the CSG ExComm. If anybody is interested, please let me know and I’ll put a name forward. DEADLINE: Friday, 30 June 2023 at 17:00 UTC Meetings at ICANN 77: CSG Membership – Wednesday, 14 June 2023 at 19:30 UTC CPH and CSG Membership – Thursday, 15 June 2023 at 17:45 UTC

1 0

ICANN Business Constituency (BC) comment on .usTLD registrant data access (Docket 230412-0099)
by Steve DelBianco May 31, 2023

May 31, 2023

DEPARTMENT OF COMMERCE National Telecommunications and Information Administration (NTIA) [Docket Number: 230412–0099] RIN 0660–XC058 Introduction of Accountable Measures Regarding Access to Personal Information of .us Registrants _____________________________________________________________________________________________ The Business Constituency<https://www.icannbc.org/> (BC) is the representative voice of business users of the internet and their customers as their concerns relate to governance of the domain name system (DNS). Our constituency is chartered by the Internet Corporation for Assigned Names and Numbers (ICANN), the multistakeholder body charged with maintaining a secure and stable DNS. The BC, over time, has carefully considered all aspects of the debate over domain name registration data (or “WHOIS”) policy as it has progressed. While sensitive to the concerns raised in this proposed policy change for the .US country code top-level domain (ccTLD), the BC in this comment lodges again its position that WHOIS data must be accessible to the broadest extent possible. In our experience, access to an unencumbered WHOIS database is beneficial to the public interest and helps insulate against a rising tide of DNS abuse. Our replies to the specific questions posed in the Request for Comment are attached. Thank you for the opportunity to comment. Mason Cole Chair ICANN Business Constituency mcole(a)perkinscoie.com<mailto:mcole@perkinscoie.com> +1-503-407-2555 Steve DelBianco Vice Chair for Policy Coordination ICANN Business Constituency sdelbianco(a)netchoice.org<mailto:sdelbianco@netchoice.org> +1-703-615-6206

2 1

Webinar today on proposed RAA and RyA amendments to address DNS Abuse
by Steve DelBianco May 30, 2023

May 30, 2023

BC members – this is “prep week” for ICANN 77. Today, ICANN Org is holding an update on the Registry Agreement and Registrar Accreditation Agreement amendment negotiation with the Contracted Parties. These amendments are designed to address DNS Abuse obligations. Today’s webinar<file:///BC%20members%20–%20this%20is%20“prep%20week”%20for%20ICANN%2077%20and%20there’s%20a%20session%20today%20on%20proposed%20RAA%20and%20RyA%20amendments%20to%20address%20DNS%20Abuse.%20%20%20%20The%20draft%20agreements%20were%20published%20last%20week,%20%20%20%20Today’s%20webinar%20is%20at%2014/00%20Eastern%20US%20time.> is at 14:00 Eastern US time. These draft agreements were published<https://www.icann.org/en/announcements/details/amendments-to-the-base-gtld-…> last week for public comment<https://www.icann.org/en/public-comment/proceeding/amendments-base-gtld-ra-…>, closing 13-Jul: Proposed Global Amendment to the Registrar Accreditation Agreement (PDF, 47.56 KB)<https://itp.cdn.icann.org/en/files/registry-agreement/proposed-global-amend…> Proposed Clean 2013 Registrar Accreditation Agreement (PDF, 605.42 KB)<https://itp.cdn.icann.org/en/files/registry-agreement/proposed-clean-2013-r…> Proposed Global Amendment to the Base gTLD Registry Agreement (PDF, 50.74 KB)<https://itp.cdn.icann.org/en/files/registry-agreement/proposed-global-amend…> Proposed Redline Base gTLD Registry Agreement (PDF, 741.99 KB)<https://itp.cdn.icann.org/en/files/registry-agreement/proposed-redline-base…> Proposed Redline 2013 Registrar Accreditation Agreement (PDF, 620.57 KB)<https://itp.cdn.icann.org/en/files/registry-agreement/proposed-redline-2013…> Proposed Clean Base gTLD Registry Agreement (PDF, 747.21 KB)<https://itp.cdn.icann.org/en/files/registry-agreement/proposed-clean-base-g…>

1 0

ICANN Org webinars on Registration Data Request Service, May 16 and May 17
by Steve DelBianco May 15, 2023

May 15, 2023

See announcement<https://www.icann.org/en/announcements/details/icann-to-showcase-early-deve…> of these webinars, regarding the RDRS. ICANN Org will host two webinars to showcase early development of the Registration Data Request Service (formerly known as the WHOIS Disclosure System). Webinar #1: 16 May from 13:00-14:30 UTC Registration link: https://icann.zoom.us/webinar/register/WN_NYL6fh9-SVWmEHeVQ4R4yQ Webinar #2: 17 May from 03:00-04:30 UTC Registration link: https://icann.zoom.us/webinar/register/WN_xkAdv7uOTNeEOsM0_c-txQ an update on the progress made in the development of the service, which will be used by registrars and requestors of nonpublic generic top-level domain (gTLD) registration data. The webinars will also give participants an opportunity to ask questions related to the development of the service. All ICANN-accredited registrars, ICANN community members, and other parties who are interested in learning more about the service are encouraged to join. The Registration Data Request Service will streamline the process for submitting and evaluating requests for access to nonpublic gTLD registration data through the use of a single platform. The service will connect requestors seeking nonpublic data with the relevant ICANN-accredited registrars for gTLD domain names who participate in the service. The operation of the service is intended to gather usage and demand data that can inform the ICANN Board's consideration of the consensus policy recommendations<https://gnso.icann.org/sites/default/files/file/field-file-attach/epdp-phas…> related to a System for Standardized Access/Disclosure, and ongoing consultations with the Generic Names Supporting Organization Council. The Registration Data Request Service is currently being developed by ICANN org with the aim to launch in November 2023. For more information, visit the Registration Data Request Service page<https://www.icann.org/resources/pages/registration-data-request-service-202…>.

1 0

New ICANN project on Malicious Domain Name Registrations
by Steve DelBianco April 26, 2023

April 26, 2023

Here<https://www.icann.org/en/blogs/details/new-icann-project-explores-the-drive…> and below is ICANN Org’s new blog related to DNS Abuse. New ICANN Project Explores the Drivers of Malicious Domain Name Registrations 25 April 2023 By Samaneh Tajalizadehkhoob<https://www.icann.org/> ________________________________ The Internet Corporation for Assigned Names and Numbers (ICANN) is funding a new project that aims to systematically analyze the preferences of cyberattackers and possible measures to mitigate malicious activities across top-level domains (TLDs). This new project is called Inferential Analysis of Maliciously Registered Domains (INFERMAL), and will be supervised by ICANN's Office of the Chief Technology Officer Security, Stability, and Resiliency team. This project is funded as a part of ICANN's Domain Name System (DNS) Security Threat Mitigation Program<https://www.icann.org/dns-security-threat>, which strives to make the Internet a safer place for end users by reducing the prevalence of DNS security threats across the Internet. When it comes to DNS security threats, one method cybercriminals use is to actively register domains to launch Internet-scale attacks, such as phishing, malware, and spam campaigns. There are many theoretical reasons why malicious actors may prefer to use the domain names of certain registrars over others. Some evidence<https://www.icann.org/en/system/files/files/sadag-final-09aug17-en.pdf> suggests, for example, that malicious actors may prefer registrars that provide low registration prices or that accept specific payment methods. They also may look for registrars that offer free application programming interfaces (APIs) for bulk registrations or avoid registrars that require certain information in the purchasing process. Nonetheless, no study has systematically examined the preferences of attackers. This new project, INFERMAL, aims to expand the knowledge in this area. ICANN is uniquely positioned to investigate this topic and has looked at the problem before. This investigation may also yield policy implications for ICANN. The findings could help registrars and registries identify relevant DNS anti-abuse practices. Reducing DNS abuse via domain names is good for the DNS industry and all Internet users. Such findings could strengthen the self-regulation of the overall domain name industry and could reduce the costs associated with domain regulations. The project would also help increase the security levels of domain names and, thus, the trust of end-users. The timing of the study should not be underappreciated. ICANN is launching this project as it is preparing for the next round of new generic TLDs and increasing efforts to promote Universal Acceptance (UA), having just celebrated the first-ever UA Day<https://uasg.tech/ua-day/>. ICANN's mission is to coordinate the global Internet's systems of unique identifiers, including the DNS. Our aim is to ensure a stable, secure, and unified global Internet. Dr. Maciej Korczyński<https://mkorczynski.com/> will serve as the scientific coordinator of the INFERMAL project. He is an Associate Professor of computer networks and cybersecurity at the Grenoble Institute of Technology in France. His main interests revolve around large-scale passive and active measurements and analysis of cybersecurity, with a focus on the DNS. Since 2015, he has co-authored over 30 scientific articles about domain name and DNS infrastructure abuse, DNS vulnerabilities, security metrics, Internet Protocol address spoofing, distributed denial-of-service attacks, botnets, and vulnerability notifications. So how will the project work? The project team plans to collect and analyze a comprehensive list of domain name registration policies pertinent to would-be attackers. This includes registration features such as an API registration panel, an ability to register in bulk, accepted payment methods (credit card, Bitcoin, or WebMoney), and retail pricing, among many other potential registry features. Using statistical modeling, the team plans to identify the registration factors preferred by attackers. We expect that the project will result in highly impactful scientific publications and industry presentations at the most relevant security, Internet stability, and policy conferences hosted by ICANN; the Messaging, Malware and Mobile Anti-Abuse Working Group; the DNS Operations, Analysis, and Research Center; and the Council of European National Country Code Top-Level Domain Registries. Another blog post will follow with a detailed timeline, information on the project website, and project deliverables. Stay tuned for our updates, and do not hesitate to contact us at octo(a)icann.org<mailto:octo@icann.org>. Authors [Samaneh Tajalizadehkhoob] Samaneh Tajalizadehkhoob Director, Security, Stability and Resiliency Research Read biography<https://www.icann.org/>

1 0

Registrant Data Request System (RDRS) Data Dictionary
by Steve DelBianco April 23, 2023

April 23, 2023

Yuko, Thank you for sharing the proposed data dictionary/data model. I will be in-flight during our 24-Apr small team call, so wanted to share these thoughts via email before the call. Since Cancun, the BC has been pressing ICANN staff to share their data model for the Registrant Data Request System (RDRS). We asked for the data model in order to understand whether RDRS would capture and retain enough detail to help us analyze the nature and origin of requests, evidence provided, reason given, etc. Also whether the requests result in disclosures, and why disclosure was denied. We are glad to see that the proposed (attached) data model does include the detail we sought. However, Yuko’s email below indicates ICANN will not make the detail available to community members for analysis. That’s different from when the BC agreed to proceed with SSAD Light. At that time, the staff design paper<https://www.icann.org/en/system/files/files/whois-disclosure-system-design-…> and addendum<https://gnso.icann.org/sites/default/files/policy/2022/correspondence/ducos…> indicated access to data, even for non-participating registrars: "The system will provide reporting on a periodic basis not to exceed the recommended durations. The exact form of the reporting is to be determined. It is envisioned that eventually the data will be made available through the Open Data platform for public consumption." (p.31) Staff added this to the addendum<https://gnso.icann.org/sites/default/files/policy/2022/correspondence/ducos…> at p.4: “To facilitate the evaluation of the WHOIS Disclosure System, the small team will continue to work with ICANN Org to ensure that the necessary data is available to ensure the proper evaluation of the Whois Disclosure System, taking into account legal limitations that may exist to share certain information.” As the BC representative on this Council small team<https://community.icann.org/pages/viewpage.action?pageId=186779415>, I am asked to continue pressing the need for someone ( ICANN staff or trusted experts ) to be prepared to perform detailed analysis of the data before drawing any conclusions about whether to proceed with a full-blown SSAD. From: GNSO-EPDPP2-SmallTeam <gnso-epdpp2-smallteam-bounces(a)icann.org> on behalf of Yuko Yokoyama <yuko.yokoyama(a)icann.org> Date: Wednesday, April 19, 2023 at 2:59 PM To: gnso-epdpp2-smallteam(a)icann.org <gnso-epdpp2-smallteam(a)icann.org> Subject: [GNSO-EPDPP2-SmallTeam] RDRS Data Dictionary Dear Small Team members, Please see attached ICANN org’s data dictionary for the Registration Data Request Service. This document provides all the data fields captured in the system from both requestor and registrar sides, in a more digestible manner than the ones in the Design Paper<https://www.icann.org/en/system/files/files/whois-disclosure-system-design-…>. * Tab 1: All the data fields captured in the requestor side of the System * Tab 2: All the data fields captured in the registrar side of the System * Tab 3: Reporting criteria specified in the Addendum<https://gnso.icann.org/sites/default/files/policy/2022/correspondence/ducos…> and whether those are reportable Please note, this document is being shared for the purpose of transparency and to showcase that the reporting criteria that are specified in the Addendum can be achieved with the data elements being collected. Additionally, our aim is that this document can aid in the Small Team’s discussion should it wish to add additional reporting criteria. We would like to add that ICANN org will not share any raw data collected through the System with external parties outside the System. While we understand the importance of transparency and accountability, we also want to ensure that ICANN org respects the privacy and the confidentiality of the requests logged through the system. The monthly reports will provide the necessary metrics as detailed in the Addendum, along with any other metrics deemed necessary by the Small Team to the extent that the data is available in a systematic manner, with the metrics being based on numerical and usage data. It should be noted that certain data elements listed in the data dictionary, for example, names of requestors, evidence and attachments, will not be analyzed or used as metrics for any other purpose that would go beyond gathering usage data. ICANN org ensured that the principles of privacy-by-design are embedded in the System’s design and development from its inception. Principles such as role-based data access limitation, data minimization, and data retention, were carefully considered and the publication of raw data would violate these principles. It is also important to remember that the purpose of this proof-of-concept system is not to perform contextual or content analysis, for example, evaluating the legitimacy of registrars’ disclosure decisions or analyzing outcome trends. We want to emphasize that GNSO Council's request and the ICANN Board's direction is to implement a cost-effective system that will simplify the process for submitting and receiving requests for nonpublic gTLD registration data for both the requestors and registrars and to report on usage of this system to help inform the Council–Board consultations on the next steps for the SSAD recommendations. Regards, Yuko Yokoyama Program Director Strategic Initiatives, Global Domains & Strategy Internet Corporation for Assigned Names and Numbers (ICANN) Direct Line: +1 310 578 8693 Mobile: +1 310 745 1517 E-mail: yuko.yokoyama(a)icann.org<mailto:yuko.yokoyama@icann.org> www.icann.org<http://www.icann.org/>

1 0

Re: [bc-gnso] Mason and Mark in the ICANN Deck of Cards
by Andrew Mack March 12, 2023

March 12, 2023

Bravo Superheroes! Andrew Mack Principal C: +1 (202) 256-1077 O: +1 (202) 642-6429 Skype: Andrew.Mack [signature_2312459691] www.amglobal.com<http://www.amglobal.com/> | amack(a)amglobal.com<mailto:amack@amglobal.com> From: Bc-gnso <bc-gnso-bounces(a)icann.org> on behalf of Steve DelBianco via Bc-gnso <bc-gnso(a)icann.org> Reply-To: Steve DelBianco <sdelbianco(a)netchoice.org> Date: Saturday, March 11, 2023 at 1:26 PM To: BC List <bc-gnso(a)icann.org> Subject: [bc-gnso] Mason and Mark in the ICANN Deck of Cards A rare treat for BC members attending ICANN75 in Cancun: The ICANN76 Deck of Players includes Mason and Mark D: [cid:image002.jpg@01D95504.76D793D0]

1 0

Policy Calendar for 13-Mar BC Meeting
by Steve DelBianco March 12, 2023

March 12, 2023

Here’s the Policy Calendar for the BC OPEN MEETING on 13-Mar (also in attachment “policy calendar.pdf”) Channel 1. BC participation in ICANN Public Comment process: On 28-Feb we commented<https://itp.cdn.icann.org/public-comment/proceeding/Proposed%20Procedure%20…> on Proposed Procedure<https://itp.cdn.icann.org/en/files/root-system/procedure-selecting-top-leve…> for Selecting a Top-Level Domain String for Private Use. (See comments page<https://www.icann.org/en/public-comment/proceeding/proposed-procedure-for-s…> and SAC 113<https://www.icann.org/en/system/files/files/sac-113-en.pdf>, published Sep-2020.). This is about locally-defined domain names that enterprises use to support their applications and infrastructure, where that domain TLD is not present in the root zone. “Two examples of private-use TLDs that are well known within the ICANN community are .corp and .home.” Thanks to Rajiv Prasad for drafting. On 13-Feb we commented<https://cbu.memberclicks.net/assets/docs/positions-statements/2023/2023_02F…> on the FY24-28 Operating & Financial Plan, FY24 Op plan & budget. (comments page<https://www.icann.org/en/public-comment/proceeding/draft-fy2428-operating-f…>). Thanks to Tim Smith for drafting. Selected ICANN Public Comments<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_public-2…> and other opportunities for the BC to comment: 1. proposed ICANN bylaws amendments<https://itp.cdn.icann.org/en/files/additional-reviews/proposed-amendments-t…> for the IANA Naming Function Review (comments page<https://www.icann.org/en/public-comment/proceeding/iana-naming-function-rev…>). Comments close 18-Apr. This review was added to ICANN bylaws as part of the IANA transition, to let customers of IANA naming function confirm performance of the IANA Naming Function Contract between ICANN and its affiliate, Public Technical Identifiers. In 2021 the BC supported<https://cbu.memberclicks.net/assets/docs/positions-statements/2021/2021_03M…> a minor amendment to the IANA contract. In 2020 we commented on the first IANA Naming Function Review<https://www.icannbc.org/assets/docs/positions-statements/2020/2020_12Decemb…>, thanks to Jimson Olufuye. Looking for volunteer(s) to draft a BC comment on these bylaw amendments. 2. NIS2, followed closely by Andrew Bennett, Nik Lagergren, and Marie Pattullo. NIS2 final text<https://www.europarl.europa.eu/doceo/document/A-9-2021-0313-AM-281-281_EN.p…> was approved by European Parliament on 10-Nov, and by Council on 28-Nov. That final text published on 27-Dec<https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=OJ:L:2022:333:FULL&…> (p.82), which begins the 21-month period for Member States to transpose into national laws and regulations. See Caroline’s 12-Mar email regarding NIS2 discussions in Cancun on Saturday. Channel 2. Support for discussion and votes of our representatives on GNSO Council Marie Pattullo and Mark Datysgeld are our GNSO Councilors. Previous Council meeting was 16-Feb. See Agenda<https://community.icann.org/x/mgjVD>, Transcript<https://gnso.icann.org/sites/default/files/policy/2023/transcript/transcrip…>, Zoom Recording<https://icann.zoom.us/rec/share/qYmJbvdD2iftNPPz29ZL3fJUNMO2_e0asCMeWlcTRWl…>. Meeting highlights include: Unanimously approved amended charter<https://gnso.icann.org/sites/default/files/policy/2023/correspondence/novoa…> for Transfer Policy Review PDP and Project Change Request<https://gnso.icann.org/sites/default/files/policy/2023/correspondence/carne…> Unanimously approved revised Charter<https://gnso.icann.org/sites/default/files/policy/2023/draft/draft-scbo-cha…> for the Budget and Operations Townhall (formerly known as the SCBO). Next Council meeting is 15-Mar at 18:15 UTC while in Cancun. Agenda<https://community.icann.org/display/gnsocouncilmeetings/Final+Proposed+Agen…> highlights include: Item 4: Vote on adopting Council committee to oversee continuous improvement recommendations<https://gnso.icann.org/sites/default/files/policy/2023/correspondence/chen-…> Item 5: Discuss next steps for Expired Domain Deletion Policy and Recovery Policy, small team recommendation<https://docs.google.com/document/d/1zxxyIsg7HVGtAK7HsaTfw3nMX_zZfY3hUrdiDoa…>. Item 6: Discuss GNSO projects that may impact SubPro timeline Item 7: Continue discussing SubPro Item 8: Discuss next steps for Whois Disclosure System Steve is on Council small team<https://community.icann.org/pages/viewpage.action?pageId=186779415> on SSAD ODA<https://www.icann.org/en/system/files/files/ssad-oda-25jan22-en.pdf>, to review a“ticketing system” without obligations for use or for disclosure. On 13-Sep ICANN staff released a design paper<https://www.icann.org/en/system/files/files/whois-disclosure-system-design-…>. Highlights: ICANN org says development over nine months; development and two-year maintenance would be $100,000 * It does not include accreditation of the requestors. * It does not include a billing function or any fees to the requestor. * There is no obligation of automated processing of requests by contracted parties. We pushed for logging and reporting of request data, even when the registrar is not currently participating. The design paper<https://www.icann.org/en/system/files/files/whois-disclosure-system-design-…> and addendum<https://gnso.icann.org/sites/default/files/policy/2022/correspondence/ducos…> indicate access to data, even for non-participating registrars: "The system will provide reporting on a periodic basis not to exceed the recommended durations. The exact form of the reporting is to be determined. It is envisioned that eventually the data will be made available through the Open Data platform for public consumption." (p.31) Marika (Staff) added this to the addendum<https://gnso.icann.org/sites/default/files/policy/2022/correspondence/ducos…> at p.4: “To facilitate the evaluation of the WHOIS Disclosure System, the small team will continue to work with ICANN Org to ensure that the necessary data is available to ensure the proper evaluation of the Whois Disclosure System, taking into account legal limitations that may exist to share certain information.” See Council’s 17-Nov letter to the Board<https://www.icann.org/en/system/files/correspondence/ducos-to-sinha-17nov22…>. On 27-Feb-2023 the Board directed<https://www.icann.org/en/board-activities-and-meetings/materials/approved-r…> ICANN org to develop the Whois Disclosure System within 11 months. On 11-Mar-2023 the small team held a session in Cancun to hear about progress from Org’s development team. The system is now named Registration Data Request Service Steve asked for the data model, up-front. To include images of screenshots submitted with requests. Granularity of reporting can be adjusted later. Suggested batch request feature from vendors like AppDetex and Fairwinds Steve said: Usage has 2 dimensions: Quantity of requests and responses Quality of requests (origin, reason, detail, registrar, domain name, etc.) Staff said they can evolve the data model over time (huh?). Asked us to say what we want reported. Other Council activities: 1. Closed Generic gTLDs in the next round. following an invitation from the Board, GNSO and GAC will “formulate a workable framework to identify and handle closed generic applications for the immediate next round of new gTLDs”, and in this dialogue we will be joined by ALAC. The framework discussion will focus on options other than the two endpoint positions (i.e. no closed generics at all; closed generics without restrictions) as per the Board’s Proposed Parameters for Dialogue. As discussed on our 14-Nov call, Steve researched prior BC positions on closed generic going back a decade to our comments during the 2012 round of gTLD expansion. See attached email from Steve with the full explanation. To summarize In a sentence, we’d say: The BC would be concerned about consumer deception and competitor exclusion if a single competitor in an industry manages a closed TLD where the TLD string is closely identified with the industry. For example, say a travel company or a hotel chain runs .HOTELS as a closed TLD -- not allowing competitors to register second level names, while also controlling content on domains such as search.hotels, eco.hotels, family.hotels, best.hotels, cheap.hotels, luxury.hotels, etc. It’s easy to see how the TLD owner could bias content and search results on those consumer information sites, without consumers being fully aware. 2. Transfer Policy Working Group. (Zak Muscovitch and Arinola Akinyemi). Work group evaluated public comment report<https://itp.cdn.icann.org/en/files/inter-registrar-transfer-policy-irtp/sum…> on its initial report<https://itp.cdn.icann.org/en/files/inter-registrar-transfer-policy-irtp/tra…>. Now discussing Charter Questions<https://docs.google.com/document/d/1i6tLO_qbSa-ace0BnKaAn7voP1UA1RjYlrRo2Zn…> related to the Transfer Dispute Resolution Policy (TDRP) 3. GNSO Guidance Process (GGP). (Lawrence Olawale-Roberts). Work on Applicant Support kicks off on Monday, 21 November at 1500 UTC with an initial call of the working group. The main wiki pag<https://community.icann.org/display/GGPGIRFAS/GNSO+Guidance+Process+%28GGP%…>e that provides the status and background of the task and the page that lists the Members and Alternates<https://community.icann.org/display/GGPGIRFAS/Members+and+Mailing+List> are linked within. Observers will have ability to view member chat and information shared in the zoom webinar room, but observers will not be able to use chat or raise hands during sessions. BC member Segunfunmi Olajide has signed up as an observer. 4. DNS Abuse small team. Mark Datysgeld serves as co-lead. CPH representatives met with ICANN Org for negotiations on RAA and RyA amendments to address DNS Abuse. (Sally’s letter<https://www.icann.org/en/system/files/correspondence/costerton-to-heineman-…>). To inform that negotiation, Mason drafted and sent this letter<https://www.icann.org/en/system/files/correspondence/cole-et-al-to-sinha-co…> from BC, IPC, and ALAC on 23-Jan Channel 3. Supporting discussion/voting on matters before the Commercial Stakeholders Group (CSG) Tim Smith is the CSG Liaison for the BC. See final schedule for ICANN 76 in Cancun<https://icann76.sched.com/>, 11-Mar thru 16-Mar Board Seat 14. CSG ExComm has now offered 2 candidates to NCSG and are awaiting their consideration. Determining the candidate who will be put forward on behalf of the NCPH will likely take us through ICANN 76 and we are hopeful we can find a common candidate from the two SGs. CSG is also seeking more ongoing dialogue with NCSG and our ExComm has proposed more regular meetings, even intersessional between ICANN meetings, to discuss our common interests. ICANN Board and CSG will meet – Tuesday, March 14, 21:30 UTC (4:30pm) Additional upcoming meetings CPH DNS Abuse Outreach – Monday, March 13, 18:15 UTC (1:15pm) CSG Membership Meeting – Tuesday, March 14, 15:30 UTC (10:30am)

1 0

Mason and Mark in the ICANN Deck of Cards
by Steve DelBianco March 11, 2023

March 11, 2023

A rare treat for BC members attending ICANN75 in Cancun: The ICANN76 Deck of Players includes Mason and Mark D: [cid:image001.jpg@01D9541D.006E6580]

1 0

DNS Abuse Institute Newsletter - March 2023
by Steve DelBianco March 11, 2023

March 11, 2023

For those BC members who are interested. View this email in your browser<https://mailchi.mp/dnsabuseinstitute.org/dns-abuse-institute-newsletter-oct…> [https://mcusercontent.com/feb87794e3b3c6cb0d7949bdf/images/8f06597e-6713-73…] MARCH 2023 EDITION With ICANN 76 in Cancun drawing near, it seemed a good time to provide an update on the activities of the DNS Abuse Institute. Below we’ve got news on our measurement project DNSAI Compass™, NetBeacon™, and some recent work on bulk domain registrations. DNSAI COMPASS We have now been publishing data<https://dnsabuseinstitute.us16.list-manage.com/track/click?u=feb87794e3b3c6…> as part of our measurement initiative for over 6 months. The intention of Compass is to establish a credible source of metrics for addressing DNS Abuse. We hope this will enable focused conversations, and identify opportunities for improvement, help us understand through these reports which factors, policies, and processes are effective, and empower the industry with evidence. As Compass matures, we’re working towards public reporting on individual Top Level Domains (TLD) and registrar performance. Our aim is to celebrate and recognize observed good practice, as well as shine a spotlight on potential for areas of improvement in the industry. We’ve also been working on developing individualized reports for registrars and TLDs ahead of ICANN76 in Cancun. These are the reports we show to registrars and registry operators when we meet with them directly to give them a sense of how they’re doing. These are not for public consumption and we do not intend to publish them. However, they do contain a number of metrics which could be used as part of an approach to public reporting. For those of you headed to ICANN76, we’ll be presenting at the CPH DNS Abuse Outreach Session during the 'upcoming community work' section, and giving a preview of some of the data we hold (with permission from the relevant registry and registrar). This session takes place at 13:15 Cancun (UTC-5), 13 March 2023<https://dnsabuseinstitute.us16.list-manage.com/track/click?u=feb87794e3b3c6…>. We’re offering an opportunity for all registries and registrars to meet with us and view the domain registration and abuse data we have collected on your registrar/registry. If you would like to chat with us in person in Cancun, Please contact us<https://dnsabuseinstitute.us16.list-manage.com/track/click?u=feb87794e3b3c6…> for more information or book a time<https://dnsabuseinstitute.us16.list-manage.com/track/click?u=feb87794e3b3c6…> directly. Alternatively, we can organize a virtual meeting later in March/April 2023. NETBEACON When we began developing NetBeacon<https://dnsabuseinstitute.us16.list-manage.com/track/click?u=feb87794e3b3c6…>, our free abuse reporting system, we concentrated on ensuring it had the features needed to improve the experience of receiving reports for Registrars. This meant ensuring reports were standardized, enriched with useful information, and distributed to where registrars wanted to get them. While there is always more work to do on the recipient side, we’ve been recently working to add useful features for the people and organizations that wish to report DNS Abuse. We’re pleased to announce that NetBeacon now has the ability to “verify” abuse reporters. Anyone who represents an organization can request verification from the Identity settings page in NetBeacon. This allows verified abuse reporters to include their organization name in report subject lines, and to include boilerplate text on every abuse report they submit. We’ve got a number of other reporter-specific features in the pipeline we look forward to sharing soon. Check out NetBeacon here<https://dnsabuseinstitute.us16.list-manage.com/track/click?u=feb87794e3b3c6…>. PUBLICATIONS Letter to the GNSO on Bulk Registrations In January, the DNSAI received a letter from the GNSO asking for information on the relationship between bulk domain registration and DNS Abuse. We recently published our response here<https://dnsabuseinstitute.us16.list-manage.com/track/click?u=feb87794e3b3c6…>. Briefly, we surveyed all the research we could find on bulk registrations, and found that there were no consistent definitions of the issue. In addition, none of the research attempted to understand what proportion of bulk registered domains were abusive, only that some abusive domains were registered in bulk. While we’re conducting our own investigations into the issue, it seems clear to us that more research would be necessary to justify work from the community. Best Practices Anti-Fraud Tools and Registration Flows for Registrars<https://dnsabuseinstitute.us16.list-manage.com/track/click?u=feb87794e3b3c6…> Making Phishing Reports Useful<https://dnsabuseinstitute.us16.list-manage.com/track/click?u=feb87794e3b3c6…> Abuse Reporter Expectation Management<https://dnsabuseinstitute.us16.list-manage.com/track/click?u=feb87794e3b3c6…> Generic Abuse Policy for Registrars and Registries<https://dnsabuseinstitute.us16.list-manage.com/track/click?u=feb87794e3b3c6…> Secure Your Website, Save the Internet<https://dnsabuseinstitute.us16.list-manage.com/track/click?u=feb87794e3b3c6…> DNSAI IN THE NEWS DNSAI Compass: Six Months of Measuring Phishing and Malware An article the Institute published in CircleID<https://dnsabuseinstitute.us16.list-manage.com/track/click?u=feb87794e3b3c6…> to share information on lessons learnt six months on measuring phishing and malware. Introduction to the Institute in Spanish Thank you to .ec for hosting us on their webinar and translating our introduction to the Institute into Spanish. Available online<https://dnsabuseinstitute.us16.list-manage.com/track/click?u=feb87794e3b3c6…> (at 38 mins). UPCOMING EVENTS ICANN Cancun We will be available for meetings with interested parties. In particular, if you’re a registrar or registry and you haven’t met with us to view your unpublished data we encourage you to do so. You can book a meeting here<https://dnsabuseinstitute.us16.list-manage.com/track/click?u=feb87794e3b3c6…>. Nordic Domain Days Graeme will be in Stockholm for Nordic Domain Days, May 8th & 9th, 2023. We’ll be participating in a DNS Abuse workshop, and introducing everyone to NetBeacon and our Compass reporting. If you’re planning on attending and want to catch up, please reach out. Thanks for reading, and as usual, please feel free to reach out directly. Graeme Bunton, Executive Director, DNS Abuse Institute @graemebunton graeme(a)dnsabuseinstitute.org<mailto:graeme@dnsabuseinstitute.org> [Twitter]<https://dnsabuseinstitute.us16.list-manage.com/track/click?u=feb87794e3b3c6…> [Facebook]<https://dnsabuseinstitute.us16.list-manage.com/track/click?u=feb87794e3b3c6…> [Website]<https://dnsabuseinstitute.us16.list-manage.com/track/click?u=feb87794e3b3c6…> Copyright © 2023 Public Interest Registry, All rights reserved. You are receiving this email because you joined our news mailing list at the dnsabuseinstitute.org website. Our mailing address is: Public Interest Registry 11911 Freedom Dr Ste 1000 Reston, VA 20190-5631 Add us to your address book<https://dnsabuseinstitute.us16.list-manage.com/vcard?u=feb87794e3b3c6cb0d79…> Want to change how you receive these emails? You can update your preferences<https://dnsabuseinstitute.us16.list-manage.com/profile?u=feb87794e3b3c6cb0d…> or unsubscribe from this list<https://dnsabuseinstitute.us16.list-manage.com/unsubscribe?u=feb87794e3b3c6…>.

1 0