I'm all for expanding the clause to include non-IP abuse. On Sep 3, 2013, at 1:08 PM, "Andy Abrams" <abrams@google.com<mailto:abrams@google.com>> wrote: Hi Steve, We really appreciate your work on this document and your efforts to capture the discussions from last week. Our only minor follow-up comment relates to the use of the term "donations" in the first sentence of "Eligibility for Protected Registration." Per our previous comment, I think there are some issues with including "donations" as a per se reason to disqualify one from taking advantage of privacy/proxy services, given the frequent connection between donations and political or other free speech. With that said, I recognize that there is value in preventing a specific abuse relating to donations, namely, charity scams that solicit money. Perhaps we can reach a compromise by removing the term from the sentence, but by broadening the second clause in the sentence to include other abuses beyond IP infringement, including phishing, malware, financial scams, etc. We'd love to hear others' views on this point. Best, Andy and Aparna On Mon, Sep 2, 2013 at 8:49 AM, Steve DelBianco <sdelbianco@netchoice.org<mailto:sdelbianco@netchoice.org>> wrote: As a follow-up to Thursday's BC call, here's a new draft for member review. First thing I did was re-read the EWG report on which we are commenting. (link<http://www.icann.org/en/groups/other/gtld-directory-services/initial-report-24jun13-en.pdf>) It's also helpful to review FAQs published by the EWG (link<http://www.icann.org/en/groups/other/gtld-directory-services/faqs>) Second thing I did was review prior BC positions on this, starting with our Jul-2011 "Response to WHOIS Policy Review Team Discussion Paper" (link<http://www.bizconst.org/Positions-Statements/BC_on_WHOIS_Review_Questions.pdf>) where the BC said: "ICANN should also consider mechanisms to create and maintain a centralized WHOIS database." Also see Jun-2012 BC comment on WHOIS Affirmation Review (link<http://www.bizconst.org/Positions-Statements/BC%20on%20WHOIS%20RT%20Final%20Report.pdf>), where we endorsed privacy/proxy obligations: • Adopting agreed standardized relay and reveal processes and timeframes • Conducting periodic due diligence checks on customer contact information; • Providing clear and unambiguous guidance on the rights and responsibilities of registered name holders, and how those should be managed in the Privacy / Proxy environment. And see our May-2013 comments on the new RAA (link<http://www.bizconst.org/Positions-Statements/BC%20Comment%20on%20final%202013%20RAA%20%5BFINAL%5D.pdf>), where we proposed Relay and Reveal obligations and timelines for privacy/proxy services. Then I started with our 9-Aug draft comments and added discussion from 29-Aug BC member call. Attached is my 2-Sep draft, plus a redline comparing with the previous draft distributed (9-Aug). Please REPLY ALL with objections or comments before Thursday 5-Sep so we can meet the EWG deadline of 6-Sep. Looking forward to an informed and respectful discussions, so we can get our thoughts to the EWG while they are working on their final report for October publication. -- Steve DelBianco Executive Director NetChoice http://www.NetChoice.org and http://blog.netchoice.org +1.202.420.7482<tel:%2B1.202.420.7482> -- Andy Abrams | Trademark Counsel Google | 1600 Amphitheatre Parkway, Mountain View, CA 94043 (650) 669-8752<https://www.google.com/voice#phones>

Certainly willing to hear more from others who may disagree but I think text is appropriate as is (sites seeking donations do not get privacy/proxy services); I have work experience relating to trying to deal with potentially scam fund raisers after 9/11. Laura Covington VP, Intellectual Property Policy Yahoo! Inc. lhc@yahoo-inc.com 408.349.5187 From: Steve DelBianco <sdelbianco@netchoice.org<mailto:sdelbianco@netchoice.org>> Date: Tuesday, September 3, 2013 3:02 PM To: "Smith, Bill" <bill.smith@paypal-inc.com<mailto:bill.smith@paypal-inc.com>>, Andy Abrams <abrams@google.com<mailto:abrams@google.com>> Cc: "bc-gnso@icann.org<mailto:bc-gnso@icann.org> list" <bc-gnso@icann.org<mailto:bc-gnso@icann.org>> Subject: Re: [bc-gnso] FOR REVIEW: Latest draft of BC comments on Expert Working Group (EWG) for directory services (Whois) Yes, but that's not entirely Andy's point, Bill. Andy first suggested we allow privacy protections for a website that solicited donations. Do BC members believe that donation-soliciting sites should be eligible for privacy/proxy services? As Andy notes, donors are often fooled by sites that pretend to be a reputable group helping with an emergency. The Red Cross/Red Crescent has talked about this at ICANN before. Should we really be recommending that ICANN allow privacy/proxy services for any site that solicits donations, as opposed to payments for services/goods/ads? Please read (and react) to the text proposed for this section (page 2, re-attached for your convenience), because the discussion thread sometimes tells only half the story… From: <Smith>, Bill <bill.smith@paypal-inc.com<mailto:bill.smith@paypal-inc.com>> Date: Tuesday, September 3, 2013 5:19 PM To: Andy Abrams <abrams@google.com<mailto:abrams@google.com>> Cc: Steve DelBianco <sdelbianco@netchoice.org<mailto:sdelbianco@netchoice.org>>, "bc-gnso@icann.org<mailto:bc-gnso@icann.org> list" <bc-gnso@icann.org<mailto:bc-gnso@icann.org>> Subject: Re: [bc-gnso] FOR REVIEW: Latest draft of BC comments on Expert Working Group (EWG) for directory services (Whois) I'm all for expanding the clause to include non-IP abuse. On Sep 3, 2013, at 1:08 PM, "Andy Abrams" <abrams@google.com<mailto:abrams@google.com>> wrote: Hi Steve, We really appreciate your work on this document and your efforts to capture the discussions from last week. Our only minor follow-up comment relates to the use of the term "donations" in the first sentence of "Eligibility for Protected Registration." Per our previous comment, I think there are some issues with including "donations" as a per se reason to disqualify one from taking advantage of privacy/proxy services, given the frequent connection between donations and political or other free speech. With that said, I recognize that there is value in preventing a specific abuse relating to donations, namely, charity scams that solicit money. Perhaps we can reach a compromise by removing the term from the sentence, but by broadening the second clause in the sentence to include other abuses beyond IP infringement, including phishing, malware, financial scams, etc. We'd love to hear others' views on this point. Best, Andy and Aparna On Mon, Sep 2, 2013 at 8:49 AM, Steve DelBianco <sdelbianco@netchoice.org<mailto:sdelbianco@netchoice.org>> wrote: As a follow-up to Thursday's BC call, here's a new draft for member review. First thing I did was re-read the EWG report on which we are commenting. (link<http://www.icann.org/en/groups/other/gtld-directory-services/initial-report-24jun13-en.pdf>) It's also helpful to review FAQs published by the EWG (link<http://www.icann.org/en/groups/other/gtld-directory-services/faqs>) Second thing I did was review prior BC positions on this, starting with our Jul-2011 "Response to WHOIS Policy Review Team Discussion Paper" (link<http://www.bizconst.org/Positions-Statements/BC_on_WHOIS_Review_Questions.pdf>) where the BC said: "ICANN should also consider mechanisms to create and maintain a centralized WHOIS database." Also see Jun-2012 BC comment on WHOIS Affirmation Review (link<http://www.bizconst.org/Positions-Statements/BC%20on%20WHOIS%20RT%20Final%20Report.pdf>), where we endorsed privacy/proxy obligations: • Adopting agreed standardized relay and reveal processes and timeframes • Conducting periodic due diligence checks on customer contact information; • Providing clear and unambiguous guidance on the rights and responsibilities of registered name holders, and how those should be managed in the Privacy / Proxy environment. And see our May-2013 comments on the new RAA (link<http://www.bizconst.org/Positions-Statements/BC%20Comment%20on%20final%202013%20RAA%20%5BFINAL%5D.pdf>), where we proposed Relay and Reveal obligations and timelines for privacy/proxy services. Then I started with our 9-Aug draft comments and added discussion from 29-Aug BC member call. Attached is my 2-Sep draft, plus a redline comparing with the previous draft distributed (9-Aug). Please REPLY ALL with objections or comments before Thursday 5-Sep so we can meet the EWG deadline of 6-Sep. Looking forward to an informed and respectful discussions, so we can get our thoughts to the EWG while they are working on their final report for October publication. -- Steve DelBianco Executive Director NetChoice http://www.NetChoice.org and http://blog.netchoice.org +1.202.420.7482<tel:%2B1.202.420.7482> -- Andy Abrams | Trademark Counsel Google | 1600 Amphitheatre Parkway, Mountain View, CA 94043 (650) 669-8752<https://www.google.com/voice#phones>

I support expanding the clause as well to include malware, phishing, etc. From: bill.smith@paypal-inc.com To: abrams@google.com CC: sdelbianco@netchoice.org; bc-gnso@icann.org Subject: Re: [bc-gnso] FOR REVIEW: Latest draft of BC comments on Expert Working Group (EWG) for directory services (Whois) Date: Tue, 3 Sep 2013 21:19:36 +0000 I'm all for expanding the clause to include non-IP abuse. On Sep 3, 2013, at 1:08 PM, "Andy Abrams" <abrams@google.com> wrote: Hi Steve, We really appreciate your work on this document and your efforts to capture the discussions from last week. Our only minor follow-up comment relates to the use of the term "donations" in the first sentence of "Eligibility for Protected Registration." Per our previous comment, I think there are some issues with including "donations" as a per se reason to disqualify one from taking advantage of privacy/proxy services, given the frequent connection between donations and political or other free speech. With that said, I recognize that there is value in preventing a specific abuse relating to donations, namely, charity scams that solicit money. Perhaps we can reach a compromise by removing the term from the sentence, but by broadening the second clause in the sentence to include other abuses beyond IP infringement, including phishing, malware, financial scams, etc. We'd love to hear others' views on this point. Best, Andy and Aparna On Mon, Sep 2, 2013 at 8:49 AM, Steve DelBianco <sdelbianco@netchoice.org> wrote: As a follow-up to Thursday's BC call, here's a new draft for member review. First thing I did was re-read the EWG report on which we are commenting. (link) It's also helpful to review FAQs published by the EWG (link) Second thing I did was review prior BC positions on this, starting with our Jul-2011 "Response to WHOIS Policy Review Team Discussion Paper" (link) where the BC said: "ICANN should also consider mechanisms to create and maintain a centralized WHOIS database." Also see Jun-2012 BC comment on WHOIS Affirmation Review (link), where we endorsed privacy/proxy obligations: • Adopting agreed standardized relay and reveal processes and timeframes • Conducting periodic due diligence checks on customer contact information; • Providing clear and unambiguous guidance on the rights and responsibilities of registered name holders, and how those should be managed in the Privacy / Proxy environment. And see our May-2013 comments on the new RAA (link), where we proposed Relay and Reveal obligations and timelines for privacy/proxy services. Then I started with our 9-Aug draft comments and added discussion from 29-Aug BC member call. Attached is my 2-Sep draft, plus a redline comparing with the previous draft distributed (9-Aug). Please REPLY ALL with objections or comments before Thursday 5-Sep so we can meet the EWG deadline of 6-Sep. Looking forward to an informed and respectful discussions, so we can get our thoughts to the EWG while they are working on their final report for October publication. -- Steve DelBianco Executive Director NetChoice http://www.NetChoice.org and http://blog.netchoice.org +1.202.420.7482 -- Andy Abrams | Trademark Counsel Google | 1600 Amphitheatre Parkway, Mountain View, CA 94043 (650) 669-8752

Thanks Steve. I have no objections with the paragraph below. I would suggest that on page 6, if we accept that users should pay a fee for gated access that we should qualify that by saying the fee should be limited to cost recovery. In fact, I question whether gated access shouldn't be part of the cost of doing business for registrars. I would welcome thoughts from others. Thanks for all of your efforts in coordinating these comments. From: owner-bc-gnso@icann.org [mailto:owner-bc-gnso@icann.org] On Behalf Of Steve DelBianco Sent: Friday, September 06, 2013 1:04 AM To: bc-gnso@icann.org list Subject: [bc-gnso] LAST CALL: BC comments on Expert Working Group (EWG) for directory services (Whois) Importance: High This is "Last Call" for members who would object to filing the attached comments by tomorrow's deadline. Since I circulated a draft on Monday, we have seen no objections. But we did see some excellent debate about this paragraph: Eligibility for privacy/proxy protection should only be extended to registrants who promise not to solicit sales, payments, or donations, and promise not to facilitate infringement of intellectual property rights. And the EWG's "Maximum Protected Registration" should only be available to registrants who demonstrate a need for privacy to protect at-risk free-speech uses. Google questioned the idea of per-se restricting donation-seeking domains from using privacy/proxy services. Looks to me like the majority of subsequent comments were in favor of retaining the per-se restriction above. But as a by-product of that discussion, several of you wanted to add a few more offenses to the list of things that privacy/proxy eligible domains would promise not to do. So I've revised that first sentence to read: Eligibility for privacy/proxy protection should only be extended to registrants who promise not to solicit sales, payments, or donations, and promise not to facilitate infringement of intellectual property rights, distribution of malware, phishing, or other fraud. Unless more than 5 members object, I will file these comments by 3pm EST on Friday 6-Sep. From: Steve DelBianco <sdelbianco@netchoice.org<mailto:sdelbianco@netchoice.org>> Date: Monday, September 2, 2013 11:45 AM To: "bc-gnso@icann.org<mailto:bc-gnso@icann.org> list" <bc-gnso@icann.org<mailto:bc-gnso@icann.org>> Subject: FOR REVIEW: Latest draft of BC comments on Expert Working Group (EWG) for directory services (Whois) As a follow-up to Thursday's BC call, here's a new draft for member review. First thing I did was re-read the EWG report on which we are commenting. (link<http://www.icann.org/en/groups/other/gtld-directory-services/initial-report-24jun13-en.pdf%20>) It's also helpful to review FAQs published by the EWG (link<http://www.icann.org/en/groups/other/gtld-directory-services/faqs%20>) Second thing I did was review prior BC positions on this, starting with our Jul-2011 "Response to WHOIS Policy Review Team Discussion Paper" (link<http://www.bizconst.org/Positions-Statements/BC_on_WHOIS_Review_Questions.pdf%20>) where the BC said: "ICANN should also consider mechanisms to create and maintain a centralized WHOIS database." Also see Jun-2012 BC comment on WHOIS Affirmation Review (link<http://www.bizconst.org/Positions-Statements/BC%20on%20WHOIS%20RT%20Final%20Report.pdf%20>), where we endorsed privacy/proxy obligations: * Adopting agreed standardized relay and reveal processes and timeframes * Conducting periodic due diligence checks on customer contact information; * Providing clear and unambiguous guidance on the rights and responsibilities of registered name holders, and how those should be managed in the Privacy / Proxy environment. And see our May-2013 comments on the new RAA (link<http://www.bizconst.org/Positions-Statements/BC%20Comment%20on%20final%202013%20RAA%20%5BFINAL%5D.pdf%20>), where we proposed Relay and Reveal obligations and timelines for privacy/proxy services. Then I started with our 9-Aug draft comments and added discussion from 29-Aug BC member call. Attached is my 2-Sep draft, plus a redline comparing with the previous draft distributed (9-Aug). Please REPLY ALL with objections or comments before Thursday 5-Sep so we can meet the EWG deadline of 6-Sep. Looking forward to an informed and respectful discussions, so we can get our thoughts to the EWG while they are working on their final report for October publication. -- Steve DelBianco Executive Director NetChoice http://www.NetChoice.org and http://blog.netchoice.org +1.202.420.7482 This message and its attachments may contain legally privileged or confidential information. It is intended solely for the named addressee. If you are not the addressee indicated in this message (or responsible for delivery of the message to the addressee), you may not copy or deliver this message or its attachments to anyone. Rather, you should permanently delete this message and its attachments and kindly notify the sender by reply e-mail. Any content of this message and its attachments that does not relate to the official business of Twenty-First Century Fox, Inc. or its subsidiaries must be taken not to have been sent or endorsed by any of them. No representation is made that this email or its attachments are without defect.

This is "Last Call" regarding proposed BC comments on Rights Protection Mechanism (RPM) requirements (attached). This public comment (link<http://www.icann.org/en/news/public-comment/rpm-requirements-06aug13-en.htm>) closes 18-Sep. Here's the history on this comment draft: We circulated Elisa Cooper's initial draft on 26-Aug and discussed on our member call on 29-Aug. Andy Abrams (Google) quickly suggested "a minimum 60-day combined sunrise/notice period as opposed to a minimum 30-day notice period and minimum 30-day sunrise period." Liz (FairWinds), Laura (Yahoo), and Marie (AIM) agreed with Andy's suggestion. As did Elisa, who circulated a new draft on 3-Sep. Members who would object to the attached comment should REPLY ALL by 17-Sep indicating concerns. Unless more than 5 members object, I will file these comments on 18-Sep. Thanks to Elisa and Andy for their work on this comment. -- Steve DelBianco Executive Director NetChoice http://www.NetChoice.org and http://blog.netchoice.org +1.202.420.7482

Steve, All: Thanks so much for circulating the BC comments and for adding your edits. The BC concerns are confirmed by a report Verisign just released today (attached). Verisign did a deep dive into just one of the new gTLDs -- .CBA, which was applied for by the Commonwealth Bank of Australia. The bank wrote a letter to ICANN complaining that .cba had been improperly categorized by ICANN as "uncalculated risk" and asked to be changed to the "low risk" category. They said that any name collision that the Interisle report reported as coming from this string was their own traffic and they could remediate it. In fact, the Verisign report showed that Commonwealth Bank of Australia at best controls 6% of the root server traffic associated with the .cba string. The rest of the traffic, which, presents numerous risks of collision, was coming from over 170 countries including a significant portion of traffic from Japan. The traffic comes from a variety of servers, smart home devices, offices, residences, etc. This small snapshot of one new gTLD shouts out for ICANN to do a deeper dive into the new gTLDs to really understand these risks. The .cba string (unlike. .corp or .home) is not one that anyone would intuitively think could result in collisions. But in a global environment, it highlights that we really have no idea what different cultures have previously named their internal servers and devices. How many of these enterprises even know ICANN and the new gTLD launch exists? Also, the study shows ICANN cannot rely (as they are intending to do today) solely on their applicants to provide evidence of "acceptable" risk. I hope the BC comments can add a line or two about this report to flag the risks to large and small BC members and our customers. Thanks, Sarah

Sarah, thanks for forwarding this. there are several other similar examples where an applicant doesn't have the breadth of contacts, or expertise to address the 'issue' raised by risks. I had asked for stronger language in voicing concerns. Citing the Verisign study as an example of the importance of further study, before proceeding with the staff recommendation to leave all things and all responsibility to applicants, is one possible addition to the comments. Another issue though, is the point I made about just assuming that calls to identify an IP address will lead automatically to a single contact within an organization/company, and that it is a direct line of then ability to understand the question, take action, and actually get authorization internally to take action is simply false. Even if that were a direct path, As Sarah points out, as documented in the Verisign study, it is not a single point of concern, but a 'number' yet to be determined and yet to be contacted and notified. I fully support Sarah's suggestions, and went a little farther. Marilyn Cade Le 16 sept. 2013 à 05:36, "Deutsch, Sarah B" <sarah.b.deutsch@verizon.com> a écrit :Steve, All: Thanks so much for circulating the BC comments and for adding your edits. The BC concerns are confirmed by a report Verisign just released today (attached). Verisign did a deep dive into just one of the new gTLDs -- .CBA, which was applied for by the Commonwealth Bank of Australia. The bank wrote a letter to ICANN complaining that .cba had been improperly categorized by ICANN as “uncalculated risk” and asked to be changed to the “low risk” category. They said that any name collision that the Interisle report reported as coming from this string was their own traffic and they could remediate it. In fact, the Verisign report showed that Commonwealth Bank of Australia at best controls 6% of the root server traffic associated with the .cba string. The rest of the traffic, which, presents numerous risks of collision, was coming from over 170 countries including a significant portion of traffic from Japan. The traffic comes from a variety of servers, smart home devices, offices, residences, etc. This small snapshot of one new gTLD shouts out for ICANN to do a deeper dive into the new gTLDs to really understand these risks. The .cba string (unlike. .corp or .home) is not one that anyone would intuitively think could result in collisions. But in a global environment, it highlights that we really have no idea what different cultures have previously named their internal servers and devices. How many of these enterprises even know ICANN and the new gTLD launch exists? Also, the study shows ICANN cannot rely (as they are intending to do today) solely on their applicants to provide evidence of “acceptable” risk. I hope the BC comments can add a line or two about this report to flag the risks to large and small BC members and our customers. Thanks, Sarah <Verisign CBA Name Collision Study and Letter to ICANN Board (2).pdf>

Thank you again Steve. Best, Elisa Elisa Cooper Director of Product Marketing MarkMonitor Elisa Cooper Chair ICANN Business Constituency 208 389-5779 PH From: owner-bc-gnso@icann.org [mailto:owner-bc-gnso@icann.org] On Behalf Of Steve DelBianco Sent: Saturday, September 14, 2013 9:03 PM To: bc-gnso@icann.org list Subject: [bc-gnso] LAST CALL: BC comment on Proposal to Mitigate Name Collision Risks (filing deadline 17-Sep) Importance: High This is "Last Call" regarding proposed BC comments on ICANN's Proposal to Mitigate Name Collision Risks (attached). This public comment (link<http://www.icann.org/en/news/public-comment/name-collision-05aug13-en.htm>) closes 17-Sep. Here's the history on this comment draft: We circulated Elisa Cooper's initial draft on 26-Aug. Sarah Deutsch (Verizon) circulated edits on 27-Aug, offering stronger language about impact on customers of BC members, and questions ICANN's criteria for "low risk" strings. We discussed on our member call on 29-Aug. Sarah re-posted her comment on 3-Sep, referring us to Mikey O'Connor's post (link<http://www.haven2.com/index.php/archives/new-gtlds-and-namespace-collision>) Steve (NetChoice) circulated comments filed by NetChoice on 8-Sep. In the attached draft, Steve added to Sarah's edits by questioning the "acceptable risk" criteria proposed by ICANN. Steve added to Sarah's request for additional time, asking for more comment time once ICANN publishes written briefing requested by the GAC in Durban. Members who would object to the attached comment should REPLY ALL by 16-Sep indicating concerns. Unless more than 5 members object, I will file these comments on 17-Sep. Thanks to Elisa and Sarah for their work on this comment. -- Steve DelBianco Executive Director NetChoice http://www.NetChoice.org and http://blog.netchoice.org +1.202.420.7482