- CCPDP4-CS-SG - lists.icann.org

next ccPDP4 IDN Confusing Similarity Subgroup (#3) teleconference | 26 April at 13:00 UTC
by Kimberly Carlson April 18, 2022

April 18, 2022

Dear all, The next ccPDP4 IDN Confusing Similarity Subgroup (#3) teleconference is scheduled for 26 April at 13:00 UTC. An agenda will be circulated prior to the call. Please find the call details below: Join Zoom Meeting https://icann.zoom.us/j/95631267648?pwd=d21sUzV1OUh0ekRxNnZwWUlnc2ZHQT09 Meeting ID: 956 3126 7648 Passcode: PDP4-04-26 Wiki: https://community.icann.org/x/_Qx1Cw

1 0

NOTES | ccPDP4-DS | 12 April 2022 (13 UTC)
by Joke Braeken April 12, 2022

April 12, 2022

NOTES | ccPDP4-DS | 12 April 2022 (13 UTC) 1. Welcome and roll call Welcome by Chair Anil. Apologies by Vice Chair Svitlana 2. Administrative matters a. ICANN74 sessions (full WG meeting and update to community) 2 sessions for ccPDP4 in ICANN74 (hybrid, in The Hague): * Policy Session: Consultation with broader community on the results to date First 30 min for ccPDP3-RM, remaining slot for ccPDP4 Tuesday, 14 June | 11:15-12:30 UTC No overlap with EPDP session, to avoid conflict for Anil * Full WG meeting by ccPDP4: kick-off the stress-testing. Tuesday, 14 June | 15:30-16:30 UTC Note: please pre–register for ICANN74. 8 June is a hard deadline, if you wish to attend ICANN74 (either remotely or in person) b. Action items i. Illustrate the findings ( see below item 3 b, c and d) 3. Review current practice (2nd reading) Bart: see slide deck from last meeting Slide 3: shows the extent of the confusing similarity procedures. More details available here: https://www.icann.org/resources/pages/fast-track-2012-02-25-en. BG, EU, GR. were considered to be confusingly similar. They went through the EPSRP. .eu in greek had to go through the risk mitigation panel. Anil: also evaluate the blocked strings, and the strings waiting for allocation, in EPDP. Will ccPDP4 do the same. Regarding risk mitigation. Initiated only after the requester (cctld manager) submits info to icann. Once the requested string is not passing the process Bart: both EPSRP and the risk mitigation, are initiated by the requestor/applicant. The 1st panel looks at the selected string. That panel determines the string is confusingly similar to (potential) other strings. The requester then decides to use the EPSRP (or not). Main difference between the FTP and the future IDN selection process and new gTLD process. The FTP and idn selection process are ongoing. Available since 2009. There is always the option to adjust the application, and the selected string. Sarmad: Please note that Risk Mitigation Process only applicable in one condition (and not more generally): If the DSP or EPSRP evaluation has determined that the requested string is confusingly similar in uppercase only (and not in lowercase). Bart: EPSRP uses a different methodology. At the request of the applicant or IDN ccTLD manager. The risk mitigation also at the request of the applicant. If you compare current practice under FTP with what happens under new gTLD process, although they use the same criteria of what is considered confusing similarity, are different/ Regarding Question 1: you have to compare to something. A selected string and its variants. Basis for comparison is more limited under the FTP. looking at individual characters? Or combined set of characters? EPSRP always looked at the combination. c. Basic overview of current process and subprocesses d. Results special cases: https://www.icann.org/resources/pages/epsrp-reports-2014-10-14-en e. Results to date EPSRP: https://www.icann.org/en/system/files/files/epsrp-european-union-30sep14-en… f. Results to date Risk Mitigation Evaluation: https://www.icann.org/en/system/files/files/eu-greek-mitigation-measures-28… SSAC and ccNSO discussed risk mitigation. This resulted in the update of the FTP. The report on how the SSAC and a ccNSO WG dealt with this, and their considerations. It builds on the principle that confusing similarity is about risk management. Confusing similarity panel in first instance: DNS Stability Panel. Combines Technical Panel and Similarity Review Panel Anil: how long does the process take for the various panels? Bart: first let’s illustrate the differences. Different methodology. Open process. If the selected string is considered confusing similar, it can be amended. EPSRP Executive summary. Sarmad: EPSRP may take up to 1 year. Risk mitigation never done before. Could be multiple months. Some dependency on the applicant to develop a plan, the review etc. First looking at strings, are 2 strings similar or not? EPSRP makes it more objective. In the 3 cases, the target string and other strings in upper and lower case, options were chosen. Experiments at university in Michigan. Experimental technique. Details are in the report. Panel of experts, evaluated the results from the experiment. Bart: resource intense, duration. This was 2nd and final reading of the current processes and sub-processes. Anil: thank you to all for the clarifications. We approach the top of the hour. Suggests we continue the discussion at the next meeting 4. Discussion on CS: a. Should Confusing Similarity review be maintained? What’s the rationale? b. Should criteria to assess confusing similarity be amended? Criteria: String confusion exists where a string so nearly resembles another visually that it is likely to deceive or cause confusion. For the likelihood of confusion to exist, it must be probable, not merely possible that confusion will arise in the mind of the average, reasonable Internet user. c. Should the 3-step approach (first review, EPSRP, Risk mitigation review) be maintained or could process be simplified? Bart quickly introduces the topic Sarmad: one more element that is now available. Work through the script-based panels for RZ-LGR. When they did variant analysis, they looked at similar characters as well. They left additional data in their proposals, very often. It is useful data, coming directly from the script community. 5. Next meetings 19 April VM SG | 14:00 UTC - 90 min duration 26 April CS SG | 13:00 UTC 3 May VM SG | 14:00 UTC - 90 min duration 10 May CS SG | 13:00 UTC 6. AOB None 7. Closure Thank you all. Bye Joke Braeken joke.braeken(a)icann.org

1 0

REMINDER: ccPDP4 IDN Confusing Similarity Subgroup (#2) teleconference | 12 April at 13:00 UTC
by Kimberly Carlson April 12, 2022

April 12, 2022

Dear all, As a reminder, the next ccPDP4 IDN Confusing Similarity Subgroup (#2) teleconference is scheduled for 12 April at 13:00 UTC. An agenda will be circulated prior to the call. Please find the call details below: Join Zoom Meeting https://icann.zoom.us/j/98382245093?pwd=T1psMk9UdmJ2M205OW1YRFpEaTJFdz09 Meeting ID: 983 8224 5093 Passcode: ccpdp4-CS# Wiki: https://community.icann.org/x/8wx1Cw

2 2

ccPDP4 IDN Confusing Similarity Subgroup (#2) teleconference | 12 April at 13:00 UTC
by Kimberly Carlson April 12, 2022

April 12, 2022

**STARTING IN ONE HOUR*** Dear all, The next ccPDP4 IDN Confusing Similarity Subgroup (#2) teleconference is scheduled for 12 April at 13:00 UTC. An agenda will be circulated prior to the call. Please find the call details below: Join Zoom Meeting https://icann.zoom.us/j/98382245093?pwd=T1psMk9UdmJ2M205OW1YRFpEaTJFdz09 Meeting ID: 983 8224 5093 Passcode: ccpdp4-CS# Wiki: https://community.icann.org/x/8wx1Cw

1 0

ccPDP4 IDN Confusing Similarity Subgroup (#2) teleconference | 12 April at 13:00 UTC
by Kimberly Carlson April 5, 2022

April 5, 2022

Dear all, The next ccPDP4 IDN Confusing Similarity Subgroup (#2) teleconference is scheduled for 12 April at 13:00 UTC. An agenda will be circulated prior to the call. Please find the call details below: Join Zoom Meeting https://icann.zoom.us/j/98382245093?pwd=T1psMk9UdmJ2M205OW1YRFpEaTJFdz09 Meeting ID: 983 8224 5093 Passcode: ccpdp4-CS# Wiki: https://community.icann.org/x/8wx1Cw

1 0

NOTES | ccPDP4 - Confusing Similarity subgroup | Tuesday, 29 March 2022 (13 UTC)
by Joke Braeken March 29, 2022

March 29, 2022

NOTES | ccPDP4 - Confusing Similarity subgroup | Tuesday, 29 March 2022 (13 UTC) 1. Welcome & roll call Welcome by Kenny Huang (.tw) Next time Anil will chair Slides and background material can also be found on the wiki: https://community.icann.org/x/ehgiCw 2. Admin matters Anil as Chair, Svitlana as Vice Chair Kenny mentioned that if she is not available, he can assist 3. Brief tour de table Let’s skip this, since we all know eachother 4. Introducing Confusing Similarity Bart speaks to some slides. This was the most contentious topic or issue, with respect to the Fast Track Process. It is also the area which has evolved most. No right or wrong: some solutions are better, some are less good. There is no “best” solution. Trade off between various interests that need to be taken into account. Subgroup needs to suggest a way forward to the full WG, to be included in the basis doc. 2 docs were shared. * Board doc * What is currently included in the FTP itself and the related guidelines. >>> Fast Track Confusing similar ccTLD cases to date See icann website. 3 cases (there are 4) which have caused confusing similarity issues, which have been the drivers of the Fast Track Process (FTP). led to EPSRP. Extended Process Similarity Review Panel. Requestor was deleted. The request from Bulgaria and Greece was a government-related entity. In the case of the EU, the European Commission played an important role. EURid was the requestor, in consultation with the EC. Contentious matter. >>> Criteria confusing similarity See definition on slides, from the FTP, refined with introduction of EPSRP. Confusing will arise in the mind of an average internet user It is not exact. Lots of judgment involved. * Proportionate * Adequate * Self-contained * Global impact >>> Board Report 2013 Proposal Developed in 2012. Dealt with issues identified in the 2nd review of the FTP. Was considered a test bed for policy proposals. One of the concerns was that the CS-review was unclear (black box approach): methodology, there was no comparison with one or more similar cases, or at character level. Moreover, it was unknown who was conducting the review. 1 person? More? Board report included the need for more transparency. If necessary, a more extensive panel could do the review. Unclear if and when. Review of the original evaluation? The EPSRP was introduced. As a result, you will see procedural changes in the Board Report. Since 2013, also included in the FTP. triggered by the 2nd review. >>> Current FT confusing similarity procedures (since 2019) Summary where we are now. * DNS Stability Evaluation. Same panel also checks the technical requirements. (since 2009) * EPSRP (since 2013). 2nd and final CS assessment, at the request of the entity that submits the selected string for validation. * Risk Mitigation Evaluation (since 2019) One of EU related IDN ccTLDs (.eu in Greek) was still considered to be confusingly similar by EPSRP. This came back in the 3rd review of the FTP. There was an intense discussion between ccNSO and SSAC regarding the next steps. The result was the introduction of a Risk Mitigation approach. Judgmental. This was perceived as a Risk Mitigation exercise. Anil: When the EPSRP goes for the 2nd and final evaluation, does it also take into account tech evaluation? Bart: no Anil: why need third step? Bart: goes back to the eu-case. Let’s talk about this in the next slide. It assumes that a string is confusingly similar. By the time the idn cctld becomes operational, mitigation measures need to be in place. They are assessed against the original criteria. If they do not meet the criteria, the string is considered to be not valid. Sarmad: The Risk Mitigation Assessment does not apply to all cases. There are some pre-conditions. In case the string is still considered similar under EPSRP. For instance here the reasoning was that the confusion was not in the lower case, but in the upper case. Bart: quite extensive and contentious >>> Panels FTP (since 2019) Already in the Board Report in 2013, you saw 3 panels listed: * (1) Technical panel. See discussion in basic doc. Meets IDNA protocol etc. in future, allocatable under RZ-LGR. Fairly straightforward. (e.g. character lengths). No IDN ccTLD has been declined because of issues in that limited sense. Sarmad: aware of at least one case. Cannot share string because of confidentiality. * (2) Similarity Review Panel Same panel (1 and 2) for the FTP, but different panels for gTLDs. If we would separate the 2 panels, the EPSRP builds on second panel. They use a different framework, for conducting the similarity process. Costly and time-consuming, hence not suited for an initial review * (3) EPSRP * (4) Risk Treatment Appraisal Process Panel (RTAP) Risk Mitigation builds on 2nd confusing similarity. Allows the requestors to mitigate the risks associated with the CS that is the result of the EPSRP. Anil: more clarity will probably come later. EPSRP is on the request. Bart: correction “at the request” Anil: Risk Mitigation Evaluation is also made by requestor. Bart: Voluntary next step for requestor Anil: but important to evaluate that the system does not become unstable in future. DNS Abuse. Bart: if an idn ccTLD string is found to be CS, it is not valid, and will not go through the process, and will not be delegated. If it is considered confusingly similar, it will never be delegated. Starting point: “not valid”. If the requestor does not request the EPSRP or does not suggest Risk Mitigation Process, that ends the request itself. 5. Next steps Bart: there are some questions this group should answer. * Confirm that CS is still relevant. Is the evaluation still needed? Potential of abuse, and the risk around CS, probably gives us an answer. * Which criteria does the group use? Look at the Board report, FTP, etc. Are there additions or amendments needed? * Methodology: How detailed does it need to be? Leave details to implementation? * How many panels? What type if basic mechanism? CS review, and a review of that, and then a risk mitigation? Strike one or 2 panels? Strike the risk mitigation? We can use materials from Board Report and FTP for a proposal for the full WG. Anil: important steps. 2 additions * Before starting the process, we should understand some examples. Where we have rejected a requested string. 2nd example: CS at the technical evaluation level, but them mitigated and delegated * Panels that are required. The group should discuss whether it should remain a request by the requestor, or whether it should be mandatory, considering the stability of the DNS. Bart: see initial cases. We can run through the documented cases. They are publicly available. See next call. Cases were first rejected by the stability panel and then accepted by the EPSRP. Final one was accepted by first panel, rejected by EPSRP, and then went through risk mitigation. Greek, latin, cyrillic. Same story could apply elsewhere. What we want to avoid, is to go through of the various methods of the EPSRP. Very different way. Is SWORD still used? Sarmad: not used by the stability panel. Not in FTP according to Bart. Bart: methodology was unknown. SWORD as a tool is not used anymore. 6. Next meetings 5 April | 14 UTC (ccPDP4 VM) 12 April | 13 UTC (ccPDP4 CS) 19 April | 14 UTC (ccPDP4 VM) 26 April | 13 UTC (ccPDP4 CS) Kenny invites all to review the documents ahead of the next meeting 7. AOB Sarmad: Bart suggested the exisyting examples are from the latin/cyrillic/greek set. The different script communities looked at RZ-LGR. In some cases they had to look at similarities. As a by-product, they included some examples of similar characters in appendix. See https://www.icann.org/resources/pages/lgr-proposals-2015-12-01-en Not a normative doc, just informational, could be of use. 8. Closure Thank you all. Bye. Joke Braeken joke.braeken(a)icann.org

1 0

STARTING NOW ccPDP4 IDN Confusing Similarity Subgroup (#1) teleconference is scheduled for 29 March at 13:00 UTC
by Kimberly Carlson March 29, 2022

March 29, 2022

STARTING NOW From: Kimberly Carlson <kimberly.carlson(a)icann.org> Date: Tuesday, March 29, 2022 at 5:04 AM To: "ccpdp4-cs-sg(a)icann.org" <ccpdp4-cs-sg(a)icann.org> Subject: REMINDER: ccPDP4 IDN Confusing Similarity Subgroup (#1) teleconference is scheduled for 29 March at 13:00 UTC Dear all, As a reminder, the inaugural ccPDP4 IDN Confusing Similarity Subgroup (#1) teleconference is scheduled for 29 March at 13:00 UTC. Review and background material attached. Agenda: 1. Welcome & roll call 2. Admin matters Introducing Chair / Vice Chair 3. Brief tour de table 4. Introducing Confusing Similarity 5. Next steps 6. Next meetings * 4 April | 14:00 UTC – VM SG * 12 April | 13:00 UTC – CS SG * 19 April | 14:00 UTC – VM SG * 26 April | 13:00 UTC – CS SG 6. AOB 7, Closure Please find the call details below: Join Zoom Meeting https://icann.zoom.us/j/97111681322?pwd=YTBPUnk5aWE1WVNMS2oraVNJQzFOUT09 Meeting ID: 971 1168 1322 Passcode: ccPDP4-CS1 Wiki: https://community.icann.org/x/ehgiCw

1 0

ccPDP4 IDN Confusing Similarity Subgroup (#1) teleconference | 29 March at 13:00 UTC
by Kimberly Carlson March 29, 2022

March 29, 2022

***STARTING IN ONE HOUR*** Dear all, The inaugural ccPDP4 IDN Confusing Similarity Subgroup (#1) teleconference is scheduled for 29 March at 13:00 UTC. An agenda will be circulated prior to the call. Please find the call details below: Join Zoom Meeting https://icann.zoom.us/j/97111681322?pwd=YTBPUnk5aWE1WVNMS2oraVNJQzFOUT09 Meeting ID: 971 1168 1322 Passcode: ccPDP4-CS1 Wiki: https://community.icann.org/x/ehgiCw

1 0

REMINDER: ccPDP4 IDN Confusing Similarity Subgroup (#1) teleconference is scheduled for 29 March at 13:00 UTC
by Kimberly Carlson March 29, 2022

March 29, 2022

Dear all, As a reminder, the inaugural ccPDP4 IDN Confusing Similarity Subgroup (#1) teleconference is scheduled for 29 March at 13:00 UTC. Review and background material attached. Agenda: 1. Welcome & roll call 2. Admin matters Introducing Chair / Vice Chair 3. Brief tour de table 4. Introducing Confusing Similarity 5. Next steps 6. Next meetings * 4 April | 14:00 UTC – VM SG * 12 April | 13:00 UTC – CS SG * 19 April | 14:00 UTC – VM SG * 26 April | 13:00 UTC – CS SG 6. AOB 7, Closure Please find the call details below: Join Zoom Meeting https://icann.zoom.us/j/97111681322?pwd=YTBPUnk5aWE1WVNMS2oraVNJQzFOUT09 Meeting ID: 971 1168 1322 Passcode: ccPDP4-CS1 Wiki: https://community.icann.org/x/ehgiCw

1 1

ccPDP4 IDN Confusing Similarity Subgroup (#1) teleconference | 29 March at 13:00 UTC
by Kimberly Carlson March 29, 2022

March 29, 2022

Dear all, The inaugural ccPDP4 IDN Confusing Similarity Subgroup (#1) teleconference is scheduled for 29 March at 13:00 UTC. An agenda will be circulated prior to the call. Please find the call details below: Join Zoom Meeting https://icann.zoom.us/j/97111681322?pwd=YTBPUnk5aWE1WVNMS2oraVNJQzFOUT09 Meeting ID: 971 1168 1322 Passcode: ccPDP4-CS1 Wiki: https://community.icann.org/x/ehgiCw

1 0