July 2006 - council - lists.icann.org

RE: [council] Proposed simplified WHOIS motion for 20 July 2006
by Bruce Tonkin 19 Jul '06

19 Jul '06

Hello Marilyn, > > The motion below asks some of the Councilors to state what > they think the formulation 1 means and why they supported it. > I am not inclined to oppose that segment of the motion, but > ask, for clarification: What do we intend, as Council, to do > with this new information from Councilors? How will it be > used? Is it additional information to inform Council's > discussions, or is it to assist the TF in improving clarity > of where the Councilors views are? This is a good question to ask. The original motion came from a discussion of options that included giving some reasons why Council members voted in a particular way, providing a formal clarification of the original definition, changing the original definition. There seemed to be support in Marrakech with simply starting with getting individuals to give reasons why they supported formulation 1. In terms of what we do with that material, in the first instance it would have the same status as minutes of a meeting. As Avri and others have pointed out, each member of Council is using their individual judgement when voting on a motion. There will always be a range of reasons why a set of individuals will support a particular motion, and there will always be a range of interpretations of the meaning of a particular motion. I would be concerned if the range was too great - I would hope that the interpretations were roughly consistent. What we have discovered is that the range may be too large, and thus the definition needs improving. So for now lets see what the reasons provided are. I hope that some of those that supported the motion might collaborate to perhaps reach some agreement on a common view. If there is some common view that emerges, then we could decide to vote as a Council on a motion that puts forward that view. This could then be issued as a formal communication to the task force and the general community. > > > On a broader note, the interpretation of Formulation 1 that > you presented to the joint GAC/Council meeting on Monday that > I saw in the PowerPoint later, appears to address some of the > concerns of the BC, if indeed, Formulation 1 is inclusive of > the needs that we see for public access to the data to > support the concerns and needs of ISPs, business users, > trademark interests, consumer protection and law enforcement. > I am unclear what you mean by this statement. Access to what data? I believed what I presented in the GAC Forum was factual, rather than a unique interpretation. I did provide this explanation at the Wellington meeting, prior to any votes being taken. I have since been told that there are a wide range of different interpretations. The definition agreed by Council stated: "issues related to the configuration of the records associated with the domain name within a DNS nameserver. " I clarified that the type of issues that I have heard discussed (e.g Technical, intellectual property, consumer protection, SPAM, fraud etc) all result from the configuration of a DNS record. E.g if a DNS record is configured such that a domain name points to a particular Internet location where there is a computer that contains some stolen intellectual property, the link between that domain name and the intellectual property is as a result of configuration of the DNS record. I stated that the current definition does not constrain the type of "issues" in any way, other than that they are related to the configuration of the domain name. I believe June Seo in the Council meeting suggested that it might have been better to state the definition in simpler terms: e.g "issues related to the domain name". The actions possible to resolve an issue with a domain name include: - Deletion of DNS records - Re-configuration of the DNS records - Suspension (ie removal from the zonefile) Note a domain name can exist in the registry and have no operational function. Ie it need not appear in a DNS zone. Note also that you can dis-associate a domain name with an Internet location. That may not in itself typically solve a particular intellectual property issue. The offending material is presumably still located on a computer that is connected to the Internet at that location. You don't need a domain name to reach a particular location (the IP address is sufficient), and it is also possible that multiple domain names could be configured to be associated with a particular Internet location. Likewise, if you just deal with a particular computer connected to the Internet with offending content, then the domain name can be re-configured to be associated with the same offending content at a different Internet location. To deal with "issues" you typically need to understand the system as a whole. A single domain name and its associated DNS records is only one small part of the system. The ICANN mission is related to the domain name component. Issues with content hosted on computers connected to the Internet are not within the scope of ICANN, but certainly need to be considered by anyone that has an intellectual property, law enforcement or other issue. The wider debate is really about what data elements need to be made public to resolve issues. This is part of : "provide information sufficient to contact a responsible party for a particular gTLD domain name who can resolve, or reliably pass on data to a party who can resolve". It is for the task force to make a recommendation in this area. I made no statement on the data elements that would comprise the "information" in the definition. A group of registrars separately did state in Marrakech: "We the undersigned registrars wish to confirm that we will continue to collect the data (commonly called WHOIS data) as required by the registrar accreditation agreement (all of which is currently displayed to the general public), and will continue to provide access to such data to law enforcement, intellectual property, ISPs, and others through appropriate processes. Registrars are open to improve those processes for more efficient access by legitimate users." That is not a view that I expressed as being a Council view. This statement does not imply that the data should be made public. I hope this helps and doesn't further create confusion. I am apparently a very confusing person. Regards, Bruce Tonkin

1 0

RE: [council] Proposed simplified WHOIS motion for 20 July 2006
by Bruce Tonkin 19 Jul '06

19 Jul '06

Hello Avri, I agree with much of what you say. The difficulty is that this has been so contentious in both the task force and the Council, that having an agreed set of next steps is useful, even if those steps seem obvious. It helps both me and the staff in managing external communications, as many have asked what the current discussion means and what we are going to do about the input received. Regards, Bruce Tonkin

1 0

New gTLDs committee and IDN policy work meeting in Amsterdam
by GNSO.SECRETARIAT＠GNSO.ICANN.ORG 18 Jul '06

18 Jul '06

[To: council[at]gnso.icann.org] Dear Council Members, The proposed face to face meeting on new gTLDs and IDNs will take place on Tuesday, 29 August, starting at midday, and going through to Thursday afternoon, 31 August 2006 at the Sheraton Airport Hotel in Amsterdam with direct access to Schiphol International Airport's arrival and departure halls. http://www.starwoodhotels.com/sheraton/property/overview/index.html?propert… The meeting room will accommodate about 30 people in a U shape, some extra chairs may be added and there will be teleconferencing facilities for remote participation. GNSO Travel support will be announced shortly. Please let me know off the list whether you will be attending or participating remotely, and whether you need an hotel room reservation. Details of the reservation will be following soon. Please let me know if you have any questions. Thank you very much. Kind regards, Glen -- Glen de Saint Géry GNSO Secretariat - ICANN gnso.secretariat[at]gnso.icann.org http://gnso.icann.org

1 0

Text in Free Trade Agreement between Australia and the United States
by Bruce Tonkin 18 Jul '06

18 Jul '06

Hello All, During the ICANN public forum in Marrakesh, there was mention of domain names in a free trade agreement between the USA and Chile. Search for "ERICK IRIARTE" in the transcript at: http://www.icann.org/meetings/marrakech/captioning-forum1-28jun06.htm Vint Cerf asked for a reference. I asked Melbourne IT's General Counsel to check the Australian/USA Free trade agreement, and there is similar text. >From Chapter 17 of the Australia-United States Free Trade Agreement on Intellectual Property Rights: http://www.dfat.gov.au/trade/negotiations/us_fta/final-text/chapter_17.h tml "Article 17.3 : Domain Names On The Internet 1. In order to address trademark cyber-piracy, each Party shall require that the management of its country-code top-level domain (ccTLD) provide an appropriate procedure for the settlement of disputes, based on the principles established in the Uniform Domain-Name Dispute-Resolution Policy. 2. Each Party shall require that the management of its ccTLD provide online public access to a reliable and accurate database of contact information for domain-name registrants." Regards, Bruce Tonkin

1 0

Proposed motion regarding Personal Data that is collected and retained by registrars
by Bruce Tonkin 18 Jul '06

18 Jul '06

Hello All, As discussed in my earlier email, and taking into account the email discussions so far, I propose a separate motion to initiate further dialogue with ICANN Advisory Committees such as the GAC, SSAC, and ALAC on the topic of the purposes for which Personal Data is collected from Registrants. I want to make sure that we can relatively quickly have some documentation to support a useful dialogue, without requiring the formation of additional task forces or working groups. We already have large quantities of information on the WHOIS debate that are available via either the DNSO or GNSO websites, along with transcripts of past workshops at ICANN meetings. Up until now, much of the Personal Data that is collected is made available to the general public with almost no access control. This means that the purposes for which the data is collected is almost irrelevant, as members of the public may use the data for all sorts of things. It is virtually impossible to police any "use limitation" of this public data, ie Personal Data should not be disclosed, made available or otherwise used for purposes other than those specified. You can even print out the public data from the WHOIS service and use it as a doorstop. Note also that registrars are in no way constrained in what purposes they collect Personal Data including for marketing purposes, as long as these are part of their agreement with the Registered Name Holder. I propose the following new motion: "The GNSO Council notes that consistent with generally accepted privacy principles, Registrars shall provide notice to each new or renewed Registered Name Holder stating: (i) The purposes for which any Personal Data collected from the applicant are intended; (ii) The intended recipients or categories of recipients of the data (including the Registry Operator and others who will receive the data from Registry Operator); (iii) Which data are obligatory and which data, if any, are voluntary; and (iv) How the Registered Name Holder or data subject can access and, if necessary, rectify the data held about them. To further understand the range of purposes for which data is intended, the GNSO proposes the following steps: (1) The ICANN staff will review a sample of registrar agreements with Registered Name Holders to identify some of the purposes for which registrars collected Personal Data from registrants. (2) The ICANN staff will review a sample of cctld registry or cctld registrar agreements with registrants to identify some of the purposes for which these organisations collect Personal Data from registrants. (3) The ICANN staff will summarise the current material that has resulted from WHOIS discussions since 2002 that document the current uses of the data that is currently made public through the WHOIS service. (4) Based on the material produced in steps (1), (2) and (3) above, the Council will undertake a dialogue with the ICANN Advisory Committee's such as the GAC, SSAC and ALAC to determine whether any work is required on mandating particular purposes, consistent with ICANN's mission and core values, for which registrars must collect Personal Data from registrants. The dialogue should seek to examine and understand consumer protection, privacy/data protection and law enforcement views, perspectives and concerns."

2 1

RE: [council] Proposed WHOIS motion for 20 July 2006
by Bruce Tonkin 18 Jul '06

18 Jul '06

Hello All, I am wondering whether we should actually pull out clause 3 from the motion below and treat it separately. Clause 3 is actually much broader in scope than WHOIS, as it is about the purposes for which registrars collect and retain data. The WHOIS service is only one of several purposes for which data is collected and retained, and there are different services available for accessing data related to domain names depending on the intended recipients of that data. For example many registrars provide interfaces for registrants and resellers to access data that are separate from the WHOIS service. I have been contacted by some registrars, that including this as part of a "WHOIS motion", may be confusing as some of the data referred to in the motion below is not related to WHOIS, and some of the data is related to the current WHOIS service. Regards, Bruce Tonkin > -----Original Message----- > From: owner-council(a)gnso.icann.org > [mailto:owner-council@gnso.icann.org] On Behalf Of Bruce Tonkin > Sent: Thursday, 13 July 2006 6:59 PM > To: Council GNSO > Subject: [council] Proposed WHOIS motion for 20 July 2006 > > Hello All, > > Below is a revised motion derived from the tabled motion > discussed in Marrakech, and taking into account feedback I > have received since. > > The main changes are in step (3), where I have attempted to > link the language to current clauses in the registrar > accreditation agreement, and included a requirement to > consider privacy and law enforcement perspectives. I have > also left out SSAC, as most of the focus in > Marrakech was on Government input and additional public > input. We will > of course continue to liaise with the SSAC as we do with the > ALAC. We > have not yet heard any concerns from SSAC or ALAC with the > current definition of the WHOIS service. > > I have also added a list of the relevant data elements. > > Comments/improvements welcome. > > Regards, > Bruce Tonkin > > > Proposed Motion on WHOIS > > The GNSO Council notes that the current WHOIS definition is > related to the service that provides public access to some or > all of the data collected, and is not a definition of the > purpose of the data itself. > > In response to the extensive community and Government input > on the definition of the purpose of WHOIS, the GNSO Council > agrees to undertake the following steps: > > (1) Each Council member that voted in favour of the > definition will provide a brief explanation of the reason for > supporting the resolution and their understanding of its meaning. > > (2) The ICANN staff will provide a summary of the other > interpretations of the definition that have been expressed > during the public comment period, and subsequently in > correspondence from the public and Governments. > > (3) The Council will undertake a dialogue with governments, > via the GAC, to work towards developing a broadly > understandable definition of the minimum purposes for which > the current data required in the Registrar Accreditation > Agreement (see clause 3.4 of > http://www.icann.org/registrars/ra-agreement-17may01.htm ), as listed > below, is collected and retained. The dialogue should seek > to balance > privacy and law enforcement concerns with ICANN's mission and > core values, and must take into account the views of law > enforcement agencies, data protection authorities, the > policies and rules of access to ccTLD data, and relevant > national laws. > > Note that one of the purposes would be for the public display > of some or all of the data as per the recent definition of > the purpose of WHOIS. > Note that Registrars are required (clause 3.7.7.4) to provide > notice to each new or renewed Registered Name Holder stating > the purposes for which any Personal Data collected from the > applicant are intended, and the intended recipients or > categories of recipients of the data (including the Registry > Operator and others who will receive the data from Registry Operator). > > > (4) The GNSO Council requests that the WHOIS task force > continue with their work as specified in the terms of > reference taking into account the recent input that has been > provided and any further clarification as it becomes > available from Council. > > > (5) The GNSO Council will take the final report from the > WHOIS task force that addresses all terms of reference and > the outcomes of the dialogue with governments, and consider > improving the wording of the WHOIS service definition so that > it is broadly understandable. > > > > List of data that must be collected and retained by registrars: > ************************************************************** > > *************************************************************** > > The following is commonly referred to as the "WHOIS Data": > ********************************************************** > > (a) The name of the Registered Name; > > (b) The names of the primary nameserver and secondary > nameserver(s) for the Registered Name; > > (c) The identity of Registrar (which may be provided through > Registrar's website); > > (d) The original creation date of the registration; > > (e) The expiration date of the registration; > > (f) The name and postal address of the Registered Name Holder; > > (g) The name, postal address, e-mail address, voice telephone > number, and (where available) fax number of the technical > contact for the Registered Name; and > > (h) The name, postal address, e-mail address, voice telephone > number, and (where available) fax number of the > administrative contact for the Registered Name. > > In addition there is: > ********************* > > (i) The name and (where available) postal address, e-mail > address, voice telephone number, and fax number of the > billing contact; > > (j) In electronic form, the submission date and time, and the > content, of all registration data (including updates) > submitted in electronic form to the Registry Operator(s); > > (k) In electronic, paper, or microfilm form, all written > communications constituting registration applications, > confirmations, modifications, or terminations and related > correspondence with Registered Name Holders, including > registration contracts; and > > (l) In electronic form, records of the accounts of all > Registered Name Holders with Registrar, including dates and > amounts of all payments and refunds. > > > > > > > >

1 0

Data principles
by Bruce Tonkin 18 Jul '06

18 Jul '06

Hello All, While considering the proposed WHOIS motion, it may be worth considering some of these principles from the OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data. From: http://www.oecd.org/document/18/0,2340,en_2649_34255_1815186_1_1_1_1,00. html **Collection Limitation Principle There should be limits to the collection of personal data and any such data should be obtained by lawful and fair means and, where appropriate, with the knowledge or consent of the data subject. **Data Quality Principle Personal data should be relevant to the purposes for which they are to be used, and, to the extent necessary for those purposes, should be accurate, complete and kept up-to-date. **Purpose Specification Principle The purposes for which personal data are collected should be specified not later than at the time of data collection and the subsequent use limited to the fulfilment of those purposes or such others as are not incompatible with those purposes and as are specified on each occasion of change of purpose. **Use Limitation Principle Personal data should not be disclosed, made available or otherwise used for purposes other than those specified in accordance with Paragraph 9 [ie paragraph above] except: a) with the consent of the data subject; or b) by the authority of law. **Security Safeguards Principle Personal data should be protected by reasonable security safeguards against such risks as loss or unauthorised access, destruction, use, modification or disclosure of data. **Openness Principle There should be a general policy of openness about developments, practices and policies with respect to personal data. Means should be readily available of establishing the existence and nature of personal data, and the main purposes of their use, as well as the identity and usual residence of the data controller. **Individual Participation Principle An individual should have the right: a) to obtain from a data controller, or otherwise, confirmation of whether or not the data controller has data relating to him; b) to have communicated to him, data relating to him within a reasonable time; at a charge, if any, that is not excessive; in a reasonable manner; and in a form that is readily intelligible to him; c) to be given reasons if a request made under subparagraphs(a) and (b) is denied, and to be able to challenge such denial; and d) to challenge data relating to him and, if the challenge is successful to have the data erased, rectified, completed or amended. **Accountability Principle A data controller should be accountable for complying with measures which give effect to the principles stated above. Regards, Bruce Tonkin

1 0

RE: [council] Proposed WHOIS motion for 20 July 2006-- suggested edits and proposal for working with the ccTLD managers and SSAC
by Marilyn Cade 18 Jul '06

18 Jul '06

I posted earlier to the Council several suggestions, and included a new draft of the resolution. It is pasted below, for simple clarity.... this is what my substitute text looks like, without mark up. I did post a marked up version, but I understand that is confusing in plain text. So, consider this a substitute text to the chairman's draft/redraft: ---------------------------------------------------------------------------- (3) The Council will undertake a dialogue with governments, via the GAC, and to include the SSAC, to work towards developing a broadly understandable definition of the purposes for which the current data required in the Registrar Accreditation Agreement (see clause 3.4 of http://www.icann.org/registrars/ra-agreement-17may01.htm ), as listed below, is collected, retained and used. The dialogue should seek to examine and understand consumer protection, privacy/data protection and law enforcement views and perspectives and concerns, taking into account ICANN's mission and core values. In addition, to inform the Council's deliberations, this dialogue and examination should include gathering information and discourse with a representative group of ccTLD managers regarding their policies and rules of access to ccTLD data, and relevant national laws.

1 0

Issues Report on Policy Issues relating to IDN at the top-level
by GNSO.SECRETARIAT＠GNSO.ICANN.ORG 17 Jul '06

17 Jul '06

[council[at]gnso.icann.org; liaison6c[at]gnso.icann.org] Dear All, The Issues Report on Policy Issues relating to IDN at the top-level has been posted at: http://gnso.icann.org/ and http://gnso.icann.org/issues/idn-tlds/ Thank you. Kind regards, Glen -- Glen de Saint Géry GNSO Secretariat - ICANN gnso.secretariat[at]gnso.icann.org http://gnso.icann.org

1 0

RE: [council] Proposed WHOIS motion for 20 July 2006
by Bruce Tonkin 17 Jul '06

17 Jul '06

Hello All, > > (3) The Council will undertake a dialogue with governments, > via the GAC, to work towards developing a broadly > understandable definition of the minimum purposes for which > the current data required in the Registrar Accreditation > Agreement (see clause 3.4 of > http://www.icann.org/registrars/ra-agreement-17may01.htm ), as listed > below, is collected and retained. The dialogue should seek > to balance > privacy and law enforcement concerns with ICANN's mission and > core values, and must take into account the views of law > enforcement agencies, data protection authorities, the > policies and rules of access to ccTLD data, and relevant > national laws. An alternative wording for the last sentence is: The purpose of the dialogue should be to seek, to the extent reasonably possible, a balance of privacy and law enforcement concerns with ICANN's mission and core values, and may also consider the views of data protection authorities, the policies and rules of access to ccTLD data, and relevant national laws. Regards, Bruce Tonkin

4 5