Additional Evidence of ICANN Engaging in Bilateral Negotiations with Contracting Parties
Hello All, I look forward to seeing many of you next week in Seattle. I wanted to share some additional information I stumbled across while reviewing recent amendments to the .COM Registry Agreement. During our CPWG deep dive session on ICANN and Contracting Parties implementing policy through bilateral negotiations, I raised the example of the cybersecurity incident reporting that first appeared in the .COM agreement and then the new baseline Registry Agreement. During the session, I asked both Avri and Becky, based upon their work on SubPro if they could point me in the direction of this topic being substantively discussed within the community before its inclusion in the baseline registry agreement. Unfortunately, neither could recall this specific topic being discussed by the community before its appearance in the .COM Registry Agreement. In December of last year, ICANN and Verisign amended the Letter of Intent which is part of the .COM Registry Agreement. Paragraph 3 of the LOI states in relevant part that: ICANN and Verisign shall work together in good faith to: (i) determine the appropriate process for ICANN to publish certain information (as advised by the Security and Stability Advisory Committee in its 03 November 2015 Advisory (SAC074) and approved by the ICANN Board of Directors) contained in any Registry Operator incident disclosure made pursuant to Appendix 11, Section (d) of the .com Registry Agreement; and (ii) amend the .com and .net Registry Agreements to permit such publication consistent with similar obligations for other registry operators See https://itp.cdn.icann.org/en/files/registry-agreements/multiple/verisign-loi... Two things raised concerns that I wanted to share with the group and solicit your feedback on. 1. Since cybersecurity incident reporting is NOW part of the proposed baseline registry agreement, why is this work NOT part of the SubPro IRT community work? Why is ICANN Staff tripling down on bi-lateral negotiations with a contracting party while ignoring the clear guidance outlined in the ICANN bylaws regarding this type of policy development work? I think the community deserves an explanation. 2. During the Prep Week Call Xavier informed the community that VRSN and ICANN would let this LOI lapse at the end of the year, resulting in a 4 million dollar shortfall per year going forward. Now in the preamble to the LOI amendment they talk about valuable consideration. Does anyone else find it interesting that it appears that VRSN gets preferred treatment to negotiate important cybersecurity terms outside of the ICANN multistakeholder model, and as soon as they get what they want, VRSN just lets the LOI lapse? As always, I am open to other alternative viewpoints on these facts, but I am struggling to find them to be totally honest Best regards, Michael
I do not understand the source of your conviction that icann is not allowed to engage in bilateral negotiations to agree on contract provisions touching subjects within the picket fence. ICANN has always had authority to do so. For example, “Whois” requirements were historically in registry and registrar agreements notwithstanding the fact that access to registrant data is explicitly within the picket fence. The community remains free to to develop policy that change, eliminate, or expand on contractual obligations. Becky Burr Sent from my iPhone
On Mar 5, 2025, at 19:21, mike palage.com <mike@palage.com> wrote:
Hello All,
I look forward to seeing many of you next week in Seattle. I wanted to share some additional information I stumbled across while reviewing recent amendments to the .COM Registry Agreement.
During our CPWG deep dive session on ICANN and Contracting Parties implementing policy through bilateral negotiations, I raised the example of the cybersecurity incident reporting that first appeared in the .COM agreement and then the new baseline Registry Agreement. During the session, I asked both Avri and Becky, based upon their work on SubPro if they could point me in the direction of this topic being substantively discussed within the community before its inclusion in the baseline registry agreement. Unfortunately, neither could recall this specific topic being discussed by the community before its appearance in the .COM Registry Agreement.
In December of last year, ICANN and Verisign amended the Letter of Intent which is part of the .COM Registry Agreement. Paragraph 3 of the LOI states in relevant part that:
ICANN and Verisign shall work together in good faith to: (i) determine the appropriate process for ICANN to publish certain information (as advised by the Security and Stability Advisory Committee in its 03 November 2015 Advisory (SAC074) and approved by the ICANN Board of Directors) contained in any Registry Operator incident disclosure made pursuant to Appendix 11, Section (d) of the .com Registry Agreement; and (ii) amend the .com and .net Registry Agreements to permit such publication consistent with similar obligations for other registry operators
See https://itp.cdn.icann.org/en/files/registry-agreements/multiple/verisign-loi...
Two things raised concerns that I wanted to share with the group and solicit your feedback on.
Since cybersecurity incident reporting is NOW part of the proposed baseline registry agreement, why is this work NOT part of the SubPro IRT community work? Why is ICANN Staff tripling down on bi-lateral negotiations with a contracting party while ignoring the clear guidance outlined in the ICANN bylaws regarding this type of policy development work? I think the community deserves an explanation. During the Prep Week Call Xavier informed the community that VRSN and ICANN would let this LOI lapse at the end of the year, resulting in a 4 million dollar shortfall per year going forward. Now in the preamble to the LOI amendment they talk about valuable consideration. Does anyone else find it interesting that it appears that VRSN gets preferred treatment to negotiate important cybersecurity terms outside of the ICANN multistakeholder model, and as soon as they get what they want, VRSN just lets the LOI lapse?
As always, I am open to other alternative viewpoints on these facts, but I am struggling to find them to be totally honest
Best regards,
Michael
As the world turns........FWIW, some of us - I know I can speak for Evan Leibovitch - have, time out of memory, ceded bilateral negotiations with contracted parties properly within the province of ICANN org. What we have asked is for some of us from the edge of the community to be allowed conditional access to those sessions. We would not participate, just as witnesses. Even the representatives of the contracted parties who we were talking to at the time did not oppose. That proposal was rejected by ICANN org, some say with prejudice. Carlton ============================== *Carlton A Samuels* *Mobile: 876-818-1799Strategy, Process, Governance, Assessment & Turnaround* ============================= On Mon, 10 Mar 2025 at 10:49, Becky Burr via CPWG <cpwg@icann.org> wrote:
I do not understand the source of your conviction that icann is not allowed to engage in bilateral negotiations to agree on contract provisions touching subjects within the picket fence. ICANN has always had authority to do so. For example, “Whois” requirements were historically in registry and registrar agreements notwithstanding the fact that access to registrant data is explicitly within the picket fence. The community remains free to to develop policy that change, eliminate, or expand on contractual obligations.
Becky Burr Sent from my iPhone
On Mar 5, 2025, at 19:21, mike palage.com <mike@palage.com> wrote:
Hello All,
I look forward to seeing many of you next week in Seattle. I wanted to share some additional information I stumbled across while reviewing recent amendments to the .COM Registry Agreement.
During our CPWG deep dive session on ICANN and Contracting Parties implementing policy through bilateral negotiations, I raised the example of the cybersecurity incident reporting that first appeared in the .COM agreement and then the new baseline Registry Agreement. During the session, I asked both Avri and Becky, based upon their work on SubPro if they could point me in the direction of this topic being substantively discussed within the community before its inclusion in the baseline registry agreement. Unfortunately, neither could recall this specific topic being discussed by the community before its appearance in the .COM Registry Agreement.
In December of last year, ICANN and Verisign amended the Letter of Intent which is part of the .COM Registry Agreement. Paragraph 3 of the LOI states in relevant part that:
ICANN and Verisign shall work together in good faith to: (i) determine the
appropriate process for ICANN to publish certain information (as advised by the
Security and Stability Advisory Committee in its 03 November 2015 Advisory
(SAC074) and approved by the ICANN Board of Directors) contained in any
Registry Operator incident disclosure made pursuant to Appendix 11, Section (d)
of the .com Registry Agreement; and (ii) amend the .com and .net Registry
Agreements to permit such publication consistent with similar obligations for
other registry operators
See https://itp.cdn.icann.org/en/files/registry-agreements/multiple/verisign-loi...
Two things raised concerns that I wanted to share with the group and solicit your feedback on.
1. Since cybersecurity incident reporting is NOW part of the proposed baseline registry agreement, why is this work NOT part of the SubPro IRT community work? Why is ICANN Staff tripling down on bi-lateral negotiations with a contracting party while ignoring the clear guidance outlined in the ICANN bylaws regarding this type of policy development work? I think the community deserves an explanation. 2. During the Prep Week Call Xavier informed the community that VRSN and ICANN would let this LOI lapse at the end of the year, resulting in a 4 million dollar shortfall per year going forward. Now in the preamble to the LOI amendment they talk about valuable consideration. Does anyone else find it interesting that it appears that VRSN gets preferred treatment to negotiate important cybersecurity terms outside of the ICANN multistakeholder model, and as soon as they get what they want, VRSN just lets the LOI lapse?
As always, I am open to other alternative viewpoints on these facts, but I am struggling to find them to be totally honest
Best regards,
Michael
_______________________________________________ CPWG mailing list -- cpwg@icann.org To unsubscribe send an email to cpwg-leave@icann.org
_______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.
participants (3)
-
Becky Burr -
Carlton Samuels -
mike palage.com