February 2018 - Gdd-gnso-ppsai-impl

Summary, action items from today's PP IRT call
by Amy Bivins March 6, 2018

March 6, 2018

Dear Colleagues, Thank you for your active participation on today's Privacy/Proxy IRT call. We covered a lot of ground. If you could not attend, I encourage you to listen to the recording, available on the wiki, https://participate.icann.org/p39onhjd1g1/. Please review the items discussed today (summarized below) and provide any additional input to the list no later than your EOD Friday, 23 Feb. Monthly Reporting Specification 1. Issue 1: Report frequency-IRT members seemed to support a requirement that these reports be submitted quarterly (current draft suggested monthly). Absent contrary input on the list this week, this change will be made in next draft. 2. Issue 2: Report submission-on-list, some IRT members said that using ICANN reporting interface was too complicated and/or unnecessary. No one commented on this topic during today's meeting. Absent substantial input on this topic on-list this week indicating that many IRT members would support a contrary reporting mechanism, no changes will be made on this point. 3. Issue 3: Report format-on-list, some IRT members took issue with requiring both per-registrar and per-TLD reports. During the call, some IRT members indicating per-TLD could be too labor intensive, but other IRT members supported having per-TLD reports. Additional IRT input is requested on this point. 4. Issue 4: Report fields-on-list, suggestions have been made for eliminating some fields, and adding others. Based on the discussion in today's call (absent contrary and/or additional suggestions on-list) the specification will be updated to: eliminate "total" numbers for requests for specific contacts, eliminate "publication" fields for LEA and IP requests, add publication/disclosure-other fields to capture non-LEA/IP requests, add coded "reasons for denial" fields. PP Applicant Guide 1. Issue 1: Shift to "rolling" application period (eliminating application phases). IRT members supported this approach. Absent contrary feedback on-list we will proceed with this approach. 2. Issue 2: Elimination of many "essay" questions in favor of "checkbox" questions. IRT members supported this approach. Absent contrary feedback on-list we will proceed with this approach. 3. Issue 3: Fees proposal. IRT requested additional documentation of costs to support fees proposal (ICANN org will work to provide this ASAP). LEA Disclosure Framework Specification 1. Issue 1: Language re: notices to customers in Sections 6.3 and 4.3, while not directly contradictory, sets different standards for the timing of notice to customers regarding an LEA request. Per IRT input on-list and on today's call, edits will be made to make clear that Section 4.3 controls, and language to 4.3 to make clear that provide will notify customer of a request in accordance with ToS and timeframe requested by LEA, subject to any other requirements under applicable law or court order. Any additional input on this is requested by the end of the week. 2. Issue 2: Required provider responses to high priority LEA requests. Per discussion on-list and during today's call, it appears that * If "action" is clearly defined to include (1) disclosure of the requested information, (2) refusal to disclose the requested information for one of the reasons listed in section 4.2.2, and/or (3) in exceptional circumstances, informing LEA that the provider requires additional time to respond, then * The IRT appears to find a 24-hour response time acceptable for high-priority requests from LEA that qualify for this specification. * IRT feedback is specifically requested on this point. Please respond to the list noting whether you (1) support, (2) oppose, or (3) would edit (explain how) the requirement that providers be required to action high-priority requests from LEA within 24 hours of receipt of the request from LEA. If there is disagreement on this, this will be flagged during the public comment period. Best, Amy Amy E. Bivins Registrar Services and Engagement Senior Manager Registrar Services and Industry Relations Internet Corporation for Assigned Names and Numbers (ICANN) Direct: +1 (202) 249-7551 Fax: +1 (202) 789-0104 Email: amy.bivins(a)icann.org<mailto:amy.bivins@icann.org> www.icann.org<http://www.icann.org>

15 34

Updated PPAA draft and related materials attached for IRT review
by Amy Bivins March 3, 2018

March 3, 2018

Dear Colleagues, Attached is the updated PPAA draft, in redline and non-redline versions. I've also included a version with references to the Final report and notes to the IRT about where edits were made (or not made). The attached slide deck includes an overview of the accreditation program materials, remaining open issues, and identifies how each of the Final Recommendations are proposed to be implemented. Please begin reviewing the updates to the PPAA draft and come prepared to discuss at our meeting on Tuesday. Also, please provide any final feedback on the LEA framework and reporting specification no later than this Friday, 2 March. We plan to update this draft with respect to feedback received on those issues next week as we prepare these materials for the public comment period. Brief, high-level summary of the changes/questions for the IRT in this PPAA draft: 1. Non-substantive copy edits throughout 2. Labeling specification (and all references to this specification) deleted based on IRT feedback that the requirements therein appeared to be beyond scope. Labeling requirement included in PPAA body at Section 3.15. 3. Reporting specification (and references to this specification) added. Specification remains under IRT review (deadline for feedback 2 March). Links to PP IETF documents are not yet functional, as these are not yet published. These are expected to be published prior to the publication of the draft PPAA for public comment and links will be updated if needed when this specification is finalized based on final IRT feedback. 4. Definition of "Working Group" (applicable to amendment, negotiation processes-See, e.g., Section 7.4.1) updated throughout PPAA to eliminate references to any future PPSG. In its place, the WG will now be convened by the GNSO Council (See PPAA Section 1.43), as recommended by the IRT. 5. All references to a Provider terminating a customer's domain registration or requesting that a registrar do so in response to a breach of the terms of service or other wrongs have been deleted, per IRT input. (See, e.g. Section 3.5.3.1; See, specifically, Section 3.5.3.17 (regarding cancellations of services related to names that are subject to UDRP/URS proceedings.) 6. Explicit requirement that Provider publish its terms of service has been added (See Section 3.8.1). Prior draft referenced requirements for ToS contents but didn't explicitly require that ToS be published, as directed by the Final Report. 7. Abuse desk requirement in PPAA Section 3.12.1 edited to match language in Final Report (language about the abuse contact being "capable and authorized to investigate..." from the Final Report had been inadvertently deleted at some point in a prior draft). 8. Deletion of LEA-related abuse contact requirements in PPAA text (formerly section 3.12.2). All LEA-specific requirements are now included in the LEA Disclosure Framework Specification. 9. Reference to use of "high-volume, automated electronic processes..." in PPAA section 3.14 was moved to Intellectual Property Disclosure Framework Specification. 10. Clarification added that a provider on suspended status may continue to provide services for existing registrations (Section 5.7.3) 11. Several clean-up edits in Specification 1, Data Escrow Specification. ICANN is currently reviewing the inclusion of this Specification in the PPAA itself, as opposed to the RAA format which has the escrow specification separate from the accreditation agreement. As technical requirements/RFCs may be updated from time to time, there are benefits to having this outside the PPAA itself. IRT feedback is requested on this topic. 12. Specification 2: Customer Data Accuracy Program Specification. Edit to Section 1, to clarify that obligation applies when Provider begins providing the Services for a name, as opposed to when the name is registered. 13. Specification 4: Law Enforcement Authority Specification. This specification is currently under final IRT review (deadline for feedback 2 March). Substantive edits may be made after this review period. There is currently some disagreement among IRT members regarding high priority requests, specifically: (a) how the receipt process should or should not apply to high priority requests, (b) the time that should be allowed for a provider to action a "high priority" request. In addition, the IRT is considering defining "action" for greater clarity. 14. Data retention specification: The data required to be retained has been reduced by the deletion of the labeling specification (see Section 1.1.6). Amy E. Bivins Registrar Services and Engagement Senior Manager Registrar Services and Industry Relations Internet Corporation for Assigned Names and Numbers (ICANN) Direct: +1 (202) 249-7551 Fax: +1 (202) 789-0104 Email: amy.bivins(a)icann.org<mailto:amy.bivins@icann.org> www.icann.org<http://www.icann.org>

6 8

Reminder: No IRT meeting today
by Amy Bivins Feb. 27, 2018

Feb. 27, 2018

Dear Colleagues, This is a reminder that we do not have an IRT meeting today. Please send any further input you have on the topics discussed last week to the list by your end of day Friday. We are finalizing the PPAA draft (minus the remaining items that are open on the list) and I hope to be able to send it to you by this evening or tomorrow morning. Amy Sent from my iPhone

5 5

Agenda, materials for Tuesday's PP IRT call
by Amy Bivins Feb. 20, 2018

Feb. 20, 2018

Hello, All, At our next PP IRT meeting, we will discuss the following: * LEA Framework Specification: * Remaining issue re: time period for actioning high priority requests. If no agreement is reached this will be flagged for the public comment period. We will discuss most recent suggestions made on the list and determine whether there is an IRT consensus to adopt any of these proposed changes. * Question from ICANN about Section 6.3's application to Section 4.3: Do you view these sections to be in conflict? * Section 6.3 states that Customer Notification should take place at the earliest opportunity, unless such disclosure would pose a risk to operational sensitivity; safety of individuals; or is prohibited by law or court order. Such circumstances must be detailed in the disclosure request. * Text of 6.3 was included in PSWG's initial proposal. * Section 4.3 (in summary, also included in PSWG initial proposal) states that the provider will notify the customer of a disclosure request in accordance with its terms of service and the timeframe identified by LEA. The provider may voluntarily set a generic timeframe for this notice, such as 90 days, which can be extended at LEA's request. * IRT feedback on draft Monthly Reporting Specification, distributed earlier this week (also attached) * IRT feedback on updated draft Applicant Guide (attached). Please note that the proposed application process has been substantially updated since the IRT's last review of this document, and that the proposed fee schedule has been updated. Please review these items prior to our meeting and come prepared to discuss each of these topics. Amy E. Bivins Registrar Services and Engagement Senior Manager Registrar Services and Industry Relations Internet Corporation for Assigned Names and Numbers (ICANN) Direct: +1 (202) 249-7551 Fax: +1 (202) 789-0104 Email: amy.bivins(a)icann.org<mailto:amy.bivins@icann.org> www.icann.org<http://www.icann.org>

6 5

PPAA Reporting Specification Attached for IRT review
by Amy Bivins Feb. 16, 2018

Feb. 16, 2018

Dear Colleagues, A new draft PPAA specification, the monthly reporting specification, is ready for your review. This specification includes the requirements for provider reports to ICANN. This specification is proposed to implement the recommendation from the Final Report, "providers should be required to maintain statistics on the number of Publication and Disclosure requests received and the number honored, and provide these statistics in aggregate form to ICANN for periodic publication. The data should be aggregated so as not to create a market where nefarious users of the domain name system are able to use the information to find the P/P service that is least likely to make Disclosures." (See Final Report, p. 18). We can discuss this during our call next week if you have any questions or comments. I'll also be sending the updated Applicant Guide to the list later this week, for discussion on Tuesday. Looking ahead, we are working to finalize the RRI Specification that accompanies the attached reporting specification. The RRI Specification will include the technical specifics for submitting these reports via the API. I'll send it to the list as soon as it is available. We are also in the process of reviewing the Labeling Specification, pursuant to IRT feedback, and will have an updated draft for the IRT to review as soon as possible. Best, Amy Amy E. Bivins Registrar Services and Engagement Senior Manager Registrar Services and Industry Relations Internet Corporation for Assigned Names and Numbers (ICANN) Direct: +1 (202) 249-7551 Fax: +1 (202) 789-0104 Email: amy.bivins(a)icann.org<mailto:amy.bivins@icann.org> www.icann.org<http://www.icann.org>

5 14

Notes, Action Items From Today's PP IRT Call
by Amy Bivins Feb. 16, 2018

Feb. 16, 2018

Dear Colleagues, Thank you for your active participation on today's Privacy/Proxy IRT call. For those who could not attend, I encourage you to review the recording, which is posted on the wiki, https://community.icann.org/display/IRT/13+February+2018. Today, we discussed three topics: (1) the updated de-accreditation procedure; (2) the updated Policy document; and (3) the ongoing discussion on the list re: the LEA framework specification, specifically the processes of discussing the disagreement about the timing of a provider's "actioning" of a "high priority" request. Please review the attached materials, summary below and/or the recording and provide any further input on these topics by the end of this week. IRT feedback is specifically requested on the five recommendations received from IRT members related to the LEA Framework Specification. This will be discussed next week. IRT Input on De-Accreditation Process * Recommendation 1: In Section 2.2.4, edit to note that this right of transfer is subject to the ICANN transfer policy. * Proposed response: This edit will be made unless we receive input to the contrary that warrants further discussion. * Recommendation 2: In Section 2.5, delete references to specific methods of contact. * Proposed response: This edit will be made unless we receive input to the contrary that warrants further discussion. * Recommendation 3: In Section 3, should there be more specifics about what this notice should require? Section 2.4 could be referenced, for example. * Proposed response: Absent further input on Section 2.4, a reference to Section 2.4 will be added. IRT Input on Draft Policy Document * Recommendation 1: Eliminate use of "Person" in definitions. * Proposed response 1: This topic has been raised before, but did not appear to have widespread support by members of the IRT. The word "Person" was used to ensure consistency across definitions and for clarity and conciseness. As a result, it seems preferable to retain the use of the word "Person," absent feedback that indicates it is the consensus view of the IRT to eliminate the use of the word "Person." * Proposed response 2: One IRT member suggested that the word "Person" could be added to the definitions section of this document for added clarity. This edit will be made unless we receive input to the contrary that warrants further discussion. * Recommendation 2: Implementation of RDDS requirements, as a matter of policy, should be done through high-level WHOIS policy rather than piecemeal in this Policy document, as this could be lost over time as/when/if other WHOIS requirements are updated. * Proposed response: Additional IRT feedback is requested on this topic, and staff will also consult about this topic. There are many different ICANN policies that concern WHOIS/RDDS (https://www.icann.org/resources/pages/registrars/consensus-policies-en) The CL&D Policy does specifically concern labeling, which is what the requirement here is about, https://www.icann.org/resources/pages/rdds-labeling-policy-2017-02-01-en. LEA Framework Discussions The IRT has been discussing the draft LEA Disclosure Framework Specification periodically for approximately nine months. Most elements of this draft framework appear to be settled, but disagreement remains on one specific point: how and when a provider must "action" a "high priority" request. PSWG members of the IRT have proposed that high priority requests be actioned within 24 hours. IRT members, particularly registrars, contend that this time period is unreasonable. The most recent feedback received on this on the list for proposed edits to the current draft (which currently requires that a high priority request be actioned within 24 hours) is as follows: * Recommendation 1: Where a disclosure request has been categorized as High Priority, Provider shall use its best efforts towards actioning the request within 24 hours on business days or as close as possible to this, or "actioning the request within 24 hours for up to 90% (or some other level determined acceptable by Providers) of incidences." * Recommendation 2: Add "without limitations" back to section 4.2.2. What's listed under 4.2.2 should be non-limiting examples for when disclosure can be reasonably refused. * Recommendation 3: Define the word "Action" as follows (or similar): "As used in this subsection, "action" means (i) to disclose to the LEA requestor, or (ii) to refuse to disclose to the LEA requestor, citing one or more of the reasons listed in 4.2.2"?; or to add, after "action," "in accordance with subsection 4.2," which includes both the options listed (as well as the option of extending the deadline, "in exceptional circumstances," see 4.2.4). * Recommendation 4: Where a disclosure request is categorized as High Priority, LEA will make every effort to contact the Provider directly to discuss the matter, and should it be determined that Provider has useful information, Provider shall use its best efforts to action the request within 24 hours, noting that a court order/subpoena may still be required prior to release of any information. Registrar will not be required to take any action in contravention of applicable law. * Recommendation 5: Edit to state that "Provider shall use reasonable efforts to respond to the request as soon as possible" as opposed to Provider shall use its best efforts to action the request within 24 hours. IRT Action Item: IRT feedback is specifically requested on these five recommendations. This will be discussed once more, on Tuesday, with the goal of determining whether agreement can be reached or not on any further changes to the current draft. If agreement cannot be reached on Tuesday, the various positions will be specifically noted in the call for public comments. Best, Amy Amy E. Bivins Registrar Services and Engagement Senior Manager Registrar Services and Industry Relations Internet Corporation for Assigned Names and Numbers (ICANN) Direct: +1 (202) 249-7551 Fax: +1 (202) 789-0104 Email: amy.bivins(a)icann.org<mailto:amy.bivins@icann.org> www.icann.org<http://www.icann.org>

3 3

Re: [Gdd-gnso-ppsai-impl] Request for IRT Feedback: LEA Framework Specification, Receipt Process's Application to High Priority Requests
by Sara Bockey Feb. 13, 2018

Feb. 13, 2018

A few items. Again, I’m concerned that we are creating policy, not implementing it. Granted, the framework outlined in the Final Report is not as robust as what is detailed for IPC, but then again LEA did not participate in the PDP process. The IRT is not the place to be creating policy for LEAs. That said, the problem with a strict 24-hour period is that it doesn’t acknowledge certain situations/matters may require additional time, falling outside a 24-hour period despite a Provider’s best efforts. Language such as “Where a disclosure request has been categorized as High Priority, this must be actioned within 24 hours” are overly strict and sets the Provider up for failure/being out of compliance due to circumstances beyond its control. Finally, I fear the LEA framework as currently written creates unrealistic expectations/SLAs. There seems to be a presumption of disclosure – if LEAs check all the right boxes, the information will be disclosed. However, this decision should reside with the provider, who does not have to bypass due process just to please LEAs. sara bockey sr. policy manager | GoDaddy™ sbockey(a)godaddy.com<mailto:sbockey@godaddy.com> 480-366-3616 skype: sbockey This email message and any attachments hereto is intended for use only by the addressee(s) named herein and may contain confidential information. If you have received this email in error, please immediately notify the sender and permanently delete the original and any copy of this message and its attachments. From: Gdd-gnso-ppsai-impl <gdd-gnso-ppsai-impl-bounces(a)icann.org> on behalf of Amy Bivins <amy.bivins(a)icann.org> Reply-To: "gdd-gnso-ppsai-impl(a)icann.org" <gdd-gnso-ppsai-impl(a)icann.org> Date: Monday, February 5, 2018 at 7:51 AM To: "gdd-gnso-ppsai-impl(a)icann.org" <gdd-gnso-ppsai-impl(a)icann.org> Subject: [Gdd-gnso-ppsai-impl] Request for IRT Feedback: LEA Framework Specification, Receipt Process's Application to High Priority Requests Dear Colleagues, As mentioned on the list a couple of weeks ago, the current draft PPAA is still a bit ambiguous regarding how the review process outlined in Section 3.2.1 applies to high priority requests. We need ensure that the draft is clear about this requirement when we go out for public comment (and if there is opposition to the proposed requirement by any members of the IRT, this will be flagged in the call for comments). Upon reviewing the IRT’s input to date, I am proposing an edit that I believe reflects the IRT discussion on this point. Please review and provide your comments on this proposed language no later than this Friday, 9 February. To summarize, the current draft contains a two-step process for Providers upon receipt of a request from LEA. (1) Within two business days, the Provider must review the request and confirm to the LEA requester that it has been received and contains the relevant information required to meet the minimum standard for acceptance (See 3.2.1 of Specification 4). (2) The Provider must then action the request in accordance with the priority level (within 24 hours for “high priority” requests (4.1.2); or within the timeline requested by LEA, if possible, for other requests (See 4.1.3). The current language may be a bit ambiguous as to whether the two business day “review period” applies before the 24-hour period for responding to high priority requests (as explained in more detail in the attached message). The view of registrar IRT members appears to be that requiring action within 24 hours of receipt of an LEA request, even if it is a high priority request, is unacceptable. PSWG members of the IRT disagree. Other IRT members appear to have mixed views on this (some referenced the RAA requirement that “Well-founded reports of Illegal Activity submitted to these [dedicated LEA] contacts must be reviewed within 24 hours by an individual who is empowered by Registrar to take necessary and appropriate actions in response to the report.” Registrar members of the IRT said that the RAA-required review is less intensive than the PPAA review due to the specific requirements in the PPAA draft). Based on the views expressed within the IRT, it appears that one potential solution to this ambiguity would be to update Section 4.1.2 to state that (proposed edit in red), “Where a disclosure request has been categorized as High Priority, this must be actioned within 24 hours of completion of the receipt process outlined in Section 3.2.” The LEA Requestor will detail the threat type and justification for a request with a Priority Level of High Priority.” The practical impact of this proposed change would be that the provider must action a high priority request within 24 hours of determining that the request meets the minimum standard for acceptance. If the provider completes the receipt process sooner than 2 business days after receipt of the request, this would start the 24-hour clock for actioning the request. Thus, this could shorten the response window a bit, partially addressing the PSWG concerns of a “two business days plus 24 hours” requirement, while also addressing registrar concerns by not starting the clock until the provider has time to review the request, if the full time of the receipt process is required to conduct that review. Please provide your feedback on this proposed change no later than this Friday, 9 Feb. And if you have further comments on this, please share those as well. Best, Amy Amy E. Bivins Registrar Services and Engagement Senior Manager Registrar Services and Industry Relations Internet Corporation for Assigned Names and Numbers (ICANN) Direct: +1 (202) 249-7551 Fax: +1 (202) 789-0104 Email: amy.bivins(a)icann.org<mailto:amy.bivins@icann.org> www.icann.org<http://www.icann.org>

9 31

Re: [Gdd-gnso-ppsai-impl] Materials for tomorrow's PP IRT call
by Michelle DeSmyter Feb. 12, 2018

Feb. 12, 2018

Hi Chris, Thank you for this, I will note your apology for tomorrow's meeting. Kind regards, Michelle From: Gdd-gnso-ppsai-impl <gdd-gnso-ppsai-impl-bounces(a)icann.org<mailto:gdd-gnso-ppsai-impl-bounces@icann.org>> on behalf of Chris Pelling <chris(a)netearth.net<mailto:chris@netearth.net>> Reply-To: "gdd-gnso-ppsai-impl(a)icann.org<mailto:gdd-gnso-ppsai-impl@icann.org>" <gdd-gnso-ppsai-impl(a)icann.org<mailto:gdd-gnso-ppsai-impl@icann.org>> Date: Monday, February 12, 2018 at 12:32 PM To: "gdd-gnso-ppsai-impl(a)icann.org<mailto:gdd-gnso-ppsai-impl@icann.org>" <gdd-gnso-ppsai-impl(a)icann.org<mailto:gdd-gnso-ppsai-impl@icann.org>> Subject: Re: [Gdd-gnso-ppsai-impl] Materials for tomorrow's PP IRT call Hi Amy, Sorry I wont be able to make this tomorrow. Kind regards, Chris ________________________________ From: "Amy Bivins" <amy.bivins(a)icann.org<mailto:amy.bivins@icann.org>> To: gdd-gnso-ppsai-impl(a)icann.org<mailto:gdd-gnso-ppsai-impl@icann.org> Sent: Monday, 12 February, 2018 17:23:47 Subject: [Gdd-gnso-ppsai-impl] Materials for tomorrow's PP IRT call Hello, All, In advance of tomorrow's IRT call, I'm attaching the updated PP Policy document (in both clean and redline versions) and the de-accreditation process document in redline. Tomorrow we're planning to walk through the updates to these documents since we've last discussed them, and then we'll leave them open for your feedback. Following up on the discussion on the list this past week, we've seen significant discussion of the LEA disclosure framework. I don't believe that Peter is available tomorrow to join us, so we should wait until he is available (hopefully next week) to discuss. If, despite the progression of this discussion, we are unable to reach agreement on the topic, we will flag the various suggestions and views raised by IRT members for public comment. Best, Amy Amy E. Bivins Registrar Services and Engagement Senior Manager Registrar Services and Industry Relations Internet Corporation for Assigned Names and Numbers (ICANN) Direct: +1 (202) 249-7551 Fax: +1 (202) 789-0104 Email: amy.bivins(a)icann.org<mailto:amy.bivins@icann.org> www.icann.org<http://www.icann.org> _______________________________________________ Gdd-gnso-ppsai-impl mailing list Gdd-gnso-ppsai-impl(a)icann.org<mailto:Gdd-gnso-ppsai-impl@icann.org> https://mm.icann.org/mailman/listinfo/gdd-gnso-ppsai-impl

2 1

Materials for tomorrow's PP IRT call
by Amy Bivins Feb. 12, 2018

Feb. 12, 2018

Hello, All, In advance of tomorrow's IRT call, I'm attaching the updated PP Policy document (in both clean and redline versions) and the de-accreditation process document in redline. Tomorrow we're planning to walk through the updates to these documents since we've last discussed them, and then we'll leave them open for your feedback. Following up on the discussion on the list this past week, we've seen significant discussion of the LEA disclosure framework. I don't believe that Peter is available tomorrow to join us, so we should wait until he is available (hopefully next week) to discuss. If, despite the progression of this discussion, we are unable to reach agreement on the topic, we will flag the various suggestions and views raised by IRT members for public comment. Best, Amy Amy E. Bivins Registrar Services and Engagement Senior Manager Registrar Services and Industry Relations Internet Corporation for Assigned Names and Numbers (ICANN) Direct: +1 (202) 249-7551 Fax: +1 (202) 789-0104 Email: amy.bivins(a)icann.org<mailto:amy.bivins@icann.org> www.icann.org<http://www.icann.org>

2 1

Re: [Gdd-gnso-ppsai-impl] Materials for tomorrow's PP IRT call
by Darcy Southwell Feb. 12, 2018

Feb. 12, 2018

My apologies, but I won’t be able to make tomorrow’s meeting. I will follow up by listening to the recording. Darcy From: Gdd-gnso-ppsai-impl <gdd-gnso-ppsai-impl-bounces(a)icann.org> on behalf of Amy Bivins <amy.bivins(a)icann.org> Reply-To: <gdd-gnso-ppsai-impl(a)icann.org> Date: Monday, February 12, 2018 at 9:23 AM To: "gdd-gnso-ppsai-impl(a)icann.org" <gdd-gnso-ppsai-impl(a)icann.org> Subject: [Gdd-gnso-ppsai-impl] Materials for tomorrow's PP IRT call Hello, All, In advance of tomorrow’s IRT call, I’m attaching the updated PP Policy document (in both clean and redline versions) and the de-accreditation process document in redline. Tomorrow we’re planning to walk through the updates to these documents since we’ve last discussed them, and then we’ll leave them open for your feedback. Following up on the discussion on the list this past week, we’ve seen significant discussion of the LEA disclosure framework. I don’t believe that Peter is available tomorrow to join us, so we should wait until he is available (hopefully next week) to discuss. If, despite the progression of this discussion, we are unable to reach agreement on the topic, we will flag the various suggestions and views raised by IRT members for public comment. Best, Amy Amy E. Bivins Registrar Services and Engagement Senior Manager Registrar Services and Industry Relations Internet Corporation for Assigned Names and Numbers (ICANN) Direct: +1 (202) 249-7551 Fax: +1 (202) 789-0104 Email: amy.bivins(a)icann.org www.icann.org _______________________________________________ Gdd-gnso-ppsai-impl mailing list Gdd-gnso-ppsai-impl(a)icann.org https://mm.icann.org/mailman/listinfo/gdd-gnso-ppsai-impl

2 1

Doc's for 2/13 PPSAI IRT call?
by Metalitz, Steven Feb. 12, 2018

Feb. 12, 2018

Hello Amy, In the run up to tomorrow's call I am checking on the status of the 2 documents you referenced in the message below as likely to be ready for review by the IRT by then: (1) One additional specification to review, related to the proposed format for monthly reporting (2) Updates to the draft Policy document, de-accreditation process document, and Applicant Guide based on the IRT's input Thanks in advance for the latest on this. Steve Metalitz [image001] Steven J. Metalitz | Partner, through his professional corporation T: 202.355.7902 | met(a)msk.com<mailto:met@msk.com> Mitchell Silberberg & Knupp LLP | www.msk.com<http://www.msk.com/> 1818 N Street NW, 8th Floor, Washington, DC 20036 THE INFORMATION CONTAINED IN THIS E-MAIL MESSAGE IS INTENDED ONLY FOR THE PERSONAL AND CONFIDENTIAL USE OF THE DESIGNATED RECIPIENTS. THIS MESSAGE MAY BE AN ATTORNEY-CLIENT COMMUNICATION, AND AS SUCH IS PRIVILEGED AND CONFIDENTIAL. IF THE READER OF THIS MESSAGE IS NOT AN INTENDED RECIPIENT, YOU ARE HEREBY NOTIFIED THAT ANY REVIEW, USE, DISSEMINATION, FORWARDING OR COPYING OF THIS MESSAGE IS STRICTLY PROHIBITED. PLEASE NOTIFY US IMMEDIATELY BY REPLY E-MAIL OR TELEPHONE, AND DELETE THE ORIGINAL MESSAGE AND ALL ATTACHMENTS FROM YOUR SYSTEM. THANK YOU. From: Gdd-gnso-ppsai-impl [mailto:gdd-gnso-ppsai-impl-bounces@icann.org] On Behalf Of Amy Bivins Sent: Tuesday, January 30, 2018 11:14 AM To: gdd-gnso-ppsai-impl(a)icann.org Subject: [Gdd-gnso-ppsai-impl] Action items, next steps following today's IRT call Dear Colleagues, Thank you for your participation on today's privacy/proxy IRT call. If you couldn't attend, I encourage you to listen to the (very short) recording, available on the wiki, https://community.icann.org/display/IRT/30+January+2018<https://community.icann.org/display/IRT/30+January+2018> Today, we reviewed proposed edits to Specification 5, including the addition of the following text from the Final Report to the specification's introduction (see p. 85 of the Final Report), "Given the balance that this Policy attempts to strike, evidence of the use of high-volume, automated electronic processes for sending Requests or responses to Requests (without human review) to the systems of Requesters, Providers, or Customers in performing any of the steps in the processes outlined in this Policy shall create a rebuttable presumption of non-compliance with this Policy." Barring any further IRT discussion on this change, or the other following typographical changes throughout the specification, we will make these edits to the next PPAA draft: * Updating references to "WHOIS" to "RDDS" throughout the specification; * Updating the word "Policy" to "Specification" throughout the specification; * Changing the word "trademark" to "copyright" in Section 32.2.7.4<http://32.2.7.4>. We also reviewed the previously agreed-upon plan to publish the draft data retention specification as-is, with the understanding that this could be impacted at a later date by the parallel GDPR work that is currently underway. Please send any further input you have on these items to the list this week. Next Steps We have one additional specification to review, related to the proposed format for monthly reporting (we expect this will mostly be of interest to the registrar members of the IRT). If this is ready next week we will review but, if not, we may cancel next week's meeting. I'll let you know by the end of this week. Meanwhile, ICANN Org is finalizing updates to the draft Policy document, de-accreditation process document, and Applicant Guide based on the IRT's input. I expect to be able to share these with you next week, for discussion the following week (the week of 13 February). I hope to be able to share the next PPAA draft with you the week of 13 Feb, for final IRT review over the following couple of weeks. Once these materials have been reviewed by the IRT, we will be ready for public comment. Our hope is to publish these for comment by the end of February, or at least prior to ICANN61. We have requested an IRT meeting slot for ICANN61, but do not have a date/time confirmed yet. Provided we are out for comment at that point, we plan to discuss the remaining Transfer Policy issue during that meeting. Best, Amy Amy E. Bivins Registrar Services and Engagement Senior Manager Registrar Services and Industry Relations Internet Corporation for Assigned Names and Numbers (ICANN) Direct: +1 (202) 249-7551 Fax: +1 (202) 789-0104 Email: amy.bivins(a)icann.org<mailto:amy.bivins@icann.org> www.icann.org<http://www.icann.org>

2 1

Request for IRT Feedback: LEA Framework Specification, Receipt Process's Application to High Priority Requests
by Amy Bivins Feb. 5, 2018

Feb. 5, 2018

Dear Colleagues, As mentioned on the list a couple of weeks ago, the current draft PPAA is still a bit ambiguous regarding how the review process outlined in Section 3.2.1 applies to high priority requests. We need ensure that the draft is clear about this requirement when we go out for public comment (and if there is opposition to the proposed requirement by any members of the IRT, this will be flagged in the call for comments). Upon reviewing the IRT's input to date, I am proposing an edit that I believe reflects the IRT discussion on this point. Please review and provide your comments on this proposed language no later than this Friday, 9 February. To summarize, the current draft contains a two-step process for Providers upon receipt of a request from LEA. (1) Within two business days, the Provider must review the request and confirm to the LEA requester that it has been received and contains the relevant information required to meet the minimum standard for acceptance (See 3.2.1 of Specification 4). (2) The Provider must then action the request in accordance with the priority level (within 24 hours for "high priority" requests (4.1.2); or within the timeline requested by LEA, if possible, for other requests (See 4.1.3). The current language may be a bit ambiguous as to whether the two business day "review period" applies before the 24-hour period for responding to high priority requests (as explained in more detail in the attached message). The view of registrar IRT members appears to be that requiring action within 24 hours of receipt of an LEA request, even if it is a high priority request, is unacceptable. PSWG members of the IRT disagree. Other IRT members appear to have mixed views on this (some referenced the RAA requirement that "Well-founded reports of Illegal Activity submitted to these [dedicated LEA] contacts must be reviewed within 24 hours by an individual who is empowered by Registrar to take necessary and appropriate actions in response to the report." Registrar members of the IRT said that the RAA-required review is less intensive than the PPAA review due to the specific requirements in the PPAA draft). Based on the views expressed within the IRT, it appears that one potential solution to this ambiguity would be to update Section 4.1.2 to state that (proposed edit in red), "Where a disclosure request has been categorized as High Priority, this must be actioned within 24 hours of completion of the receipt process outlined in Section 3.2." The LEA Requestor will detail the threat type and justification for a request with a Priority Level of High Priority." The practical impact of this proposed change would be that the provider must action a high priority request within 24 hours of determining that the request meets the minimum standard for acceptance. If the provider completes the receipt process sooner than 2 business days after receipt of the request, this would start the 24-hour clock for actioning the request. Thus, this could shorten the response window a bit, partially addressing the PSWG concerns of a "two business days plus 24 hours" requirement, while also addressing registrar concerns by not starting the clock until the provider has time to review the request, if the full time of the receipt process is required to conduct that review. Please provide your feedback on this proposed change no later than this Friday, 9 Feb. And if you have further comments on this, please share those as well. Best, Amy Amy E. Bivins Registrar Services and Engagement Senior Manager Registrar Services and Industry Relations Internet Corporation for Assigned Names and Numbers (ICANN) Direct: +1 (202) 249-7551 Fax: +1 (202) 789-0104 Email: amy.bivins(a)icann.org<mailto:amy.bivins@icann.org> www.icann.org<http://www.icann.org>

1 0

Canceled--PP IRT meeting scheduled for 6 Feb
by Amy Bivins Feb. 2, 2018

Feb. 2, 2018

Dear Colleagues, The Privacy/Proxy IRT meeting scheduled for 6 February has been canceled. We will reconvene the following week, 13 February. Please watch your inboxes, as updated materials should be distributed for your review and discussion on 13 February by the end of next week. Best (and have a great weekend!), Amy Amy E. Bivins Registrar Services and Engagement Senior Manager Registrar Services and Industry Relations Internet Corporation for Assigned Names and Numbers (ICANN) Direct: +1 (202) 249-7551 Fax: +1 (202) 789-0104 Email: amy.bivins(a)icann.org<mailto:amy.bivins@icann.org> www.icann.org<http://www.icann.org>

1 0