March 2018 - Gdd-gnso-ppsai-impl

Re: [Gdd-gnso-ppsai-impl] Discussion items for today's PP IRT face-to-face at ICANN61 (starting in 10 mins)
by Sara Bockey April 3, 2018

April 3, 2018

Amy, Following our F2F discussion on Sunday, many of us have continuing and renewed concerns regarding the LEA spec, in particular the high priority disclosure framework and Section 4.2. After much discussion and many options being put to staff, 4.1.2 has devolved to a “compromise” which is basically the exact same language we started with 6 months ago, with the exception of adding “in accordance with Section 4.2.” As such, we are very concerned that the LEA Spec as written creates a presumption of disclosure and means to bypass due process. Additionally, it is important to remember that this is an accreditation program for ALL Privacy/Proxy Providers around the globe. That means that LEA requests come from LEA in all sorts of countries, and the language in the accreditation agreement need to reflect that. We cannot take an American-centric view. We need to bolster the language in 4.2 to better protect the rights of the Provider and its customers. Therefore, if we are to consider/accept the current proposed high priority language, namely: “Where a disclosure request has been categorized as High Priority, this must be actioned within 24 hours, in accordance with Section 4.2. The LEA Requester will detail the threat type and justification for a request with a Priority Level of High Priority.” Then the following amendments must be made to Section 4.2 (new language in bold below): 4.2. Disclosure: 4.2.1. Within the applicable timeframe for a request’s Priority Level, Provider will disclose to the LEA Requestor, using a secure mechanism (this must be defined), the Requested Information it holds [associated with] the account. 4.2.2. Disclosure can be reasonably refused by Provider for reasons consistent with the general policy stated herein, including without limitations any of the following: 4.2.2.1. The LEA Requestor failed to provide to Provider information to meet the minimum standard for acceptance as outlined in Section 2 of this Specification; 4.2.2.2. If disclosure would lead to a contravention of applicable law; or 4.2.2.3. Where the Customer has provided, or Provider has found, specific information, facts, or circumstances showing that disclosure will endanger the safety of the Customer. 4.2.2.4. Where Provider has requested a court order/warrant/subpoena and LEA Requestor was unable or unwilling to provide same. 4.2.2.5. Where Provider has not been able to verify the identity of the LEA Requestor. (We also need to determine how Providers can best verify the identity of the requestor in a timely fashion. This can at times be very time consuming.) 4.2.2.6. Where Provider has found, after investigation, that LEA Requestor’s request is not well founded. 4.2.3. If disclosure is refused by Provider, Provider must provide written notice (which may be by electronic communication) to the LEA Requestor setting for Provider’s specific reasons for refusing to disclose. Such notice must be provided by Provider to the LEA Requestor prior to any Customer notification by Provider, irrespective of the reason for refusal. 4.2.4. In exceptional circumstances, if Provider requires additional time to respond to the LEA Requestor, Provider shall inform the LEA Requestor of the cause of the delay and agree with the LEA Requestor on a new date by which it will provide its response under this Section. 4.2. 4.2.5. For all refusals made in accordance with the policy and requirements herein, Provider must accept and give due consideration to the LEA Requestor’s requests for reconsideration of the refusal to disclose. 4.2.6. Nothing in Section 4.2 above shall be interpreted nor is it intended to imply the Provider shall forego due process within its applicable jurisdiction to satisfy LEA Requestor’s request, regardless of Priority Level. Finally, I believe you were wanting to know if it was acceptable to have Escrow separate from the PPAA. I believe that is the case for the RAA, so I do not see an issue with having it separate from the PPAA. Sara sara bockey sr. policy manager | GoDaddy™ sbockey(a)godaddy.com<mailto:sbockey@godaddy.com> 480-366-3616 skype: sbockey This email message and any attachments hereto is intended for use only by the addressee(s) named herein and may contain confidential information. If you have received this email in error, please immediately notify the sender and permanently delete the original and any copy of this message and its attachments. From: Gdd-gnso-ppsai-impl <gdd-gnso-ppsai-impl-bounces(a)icann.org> on behalf of Amy Bivins <amy.bivins(a)icann.org> Reply-To: "gdd-gnso-ppsai-impl(a)icann.org" <gdd-gnso-ppsai-impl(a)icann.org> Date: Sunday, March 11, 2018 at 6:24 PM To: "gdd-gnso-ppsai-impl(a)icann.org" <gdd-gnso-ppsai-impl(a)icann.org> Subject: [Gdd-gnso-ppsai-impl] Discussion items for today's PP IRT face-to-face at ICANN61 (starting in 10 mins) Dear Colleagues, Attached you will find a document that a member of the finance team will be discussing during our session starting in a few minutes. In addition, you’ll be hearing an update about ongoing discussions between registrar and PSWG members of the IRT related to the draft LEA disclosure framework specification. This language was discussed informally among a smaller group this afternoon. Registrar and PSWG members of the IRT appear to be nearing agreement on a proposal for presentation to the IRT that would include a 24-hour time frame for provider responses to high priority LEA requests, with some additional requirements for documentation demonstrating that the request is high priority. The updated draft language for Section 4.1.2 for further discussion (deletions shown as strikeouts, additions in blue) is currently: * “Where a disclosure request has been categorized as High Priority, this must be actioned responded to within 24 hours, in accordance with Section 4.2. The LEA Requester will detail the threat type and justification for a request with a Priority Level of High Priority.” In addition, staff was asked to provide suggestions for additional details that can be specified about what goes into a High Priority requests. Staff has proposed the following as a starting point. * “For High Priority requests, in addition to the requirements specified in Section 2.1.*, LEA Requesters should provide specific information demonstrating that the request is necessary due to an imminent threat to life, serious bodily injury, critical infrastructure or child exploitation”. (Note: Section 2.1 is the section that lists all the details currently needed for a request.) We will be discussing these during the session and soliciting further feedback on the list afterward. Best, Amy Amy E. Bivins Registrar Services and Engagement Senior Manager Registrar Services and Industry Relations Internet Corporation for Assigned Names and Numbers (ICANN) Direct: +1 (202) 249-7551 Fax: +1 (202) 789-0104 Email: amy.bivins(a)icann.org<mailto:amy.bivins@icann.org> www.icann.org<http://www.icann.org>

6 6

Re: [Gdd-gnso-ppsai-impl] Reminder: IRT feedback requested on proposed LEA Spec edits by EOD Friday, 30 March
by Darcy Southwell March 30, 2018

March 30, 2018

Amy, Given the edits and details below, and the March 30 deadline for further suggestions, what is staff’s expected timing for publishing for public comment? Thanks, Darcy From: Gdd-gnso-ppsai-impl <gdd-gnso-ppsai-impl-bounces(a)icann.org> on behalf of Amy Bivins <amy.bivins(a)icann.org> Reply-To: <gdd-gnso-ppsai-impl(a)icann.org> Date: Wednesday, March 28, 2018 at 5:40 AM To: "gdd-gnso-ppsai-impl(a)icann.org" <gdd-gnso-ppsai-impl(a)icann.org> Subject: [Gdd-gnso-ppsai-impl] Reminder: IRT feedback requested on proposed LEA Spec edits by EOD Friday, 30 March Dear Colleagues, This is a reminder that you are requested to provide any additional input you have on the latest proposed edits to the LEA Specification no later than this Friday, 30 March. The latest message to the group on this topic is attached. The following proposed edits appear to be non-controversial given all of the IRT discussions to date. If we receive no objections to these proposals, we will add these to the draft prior to publishing for public comment: (1) The addition of the following sections proposed by Sara Bockey (information required to be included in an LEA request): 2.1.9 A clear statement that the domain name or URL involved is part of an official investigation. 2.1.10 A clear statement that the Law Enforcement/Gov’t Agency [propose to change to “Law Enforcement Authority” here for consistency] has attempted to contact the relevant parties and has no other means of identifying them. 2.1.11 For High Priority requests, in addition to the requirements specified in 2.1.1-2.1.10, the Requestor must provide specific information demonstrating that the request is High Priority due to an imminent threat to life, serious bodily injury, critical infrastructure or child exploitation. We would also likely re-arrange this section slightly, to move the current section 2.1.7 (Any details otherwise required by applicable law) to the end of this section. (2) The addition of “subject to any additional requirements under applicable law or court order” in Section 4.3.1. (3) Moving section 6.3 up to the notification section as 4.3.3. The edits proposed in Section 4.2 appear to be more controversial and would be flagged during the public comment period. Likewise, the disagreement among IRT members on the time period for high-priority requests would be specifically flagged for public comment. If you would like to discuss any of these proposed edits during our call on Tuesday, please let me know. Internally, we are continuing to work on the request for additional data surrounding the fees proposal. We are also working on removing the data escrow specification from the body of the contract into a separate specification, and corresponding edits to the contract to accommodate that. I’m not sure whether the data escrow materials will be ready for next week or not. I’ll update you before we meet. If we don’t have updated escrow materials ready and you do not wish to discuss any of the LEA-related issues, we might cancel Tuesday’s call. The fees information will not be ready for next week, but we will get it to you as soon as possible. Best, Amy Amy E. Bivins Registrar Services and Engagement Senior Manager Registrar Services and Industry Relations Internet Corporation for Assigned Names and Numbers (ICANN) Direct: +1 (202) 249-7551 Fax: +1 (202) 789-0104 Email: amy.bivins(a)icann.org www.icann.org _______________________________________________ Gdd-gnso-ppsai-impl mailing list Gdd-gnso-ppsai-impl(a)icann.org https://mm.icann.org/mailman/listinfo/gdd-gnso-ppsai-impl

5 4

Re: [Gdd-gnso-ppsai-impl] Reminder: IRT feedback requested on proposed LEA Spec edits by EOD Friday, 30 March
by Michele Neylon - Blacknight March 29, 2018

March 29, 2018

Amy During a registrar specific meeting with Compliance in PR we asked specifically about their overall expected spend and the volume of complaints they currently handle related to privacy / proxy. Three things came out of this: 1 – Compliance does not see a large volume of complaints related to privacy / proxy 2 – Compliance has more staff budgeted for than they currently have 3 – they have no plans to increase their headcount Considering that the bulk of engagement from ICANN staff in relation to proxy / privacy is going to be around contractual enforcement I am really curious to see how ICANN intends to rationalise the proposed fees. Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 From: Gdd-gnso-ppsai-impl <gdd-gnso-ppsai-impl-bounces(a)icann.org> on behalf of Amy Bivins <amy.bivins(a)icann.org> Reply-To: "gdd-gnso-ppsai-impl(a)icann.org" <gdd-gnso-ppsai-impl(a)icann.org> Date: Wednesday 28 March 2018 at 13:40 To: "gdd-gnso-ppsai-impl(a)icann.org" <gdd-gnso-ppsai-impl(a)icann.org> Subject: [Gdd-gnso-ppsai-impl] Reminder: IRT feedback requested on proposed LEA Spec edits by EOD Friday, 30 March Dear Colleagues, This is a reminder that you are requested to provide any additional input you have on the latest proposed edits to the LEA Specification no later than this Friday, 30 March. The latest message to the group on this topic is attached. The following proposed edits appear to be non-controversial given all of the IRT discussions to date. If we receive no objections to these proposals, we will add these to the draft prior to publishing for public comment: (1) The addition of the following sections proposed by Sara Bockey (information required to be included in an LEA request): 2.1.9 A clear statement that the domain name or URL involved is part of an official investigation. 2.1.10 A clear statement that the Law Enforcement/Gov’t Agency [propose to change to “Law Enforcement Authority” here for consistency] has attempted to contact the relevant parties and has no other means of identifying them. 2.1.11 For High Priority requests, in addition to the requirements specified in 2.1.1-2.1.10, the Requestor must provide specific information demonstrating that the request is High Priority due to an imminent threat to life, serious bodily injury, critical infrastructure or child exploitation. We would also likely re-arrange this section slightly, to move the current section 2.1.7 (Any details otherwise required by applicable law) to the end of this section. (2) The addition of “subject to any additional requirements under applicable law or court order” in Section 4.3.1. (3) Moving section 6.3 up to the notification section as 4.3.3. The edits proposed in Section 4.2 appear to be more controversial and would be flagged during the public comment period. Likewise, the disagreement among IRT members on the time period for high-priority requests would be specifically flagged for public comment. If you would like to discuss any of these proposed edits during our call on Tuesday, please let me know. Internally, we are continuing to work on the request for additional data surrounding the fees proposal. We are also working on removing the data escrow specification from the body of the contract into a separate specification, and corresponding edits to the contract to accommodate that. I’m not sure whether the data escrow materials will be ready for next week or not. I’ll update you before we meet. If we don’t have updated escrow materials ready and you do not wish to discuss any of the LEA-related issues, we might cancel Tuesday’s call. The fees information will not be ready for next week, but we will get it to you as soon as possible. Best, Amy Amy E. Bivins Registrar Services and Engagement Senior Manager Registrar Services and Industry Relations Internet Corporation for Assigned Names and Numbers (ICANN) Direct: +1 (202) 249-7551 Fax: +1 (202) 789-0104 Email: amy.bivins(a)icann.org<mailto:amy.bivins@icann.org> www.icann.org<http://www.icann.org>

7 8

Reminder: IRT feedback requested on proposed LEA Spec edits by EOD Friday, 30 March
by Amy Bivins March 28, 2018

March 28, 2018

Dear Colleagues, This is a reminder that you are requested to provide any additional input you have on the latest proposed edits to the LEA Specification no later than this Friday, 30 March. The latest message to the group on this topic is attached. The following proposed edits appear to be non-controversial given all of the IRT discussions to date. If we receive no objections to these proposals, we will add these to the draft prior to publishing for public comment: (1) The addition of the following sections proposed by Sara Bockey (information required to be included in an LEA request): 2.1.9 A clear statement that the domain name or URL involved is part of an official investigation. 2.1.10 A clear statement that the Law Enforcement/Gov't Agency [propose to change to "Law Enforcement Authority" here for consistency] has attempted to contact the relevant parties and has no other means of identifying them. 2.1.11 For High Priority requests, in addition to the requirements specified in 2.1.1-2.1.10, the Requestor must provide specific information demonstrating that the request is High Priority due to an imminent threat to life, serious bodily injury, critical infrastructure or child exploitation. We would also likely re-arrange this section slightly, to move the current section 2.1.7 (Any details otherwise required by applicable law) to the end of this section. (2) The addition of "subject to any additional requirements under applicable law or court order" in Section 4.3.1. (3) Moving section 6.3 up to the notification section as 4.3.3. The edits proposed in Section 4.2 appear to be more controversial and would be flagged during the public comment period. Likewise, the disagreement among IRT members on the time period for high-priority requests would be specifically flagged for public comment. If you would like to discuss any of these proposed edits during our call on Tuesday, please let me know. Internally, we are continuing to work on the request for additional data surrounding the fees proposal. We are also working on removing the data escrow specification from the body of the contract into a separate specification, and corresponding edits to the contract to accommodate that. I'm not sure whether the data escrow materials will be ready for next week or not. I'll update you before we meet. If we don't have updated escrow materials ready and you do not wish to discuss any of the LEA-related issues, we might cancel Tuesday's call. The fees information will not be ready for next week, but we will get it to you as soon as possible. Best, Amy Amy E. Bivins Registrar Services and Engagement Senior Manager Registrar Services and Industry Relations Internet Corporation for Assigned Names and Numbers (ICANN) Direct: +1 (202) 249-7551 Fax: +1 (202) 789-0104 Email: amy.bivins(a)icann.org<mailto:amy.bivins@icann.org> www.icann.org<http://www.icann.org>

2 1

Updated reporting specification, per IRT feedback
by Amy Bivins March 26, 2018

March 26, 2018

Dear Colleagues, Attached is an updated version of the reporting specification. To summarize the changes that were made: 1. We updated the report frequency to quarterly (initial proposal was monthly) 2. We eliminated the per-TLD report requirement 3. We eliminated a few of the unnecessary fields (e.g., publication requests for IP and LEA, some of the "total" fields at the top) 4. We added a couple of fields for "other" requests (non-LEA or IP) We have considered the IRT's feedback on use of RRI. ICANN org believes that the use of RRI is preferable for both ICANN org and providers, as opposed to accepting emailed forms because: * The only difference on the provider side is using an API (the report format will be the same, and ICANN is providing a template to create the CSV file that will be submitted via the API); * Using the API will allow real-time confirmation that the report format is valid, eliminating the need for manual communications back and forth between ICANN org and the provider * ICANN org will provide training materials for using the API for providers who are unfamiliar with the process. If you have any further feedback on this, please send it to the list. Best, Amy Amy E. Bivins Registrar Services and Engagement Senior Manager Registrar Services and Industry Relations Internet Corporation for Assigned Names and Numbers (ICANN) Direct: +1 (202) 249-7551 Fax: +1 (202) 789-0104 Email: amy.bivins(a)icann.org<mailto:amy.bivins@icann.org> www.icann.org<http://www.icann.org>

2 1

IRT meeting canceled tomorrow, please send any final input on LEA spec by EOD Friday, 30 April
by Amy Bivins March 26, 2018

March 26, 2018

Dear Colleagues, Since we are still having issues with Adobe Connect, we are going to cancel tomorrow's Privacy/Proxy IRT meeting, as it would be difficult to review this document without a screen. Please send any final feedback on the proposed edits to this specification, raised by Sara and Nick, no later than your EOD Friday. I've attached the most recent markup that includes notes on proposed edits. Best, Amy Amy E. Bivins Registrar Services and Engagement Senior Manager Registrar Services and Industry Relations Internet Corporation for Assigned Names and Numbers (ICANN) Direct: +1 (202) 249-7551 Fax: +1 (202) 789-0104 Email: amy.bivins(a)icann.org<mailto:amy.bivins@icann.org> www.icann.org<http://www.icann.org>

1 0

Discussion document for Tuesday's PP IRT meeting
by Amy Bivins March 24, 2018

March 24, 2018

Thank you, Sara. I’ve created a new markup of the spec showing the most recent comments and proposed edits from Sara Bockey and Nick Shorey (attached). We will go through this on Tuesday to determine whether there is consensus on any of these edits. If other registrars agree with Sara’s position on the 24 hour/1 business day issue, we will flag this as an area of disagreement among IRT members and specifically request public comments on this. I’m not sure yet whether we will have Adobe Connect capability restored in time for our meeting. If not, we will do the best we can with a phone bridge. Thanks, and have a great weekend. Amy From: Gdd-gnso-ppsai-impl [mailto:gdd-gnso-ppsai-impl-bounces@icann.org] On Behalf Of Sara Bockey Sent: Thursday, March 22, 2018 4:30 PM To: gdd-gnso-ppsai-impl(a)icann.org Subject: Re: [Gdd-gnso-ppsai-impl] Discussion items for today's PP IRT face-to-face at ICANN61 (starting in 10 mins) Hi Amy, After further discussions within our Legal team, we (GoDaddy) have determined that committing to a 24-hour response time for high priority requests is unworkable. Our P/P team does not, nor have they ever, provide a 24/7 service. Additionally, while GoDaddy, the registrar, has received “imminent threat to life” requests, our P/P team has not. Building this capability in our P/P would be a significant undertaking. And if this poses a challenge for a company as large as GoDaddy, it will be significantly more difficult for smaller providers. As Peter has often reminded us, this agreement is between the Provider and ICANN, and LEA is not a party to it. While we understand and respect the needs of LEAs, and GoDaddy has a long-standing track record of cooperating with high-priority investigations, that doesn’t mean we can accept unreasonable contract terms. Accordingly, after much consideration and internal discussions with our P/P and Legal teams, GoDaddy believes one business day is the appropriate response time for High Priority requests. Additionally, our Legal team has determined the following amendments are needed to the Specification. Section 2.1, the following provisions must be added: 2.1.9 A clear statement that the domain name or URL involved is part of an official investigation. 2.1.10 A clear statement that Law Enforcement/Gov’t Agency has attempted to contact the relevant parties and has no other means of identifying them. I would also like clarification to understand where ICANN staff is intending to include this proposed language: “For High Priority requests, in addition to the requirements specified in Section 2.1.*, LEA Requesters should provide specific information demonstrating that the request is necessary due to an imminent threat to life, serious bodily injury, critical infrastructure or child exploitation”. Was staff intending it to be part of 2.1 or appear elsewhere? Regarding Nick’s comment on previously proposed language in 4.2.2.6, which states “Where Provider has found, after investigation, that LEA Requestor’s request is not well founded”, the intent to not to challenge the veracity of the request, but rather a reflection of the language that appears in Section 3.18.2 of the RAA. Regarding Nick’s comments on the proposed language in 4.2.2.4 and 4.2.6, while I appreciate his efforts to combine the two provisions as a compromise, 4.2.6 must stand on its own. I am willing to remove “Where Provider has requested a court order/warrant/subpoena and LEA Requestor was unable or unwilling to provide same” as a reason for refusal under 4.2.2, but the proposed 4.2.6 language must remain as is. In light of the above, 4.2.2 and 4.2.6 would read as follows: 4.2.2. Disclosure can be reasonably refused by Provider for reasons consistent with the general policy stated herein, including without limitations any of the following: 4.2.2.1. The LEA Requestor failed to provide to Provider information to meet the minimum standard for acceptance as outlined in Section 2 of this Specification; 4.2.2.2. If disclosure would lead to a contravention of applicable law; or 4.2.2.3. Where the Customer has provided, or Provider has found, specific information, facts, or circumstances showing that disclosure will endanger the safety of the Customer. 4.2.2.4. Where Provider has not been able to verify the identity of the LEA Requestor, in accordance with 3.2.2. 4.2.2.5. Where Provider has found, after investigation, that LEA Requestor’s request is not well founded. 4.2.6. Nothing in Section 4.2 above shall be interpreted nor is it intended to imply the Provider shall forego due process within its applicable jurisdiction to satisfy LEA Requestor’s request, regardless of Priority Level. Finally, I want to ensure that Staff includes a provision regarding exceptional circumstances, as previously discussed, to address acts of nature, or other circumstances outside of the provider’s control. Perhaps we can address this in Section 4.2.4, for example: 4.2.4. In exceptional circumstances, if Provider requires additional time to respond to the LEA Requestor, Provider shall inform the LEA Requestor of the cause of the delay and agree with the LEA Requestor on a new date by which it will provide its response under this Section. 4.2. 4.2.4.1. Exceptional circumstances to include delays caused by acts of nature. Sara sara bockey sr. policy manager | GoDaddy™ sbockey(a)godaddy.com<mailto:sbockey@godaddy.com> 480-366-3616 skype: sbockey This email message and any attachments hereto is intended for use only by the addressee(s) named herein and may contain confidential information. If you have received this email in error, please immediately notify the sender and permanently delete the original and any copy of this message and its attachments. From: Gdd-gnso-ppsai-impl <gdd-gnso-ppsai-impl-bounces(a)icann.org<mailto:gdd-gnso-ppsai-impl-bounces@icann.org>> on behalf of Amy Bivins <amy.bivins(a)icann.org<mailto:amy.bivins@icann.org>> Reply-To: "gdd-gnso-ppsai-impl(a)icann.org<mailto:gdd-gnso-ppsai-impl@icann.org>" <gdd-gnso-ppsai-impl(a)icann.org<mailto:gdd-gnso-ppsai-impl@icann.org>> Date: Thursday, March 15, 2018 at 12:44 PM To: "gdd-gnso-ppsai-impl(a)icann.org<mailto:gdd-gnso-ppsai-impl@icann.org>" <gdd-gnso-ppsai-impl(a)icann.org<mailto:gdd-gnso-ppsai-impl@icann.org>> Subject: Re: [Gdd-gnso-ppsai-impl] Discussion items for today's PP IRT face-to-face at ICANN61 (starting in 10 mins) Thanks, everyone, for your continued work on this. Sara and other registrars in the group, what do you think about the issues/edits raised by Peter and Nick? I know it had been an incredibly busy week for those of you at ICANN61. It’s not expected that resolution must be reached on this this week. It’s clear that both sides are willing to continue working toward a compromise and hopefully we can pick this up on the list next week and wrap this up in our next meeting. With respect to the other major topic discussed this week, I’ll get you additional information as soon as I can regarding the fees discussion. Safe travels to everyone who attended ICANN61! Best, Amy Sent from my iPhone On Mar 15, 2018, at 1:36 PM, Nick Shorey <lists(a)nickshorey.com<mailto:lists@nickshorey.com>> wrote: Hi everyone, I suggest a couple of tweaks to the text amendments proposed by Sara, to provide further clarity: 4.2.2.4. Where a court order/warrant/subpoena is legally required and Requestor was unable or unwilling to provide the same; I think 4.2.6. is covered in 4.2.2 (it was certainly intended to achieve this, so maybe these two could be combined with something like: 4.2.2. If disclosure would lead to a contravention of applicable law, or require the Provider to act outside of due legal process within its required jurisdiction, irrespective of Priority Level. I’m not sure about the inclusion of 4.2.2.6. If the intent is to give the ability of the Provider to challenge the veracity of Request when appropriate legal authority (court order etc) has been provided I disagree, as I believe the judicial process should ultimately determine the veracity and legality of the prosecution’s evidential case, and I think it is a dangerous thing to shift the responsibility to the Provider to make such determinations. If the intent is to challenge the accuracy of the request, such as the domain name in question has been incorrectly spelt, or the privacy registration is not held with the Provider, then this should be covered in 4.2.2.1 and 4.2.3. Kind regards, Nick Nick Shorey Phone: +44 (0) 7552 455 988 Email: lists(a)nickshorey.com<mailto:lists@nickshorey.com> Skype: nick.shorey Twitter: @nickshorey LinkedIn: www.linkedin.com/in/nicklinkedin<http://www.linkedin.com/in/nicklinkedin> Web: www.nickshorey.com<http://www.nickshorey.com> On 15 Mar 2018, at 17:08, Roman, Peter (CRM) <Peter.Roman(a)usdoj.gov<mailto:Peter.Roman@usdoj.gov>> wrote: All - I need some time to review and digest this, but my first reaction is that this is a good attempt to find a working compromise. That said, there is one provision that is mildly problematic: 4.2.2.4. Where Provider has requested a court order/warrant/subpoena and LEA Requestor was unable or unwilling to provide same. The whole point of the emergency request is that there is not enough time to get any kind of court order. If there was time to get a court order, we would just go get it. This provision would effectively render the high priority disclosure meaningless. Also, I was kind of hoping that rather than just denying requests outright, if the provider finds some problem, there could be a discussion between the provider and the Requestor about what those problems are and whether we can rectify them. I don’t know whether that can be incorporated in the draft but I hope that was an underlying assumption that I just missed in this quick review (while listening to the timeline discussion in San Juan). Finally, I don’t understand the bit about providers giving the LEA Requestor a written response. First, that seems slow in a situation where speed is critical (unless by “in writing” you mean “by email or text”). If you are going to deny the request, it would be good to do so in time to see if we can fix the issue and/or to work other avenues of investigation. Second, as noted above, that sounds like a final decision will be made without any consultation with the Requestor to try and fix the request. Thanks for taking the time to work on this with us and being willing to compromise. Best, Peter Roman Senior Counsel Computer Crime & Intellectual Property Section Criminal Division U.S. Department of Justice 1301 New York Ave.<x-apple-data-detectors://7>, NW Washington, DC 20530 (202) 305-1323 peter.roman(a)usdoj.gov<mailto:peter.roman@usdoj.gov> On Mar 15, 2018, at 12:30 PM, Sara Bockey <sbockey(a)godaddy.com<mailto:sbockey@godaddy.com>> wrote: Amy, Following our F2F discussion on Sunday, many of us have continuing and renewed concerns regarding the LEA spec, in particular the high priority disclosure framework and Section 4.2. After much discussion and many options being put to staff, 4.1.2 has devolved to a “compromise” which is basically the exact same language we started with 6 months ago, with the exception of adding “in accordance with Section 4.2.” As such, we are very concerned that the LEA Spec as written creates a presumption of disclosure and means to bypass due process. Additionally, it is important to remember that this is an accreditation program for ALL Privacy/Proxy Providers around the globe. That means that LEA requests come from LEA in all sorts of countries, and the language in the accreditation agreement need to reflect that. We cannot take an American-centric view. We need to bolster the language in 4.2 to better protect the rights of the Provider and its customers. Therefore, if we are to consider/accept the current proposed high priority language, namely: “Where a disclosure request has been categorized as High Priority, this must be actioned within 24 hours, in accordance with Section 4.2. The LEA Requester will detail the threat type and justification for a request with a Priority Level of High Priority.” Then the following amendments must be made to Section 4.2 (new language in bold below): 4.2. Disclosure: 4.2.1. Within the applicable timeframe for a request’s Priority Level, Provider will disclose to the LEA Requestor, using a secure mechanism (this must be defined), the Requested Information it holds [associated with] the account. 4.2.2. Disclosure can be reasonably refused by Provider for reasons consistent with the general policy stated herein, including without limitations any of the following: 4.2.2.1. The LEA Requestor failed to provide to Provider information to meet the minimum standard for acceptance as outlined in Section 2 of this Specification; 4.2.2.2. If disclosure would lead to a contravention of applicable law; or 4.2.2.3. Where the Customer has provided, or Provider has found, specific information, facts, or circumstances showing that disclosure will endanger the safety of the Customer. 4.2.2.4. Where Provider has requested a court order/warrant/subpoena and LEA Requestor was unable or unwilling to provide same. 4.2.2.5. Where Provider has not been able to verify the identity of the LEA Requestor. (We also need to determine how Providers can best verify the identity of the requestor in a timely fashion. This can at times be very time consuming.) 4.2.2.6. Where Provider has found, after investigation, that LEA Requestor’s request is not well founded. 4.2.3. If disclosure is refused by Provider, Provider must provide written notice (which may be by electronic communication) to the LEA Requestor setting for Provider’s specific reasons for refusing to disclose. Such notice must be provided by Provider to the LEA Requestor prior to any Customer notification by Provider, irrespective of the reason for refusal. 4.2.4. In exceptional circumstances, if Provider requires additional time to respond to the LEA Requestor, Provider shall inform the LEA Requestor of the cause of the delay and agree with the LEA Requestor on a new date by which it will provide its response under this Section. 4.2. 4.2.5. For all refusals made in accordance with the policy and requirements herein, Provider must accept and give due consideration to the LEA Requestor’s requests for reconsideration of the refusal to disclose. 4.2.6. Nothing in Section 4.2 above shall be interpreted nor is it intended to imply the Provider shall forego due process within its applicable jurisdiction to satisfy LEA Requestor’s request, regardless of Priority Level. Finally, I believe you were wanting to know if it was acceptable to have Escrow separate from the PPAA. I believe that is the case for the RAA, so I do not see an issue with having it separate from the PPAA. Sara sara bockey sr. policy manager | GoDaddy™ sbockey(a)godaddy.com<mailto:sbockey@godaddy.com> 480-366-3616 skype: sbockey This email message and any attachments hereto is intended for use only by the addressee(s) named herein and may contain confidential information. If you have received this email in error, please immediately notify the sender and permanently delete the original and any copy of this message and its attachments. From: Gdd-gnso-ppsai-impl <gdd-gnso-ppsai-impl-bounces(a)icann.org<mailto:gdd-gnso-ppsai-impl-bounces@icann.org>> on behalf of Amy Bivins <amy.bivins(a)icann.org<mailto:amy.bivins@icann.org>> Reply-To: "gdd-gnso-ppsai-impl(a)icann.org<mailto:gdd-gnso-ppsai-impl@icann.org>" <gdd-gnso-ppsai-impl(a)icann.org<mailto:gdd-gnso-ppsai-impl@icann.org>> Date: Sunday, March 11, 2018 at 6:24 PM To: "gdd-gnso-ppsai-impl(a)icann.org<mailto:gdd-gnso-ppsai-impl@icann.org>" <gdd-gnso-ppsai-impl(a)icann.org<mailto:gdd-gnso-ppsai-impl@icann.org>> Subject: [Gdd-gnso-ppsai-impl] Discussion items for today's PP IRT face-to-face at ICANN61 (starting in 10 mins) Dear Colleagues, Attached you will find a document that a member of the finance team will be discussing during our session starting in a few minutes. In addition, you’ll be hearing an update about ongoing discussions between registrar and PSWG members of the IRT related to the draft LEA disclosure framework specification. This language was discussed informally among a smaller group this afternoon. Registrar and PSWG members of the IRT appear to be nearing agreement on a proposal for presentation to the IRT that would include a 24-hour time frame for provider responses to high priority LEA requests, with some additional requirements for documentation demonstrating that the request is high priority. The updated draft language for Section 4.1.2 for further discussion (deletions shown as strikeouts, additions in blue) is currently: * “Where a disclosure request has been categorized as High Priority, this must beactioned responded to within 24 hours, in accordance with Section 4.2. The LEA Requester will detail the threat type and justification for a request with a Priority Level of High Priority.” In addition, staff was asked to provide suggestions for additional details that can be specified about what goes into a High Priority requests. Staff has proposed the following as a starting point. * “For High Priority requests, in addition to the requirements specified in Section 2.1.*, LEA Requesters should provide specific information demonstrating that the request is necessary due to an imminent threat to life, serious bodily injury, critical infrastructure or child exploitation”. (Note: Section 2.1 is the section that lists all the details currently needed for a request.) We will be discussing these during the session and soliciting further feedback on the list afterward. Best, Amy Amy E. Bivins Registrar Services and Engagement Senior Manager Registrar Services and Industry Relations Internet Corporation for Assigned Names and Numbers (ICANN) Direct: +1 (202) 249-7551 Fax: +1 (202) 789-0104 Email: amy.bivins(a)icann.org<mailto:amy.bivins@icann.org> www.icann.org<http://www.icann.org/> _______________________________________________ Gdd-gnso-ppsai-impl mailing list Gdd-gnso-ppsai-impl(a)icann.org<mailto:Gdd-gnso-ppsai-impl@icann.org> https://mm.icann.org/mailman/listinfo/gdd-gnso-ppsai-impl _______________________________________________ Gdd-gnso-ppsai-impl mailing list Gdd-gnso-ppsai-impl(a)icann.org<mailto:Gdd-gnso-ppsai-impl@icann.org> https://mm.icann.org/mailman/listinfo/gdd-gnso-ppsai-impl <signature.asc> _______________________________________________ Gdd-gnso-ppsai-impl mailing list Gdd-gnso-ppsai-impl(a)icann.org<mailto:Gdd-gnso-ppsai-impl@icann.org> https://mm.icann.org/mailman/listinfo/gdd-gnso-ppsai-impl

3 2

PP IRT action items, agenda for next week's meeting
by Amy Bivins March 21, 2018

March 21, 2018

Dear Colleagues, I hope you are well! Following up on the IRT's discussions during ICANN61, we have a couple of action items. Our next meeting is scheduled for 27 March, 1400 UTC. Registrar and PSWG members of the IRT are requested to provide any additional feedback on the LEA Disclosure Framework Specification discussion (most recent thread attached) prior to our next meeting. To recap, registrar members of the IRT indicated that they could potentially accept a 24-hour period for actioning high priority requests, provided other edits were made. PSWG provided feedback on those proposed edits. Feedback from registrar members of the group is specifically requested on the PSWG/LEA members' most recent response. We will have a final discussion on this topic on Tuesday, to determine whether or not a compromise can be reached. Per your feedback, ICANN org is finalizing an updated reporting specification draft, which I hope to be able to distribute to you this week. We're also working on edits to the data escrow spec, which we hope to be ready to discuss shortly. We are reviewing your feedback on fees with the Finance team and will provide an update next week. Best, Amy Amy E. Bivins Registrar Services and Engagement Senior Manager Registrar Services and Industry Relations Internet Corporation for Assigned Names and Numbers (ICANN) Direct: +1 (202) 249-7551 Fax: +1 (202) 789-0104 Email: amy.bivins(a)icann.org<mailto:amy.bivins@icann.org> www.icann.org<http://www.icann.org>

1 0

Update, action items following PP IRT meetings at ICANN61
by Amy Bivins March 16, 2018

March 16, 2018

Dear Colleagues, I hope you are well. If you were unable to attend the ICANN61 privacy/proxy IRT face-to-face meeting in person or listen in, I encourage you to review the recording, available here: https://participate.icann.org/p4gkq5rzjbj/ Below, you will see a list of outstanding items, as well as a call for your feedback. Please review carefully. We are requesting your final feedback on items (1)-(2) by this Friday. During the session on Sunday, the IRT heard a presentation from ICANN org finance regarding the proposed fee schedule. ICANN is reviewing the IRT's request for additional supporting data and intends to provide a response next week. The IRT heard an update on discussions between PSWG and registrar members of the IRT on the LEA Disclosure Framework Specification. PSWG and registrar members continue to discuss this topic this week, with the goal of determining whether a compromise can be reached by this Friday. IRT Action Items 1. Request for feedback on draft reporting specification, per discussion on the list. Any additional IRT feedback is requested by the end of this week. We will draft any updates in response to your feedback early next week. * The most significant issue appears to be the level of detail that should be required for the reports. Registrar members of the IRT have asserted that it will be difficult to provide the level of detail proposed (or that these could be prone to human error in reporting)-regarding types of requests (LEA, IP, Other) and reporting by-registrar and by-TLD. Any additional feedback is specifically requested on this topic this week. A decision will be made on this after the close of ICANN61, for the purpose of drafting final proposed requirements for public comment. * There were issues raised about using the RRI reporting system versus allowing forms to be emailed. ICANN provided additional details (attached) on the RRI process (creating spreadsheet using standard format, converting to CSV, and submitting using API). The RRI process would be largely the same using an emailed form (the only difference would be emailing the CSV or spreadsheet rather than using the API). Considering the benefits of using RRI (less manual review of reports, immediate notifications to providers if there are problems with the report, less back-and-forth to correct report errors) ICANN proposes to keep the RRI requirement absent significant opposition to this from the IRT. Training for how to use the RRI system can be provided for providers who need it. 2. A question on the data escrow specification: Does the IRT see an issue with making the data escrow specification a separate document from the PPAA, so that it can be more easily updated if/when technical requirements change (as is done for registrars)? 3. Any additional IRT feedback on updated PPAA draft (attached) requested by 23 March. Our next IRT meeting is scheduled for 27 March, 1400 UTC. Best, Amy Amy E. Bivins Registrar Services and Engagement Senior Manager Registrar Services and Industry Relations Internet Corporation for Assigned Names and Numbers (ICANN) Direct: +1 (202) 249-7551 Fax: +1 (202) 789-0104 Email: amy.bivins(a)icann.org<mailto:amy.bivins@icann.org> www.icann.org<http://www.icann.org>

2 1

Discussion items for today's PP IRT face-to-face at ICANN61 (starting in 10 mins)
by Amy Bivins March 11, 2018

March 11, 2018

Dear Colleagues, Attached you will find a document that a member of the finance team will be discussing during our session starting in a few minutes. In addition, you'll be hearing an update about ongoing discussions between registrar and PSWG members of the IRT related to the draft LEA disclosure framework specification. This language was discussed informally among a smaller group this afternoon. Registrar and PSWG members of the IRT appear to be nearing agreement on a proposal for presentation to the IRT that would include a 24-hour time frame for provider responses to high priority LEA requests, with some additional requirements for documentation demonstrating that the request is high priority. The updated draft language for Section 4.1.2 for further discussion (deletions shown as strikeouts, additions in blue) is currently: * "Where a disclosure request has been categorized as High Priority, this must be actioned responded to within 24 hours, in accordance with Section 4.2. The LEA Requester will detail the threat type and justification for a request with a Priority Level of High Priority." In addition, staff was asked to provide suggestions for additional details that can be specified about what goes into a High Priority requests. Staff has proposed the following as a starting point. * "For High Priority requests, in addition to the requirements specified in Section 2.1.*, LEA Requesters should provide specific information demonstrating that the request is necessary due to an imminent threat to life, serious bodily injury, critical infrastructure or child exploitation". (Note: Section 2.1 is the section that lists all the details currently needed for a request.) We will be discussing these during the session and soliciting further feedback on the list afterward. Best, Amy Amy E. Bivins Registrar Services and Engagement Senior Manager Registrar Services and Industry Relations Internet Corporation for Assigned Names and Numbers (ICANN) Direct: +1 (202) 249-7551 Fax: +1 (202) 789-0104 Email: amy.bivins(a)icann.org<mailto:amy.bivins@icann.org> www.icann.org<http://www.icann.org>

1 0

Additional Background Re: Proposed PP Reporting Process
by Amy Bivins March 11, 2018

March 11, 2018

Dear Colleagues, Following up on our discussion today about the processes for monthly reporting, I can now provide some additional information from our tech team. I have attached two templates that can be used to get a better idea of how the report contents are expected to look (using RRI) assuming 2 sample registrars and TLDs. These templates were created using our current internal working draft, so the fields don't match the previous version of the specification you reviewed. Certain fields (in the top row) were tentatively deleted, and others added, pending further IRT input on the topic. If the IRT's consensus was that reporting should not be broken out by category, the number of fields would be further reduced. Providers would not be required under the current proposal to automate their end of the reporting and are allowed to generate the files manually if they prefer. Since RRI is a RESTful API, users may upload the report files using a simple command line, or even public web browser extensions that allow users to execute HTTP PUT requests as a REST Client. For example, in a Unix based terminal this can be done by running the following commands replacing the highlighted fields with the corresponding value for the Provider credentials, file name, provider ID and reported date: * Upload Per Registrar report: curl -u username:password --header "Content-Type:text/csv" --request PUT --data-binary @PPSP-registrars-yyyymm.csv --dump-header - <base-url>/report/ppsp-activity-registrar/PPSP-ID/2018-03 * Upload Per TLD report: curl -u username:password --header "Content-Type:text/csv" --request PUT --data-binary @PPSP-tld-yyyymm.csv --dump-header - <base-url>/report/ppsp-activity-tld/PPSP-ID/2018-03 Some REST clients for browsers have similar looks to the screenshot below added for reference to show the ease of use, however ICANN does not provide support for third party software. [cid:image001.jpg@01D3B55A.2B813B10] Please let me know should there be any other questions. Best, Amy Amy E. Bivins Registrar Services and Engagement Senior Manager Registrar Services and Industry Relations Internet Corporation for Assigned Names and Numbers (ICANN) Direct: +1 (202) 249-7551 Fax: +1 (202) 789-0104 Email: amy.bivins(a)icann.org<mailto:amy.bivins@icann.org> www.icann.org<http://www.icann.org>

4 6

Re: [Gdd-gnso-ppsai-impl] Action items from today's IRT call
by Sara Bockey March 11, 2018

March 11, 2018

Amy, It seems clear that the additional language is necessary regardless of 4.2. It’s been raised repeatedly and agreed to by pretty much all of the registrars, so it’s unclear to me why you keep trying to remove it. Additionally, it has been raised repeatedly and agreed to my pretty much all of the registrars that the 3 instances under 4.2.2 are not sufficient. There are extraordinary circumstances that could arise, as outlined previously. At the very least, we need to amend the language to say “including but not limited to”. It’s incredibly frustrating that staff does not appear to hear what we are saying. Sara sara bockey sr. policy manager | GoDaddy™ sbockey(a)godaddy.com<mailto:sbockey@godaddy.com> 480-366-3616 skype: sbockey This email message and any attachments hereto is intended for use only by the addressee(s) named herein and may contain confidential information. If you have received this email in error, please immediately notify the sender and permanently delete the original and any copy of this message and its attachments. From: Gdd-gnso-ppsai-impl <gdd-gnso-ppsai-impl-bounces(a)icann.org> on behalf of Amy Bivins <amy.bivins(a)icann.org> Reply-To: "gdd-gnso-ppsai-impl(a)icann.org" <gdd-gnso-ppsai-impl(a)icann.org> Date: Thursday, March 8, 2018 at 8:04 AM To: "gdd-gnso-ppsai-impl(a)icann.org" <gdd-gnso-ppsai-impl(a)icann.org> Subject: Re: [Gdd-gnso-ppsai-impl] Action items from today's IRT call Thanks, Lindsay! I’ll note that in Section 4.2 (I’ve attached a copy of the specification as it looks now, with no changes), disclosure may be reasonably refused if disclosure would contravene applicable law. What if we added something in this section 4.2, such that disclosure may be reasonably refused if a subpoena or a court order is required to obtain the requested information? From: Gdd-gnso-ppsai-impl [mailto:gdd-gnso-ppsai-impl-bounces@icann.org] On Behalf Of Lindsay Hamilton-Reid Sent: Thursday, March 8, 2018 10:00 AM To: gdd-gnso-ppsai-impl(a)icann.org Subject: Re: [Gdd-gnso-ppsai-impl] Action items from today's IRT call Hi Amy Thank you for the suggestion and while we have reworded another clause to compensate for the first part of your deletion, the part about court orders must remain. We will not provide information without a court order and will certainly not contravene applicable law. I know we are trying to find the right balance here but it must be reasonable. We will of course do what we can to help law enforcement but we are not here for the benefit of LEAs and do have the rights of our customers to protect, particularly in view of the GDPR and the upcoming ePrivacy regulations. Many thanks Lindsay Lindsay Hamilton-Reid Senior Legal Counsel Direct: +44 (0)1452 509145 | Mobile: 07720 091147 | Email: Lindsay.Hamilton-Reid(a)1and1.co.uk<mailto:Lindsay.Hamilton-Reid@1and1.co.uk> www.fasthosts.co.uk<http://www.fasthosts.co.uk/> www.1and1.co.uk<http://www.1and1.co.uk/> [fh-1and1] © 2015 All rights reserved. Fasthosts is the trading name of Fasthosts Internet Limited. Company registration no. 03656438. Registered in England and Wales. Registered office: Discovery House, 154 Southgate Street, Gloucester, GL1 2EX. VAT no. 720821857. 1&1 is the trading name of 1&1 Internet Limited. Company registration no. 03953678. Registered in England and Wales. Registered office: Discovery House, 154 Southgate Street, Gloucester, GL1 2EX. VAT no. 752539027. This message (including any attachments) is confidential and may be legally privileged. If you are not the intended recipient, you should not disclose, copy or use any part of it - please delete all copies immediately and notify 1&1 on 0844 335 1211 or Fasthosts on 0333 0142 700. Any statements, opinions or information in this message are provided by the author, not on behalf of 1&1 and/or Fasthosts, unless subsequently confirmed by an individual who is authorised to represent 1&1 and/or Fasthosts. [linkedin]<http://www.linkedin.com/company/fasthosts-internet-ltd>[twitter]<https://twitter.com/Fasthosts>[facebook]<https://www.facebook.com/fasthostsinternet>[gplus]<https://plus.google.com/u/0/b/107582097021398424605/+fasthosts/posts>[blog]<http://blogs.fasthosts.co.uk/>[youtube]<http://www.youtube.com/user/Fasthostsinternet> From: Gdd-gnso-ppsai-impl [mailto:gdd-gnso-ppsai-impl-bounces@icann.org] On Behalf Of Amy Bivins Sent: 08 March 2018 12:07 To: gdd-gnso-ppsai-impl(a)icann.org<mailto:gdd-gnso-ppsai-impl@icann.org> Subject: Re: [Gdd-gnso-ppsai-impl] Action items from today's IRT call Thanks, Peter, for your input on this. I’m noticing that while you aren’t happy with the proposed one business day requirement, you didn’t say that it’s a definite non-starter, either. Perhaps there is some room for compromise. Sara and other registrars who supported Sara’s proposed language, how would you feel about trimming the proposal to account for the discussion on Tuesday about points that are already covered elsewhere in the framework? If we did that, it would look something like this (edit to Sara’s proposal in redline): 4.1.2 Where a disclosure request has been categorized as High Priority, LEA will make every effort to contact the Provider directly to discuss the matter, and should it be determined that Provider has useful information, Provider shall use its best efforts to action the request within one business day., noting that a court order/subpoena may still be required prior to release of any information. Registrar will not be required to take any action in contravention of applicable law. As proposed below, we could also update 3.1 to make abundantly clear that this is a direct LEA contact to the provider’s designated LEA contact, which may be an email address, form, phone number, or any other means the provider has shared with LEA. There must be a way for LEA to obtain the designated contact via the website (even instructions to call the provider’s main number would seem to satisfy this request) but the contact itself does not have to be posted on the website. 3.1 Pre‐Request: Provider will establish and maintain a designated LEA Requestor point of contact for submitting disclosure requests. Provider shall publish on its website the designated contact (e.g. email address, telephone number, form) or other means for LEA to obtain designated LEA contact information). If the language looked like this, for compliance purposes we could use some additional clarity about what it means for a provider to “use its best efforts to action the request within one business day.” Sara and other registrars who support this proposal, if we kept the “one business day” standard, would you be able to compromise by editing this a bit to make clear that a human (non-automated) response would be required within one business day of receipt of the request (perhaps by simply reverting to the word “action” if we were to clearly define that as discussed previously)? Peter, what would you and your PSWG colleagues think about this? Thanks, all for your continued attention to this matter. Hopefully, we can reach a conclusion on this while many of you are at ICANN61 in Puerto Rico. I’ll note that the poll is still open through EOD Friday, https://www.surveymonkey.com/r/CMGF8FZ. As of now, there are 18 responses. Four IRT members support raising this issue to the Council, and 14 oppose that (including some registrars). Best, Amy From: Gdd-gnso-ppsai-impl [mailto:gdd-gnso-ppsai-impl-bounces@icann.org] On Behalf Of Roman, Peter (CRM) Sent: Wednesday, March 7, 2018 1:08 PM To: gdd-gnso-ppsai-impl(a)icann.org<mailto:gdd-gnso-ppsai-impl@icann.org> Subject: Re: [Gdd-gnso-ppsai-impl] Action items from today's IRT call FWIW, I am not very happy with the one business day requirement to action the law enforcement High Priority request. Even a 24 hour window is too long. This is an emergency, that’s why we will be using this process. It really should be actioned more or less immediately. If it didn’t need immediate attention, we wouldn’t be using the High Priority process. Peter Roman Senior Counsel Computer Crime & Intellectual Property Section Criminal Division Department of Justice 1301 New York Ave., NW Washington, DC 20530 (202) 305-1323 peter.roman(a)usdoj.gov<mailto:peter.roman@usdoj.gov> From: Gdd-gnso-ppsai-impl [mailto:gdd-gnso-ppsai-impl-bounces@icann.org] On Behalf Of Amy Bivins Sent: Tuesday, March 6, 2018 11:42 AM To: gdd-gnso-ppsai-impl(a)icann.org<mailto:gdd-gnso-ppsai-impl@icann.org> Subject: [Gdd-gnso-ppsai-impl] Action items from today's IRT call Dear Colleagues, Thank you for your participation on today’s privacy/proxy IRT call. If you couldn’t attend, I encourage you to listen to the recording, https://community.icann.org/display/IRT/06+March+2018 If you haven’t already, please complete the IRT poll regarding the potential policy implications surrounding the IRT discussions on the LEA framework specification no later than Friday, https://www.surveymonkey.com/r/CMGF8FZ Currently, two IRT members have indicated that they believe the issue should be escalated to the Council. Fourteen responded that this should not be escalated to the Council at this stage. Today, we solicited any additional feedback related to the draft reporting specification. I’ve attached a draft with some notes indicating the feedback received to date. We will begin updating the specification based on this feedback, and will consider any additional feedback received between now and the end of the IRT session at ICANN61 in updating the draft. We also discussed a proposal from Sara Bockey on-list, which has been supported by several other registrar members of the IRT, for alternative language for the LEA Framework Specification. The proposed language is: 4.1.2 Where a disclosure request has been categorized as High Priority, this must be actioned within 24 hours. The LEA Requestor will detail the threat type and justification for a request with a Priority Level of High Priority. Where a disclosure request has been categorized as High Priority, LEA will make every effort to contact the Provider directly to discuss the matter, and should it be determined that Provider has useful information, Provider shall use its best efforts to action the request within one business day, noting that a court order/subpoena may still be required prior to release of any information. Registrar will not be required to take any action in contravention of applicable law. Based on the discussion today, it’s possible that an edit could potentially be made in Section 3.1, to eliminate the perceived need for the “contact the Provider directly” language, such as: 3.1 Pre‐Request: Provider will establish and maintain a designated LEA Requestor point of contact for submitting disclosure requests. Provider shall publish on its website the designated contact (e.g. email address, telephone number, form) or other means for LEA to obtain designated LEA contact information). I’ll note that because LEA are not a party to this contract, I don’t think they could be required via this contract to “make every effort,” so that may be a point to consider. Also, the draft already states, at Section 4.2.2.2 that a Provider can refuse disclosure if the disclosure would lead to a contravention of applicable law. Concerns have also been raised about the “best efforts” language. IRT feedback is requested on-list on the above proposed language. If IRT members who oppose the current PSWG-proposed text can reach agreement on proposed language, this can be published for public comment. This will be on the agenda for the session on Sunday at ICANN61. A full agenda will be distributed later this week. In addition, if the IRT would like to discuss any items from the updated PPAA draft in Puerto Rico, please let me know. Best, Amy Amy E. Bivins Registrar Services and Engagement Senior Manager Registrar Services and Industry Relations Internet Corporation for Assigned Names and Numbers (ICANN) Direct: +1 (202) 249-7551 Fax: +1 (202) 789-0104 Email: amy.bivins(a)icann.org<mailto:amy.bivins@icann.org> www.icann.org<http://www.icann.org>

10 24

Privacy/Proxy IRT Working Meeting at ICANN61
by Amy Bivins March 9, 2018

March 9, 2018

Dear Colleagues, Below, you will find our agenda and dial-in information for Sunday's face-to-face Privacy/Proxy IRT meeting at ICANN61, scheduled for 18:30-19:30 local time. For those that cannot attend, an update will be distributed to the group after the meeting, and the recording will be posted. Agenda: * Update on Project Status and Timeline * Finance Presentation * Outstanding Issues * LEA Framework Specification * Pending Updates to Reporting Specification, Per IRT Feedback * IRT Discussion Question Re: Data Escrow Specification (IRT views solicited about making Escrow Specification a Separate Document from PPAA (as is done in RAA), per question in circulated PPAA draft, to make it easier to update if/when technical requirements evolve) * Any IRT Feedback on Updated PPAA Draft * AOB Adobe Connect: https://participate.icann.org/sju61-208a If you haven't completed the poll requested by Darcy Southwell, as GNSO Council Liaison, related to the LEA Framework Specification, please complete it no later than your end of day today, https://www.surveymonkey.com/r/CMGF8FZ. As of now, 18 IRT members have completed the poll. Four support taking the LEA Framework Specification issue to the Council at this stage, and 14 oppose this course of action. Please let me know if you have any questions or concerns or specific items you would like to add to the agenda.

1 0

Action items from today's IRT call
by Amy Bivins March 8, 2018

March 8, 2018

Dear Colleagues, Thank you for your participation on today’s privacy/proxy IRT call. If you couldn’t attend, I encourage you to listen to the recording, https://community.icann.org/display/IRT/06+March+2018 If you haven’t already, please complete the IRT poll regarding the potential policy implications surrounding the IRT discussions on the LEA framework specification no later than Friday, https://www.surveymonkey.com/r/CMGF8FZ Currently, two IRT members have indicated that they believe the issue should be escalated to the Council. Fourteen responded that this should not be escalated to the Council at this stage. Today, we solicited any additional feedback related to the draft reporting specification. I’ve attached a draft with some notes indicating the feedback received to date. We will begin updating the specification based on this feedback, and will consider any additional feedback received between now and the end of the IRT session at ICANN61 in updating the draft. We also discussed a proposal from Sara Bockey on-list, which has been supported by several other registrar members of the IRT, for alternative language for the LEA Framework Specification. The proposed language is: 4.1.2 Where a disclosure request has been categorized as High Priority, this must be actioned within 24 hours. The LEA Requestor will detail the threat type and justification for a request with a Priority Level of High Priority. Where a disclosure request has been categorized as High Priority, LEA will make every effort to contact the Provider directly to discuss the matter, and should it be determined that Provider has useful information, Provider shall use its best efforts to action the request within one business day, noting that a court order/subpoena may still be required prior to release of any information. Registrar will not be required to take any action in contravention of applicable law. Based on the discussion today, it’s possible that an edit could potentially be made in Section 3.1, to eliminate the perceived need for the “contact the Provider directly” language, such as: 3.1 Pre‐Request: Provider will establish and maintain a designated LEA Requestor point of contact for submitting disclosure requests. Provider shall publish on its website the designated contact (e.g. email address, telephone number, form) or other means for LEA to obtain designated LEA contact information). I’ll note that because LEA are not a party to this contract, I don’t think they could be required via this contract to “make every effort,” so that may be a point to consider. Also, the draft already states, at Section 4.2.2.2 that a Provider can refuse disclosure if the disclosure would lead to a contravention of applicable law. Concerns have also been raised about the “best efforts” language. IRT feedback is requested on-list on the above proposed language. If IRT members who oppose the current PSWG-proposed text can reach agreement on proposed language, this can be published for public comment. This will be on the agenda for the session on Sunday at ICANN61. A full agenda will be distributed later this week. In addition, if the IRT would like to discuss any items from the updated PPAA draft in Puerto Rico, please let me know. Best, Amy Amy E. Bivins Registrar Services and Engagement Senior Manager Registrar Services and Industry Relations Internet Corporation for Assigned Names and Numbers (ICANN) Direct: +1 (202) 249-7551 Fax: +1 (202) 789-0104 Email: amy.bivins(a)icann.org<mailto:amy.bivins@icann.org> www.icann.org<http://www.icann.org>

4 6

Re: [Gdd-gnso-ppsai-impl] Finance update re. today's PP IRT call
by Michele Neylon - Blacknight March 6, 2018

March 6, 2018

I’m attending Puerto Rico in person, but I sincerely doubt I’ll be attending that meeting in person, as I’ve a strong aversion to doing 12 hour days Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 From: Gdd-gnso-ppsai-impl <gdd-gnso-ppsai-impl-bounces(a)icann.org> on behalf of Chris Pelling <chris(a)netearth.net> Reply-To: "gdd-gnso-ppsai-impl(a)icann.org" <gdd-gnso-ppsai-impl(a)icann.org> Date: Tuesday 6 March 2018 at 12:40 To: "gdd-gnso-ppsai-impl(a)icann.org" <gdd-gnso-ppsai-impl(a)icann.org> Subject: Re: [Gdd-gnso-ppsai-impl] Finance update re. today's PP IRT call Hi Jenn, Can you please confirm that the slides and their "reasoning" is sent out via this list please - as I am not attending in person, nor remotely as thats gone midnight UK time. Kind regards, Chris ________________________________ From: "Jennifer Gore" <jennifer.gore(a)icann.org> To: gdd-gnso-ppsai-impl(a)icann.org Sent: Tuesday, 6 March, 2018 12:28:37 Subject: [Gdd-gnso-ppsai-impl] Finance update re. today's PP IRT call Dear Colleagues, Unfortunately, the finance team will not be available to join our meeting today to present the data associated with the PP program fee schedule. However, they have committed to present in person during the IRT mtg in Puerto Rico on Sunday March 11, 2018 at 6:30 PM. If the meantime, please let me know if you have any questions. Thank you, Jennifer Gore _______________________________________________ Gdd-gnso-ppsai-impl mailing list Gdd-gnso-ppsai-impl(a)icann.org https://mm.icann.org/mailman/listinfo/gdd-gnso-ppsai-impl

1 0

Summary, action items from today's PP IRT call
by Amy Bivins March 6, 2018

March 6, 2018

Dear Colleagues, Thank you for your active participation on today's Privacy/Proxy IRT call. We covered a lot of ground. If you could not attend, I encourage you to listen to the recording, available on the wiki, https://participate.icann.org/p39onhjd1g1/. Please review the items discussed today (summarized below) and provide any additional input to the list no later than your EOD Friday, 23 Feb. Monthly Reporting Specification 1. Issue 1: Report frequency-IRT members seemed to support a requirement that these reports be submitted quarterly (current draft suggested monthly). Absent contrary input on the list this week, this change will be made in next draft. 2. Issue 2: Report submission-on-list, some IRT members said that using ICANN reporting interface was too complicated and/or unnecessary. No one commented on this topic during today's meeting. Absent substantial input on this topic on-list this week indicating that many IRT members would support a contrary reporting mechanism, no changes will be made on this point. 3. Issue 3: Report format-on-list, some IRT members took issue with requiring both per-registrar and per-TLD reports. During the call, some IRT members indicating per-TLD could be too labor intensive, but other IRT members supported having per-TLD reports. Additional IRT input is requested on this point. 4. Issue 4: Report fields-on-list, suggestions have been made for eliminating some fields, and adding others. Based on the discussion in today's call (absent contrary and/or additional suggestions on-list) the specification will be updated to: eliminate "total" numbers for requests for specific contacts, eliminate "publication" fields for LEA and IP requests, add publication/disclosure-other fields to capture non-LEA/IP requests, add coded "reasons for denial" fields. PP Applicant Guide 1. Issue 1: Shift to "rolling" application period (eliminating application phases). IRT members supported this approach. Absent contrary feedback on-list we will proceed with this approach. 2. Issue 2: Elimination of many "essay" questions in favor of "checkbox" questions. IRT members supported this approach. Absent contrary feedback on-list we will proceed with this approach. 3. Issue 3: Fees proposal. IRT requested additional documentation of costs to support fees proposal (ICANN org will work to provide this ASAP). LEA Disclosure Framework Specification 1. Issue 1: Language re: notices to customers in Sections 6.3 and 4.3, while not directly contradictory, sets different standards for the timing of notice to customers regarding an LEA request. Per IRT input on-list and on today's call, edits will be made to make clear that Section 4.3 controls, and language to 4.3 to make clear that provide will notify customer of a request in accordance with ToS and timeframe requested by LEA, subject to any other requirements under applicable law or court order. Any additional input on this is requested by the end of the week. 2. Issue 2: Required provider responses to high priority LEA requests. Per discussion on-list and during today's call, it appears that * If "action" is clearly defined to include (1) disclosure of the requested information, (2) refusal to disclose the requested information for one of the reasons listed in section 4.2.2, and/or (3) in exceptional circumstances, informing LEA that the provider requires additional time to respond, then * The IRT appears to find a 24-hour response time acceptable for high-priority requests from LEA that qualify for this specification. * IRT feedback is specifically requested on this point. Please respond to the list noting whether you (1) support, (2) oppose, or (3) would edit (explain how) the requirement that providers be required to action high-priority requests from LEA within 24 hours of receipt of the request from LEA. If there is disagreement on this, this will be flagged during the public comment period. Best, Amy Amy E. Bivins Registrar Services and Engagement Senior Manager Registrar Services and Industry Relations Internet Corporation for Assigned Names and Numbers (ICANN) Direct: +1 (202) 249-7551 Fax: +1 (202) 789-0104 Email: amy.bivins(a)icann.org<mailto:amy.bivins@icann.org> www.icann.org<http://www.icann.org>

15 34

IRT Member Poll, Please Complete by EOD Friday, 9 March
by Amy Bivins March 5, 2018

March 5, 2018

Dear Colleagues, Pursuant to Darcy's request sent to the list on Friday, please complete this linked poll, which will be used to gauge IRT consensus with respect to any potential policy implications raised by the current IRT debate on the draft LEA framework specification, https://www.surveymonkey.com/r/CMGF8FZ. Please complete this poll no later than your end of day Friday, 9 March. I've also included a couple of questions related to the reporting specification, to ensure we collect as many IRT member views on this topic as possible. For our meeting tomorrow, we will have a presentation from the Finance team with more information about the proposed program fees schedule. We can also discuss any issues you would like to raise related to the updated PPAA draft that was distributed last week and the proposed agenda for the IRT meeting at ICANN61. If you have specific you would like to discuss, please send them to the list before the call if possible. Best, Amy Amy E. Bivins Registrar Services and Engagement Senior Manager Registrar Services and Industry Relations Internet Corporation for Assigned Names and Numbers (ICANN) Direct: +1 (202) 249-7551 Fax: +1 (202) 789-0104 Email: amy.bivins(a)icann.org<mailto:amy.bivins@icann.org> www.icann.org<http://www.icann.org>

6 7

Updated PPAA draft and related materials attached for IRT review
by Amy Bivins March 3, 2018

March 3, 2018

Dear Colleagues, Attached is the updated PPAA draft, in redline and non-redline versions. I've also included a version with references to the Final report and notes to the IRT about where edits were made (or not made). The attached slide deck includes an overview of the accreditation program materials, remaining open issues, and identifies how each of the Final Recommendations are proposed to be implemented. Please begin reviewing the updates to the PPAA draft and come prepared to discuss at our meeting on Tuesday. Also, please provide any final feedback on the LEA framework and reporting specification no later than this Friday, 2 March. We plan to update this draft with respect to feedback received on those issues next week as we prepare these materials for the public comment period. Brief, high-level summary of the changes/questions for the IRT in this PPAA draft: 1. Non-substantive copy edits throughout 2. Labeling specification (and all references to this specification) deleted based on IRT feedback that the requirements therein appeared to be beyond scope. Labeling requirement included in PPAA body at Section 3.15. 3. Reporting specification (and references to this specification) added. Specification remains under IRT review (deadline for feedback 2 March). Links to PP IETF documents are not yet functional, as these are not yet published. These are expected to be published prior to the publication of the draft PPAA for public comment and links will be updated if needed when this specification is finalized based on final IRT feedback. 4. Definition of "Working Group" (applicable to amendment, negotiation processes-See, e.g., Section 7.4.1) updated throughout PPAA to eliminate references to any future PPSG. In its place, the WG will now be convened by the GNSO Council (See PPAA Section 1.43), as recommended by the IRT. 5. All references to a Provider terminating a customer's domain registration or requesting that a registrar do so in response to a breach of the terms of service or other wrongs have been deleted, per IRT input. (See, e.g. Section 3.5.3.1; See, specifically, Section 3.5.3.17 (regarding cancellations of services related to names that are subject to UDRP/URS proceedings.) 6. Explicit requirement that Provider publish its terms of service has been added (See Section 3.8.1). Prior draft referenced requirements for ToS contents but didn't explicitly require that ToS be published, as directed by the Final Report. 7. Abuse desk requirement in PPAA Section 3.12.1 edited to match language in Final Report (language about the abuse contact being "capable and authorized to investigate..." from the Final Report had been inadvertently deleted at some point in a prior draft). 8. Deletion of LEA-related abuse contact requirements in PPAA text (formerly section 3.12.2). All LEA-specific requirements are now included in the LEA Disclosure Framework Specification. 9. Reference to use of "high-volume, automated electronic processes..." in PPAA section 3.14 was moved to Intellectual Property Disclosure Framework Specification. 10. Clarification added that a provider on suspended status may continue to provide services for existing registrations (Section 5.7.3) 11. Several clean-up edits in Specification 1, Data Escrow Specification. ICANN is currently reviewing the inclusion of this Specification in the PPAA itself, as opposed to the RAA format which has the escrow specification separate from the accreditation agreement. As technical requirements/RFCs may be updated from time to time, there are benefits to having this outside the PPAA itself. IRT feedback is requested on this topic. 12. Specification 2: Customer Data Accuracy Program Specification. Edit to Section 1, to clarify that obligation applies when Provider begins providing the Services for a name, as opposed to when the name is registered. 13. Specification 4: Law Enforcement Authority Specification. This specification is currently under final IRT review (deadline for feedback 2 March). Substantive edits may be made after this review period. There is currently some disagreement among IRT members regarding high priority requests, specifically: (a) how the receipt process should or should not apply to high priority requests, (b) the time that should be allowed for a provider to action a "high priority" request. In addition, the IRT is considering defining "action" for greater clarity. 14. Data retention specification: The data required to be retained has been reduced by the deletion of the labeling specification (see Section 1.1.6). Amy E. Bivins Registrar Services and Engagement Senior Manager Registrar Services and Industry Relations Internet Corporation for Assigned Names and Numbers (ICANN) Direct: +1 (202) 249-7551 Fax: +1 (202) 789-0104 Email: amy.bivins(a)icann.org<mailto:amy.bivins@icann.org> www.icann.org<http://www.icann.org>

6 8