April 2018 - Gdd-gnso-ppsai-impl

Notes, action items from today's PP IRT meeting--feedback requested by 27 April
by Amy Bivins April 17, 2018

April 17, 2018

Dear Colleagues, Thank you for your participation on today's privacy/proxy IRT call. For those who could not attend, I regret that we were unable to record this meeting (an issue with a new internal recording policy), but this was a one-time issue and all future meetings will be recorded. I've done my best to annotate the LEA specification document with the items we discussed, and have also attached the chat transcript. IRT Action Items We are nearing the completion of discussions on the LEA Specification. Other than the item of clear disagreement among members of the IRT-the time period for high priority requests-we are largely in the refining stage. To that end, we have a few final proposed edits for the group to review and comment on-including some edits that were originally suggested by Sara Bockey a few weeks ago and supported by many registrar members of the IRT. If we don't hear any opposition to these edits that would warrant further discussion, we will make these edits as requested in the draft we publish for comment. Today, we considered whether the LEA Framework Specification would be clearer if we reorganized it slightly, to make more clear where processes apply to high priority requests and when they don't. I've included two versions of the draft-the one with "orig" at the end of the title-which includes the proposed edits without reorganizing, and the "reorganized" one. Please review both and respond to the list with your thoughts about the proposed reorganizing of this. Please provide any additional input you have on this draft no later than next Friday, 27 April. Please note, specifically, questions in the following sections: Original Numbering Reorganized Version Section 2.1.10 (addition of "except in high priority" language at beginning of edit) Same section Section 3.2.1 (addition of the words "Standard Priority" to make clear this 2 business day receipt process doesn't apply in high priority cases) Moved to Section 3.2.2 Section 4.2.2 (inclusion of "without limitations" language, plus input about and question from Steve Metalitz-any other reasons that registrars feel would be reasonable for refusing disclosure?); Also see feedback, generally, from PSWG liaison, in meeting chat transcript (most pasted into specification document but cuts off at the end) Same section Section 4.2.2.5 (is this redundant? ) Same section Section 4.2.6 (is this redundant?) Same section I'm also attaching the most recent draft de-accreditation procedure document. As mentioned on the list last week, upon further consideration on the ICANN org side we think we should add back in the proposed transition procedure for customers impacted by the de-accreditation or termination of a third-party provider (section 4). Please review and provide any further comments on this no later than 27 April. For next week, we are hoping to have the requested fees information ready for you to discuss. I'll update you as soon as I can. Best, Amy Amy E. Bivins Registrar Services and Engagement Senior Manager Registrar Services and Industry Relations Internet Corporation for Assigned Names and Numbers (ICANN) Direct: +1 (202) 249-7551 Fax: +1 (202) 789-0104 Email: amy.bivins(a)icann.org<mailto:amy.bivins@icann.org> www.icann.org<http://www.icann.org>

2 1

Items for PP IRT discussion on Tuesday
by Amy Bivins April 17, 2018

April 17, 2018

Dear Colleagues, Attached are updated documents for discussion on Tuesday's Privacy/Proxy IRT call, at 1400 UTC: 1. Updated draft de-accreditation procedure 2. Updated LEA Framework Specification markup On our call Tuesday, I'll walk you through the updates that have been made to the de-accreditation procedure based on your feedback. Please come prepared to discuss any further feedback you may have on this document, particularly the re-introduction of a proposed transition procedure that could be used to attempt to transfer impacted customers to a new provider if a provider is de-accredited. We considered whether to remove this process in the prior draft, due to practical concerns, but upon further consideration we think this process should be included, with the caveat that once it is tested adjustments may be needed to make the process work. For the updated markup of the LEA framework specification, the goal is to determine whether we have consensus among IRT members to adopt any of the changes proposed by registrar members of the IRT. There appears to be strong support for many of these proposed changes, so unless there is opposition to changes they can be incorporated into the draft. It's clear that the 24-hour response time proposed by the PSWG for high-priority requests does not have consensus support of the IRT, so we plan to call out this section specifically during the public comment period for community feedback. I hope to also have an update for you on data escrow next week and, if not, soon thereafter. As Adobe Connect is still unavailable, Michelle will circulate alternative information for you to dial in for the meeting. Best, Amy Amy E. Bivins Registrar Services and Engagement Senior Manager Registrar Services and Industry Relations Internet Corporation for Assigned Names and Numbers (ICANN) Direct: +1 (202) 249-7551 Fax: +1 (202) 789-0104 Email: amy.bivins(a)icann.org<mailto:amy.bivins@icann.org> www.icann.org<http://www.icann.org>

7 13

Re: [Gdd-gnso-ppsai-impl] Items for PP IRT discussion on Tuesday
by Sara Bockey April 16, 2018

April 16, 2018

Hi Amy, I hate to be nitpicky, I noticed in the revised LEA Spec you are stating that only Eric and Volker supported my proposal. Theo and Chris Pelling also noted their support. Please revise your records to accurately reflect this. Thanks, Sara sara bockey sr. policy manager | GoDaddy™ sbockey(a)godaddy.com<mailto:sbockey@godaddy.com> 480-366-3616 skype: sbockey This email message and any attachments hereto is intended for use only by the addressee(s) named herein and may contain confidential information. If you have received this email in error, please immediately notify the sender and permanently delete the original and any copy of this message and its attachments. From: Gdd-gnso-ppsai-impl <gdd-gnso-ppsai-impl-bounces(a)icann.org> on behalf of Amy Bivins <amy.bivins(a)icann.org> Reply-To: "gdd-gnso-ppsai-impl(a)icann.org" <gdd-gnso-ppsai-impl(a)icann.org> Date: Wednesday, April 11, 2018 at 11:32 AM To: "gdd-gnso-ppsai-impl(a)icann.org" <gdd-gnso-ppsai-impl(a)icann.org> Subject: [Gdd-gnso-ppsai-impl] Items for PP IRT discussion on Tuesday Dear Colleagues, Attached are updated documents for discussion on Tuesday’s Privacy/Proxy IRT call, at 1400 UTC: 1. Updated draft de-accreditation procedure 2. Updated LEA Framework Specification markup On our call Tuesday, I’ll walk you through the updates that have been made to the de-accreditation procedure based on your feedback. Please come prepared to discuss any further feedback you may have on this document, particularly the re-introduction of a proposed transition procedure that could be used to attempt to transfer impacted customers to a new provider if a provider is de-accredited. We considered whether to remove this process in the prior draft, due to practical concerns, but upon further consideration we think this process should be included, with the caveat that once it is tested adjustments may be needed to make the process work. For the updated markup of the LEA framework specification, the goal is to determine whether we have consensus among IRT members to adopt any of the changes proposed by registrar members of the IRT. There appears to be strong support for many of these proposed changes, so unless there is opposition to changes they can be incorporated into the draft. It’s clear that the 24-hour response time proposed by the PSWG for high-priority requests does not have consensus support of the IRT, so we plan to call out this section specifically during the public comment period for community feedback. I hope to also have an update for you on data escrow next week and, if not, soon thereafter. As Adobe Connect is still unavailable, Michelle will circulate alternative information for you to dial in for the meeting. Best, Amy Amy E. Bivins Registrar Services and Engagement Senior Manager Registrar Services and Industry Relations Internet Corporation for Assigned Names and Numbers (ICANN) Direct: +1 (202) 249-7551 Fax: +1 (202) 789-0104 Email: amy.bivins(a)icann.org<mailto:amy.bivins@icann.org> www.icann.org<http://www.icann.org>

1 0

Re: [Gdd-gnso-ppsai-impl] Items for PP IRT discussion on Tuesday
by Michele Neylon - Blacknight April 16, 2018

April 16, 2018

Amy I would hope that our repeated queries about the fee structure are addressed before Staff proceeds to put this out for public comment. Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 From: Gdd-gnso-ppsai-impl <gdd-gnso-ppsai-impl-bounces(a)icann.org> on behalf of Amy Bivins <amy.bivins(a)icann.org> Reply-To: "gdd-gnso-ppsai-impl(a)icann.org" <gdd-gnso-ppsai-impl(a)icann.org> Date: Monday 16 April 2018 at 15:17 To: "gdd-gnso-ppsai-impl(a)icann.org" <gdd-gnso-ppsai-impl(a)icann.org> Subject: Re: [Gdd-gnso-ppsai-impl] Items for PP IRT discussion on Tuesday Dear Colleagues, This is a reminder that on tomorrow’s IRT call, we will be discussing the following: 1. any feedback you have on the current draft of the de-accreditation procedure (the change in this version of the draft is that we’ve added back in a draft ICANN-facilitated transition procedure that can be used to try to transition customers to a new provider in the event a provider is terminated). 2. the draft LEA disclosure framework specification. We will go through the most recent edits proposed by Sara Bockey and supported by many other registrars in the group to determine whether there is sufficient support in the IRT to incorporate these edits into the draft that will be published for public comment. We are planning to use the Zoom conferencing software for the call, and Michelle will be circulating login information to the list later today. If there are any issues with using Zoom, we will revert to using a phone bridge only, but are hoping to have Zoom so that we can review the LEA framework specification markup together in real time. As this is a new (to us) program, please long in early if you can to get a feel for how it works. Best, Amy From: Gdd-gnso-ppsai-impl [mailto:gdd-gnso-ppsai-impl-bounces@icann.org] On Behalf Of Amy Bivins Sent: Wednesday, April 11, 2018 2:32 PM To: gdd-gnso-ppsai-impl(a)icann.org Subject: [Gdd-gnso-ppsai-impl] Items for PP IRT discussion on Tuesday Dear Colleagues, Attached are updated documents for discussion on Tuesday’s Privacy/Proxy IRT call, at 1400 UTC: 1. Updated draft de-accreditation procedure 2. Updated LEA Framework Specification markup On our call Tuesday, I’ll walk you through the updates that have been made to the de-accreditation procedure based on your feedback. Please come prepared to discuss any further feedback you may have on this document, particularly the re-introduction of a proposed transition procedure that could be used to attempt to transfer impacted customers to a new provider if a provider is de-accredited. We considered whether to remove this process in the prior draft, due to practical concerns, but upon further consideration we think this process should be included, with the caveat that once it is tested adjustments may be needed to make the process work. For the updated markup of the LEA framework specification, the goal is to determine whether we have consensus among IRT members to adopt any of the changes proposed by registrar members of the IRT. There appears to be strong support for many of these proposed changes, so unless there is opposition to changes they can be incorporated into the draft. It’s clear that the 24-hour response time proposed by the PSWG for high-priority requests does not have consensus support of the IRT, so we plan to call out this section specifically during the public comment period for community feedback. I hope to also have an update for you on data escrow next week and, if not, soon thereafter. As Adobe Connect is still unavailable, Michelle will circulate alternative information for you to dial in for the meeting. Best, Amy Amy E. Bivins Registrar Services and Engagement Senior Manager Registrar Services and Industry Relations Internet Corporation for Assigned Names and Numbers (ICANN) Direct: +1 (202) 249-7551 Fax: +1 (202) 789-0104 Email: amy.bivins(a)icann.org<mailto:amy.bivins@icann.org> www.icann.org<http://www.icann.org>

2 1

PP IRT meeting cancelled next week
by Amy Bivins April 6, 2018

April 6, 2018

Dear Colleagues, The privacy/proxy IRT meeting scheduled for next Tuesday, 10 April, has been canceled, because new materials are still being finzlied for IRT review. The several recent cancelations will impact our overall timeline and projected date for proceeding to public comment. We will provide updated materials for IRT review as soon as they are ready, and I hope to be able to update you next week on overall status/timeline issues. Thanks, and have a great weekend. Amy E. Bivins Registrar Services and Engagement Senior Manager Registrar Services and Industry Relations Internet Corporation for Assigned Names and Numbers (ICANN) Direct: +1 (202) 249-7551 Fax: +1 (202) 789-0104 Email: amy.bivins(a)icann.org<mailto:amy.bivins@icann.org> www.icann.org<http://www.icann.org>

3 3

Re: [Gdd-gnso-ppsai-impl] Discussion items for today's PP IRT face-to-face at ICANN61 (starting in 10 mins)
by Sara Bockey April 3, 2018

April 3, 2018

Amy, Following our F2F discussion on Sunday, many of us have continuing and renewed concerns regarding the LEA spec, in particular the high priority disclosure framework and Section 4.2. After much discussion and many options being put to staff, 4.1.2 has devolved to a “compromise” which is basically the exact same language we started with 6 months ago, with the exception of adding “in accordance with Section 4.2.” As such, we are very concerned that the LEA Spec as written creates a presumption of disclosure and means to bypass due process. Additionally, it is important to remember that this is an accreditation program for ALL Privacy/Proxy Providers around the globe. That means that LEA requests come from LEA in all sorts of countries, and the language in the accreditation agreement need to reflect that. We cannot take an American-centric view. We need to bolster the language in 4.2 to better protect the rights of the Provider and its customers. Therefore, if we are to consider/accept the current proposed high priority language, namely: “Where a disclosure request has been categorized as High Priority, this must be actioned within 24 hours, in accordance with Section 4.2. The LEA Requester will detail the threat type and justification for a request with a Priority Level of High Priority.” Then the following amendments must be made to Section 4.2 (new language in bold below): 4.2. Disclosure: 4.2.1. Within the applicable timeframe for a request’s Priority Level, Provider will disclose to the LEA Requestor, using a secure mechanism (this must be defined), the Requested Information it holds [associated with] the account. 4.2.2. Disclosure can be reasonably refused by Provider for reasons consistent with the general policy stated herein, including without limitations any of the following: 4.2.2.1. The LEA Requestor failed to provide to Provider information to meet the minimum standard for acceptance as outlined in Section 2 of this Specification; 4.2.2.2. If disclosure would lead to a contravention of applicable law; or 4.2.2.3. Where the Customer has provided, or Provider has found, specific information, facts, or circumstances showing that disclosure will endanger the safety of the Customer. 4.2.2.4. Where Provider has requested a court order/warrant/subpoena and LEA Requestor was unable or unwilling to provide same. 4.2.2.5. Where Provider has not been able to verify the identity of the LEA Requestor. (We also need to determine how Providers can best verify the identity of the requestor in a timely fashion. This can at times be very time consuming.) 4.2.2.6. Where Provider has found, after investigation, that LEA Requestor’s request is not well founded. 4.2.3. If disclosure is refused by Provider, Provider must provide written notice (which may be by electronic communication) to the LEA Requestor setting for Provider’s specific reasons for refusing to disclose. Such notice must be provided by Provider to the LEA Requestor prior to any Customer notification by Provider, irrespective of the reason for refusal. 4.2.4. In exceptional circumstances, if Provider requires additional time to respond to the LEA Requestor, Provider shall inform the LEA Requestor of the cause of the delay and agree with the LEA Requestor on a new date by which it will provide its response under this Section. 4.2. 4.2.5. For all refusals made in accordance with the policy and requirements herein, Provider must accept and give due consideration to the LEA Requestor’s requests for reconsideration of the refusal to disclose. 4.2.6. Nothing in Section 4.2 above shall be interpreted nor is it intended to imply the Provider shall forego due process within its applicable jurisdiction to satisfy LEA Requestor’s request, regardless of Priority Level. Finally, I believe you were wanting to know if it was acceptable to have Escrow separate from the PPAA. I believe that is the case for the RAA, so I do not see an issue with having it separate from the PPAA. Sara sara bockey sr. policy manager | GoDaddy™ sbockey(a)godaddy.com<mailto:sbockey@godaddy.com> 480-366-3616 skype: sbockey This email message and any attachments hereto is intended for use only by the addressee(s) named herein and may contain confidential information. If you have received this email in error, please immediately notify the sender and permanently delete the original and any copy of this message and its attachments. From: Gdd-gnso-ppsai-impl <gdd-gnso-ppsai-impl-bounces(a)icann.org> on behalf of Amy Bivins <amy.bivins(a)icann.org> Reply-To: "gdd-gnso-ppsai-impl(a)icann.org" <gdd-gnso-ppsai-impl(a)icann.org> Date: Sunday, March 11, 2018 at 6:24 PM To: "gdd-gnso-ppsai-impl(a)icann.org" <gdd-gnso-ppsai-impl(a)icann.org> Subject: [Gdd-gnso-ppsai-impl] Discussion items for today's PP IRT face-to-face at ICANN61 (starting in 10 mins) Dear Colleagues, Attached you will find a document that a member of the finance team will be discussing during our session starting in a few minutes. In addition, you’ll be hearing an update about ongoing discussions between registrar and PSWG members of the IRT related to the draft LEA disclosure framework specification. This language was discussed informally among a smaller group this afternoon. Registrar and PSWG members of the IRT appear to be nearing agreement on a proposal for presentation to the IRT that would include a 24-hour time frame for provider responses to high priority LEA requests, with some additional requirements for documentation demonstrating that the request is high priority. The updated draft language for Section 4.1.2 for further discussion (deletions shown as strikeouts, additions in blue) is currently: * “Where a disclosure request has been categorized as High Priority, this must be actioned responded to within 24 hours, in accordance with Section 4.2. The LEA Requester will detail the threat type and justification for a request with a Priority Level of High Priority.” In addition, staff was asked to provide suggestions for additional details that can be specified about what goes into a High Priority requests. Staff has proposed the following as a starting point. * “For High Priority requests, in addition to the requirements specified in Section 2.1.*, LEA Requesters should provide specific information demonstrating that the request is necessary due to an imminent threat to life, serious bodily injury, critical infrastructure or child exploitation”. (Note: Section 2.1 is the section that lists all the details currently needed for a request.) We will be discussing these during the session and soliciting further feedback on the list afterward. Best, Amy Amy E. Bivins Registrar Services and Engagement Senior Manager Registrar Services and Industry Relations Internet Corporation for Assigned Names and Numbers (ICANN) Direct: +1 (202) 249-7551 Fax: +1 (202) 789-0104 Email: amy.bivins(a)icann.org<mailto:amy.bivins@icann.org> www.icann.org<http://www.icann.org>

6 6

No PP IRT meeting tomorrow
by Amy Bivins April 2, 2018

April 2, 2018

Dear Colleagues, As we are still working to finalize data escrow-related materials for you, we are cancelling tomorrow's IRT meeting. I'm hoping to be able to send the data escrow-related materials to you by mid-week, so that you have plenty of time to review before we discuss on our call next week. Best, Amy Amy E. Bivins Registrar Services and Engagement Senior Manager Registrar Services and Industry Relations Internet Corporation for Assigned Names and Numbers (ICANN) Direct: +1 (202) 249-7551 Fax: +1 (202) 789-0104 Email: amy.bivins(a)icann.org<mailto:amy.bivins@icann.org> www.icann.org<http://www.icann.org>

1 0