July 2024 - Gdd-gnso-ppsai-impl

Reminder. IRT Task 20240725a Due on 01 Aug 2024. Review IRT Final Report Comment Guidelines prior to making comments
by Dennis Chang July 29, 2024

July 29, 2024

Dear IRT, This is a reminder to complete this task. I typically do not send reminders for tasks completion but thought I’ll do it here and give you an opportunity to reply with questions. If you’ve missed our meetings, please listen to both IRT session 1 and 2 recordings to get the context for this simple task. https://community.icann.org/display/IRT/IRT+Meetings After that, if you still have questions about this task or the context, you can always reach out. There are 48 IRT members. This is a large team and I’d appreciate your support in keeping all of us together as one team on the same page. Please feel free to reach out to me privately or reply to all. Thanks, Dennis Chang From: Dennis Chang via Gdd-gnso-ppsai-impl <gdd-gnso-ppsai-impl(a)icann.org> Reply-To: "PPSAI IRT members, including observers" <gdd-gnso-ppsai-impl(a)icann.org> Date: Thursday, July 25, 2024 at 1:25 PM To: "gdd-gnso-ppsai-impl(a)icann.org" <gdd-gnso-ppsai-impl(a)icann.org> Cc: Dennis Chang <dennis.chang(a)icann.org> Subject: [Gdd-gnso-ppsai-impl] IRT Task 20240725a: Review IRT Final Report Comment Guidelines prior to making comments Dear IRT, Thank you for supporting our call today. As we discussed, I’ll be sending out 3 IRT Tasks today. Please complete this task first and look for other emails to follow. 20240725a Review IRT Final Report Comment Guidelines [drive.google.com]<https://urldefense.com/v3/__https:/drive.google.com/file/d/1OxQmITYCFGxKrGG…> prior to making comments 01Aug2024 For those that missed the meeting, there will be an email notification sent to you when the recording is available on the IRT Wiki for you to catch up with us. This is a complex and involved policy implementation and I appreciate everyone support and patience as we are building the stable ground for all of us to operation from. There will be many more communications following. -- Kind Regards, Dennis S. Chang GDD Programs Director Phone: +1 213 293 7889 Sykpe: dennisSchang www.icann.org<http://www.icann.org> One World – One Internet

1 0

Re: [Ext] Administrative Comment/Question
by Dennis Chang July 26, 2024

July 26, 2024

Hello Michael, 1. Thanks for catching the URL error in the workbook. * I just fixed it and it should work now. 2. On your request for Google Doc assistance, I’ll ask those on my team to reach out to you directly. * If others on the IRT would like assistance, we could conduct a special training session too. 3. ICANN org will log all comments and track them to resolution using a sheet in the IRT workbook. * I mentioned this briefly yesterday and more instructions on this will come to IRT when we have it set up. Good to see you using the IRT tools well already and thanks for support! Thanks, Dennis Chang From: "michael palage.com" <michael(a)palage.com> Date: Friday, July 26, 2024 at 8:39 AM To: "PPSAI IRT members, including observers" <gdd-gnso-ppsai-impl(a)icann.org> Cc: Dennis Chang <dennis.chang(a)icann.org> Subject: [Ext] Administrative Comment/Question Hello Dennis, I have a question and a comment. First, my comment. The link to the IRT membership URL in the Google Doc tab “IRT Members” Cell B3 needs to be updated to the new URL on the Confluence site, https://community.icann.org/pages/viewpage.action?pageId=62395753 Second, my question. I would appreciate any Google Doc assistance on how to view comments that have been resolved? There was a comment that Steve had made, which was listed as “resolved” earlier this morning. However, when I checked back later in the morning I was unable to view it or find it. Can ICANN Org please explain how comments will be “resolved” and what ability there is to capture these comments should they accidentally be resolved/deleted by another group member? I think this is an important question to answer before we invest a lot of time marking up the document. Thanks in advance. Best regards, Michael

1 0

IRT Task 20240725c: Provide comments of concerns of the PPSAI PDP Final Report (2015) Due: 16Aug2024
by Dennis Chang July 26, 2024

July 26, 2024

Dear IRT, This is the 3rd Task we discuss at our meeting today. 20240725c Provide comments of concerns in in IRT Cemmentable Version of the PPSAI PDP Final Report (2015)<https://docs.google.com/document/d/1nS5WTk0p79XRT0CcCzByAyH_xn6KMDgElc5F6QS…> 16Aug2024 Please note the due that that comes after the two tasks I sent out earlier. This is by design to ensure that the IRT work on Clarifying Questions get done before we begin discussing concerns. Please focus your comment on the 21 recommendations presented in section 1.3.1 if you could. Precede each comment with “2. Concern …” to note that your comment is to be addressed after we answer the questions about the recommendation. Again, I invite the IRT members to reply to the comments to facilitate our discussion later. Per our work plan in the IRT workbook, session #4 on 22 August 2024 is when we plan to discuss these concerns as a team. Reminder: The IRT Work Plan and IRT Task List are always available to the IRT members (IRT members only) to reference and track. IRT Workbook: https://docs.google.com/spreadsheets/d/1rqfRaG1yL8HU48u0_3rIHkREoWN0Psr0rT_… As we make progress, we’ll assign more tasks that has more to do with the implementation design but for now, let’s come together to build a common understanding of the policy recommendations language. Thank you for your support and collaboration. -- Kind Regards, Dennis S. Chang GDD Programs Director Phone: +1 213 293 7889 Sykpe: dennisSchang www.icann.org<http://www.icann.org> One World – One Internet

2 1

Zoom Recording Available: IRT Session #2: 25 July 2024
by Dana Kuebler July 26, 2024

July 26, 2024

Dear IRT, Today’s zoom recorded session is now available on the wiki IRT Meetings Page<https://community.icann.org/pages/viewpage.action?pageId=362315806>. Please look for another email once the session transcript becomes available. All the best, Dana Kuebler-Weber

1 0

IRT Task 20240725a: Review IRT Final Report Comment Guidelines prior to making comments
by Dennis Chang July 25, 2024

July 25, 2024

Dear IRT, Thank you for supporting our call today. As we discussed, I’ll be sending out 3 IRT Tasks today. Please complete this task first and look for other emails to follow. 20240725a Review IRT Final Report Comment Guidelines<https://drive.google.com/file/d/1OxQmITYCFGxKrGGpLFS0VwmDnSQ6xDoS/view?usp=…> prior to making comments 01Aug2024 For those that missed the meeting, there will be an email notification sent to you when the recording is available on the IRT Wiki for you to catch up with us. This is a complex and involved policy implementation and I appreciate everyone support and patience as we are building the stable ground for all of us to operation from. There will be many more communications following. -- Kind Regards, Dennis S. Chang GDD Programs Director Phone: +1 213 293 7889 Sykpe: dennisSchang www.icann.org<http://www.icann.org> One World – One Internet

2 1

IRT Task 20240725b: Provide clarifying questions in IRT Commentable Version of the PPSAI PDP Final Report (2015) Due 02 Aug 2024
by Dennis Chang July 25, 2024

July 25, 2024

Dear IRT, This is the 2nd task we discussed at the IRT meeting today. Per the instruction given at the meeting and the guideline on working with the Cementable document, ask your Clarifying questions to better understand a recommendation” focused on Section 1.3.1 where you’ll find Recommendations 1 to 21. Please make your comments to start with “1. Question …” to separate from the notable concerns you’ll be asked to make with another task with a later due date. 20240725b Provide clarifying questions in IRT Cementable Version of the PPSAI PDP Final Report (2015)<https://docs.google.com/document/d/1nS5WTk0p79XRT0CcCzByAyH_xn6KMDgElc5F6QS…> 02Aug2024 You’ll note are already comments made at the meeting by the IRT members. When you find questions that you have answers to, please feel free to add as a reply. You may also add follow-up questions as a reply as you have them. We expect that this document will get busy soon, and we plan to collect, sort, and track all comments in the IRT workbook. We’ll let you know how that gets done later. -- Kind Regards, Dennis S. Chang GDD Programs Director Phone: +1 213 293 7889 Sykpe: dennisSchang www.icann.org<http://www.icann.org> One World – One Internet

1 0

Background Information - Follow Up
by michael palage.com July 25, 2024

July 25, 2024

Hello Dennis, I am writing regarding my request on today's call to have equal time should the RrSG be permitted time to present on current Privacy Proxy services in the marketplace. First, I want to address your concern about limiting our work to ICANN's narrow mandate. There have been several ICANN community events in which the issue of registrant verification has been discussed. See for example ICANN79 ccNSO Tech Day, eID panel discussion, https://icann79.sched.com/event/1a1DU/tech-day-3-of-4; ICANN79 ALAC Plenary - Building Trust on the Internet through Registrant Verification, https://icann79.sched.com/event/1a1DH/at-large-plenary-session-2-building-t… registrant-verification; and the recent ICANN Contracting Party Summit session entitled NIS 2.0 and Registrant Verification, https://cpsummit2024.sched.com/event/1c1fQ/nis2registrant-verification Also, excluding these factual data points on what is currently feasible within the domain name marketplace appears to be inconsistent with ICANN Org's public statements. In connection with ICANN Org's response to the US CIRCIA Notice of Proposed Rule Making, ICANN Org made the following statement: The multistakeholder system also allows for the development and implementation of global policies. Global policies enable the Internet to remain a single, unified and interoperable platform. By contrast, regulation by local, national or regional governmental bodies risks fragmenting the Internet and creating conflicting obligations for Internet stakeholders. Regulation by one jurisdiction incentivizes other jurisdictions to intervene with their own policy objectives. See https://www.regulations.gov/comment/CISA-2022-0010-0437 If this IRT group wants to explicitly exclude market-based solutions currently available within the broader domain name marketplace, we should properly document this decision so that national governments in those markets will be free to act based on ICANN's inaction. I am copying Elena Plexida and Veni Markovski on this email as I believe this goes to the heart of some of the current WSIS+20 and GDC discussions taking place regarding the ongoing evolution and vibrancy of the ICANN multistakeholder model. I would also like to reshare the link I posted in the Zoom chat regarding the NIS 2.0 implementation guidance comment that I submitted to the Commission today regarding the broader DNS supply chain ecosystem, see https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/1… Privacy and Proxy providers are key players in the broader DNS ecosystem that ICANN currently has no contractual oversight. NIS 2.0 Article 6 (22) defines privacy and proxy providers as entities "providing domain name registration services" for purposes of Article 28. Therefore "[t]he relative complexity of the DNS registration supply chain described above (registry, registrar, reseller, registrant, hosts and other DNS providers) provides many opportunities for malicious actors" as described in the OECD whitepaper on DNS security is even more complex when you add privacy and proxy providers. Hopefully, this email helps clear up why I believe having ALL the available facts before the IRT is critical to our success. Best regards, Michael

1 0

P/P services vs Accuracy and Disclosure rules for registrars
by Steve Crocker July 24, 2024

July 24, 2024

Dennis, Thanks for your note. This working group is the restart of the IRT process for the Privacy and Proxy Services Accreditation policy. Quite a bit of time has passed since that policy was passed. There were some serious issues with the policy when it was adopted, and the situation has become worse. Accordingly, I am raising some questions about where we're going. This is a first draft of what I expect will become a more complete memo intended for wider distribution. It feels appropriate to share these thoughts first within this working group. Privacy and proxy services are intended to protect the identity of and restrict access to registrants. The fact that they have become widely used is a strong indication that registrants feel the need for such protection. (And, I think it needs to be said, their widespread use is also due in part to active sales efforts. People are spending a noticeable amount of money on these services, so this is an important source of revenue.) *Privacy Services* Let me address Privacy services first. When a registrant uses a Privacy service, the name of the registrant is provided to the registrar, but the registrant's address, email and phone number are not. Instead, the address, email and phone number of the Privacy service is provided to the registrar. If the registrant makes those data elements available to a requestor, the requestor will be able to contact Privacy service. The requestor will also know the name of the registrant and may be able to find other ways to contact the registrant. The troubling aspect of a Privacy service is the requestor has no explicit way of knowing whether the address, email and phone number are associated with the registrant or with a Privacy service. The intent of the Privacy and Proxy Service Accreditation policy is to make it clear to requestors that the data they are receiving is for a Privacy service. From my point of view, overloading the registrant's address, email and phone number fields with the Privacy service's data elements is unnecessarily confusing. *A simpler and more straightforward approach is to add a correspondence address, email and/or phone number to the registration data.* Of course, in order for this to accomplish the intended purpose, the registrant's address, email and phone number would NOT be easily available. And that involves the rules for disclosure of non-public data. More on this below. *Proxy service vs NIS2 and GDPR* A Proxy service differs from a Privacy service by hiding all data about the registrant. The registrant has no data about the actual registrant. Or, to be more precise, the registrant sees the Proxy service as the actual registrant, and the term that's often used to refer to the Proxy service's client is the "beneficial registrant." Today, Proxy service providers operate outside the ICANN contractual structure. With the exception of formal judicial processes, e.g. a government agent serving a warrant or subpoena, there is no way to compel a Proxy service to disclose the identity and other data about the beneficial registrant. The intent of the Privacy and Proxy Accreditation policy is to require Privacy and Proxy services to: - register with ICANN, - agree to an accreditation process, - conform with whatever rules are adopted later regarding collecting accurate data, and - conform to whatever rules are adopted later regarding disclosing that data. Meanwhile, ICANN is very, very, very slowly developing rules regarding the accuracy of the registration data and the disclosure of that data to appropriate requestors. ICANN has spent an inordinate amount of time wrestling with the GDPR. The sequence from SSAD to RDRS has been wasteful and ineffective. NIS2 is going to require accurate data, and we have not yet begun to take that requirement into account. The question that seems obvious to me is how these two sets of rules will interact. For example : - If registrants achieve greater protection using a Proxy service than without, does that mean the protection provided by registrars is insufficient? - The other side of that same question relates to disclosure. If a requestor has a legitimate need for registration data, but the data in its database is only the name of the Proxy service, doesn't that undermine the concept of providing registration to appropriate requestors for legitimate purposes? There are other questions related to the creation of a new bureaucracy that deserve attention, but I think those questions should come after we have a sensible understanding of how the overall system is supposed to work. *Whither the PPSAI working group?* The PPSAI working is focused on implementing an accreditation process for Privacy and Proxy services. What's missing in my view is clarity as to the purpose of this accreditation and clarity as to whether accrediting P/P Services will accomplish the purpose. In brief, we don't have a policy that is fit for purpose. ============================================= As I said at the top, this is a first draft. I invite responses, and I am particularly interested in others who wish to join the effort to make sense of this effort. Thanks, Steve sender

5 5

IRT Session #2: Agenda and preparation for 25 July Session
by Dennis Chang July 23, 2024

July 23, 2024

Dear PPSAI IRT, I look forward to our meeting on Thursday 25 July at 15:30 UTC for 90 minutes. Recurring calendar invitations with the zoom meeting details have been emailed to all current IRT members. Please reach out in advance of the meeting to Dana Kuebler<mailto:dana.kuebler@icann.org> dana.kuebler(a)icann.org<mailto:dana.kuebler@icann.org> or Noor Zannat<mailto:noor.zannat@icann.org> noor.zannat(a)icann.org<mailto:noor.zannat@icann.org> if you are an IRT member and did not receive session invitation details or are unable to access the IRT Team Google Drive<https://drive.google.com/drive/folders/0AOaxo18QlKY6Uk9PVA>. note: If your statement of interest (SOI) is incomplete or you wish to be an observer, you will not receive meeting invitations or access to the IRT working documents. We hope you have had some time to review the Board approved PPSAI Final Report<https://gnso.icann.org/sites/default/files/filefield_48305/ppsai-final-07de…> and identify any questions for further discussion with the IRT. This was an IRT Task issued on 13 June 2024. 20240613b Read PPSAI Final Report<https://gnso.icann.org/sites/default/files/filefield_48305/ppsai-final-07de…> and identify any questions for the IRT 20240710 I realized that many of you joined the IRT as recently as last week and are still working on this task. Please complete before our meeting this Thursday since we will be discussing the Final Report at our meeting. We maintain the IRT Meeting Information on the IRT Wiki: Meeting Agenda and Recording. Please check this link to confirm your access to the meeting agenda > Agenda<https://community.icann.org/pages/viewpage.action?pageId=362315806> Agenda Welcome & verify team access Orientation to IRT materials (IRT Team Drive) Collaborative review of final report section 1.3.1 Summary of the WG’s Final consensus recommendations <https://docs.google.com/document/d/1nS5WTk0p79XRT0CcCzByAyH_xn6KMDgElc5F6QS…> (pages 5-18) and Overview of IRT comment instructions AOB Next steps/tasks Session Target Objectives: 1. Verify member access to shared collaboration space and communications 2. Establish methods and tools to capture IRT questions and concerns on the 21 recommendations 3. Working session for IRT members to make comments and conduct discussion. -- Kind Regards, Dennis S. Chang GDD Programs Director Phone: +1 213 293 7889 Sykpe: dennisSchang www.icann.org<http://www.icann.org> One World – One Internet

1 0

Re: PPSAI IRT meeting scheduling plan
by Dennis Chang July 22, 2024

July 22, 2024

Hi Luc, I just saw the meeting invitation hit my inbox. Could you confirm you received it too? Thanks, Dennis Chang From: Luc SEUFER via Gdd-gnso-ppsai-impl <gdd-gnso-ppsai-impl(a)icann.org> Reply-To: "PPSAI IRT members, including observers" <gdd-gnso-ppsai-impl(a)icann.org> Date: Monday, July 22, 2024 at 8:10 AM To: "gdd-gnso-ppsai-impl(a)icann.org" <gdd-gnso-ppsai-impl(a)icann.org> Cc: Luc SEUFER <lseufer(a)namespace.com> Subject: [Gdd-gnso-ppsai-impl] Re: PPSAI IRT meeting scheduling plan Hi Dennis et alia, Was the meeting invite sent already, and I missed it? Thanks, Luc From: Dennis Chang via Gdd-gnso-ppsai-impl <gdd-gnso-ppsai-impl(a)icann.org> Date: Thursday, 18 July 2024 at 01:19 To: gdd-gnso-ppsai-impl(a)icann.org <gdd-gnso-ppsai-impl(a)icann.org> Cc: Dennis Chang <dennis.chang(a)icann.org> Subject: [Gdd-gnso-ppsai-impl] PPSAI IRT meeting scheduling plan Dear PPSAI IRT, Thank you for responding to the recent request for availability. Our meetings will be scheduled for 90 minutes beginning on Thursday 25 July 15:30-17:00 UTC. Look for meeting call information details in a separate email. You will soon be receiving meeting invites for recurring meetings every other Thursday until ICANN81. We are reserving the time space in case we need to meet; however, meetings may be shortened or canceled if there is nothing to discuss at that time. At this time, we plan to hold an in-person meeting at ICANN81, but we are still coordinating the details internally. We will notify you as soon as we have a tentative time. Note: Meeting invitations are for IRT Members and should not be forwarded to observers or non-IRT members. Please also note that IRT membership is open, and anyone can join at any time. Please look for another email to remind you of your tasks to be prepared for the meeting. We are grateful for your participation and look forward to our next meeting. -- Kind Regards, Dennis S. Chang GDD Programs Director Phone: +1 213 293 7889 Sykpe: dennisSchang www.icann.org<http://www.icann.org/> One World – One Internet

5 4