- Gdd-gnso-ppsai-impl - lists.icann.org

Re: [Gdd-gnso-ppsai-impl] Materials for tomorrow's PP IRT call
by Darcy Southwell Feb. 12, 2018

Feb. 12, 2018

My apologies, but I won’t be able to make tomorrow’s meeting. I will follow up by listening to the recording. Darcy From: Gdd-gnso-ppsai-impl <gdd-gnso-ppsai-impl-bounces(a)icann.org> on behalf of Amy Bivins <amy.bivins(a)icann.org> Reply-To: <gdd-gnso-ppsai-impl(a)icann.org> Date: Monday, February 12, 2018 at 9:23 AM To: "gdd-gnso-ppsai-impl(a)icann.org" <gdd-gnso-ppsai-impl(a)icann.org> Subject: [Gdd-gnso-ppsai-impl] Materials for tomorrow's PP IRT call Hello, All, In advance of tomorrow’s IRT call, I’m attaching the updated PP Policy document (in both clean and redline versions) and the de-accreditation process document in redline. Tomorrow we’re planning to walk through the updates to these documents since we’ve last discussed them, and then we’ll leave them open for your feedback. Following up on the discussion on the list this past week, we’ve seen significant discussion of the LEA disclosure framework. I don’t believe that Peter is available tomorrow to join us, so we should wait until he is available (hopefully next week) to discuss. If, despite the progression of this discussion, we are unable to reach agreement on the topic, we will flag the various suggestions and views raised by IRT members for public comment. Best, Amy Amy E. Bivins Registrar Services and Engagement Senior Manager Registrar Services and Industry Relations Internet Corporation for Assigned Names and Numbers (ICANN) Direct: +1 (202) 249-7551 Fax: +1 (202) 789-0104 Email: amy.bivins(a)icann.org www.icann.org _______________________________________________ Gdd-gnso-ppsai-impl mailing list Gdd-gnso-ppsai-impl(a)icann.org https://mm.icann.org/mailman/listinfo/gdd-gnso-ppsai-impl

2 1

Doc's for 2/13 PPSAI IRT call?
by Metalitz, Steven Feb. 12, 2018

Feb. 12, 2018

Hello Amy, In the run up to tomorrow's call I am checking on the status of the 2 documents you referenced in the message below as likely to be ready for review by the IRT by then: (1) One additional specification to review, related to the proposed format for monthly reporting (2) Updates to the draft Policy document, de-accreditation process document, and Applicant Guide based on the IRT's input Thanks in advance for the latest on this. Steve Metalitz [image001] Steven J. Metalitz | Partner, through his professional corporation T: 202.355.7902 | met(a)msk.com<mailto:met@msk.com> Mitchell Silberberg & Knupp LLP | www.msk.com<http://www.msk.com/> 1818 N Street NW, 8th Floor, Washington, DC 20036 THE INFORMATION CONTAINED IN THIS E-MAIL MESSAGE IS INTENDED ONLY FOR THE PERSONAL AND CONFIDENTIAL USE OF THE DESIGNATED RECIPIENTS. THIS MESSAGE MAY BE AN ATTORNEY-CLIENT COMMUNICATION, AND AS SUCH IS PRIVILEGED AND CONFIDENTIAL. IF THE READER OF THIS MESSAGE IS NOT AN INTENDED RECIPIENT, YOU ARE HEREBY NOTIFIED THAT ANY REVIEW, USE, DISSEMINATION, FORWARDING OR COPYING OF THIS MESSAGE IS STRICTLY PROHIBITED. PLEASE NOTIFY US IMMEDIATELY BY REPLY E-MAIL OR TELEPHONE, AND DELETE THE ORIGINAL MESSAGE AND ALL ATTACHMENTS FROM YOUR SYSTEM. THANK YOU. From: Gdd-gnso-ppsai-impl [mailto:gdd-gnso-ppsai-impl-bounces@icann.org] On Behalf Of Amy Bivins Sent: Tuesday, January 30, 2018 11:14 AM To: gdd-gnso-ppsai-impl(a)icann.org Subject: [Gdd-gnso-ppsai-impl] Action items, next steps following today's IRT call Dear Colleagues, Thank you for your participation on today's privacy/proxy IRT call. If you couldn't attend, I encourage you to listen to the (very short) recording, available on the wiki, https://community.icann.org/display/IRT/30+January+2018<https://community.icann.org/display/IRT/30+January+2018> Today, we reviewed proposed edits to Specification 5, including the addition of the following text from the Final Report to the specification's introduction (see p. 85 of the Final Report), "Given the balance that this Policy attempts to strike, evidence of the use of high-volume, automated electronic processes for sending Requests or responses to Requests (without human review) to the systems of Requesters, Providers, or Customers in performing any of the steps in the processes outlined in this Policy shall create a rebuttable presumption of non-compliance with this Policy." Barring any further IRT discussion on this change, or the other following typographical changes throughout the specification, we will make these edits to the next PPAA draft: * Updating references to "WHOIS" to "RDDS" throughout the specification; * Updating the word "Policy" to "Specification" throughout the specification; * Changing the word "trademark" to "copyright" in Section 32.2.7.4<http://32.2.7.4>. We also reviewed the previously agreed-upon plan to publish the draft data retention specification as-is, with the understanding that this could be impacted at a later date by the parallel GDPR work that is currently underway. Please send any further input you have on these items to the list this week. Next Steps We have one additional specification to review, related to the proposed format for monthly reporting (we expect this will mostly be of interest to the registrar members of the IRT). If this is ready next week we will review but, if not, we may cancel next week's meeting. I'll let you know by the end of this week. Meanwhile, ICANN Org is finalizing updates to the draft Policy document, de-accreditation process document, and Applicant Guide based on the IRT's input. I expect to be able to share these with you next week, for discussion the following week (the week of 13 February). I hope to be able to share the next PPAA draft with you the week of 13 Feb, for final IRT review over the following couple of weeks. Once these materials have been reviewed by the IRT, we will be ready for public comment. Our hope is to publish these for comment by the end of February, or at least prior to ICANN61. We have requested an IRT meeting slot for ICANN61, but do not have a date/time confirmed yet. Provided we are out for comment at that point, we plan to discuss the remaining Transfer Policy issue during that meeting. Best, Amy Amy E. Bivins Registrar Services and Engagement Senior Manager Registrar Services and Industry Relations Internet Corporation for Assigned Names and Numbers (ICANN) Direct: +1 (202) 249-7551 Fax: +1 (202) 789-0104 Email: amy.bivins(a)icann.org<mailto:amy.bivins@icann.org> www.icann.org<http://www.icann.org>

2 1

Request for IRT Feedback: LEA Framework Specification, Receipt Process's Application to High Priority Requests
by Amy Bivins Feb. 5, 2018

Feb. 5, 2018

Dear Colleagues, As mentioned on the list a couple of weeks ago, the current draft PPAA is still a bit ambiguous regarding how the review process outlined in Section 3.2.1 applies to high priority requests. We need ensure that the draft is clear about this requirement when we go out for public comment (and if there is opposition to the proposed requirement by any members of the IRT, this will be flagged in the call for comments). Upon reviewing the IRT's input to date, I am proposing an edit that I believe reflects the IRT discussion on this point. Please review and provide your comments on this proposed language no later than this Friday, 9 February. To summarize, the current draft contains a two-step process for Providers upon receipt of a request from LEA. (1) Within two business days, the Provider must review the request and confirm to the LEA requester that it has been received and contains the relevant information required to meet the minimum standard for acceptance (See 3.2.1 of Specification 4). (2) The Provider must then action the request in accordance with the priority level (within 24 hours for "high priority" requests (4.1.2); or within the timeline requested by LEA, if possible, for other requests (See 4.1.3). The current language may be a bit ambiguous as to whether the two business day "review period" applies before the 24-hour period for responding to high priority requests (as explained in more detail in the attached message). The view of registrar IRT members appears to be that requiring action within 24 hours of receipt of an LEA request, even if it is a high priority request, is unacceptable. PSWG members of the IRT disagree. Other IRT members appear to have mixed views on this (some referenced the RAA requirement that "Well-founded reports of Illegal Activity submitted to these [dedicated LEA] contacts must be reviewed within 24 hours by an individual who is empowered by Registrar to take necessary and appropriate actions in response to the report." Registrar members of the IRT said that the RAA-required review is less intensive than the PPAA review due to the specific requirements in the PPAA draft). Based on the views expressed within the IRT, it appears that one potential solution to this ambiguity would be to update Section 4.1.2 to state that (proposed edit in red), "Where a disclosure request has been categorized as High Priority, this must be actioned within 24 hours of completion of the receipt process outlined in Section 3.2." The LEA Requestor will detail the threat type and justification for a request with a Priority Level of High Priority." The practical impact of this proposed change would be that the provider must action a high priority request within 24 hours of determining that the request meets the minimum standard for acceptance. If the provider completes the receipt process sooner than 2 business days after receipt of the request, this would start the 24-hour clock for actioning the request. Thus, this could shorten the response window a bit, partially addressing the PSWG concerns of a "two business days plus 24 hours" requirement, while also addressing registrar concerns by not starting the clock until the provider has time to review the request, if the full time of the receipt process is required to conduct that review. Please provide your feedback on this proposed change no later than this Friday, 9 Feb. And if you have further comments on this, please share those as well. Best, Amy Amy E. Bivins Registrar Services and Engagement Senior Manager Registrar Services and Industry Relations Internet Corporation for Assigned Names and Numbers (ICANN) Direct: +1 (202) 249-7551 Fax: +1 (202) 789-0104 Email: amy.bivins(a)icann.org<mailto:amy.bivins@icann.org> www.icann.org<http://www.icann.org>

1 0

Canceled--PP IRT meeting scheduled for 6 Feb
by Amy Bivins Feb. 2, 2018

Feb. 2, 2018

Dear Colleagues, The Privacy/Proxy IRT meeting scheduled for 6 February has been canceled. We will reconvene the following week, 13 February. Please watch your inboxes, as updated materials should be distributed for your review and discussion on 13 February by the end of next week. Best (and have a great weekend!), Amy Amy E. Bivins Registrar Services and Engagement Senior Manager Registrar Services and Industry Relations Internet Corporation for Assigned Names and Numbers (ICANN) Direct: +1 (202) 249-7551 Fax: +1 (202) 789-0104 Email: amy.bivins(a)icann.org<mailto:amy.bivins@icann.org> www.icann.org<http://www.icann.org>

1 0

Action items, next steps following today's IRT call
by Amy Bivins Jan. 30, 2018

Jan. 30, 2018

Dear Colleagues, Thank you for your participation on today's privacy/proxy IRT call. If you couldn't attend, I encourage you to listen to the (very short) recording, available on the wiki, https://community.icann.org/display/IRT/30+January+2018 Today, we reviewed proposed edits to Specification 5, including the addition of the following text from the Final Report to the specification's introduction (see p. 85 of the Final Report), "Given the balance that this Policy attempts to strike, evidence of the use of high-volume, automated electronic processes for sending Requests or responses to Requests (without human review) to the systems of Requesters, Providers, or Customers in performing any of the steps in the processes outlined in this Policy shall create a rebuttable presumption of non-compliance with this Policy." Barring any further IRT discussion on this change, or the other following typographical changes throughout the specification, we will make these edits to the next PPAA draft: * Updating references to "WHOIS" to "RDDS" throughout the specification; * Updating the word "Policy" to "Specification" throughout the specification; * Changing the word "trademark" to "copyright" in Section 32.2.7.4. We also reviewed the previously agreed-upon plan to publish the draft data retention specification as-is, with the understanding that this could be impacted at a later date by the parallel GDPR work that is currently underway. Please send any further input you have on these items to the list this week. Next Steps We have one additional specification to review, related to the proposed format for monthly reporting (we expect this will mostly be of interest to the registrar members of the IRT). If this is ready next week we will review but, if not, we may cancel next week's meeting. I'll let you know by the end of this week. Meanwhile, ICANN Org is finalizing updates to the draft Policy document, de-accreditation process document, and Applicant Guide based on the IRT's input. I expect to be able to share these with you next week, for discussion the following week (the week of 13 February). I hope to be able to share the next PPAA draft with you the week of 13 Feb, for final IRT review over the following couple of weeks. Once these materials have been reviewed by the IRT, we will be ready for public comment. Our hope is to publish these for comment by the end of February, or at least prior to ICANN61. We have requested an IRT meeting slot for ICANN61, but do not have a date/time confirmed yet. Provided we are out for comment at that point, we plan to discuss the remaining Transfer Policy issue during that meeting. Best, Amy Amy E. Bivins Registrar Services and Engagement Senior Manager Registrar Services and Industry Relations Internet Corporation for Assigned Names and Numbers (ICANN) Direct: +1 (202) 249-7551 Fax: +1 (202) 789-0104 Email: amy.bivins(a)icann.org<mailto:amy.bivins@icann.org> www.icann.org<http://www.icann.org>

1 0

Copy edits to Spec. 5
by Metalitz, Steven Jan. 29, 2018

Jan. 29, 2018

PPSAI IRT colleagues, In advance of our discussion tomorrow on Specification 5, the Intellectual Property Disclosure Framework Specification, I offer a handful of copy edits/typo corrections in the attached document. Mainly this involves substituting the word "Specification" for "Policy" and "RDDS" for "Whois." In case you have trouble distinguishing these copy edits from the ICANN staff's redlines, note that the only sections I have touched are the following: 1.3, 1.4, 2.2.2, 2.2.7.4, 2.3.2, 3.1.2.1. In addition, I suggest we find the appropriate place in this Specification for implementation of the following paragraph from the Illustrative Disclosure Framework adopted by the PDP Working Group: "Given the balance that this Policy attempts to strike, evidence of the use of high-volume, automated electronic processes for sending Requests or responses to Requests (without human review) to the systems of Requesters, Providers, or Customers in performing any of the steps in the processes outlined in this Policy shall create a rebuttable presumption of non-compliance with this Policy." Looking forward to our discussion tomorrow. Steve Metalitz [image001] Steven J. Metalitz | Partner, through his professional corporation T: 202.355.7902 | met(a)msk.com<mailto:met@msk.com> Mitchell Silberberg & Knupp LLP | www.msk.com<http://www.msk.com/> 1818 N Street NW, 8th Floor, Washington, DC 20036 THE INFORMATION CONTAINED IN THIS E-MAIL MESSAGE IS INTENDED ONLY FOR THE PERSONAL AND CONFIDENTIAL USE OF THE DESIGNATED RECIPIENTS. THIS MESSAGE MAY BE AN ATTORNEY-CLIENT COMMUNICATION, AND AS SUCH IS PRIVILEGED AND CONFIDENTIAL. IF THE READER OF THIS MESSAGE IS NOT AN INTENDED RECIPIENT, YOU ARE HEREBY NOTIFIED THAT ANY REVIEW, USE, DISSEMINATION, FORWARDING OR COPYING OF THIS MESSAGE IS STRICTLY PROHIBITED. PLEASE NOTIFY US IMMEDIATELY BY REPLY E-MAIL OR TELEPHONE, AND DELETE THE ORIGINAL MESSAGE AND ALL ATTACHMENTS FROM YOUR SYSTEM. THANK YOU. From: Gdd-gnso-ppsai-impl [mailto:gdd-gnso-ppsai-impl-bounces@icann.org] On Behalf Of Amy Bivins Sent: Tuesday, January 23, 2018 2:53 PM To: gdd-gnso-ppsai-impl(a)icann.org Subject: [Gdd-gnso-ppsai-impl] Final IRT Feedback Due EOD Sunday 28 Jan: draft LEA framework Dear Colleagues, Thanks so much for your active participation on today's Privacy/Proxy Accreditation Program IRT call. If you were unable to attend, I encourage you to listen to the recording. Today, we continued discussing the LEA disclosure framework specification in the draft PPAA (pp. 50-54 of the draft contract, attached). The discussion today confirmed that there is continued uncertainty regarding two items in the draft framework. Please submit any final feedback that you have on these topics to the list this week. After this final feedback period, if this issue/these issues are unresolved, they will be specifically identified as unresolved in the call for public comments. Section 3.1: As drafted, this section requires Providers to publish on their websites the designated LEA contact (e.g. email address, telephone number, form or other means for LEA to obtain the designated LEA contact information). Summary of Issue: Many members of the IRT support the deletion of the requirement that this contact (or a means to obtain this contact) appear on the Provider's website. The RAA does not require registrars to publish the registrar LEA contact on the registrar website (See RAA 3.18.2). There appear to be at least a few possible paths forward: 1. Keep language as-is. 2. Delete the second sentence of 3.1, which requires that this information be posted on the Provider website. 3. Replace the second sentence of 3.1 with language such as that suggested by Steve Metalitz, "Provider shall provide to LEA an appropriate means for LEA to obtain the designated LEA contact information." 4. Language from Section 3.18.2 of the RAA could be adapted for this agreement by changing "Registrar" to "Provider" or by making additional edits: 3.18.2 Registrar shall establish and maintain a dedicated abuse point of contact, including a dedicated email address and telephone number that is monitored 24 hours a day, seven days a week, to receive reports of Illegal Activity by law enforcement, consumer protection, quasi-governmental or other similar authorities designated from time to time by the national or territorial government of the jurisdiction in which the Registrar is established or maintains a physical office. 5. We could keep the language as-is for now, note any remaining disagreement about whether the contact (or a way to obtain it) should be posted on the Provider's website during the public comment period, and request community feedback on potential paths forward. 6. Some other path (please explain). Timeline for Providers to Action "High Priority" Requests From LEA Summary of Issue: The current PPAA draft contains a two-step process for Providers upon receipt of a request from LEA. (1) Within two business days, the Provider must review the request and confirm to the LEA requester that it has been received and contains the relevant information required to meet the minimum standard for acceptance (See 3.2.1). (2) The Provider must then action the request in accordance with the priority level (within 24 hours for "high priority" requests (4.1.2); or within the timeline requested by LEA, if possible, for other requests (See 4.1.3). Note 1: The RAA requires (See Section 3.18.2) that "Well-founded reports of Illegal Activity submitted to these [dedicated LEA] contacts must be reviewed within 24 hours by an individual who is empowered by Registrar to take necessary and appropriate actions in response to the report." Note 2: There is some uncertainty, as this is currently drafted, as to whether the 2 business day review period applies before the 24 hour response time for "high priority" requests. Section 4.1.1 states that "Upon completion of the Receipt Process Specified in Section 3 of this Specification, Provider will action, in accordance with Sections 4.2 and 4.3 of this Specification, the disclosure request in accordance with the Priority Level." Upon the resolution of the issue below, we will review the specification as a whole to ensure it reflects the intended result. IRT questions: 1. Should Providers be required to action all "high priority" requests within 24 hours of receipt, as recommended by PSWG (and not apply the 2 business day "receipt period" first)? 2. If no, do you see a compromise short of applying the current 2 business day receipt period prior to the 24-hour period for actioning a "high priority" request? Thanks so much for your continued input on these topics. Next week, we will pick up our discussion with the IP Disclosure Framework Specification. Best, Amy Amy E. Bivins Registrar Services and Engagement Senior Manager Registrar Services and Industry Relations Internet Corporation for Assigned Names and Numbers (ICANN) Direct: +1 (202) 249-7551 Fax: +1 (202) 789-0104 Email: amy.bivins(a)icann.org<mailto:amy.bivins@icann.org> www.icann.org<http://www.icann.org>

1 0

Final IRT Feedback Due EOD Sunday 28 Jan: draft LEA framework
by Amy Bivins Jan. 24, 2018

Jan. 24, 2018

Dear Colleagues, Thanks so much for your active participation on today's Privacy/Proxy Accreditation Program IRT call. If you were unable to attend, I encourage you to listen to the recording. Today, we continued discussing the LEA disclosure framework specification in the draft PPAA (pp. 50-54 of the draft contract, attached). The discussion today confirmed that there is continued uncertainty regarding two items in the draft framework. Please submit any final feedback that you have on these topics to the list this week. After this final feedback period, if this issue/these issues are unresolved, they will be specifically identified as unresolved in the call for public comments. Section 3.1: As drafted, this section requires Providers to publish on their websites the designated LEA contact (e.g. email address, telephone number, form or other means for LEA to obtain the designated LEA contact information). Summary of Issue: Many members of the IRT support the deletion of the requirement that this contact (or a means to obtain this contact) appear on the Provider's website. The RAA does not require registrars to publish the registrar LEA contact on the registrar website (See RAA 3.18.2). There appear to be at least a few possible paths forward: 1. Keep language as-is. 2. Delete the second sentence of 3.1, which requires that this information be posted on the Provider website. 3. Replace the second sentence of 3.1 with language such as that suggested by Steve Metalitz, "Provider shall provide to LEA an appropriate means for LEA to obtain the designated LEA contact information." 4. Language from Section 3.18.2 of the RAA could be adapted for this agreement by changing "Registrar" to "Provider" or by making additional edits: 3.18.2 Registrar shall establish and maintain a dedicated abuse point of contact, including a dedicated email address and telephone number that is monitored 24 hours a day, seven days a week, to receive reports of Illegal Activity by law enforcement, consumer protection, quasi-governmental or other similar authorities designated from time to time by the national or territorial government of the jurisdiction in which the Registrar is established or maintains a physical office. 5. We could keep the language as-is for now, note any remaining disagreement about whether the contact (or a way to obtain it) should be posted on the Provider's website during the public comment period, and request community feedback on potential paths forward. 6. Some other path (please explain). Timeline for Providers to Action "High Priority" Requests From LEA Summary of Issue: The current PPAA draft contains a two-step process for Providers upon receipt of a request from LEA. (1) Within two business days, the Provider must review the request and confirm to the LEA requester that it has been received and contains the relevant information required to meet the minimum standard for acceptance (See 3.2.1). (2) The Provider must then action the request in accordance with the priority level (within 24 hours for "high priority" requests (4.1.2); or within the timeline requested by LEA, if possible, for other requests (See 4.1.3). Note 1: The RAA requires (See Section 3.18.2) that "Well-founded reports of Illegal Activity submitted to these [dedicated LEA] contacts must be reviewed within 24 hours by an individual who is empowered by Registrar to take necessary and appropriate actions in response to the report." Note 2: There is some uncertainty, as this is currently drafted, as to whether the 2 business day review period applies before the 24 hour response time for "high priority" requests. Section 4.1.1 states that "Upon completion of the Receipt Process Specified in Section 3 of this Specification, Provider will action, in accordance with Sections 4.2 and 4.3 of this Specification, the disclosure request in accordance with the Priority Level." Upon the resolution of the issue below, we will review the specification as a whole to ensure it reflects the intended result. IRT questions: 1. Should Providers be required to action all "high priority" requests within 24 hours of receipt, as recommended by PSWG (and not apply the 2 business day "receipt period" first)? 2. If no, do you see a compromise short of applying the current 2 business day receipt period prior to the 24-hour period for actioning a "high priority" request? Thanks so much for your continued input on these topics. Next week, we will pick up our discussion with the IP Disclosure Framework Specification. Best, Amy Amy E. Bivins Registrar Services and Engagement Senior Manager Registrar Services and Industry Relations Internet Corporation for Assigned Names and Numbers (ICANN) Direct: +1 (202) 249-7551 Fax: +1 (202) 789-0104 Email: amy.bivins(a)icann.org<mailto:amy.bivins@icann.org> www.icann.org<http://www.icann.org>

2 3

Agenda for tomorrow's PP IRT meeting
by Amy Bivins Jan. 22, 2018

Jan. 22, 2018

Hello, All, Thanks so much for your input on the list last week. Tomorrow, we will pick up where we left off last week, continuing to discuss the LEA disclosure framework specification. We will continue to discuss remaining IRT comments that we have received on the remainder of the specifications. I'm also attaching for your information the most recent data escrow specification, which is not included in the current PPAA draft, but will be included in the next version. This document was last discussed by the IRT in October, and we have received no recommendations for edits to it since then. Unless any additional IRT feedback on this reveals a need for changes, this will be included as-is in the next PPAA draft. Best, Amy Amy E. Bivins Registrar Services and Engagement Senior Manager Registrar Services and Industry Relations Internet Corporation for Assigned Names and Numbers (ICANN) Direct: +1 (202) 249-7551 Fax: +1 (202) 789-0104 Email: amy.bivins(a)icann.org<mailto:amy.bivins@icann.org> www.icann.org<http://www.icann.org>

3 2

Summary of today's privacy/proxy IRT call, IRT action items
by Amy Bivins Jan. 18, 2018

Jan. 18, 2018

Dear Colleagues, Thanks so much for your active participation on today's privacy/proxy IRT call. If you were unable to attend, I encourage you to listen to the recording, which is available on the wiki, https://participate.icann.org/p8nkvqvkvyr/ Today we began reviewing the most recent round of IRT member comments on the PPAA specifications. Some high-level notes regarding our discussions are below. Please send any additional input you have on the topics discussed today to the list no later than the end of this week. Next week, we will pick up where we left off today on the LEA disclosure framework specification. Specification 1: Customer Data Accuracy Specification Issue 1: Re: IRT member comment-this specification needs to be revisited, confusing as to how this is impacted by Affiliate/TPP status Proposed Solution: Move Section 3 to the beginning of this specification. Issue 2: Should Section 1 be edited to add an additional trigger-when the privacy and/or proxy service is enabled? Rationale: PP Service could be turned on in response to a WHOIS accuracy complaint, resulting in the shielding of potentially inaccurate information instead of validation/verification. IRT Feedback on this proposal was mixed. Additional feedback is requested. Issue 3: In Section 5, IRT member recommended that all references to registrars to terminate or suspend should be removed. Rationale: Registrars are not bound by this contract. IRT Feedback: At a minimum, registrars should be notified if PP service is suspended or terminated due to inaccurate customer contact information. This will trigger registrar obligations under the RAA to validate/verify. Issue 4: In Section 6, does addition of "by Registrar" solve issue (to clarify that PP provider cannot place names on clientHold or TransferProhibited status)? IRT Feedback seemed to support this change. Specification 2: Registration Data Directory Service Labeling Specification Issue 1: Is this specification attempting to require retention of this data, or to simply identify what information should appear in WHOIS for PP registrations? Assuming the latter, this specification should be updated (perhaps in introductory language in Section 1, and potentially moving up section 3) to clearly note this purpose. In addition, labeling requirements for "registrant organization" field should be added as an example in Section 1. Sections 3.2.1 and 3.5.3 should also be reviewed to ensure consistency across contract text, data retention specification and this specification. Specification 3: Consensus Policies and Temporary Policies Specification Issue 1: Feedback from Theo Geurts (Re: Section 1.2.1)-how does a privacy service endanger the security or stability of the internet? Comments on today's call: IRT member comment-this should only be included if there is a specific purpose for this; Other IRT members-there are instances where someone acting in a manner that could endanger security/stability may be hiding behind a PP service Proposed Next Steps: If no further IRT feedback to the contrary, reasons to keep this section appear to have been identified. Issue 2: IRT member Feedback Re: Section 1.3-I think we can delete all sections in 1.3 as they deal with domain name registrations in general rather than providing a privacy service. We could say privacy providers should not practice warehousing, but that is not what it currently says. Comments from today's call: At least some of these sections appear to be relevant to PP services (see, e.g. Sections 1.3.6) Proposed Next Steps: If IRT members would like to identify any sections that they believe should be deleted, please send specific suggestions to the list this week. Specification 4: Law Enforcement Authority Disclosure Framework Specification Issue 1: Proposal to change references to "national or international law" to "applicable law" Comments from today's call: No issues raised on call Proposed next steps: Update language throughout specification if no contrary input from IRT. Issue 2: Timeline for processing/responding to "high priority" requests Current status: PPAA draft provides for two business days for providers to process LEA requests and ensure they meet minimum standards for acceptance (Section 3.2.1). If a request meets criteria for "high priority" request, provider must action the request within 24 hours (Section 4.1.2) Comments from today's call: Timeline for provider responses to high priority LEA requests was revisited. PSWG representative stated that this is too long. Some Rr representatives on call reiterated prior feedback that receipt process may require legal/outside review, and that 2 business days is appropriate timeframe. Proposed next steps: This discussion mirrors points raised in prior discussions regarding this framework (summary of most recent discussions in August, including results of IRT poll regarding potential changes from "2 business day" review period, attached). This topic will be continued next week. If there is continued disagreement among IRT stakeholders after Tuesday's call, this item will be specifically flagged for community input in the call for public comments. Best, Amy Amy E. Bivins Registrar Services and Engagement Senior Manager Registrar Services and Industry Relations Internet Corporation for Assigned Names and Numbers (ICANN) Direct: +1 (202) 249-7551 Fax: +1 (202) 789-0104 Email: amy.bivins(a)icann.org<mailto:amy.bivins@icann.org> www.icann.org<http://www.icann.org>

6 5

Regrets for today's call
by Darcy Southwell Jan. 16, 2018

Jan. 16, 2018

My apologies, but I will not be able to make the 16 January call. __________ *Darcy Southwell *| Compliance Officer M: +1 503-453-7305 │ Skype: darcy.enyeart

2 1