- Gdd-gnso-ppsai-impl - lists.icann.org

Materials, IRT Action Items from 30 May PP Call
by Amy Bivins June 5, 2017

June 5, 2017

Dear Colleagues, Thanks so much for your active participation on today's Privacy/Proxy IRT call. If you were unable to attend, I encourage you to listen to the recording because we covered a lot of ground today. The recording is available on the wiki, https://participate.icann.org/p6bxagpwaq9/ IRT Action Items (1) Please submit any additional feedback you have on the draft v1 applicant guide (attached) by Friday. We will be discussing again and there will be more opportunities for discussion, but the more feedback we have now the better, as we will use the feedback received this week in drafting v2. A summary of your feedback received to date on the applicant guide is attached. I am also attaching the results of the IRT survey of initial operational questions that you completed back in February-this came up briefly on today's call. I apologize that I over-stated the point referenced today on the call-I said that the majority of the IRT said in the poll that the existence of a PP Provider application and/or the contents of an application for accreditation should not be made public. This is true-there was a slight majority of the IRT for this point on each of the questions, but it was a very close result for both questions and the number of participants was relatively low for this poll. (2) Please submit your feedback on the RDDS labeling proposals discussed on today's call no later than Friday. For those not on the call, the Registrar Subteam has developed two possible solutions to implementing the recommendation that registrations involving privacy and/or proxy services should be clearly labeled as such in WHOIS. The first solution would be to (a) require that the privacy/proxy service provider name and ICANN ID appear in the registrant name and/or the registrant organization field (the "or" is to accommodate privacy services where the customer's name appears in the Registrant Name field--this was discussed further on the call). The second solution was (b) require that the privacy/proxy service provider's name, ICANN ID and a URL to the ICANN webpage listing of all accredited providers and contact information. The IRT was roughly split on these proposals. Some IRT members saw an added benefit to the URL (which would provide an easily-identifiable source of Provider contact information that may not be visible in WHOIS), while others thought the URL was unnecessary and could complicate automated uses of the label. If no clear consensus is reached on the list on the path forward on this one, we will take this to a poll. (3) Please submit any additional feedback you have regarding the "unaffiliated provider" issue raised by the registrar subteam today on the call. In summary, members of the registrar subteam have suggested that certain operational issues may make the accreditation of providers that are not affiliated with a registrar highly undesirable or impossible. There have been challenges noted by IRT members and staff throughout this IRT related to unaffiliated providers (particularly in the area of de-accreditation). However, as noted on the call, the Final Report does clearly reference unaffiliated providers, which seems to indicate an intent that unaffiliated providers should be permitted to become accredited. As a result, any potential question/action that would limit eligibility for accreditation by providers that are not affiliated with a registrar would likely need to be taken to the GNSO Council for guidance. At this stage, we are hoping to gather as much IRT input as possible on this so that we can determine how best to proceed. Please send your feedback to the list on this topic this week. As any changes on this point would have a substantial impact on the overall implementation of this program, any action on this should be taken as soon as practicable. Thanks so much for your attention to these matters. Please don't hesitate to contact me or write to the list directly if you have additional comments or questions. Amy E. Bivins Registrar Services and Engagement Senior Manager Registrar Services and Industry Relations Internet Corporation for Assigned Names and Numbers (ICANN) Direct: +1 (202) 249-7551 Fax: +1 (202) 789-0104 Email: amy.bivins(a)icann.org<mailto:amy.bivins@icann.org> www.icann.org<http://www.icann.org>

8 14

Re: [Gdd-gnso-ppsai-impl] Fwd: PSWG proposal
by theo geurts June 4, 2017

June 4, 2017

Sure Nick, no worries, I don't mind. Best regards, Theo On 4-6-2017 18:13, Nick Shorey Lists wrote: > Hi Theo, > > Thanks for the email. If you don't mind I'll hold until Tuesday, but > it's a good question to raise, and certainly one I'm keen to discuss > in practical terms with the experts within this group. > > Kind regards, > > Nick > > Nick Shorey > Phone: +44 (0) 7552 455 988 > Email: lists(a)nickshorey.com <mailto:lists@nickshorey.com> > Skype: nick.shorey > Twitter: @nickshorey > LinkedIn: www.linkedin.com/in/nicklinkedin > <http://www.linkedin.com/in/nicklinkedin> > Web: www.nickshorey.com <http://www.nickshorey.com> > > On 4 Jun 2017, at 13:11, theo geurts <gtheo(a)xs4all.nl > <mailto:gtheo@xs4all.nl>> wrote: > > Looking forward to the presentation. > > Nick, can you provide some background on 4.2.1 in advance? If not, no > worries, we will zoom in on it Tuesday, I am just curious and most > likely overthinking what a secure mechanism is, in this scenario. > > /4.2.1 Within the appropriate timeframe consistent with the Priority > Level, the Provider will disclose to Requestor using a secure > mechanism the Requested Information it holds against the account. / > > Best regards, > > Theo Geurts > > > On 4-6-2017 13:10, Amy Bivins wrote: >> Dear Colleagues, >> >> Please see the PSWG proposal attached, which Nick Shorey will present >> to the IRT on Tuesday. >> >> Best, >> Amy >> >> Sent from my iPhone >> >> Begin forwarded message: >> >>> *From:* Nick Shorey <lists(a)nickshorey.com <mailto:lists@nickshorey.com>> >>> *Date:* June 4, 2017 at 6:42:52 AM EDT >>> *To:* Amy Bivins <amy.bivins(a)icann.org <mailto:amy.bivins@icann.org>> >>> *Cc:* Fabien Betremieux <fabien.betremieux(a)icann.org >>> <mailto:fabien.betremieux@icann.org>> >>> *Subject:* *[Ext] Re: Checking in on PSWG proposal* >>> >>> Hi Amy, >>> >>> Please see attached the Disclosure Framework Principles document, >>> which has now been approved by the GAC. >>> >>> Do send me the details for Tuesday's session, and I look forward to >>> running the rest of the IRT through the document. >>> >>> FYI I did a Webinar for the GAC last week which took around 30 mins >>> - though I anticipate there could be more questions from the IRT so >>> it could run longer. >>> >>> Kind regards, >>> >>> Nick >>> >>> *Nick Shorey* >>> Phone: +44 (0) 7552 455 988 >>> Email: lists(a)nickshorey.com <mailto:lists@nickshorey.com> >>> Skype: nick.shorey >>> Twitter: @nickshorey >>> LinkedIn: www.linkedin.com/in/nicklinkedin[linkedin.com] >>> <https://urldefense.proofpoint.com/v2/url?u=http-3A__www.linkedin.com_in_nic…> >>> Web: www.nickshorey.com[nickshorey.com] >>> <https://urldefense.proofpoint.com/v2/url?u=http-3A__www.nickshorey.com&d=Dw…> >>> >>> On Sat, Jun 3, 2017 at 4:12 PM, Amy Bivins <amy.bivins(a)icann.org >>> <mailto:amy.bivins@icann.org>> wrote: >>> >>> Hi Nick, >>> >>> Just checking in-how are things looking for the PSWG proposal >>> for PP? >>> >>> Thanks and have a great weekend! >>> Amy >>> >>> Sent from my iPhone >>> >>> >> >> >> _______________________________________________ >> Gdd-gnso-ppsai-impl mailing list >> Gdd-gnso-ppsai-impl(a)icann.org >> https://mm.icann.org/mailman/listinfo/gdd-gnso-ppsai-impl >

1 0

Fwd: PSWG proposal
by Amy Bivins June 4, 2017

June 4, 2017

Dear Colleagues, Please see the PSWG proposal attached, which Nick Shorey will present to the IRT on Tuesday. Best, Amy Sent from my iPhone Begin forwarded message: From: Nick Shorey <lists(a)nickshorey.com<mailto:lists@nickshorey.com>> Date: June 4, 2017 at 6:42:52 AM EDT To: Amy Bivins <amy.bivins(a)icann.org<mailto:amy.bivins@icann.org>> Cc: Fabien Betremieux <fabien.betremieux(a)icann.org<mailto:fabien.betremieux@icann.org>> Subject: [Ext] Re: Checking in on PSWG proposal Hi Amy, Please see attached the Disclosure Framework Principles document, which has now been approved by the GAC. Do send me the details for Tuesday's session, and I look forward to running the rest of the IRT through the document. FYI I did a Webinar for the GAC last week which took around 30 mins - though I anticipate there could be more questions from the IRT so it could run longer. Kind regards, Nick Nick Shorey Phone: +44 (0) 7552 455 988 Email: lists(a)nickshorey.com<mailto:lists@nickshorey.com> Skype: nick.shorey Twitter: @nickshorey LinkedIn: www.linkedin.com/in/nicklinkedin[linkedin.com]<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.linkedin.com_in_nic…> Web: www.nickshorey.com[nickshorey.com]<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.nickshorey.com&d=Dw…> On Sat, Jun 3, 2017 at 4:12 PM, Amy Bivins <amy.bivins(a)icann.org<mailto:amy.bivins@icann.org>> wrote: Hi Nick, Just checking in-how are things looking for the PSWG proposal for PP? Thanks and have a great weekend! Amy Sent from my iPhone

3 2

Agenda for Privacy/Proxy IRT call, 30 May
by Amy Bivins May 26, 2017

May 26, 2017

Dear Colleagues, On our next Privacy/Proxy IRT call, scheduled for Tuesday, 30 May, at 1400 UTC, we will discuss the following: * Update regarding the Registrar Subteam's work on RDDS labeling (Francisco Arias, Technical Services, will be joining us for this discussion); * Discussion of IRT feedback on draft applicant guide. If there are any additional topics you wish to raise, please let me know by responding to the list. I summarize the input we have received to date on the draft applicant guide, but because Monday is a holiday and the meeting is early Tuesday in the US, today is the cutoff for sharing material that will be incorporated into the slide deck. Thanks so much for your participation, and I look forward to speaking with you on Tuesday. Have a great weekend! Best, Amy Amy E. Bivins Registrar Services and Engagement Senior Manager Registrar Services and Industry Relations Internet Corporation for Assigned Names and Numbers (ICANN) Direct: +1 (202) 249-7551 Fax: +1 (202) 789-0104 Email: amy.bivins(a)icann.org<mailto:amy.bivins@icann.org> www.icann.org<http://www.icann.org>

1 0

Materials for PP IRT Review, Meeting Next Week Canceled to Provide Additional Review Time
by Amy Bivins May 26, 2017

May 26, 2017

Dear Colleagues, Thanks so much for your active participation on yesterday's Privacy/Proxy IRT call. The meeting recording and materials are available on the wiki: https://community.icann.org/display/IRT/16+May+2017 As a reminder, we are requesting your feedback on the draft v1 applicant guide, distributed to the IRT last week and also attached. Following our discussion yesterday, I created two new documents to aid your review of the draft applicant guide: (1) a comparison document that shows the differences between the current ICANN application for registrar accreditation and the draft v1 application for privacy/proxy service provider accreditation (attached). (2) An annotated version of the draft v1 application for privacy/proxy service provider accreditation (attached), noting questions that are proposed in response to a specific recommendation from the Final Report. As you are reviewing these documents, please consider the following questions: (a) Is this proposed process consistent with the intent of the Policy recommendations? (b) Do the proposed evaluation criteria seem to be consistent with the intent of the Policy recommendations? (c) Are there areas where ICANN should consider streamlining the evaluation for registrar-Affiliated providers? (d) Are there processes/criteria that may require "implementation adjustment" (as noted in p. 6 of the Final Report) in the case of providers that are not affiliated with ICANN-accredited registrars? (e) Should ICANN consider reducing the number of evaluation questions and instead ensure that the applicant understands and agrees to comply with the relevant requirements via the required applicant educational program (and screening test, as discussed in April?). If so, which questions do you believe could/should be evaluated in this manner? Next week's meeting, scheduled for 23 May, is canceled to provide additional time for this review. Our next meeting will be on 30 May 2017. Please send your feedback on these documents to the list no later than your EOD 25 May. If you have questions or comments between now and then, please don't hesitate to reply to the list or contact me directly. Best, Amy Amy E. Bivins Registrar Services and Engagement Senior Manager Registrar Services and Industry Relations Internet Corporation for Assigned Names and Numbers (ICANN) Direct: +1 (202) 249-7551 Fax: +1 (202) 789-0104 Email: amy.bivins(a)icann.org<mailto:amy.bivins@icann.org> www.icann.org<http://www.icann.org>

6 8

Fwd: [Ext] Update: PPSAI Disclosure Framework
by Amy Bivins May 12, 2017

May 12, 2017

Dear Colleagues, Please see the update below from Nick Shorey regarding the timeline of the GAC's review of the PSWG proposal. Best, Amy Sent from my iPhone Begin forwarded message: From: Nick Shorey <lists(a)nickshorey.com<mailto:lists@nickshorey.com>> Date: May 12, 2017 at 9:56:04 AM EDT To: Amy Bivins <amy.bivins(a)icann.org<mailto:amy.bivins@icann.org>> Subject: [Ext] Update: PPSAI Disclosure Framework Hi Amy, Hope you're well. Please can you share this update with the members of the IRT. FYI I'm still not receiving any IRT emails on this address - and none caught in my spam - can you double check I'm on the mailing list for lists(a)nickshorey.com<mailto:lists@nickshorey.com>? The draft principles developed by the PSWG for the disclosure framework has now been circulated to the GAC for approval. Due to a busy schedule of ITU meetings affecting many GAC representatives, the deadline has been extended to 2nd June. If approval is given, I then hope to issue this to the IRT on 3rd June. Please accept my apologies for the delays. Kind regards, Nick Nick Shorey Phone: +44 (0) 7552 455 988 Email: lists(a)nickshorey.com<mailto:lists@nickshorey.com> Skype: nick.shorey Twitter: @nickshorey LinkedIn: www.linkedin.com/in/nicklinkedin[linkedin.com]<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.linkedin.com_in_nic…> Web: www.nickshorey.com[nickshorey.com]<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.nickshorey.com&d=Dw…>

1 0

Materials, questions for 16 May Privacy/Proxy IRT Call
by Amy Bivins May 12, 2017

May 12, 2017

Dear Colleagues, I hope you are well. In advance of our call on Tuesday, 16 May, at 15:00 UTC, I am attaching a draft applicant guide, which we will be discussing on the call. Please review this document prior to the call. The document outlines a proposed application process and preliminary evaluation criteria based on the initial discussions we had in April. The document includes a draft application for accreditation that is modeled on the registrar accreditation application, for discussion purposes. As you are reviewing this document, please consider the following questions: (1) Is this proposed process consistent with the intent of the Policy recommendations? (2) Do the proposed evaluation criteria seem to be consistent with the intent of the Policy recommendations? (3) Are there areas where ICANN should consider streamlining the evaluation for registrar-Affiliated providers? (4) Are there processes/criteria that may require "implementation adjustment" (as noted in p. 6 of the Final Report) in the case of providers that are not affiliated with ICANN-accredited registrars? (5) Should ICANN consider reducing the number of evaluation questions and instead ensure that the applicant understands and agrees to comply with the relevant requirements via the required applicant educational program (and screening test, as discussed in April?). If so, which questions do you believe could/should be evaluated in this manner? We look forward to speaking with you next week. On the call, I'll provide an overview of the document and then open the call up for IRT discussion on the questions above and any other feedback you have on the document. I encourage you to share any initial thoughts you may have on these questions on the list prior to the call, if you are able, to give other IRT members time to consider issues raised prior to the call. Best, Amy Amy E. Bivins Registrar Services and Engagement Senior Manager Registrar Services and Industry Relations Internet Corporation for Assigned Names and Numbers (ICANN) Direct: +1 (202) 249-7551 Fax: +1 (202) 789-0104 Email: amy.bivins(a)icann.org www.icann.org

1 0

Results of IRT poll on PP de-accreditation, next steps
by Amy Bivins May 4, 2017

May 4, 2017

Dear Colleagues, Thank you for your participation in last week's Privacy/Proxy IRT call and the recent poll regarding Privacy/Proxy Provider de-accreditation. A summary of the input received on the call and in the poll is attached. Based on this initial feedback, ICANN is developing an initial proposal for discussion based on the proposed "Option 1." We aim to have this ready for continued IRT discussions in late May. As a reminder, our IRT meeting for next week, 9 May, is canceled due to the GDD Summit. We will re-convene on 16 May. Best, Amy Amy E. Bivins Registrar Services and Engagement Senior Manager Registrar Services and Industry Relations Internet Corporation for Assigned Names and Numbers (ICANN) Direct: +1 (202) 249-7551 Fax: +1 (202) 789-0104 Email: amy.bivins(a)icann.org www.icann.org

1 0

Re: [Gdd-gnso-ppsai-impl] Accreditation and de-accreditation of NA-TPPPs
by Chris Pelling April 30, 2017

April 30, 2017

All very good points Theo, food for thought certainly. Sent from Chris on the move! On Sun, Apr 30, 2017 at 6:41 PM +0100, "theo geurts" <gtheo(a)xs4all.nl> wrote: Hi all, I think we are jumping the gun when it comes to the de-accreditation approach as proposed by the poll from last week. While trying to come up with a process, it became rather messy, and eventually, I gave up, as every solution was rather poor. So I reversed the process and started with the accreditation process to see if that would yield better results. The process for registrars offering privacy services or its affiliates is not problematic as we roughly have an idea and we have the WG recommendations. Now the non-affiliated third party privacy providers (NA-TPPP), that is a rather different beast. A classic example for those who spend time in the data metrics policy making WG where you can't qualify or quantify a problem, and you can't turn to the CPH to ask them for information or input due to the fact these TPPP are not regulated at all. NA-TPPP who or what are they? Some of them seem to be on the surface semi-professional while others seem to be a hobby project that grown out of portion and the rest is somewhere in between. The business model they use: You give them your registrant data, and they give you a set of privacy information that you can use at your registrar for free. One has to wonder how sustainable this business model is. How to onboard an NA-TPPP? For Registrars it is easy to get ICANN accredited in a sense, there is a good reason. A Registrar wants to register .com domain names? Then the requirement is to become ICANN accredited and only then you can start the accreditation process with Verisign. Onboarding an NA-TPPPs sounds like selling ice cream on the north pole. We barely have an idea who they are, and for sure they have no idea who or what ICANN is (sorry if I am bursting some bubbles here). Outreach will be problematic. Fees. NA-TPPPs do not sell domain names, they "offer" a service. For every registration and renewal a Registrar pays 18 cents to ICANN, wich goes into the ICANN budget. RDE Though the NA-TTTP might (it better be) have the registrant data, the Registrar is not included in this escrow deposit as they do not know where the privacy service info is used by the registrant. WDRP Audit requirement, who is going to pay for this? ERRP See WDRP ICANN involvement when NA-TPPP goes out of business. Worst case scenario the NA-TPPP gets breached and loses all data and backups. This has happened before in the past. ICANN would have to reach out to all registrants and somehow get Registrars in the mix. I am not sure how this scenario would unfold. Most likely it will be a costly business. Operational concerns IRTP C. This discussion still needs to take place somewhere. But if an NA-TPPP goes down we need to make sure that there is no loss of domain names or exposure of personal data. I think I am going to stop here for now. But I think we still need to get the accreditation process done first and then move on to the de-accreditation part. Best regards, Theo Geurts

1 0

Accreditation and de-accreditation of NA-TPPPs
by theo geurts April 30, 2017

April 30, 2017

Hi all, I think we are jumping the gun when it comes to the de-accreditation approach as proposed by the poll from last week. While trying to come up with a process, it became rather messy, and eventually, I gave up, as every solution was rather poor. So I reversed the process and started with the accreditation process to see if that would yield better results. The process for registrars offering privacy services or its affiliates is not problematic as we roughly have an idea and we have the WG recommendations. Now the non-affiliated third party privacy providers (NA-TPPP), that is a rather different beast. A classic example for those who spend time in the data metrics policy making WG where you can't qualify or quantify a problem, and you can't turn to the CPH to ask them for information or input due to the fact these TPPP are not regulated at all. *NA-TPPP who or what are they?* Some of them seem to be on the surface semi-professional while others seem to be a hobby project that grown out of portion and the rest is somewhere in between. *The business model they use:* You give them your registrant data, and they give you a set of privacy information that you can use at your registrar for free. One has to wonder how sustainable this business model is. *How to onboard an NA-TPPP?* For Registrars it is easy to get ICANN accredited in a sense, there is a good reason. A Registrar wants to register .com domain names? Then the requirement is to become ICANN accredited and only then you can start the accreditation process with Verisign. Onboarding an NA-TPPPs sounds like selling ice cream on the north pole. We barely have an idea who they are, and for sure they have no idea who or what ICANN is (sorry if I am bursting some bubbles here). Outreach will be problematic. *Fees. * NA-TPPPs do not sell domain names, they "offer" a service. For every registration and renewal a Registrar pays 18 cents to ICANN, wich goes into the ICANN budget. *RDE* Though the NA-TTTP might (it better be) have the registrant data, the Registrar is not included in this escrow deposit as they do not know where the privacy service info is used by the registrant. *WDRP* Audit requirement, who is going to pay for this? *ERRP* See WDRP *ICANN involvement when NA-TPPP goes out of business. * Worst case scenario the NA-TPPP gets breached and loses all data and backups. This has happened before in the past. ICANN would have to reach out to all registrants and somehow get Registrars in the mix. I am not sure how this scenario would unfold. Most likely it will be a costly business. *Operational concerns* IRTP C. This discussion still needs to take place somewhere. But if an NA-TPPP goes down we need to make sure that there is no loss of domain names or exposure of personal data. I think I am going to stop here for now. But I think we still need to get the accreditation process done first and then move on to the de-accreditation part. Best regards, Theo Geurts

1 0