Re: [Invt-gdd-gnso-ppsai-impl] Re: PPSAI IRT Meeting Reminder: This Thursday 15:30-17:00 UTC, 8:30-10:00 am PDT
Dennis, I had a comment marked as a “Concern” in the Google document that appears to have been removed, or at least I cannot find it. The substance of the Concern was that there should be a standard or set of best practices that should be followed in making a decision concerning disclosure. Thanks, John [http://www.nelsonmullins.com/img/ecard-logo.png] JOHN C. MCELWAINE PARTNER john.mcelwaine@nelsonmullins.com<mailto:john.mcelwaine@nelsonmullins.com> LIBERTY CENTER | SUITE 600 151 MEETING STREET | CHARLESTON, SC 29401 T 843.534.4302 F 843.722.8700 101 CONSTITUTION AVENUE, NW | SUITE 900 WASHINGTON, D.C., 20001 T 202.689.2939 F 202.689.2860 NELSONMULLINS.COM<http://www.nelsonmullins.com> VCARD<http://www.nelsonmullins.com/people/john-mcelwaine/vcard> VIEW BIO<http://www.nelsonmullins.com/people/john-mcelwaine> From: pimo via Invt-gdd-gnso-ppsai-impl <invt-gdd-gnso-ppsai-impl@icann.org> Sent: Thursday, October 17, 2024 10:31 AM To: Noor Zannat via Invt-gdd-gnso-ppsai-impl <invt-gdd-gnso-ppsai-impl@icann.org> Cc: pimo <pimonit@gmail.com> Subject: [Invt-gdd-gnso-ppsai-impl] Re: PPSAI IRT Meeting Reminder: This Thursday 15:30-17:00 UTC, 8:30-10:00 am PDT Hi Noor, I hope you are well. I was wondering if I could join the call half an hour later today—if you feel it's not too disruptive—as I have another call until 5. Otherwise, I’ll watch the recording and feed in any thoughts in due course. Hi Noor, I hope you are well. I was wondering if I could join the call half an hour later today—if you feel it's not too disruptive—as I have another call until 5. Otherwise, I’ll watch the recording and feed in any thoughts in due course. Thanks, Paola On Wed, 16 Oct 2024 at 19:03, Noor Zannat via Invt-gdd-gnso-ppsai-impl <invt-gdd-gnso-ppsai-impl@icann.org<mailto:invt-gdd-gnso-ppsai-impl@icann.org>> wrote: Dear PPSAI IRT, This is a reminder for our upcoming IRT Meeting scheduled for 90 minutes tomorrow. Agenda details can be found here<https://urldefense.com/v3/__https:/community.icann.org/display/IRT/IRT*Meeti...> REMINDER: Please sign into the zoom session with your full name. Admittance to the session may be delayed or denied if your full name is not provided. Additionally, Artificial Intelligence (AI) bots will not be allowed into the meeting as discussed during IRT Session #2, 24 July 2024 Join the Zoom room directly (recommended): https://icann.zoom.us/j/92061188255?pwd=7RXCoyaLUvzOYsfjdDI9qBz8klNkHo.1<https://urldefense.com/v3/__https:/icann.zoom.us/j/92061188255?pwd=7RXCoyaLUvzOYsfjdDI9qBz8klNkHo.1__;!!LBFcHN3WCgnqDQ!hVUc28nIiR6-RcwTWcaRg0yu3dfcGvy0rzPkzpHlcyYLo5HB2LMuDjpfHy_yzwfggqDeyHudJ_k5pO34z4fbi1KP5s2uNquZ2iJX$> (no password required) Before joining the call: Please be sure you have read the Expected Standards of Behavior<https://urldefense.com/v3/__https:/www.icann.org/resources/pages/expected-st...> If joining Zoom via the Zoom App, the following will be required: Meeting ID: 920 6118 8255 Password: %3a?$S5ZjZ If you are joining via audio only: One tap mobile +13462487799,,92061188255#,,,,*9486090507# US (Houston) +16699006833,,92061188255#,,,,*9486090507# US (San Jose) Dial in directly with your chosen number<https://urldefense.com/v3/__https:/zoom.us/zoomconference?u=Xk-KXAYeXAJnzZvt...> and provide: Meeting ID: 920 6118 8255 Password: 9486090507 If this is your first time with Zoom, please take a look here: Welcome to Zoom<https://urldefense.com/v3/__https:/gnso.icann.org/sites/default/files/policy...> Thank you for your support, we look forward to seeing you. Regards, Noor Zannat _______________________________________________ Invt-gdd-gnso-ppsai-impl mailing list -- invt-gdd-gnso-ppsai-impl@icann.org<mailto:invt-gdd-gnso-ppsai-impl@icann.org> To unsubscribe send an email to invt-gdd-gnso-ppsai-impl-leave@icann.org<mailto:invt-gdd-gnso-ppsai-impl-leave@icann.org> Confidentiality Notice This message is intended exclusively for the individual or entity to which it is addressed. This communication may contain information that is proprietary, privileged, confidential or otherwise legally exempt from disclosure. If you are not the named addressee, you are not authorized to read, print, retain, copy or disseminate this message or any part of it. If you have received this message in error, please notify the sender immediately either by phone (800-237-2000) or reply to this e-mail and delete all copies of this message.
Ignore. I found int. It was just not showing unless clicked upon. John From: John McElwaine Sent: Thursday, October 17, 2024 11:51 AM To: Dennis Chang via Gdd-gnso-ppsai-impl <gdd-gnso-ppsai-impl@icann.org> Subject: RE: [Invt-gdd-gnso-ppsai-impl] Re: PPSAI IRT Meeting Reminder: This Thursday 15:30-17:00 UTC, 8:30-10:00 am PDT Dennis, I had a comment marked as a “Concern” in the Google document that appears to have been removed, or at least I cannot find it. The substance of the Concern was that there should be a standard or set of best practices that should be followed in making a decision concerning disclosure. Thanks, John [http://www.nelsonmullins.com/img/ecard-logo.png] JOHN C. MCELWAINE PARTNER john.mcelwaine@nelsonmullins.com<mailto:john.mcelwaine@nelsonmullins.com> LIBERTY CENTER | SUITE 600 151 MEETING STREET | CHARLESTON, SC 29401 T 843.534.4302 F 843.722.8700 101 CONSTITUTION AVENUE, NW | SUITE 900 WASHINGTON, D.C., 20001 T 202.689.2939 F 202.689.2860 NELSONMULLINS.COM<http://www.nelsonmullins.com> VCARD<http://www.nelsonmullins.com/people/john-mcelwaine/vcard> VIEW BIO<http://www.nelsonmullins.com/people/john-mcelwaine> From: pimo via Invt-gdd-gnso-ppsai-impl <invt-gdd-gnso-ppsai-impl@icann.org<mailto:invt-gdd-gnso-ppsai-impl@icann.org>> Sent: Thursday, October 17, 2024 10:31 AM To: Noor Zannat via Invt-gdd-gnso-ppsai-impl <invt-gdd-gnso-ppsai-impl@icann.org<mailto:invt-gdd-gnso-ppsai-impl@icann.org>> Cc: pimo <pimonit@gmail.com<mailto:pimonit@gmail.com>> Subject: [Invt-gdd-gnso-ppsai-impl] Re: PPSAI IRT Meeting Reminder: This Thursday 15:30-17:00 UTC, 8:30-10:00 am PDT Hi Noor, I hope you are well. I was wondering if I could join the call half an hour later today—if you feel it's not too disruptive—as I have another call until 5. Otherwise, I’ll watch the recording and feed in any thoughts in due course. Hi Noor, I hope you are well. I was wondering if I could join the call half an hour later today—if you feel it's not too disruptive—as I have another call until 5. Otherwise, I’ll watch the recording and feed in any thoughts in due course. Thanks, Paola On Wed, 16 Oct 2024 at 19:03, Noor Zannat via Invt-gdd-gnso-ppsai-impl <invt-gdd-gnso-ppsai-impl@icann.org<mailto:invt-gdd-gnso-ppsai-impl@icann.org>> wrote: Dear PPSAI IRT, This is a reminder for our upcoming IRT Meeting scheduled for 90 minutes tomorrow. Agenda details can be found here<https://urldefense.com/v3/__https:/community.icann.org/display/IRT/IRT*Meeti...> REMINDER: Please sign into the zoom session with your full name. Admittance to the session may be delayed or denied if your full name is not provided. Additionally, Artificial Intelligence (AI) bots will not be allowed into the meeting as discussed during IRT Session #2, 24 July 2024 Join the Zoom room directly (recommended): https://icann.zoom.us/j/92061188255?pwd=7RXCoyaLUvzOYsfjdDI9qBz8klNkHo.1<https://urldefense.com/v3/__https:/icann.zoom.us/j/92061188255?pwd=7RXCoyaLUvzOYsfjdDI9qBz8klNkHo.1__;!!LBFcHN3WCgnqDQ!hVUc28nIiR6-RcwTWcaRg0yu3dfcGvy0rzPkzpHlcyYLo5HB2LMuDjpfHy_yzwfggqDeyHudJ_k5pO34z4fbi1KP5s2uNquZ2iJX$> (no password required) Before joining the call: Please be sure you have read the Expected Standards of Behavior<https://urldefense.com/v3/__https:/www.icann.org/resources/pages/expected-st...> If joining Zoom via the Zoom App, the following will be required: Meeting ID: 920 6118 8255 Password: %3a?$S5ZjZ If you are joining via audio only: One tap mobile +13462487799,,92061188255#,,,,*9486090507# US (Houston) +16699006833,,92061188255#,,,,*9486090507# US (San Jose) Dial in directly with your chosen number<https://urldefense.com/v3/__https:/zoom.us/zoomconference?u=Xk-KXAYeXAJnzZvt...> and provide: Meeting ID: 920 6118 8255 Password: 9486090507 If this is your first time with Zoom, please take a look here: Welcome to Zoom<https://urldefense.com/v3/__https:/gnso.icann.org/sites/default/files/policy...> Thank you for your support, we look forward to seeing you. Regards, Noor Zannat _______________________________________________ Invt-gdd-gnso-ppsai-impl mailing list -- invt-gdd-gnso-ppsai-impl@icann.org<mailto:invt-gdd-gnso-ppsai-impl@icann.org> To unsubscribe send an email to invt-gdd-gnso-ppsai-impl-leave@icann.org<mailto:invt-gdd-gnso-ppsai-impl-leave@icann.org> Confidentiality Notice This message is intended exclusively for the individual or entity to which it is addressed. This communication may contain information that is proprietary, privileged, confidential or otherwise legally exempt from disclosure. If you are not the named addressee, you are not authorized to read, print, retain, copy or disseminate this message or any part of it. If you have received this message in error, please notify the sender immediately either by phone (800-237-2000) or reply to this e-mail and delete all copies of this message.
Hello All, Attached is the Public Whois information associated with the following domain names seized by the US Department of Justice, see https://www.justice.gov/opa/pr/justice-department-disrupts-russian-intellige... You will see that most of these domain names appear to have been using a privacy/proxy service. Best regards, Michael
I would like to highlight that this is anecdotal observations and not factual data. This is a very small subset of the likely hundred+ million domain names that use privacy/proxy services for legitimate purposes, including palage.com <http://palage.com/>. The article also repeatedly highlights how the FBI thanked private partners who worked with the FBI to address this issue: “This seizure is part of a coordinated response with our private sector partners to dismantle the infrastructure that cyber espionage actors use to attack U.S. and international targets,” said U.S. Attorney Ismail J. Ramsey for the Northern District of California. “We thank all of our private-sector partners for their diligence in analyzing, publicizing, and combating the threat posed by these illicit state-coordinated actions in the Northern District of California, across the United States, and around the world.” Again, I cannot comment on any involvement of Namecheap in this matter, but it appears that the FBI does not have any concerns with the use of privacy/proxy services for the seized domains. I am not sure what this intervention means to show. Are you implying that the bad actors only did the bad stuff because they were able to use a privacy or proxy service?
On Oct 17, 2024, at 09:46, michael palage.com via Gdd-gnso-ppsai-impl <gdd-gnso-ppsai-impl@icann.org> wrote:
CAUTION: This email originated from outside the organization. Do not click links unless you can confirm the sender and know the content is safe. Hello All,
Attached is the Public Whois information associated with the following domain names seized by the US Department of Justice, seehttps://www.justice.gov/opa/pr/justice-department-disrupts-russian-intellige...
You will see that most of these domain names appear to have been using a privacy/proxy service.
Best regards,
Michael
<Whois-Records.pdf>_______________________________________________ Gdd-gnso-ppsai-impl mailing list -- gdd-gnso-ppsai-impl@icann.org <mailto:gdd-gnso-ppsai-impl@icann.org> To unsubscribe send an email to gdd-gnso-ppsai-impl-leave@icann.org <mailto:gdd-gnso-ppsai-impl-leave@icann.org> _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.
And for a third point of view on this, it doesn't matter for purposes of implementing the policy if P/P services are sometimes/often/never used by bad actors or are a good/bad idea. The existential question of whether or not P/P services should allowed is not in scope for the IRT. I hope that the IRT can get back on track and identify, with a basis beyond opinion or a desire to relitigate old issues lost during the PDP, anything that may need a fresh policy look due to changes in the technology, law, etc. since the policy was adopted. Best, Paul From: Owen Smigelski via Gdd-gnso-ppsai-impl <gdd-gnso-ppsai-impl@icann.org> Sent: Thursday, October 17, 2024 12:01 PM To: PPSAI IRT members, including observers <gdd-gnso-ppsai-impl@icann.org> Cc: michael palage.com <michael@palage.com>; Owen Smigelski <owen.smigelski@namecheap.com> Subject: [Gdd-gnso-ppsai-impl] Re: Factual Data for Our Consideration I would like to highlight that this is anecdotal observations and not factual data. This is a very small subset of the likely hundred+ million domain names that use privacy/proxy services for legitimate purposes, including palage.com<http://palage.com/>. The article also repeatedly highlights how the FBI thanked private partners who worked with the FBI to address this issue: "This seizure is part of a coordinated response with our private sector partners to dismantle the infrastructure that cyber espionage actors use to attack U.S. and international targets," said U.S. Attorney Ismail J. Ramsey for the Northern District of California. "We thank all of our private-sector partners for their diligence in analyzing, publicizing, and combating the threat posed by these illicit state-coordinated actions in the Northern District of California, across the United States, and around the world." Again, I cannot comment on any involvement of Namecheap in this matter, but it appears that the FBI does not have any concerns with the use of privacy/proxy services for the seized domains. I am not sure what this intervention means to show. Are you implying that the bad actors only did the bad stuff because they were able to use a privacy or proxy service? On Oct 17, 2024, at 09:46, michael palage.com via Gdd-gnso-ppsai-impl <gdd-gnso-ppsai-impl@icann.org<mailto:gdd-gnso-ppsai-impl@icann.org>> wrote: CAUTION: This email originated from outside the organization. Do not click links unless you can confirm the sender and know the content is safe. Hello All, Attached is the Public Whois information associated with the following domain names seized by the US Department of Justice, seehttps://www.justice.gov/opa/pr/justice-department-disrupts-russian-intellige... You will see that most of these domain names appear to have been using a privacy/proxy service. Best regards, Michael <Whois-Records.pdf>_______________________________________________ Gdd-gnso-ppsai-impl mailing list -- gdd-gnso-ppsai-impl@icann.org<mailto:gdd-gnso-ppsai-impl@icann.org> To unsubscribe send an email to gdd-gnso-ppsai-impl-leave@icann.org<mailto:gdd-gnso-ppsai-impl-leave@icann.org> _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on. This email originated from outside the firm. Please use caution.
Having served on the PPSAI WG, I am aligned with this view; this IRT signifies we are advancing the P/P policy perspectives established. This aside and reflecting on the timeline, I am wondering whether on adoption of an Interim Registration Data Policy consistent with data protection and privacy principles, the privacy profile is not also established as the default for registration data compliance? And, if this is the case, whether the entire substructure for the P/P policy is not now grievously undermined? If we accept that the privacy profile is now baseline for registration, then there could be consensus for acknowledging the current P/P policy is traumatised and on life support. Carlton ============================== *Carlton A Samuels* *Mobile: 876-818-1799Strategy, Process, Governance, Assessment & Turnaround* ============================= On Thu, 17 Oct 2024 at 14:05, Paul McGrady via Gdd-gnso-ppsai-impl < gdd-gnso-ppsai-impl@icann.org> wrote:
And for a third point of view on this, it doesn’t matter for purposes of implementing the policy if P/P services are sometimes/often/never used by bad actors or are a good/bad idea. The existential question of whether or not P/P services should allowed is not in scope for the IRT. I hope that the IRT can get back on track and identify, with a basis beyond opinion or a desire to relitigate old issues lost during the PDP, anything that may need a fresh policy look due to changes in the technology, law, etc. since the policy was adopted.
Best,
Paul
*From:* Owen Smigelski via Gdd-gnso-ppsai-impl < gdd-gnso-ppsai-impl@icann.org> *Sent:* Thursday, October 17, 2024 12:01 PM *To:* PPSAI IRT members, including observers < gdd-gnso-ppsai-impl@icann.org> *Cc:* michael palage.com <michael@palage.com>; Owen Smigelski < owen.smigelski@namecheap.com> *Subject:* [Gdd-gnso-ppsai-impl] Re: Factual Data for Our Consideration
I would like to highlight that this *is* anecdotal observations and *not* factual data. This is a *very* small subset of the likely hundred+ million domain names that use privacy/proxy services for legitimate purposes, including palage.com.
The article also repeatedly highlights how the FBI thanked private partners who worked with the FBI to address this issue:
*“This seizure is part of a coordinated response with our private sector partners to dismantle the infrastructure that cyber espionage actors use to attack U.S. and international targets,” said U.S. Attorney Ismail J. Ramsey for the Northern District of California. “We thank all of our private-sector partners for their diligence in analyzing, publicizing, and combating the threat posed by these illicit state-coordinated actions in the Northern District of California, across the United States, and around the world.” *
Again, I cannot comment on any involvement of Namecheap in this matter, but it appears that the FBI does not have any concerns with the use of privacy/proxy services for the seized domains. I am not sure what this intervention means to show. Are you implying that the bad actors only did the bad stuff because they were able to use a privacy or proxy service?
On Oct 17, 2024, at 09:46, michael palage.com via Gdd-gnso-ppsai-impl < gdd-gnso-ppsai-impl@icann.org> wrote:
*CAUTION: **This email originated from outside the organization. Do not click links unless you can confirm the sender and know the content is safe.*
Hello All,
Attached is the Public Whois information associated with the following domain names seized by the US Department of Justice, see https://www.justice.gov/opa/pr/justice-department-disrupts-russian-intellige...
You will see that most of these domain names appear to have been using a privacy/proxy service.
Best regards,
Michael
<Whois-Records.pdf>_______________________________________________ Gdd-gnso-ppsai-impl mailing list -- gdd-gnso-ppsai-impl@icann.org To unsubscribe send an email to gdd-gnso-ppsai-impl-leave@icann.org _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.
This email originated from outside the firm. Please use caution. _______________________________________________ Gdd-gnso-ppsai-impl mailing list -- gdd-gnso-ppsai-impl@icann.org To unsubscribe send an email to gdd-gnso-ppsai-impl-leave@icann.org _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.
Hello Owen and Paul, First, I want to address Owen's statement that my previous email included "anecdotal observations." When the US Department of Justice seized over 40 domain names involved in a Russian Intelligence spear-phishing effort and then issued a press release. I do not believe that DoJ seizes domain names on "anecdotal observations." After reading that press release, I decided to do "research" and query the public Whois/RDDS information with each domain to document that information. As indicated in that PDF document, most of those domains where registered to your employer, NameCheap, and indicated an address with a Privacy/Proxy service also associated with NameCheap. I believe we should be able to agree on these "facts." While Owen referred to the New York Times article as a hack, I actually would encourage all IRT members to read it, see https://www.nytimes.com/2024/10/09/business/iceland-online-disinformation-id... I respect that you cannot comment on an ongoing investigation or legal proceeding. However, I "assume" based on the press release that NameCheap cooperated with the DoJ/FBI. While that was the right thing to do, it was also a smart thing to do. Now, I do want to address you and other Registrars' statements about his being just a handful of names. I would appreciate if the Contracting Parties could provide a number on want percentage of 362 million domain name registered do they view as being involved with criminal or harmful activity is acceptable? So while, 40 domain names did not cross your threshold, how about 300,000 domain names? ICANN recently credited an ICANN-accredited Registrar over $57,000 in connection with over 300,000 names that were registered using fraudulent credit cards, see https://www.icann.org/en/system/files/correspondence/weinstein-to-palage-07o.... I know the Registries and Registrars are collectively working on this problem as it does not appear to be a one-off problem but a more systemic one. Perhaps one of the Registries or Registrars on the IRT could reach out and ask if these 300,000 names were registered using a privacy/proxy service. If we could confirm this "fact." Hopefully we could all agree that it would be something material regarding the concerns about the use of proxy/privacy services in connection with DNS Abuse. This is the final response to Owen's email. Thanks for the heads-up regarding PALAGE.COM. I do not recall opting for that setting. Roger, as a GoDaddy customer, perhaps you can shed some light on how that status changed. I do not recall knowingly making this change. I think this topic deserves further discussion if, as Volker stated on today's call, some registrars default all registrations to privacy/proxy. Owen you will be happy to know public Whois/RDDS in connection PALAGE.COM is now available just like it was before. Turning to Paul's intervention. I think we are in agreement that the focus of the IRT needs to be about implementation. But as myself, Alan, Steve and others have tried to articulate, there have been a lot of material changes since this original PDP began almost 13 years ago. This sub-group is trying to convey these factual changes and bring them to the attention of the GNSO Council. And the reason for this is crucial and I hope that you please forward this email to the GNSO Council to bring this to their attention. Recital 111 to NIS 2.0 included the following text, "TLD name registries and entities providing domain name registration services should establish policies and procedures to collect and maintain accurate and complete domain name registration data, as well as to prevent and correct inaccurate registration data, in accordance with Union data protection law. Those policies and procedures should take into account, to the extent possible, the standards developed by the multi-stakeholder governance structures at international level." (emphasis added). Elena Plexida from ICANN Org, in briefing the Registrars and Registry about NIS 2.0, expressed frustration about what the term "to the extent possible" means. I think we have a front-row seat to how that language in NIS 2.0 will be interpreted. My personal hope is that we, as an IRT, can recognize some of the changes that have happened over the past 13 years and communicate this to the GNSO Council to get proper guidance. While that is my hope, I believe the more likely outcome is the contracting parties that constitute over half of the active membership in this IRT will block any changes that might lead to additional operating costs. Now if the IRT, GNSO Council, and ICANN decide not to address some of the issues that Steve, Alan, myself and others have properly raised, whether on procedural or substantive grounds, I can live with that. I just want the record to reflect that fact. Because this decision can then be communicated to the Cooperation Group, so that if they are ever confronted with a situation to interpret Recital 111 in connection with this subject matter, they will have the proper information to make their determination. Best regards, Michael From: Paul McGrady <paul@elstermcgrady.com> Sent: Thursday, October 17, 2024 3:05 PM To: PPSAI IRT members, including observers <gdd-gnso-ppsai-impl@icann.org> Cc: michael palage.com <michael@palage.com>; Owen Smigelski <owen.smigelski@namecheap.com> Subject: RE: [Gdd-gnso-ppsai-impl] Re: Factual Data for Our Consideration And for a third point of view on this, it doesn't matter for purposes of implementing the policy if P/P services are sometimes/often/never used by bad actors or are a good/bad idea. The existential question of whether or not P/P services should allowed is not in scope for the IRT. I hope that the IRT can get back on track and identify, with a basis beyond opinion or a desire to relitigate old issues lost during the PDP, anything that may need a fresh policy look due to changes in the technology, law, etc. since the policy was adopted. Best, Paul From: Owen Smigelski via Gdd-gnso-ppsai-impl <gdd-gnso-ppsai-impl@icann.org<mailto:gdd-gnso-ppsai-impl@icann.org>> Sent: Thursday, October 17, 2024 12:01 PM To: PPSAI IRT members, including observers <gdd-gnso-ppsai-impl@icann.org<mailto:gdd-gnso-ppsai-impl@icann.org>> Cc: michael palage.com <michael@palage.com<mailto:michael@palage.com>>; Owen Smigelski <owen.smigelski@namecheap.com<mailto:owen.smigelski@namecheap.com>> Subject: [Gdd-gnso-ppsai-impl] Re: Factual Data for Our Consideration I would like to highlight that this is anecdotal observations and not factual data. This is a very small subset of the likely hundred+ million domain names that use privacy/proxy services for legitimate purposes, including palage.com<http://palage.com/>. The article also repeatedly highlights how the FBI thanked private partners who worked with the FBI to address this issue: "This seizure is part of a coordinated response with our private sector partners to dismantle the infrastructure that cyber espionage actors use to attack U.S. and international targets," said U.S. Attorney Ismail J. Ramsey for the Northern District of California. "We thank all of our private-sector partners for their diligence in analyzing, publicizing, and combating the threat posed by these illicit state-coordinated actions in the Northern District of California, across the United States, and around the world." Again, I cannot comment on any involvement of Namecheap in this matter, but it appears that the FBI does not have any concerns with the use of privacy/proxy services for the seized domains. I am not sure what this intervention means to show. Are you implying that the bad actors only did the bad stuff because they were able to use a privacy or proxy service? On Oct 17, 2024, at 09:46, michael palage.com via Gdd-gnso-ppsai-impl <gdd-gnso-ppsai-impl@icann.org<mailto:gdd-gnso-ppsai-impl@icann.org>> wrote: CAUTION: This email originated from outside the organization. Do not click links unless you can confirm the sender and know the content is safe. Hello All, Attached is the Public Whois information associated with the following domain names seized by the US Department of Justice, seehttps://www.justice.gov/opa/pr/justice-department-disrupts-russian-intellige... You will see that most of these domain names appear to have been using a privacy/proxy service. Best regards, Michael <Whois-Records.pdf>_______________________________________________ Gdd-gnso-ppsai-impl mailing list -- gdd-gnso-ppsai-impl@icann.org<mailto:gdd-gnso-ppsai-impl@icann.org> To unsubscribe send an email to gdd-gnso-ppsai-impl-leave@icann.org<mailto:gdd-gnso-ppsai-impl-leave@icann.org> _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on. This email originated from outside the firm. Please use caution.
Thanks Michael. I think suggesting possible policy work based on factual changes is a good plan. Suggesting them based on what comes across as opinion likely won't fly. Glad we are moving away from a "bad idea" standard. I think that is a dead end. As for the request that I forward your email to the GNSO Council, I'll politely decline. This is for two reasons. First, there has to be a coherent process to all of this and asking the Council to review one email at a time is a recipe for chaos, not progress. The IRT needs to put together the list of facts they think have changed, e.g. laws, technology, etc. along with the policy issue(s) they think are affected and need a fresh look. Council can then make a decision about how they want to proceed, e.g. do nothing, do something, if something, GGP, PDP, EPDP, etc. Second, the concerns about NIS2 you raise are well noted, but now well developed. It seems like the better approach for your issue to be heard clearly is for the IRT to develop the fact-based information you note are on the way. Best, Paul From: michael palage.com <michael@palage.com> Sent: Thursday, October 17, 2024 5:31 PM To: Paul McGrady <paul@elstermcgrady.com>; PPSAI IRT members, including observers <gdd-gnso-ppsai-impl@icann.org>; Elena Plexida <elena.plexida@icann.org> Cc: Owen Smigelski <owen.smigelski@namecheap.com> Subject: RE: [Gdd-gnso-ppsai-impl] Re: Factual Data for Our Consideration You don't often get email from michael@palage.com<mailto:michael@palage.com>. Learn why this is important<https://aka.ms/LearnAboutSenderIdentification> Hello Owen and Paul, First, I want to address Owen's statement that my previous email included "anecdotal observations." When the US Department of Justice seized over 40 domain names involved in a Russian Intelligence spear-phishing effort and then issued a press release. I do not believe that DoJ seizes domain names on "anecdotal observations." After reading that press release, I decided to do "research" and query the public Whois/RDDS information with each domain to document that information. As indicated in that PDF document, most of those domains where registered to your employer, NameCheap, and indicated an address with a Privacy/Proxy service also associated with NameCheap. I believe we should be able to agree on these "facts." While Owen referred to the New York Times article as a hack, I actually would encourage all IRT members to read it, see https://www.nytimes.com/2024/10/09/business/iceland-online-disinformation-id... I respect that you cannot comment on an ongoing investigation or legal proceeding. However, I "assume" based on the press release that NameCheap cooperated with the DoJ/FBI. While that was the right thing to do, it was also a smart thing to do. Now, I do want to address you and other Registrars' statements about his being just a handful of names. I would appreciate if the Contracting Parties could provide a number on want percentage of 362 million domain name registered do they view as being involved with criminal or harmful activity is acceptable? So while, 40 domain names did not cross your threshold, how about 300,000 domain names? ICANN recently credited an ICANN-accredited Registrar over $57,000 in connection with over 300,000 names that were registered using fraudulent credit cards, see https://www.icann.org/en/system/files/correspondence/weinstein-to-palage-07o.... I know the Registries and Registrars are collectively working on this problem as it does not appear to be a one-off problem but a more systemic one. Perhaps one of the Registries or Registrars on the IRT could reach out and ask if these 300,000 names were registered using a privacy/proxy service. If we could confirm this "fact." Hopefully we could all agree that it would be something material regarding the concerns about the use of proxy/privacy services in connection with DNS Abuse. This is the final response to Owen's email. Thanks for the heads-up regarding PALAGE.COM. I do not recall opting for that setting. Roger, as a GoDaddy customer, perhaps you can shed some light on how that status changed. I do not recall knowingly making this change. I think this topic deserves further discussion if, as Volker stated on today's call, some registrars default all registrations to privacy/proxy. Owen you will be happy to know public Whois/RDDS in connection PALAGE.COM is now available just like it was before. Turning to Paul's intervention. I think we are in agreement that the focus of the IRT needs to be about implementation. But as myself, Alan, Steve and others have tried to articulate, there have been a lot of material changes since this original PDP began almost 13 years ago. This sub-group is trying to convey these factual changes and bring them to the attention of the GNSO Council. And the reason for this is crucial and I hope that you please forward this email to the GNSO Council to bring this to their attention. Recital 111 to NIS 2.0 included the following text, "TLD name registries and entities providing domain name registration services should establish policies and procedures to collect and maintain accurate and complete domain name registration data, as well as to prevent and correct inaccurate registration data, in accordance with Union data protection law. Those policies and procedures should take into account, to the extent possible, the standards developed by the multi-stakeholder governance structures at international level." (emphasis added). Elena Plexida from ICANN Org, in briefing the Registrars and Registry about NIS 2.0, expressed frustration about what the term "to the extent possible" means. I think we have a front-row seat to how that language in NIS 2.0 will be interpreted. My personal hope is that we, as an IRT, can recognize some of the changes that have happened over the past 13 years and communicate this to the GNSO Council to get proper guidance. While that is my hope, I believe the more likely outcome is the contracting parties that constitute over half of the active membership in this IRT will block any changes that might lead to additional operating costs. Now if the IRT, GNSO Council, and ICANN decide not to address some of the issues that Steve, Alan, myself and others have properly raised, whether on procedural or substantive grounds, I can live with that. I just want the record to reflect that fact. Because this decision can then be communicated to the Cooperation Group, so that if they are ever confronted with a situation to interpret Recital 111 in connection with this subject matter, they will have the proper information to make their determination. Best regards, Michael From: Paul McGrady <paul@elstermcgrady.com<mailto:paul@elstermcgrady.com>> Sent: Thursday, October 17, 2024 3:05 PM To: PPSAI IRT members, including observers <gdd-gnso-ppsai-impl@icann.org<mailto:gdd-gnso-ppsai-impl@icann.org>> Cc: michael palage.com <michael@palage.com<mailto:michael@palage.com>>; Owen Smigelski <owen.smigelski@namecheap.com<mailto:owen.smigelski@namecheap.com>> Subject: RE: [Gdd-gnso-ppsai-impl] Re: Factual Data for Our Consideration And for a third point of view on this, it doesn't matter for purposes of implementing the policy if P/P services are sometimes/often/never used by bad actors or are a good/bad idea. The existential question of whether or not P/P services should allowed is not in scope for the IRT. I hope that the IRT can get back on track and identify, with a basis beyond opinion or a desire to relitigate old issues lost during the PDP, anything that may need a fresh policy look due to changes in the technology, law, etc. since the policy was adopted. Best, Paul From: Owen Smigelski via Gdd-gnso-ppsai-impl <gdd-gnso-ppsai-impl@icann.org<mailto:gdd-gnso-ppsai-impl@icann.org>> Sent: Thursday, October 17, 2024 12:01 PM To: PPSAI IRT members, including observers <gdd-gnso-ppsai-impl@icann.org<mailto:gdd-gnso-ppsai-impl@icann.org>> Cc: michael palage.com <michael@palage.com<mailto:michael@palage.com>>; Owen Smigelski <owen.smigelski@namecheap.com<mailto:owen.smigelski@namecheap.com>> Subject: [Gdd-gnso-ppsai-impl] Re: Factual Data for Our Consideration I would like to highlight that this is anecdotal observations and not factual data. This is a very small subset of the likely hundred+ million domain names that use privacy/proxy services for legitimate purposes, including palage.com<http://palage.com/>. The article also repeatedly highlights how the FBI thanked private partners who worked with the FBI to address this issue: "This seizure is part of a coordinated response with our private sector partners to dismantle the infrastructure that cyber espionage actors use to attack U.S. and international targets," said U.S. Attorney Ismail J. Ramsey for the Northern District of California. "We thank all of our private-sector partners for their diligence in analyzing, publicizing, and combating the threat posed by these illicit state-coordinated actions in the Northern District of California, across the United States, and around the world." Again, I cannot comment on any involvement of Namecheap in this matter, but it appears that the FBI does not have any concerns with the use of privacy/proxy services for the seized domains. I am not sure what this intervention means to show. Are you implying that the bad actors only did the bad stuff because they were able to use a privacy or proxy service? On Oct 17, 2024, at 09:46, michael palage.com via Gdd-gnso-ppsai-impl <gdd-gnso-ppsai-impl@icann.org<mailto:gdd-gnso-ppsai-impl@icann.org>> wrote: CAUTION: This email originated from outside the organization. Do not click links unless you can confirm the sender and know the content is safe. Hello All, Attached is the Public Whois information associated with the following domain names seized by the US Department of Justice, seehttps://www.justice.gov/opa/pr/justice-department-disrupts-russian-intellige... You will see that most of these domain names appear to have been using a privacy/proxy service. Best regards, Michael <Whois-Records.pdf>_______________________________________________ Gdd-gnso-ppsai-impl mailing list -- gdd-gnso-ppsai-impl@icann.org<mailto:gdd-gnso-ppsai-impl@icann.org> To unsubscribe send an email to gdd-gnso-ppsai-impl-leave@icann.org<mailto:gdd-gnso-ppsai-impl-leave@icann.org> _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on. This email originated from outside the firm. Please use caution. This email originated from outside the firm. Please use caution.
Hi all, I don't think we should forward individual emails to the GNSO council. If we started doing that... Michael is right when he states the NIS2 recitals recommend following the ICANN moldel with regard to the verification processes and policies. This is why I have been saying all along that the output of the PPSAI-WG should be updated to take into account all the good work that the ICANN community has done in the intervening years. The recital also means that it considers the ICANN processes and policies as a good model, and as NIS2 applies equally to PP service providers, we should ensure that these providers have to comply with the same processes and policies with regard to verification and disclosure that applies to contracted parties. No more, no less. I agree it will be "interesting" (as in: "may you live in interesting times") to see how each country will interpret NIS2 in slightly different but valid ways, how courts will interpret those interpretations and how we as providers of registration services will be expected to work within these varying concepts. But those should not be the concern of our work. Regulation is one thing, ICAN policy another. There is no need to create policy for what is already regulated. And finally, as to the quality of the NYT article that reads liike an NYP article: Just count how many times they felt the need to include references to the penis museum Regus (a virtual office provider) in the article compared with how many times they acknowledge that the address is in fact a virtual office site shared by thousands of companies. "Oh, how risqué! It is slightly sexual!"! Quality journalism indeed. Pulitzer-worthy, I am sure... Sincerely, Volker Greimann General Counsel & Head of Policy and Compliance - Online Division volker.greimann@centralnic.com Office: +49-172-6367025 Web: www.teaminternet.com Team Internet Group PLC (AIM:TIG). Registered Office: 4th Floor, Saddlers House, 44 Gutter Lane, London, United Kingdom, EC2V 6BR. Team Internet is a company registered in England and Wales with the company number 8576358. ________________________________ From: michael palage.com via Gdd-gnso-ppsai-impl <gdd-gnso-ppsai-impl@icann.org> Sent: 18 October 2024 12:31 AM To: Paul McGrady <paul@elstermcgrady.com>; PPSAI IRT members, including observers <gdd-gnso-ppsai-impl@icann.org>; Elena Plexida <elena.plexida@icann.org> Cc: Owen Smigelski <owen.smigelski@namecheap.com>; michael palage.com <michael@palage.com> Subject: [Gdd-gnso-ppsai-impl] Re: Factual Data for Our Consideration Hello Owen and Paul, First, I want to address Owen’s statement that my previous email included “anecdotal observations.” When the US Department of Justice seized over 40 domain names involved in a Russian Intelligence spear-phishing effort and then issued a press release. I do not believe that DoJ seizes domain names on “anecdotal observations.” After reading that press release, I decided to do “research” and query the public Whois/RDDS information with each domain to document that information. As indicated in that PDF document, most of those domains where registered to your employer, NameCheap, and indicated an address with a Privacy/Proxy service also associated with NameCheap. I believe we should be able to agree on these “facts.” While Owen referred to the New York Times article as a hack, I actually would encourage all IRT members to read it, see https://www.nytimes.com/2024/10/09/business/iceland-online-disinformation-id... I respect that you cannot comment on an ongoing investigation or legal proceeding. However, I “assume” based on the press release that NameCheap cooperated with the DoJ/FBI. While that was the right thing to do, it was also a smart thing to do. Now, I do want to address you and other Registrars' statements about his being just a handful of names. I would appreciate if the Contracting Parties could provide a number on want percentage of 362 million domain name registered do they view as being involved with criminal or harmful activity is acceptable? So while, 40 domain names did not cross your threshold, how about 300,000 domain names? ICANN recently credited an ICANN-accredited Registrar over $57,000 in connection with over 300,000 names that were registered using fraudulent credit cards, see https://www.icann.org/en/system/files/correspondence/weinstein-to-palage-07o.... I know the Registries and Registrars are collectively working on this problem as it does not appear to be a one-off problem but a more systemic one. Perhaps one of the Registries or Registrars on the IRT could reach out and ask if these 300,000 names were registered using a privacy/proxy service. If we could confirm this “fact.” Hopefully we could all agree that it would be something material regarding the concerns about the use of proxy/privacy services in connection with DNS Abuse. This is the final response to Owen’s email. Thanks for the heads-up regarding PALAGE.COM. I do not recall opting for that setting. Roger, as a GoDaddy customer, perhaps you can shed some light on how that status changed. I do not recall knowingly making this change. I think this topic deserves further discussion if, as Volker stated on today’s call, some registrars default all registrations to privacy/proxy. Owen you will be happy to know public Whois/RDDS in connection PALAGE.COM is now available just like it was before. Turning to Paul’s intervention. I think we are in agreement that the focus of the IRT needs to be about implementation. But as myself, Alan, Steve and others have tried to articulate, there have been a lot of material changes since this original PDP began almost 13 years ago. This sub-group is trying to convey these factual changes and bring them to the attention of the GNSO Council. And the reason for this is crucial and I hope that you please forward this email to the GNSO Council to bring this to their attention. Recital 111 to NIS 2.0 included the following text, “TLD name registries and entities providing domain name registration services should establish policies and procedures to collect and maintain accurate and complete domain name registration data, as well as to prevent and correct inaccurate registration data, in accordance with Union data protection law. Those policies and procedures should take into account, to the extent possible, the standards developed by the multi-stakeholder governance structures at international level.” (emphasis added). Elena Plexida from ICANN Org, in briefing the Registrars and Registry about NIS 2.0, expressed frustration about what the term “to the extent possible" means. I think we have a front-row seat to how that language in NIS 2.0 will be interpreted. My personal hope is that we, as an IRT, can recognize some of the changes that have happened over the past 13 years and communicate this to the GNSO Council to get proper guidance. While that is my hope, I believe the more likely outcome is the contracting parties that constitute over half of the active membership in this IRT will block any changes that might lead to additional operating costs. Now if the IRT, GNSO Council, and ICANN decide not to address some of the issues that Steve, Alan, myself and others have properly raised, whether on procedural or substantive grounds, I can live with that. I just want the record to reflect that fact. Because this decision can then be communicated to the Cooperation Group, so that if they are ever confronted with a situation to interpret Recital 111 in connection with this subject matter, they will have the proper information to make their determination. Best regards, Michael From: Paul McGrady <paul@elstermcgrady.com> Sent: Thursday, October 17, 2024 3:05 PM To: PPSAI IRT members, including observers <gdd-gnso-ppsai-impl@icann.org> Cc: michael palage.com <michael@palage.com>; Owen Smigelski <owen.smigelski@namecheap.com> Subject: RE: [Gdd-gnso-ppsai-impl] Re: Factual Data for Our Consideration And for a third point of view on this, it doesn’t matter for purposes of implementing the policy if P/P services are sometimes/often/never used by bad actors or are a good/bad idea. The existential question of whether or not P/P services should allowed is not in scope for the IRT. I hope that the IRT can get back on track and identify, with a basis beyond opinion or a desire to relitigate old issues lost during the PDP, anything that may need a fresh policy look due to changes in the technology, law, etc. since the policy was adopted. Best, Paul From: Owen Smigelski via Gdd-gnso-ppsai-impl <gdd-gnso-ppsai-impl@icann.org<mailto:gdd-gnso-ppsai-impl@icann.org>> Sent: Thursday, October 17, 2024 12:01 PM To: PPSAI IRT members, including observers <gdd-gnso-ppsai-impl@icann.org<mailto:gdd-gnso-ppsai-impl@icann.org>> Cc: michael palage.com <michael@palage.com<mailto:michael@palage.com>>; Owen Smigelski <owen.smigelski@namecheap.com<mailto:owen.smigelski@namecheap.com>> Subject: [Gdd-gnso-ppsai-impl] Re: Factual Data for Our Consideration I would like to highlight that this is anecdotal observations and not factual data. This is a very small subset of the likely hundred+ million domain names that use privacy/proxy services for legitimate purposes, including palage.com<http://palage.com/>. The article also repeatedly highlights how the FBI thanked private partners who worked with the FBI to address this issue: “This seizure is part of a coordinated response with our private sector partners to dismantle the infrastructure that cyber espionage actors use to attack U.S. and international targets,” said U.S. Attorney Ismail J. Ramsey for the Northern District of California. “We thank all of our private-sector partners for their diligence in analyzing, publicizing, and combating the threat posed by these illicit state-coordinated actions in the Northern District of California, across the United States, and around the world.” Again, I cannot comment on any involvement of Namecheap in this matter, but it appears that the FBI does not have any concerns with the use of privacy/proxy services for the seized domains. I am not sure what this intervention means to show. Are you implying that the bad actors only did the bad stuff because they were able to use a privacy or proxy service? On Oct 17, 2024, at 09:46, michael palage.com via Gdd-gnso-ppsai-impl <gdd-gnso-ppsai-impl@icann.org<mailto:gdd-gnso-ppsai-impl@icann.org>> wrote: CAUTION: This email originated from outside the organization. Do not click links unless you can confirm the sender and know the content is safe. Hello All, Attached is the Public Whois information associated with the following domain names seized by the US Department of Justice, seehttps://www.justice.gov/opa/pr/justice-department-disrupts-russian-intellige... You will see that most of these domain names appear to have been using a privacy/proxy service. Best regards, Michael <Whois-Records.pdf>_______________________________________________ Gdd-gnso-ppsai-impl mailing list -- gdd-gnso-ppsai-impl@icann.org<mailto:gdd-gnso-ppsai-impl@icann.org> To unsubscribe send an email to gdd-gnso-ppsai-impl-leave@icann.org<mailto:gdd-gnso-ppsai-impl-leave@icann.org> _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on. This email originated from outside the firm. Please use caution.
One thing that I find amusing is that European legislation is mentioned as impacting PPSAI implementation, while other jurisdictions legislation is not. Like China Real Name policies, or Brazilian ban on anonymity… … we either take all of them onboard, or none at all. Cherry picking jurisdictions doesn’t sound like a good global policy. Rubens
Em 17 de out. de 2024, à(s) 19:31, michael palage.com via Gdd-gnso-ppsai-impl <gdd-gnso-ppsai-impl@icann.org> escreveu:
Hello Owen and Paul,
First, I want to address Owen’s statement that my previous email included “anecdotal observations.” When the US Department of Justice seized over 40 domain names involved in a Russian Intelligence spear-phishing effort and then issued a press release. I do not believe that DoJ seizes domain names on “anecdotal observations.” After reading that press release, I decided to do “research” and query the public Whois/RDDS information with each domain to document that information. As indicated in that PDF document, most of those domains where registered to your employer, NameCheap, and indicated an address with a Privacy/Proxy service also associated with NameCheap. I believe we should be able to agree on these “facts.” While Owen referred to the New York Times article as a hack, I actually would encourage all IRT members to read it, seehttps://www.nytimes.com/2024/10/09/business/iceland-online-disinformation-id...
I respect that you cannot comment on an ongoing investigation or legal proceeding. However, I “assume” based on the press release that NameCheap cooperated with the DoJ/FBI. While that was the right thing to do, it was also a smart thing to do. Now, I do want to address you and other Registrars' statements about his being just a handful of names. I would appreciate if the Contracting Parties could provide a number on want percentage of 362 million domain name registered do they view as being involved with criminal or harmful activity is acceptable?
So while, 40 domain names did not cross your threshold, how about 300,000 domain names? ICANN recently credited an ICANN-accredited Registrar over $57,000 in connection with over 300,000 names that were registered using fraudulent credit cards, see https://www.icann.org/en/system/files/correspondence/weinstein-to-palage-07o.... I know the Registries and Registrars are collectively working on this problem as it does not appear to be a one-off problem but a more systemic one. Perhaps one of the Registries or Registrars on the IRT could reach out and ask if these 300,000 names were registered using a privacy/proxy service. If we could confirm this “fact.” Hopefully we could all agree that it would be something material regarding the concerns about the use of proxy/privacy services in connection with DNS Abuse.
This is the final response to Owen’s email. Thanks for the heads-up regarding PALAGE.COM <http://palage.com/>. I do not recall opting for that setting. Roger, as a GoDaddy customer, perhaps you can shed some light on how that status changed. I do not recall knowingly making this change. I think this topic deserves further discussion if, as Volker stated on today’s call, some registrars default all registrations to privacy/proxy. Owen you will be happy to know public Whois/RDDS in connection PALAGE.COM <http://palage.com/> is now available just like it was before.
Turning to Paul’s intervention. I think we are in agreement that the focus of the IRT needs to be about implementation. But as myself, Alan, Steve and others have tried to articulate, there have been a lot of material changes since this original PDP began almost 13 years ago. This sub-group is trying to convey these factual changes and bring them to the attention of the GNSO Council. And the reason for this is crucial and I hope that you please forward this email to the GNSO Council to bring this to their attention.
Recital 111 to NIS 2.0 included the following text, “TLD name registries and entities providing domain name registration services should establish policies and procedures to collect and maintain accurate and complete domain name registration data, as well as to prevent and correct inaccurate registration data, in accordance with Union data protection law. Those policies and procedures should take into account, to the extent possible, the standards developed by the multi-stakeholder governance structures at international level.” (emphasis added).
Elena Plexida from ICANN Org, in briefing the Registrars and Registry about NIS 2.0, expressed frustration about what the term “to the extent possible" means. I think we have a front-row seat to how that language in NIS 2.0 will be interpreted. My personal hope is that we, as an IRT, can recognize some of the changes that have happened over the past 13 years and communicate this to the GNSO Council to get proper guidance. While that is my hope, I believe the more likely outcome is the contracting parties that constitute over half of the active membership in this IRT will block any changes that might lead to additional operating costs.
Now if the IRT, GNSO Council, and ICANN decide not to address some of the issues that Steve, Alan, myself and others have properly raised, whether on procedural or substantive grounds, I can live with that. I just want the record to reflect that fact. Because this decision can then be communicated to the Cooperation Group, so that if they are ever confronted with a situation to interpret Recital 111 in connection with this subject matter, they will have the proper information to make their determination.
Best regards,
Michael
From: Paul McGrady <paul@elstermcgrady.com> Sent: Thursday, October 17, 2024 3:05 PM To: PPSAI IRT members, including observers <gdd-gnso-ppsai-impl@icann.org> Cc: michael palage.com <michael@palage.com>; Owen Smigelski <owen.smigelski@namecheap.com> Subject: RE: [Gdd-gnso-ppsai-impl] Re: Factual Data for Our Consideration
And for a third point of view on this, it doesn’t matter for purposes of implementing the policy if P/P services are sometimes/often/never used by bad actors or are a good/bad idea. The existential question of whether or not P/P services should allowed is not in scope for the IRT. I hope that the IRT can get back on track and identify, with a basis beyond opinion or a desire to relitigate old issues lost during the PDP, anything that may need a fresh policy look due to changes in the technology, law, etc. since the policy was adopted.
Best, Paul
From: Owen Smigelski via Gdd-gnso-ppsai-impl <gdd-gnso-ppsai-impl@icann.org <mailto:gdd-gnso-ppsai-impl@icann.org>> Sent: Thursday, October 17, 2024 12:01 PM To: PPSAI IRT members, including observers <gdd-gnso-ppsai-impl@icann.org <mailto:gdd-gnso-ppsai-impl@icann.org>> Cc: michael palage.com <michael@palage.com <mailto:michael@palage.com>>; Owen Smigelski <owen.smigelski@namecheap.com <mailto:owen.smigelski@namecheap.com>> Subject: [Gdd-gnso-ppsai-impl] Re: Factual Data for Our Consideration
I would like to highlight that this is anecdotal observations and not factual data. This is a very small subset of the likely hundred+ million domain names that use privacy/proxy services for legitimate purposes, including palage.com <http://palage.com/>.
The article also repeatedly highlights how the FBI thanked private partners who worked with the FBI to address this issue:
“This seizure is part of a coordinated response with our private sector partners to dismantle the infrastructure that cyber espionage actors use to attack U.S. and international targets,” said U.S. Attorney Ismail J. Ramsey for the Northern District of California. “We thank all of our private-sector partners for their diligence in analyzing, publicizing, and combating the threat posed by these illicit state-coordinated actions in the Northern District of California, across the United States, and around the world.”
Again, I cannot comment on any involvement of Namecheap in this matter, but it appears that the FBI does not have any concerns with the use of privacy/proxy services for the seized domains. I am not sure what this intervention means to show. Are you implying that the bad actors only did the bad stuff because they were able to use a privacy or proxy service?
On Oct 17, 2024, at 09:46, michael palage.com via Gdd-gnso-ppsai-impl <gdd-gnso-ppsai-impl@icann.org <mailto:gdd-gnso-ppsai-impl@icann.org>> wrote:
CAUTION: This email originated from outside the organization. Do not click links unless you can confirm the sender and know the content is safe. Hello All,
Attached is the Public Whois information associated with the following domain names seized by the US Department of Justice, seehttps://www.justice.gov/opa/pr/justice-department-disrupts-russian-intellige...
You will see that most of these domain names appear to have been using a privacy/proxy service.
Best regards,
Michael
<Whois-Records.pdf>_______________________________________________ Gdd-gnso-ppsai-impl mailing list -- gdd-gnso-ppsai-impl@icann.org <mailto:gdd-gnso-ppsai-impl@icann.org> To unsubscribe send an email to gdd-gnso-ppsai-impl-leave@icann.org <mailto:gdd-gnso-ppsai-impl-leave@icann.org> _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.
This email originated from outside the firm. Please use caution. _______________________________________________ Gdd-gnso-ppsai-impl mailing list -- gdd-gnso-ppsai-impl@icann.org To unsubscribe send an email to gdd-gnso-ppsai-impl-leave@icann.org _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.
Owen, When I was re-reading my previous email, I realized that I should have said "sponsored by your employer" instead of "registered to your employer" as the Whois/RDDS records indicated. My apologizes for any confusion. However, I then thought about our IRT discussions about the inexact definition of privacy and proxy services. Could you shed any light on whether these domain names were registered to a NameCheap proxy service and then licensed to the beneficial user, or were these domains associated with a privacy service? I believe Dennis made reference to having privacy and proxy services present during our ICANN81 session. If I heard Dennis correctly, could ICANN Org please share any information on who these privacy/proxy servicers will be? Have a nice weekend. Best regards, Michael From: michael palage.com Sent: Thursday, October 17, 2024 6:31 PM To: Paul McGrady <paul@elstermcgrady.com>; PPSAI IRT members, including observers <gdd-gnso-ppsai-impl@icann.org>; Elena Plexida <elena.plexida@icann.org> Cc: Owen Smigelski <owen.smigelski@namecheap.com> Subject: RE: [Gdd-gnso-ppsai-impl] Re: Factual Data for Our Consideration Hello Owen and Paul, First, I want to address Owen's statement that my previous email included "anecdotal observations." When the US Department of Justice seized over 40 domain names involved in a Russian Intelligence spear-phishing effort and then issued a press release. I do not believe that DoJ seizes domain names on "anecdotal observations." After reading that press release, I decided to do "research" and query the public Whois/RDDS information with each domain to document that information. As indicated in that PDF document, most of those domains where registered to your employer, NameCheap, and indicated an address with a Privacy/Proxy service also associated with NameCheap. I believe we should be able to agree on these "facts." While Owen referred to the New York Times article as a hack, I actually would encourage all IRT members to read it, see https://www.nytimes.com/2024/10/09/business/iceland-online-disinformation-id... I respect that you cannot comment on an ongoing investigation or legal proceeding. However, I "assume" based on the press release that NameCheap cooperated with the DoJ/FBI. While that was the right thing to do, it was also a smart thing to do. Now, I do want to address you and other Registrars' statements about his being just a handful of names. I would appreciate if the Contracting Parties could provide a number on want percentage of 362 million domain name registered do they view as being involved with criminal or harmful activity is acceptable? So while, 40 domain names did not cross your threshold, how about 300,000 domain names? ICANN recently credited an ICANN-accredited Registrar over $57,000 in connection with over 300,000 names that were registered using fraudulent credit cards, see https://www.icann.org/en/system/files/correspondence/weinstein-to-palage-07o.... I know the Registries and Registrars are collectively working on this problem as it does not appear to be a one-off problem but a more systemic one. Perhaps one of the Registries or Registrars on the IRT could reach out and ask if these 300,000 names were registered using a privacy/proxy service. If we could confirm this "fact." Hopefully we could all agree that it would be something material regarding the concerns about the use of proxy/privacy services in connection with DNS Abuse. This is the final response to Owen's email. Thanks for the heads-up regarding PALAGE.COM. I do not recall opting for that setting. Roger, as a GoDaddy customer, perhaps you can shed some light on how that status changed. I do not recall knowingly making this change. I think this topic deserves further discussion if, as Volker stated on today's call, some registrars default all registrations to privacy/proxy. Owen you will be happy to know public Whois/RDDS in connection PALAGE.COM is now available just like it was before. Turning to Paul's intervention. I think we are in agreement that the focus of the IRT needs to be about implementation. But as myself, Alan, Steve and others have tried to articulate, there have been a lot of material changes since this original PDP began almost 13 years ago. This sub-group is trying to convey these factual changes and bring them to the attention of the GNSO Council. And the reason for this is crucial and I hope that you please forward this email to the GNSO Council to bring this to their attention. Recital 111 to NIS 2.0 included the following text, "TLD name registries and entities providing domain name registration services should establish policies and procedures to collect and maintain accurate and complete domain name registration data, as well as to prevent and correct inaccurate registration data, in accordance with Union data protection law. Those policies and procedures should take into account, to the extent possible, the standards developed by the multi-stakeholder governance structures at international level." (emphasis added). Elena Plexida from ICANN Org, in briefing the Registrars and Registry about NIS 2.0, expressed frustration about what the term "to the extent possible" means. I think we have a front-row seat to how that language in NIS 2.0 will be interpreted. My personal hope is that we, as an IRT, can recognize some of the changes that have happened over the past 13 years and communicate this to the GNSO Council to get proper guidance. While that is my hope, I believe the more likely outcome is the contracting parties that constitute over half of the active membership in this IRT will block any changes that might lead to additional operating costs. Now if the IRT, GNSO Council, and ICANN decide not to address some of the issues that Steve, Alan, myself and others have properly raised, whether on procedural or substantive grounds, I can live with that. I just want the record to reflect that fact. Because this decision can then be communicated to the Cooperation Group, so that if they are ever confronted with a situation to interpret Recital 111 in connection with this subject matter, they will have the proper information to make their determination. Best regards, Michael From: Paul McGrady <paul@elstermcgrady.com<mailto:paul@elstermcgrady.com>> Sent: Thursday, October 17, 2024 3:05 PM To: PPSAI IRT members, including observers <gdd-gnso-ppsai-impl@icann.org<mailto:gdd-gnso-ppsai-impl@icann.org>> Cc: michael palage.com <michael@palage.com<mailto:michael@palage.com>>; Owen Smigelski <owen.smigelski@namecheap.com<mailto:owen.smigelski@namecheap.com>> Subject: RE: [Gdd-gnso-ppsai-impl] Re: Factual Data for Our Consideration And for a third point of view on this, it doesn't matter for purposes of implementing the policy if P/P services are sometimes/often/never used by bad actors or are a good/bad idea. The existential question of whether or not P/P services should allowed is not in scope for the IRT. I hope that the IRT can get back on track and identify, with a basis beyond opinion or a desire to relitigate old issues lost during the PDP, anything that may need a fresh policy look due to changes in the technology, law, etc. since the policy was adopted. Best, Paul From: Owen Smigelski via Gdd-gnso-ppsai-impl <gdd-gnso-ppsai-impl@icann.org<mailto:gdd-gnso-ppsai-impl@icann.org>> Sent: Thursday, October 17, 2024 12:01 PM To: PPSAI IRT members, including observers <gdd-gnso-ppsai-impl@icann.org<mailto:gdd-gnso-ppsai-impl@icann.org>> Cc: michael palage.com <michael@palage.com<mailto:michael@palage.com>>; Owen Smigelski <owen.smigelski@namecheap.com<mailto:owen.smigelski@namecheap.com>> Subject: [Gdd-gnso-ppsai-impl] Re: Factual Data for Our Consideration I would like to highlight that this is anecdotal observations and not factual data. This is a very small subset of the likely hundred+ million domain names that use privacy/proxy services for legitimate purposes, including palage.com<http://palage.com/>. The article also repeatedly highlights how the FBI thanked private partners who worked with the FBI to address this issue: "This seizure is part of a coordinated response with our private sector partners to dismantle the infrastructure that cyber espionage actors use to attack U.S. and international targets," said U.S. Attorney Ismail J. Ramsey for the Northern District of California. "We thank all of our private-sector partners for their diligence in analyzing, publicizing, and combating the threat posed by these illicit state-coordinated actions in the Northern District of California, across the United States, and around the world." Again, I cannot comment on any involvement of Namecheap in this matter, but it appears that the FBI does not have any concerns with the use of privacy/proxy services for the seized domains. I am not sure what this intervention means to show. Are you implying that the bad actors only did the bad stuff because they were able to use a privacy or proxy service? On Oct 17, 2024, at 09:46, michael palage.com via Gdd-gnso-ppsai-impl <gdd-gnso-ppsai-impl@icann.org<mailto:gdd-gnso-ppsai-impl@icann.org>> wrote: CAUTION: This email originated from outside the organization. Do not click links unless you can confirm the sender and know the content is safe. Hello All, Attached is the Public Whois information associated with the following domain names seized by the US Department of Justice, seehttps://www.justice.gov/opa/pr/justice-department-disrupts-russian-intellige... You will see that most of these domain names appear to have been using a privacy/proxy service. Best regards, Michael <Whois-Records.pdf>_______________________________________________ Gdd-gnso-ppsai-impl mailing list -- gdd-gnso-ppsai-impl@icann.org<mailto:gdd-gnso-ppsai-impl@icann.org> To unsubscribe send an email to gdd-gnso-ppsai-impl-leave@icann.org<mailto:gdd-gnso-ppsai-impl-leave@icann.org> _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on. This email originated from outside the firm. Please use caution.
participants (7)
-
Carlton Samuels -
John McElwaine -
michael palage.com -
Owen Smigelski -
Paul McGrady -
Rubens Kuhl -
Volker Greimann