- GNSO-Accuracy-ST - lists.icann.org

Fwd: ICANN Compliance data re: whois related complaints
by Owen Smigelski April 21, 2022

April 21, 2022

Hi all, As requested on this morning’s call, I am sharing the data I collected regarding all whois related complaints reported by ICANN Contractual Compliance between 2012 to 2021. Please see the explanation below regarding my analysis and formatting. There were a total of 242 whois QR complaints (versus 198,688 whois inaccuracy complaints). The link is shareable and anyone can leave comments if there are any questions (and also happy to answer questions via email or a future meeting). Regards, Owen > Begin forwarded message: > > Hi Accuracy Scoping Team leadership, > > The CPH team has been considering additional metrics/data that could help guide the scoping team’s work. One relevant data point we considered is ICANN Compliance data regarding whois related complaints. Because of my experience creating and refining these metrics, I volunteered to compile them. We think that the results may benefit our work, and wanted to provide the data to you for review/consideration first. > > Here is a link to a Google Sheet of the data: > > https://docs.google.com/spreadsheets/d/1qj6mjk-uR6YQbum5k6Y5sH8Hk0JDJDHCdwC… > > The “Summary” tab includes all whois inaccuracy complaints filed by year from 2012 to December 2021 (the last month available). The “Raw Data” tab is all of the data from icann.org, including links to each report cited. I included all whois related complaints (such as whois unavailable and whois format) because sometimes those complaint types receive inaccuracy allegations). > > For the summary, I only totaled the whois inaccuracy complaints. I also did not include complaints that were closed before 1st notice in the summary, as those are closed as out of scope (not about actual inaccuracy, no evidence, domain suspended at time of submission, etc). Whois QR and Whois ARS tickets are not included in the annual totals as well. > > Although the numbers fluctuate between 2012 and 2017, the total volume begins to drop significantly at the beginning of 2018 (before the effective date of the GDPR). There is another significant drop in September 2020, which I think is the month that Compliance switched from Kayako to NSp. > > Although the CPH is not clear what conclusions may be drawn from this data, we think this is something that should be shared with the entire scoping team (and be incorporated into our report). Happy to answer any questions, or provide an editable version (I have a few formals in the sheet that I don’t want modified). > > Regards, > > Owen > (On behalf of the CPH scoping team) >

1 0

**Starting in 15 minutes | Meeting invitation | Registration Data Accuracy Scoping Team | Thursday, 21 April 2022 at 14:00 UTC
by Terri Agnew April 21, 2022

April 21, 2022

**Starting in 15 minutes Dear all, The Registration Data Accuracy Scoping Team meeting is scheduled on Thursday, 21 April 2022 at 14:00 UTC for 90 minutes. Please click the link below to join the webinar: https://icann.zoom.us/j/94504686990?pwd=MWc2eXZENk9yN0RqOUUzaGx2eGV0QT09<https://urldefense.com/v3/__https:/icann.zoom.us/j/94504686990?pwd=MWc2eXZE…> Passcode: Vc#0B7$pu8 For Audio only: Or One tap mobile : US: +13017158592,,94504686990#,,,,*4631547480# or +13126266799,,94504686990#,,,,*4631547480# Webinar ID: 945 0468 6990 Passcode: 4631547480 International numbers available: https://icann.zoom.us/u/akRu7JTFd <https://urldefense.com/v3/__https:/icann.zoom.us/u/akRu7JTFd__;!!PtGJab4!pY…> If this is your first time with Zoom, please take a look here: Welcome to Zoom <https://urldefense.com/v3/__https:/gnso.icann.org/sites/default/files/polic…> Members, participants, alternates and observers all have different access and participation directions, please read below! ALL: Before joining the call * Please send dial out requests to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only * Please be sure you have read the ICANN Expected Standards of Behavior<https://urldefense.com/v3/__https:/www.icann.org/resources/pages/expected-s…> * Visit the Wiki agenda page: https://community.icann.org/x/Pw51Cw * Check your time zone: https://tinyurl.com/staz76cv [tinyurl.com]<https://urldefense.com/v3/__https:/tinyurl.com/staz76cv__;!!PtGJab4!oQAYoyJ…> ONLY for Members and Alternates * Please join via the above Main Zoom Webinar link and staff will promote you to panelist. * Please select Everyone, when posting to the chat in order for everyone to see and to be captured afterwards. * Alternate replacement confirmations – In order to keep track of alternate replacements, use the google form <https://urldefense.com/v3/__https:/forms.gle/GZqMAi4kKDaVP5o66__;!!PtGJab4!…> to communicate who the alternate is replacing and for which period. This information will be publicly posted so that the Team is aware at any time who is active. Alternate Assignment –wiki page<https://community.icann.org/x/-wC7Cg>. Only for Observers: * Observers will have ability to view member chat and information shared in the zoom webinar room. * Observers will not be able to use chat or raise hands. Thank you. Kind regards, Terri

3 2

Registration Data Accuracy Scoping Team | Thursday, 21 April 2022
by Terri Agnew April 21, 2022

April 21, 2022

Dear all, All recordings for the Registration Data Accuracy Scoping Team held on Thursday, 21 April 2022 can be found on the agenda wiki page <https://community.icann.org/x/Pw51Cw> (attendance included) and the GNSO Master Calendar <https://urldefense.com/v3/__https:/gnso.icann.org/en/group-activities/calen…> . These include: * Attendance (please let me know if your name has been left off the attendance list) * Audio recording * Zoom chat archive * Zoom recording (including audio, visual, rough transcript) * Transcript For additional information, you may consult the mailing list archives <https://mm.icann.org/pipermail/gnso-accuracy-st/> and the main wiki page<https://community.icann.org/x/hQIuCg>. Thank you! Kind Regards, Terri

1 0

Meeting invitation | Registration Data Accuracy Scoping Team | Thursday, 28 April 2022 at 14:00 UTC
by Terri Agnew April 21, 2022

April 21, 2022

**Reminder, this meeting is for the entire team as the small team group has concluded. Dear all, The Registration Data Accuracy Scoping Team meeting is scheduled on Thursday, 28 April 2022 at 14:00 UTC for 90 minutes. Please click the link below to join the webinar: https://icann.zoom.us/j/94504686990?pwd=MWc2eXZENk9yN0RqOUUzaGx2eGV0QT09<https://urldefense.com/v3/__https:/icann.zoom.us/j/94504686990?pwd=MWc2eXZE…> Passcode: Vc#0B7$pu8 For Audio only: Or One tap mobile : US: +13017158592,,94504686990#,,,,*4631547480# or +13126266799,,94504686990#,,,,*4631547480# Webinar ID: 945 0468 6990 Passcode: 4631547480 International numbers available: https://icann.zoom.us/u/akRu7JTFd <https://urldefense.com/v3/__https:/icann.zoom.us/u/akRu7JTFd__;!!PtGJab4!pY…> If this is your first time with Zoom, please take a look here: Welcome to Zoom <https://urldefense.com/v3/__https:/gnso.icann.org/sites/default/files/polic…> Members, participants, alternates and observers all have different access and participation directions, please read below! ALL: Before joining the call * Please send dial out requests to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only * Please be sure you have read the ICANN Expected Standards of Behavior<https://urldefense.com/v3/__https:/www.icann.org/resources/pages/expected-s…> * Visit the Wiki agenda page: https://community.icann.org/x/Qw51Cw * Check your time zone: https://tinyurl.com/248yw48c ONLY for Members and Alternates * Please join via the above Main Zoom Webinar link and staff will promote you to panelist. * Please select Everyone, when posting to the chat in order for everyone to see and to be captured afterwards. * Alternate replacement confirmations – In order to keep track of alternate replacements, use the google form <https://urldefense.com/v3/__https:/forms.gle/GZqMAi4kKDaVP5o66__;!!PtGJab4!…> to communicate who the alternate is replacing and for which period. This information will be publicly posted so that the Team is aware at any time who is active. Alternate Assignment –wiki page<https://community.icann.org/x/-wC7Cg>. Only for Observers: * Observers will have ability to view member chat and information shared in the zoom webinar room. * Observers will not be able to use chat or raise hands. Thank you. Kind regards, Terri

1 0

**REMINDER** Meeting invitation | Registration Data Accuracy Scoping Team | Thursday, 21 April 2022 at 14:00 UTC
by Julie Bisland April 20, 2022

April 20, 2022

Dear all, The Registration Data Accuracy Scoping Team meeting is scheduled on Thursday, 21 April 2022 at 14:00 UTC for 90 minutes. Please click the link below to join the webinar: https://icann.zoom.us/j/94504686990?pwd=MWc2eXZENk9yN0RqOUUzaGx2eGV0QT09<https://urldefense.com/v3/__https:/icann.zoom.us/j/94504686990?pwd=MWc2eXZE…> Passcode: Vc#0B7$pu8 For Audio only: Or One tap mobile : US: +13017158592,,94504686990#,,,,*4631547480# or +13126266799,,94504686990#,,,,*4631547480# Webinar ID: 945 0468 6990 Passcode: 4631547480 International numbers available: https://icann.zoom.us/u/akRu7JTFd <https://urldefense.com/v3/__https:/icann.zoom.us/u/akRu7JTFd__;!!PtGJab4!pY…> If this is your first time with Zoom, please take a look here: Welcome to Zoom <https://urldefense.com/v3/__https:/gnso.icann.org/sites/default/files/polic…> Members, participants, alternates and observers all have different access and participation directions, please read below! ALL: Before joining the call * Please send dial out requests to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only * Please be sure you have read the ICANN Expected Standards of Behavior<https://urldefense.com/v3/__https:/www.icann.org/resources/pages/expected-s…> * Visit the Wiki agenda page: https://community.icann.org/x/Pw51Cw * Check your time zone: https://tinyurl.com/staz76cv [tinyurl.com]<https://urldefense.com/v3/__https:/tinyurl.com/staz76cv__;!!PtGJab4!oQAYoyJ…> ONLY for Members and Alternates * Please join via the above Main Zoom Webinar link and staff will promote you to panelist. * Please select Everyone, when posting to the chat in order for everyone to see and to be captured afterwards. * Alternate replacement confirmations – In order to keep track of alternate replacements, use the google form <https://urldefense.com/v3/__https:/forms.gle/GZqMAi4kKDaVP5o66__;!!PtGJab4!…> to communicate who the alternate is replacing and for which period. This information will be publicly posted so that the Team is aware at any time who is active. Alternate Assignment –wiki page<https://community.icann.org/x/-wC7Cg>. Only for Observers: * Observers will have ability to view member chat and information shared in the zoom webinar room. * Observers will not be able to use chat or raise hands. Thank you. Kind regards, Terri

1 0

For your review - proposed write up of assignments #1 and #2
by Marika Konings April 20, 2022

April 20, 2022

Dear All, As discussed previously, the staff support team has prepared a first draft of the write up documenting the group’s work to date on assignment #1 and #2. Note that there are a couple of placeholders, highlighted in yellow, that will need to be updated as further information becomes available and/or work progresses. In the meantime, please feel free to start your review: https://docs.google.com/document/d/13sP-2z7rusEYrDyntrgm-tcIavPMJndU/edit. Please use the comment function to provide any suggested edits and/or comments. Note that we will not discuss / review this document during this week’s meeting as the focus will be on working out the details of the different proposals. Best regards, Caitlin, Berry and Marika

1 0

Response/Comments on Proposal D from ICANN Org/Compliance Thursday's meeting to continue development of details of proposals with those interested
by Brian Gutterman April 19, 2022

April 19, 2022

Dear Accuracy Scoping Team colleagues, Per the group's request from a couple of weeks ago, please find below some comments/response from ICANN Org/Compliance to the Gap Analysis Proposal D re potential Registrar Audit(s). ICANN Org and Compliance colleagues would be happy to answer further questions the group might have after reviewing and discussing further. Best, Brian Comments from ICANN Org / ICANN Contractual Compliance: ICANN Contractual Compliance (Compliance) may proceed with registrar audit(s) that confirm compliance with Registration Data accuracy obligations within the Registrar Accreditation Agreement (RAA) and Whois Accuracy Program Specification of the RAA, including validation and verification processes, without review of nonpublic personal data in registration data. This is consistent with Compliance’s last full registrar audit. Compliance may consider taking additional steps to audit compliance with accuracy requirements, such as obtaining and reviewing records that contain personal data in registration data and specifically demonstrate verification and validation of redacted registration data. However, prior to taking any further steps in this area that would involve the processing of redacted registration data collected by registrars, ICANN org believes it should solicit guidance from the European data protection authorities prior to taking any further steps in this area, as discussed with the community at ICANN73. Once the criteria for the registrar audit is established, Compliance is typically able to initiate an audit within 2 months. Compliance would first need to establish the content of the audit itself, selection criteria, and process (e.g. single audit, batches, continuous, etc.). If registration data must be obtained through sources other than public Registration Data Director Services (RDDS), for e.g. the contracted party, data escrow provider(s), etc. this may impact the timing of initiating or completing an audit. From: GNSO-Accuracy-ST <gnso-accuracy-st-bounces(a)icann.org> on behalf of Marika Konings <marika.konings(a)icann.org> Date: Tuesday, April 19, 2022 at 12:20 AM To: "gnso-accuracy-st(a)icann.org" <gnso-accuracy-st(a)icann.org> Subject: [GNSO-Accuracy-ST] Thursday's meeting to continue development of details of proposals with those interested Dear All, Similar to last week’s meeting, coming Thursday’s meeting will be dedicated to working on the details of the different proposals as outlined here (https://docs.google.com/document/d/1sScP8MwgDCg4yvFNAYwQVql7DQob60vX/edit?p… [docs.google.com]<https://urldefense.com/v3/__https:/docs.google.com/document/d/1sScP8MwgDCg4…>). Special thanks to Sarah for providing initial responses that the group reviewed and discussed during last week’s meeting. The staff support team has accepted these responses and added in suggestion mode some additional points and questions that were raised during last week’s discussion (see page 12 & 13). If there is anything we missed, or any further input you would like to see considered, please add this to the document in advance of Thursday’s meeting. For Thursday’s meeting, we’ll start off with proposal E and then circle back to proposal A, and possibly D if a response is received from ICANN org in relation to the questions that the group posed concerning a possible Registrar Audit. Best regards, Caitlin, Berry and Marika

1 0

Potential Question for GAP Analysis Consideration for the Group
by Michael Palage April 19, 2022

April 19, 2022

Hello All, I was reviewing some recent RSEP filings and I came across the following RSEP which I believe may be relevant to our work from a couple of perspectives. For those that may not be well verse in ICANN acronym parlance, RSEP stands for Registry Service Evaluation Process and is the mechanism by which Registries can roll-out/amend new registry services. A list of all RSEP filings are available here, https://www.icann.org/resources/pages/rsep-2014-02-19-en In connection with RSEP 2022004, there is a communication from Verisign “in response to ICANN’s January 28, 2022 request that Verisign submit non-confidential documentation regarding Verisign’s plans to comply with new local law compliance directives from MIIT associated with the Measures for the Administration of Domains Names.” See https://www.icann.org/en/system/files/files/rsep-2022004-verisign-et-al-req… There were a couple of things that jumped out at me after reading this communication. First, I found it out that ICANN was requesting information from Verisign about its “plans to comply with new local law compliance.” In the past I have cited to Section 3.7.2 of the 2013 RAA that states “Registrar shall abide by applicable laws and governmental regulations” and ICANN’s Articles of Incorporation that cite to “lessening the burdens of government.” Now when I have raised these points in the past, the consensus within the group seemed to be that ICANN was not responsible for enforcing national law. This view also seems to be consistent ICANN’s recent response to the European Union regarding counterfeiting where it stated “ICANN org does not enforce laws; this is a task for governments.” See https://itp.cdn.icann.org/en/files/government-engagement-ge/icann-evidence-… Therefore, I found it odd that ICANN would be writing to Verisign about its compliance with national law. The second question that popped into my head, did ICANN send out similar communication to all registry operators, or only those listed gTLD Registry Operators as approved by MIIT (see http://xn--eqrt2g.xn--vuq861b/#) or only those Registries that had previously sought RSEP related to Registration Validation? I guess this is question the group may want to ask Brian, alternatively I could individually file an DIDP request with ICANN, but they usually take 30 days and are generally lacking in the breath of their response. While the RySG representatives have repeatedly pushed back against specific registries being called out in our work, I just do not see how we can overlook something which on its face appears to be directly within our wheelhouse. Third question, could ICANN Org provide this group a copy of the Measures for the Administration of Domains Names cites in its letter to Verisign. Given that ICANN has probably obtained a translation of this new law, it would be helpful if ICANN could provide both the Chinese as well as English versions. Best regards, Michael

2 1

Thursday's meeting to continue development of details of proposals with those interested
by Marika Konings April 19, 2022

April 19, 2022

Dear All, Similar to last week’s meeting, coming Thursday’s meeting will be dedicated to working on the details of the different proposals as outlined here (https://docs.google.com/document/d/1sScP8MwgDCg4yvFNAYwQVql7DQob60vX/edit?p…) Special thanks to Sarah for providing initial responses that the group reviewed and discussed during last week’s meeting. The staff support team has accepted these responses and added in suggestion mode some additional points and questions that were raised during last week’s discussion (see page 12 & 13). If there is anything we missed, or any further input you would like to see considered, please add this to the document in advance of Thursday’s meeting. For Thursday’s meeting, we’ll start off with proposal E and then circle back to proposal A, and possibly D if a response is received from ICANN org in relation to the questions that the group posed concerning a possible Registrar Audit. Best regards, Caitlin, Berry and Marika

1 0

Notes and action items: RDA Small Team Meeting - 14 April 2022
by Caitlin Tubergen April 14, 2022

April 14, 2022

Dear RDA Scoping Team Members, Please find below the notes and action items from today’s Small Team Meeting, where the Small Team discussed Proposal A (registrar survey) in more depth. Best regards, Marika, Berry, and Caitlin -- Action Items<https://community.icann.org/pages/viewpage.action?pageId=176622913> 1. Michael P. to provide a written update to the list, informing the Scoping Team of the latest update from ICANN org re: specific accuracy scenarios. 2. Small Team to review the proposed answers from Sarah W. and provide additional feedback and suggestions re: the answers to the questions and proposed questions for the survey (Proposal A). (https://docs.google.com/document/d/1sScP8MwgDCg4yvFNAYwQVql7DQob60vX/edit?p…) 3. Small Team to review the questions and proposed answers for Proposal E and provide additional feedback by Wednesday, 20 April - to be discussed during the Small Team's next meeting on Thursday, 21 April. (https://docs.google.com/document/d/1sScP8MwgDCg4yvFNAYwQVql7DQob60vX/edit?p…) RDA Scoping Team Meeting – Small Team Gap Analysis Proposals Meeting 14 April 2021 Discussion of Gap Analysis Proposals A & E * RrSG reps have provided homework on proposals A and E * Support Staff tried to identify specific questions to help guide the discussion – if anything is missing, please feel welcome to raise it during the call or add it to the Google doc Proposal A (Survey to Registrars) * Insight into which aspects would assist the Scoping Team in addressing its assignments, recognizing that information provided through a survey may only provide a partial picture? * Rates of verified vs. unverified domains will help show a snapshot of the current amount of domains in each group. It is important to remember that because registration and verification of domains happens constantly the rates will change. * Some Contracted Parties track validation/verification status in relation to a contact set, rather than a specific domain name. This is in alignment with the ICANN Whois Accuracy Program Specification (§3, Registrar is not required to perform the above validation and verification procedures in Section 1(a) through 1(f) above, if Registrar has already successfully completed the validation and verification procedures on the identical contact information and is not in possession of facts or knowledge of circumstances that suggest that the information is no longer valid.). This may affect the ability to report on rates of validated/verified domain names. * A contact is verified, not a domain name. A contact can be shared b/w multiple domain names or multiple accounts. Important to word this correctly. * The validation presumably counts for as many accounts as it was used to satisfy the accuracy spec – the intent of this question is to have 200MM domains, and 150MM are verified and 50MM are not. There are other questions associated with this. Have never had my contact info verified using the methodology used in the spec – there may be other questions or were other methods used to provide this verification prior to 2013. * One interesting point: the role the reseller plays in the ecosystem. What could be helpful: is this verification done by the registrar, or is this outsourced to the reseller? This could be something that could be helpful, particularly for registrars operating under the reseller model. * With respect to names registered prior to 2013 – the wording was intentional regarding legacy domain names. As long as none of the identified triggers are implicated for legacy domain names, the 2013 verification process would not have been triggered. With respect to the question regarding resellers, the answer is likely: it depends. The registrar is ultimately on the hook, but the verification could be done differently – some registrars may do it; some resellers may do it, depending on the business model. * As far as the data that is the same, is it the account holder’s data or the registrant data? In other words, if the next domain name uses the same data – is this what does not require further verification? * The registrant would not need to be re-validated. * With respect to who does the verification, that will vary depending on the registrar. * Think about specific questions to ask registrars – for example, would it help the scoping team to know the reseller’s role in verification? * Puzzled as to why reseller question is being asked. * It would be nice to know who is participating – registrars, resellers, etc. * How broadly would the survey be circulated? If there is an expectation for it to go beyond registrars, the group should discuss how this could be achieved. * The RAA is explicit that registrars are on the hook for the contractual requirements it outsources to a third party like resellers * Suggest looking at specific questions that could be helpful to ask: * The following questions look at how many domains have registration data which is validated and verified: * Do you proactively track rates of completed validation for domains registered with you? * Do you proactively track rates of completed verification for domains registered with you? * If no, is it possible to gather those rates? * If yes to a/b/c, what percentage of domains registered with you have validated registration data? * If yes to a/b/c, what percentage of domains registered with you have verified registration data? * What percentage of domains registered with you were created prior to the validation and verification requirements came into effect and have not yet been updated in a way that triggers the validation and verification requirements? * The following questions look at how many domains have data which is currently in the verification process: * Do you proactively track rates of in-progress validation for domains registered with you? * Do you proactively track rates of in-progress verification for domains registered with you? * If no, is it possible to gather those rates? * If yes to a/b/c, what percentage of domains registered with you are in the validation process now? * If yes to a/b/c, what percentage of domains registered with you are in the verification process now? * * The following questions look at how many domains are suspended due to incomplete verification: * Do you proactively track rates of suspension due to incomplete verification? * If no, is it possible to gather those rates? * If yes to a/b, what percentage of domains registered with you are suspended due to incomplete verification? * The following questions look at the rate of email bounces for Whois Data Reminder Policy Notices sent out over a set time period. * Do you proactively track the rate of bouncebacks to WDRP emails? * If no, is it possible to gather those rates? * If yes to a/b, what percentage of domains registered with you * What information is needed from the Registrar for identification purposes? * What information would be publicly shared? * Who has access to the individual responses? * Required for identification: * IANA ID * Person filling out the survey - name and contact email * * Publicly shared: * Number of Registrars which responded * Aggregated and anonymized response information * * Access to individual responses: * TBD (need to discuss with the full Scoping Team). Restriction of access to the individual responses will help promote honesty of response. * Could include a survey question allowing the responding registrar to opt in to having their response associated with their IANA ID (otherwise it would only be used in anonymized or aggregated form) * It is also important to determine the retention period of the personal data contained within the responses and include that information in the initial survey. The data should be retained for as long as is necessary to evaluate responses and then deleted (anonymized/aggregated data may be retained). * These questions are a great first start – group may need to edit further, and we should allow time for feedback. * It would be nice to see individual responses. If that is not possible, it would be important to understand the responses. Doing it an aggregated way loses important granularity. For example, what size is the registrar that is responding? * Who should be responsible for circulating the survey to Registrars? RrSG, ICANN org? * ICANN Org should circulate the survey to all Registrars (not only those which are members of the RrSG). * The RrSG will help with communicating to its membership. * How much time should be provided to respond to the survey? * Start with one month and increase if necessary * What languages should be offered? * UN6 * Translation be facilitated by ICANN org, but would add time * What incentives could be provided to encourage Registrars to participate in the survey? * Compliance safe harbor * Publish names of those registrars would participated * Publishing could also be a disincentive for participation * ICANN to offer stay from the upcoming audit * Is there a need for a compliance amnesty if survey responses indicate non-compliance? * Yes, to encourage response * Org would need to check with legal colleagues on this

1 0