HI Steve, Steve said: Returning to the registration process, what procedures are in place to inform the registrant they are in charge of and responsible for the registration, and what response, if any, is required from the registrant? If an affirmative response is required, I would say the level of validation is more than merely operational. That said, I would also agree this level of validation is somewhat less than full identity validation. Sarah says: Yes–the process that you are asking about, something to inform the registrant that their data is used on the domain and require an affirmative response, is the Whois verification process described in the Whois Accuracy Program Specification 1 (f) (i) or (ii). This is what we are referring to as operational validation, and the contractual obligation is to ensure either the email or phone number are operational. I think we should leave out any consideration of Admin contact, as that is definitely being deprecated by the EPDP Phase 1 work currently in IRT, and although I may agree regarding the obligation of a person with responsibility, I don’t think that’s relevant to this accuracy scoping work. Thanks, -- Sarah Wyld, CIPP/E Policy & Privacy Manager Pronouns: she/they swyld@tucows.com +1.416 535 0123 Ext. 1392 From: Steve Crocker Sent: October 22, 2021 8:38 AM To: gnso-accuracy-st@icann.org Subject: Re: [GNSO-Accuracy-ST] Identity Proofing Clarity - Follow UpHomework Others on this list more familiar than I am with the fine grain details of both the contracts and the operational aspects of the registration process may be able to comment on my perspective of the registration process. Registration is initiated by the account holder. The account holder is also sometimes referred to as the customer. This is the person who has an account with the registrar and thus has the capability of initiating a registration process. During the registration process the account holder provides the name and other contact details of the registrant. At that point, the registrant acquires the rights and responsibilities associated with the registration, although the account holder continues to be the person who has operational control of the registration. This distinction becomes important when there is a dispute about control of the registration. The account holder has the capability of making changes within a few seconds. If the registrant does not have electronic access to the account, they can appeal to the registrar. This process will generally take some number of days, but, I am told, the registrant will generally prevail. I would imagine that during such a dispute process, the registrant may have to provide evidence they are, in fact, the registrant. Returning to the registration process, what procedures are in place to inform the registrant they are in charge of and responsible for the registration, and what response, if any, is required from the registrant? If an affirmative response is required, I would say the level of validation is more than merely operational. That said, I would also agree this level of validation is somewhat less than full identity validation. By "merely operational" I mean that email or phone numbers are checked to see if mail is delivered or the phone is answered. Similarly, a street address is "merely operational" if it's an actual street address and presumably capable of receiving snail mail. The inclusion of affirmative feedback significantly changes the situation, in my view. Moving to a slightly different but closely related aspect of the registration process, the roles of Admin contact, Tech contact and perhaps other roles deserve a brief mention. I know our general direction is toward deprecating or eliminating these roles. That's fine with me, but I am under the impression some registrars continue to assign specific responsibility and authority to these roles. For example, I believe some registrars give Admin contact the authority to approve transfer of the registration. In my view, whenever a person is assigned a role that includes any degree of responsibility or authority, it's essential the person knows and has agreed. To be fully clear, by "responsibility" I mean an obligation to respond or act in certain circumstances, and by "authority" I mean the authorization to take certain actions. Going a step further, it's not only essential for a person assigned to a role to know their responsibility and authority, it's also essential for anyone who contacts that person to know what that person is obligated and capable to do. Thanks, Steve
