November 2019 - Gnso-epdp-team

an EPDP Thanksgiving?
by Anderson, Marc Nov. 20, 2019

Nov. 20, 2019

Janis, I note that there is currently an EPDP meeting scheduled for November 28th. This is a major public holiday in the US. Looking at the member list this impacts over half the team. In some cases, entire constituencies would need to choose between missing the call or impacting their holidays. Considering we also have a call scheduled for the 26th of that same week, I'm requesting to cancel the call on the 28th. Best, Marc

10 10

Notes and action items - EPDP Meeting #29 - 14 November 2019
by Caitlin Tubergen Nov. 19, 2019

Nov. 19, 2019

Dear EPDP Team, Apologies for the delay, but please find below the notes and action items from EPDP Meeting #29. The next EPDP Team meeting will be Thursday, 21 November at 1400 UTC. Best regards, Marika, Berry, and Caitlin -- EPDP Phase 2 - Meeting #29 Thursday, 14 November 2019 at 14.00 UTC Action Items Support Staff to apply the agreed-upon edits (including deletions, where applicable) to the Logging, Auditing, and Response Requirements Building Blocks by Friday, 15 November. EPDP Team to review updated Logging and Auditing Building Blocks by Thursday, 21 November. Agenda 1. 1. Roll Call & SOI Updates (5 minutes) 2. 2. Confirmation of agenda (Chair) 3. 3. Welcome and housekeeping issues (Chair) (5 minutes) a) Takeaways from ICANN66 · Team will continue working at its current pace until early December and assess at that time whether it is ready to publish the Initial Report, or instead, if it will publish after the F2F meeting in January. b) Timing of calls going forward · EPDP Plenary calls will remain at the same UTC time, 14:00 UTC · EPDP Legal Committee calls will be pushed ahead one hour to 15:00 UTC c) Status of building blocks · Support Staff has changed the due dates for review of the building blocks. · Support Staff has added the updated language on the balancing test framework · For some building blocks, the language has been finalized but will need to be revisited once the Team determines which entity will be making the disclosure decision · Reminder: please only provide comments to the building blocks; editing directly makes it very difficult for the Team to review d) Reminder: Confirm with Terri travel funding requirements for ICANN67 · With respect to the January EPDP F2F meeting, please book travel as soon as possible. · For travel to ICANN67, the deadline for travel support request has passed; however, if you missed the deadline, please write to gnso-secs(a)icann.org as soon as possible. 4. 4. Logging [docs.google.com] (building block new) – second reading continued (30 minutes) a) Review comments & input provided · Small Team had an initial conversation about the logging building block in Montreal, which ran in parallel to the Legal Committee meeting · The edits made by Marika from 4 November were made as a result of the small team meeting. The other edits were made by various members of the EPDP Team. As noted previously, going forward, please only provide edits in comment form. · With respect to the logging, the Team aimed to assess the key activities of the SSAD system that needed to be logged: logging related to the identity provider, logging related to the entity receiving the request, and logging related to the entity authorizing the request. b) Feedback from EPDP Team · Chapeau · No comments · Subpoint a · Logging should only happen in one place, so queries should be removed from the third item · The reason these are currently separated is because it’s unclear if the entity receiving the query will also make the disclosure decision. Once it becomes clear which entity will do what, these can be merged. · Subpoint b · Will this principle be worked out in implementation? This looks like the start of a data retention specification. There are also data protection implications of this data. · How long should the logs be retained? The small team did not have time to discuss this - possibly because this conversation may need to happen after review of the auditing building block · If the period for retention will be three years, the Team needs to provide a rationale as to why it’s three years. · The reason for three years is so that the logs are retained longer than contracted parties have to retain the data. · The logs shall be retained for a period of time sufficient to cover the time until claims by data subjects are barred by statute according to the national law applicable for the entity keeping having disclosed the data.  · The Team should assume that no personal information stored in these logs. If the Team is able to do that, that will remove concerns about retention. · Suggest changing "machine-readable format" to "in a commonly used, structured, machine-readable format accompanied by an intelligible description of all variables"  · Team agrees to take the suggestion from Thomas re: proposed data retention language (until claims by data subjects are barred by…) and suggestion from Ayden to expand on machine-readable format as noted above · Subpoint D · If the liability is still retained by the CPs, the Team needs to keep in mind that the logs could also be released to the CPs. This could be included in a footnote. · Support Staff to include a footnote re: release of logs to CPs · Perhaps include an (s) after the controller(s) · Strike DPAs in (ii) with the understanding they would fall under due legal process under (iii) · One point not captured here is the use of the logs by the technical operator of the system - technical operators may need to review logs for the technical operation of the system · Propose changing “data protection authorities” to “relevant supervisory authorities” · “due legal process, including relevant supervisory authorities, as applicable” · Request to retain original language for (i) · Subpoint E · I.e., when “they” log in - that is when the accredited user logs into the system/gateway, not when they log into the identity provider · This parenthetical should be moved down to “authorizing the request” · This deals with Alex’s process flow - the individual/entity would be validated by the identity provider itself · This bullet will need to be revisited when more details of the system are decided to allow flexibility in implementation · Action: Support Staff to revisit the fourth bullet point with Alex and see if it needs to be split into two c) Confirm next steps · Team to revisit this building block once other building blocks are finished and further decisions are made to ensure consistency. · This will now be changed to green. 5. 5. Auditing [docs.google.com] Requirements (building block new) – second reading (30 minutes) a) Review building block · Similar to the logging building block, the green text added on 4 November was added as a result of the small team meeting at ICANN66 b) Feedback from EPDP Team · Auditing of the Accrediting Authority · There are some terminology differences - in logging, there is an identity provider and in audits, there is an accreditation authority. · No, these are separate entities. · Need more information on audits - if there any implementation guidance the Team could provide, that would be helpful. · If ICANN is the accreditation authority, who above ICANN will sanction ICANN, and what mechanism is that? If it is the ICANN community, what is the mechanism for that? · An external auditor for ICANN could be a very expensive endeavor · May need to include something in the policy about access to the data that would be used to determine whether ICANN is doing an acceptable or unacceptable job. An audit of ICANN could be triggered under very specific circumstances, rather than including a periodic and potentially expensive audit. This conversation should be revisited when more decisions are made by this team. · Support Staff to reword language with the assumption that ICANN org is the accreditation authority and ICANN org can choose to outsource this function · It makes sense to assume for now that the assumptions in the Strawberry paper are correct, and that ICANN will retain responsibility for the central gateway · Audits of Identity Providers · The audit of the identity provider should be done by ICANN · It’s difficult to envision how this would work without knowing who the identity providers are · Disagree with removing “independent” from auditors - this should be done independently · The essential part here is that there needs to be some action taken periodically to ensure things are being done properly · Audits of Accredited Entities/Individuals · This is missing some details - for example - do all accredited entities need to be audited? How often is “periodically”? · Do not understand how you can audit an individual request - does this involve going into someone’s home to ensure they have disposed of data properly? · How does one prove a negative? No, I did not misuse the data. Perhaps there could be an ongoing representation, similar to what contracted parties have to do every year · This would work similarly to how CPs are audited today - ICANN would ask the accredited entity or individual a series of questions, and they would have to respond and show proof. If a complainant claims misuse of data, it should have to show evidence of this in its complaint. · This should be based on an audit set or a complaint set. · It is likely very few people would make a complaint, and that would be looked badly on by DPAs. · CPs are audited every 3-4 years, so perhaps timing like that could be considered. · The logging and auditing building blocks should be compared and all relevant actors should appear in each building block · Bracketed text can be entered here for now, but once the model is more solidified, this can be revisited · The auditing of logs text is duplicative and can be deleted c) Confirm next steps · Support Staff to apply the agreed-upon edits (including deletions, where applicable) and EPDP Team to review 6. 6. Response requirements [docs.google.com] (building block g) – second reading a) Review building block b) Feedback from EPDP Team · Most of the text was updated by the deadline given · Attempted to clarify the difference b/w checking that a request is syntactically correct and complete. In the case where the request is not syntactically correct, an error response would be returned noting which areas were not completed. When the request is found to be incomplete, an incomplete request response must be returned. · Might it make sense to separate out policy recommendations with implementation advice? · It may be helpful to have a diagram/flow chart to explain the different tracks c) Confirm next steps 7. 7. Wrap and confirm next EPDP Team meeting (5 minutes): a) Thursday 21 November at 14.00 UTC b) Confirm action items c) Confirm questions for ICANN Org, if any

1 0

Questions for ICANN Org from EPDP Team Chair
by Marika Konings Nov. 19, 2019

Nov. 19, 2019

Dear ICANN org liaisons, On behalf of Janis Karklins, in his capacity as EPDP Team Chair, please find hereby a number of questions for ICANN org he would appreciate a response to as soon as possible: Does ICANN have a clear preference on whether or not it will: 1. Field these requests for non-public data 2. Maintain its own RDS replica database 3. Make a/the determination of the validity of the request 4. Assume responsibility for this decision, in any scenario where ICANN doesn’t hold the data directly and must require a Contracted Party to respond to the Requestor (even if the Contracted Party disputes ICANN’s determination) 5. Consider an approach whereby ICANN acts as a more or less “gateway” for authorized data to pass through, data provided by the Contracted Party at the request of ICANN (per contractual requirement), with the responsibility for such disclosure to be assumed by ICANN. Best regards, Caitlin, Berry and Marika Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

2 1

Financial Sustainability Questions for ICANN Org
by Anderson, Marc Nov. 18, 2019

Nov. 18, 2019

EPDP team, Coming out of our Montreal sessions, James and I had the action item to take a look at the Financial sustainability building block: https://docs.google.com/document/d/1Ci-wvA1P9yoKjJ5DPeRbZ5FOHL2D8ExGsN2SV9T… and propose a letter to ICANN requesting their help. Attached is a first draft of a proposed letter to ICANN Org on the Financial Sustainability building block. I want to note that at the same time Eleeza has made comments to the Building block document asking additional questions and offering ICANN's help similar to what we are asking for in this letter. Thanks also go to Sarah and Alan W who provided help on an editing pass. Thank you, Marc and James

1 0

IGF-Berlin
by policy＠bacinblack.com Nov. 18, 2019

Nov. 18, 2019

Hi All, The EPDP Leadership team would like to understand how many of this team will be in Berlin for IGF 2019. As you are aware, we have two call schedule next week on the 26th and 28th. Can you reply back to ME ONLY if you plan to attend? Please, do not reply all. Rationale: 1. Attempting to find a location where the team can huddle for call(s) 2. Tuesday evening reception invitation Thank you. B Berry Cobb @berrycobb GNSO Policy Consultant

1 0

Updated building blocks for review
by Marika Konings Nov. 14, 2019

Nov. 14, 2019

Dear EPDP Team, Following today’s meeting, the staff support team has gone ahead and made the updates discussed in relation to the logging, auditing and response requirements building blocks. Please note: For the logging building block<https://docs.google.com/document/d/130z5SNuYgGhlH9hnAHJcjuZ_9F5zP7uJ4P4g_Xc…>: * As noted by Janis, this building block is considered complete for now, but please flag if any of the updates do not align with today’s discussion as soon as possible. For the auditing building block<https://docs.google.com/document/d/1MsvOfYu7tV97tGzQNjh52hZNxSsCw5ps4-dLvfR…>: * The staff support team has suggested a number of edits to address the comments raised during today’s meeting. Please review and flag by Friday 22 November if there are any remaining issues that should be further discussed. We have noted a placeholder for the section that is to be further reviewed once the EPDP Team has decided on the roles and responsibilities of the different parties in SSAD. For the response requirements building block<https://docs.google.com/document/d/1KqfkWfbC6gBIrmE3OTTw7MYpThciaMc03Lu6M9s…>: * As discussed, we have gone ahead and created a separate implementation guidance section where we have moved some of the details that appeared to be more implementation focused. We have also tried to address some of the other comments and suggestions – if there are any concerns about those edits, please note this in the google doc. Based on the remaining comments, the main open items appear to be: * Response time – the following language has been suggested: “SSAD requests that meet the automatic response criteria must receive an automatic disclosure response. For requests that do not meet the automatic response criteria, a disclosure response must be returned within 1 day for urgent requests and 7 days for all other requests.” * Definition and timeline for urgent SSAD requests – the following language is currently included: “A separate timeline of [less than X business days] will be considered for the response to ‘Urgent’ SSAD Requests, those Requests for which evidence is supplied to show an immediate need for disclosure. The criteria to determine whether it concerns an urgent request are limited to circumstances that pose an imminent threat to life, serious bodily injury, critical infrastructure or child exploitation. * How to deal with complaints – the following updated language has been proposed: “If a requestor is of the view that the response from the entity disclosing the data is not consistent with these policy recommendations, a complaint should be filed with ICANN Compliance. If a requestor is of the view that the response from the entity disclosing the data is not consistent with applicable data protection legislation, the requestor should contact the relevant data protection authority”. * Please provide your input on these and any other issues, by Tuesday 19 November 2019. Also, as a reminder, input on the following building blocks is also due by Tuesday 19 November 2019: * Terms of use<https://docs.google.com/document/d/1eZBzRclRtEXPp1EScDfftnfnv9tneD7ovxmGe84…> * Automation<https://docs.google.com/document/d/1KCzlakWVkt6GN5ZPl0my45WdR34JPes_bZwmJkY…> * Financial Stability<https://docs.google.com/document/d/1Ci-wvA1P9yoKjJ5DPeRbZ5FOHL2D8ExGsN2SV9T…> Best regards, Caitlin, Berry and Marika Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

1 0

Post Call | GNSO Temp Spec gTLD RD EPDP – Phase 2 | Thursday, 14 November 2019 at 14:00 UTC
by Terri Agnew Nov. 14, 2019

Nov. 14, 2019

Dear all, All recordings for the GNSO Temp Spec gTLD RD EPDP – Phase 2 held on Tuesday, 14 November 2019 at 14:00 UTC can be found on the agenda wiki page <https://community.icann.org/x/DoEzBw> (attendance included) and the GNSO Master calendar <https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_en_group…> . These include: * Attendance (please let me know if your name has been left off the attendance list) * Audio recording * Zoom chat archive * Zoom recording (including audio, visual, rough transcript) * Transcript As a reminder only members and alternates can join the call, observers can join via audio cast, listen to the recordings and read the transcript afterwards. For additional information, you may consult the mailing list archives <https://mm.icann.org/pipermail/gnso-epdp-team/> and the main wiki page<https://community.icann.org/x/IYEpBQ>. Thank you. With kind regards, Terri

1 0

Meeting Invitation / Observers / GNSO Temp Spec gTLD RD EPDP-P2 call / Thursday, 21 November 2019
by Terri Agnew Nov. 14, 2019

Nov. 14, 2019

As a result of various requests to facilitate observers to follow the EPDP Phase 2 deliberations in real time, audio cast will be made available for the EPDP plenary meetings. Staff will be monitoring audio cast attendance numbers so that the EPDP leadership can assess its usage. As a reminder, the zoom recording, mp3 recording, chat transcript and transcript of the EPDP plenary meetings will be publicly posted as soon as available on the EPDP wiki page and GNSO master calendar. Dear all, The next meeting of the GNSO Temp Spec gTLD RD EPDP – Phase 2 is scheduled on Thursday, 21 November 2019 at 14:00 UTC for 120 minutes. (calls will be scheduled for 120 minutes but aim to keep to 90 minutes) For other times: https://tinyurl.com/y6yyjj6h Agenda Wiki: https://community.icann.org/x/QYEzBw The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: https://gnso.icann.org/en/group-activities/calendar<https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_grou…> Meeting Audio Cast (for observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream01 Listen in application such as iTunes: http://stream.icann.org:8000/stream01.m3u<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Kind Regards, Terri If needed, an option to join via telephone has been added for this meeting. **New join information - Conference Bridge: Toll-free access number (US and Canada): 800 550 6865 and Toll 213 233 3193 Other telephone numbers found here: http://www.adigo.com/icann [adigo.com]<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.adigo.com_icann&d=D…> Enter passcode on telephone: 7349

1 0

**Starting in 7 minutes / Meeting Invitation / Observers / GNSO Temp Spec gTLD RD EPDP-P2 call / Thursday, 14 November 2019
by Terri Agnew Nov. 14, 2019

Nov. 14, 2019

**Starting in 7 minutes As a result of various requests to facilitate observers to follow the EPDP Phase 2 deliberations in real time, audio cast will be made available for the EPDP plenary meetings. Staff will be monitoring audio cast attendance numbers so that the EPDP leadership can assess its usage. As a reminder, the zoom recording, mp3 recording, chat transcript and transcript of the EPDP plenary meetings will be publicly posted as soon as available on the EPDP wiki page and GNSO master calendar. Dear all, The next meeting of the GNSO Temp Spec gTLD RD EPDP – Phase 2 is scheduled on Thursday, 14 November 2019 at 14:00 UTC for 120 minutes. (calls will be scheduled for 120 minutes but aim to keep to 90 minutes) For other times: https://tinyurl.com/y3x7rdor [tinyurl.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__tinyurl.com_y3x7rdor&d…> Agenda Wiki: https://community.icann.org/x/DoEzBw The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: https://gnso.icann.org/en/group-activities/calendar<https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_grou…> Meeting Audio Cast (for observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream01 [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Listen in application such as iTunes: http://stream.icann.org:8000/stream01.m3u<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Kind Regards, Terri If needed, an option to join via telephone has been added for this meeting. **New join information - Conference Bridge: Toll-free access number (US and Canada): 800 550 6865 and Toll 213 233 3193 Other telephone numbers found here: http://www.adigo.com/icann [adigo.com]<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.adigo.com_icann&d=D…> Enter passcode on telephone: 7349

1 0

**Reminder** Meeting Invitation / Observers / GNSO Temp Spec gTLD RD EPDP-P2 call / Thursday, 14 November 2019
by Julie Bisland Nov. 14, 2019

Nov. 14, 2019

As a result of various requests to facilitate observers to follow the EPDP Phase 2 deliberations in real time, audio cast will be made available for the EPDP plenary meetings. Staff will be monitoring audio cast attendance numbers so that the EPDP leadership can assess its usage. As a reminder, the zoom recording, mp3 recording, chat transcript and transcript of the EPDP plenary meetings will be publicly posted as soon as available on the EPDP wiki page and GNSO master calendar. Dear all, The next meeting of the GNSO Temp Spec gTLD RD EPDP – Phase 2 is scheduled on Thursday, 14 November 2019 at 14:00 UTC for 120 minutes. (calls will be scheduled for 120 minutes but aim to keep to 90 minutes) For other times: https://tinyurl.com/y3x7rdor [tinyurl.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__tinyurl.com_y3x7rdor&d…> Agenda Wiki: https://community.icann.org/x/DoEzBw The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: https://gnso.icann.org/en/group-activities/calendar<https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_grou…> Meeting Audio Cast (for observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream01 [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Listen in application such as iTunes: http://stream.icann.org:8000/stream01.m3u<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Kind Regards, Terri If needed, an option to join via telephone has been added for this meeting. **New join information - Conference Bridge: Toll-free access number (US and Canada): 800 550 6865 and Toll 213 233 3193 Other telephone numbers found here: http://www.adigo.com/icann [adigo.com]<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.adigo.com_icann&d=D…> Enter passcode on telephone: 7349

2 1