April 2020 - Gnso-epdp-team

Documents - EPDP Team Meeting #53 - 16 April 2020
by Caitlin Tubergen April 15, 2020

April 15, 2020

Dear EPDP Team: Please find attached four documents for the upcoming EPDP Meeting. Recommendation 1 (Accreditation): Remaining discussion items Recommendation 3 (Criteria and Content of Requests): Discussion items for meeting Recommendation 5 (Acknowledgement of Receipt): Discussion items for meeting Recommendation 2 (Accreditation of Governmental Entities): Initial draft of consolidated Rec. 1 and Rec. 2, including questions for GAC colleagues to consider. Please note this draft has not yet been reviewed by the EPDP GAC reps. We are sharing this draft document for informational purposes only. Please do not provide comments at this time. We will send out the discussion items for Recommendation 8 later today. Thank you. Best regards, Marika, Berry, and Caitlin

1 0

**Reminder** Meeting Invitation / Observers / GNSO Temp Spec gTLD RD EPDP-P2 call / Thursday, 16 April 2020
by Julie Bisland April 15, 2020

April 15, 2020

**See April webinar zoom URL link below. As a result of various requests to facilitate observers to follow the EPDP Phase 2 deliberations in real time, zoom webinar room will be made available for the EPDP plenary meetings. As a reminder, the zoom recording, audio recording, chat transcript and transcript of the EPDP plenary meetings will be publicly posted as soon as available on the EPDP wiki page and GNSO master calendar. Dear all, The next meeting of the GNSO Temp Spec gTLD RD EPDP – Phase 2 is scheduled on Thursday, 16 April 2020 at 14:00 UTC for 2 hours. For other times: https://tinyurl.com/r4fns8l [tinyurl.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__tinyurl.com_r4fns8l&d=…> Agenda Wiki: https://community.icann.org/x/0SqJBw The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: https://gnso.icann.org/en/group-activities/calendar<https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_grou…> **Updated information** April observer zoom webinar room: https://icann.zoom.us/j/731687691 [icann.zoom.us]<https://urldefense.proofpoint.com/v2/url?u=https-3A__icann.zoom.us_j_731687…> Going forward, observers will now join via zoom webinar room vs audio cast. Observers will have ability to view member chat and information shared in the zoom webinar room. Observers will not be able to use chat or raise hands. One tap mobile US: +16699006833,,731687691# or +13462487799,,731687691# Webinar ID: 731 687 691 International numbers available: https://icann.zoom.us/u/acwzlz1QoY [icann.zoom.us]<https://urldefense.proofpoint.com/v2/url?u=https-3A__icann.zoom.us_u_acwzlz…> Kind Regards, Terri

1 0

Proposed agenda - EPDP Team Meeting #53 - 16 April 2020
by policy＠bacinblack.com April 13, 2020

April 13, 2020

Dear EPDP Team, Please find below the proposed agenda for the next EPDP Team meeting on Thursday, 16 April at 14:00 UTC. Also, please see the following open action items: Action Items 1. Recommendation 1 <https://docs.google.com/document/d/1NSxjQokvWM1lqhSUk-5gTsy7SlWP04S5mdDPLb_…> : Based on today’s discussion, EPDP Support Staff to propose edits to Recommendation 1 for EPDP Team review by Tuesday, 14 April. 2. Recommendation 2 <https://docs.google.com/document/d/1Z6EMJp6_ZALhu7nyDQuLkYaDUsDOYCzlOxSXNhK…> : In preparation for the next meeting, EPDP Support Staff to work with GAC reps to identify the unique provisions of Recommendation 2 that require a separate recommendation (and cannot be incorporated into Recommendation 1). 3. Recommendations 3 <https://docs.google.com/document/d/1LWRTWeXzfyI5AQSkc1UnrRwgXQEFn2jko16ckuq…> , 5 <https://docs.google.com/document/d/1SXV6yiARg256UdbwkrBeUcA8MiFo7z7Ws4hi-rx…> , 8 <https://docs.google.com/document/d/1rU_tMAUjKzpbDid4KIDHU0gbzxe0pACZmRTE4fB…> : EPDP Team to review all public comments (via the public comment review tools) and provide feedback into the relevant discussion table by COB Tuesday, 14 April. 4. Timeline: Rafik to reach out to GNSO Council and request guidance about a possible extension of the EPDP Team’s timeline due to COVID-19. Rafik to flag to the Council that an extension will also involve the selection of a new chair due to Janis’ availability. {COMPLETE} Best regards, Marika, Berry, and Caitlin -- EPDP Phase 2 - Meeting #53 Proposed Agenda Thursday 16 April 2020 at 14.00 UTC 1. Roll Call & SOI Updates (5 minutes) 2. Confirmation of agenda (Chair) 3. Welcome and housekeeping issues (Chair) (5 minutes) 4. Recommendation #1 - Accreditation (15 minutes) a. Remaining concerns flagged in EPDP Team review of recommendation #1 discussion table <https://docs.google.com/document/d/1NSxjQokvWM1lqhSUk-5gTsy7SlWP04S5mdDPLb_…> – discussion items 12-16 b. EPDP Team to consider remaining discussion items c. Confirm next steps 5. Recommendation #2 – Accreditation of Governmental entities (20 minutes) a. Review discussion items gleaned from input provided on recommendation #2 discussion table <https://docs.google.com/document/d/1Z6EMJp6_ZALhu7nyDQuLkYaDUsDOYCzlOxSXNhK…> b. Confirm next steps 6. Recommendation #3 - Request Criteria & Content (20 minutes) a. Review discussion items gleaned from input provided on recommendation #3 discussion table <https://docs.google.com/document/d/1LWRTWeXzfyI5AQSkc1UnrRwgXQEFn2jko16ckuq…> b. Confirm next steps 7. Recommendation #8 – Response Requirements (20 minutes) a. Review discussion items gleaned from input provided on recommendation #8 discussion table <https://docs.google.com/document/d/1rU_tMAUjKzpbDid4KIDHU0gbzxe0pACZmRTE4fB…> b. Confirm next steps 8. Recommendation #5 – Acknowledgement of Receipt (20 minutes) a. Review discussion items gleaned from input provided on recommendation #5 discussion table <https://docs.google.com/document/d/1SXV6yiARg256UdbwkrBeUcA8MiFo7z7Ws4hi-rx…> b. Confirm next steps 9. Wrap and confirm next EPDP Team meeting (5 minutes): a. Thursday 23 April at 14.00 UTC. Topic to be addressed: CP Authorization, Disclosure Requirements, Financial Sustainability b. Confirm action items c. Confirm questions for ICANN Org, if any

1 0

Update on cost estimate exercise
by Eleeza Agopian April 9, 2020

April 9, 2020

Dear EPDP team, We are writing to provide you with an update on ICANN org’s effort to produce a cost estimate based on the answers<https://docs.google.com/document/d/1YtLHw4ASPOLwI_77bXGJrGypCHzYePQ5vaIWXzP…> provided in March in response to our questions regarding this effort. We appreciate the team’s efforts to estimate the scope of use for the SSAD and provide answers to our questions. ICANN org is committed to supporting the EPDP team in its work and hopes that its estimates prove useful for the team’s deliberations. To that end, the org is preparing estimates that in some cases will reflect ranges of costs, because some critical factors remain unknown or undetermined by the EPDP. This includes in the area of accreditation and identity verification, which we raised as concerns on today’s EPDP call. In particular, question #23 in the Q&A document<https://docs.google.com/document/d/1YtLHw4ASPOLwI_77bXGJrGypCHzYePQ5vaIWXzP…> asks for greater detail regarding the EPDP Team’s expectations about the depth and breadth of identity verification. In the org’s public comments on Preliminary Recommendation #1, we also cited concerns regarding the verification and management of signed assertions. Specifically, we noted: “As there are no recommendations on how the Accreditation Authority must verify the identity of the requestor, ICANN org believes it is important to understand the scale of effort the EPDP expects for the verification process. For example, how and to what type of standards would an IP attorney’s identity be validated? A cyber security researcher? If any possible SSAD user may be accredited, how would the Accreditation Authority or Identity Provider be expected to verify that an individual with the email address NAME(a)SLD.TLD is who they say they are? Would it be up to the Accreditation Authority or the Identity Provider to set these parameters?” We understand from today’s discussion that the EPDP notes many of these details can be worked out in the implementation phase. With this discussion in mind, the org will estimate costs to the best of its ability based on its past experiences, as suggested by the team. Given the team’s timeline for reviewing public comments on the initial report, we are working to provide you with an estimate ahead of the scheduled discussion on Preliminary Recommendation #15, which we understand to be 23 April. Our CFO Xavier Calvez and Vice President of Finance Becky Nash are available to join the team on that call, or whenever is most appropriate, to discuss these efforts as we work to produce the estimates. Thank you, Eleeza and Dan ICANN org liaisons

1 0

Notes and action items - EPDP Meeting #52 - 9 April 2020
by Caitlin Tubergen April 9, 2020

April 9, 2020

Dear EPDP Team: Please find below the notes and action items from today’s meeting. As a reminder, the next EPDP Team meeting will be Thursday, 16 April at 14:00 UTC. Best regards, Marika, Berry, and Caitlin -- Action Items Recommendation 1: Based on today’s discussion, EPDP Support Staff to propose edits to Recommendation 1 for EPDP Team review by Tuesday, 14 April. Recommendation 2: In preparation for the next meeting, EPDP Support Staff to work with GAC reps to identify the unique provisions of Recommendation 2 that require a separate recommendation (and cannot be incorporated into Recommendation 1). Recommendations 3, 5, 8: EPDP Team to review all public comments (via the public comment review tools) and provide feedback into the relevant discussion table by COB Tuesday, 14 April. Timeline: Rafik to reach out to GNSO Council and request guidance about a possible extension of the EPDP Team’s timeline due to COVID-19. Rafik to flag to the Council that an extension will also involve the selection of a new chair due to Janis’ availability. EPDP Phase 2 - Meeting #52 Proposed Agenda Thursday 9 April 2020 at 14.00 UTC 1. Roll Call & SOI Updates (5 minutes) 2. Confirmation of agenda (Chair) 3. Welcome and housekeeping issues (Chair) (10 minutes) Status of PCRT & Discussion Tables + deadlines & proposed timeline (see proposed timetable and https://community.icann.org/x/Hi6JBw) All PCRTs and Discussion Tables have been posted to the wiki Support Staff will start populating the review due dates from the draft schedule sent to the list this week As a reminder, the PCRT links are an easier form to review the comments submitted to the public comment forum, and are divided by the level of support The schedule may be revised as we go, but wanted to put an example forward for predictability and allow groups to self-organize their input Letter from Chair of GAC GAC has submitted a letter, requesting a slower pace for the EPDP, in light of COVID-19 Strongly support content of the letter – ALAC has strong concerns that EPDP Team will produce a report that the GNSO may not approve or the Board may not approve. Curious that this is coming from the GAC who has been advocating for a faster speed. The Team is constrained by its budget. This may just prolong discussions of topics the EPDP Team will still not agree on. Delaying the output is a lose-lose scenario for all sides. Extending the timeline is not worthwhile. BC supports the GAC letter. COVID-19 has changed the way that groups can respond to issues. It would be wholly inappropriate for the Board to not provide funding for this effort. The resource request is probably less since we are not asking for F2F meetings at this time. Support asking the Board for additional resources. Suggested prudent next step – reach out to the GNSO Council and let them know about the challenges and concerns raised here. Perhaps Rafik could pass the concerns along and ask for advice from the GNSO Council. Agree to make formal request to GNSO Council for advice. The homework schedule is very aggressive and many groups are likely to struggle with these deadlines given the current environment. The Team has been cautioned by the GNSO Council to stick to the timeline. The Team will likely not be able to change positions with more time. This is something that needs to evolve, and a lot of work needs to be done in the implementation phase. Groups should think about how they provide input and guidance to the implementation phase. If the pressure is removed, the Team will occupy as much time as is reallocated. The timeline puts pressure on the Team that it does have to come to an agreement and settle issues instead of constantly debating them. Preferable to miss a few comments here and there rather than take the timeline pressure off. Advocate for extending the timeline by a few months, not years Action: Rafik to reach out to GNSO Council regarding asking for an extension. The Council will also need to launch a search for a new chair of the EPDP Team, since Janis’ availability ends on 30 June. 4. Recommendation #1 - Accreditation (90 minutes) Concerns flagged in EPDP Team review of recommendation #1 discussion table EPDP Team to discuss how to address concerns Signed Assertions The bullet points that Staff has here are on track to addressing the confusion, so support what staff says The last bullet: the policy recommendations may include examples of what signed assertions may be, but these are expected to be further worked out in the implementation phase, otherwise supportive. Concerns about what kinds of assertions entities could make This is a matter of convenience that assertions are linked to identifiers, but it’s not a de facto approval of a request Accreditation or signed assertions are no guarantee for disclosure The guidance with respect to how to format a request is separate – if you are a trademark group and you are accrediting your members, there are questions you ask and proof that you require – this is separate and doesn’t have to be dealt with here Action: Based on positive feedback, and waiting for Stephanie’s comments – request Support Staff to finetune the current language in Rec. 1 with respect to signed assertions. When the Team reviews the clean text, we can use two colors – new color for text that has been edited as a result of the public comment period. Trusted Notifiers This term is a misnomer – it should be trusted requestors, not trusted notifiers. This seems very subjective – accreditation should be fact-based. Trust should not be found within the SSAD – it should be outside of the SSAD. Not opposed to the concept of trusted notifiers, but this should be on an individual basis. Support an idea where such trusted parties could be individually green lit for automated access or preferred access. Deep reservation against parties being mandated to be trusted by all. If there is such thing as a trusted requestor, this should be in a different part of the policy. This is how the team loses time – talking about something that is never going to happen. Just b/c the idea may not fit into accreditation does not mean that this isn’t a good idea. This could fit in automation, contracted party authorization – the reason this was called trusted notifier is b/c this is a concept that already exists elsewhere, but this could be called a “trusted notifier” instead Maybe there should be a feedback loop at some point This should be included somewhere in the policy – do not want to be told later on that CPs cannot attribute a trust level based on Accreditation Authority The staff bullets create more confusion rather than add clarity. The AA is responsible for the verification, issuance, and ongoing management of the Identity Credential and Signed Assertions – thought they would rely on identity providers Second bullet point talks about third parties but doesn’t mention identity providers The fourth bullet point is incorrect. In response to Q4 – what is the scope of identity verification – against what standard would the identity provider be expected to verify an identity? The last bullet point – the first phrase is redundant. Probably what we need for group accreditations – a field that must be filed in with an ID within your company so that the SSAD can attribute a request to an individual. With respect to when a request would go directly to a registry, when would that be? As a default, the request would go to the registrar. If the requestor explicitly wanted to, the request could go to the registry in the alternative. Do not want to encourage forum shopping This question belongs in the request requirement selection. We concluded that the hybrid model would be the best b/c of legal advice received to date. If groups are not supporting this model, this needs to be said right now. Support for this model hinges on an evolution mechanism Forum shopping is a given, even outside of SSAD. The Team needs to be clear that if we start somewhere and go somewhere else – that’s OK, but we need to define the hand-off Approach suggested is default to registrar but ability to go to the registry if there are compliance issues Reaccreditation Time Period If we use 5-year time period, we should consider why this period was chosen. The suggestion to have annual reminders is helpful. At this time, we don’t understand what goes into accreditation in the first place. A lot can change in five years. Term re-accreditation is overkill – maybe a re-affirmation is more appropriate. This is an implementation issue – should be relegated to the IRT This is not re-accreditation – this is renewal or re-affirmation. The five-year term should be no surprise here as registrars and compliance have used this and it has evolved over time. Self-certification to ICANN every year would be acceptable. Requirements of Accreditation Authority Accreditation is to help free up the contracted party from authenticating each user, but should be strictly prescriptive on how that is done This is ultimately an implementation question – in general, the expectation is that the AA would validate as much information as they can. The long answer – amount of information to be verified depends on the requestor There is a lot to be worked out in implementation, but “verify everything we can” isn’t helpful without further context – could check that an email address works – could conduct interviews, DNA checks – need more guidance here. Do not need to reinvent the wheel here – use registrar accreditation as a baseline example Could consider giving more time to provide additional guidance here – talked about three largest groups of requestor types: cybersecurity researchers, IP requestors, and LEA requestors – expectation is that for each of those groups, there may be specific types of validation for those groups Revocation Policy No concern, but in general when there is decision made, there should be a recourse or appeals mechanism. Code of Conduct These are the expectations of what should be provided by a requestor. This is not a code of conduct for Article 40. AA is not the authority on data protection – when it comes to what is and what is not required – it is the responsibility of the controller This is a code of conduct for the accreditation authority itself, not a code of conduct under article 40. As a wider code of conduct discussion, the SSAD would be a chapter in that Could we consider referring to a set of rules instead of a code of conduct? Support Staff to provide additional clarification Baseline Application Procedure The first bullet point – the definition of eligibility requirements will be revised over time Accredited User Revocation & Abuse SSAD must report on abuse The word sanctions is concerning here – recourse spelled out is temporary or permanent restriction of access Confirm next steps Consider remaining edits during the next meeting. Proposed method is something that allows us to move forward at a reasonable pace, but we need to finetune this method – together with a list of considered issues, we need to include the text of the recommendation. Three hours of work online, even with a break, is too much – in the future, we will stick to two hours. Next meeting – Rec. 1 and Rec. 2. In the meantime, ask GAC to work with the Support Staff and identify redundancies with Recommendation 1. If there is a specific element re: gov’t officials, that should stay in the rec; the rest will be captured in Rec. 1. 5. Recommendation #2 – Accreditation of Governmental entities (60 minutes) Overview / run through of and recommendation #2 discussion table EPDP Team to discuss how to address concerns Confirm next steps 6. Wrap and confirm next EPDP Team meeting (5 minutes): Thursday 9 April at 14.00 UTC. Topic to be addressed: Request Criteria & Content, Response Requirements, Acknowledgement of Receipt Confirm action items Confirm questions for ICANN Org, if any

1 0

Post Call | GNSO Temp Spec gTLD RD EPDP – Phase 2 | Thursday, 09 April 2020 at 14:00 UTC
by Terri Agnew April 9, 2020

April 9, 2020

Dear all, All recordings for the GNSO Temp Spec gTLD RD EPDP – Phase 2 held on Thursday, 09 April 2020 at 14:00 UTC can be found on the agenda wiki page <https://community.icann.org/x/ziqJBw> (attendance included) and the GNSO Master calendar <https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_en_group…> . These include: * Attendance (please let me know if your name has been left off the attendance list) * Audio recording * Zoom chat archive * Zoom recording (including audio, visual, rough transcript) * Transcript As a reminder only members and alternates can join the call as panelist, observers can join as an attendee to listen. For additional information, you may consult the mailing list archives <https://mm.icann.org/pipermail/gnso-epdp-team/> and the main wiki page<https://community.icann.org/x/IYEpBQ>. Thank you. With kind regards, Terri

1 0

Meeting Invitation / Observers / GNSO Temp Spec gTLD RD EPDP-P2 call / Thursday, 16 April 2020
by Terri Agnew April 9, 2020

April 9, 2020

**See April webinar zoom URL link below. As a result of various requests to facilitate observers to follow the EPDP Phase 2 deliberations in real time, zoom webinar room will be made available for the EPDP plenary meetings. As a reminder, the zoom recording, audio recording, chat transcript and transcript of the EPDP plenary meetings will be publicly posted as soon as available on the EPDP wiki page and GNSO master calendar. Dear all, The next meeting of the GNSO Temp Spec gTLD RD EPDP – Phase 2 is scheduled on Thursday, 16 April 2020 at 14:00 UTC for 2 hours. For other times: https://tinyurl.com/r4fns8l Agenda Wiki: https://community.icann.org/x/0SqJBw The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: https://gnso.icann.org/en/group-activities/calendar<https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_grou…> **Updated information** April observer zoom webinar room: https://icann.zoom.us/j/731687691 Going forward, observers will now join via zoom webinar room vs audio cast. Observers will have ability to view member chat and information shared in the zoom webinar room. Observers will not be able to use chat or raise hands. One tap mobile US: +16699006833,,731687691# or +13462487799,,731687691# Webinar ID: 731 687 691 International numbers available: https://icann.zoom.us/u/acwzlz1QoY Kind Regards, Terri

1 0

ICANN Compliance use case
by Alan Greenberg April 9, 2020

April 9, 2020

One of the use cases in Mark's list that we never got to was that of ICANN Contractual Compliance (CC). I would like to propose that we include this in our final report. The rationale is as follows: - provision of current data to ICANN is a contractual requirement - automated availability of such data will streamline and speed up ICANN CC operations and will reduce the load on CPs. To be specific, I am proposing that: Requests for redacted RDS data fields from ICANN Contractual Compliance, made in support of investigations associated with compliance issues, be fully automated within the SSAD. As far as I understand, CP are contractually obligated to respond to such requests and therefore the automation does not expose them to any additional risk. ICANN CC would of course be bound to only make such requests in support of investigations and are bound to treat the data just as they would if they had received it via today's manual channels. Alan

3 2

GAC Concerns with feasibility of timeline v. COVID-19
by Manal Ismail April 9, 2020

April 9, 2020

Dear EPDP Team, In light of the COVID-19 pandemic, and its drastic consequences on governments, organizations, private sector and individuals worldwide, I would like to express our serious concerns, as GAC leaders, that maintaining the current pace of work towards completion of Phase 2 by mid-June could jeopardize the delivery, efficacy and legitimacy of the EPDP's policy recommendations. While recognizing that the GAC has continually advised for swiftly completing policy development and implementing agreed policy on this critical public policy matter, we believe that given the current global health emergency, which puts many in the EPDP and the community under unprecedented stress (for example governments has been called to heightened duties for the continuity of essential public services), pressing important deliberations and decisions in such a short time frame on already strained participants would mean unacceptably sacrificing the product for the timeline. We understand there are budget and human resources considerations involved in the completion of Phase 2 of the EPDP. However, we are all living through a global health pandemic, so we call on the EPDP Team to seriously reassess its course and expectations (be it on the duration of its calls, the turn-around time of reviews, its ultimate timeline and budget) emulating what numerous governments, global organizations, and households are doing to adapt during these challenging times across the world. Sincerely Manal Ismail, GAC Chair on the behalf of the entire GAC Leadership

1 1

Recommendation 1 - discussion items
by Caitlin Tubergen April 8, 2020

April 8, 2020

Dear EPDP Team: In preparation for the EPDP meeting tomorrow, the Staff Support Team has prepared the attached document, which highlights the Rec. 1 issues for discussion during tomorrow’s call. The document includes questions for your consideration. Please note the document only highlights issues flagged by Tuesday’s deadline. Please feel free to flag any items we may have inadvertently missed. Best regards, Marika, Berry, and Caitlin

1 0