- Gnso-epdp-team - lists.icann.org

Fwd: Agenda
by Janis Karklins Nov. 21, 2019

Nov. 21, 2019

Dear Team members, Pls see attached the updated agenda for today's meeting with links to all documents that we will be discussing. Hope you will agree to follow this agenda that was amended after Mark's initiative. See you in a bit JK

1 0

Post-ICANN66 Policy Report Now Available
by Nathalie Peregrine Nov. 20, 2019

Nov. 20, 2019

Dear all, The Post-ICANN66 Policy Report is now available. Please click here to access it: https://go.icann.org/post66 [go.icann.org]<https://urldefense.proofpoint.com/v2/url?u=https-3A__go.icann.org_post66&d=…>. Kind regards, Nathalie Nathalie Peregrine Manager, Operations Support (GNSO) Internet Corporation for Assigned Names and Numbers (ICANN) Email: nathalie.peregrine(a)icann.org <nathalie.peregrine(a)icann.org%20> Skype: nathalie.peregrine.icann Find out more about the GNSO by visiting: https://learn.icann.org/ <https://urldefense.proofpoint.com/v2/url?u=https-3A__learn.icann.org_&d=DwM…> Follow @GNSO on Twitter: https://twitter.com/ICANN_GNSO <https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_ICANN-5FGN…> Transcripts and recordings of GNSO Working Group and Council events are located on the GNSO Master Calendar <https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_grou…> See All SO and AC events on the ICANN Global calendar [features.icann.org]<https://urldefense.proofpoint.com/v2/url?u=https-3A__features.icann.org_cal…>

1 0

Proposed agenda - EPDP Meeting #30 on Thursday, 21 November at 1400 UTC
by Caitlin Tubergen Nov. 20, 2019

Nov. 20, 2019

Dear EPDP Team: Please find below the proposed agenda for the next EPDP Team meeting on Thursday, 21 November at 1400 UTC. As a reminder, here are the action items from the last meeting: Support Staff to apply the agreed-upon edits (including deletions, where applicable) to the Logging, Auditing, and Response Requirements Building Blocks by Friday, 15 November. (complete) EPDP Team to review updated Logging and Auditing Building Blocks by Thursday, 21 November. Best regards, Marika, Berry, and Caitlin -- EPDP Phase 2 - Meeting #30 Proposed Agenda Thursday, 21 November 2019 at 14.00 UTC Roll Call & SOI Updates (5 minutes) Confirmation of agenda (Chair) Welcome and housekeeping issues (Chair) (5 minutes) a) Update from the legal committee b) Status of building blocks Response Requirements (Building Block G) – Second Reading Cont’d Review Building Block Feedback from EPDP Team Confirm next steps Terms of Use (Building Block M) – Second Reading Review Building Block Feedback from EPDP Team Confirm next steps Automation Building Block – Second Reading Review Building Block Feedback from EPDP Team Confirm next steps Financial Sustainability (Building Block N) – Second Reading Review Building Block Feedback from EPDP Team Confirm next steps Wrap and confirm next EPDP Team meeting Tuesday 26 November at 14.00 UTC Confirm action items Confirm questions for ICANN org, if any

4 3

**Reminder** Meeting Invitation / Observers / GNSO Temp Spec gTLD RD EPDP-P2 call / Thursday, 21 November 2019
by Julie Bisland Nov. 20, 2019

Nov. 20, 2019

As a result of various requests to facilitate observers to follow the EPDP Phase 2 deliberations in real time, audio cast will be made available for the EPDP plenary meetings. Staff will be monitoring audio cast attendance numbers so that the EPDP leadership can assess its usage. As a reminder, the zoom recording, mp3 recording, chat transcript and transcript of the EPDP plenary meetings will be publicly posted as soon as available on the EPDP wiki page and GNSO master calendar. Dear all, The next meeting of the GNSO Temp Spec gTLD RD EPDP – Phase 2 is scheduled on Thursday, 21 November 2019 at 14:00 UTC for 120 minutes. (calls will be scheduled for 120 minutes but aim to keep to 90 minutes) For other times: https://tinyurl.com/y6yyjj6h [tinyurl.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__tinyurl.com_y6yyjj6h&d…> Agenda Wiki: https://community.icann.org/x/QYEzBw The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: https://gnso.icann.org/en/group-activities/calendar<https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_grou…> Meeting Audio Cast (for observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream01 [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Listen in application such as iTunes: http://stream.icann.org:8000/stream01.m3u<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Kind Regards, Terri If needed, an option to join via telephone has been added for this meeting. **New join information - Conference Bridge: Toll-free access number (US and Canada): 800 550 6865 and Toll 213 233 3193 Other telephone numbers found here: http://www.adigo.com/icann [adigo.com]<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.adigo.com_icann&d=D…> Enter passcode on telephone: 7349

1 0

IGF and Team call on 26 Nov
by J Nov. 20, 2019

Nov. 20, 2019

Dear All, I have asked ICANN Org facilitate the organization of the call from Berlin by finding a room for a call in the Congress Centre. Call will start at 3pm local time. The official opening with Chanceler Merkel and UNSG Guterres will take place from 2pm to 3pm, followed by opening session that we will miss. To my knowledge the following Team membrs will attend the IGF: Becky Burr Chris Disspain Thomas Rickert Mark Svancarek Steve DelBianco Milton Mueller Ayden Férdeline Berry Cobb Best regards JK

2 1

Fwd: Maarten Botterman to Janis Karklins, chair of the EPDP
by Janis Karklins Nov. 20, 2019

Nov. 20, 2019

Dear Team members, Pls see below the reply of the Board on our 10 October letter. Hope you will find the reply informative and helpful for our deliberations. Best regards JK ---------- Forwarded message --------- From: Vinciane Koenigsfeld <vinciane.koenigsfeld(a)icann.org> Date: Tue, Nov 19, 2019 at 3:24 PM Subject: Maarten Botterman to Janis Karklins, chair of the EPDP To: karklinsj(a)gmail.com <karklinsj(a)gmail.com> Cc: Goran Marby <goran.marby(a)icann.org>, Secretary <secretary(a)icann.org>, Correspondence <Correspondence(a)icann.org>, Board Ops Team < board-ops-team(a)icann.org>, Diana Middleton <diana.middleton(a)icann.org>, Eleeza Agopian <eleeza.agopian(a)icann.org> Dear Janis Karklins, Please find the attached letter from Maarten Botterman, on behalf of the ICANN Board, in response to the letter from EPDP 2 to the ICANN Board on Standardized System for Access/Disclosure (SSAD) of 10 October 2019. Best wishes, Vinciane Koenigsfeld Sr. Director, Board Operations Vinciane.koenigsfeld(a)icann.org Mobile : (+32) 0493.09.86.50 ICANN – www.icann.org One World. One Internet.

1 0

an EPDP Thanksgiving?
by Anderson, Marc Nov. 20, 2019

Nov. 20, 2019

Janis, I note that there is currently an EPDP meeting scheduled for November 28th. This is a major public holiday in the US. Looking at the member list this impacts over half the team. In some cases, entire constituencies would need to choose between missing the call or impacting their holidays. Considering we also have a call scheduled for the 26th of that same week, I'm requesting to cancel the call on the 28th. Best, Marc

10 10

Notes and action items - EPDP Meeting #29 - 14 November 2019
by Caitlin Tubergen Nov. 19, 2019

Nov. 19, 2019

Dear EPDP Team, Apologies for the delay, but please find below the notes and action items from EPDP Meeting #29. The next EPDP Team meeting will be Thursday, 21 November at 1400 UTC. Best regards, Marika, Berry, and Caitlin -- EPDP Phase 2 - Meeting #29 Thursday, 14 November 2019 at 14.00 UTC Action Items Support Staff to apply the agreed-upon edits (including deletions, where applicable) to the Logging, Auditing, and Response Requirements Building Blocks by Friday, 15 November. EPDP Team to review updated Logging and Auditing Building Blocks by Thursday, 21 November. Agenda 1. 1. Roll Call & SOI Updates (5 minutes) 2. 2. Confirmation of agenda (Chair) 3. 3. Welcome and housekeeping issues (Chair) (5 minutes) a) Takeaways from ICANN66 · Team will continue working at its current pace until early December and assess at that time whether it is ready to publish the Initial Report, or instead, if it will publish after the F2F meeting in January. b) Timing of calls going forward · EPDP Plenary calls will remain at the same UTC time, 14:00 UTC · EPDP Legal Committee calls will be pushed ahead one hour to 15:00 UTC c) Status of building blocks · Support Staff has changed the due dates for review of the building blocks. · Support Staff has added the updated language on the balancing test framework · For some building blocks, the language has been finalized but will need to be revisited once the Team determines which entity will be making the disclosure decision · Reminder: please only provide comments to the building blocks; editing directly makes it very difficult for the Team to review d) Reminder: Confirm with Terri travel funding requirements for ICANN67 · With respect to the January EPDP F2F meeting, please book travel as soon as possible. · For travel to ICANN67, the deadline for travel support request has passed; however, if you missed the deadline, please write to gnso-secs(a)icann.org as soon as possible. 4. 4. Logging [docs.google.com] (building block new) – second reading continued (30 minutes) a) Review comments & input provided · Small Team had an initial conversation about the logging building block in Montreal, which ran in parallel to the Legal Committee meeting · The edits made by Marika from 4 November were made as a result of the small team meeting. The other edits were made by various members of the EPDP Team. As noted previously, going forward, please only provide edits in comment form. · With respect to the logging, the Team aimed to assess the key activities of the SSAD system that needed to be logged: logging related to the identity provider, logging related to the entity receiving the request, and logging related to the entity authorizing the request. b) Feedback from EPDP Team · Chapeau · No comments · Subpoint a · Logging should only happen in one place, so queries should be removed from the third item · The reason these are currently separated is because it’s unclear if the entity receiving the query will also make the disclosure decision. Once it becomes clear which entity will do what, these can be merged. · Subpoint b · Will this principle be worked out in implementation? This looks like the start of a data retention specification. There are also data protection implications of this data. · How long should the logs be retained? The small team did not have time to discuss this - possibly because this conversation may need to happen after review of the auditing building block · If the period for retention will be three years, the Team needs to provide a rationale as to why it’s three years. · The reason for three years is so that the logs are retained longer than contracted parties have to retain the data. · The logs shall be retained for a period of time sufficient to cover the time until claims by data subjects are barred by statute according to the national law applicable for the entity keeping having disclosed the data.  · The Team should assume that no personal information stored in these logs. If the Team is able to do that, that will remove concerns about retention. · Suggest changing "machine-readable format" to "in a commonly used, structured, machine-readable format accompanied by an intelligible description of all variables"  · Team agrees to take the suggestion from Thomas re: proposed data retention language (until claims by data subjects are barred by…) and suggestion from Ayden to expand on machine-readable format as noted above · Subpoint D · If the liability is still retained by the CPs, the Team needs to keep in mind that the logs could also be released to the CPs. This could be included in a footnote. · Support Staff to include a footnote re: release of logs to CPs · Perhaps include an (s) after the controller(s) · Strike DPAs in (ii) with the understanding they would fall under due legal process under (iii) · One point not captured here is the use of the logs by the technical operator of the system - technical operators may need to review logs for the technical operation of the system · Propose changing “data protection authorities” to “relevant supervisory authorities” · “due legal process, including relevant supervisory authorities, as applicable” · Request to retain original language for (i) · Subpoint E · I.e., when “they” log in - that is when the accredited user logs into the system/gateway, not when they log into the identity provider · This parenthetical should be moved down to “authorizing the request” · This deals with Alex’s process flow - the individual/entity would be validated by the identity provider itself · This bullet will need to be revisited when more details of the system are decided to allow flexibility in implementation · Action: Support Staff to revisit the fourth bullet point with Alex and see if it needs to be split into two c) Confirm next steps · Team to revisit this building block once other building blocks are finished and further decisions are made to ensure consistency. · This will now be changed to green. 5. 5. Auditing [docs.google.com] Requirements (building block new) – second reading (30 minutes) a) Review building block · Similar to the logging building block, the green text added on 4 November was added as a result of the small team meeting at ICANN66 b) Feedback from EPDP Team · Auditing of the Accrediting Authority · There are some terminology differences - in logging, there is an identity provider and in audits, there is an accreditation authority. · No, these are separate entities. · Need more information on audits - if there any implementation guidance the Team could provide, that would be helpful. · If ICANN is the accreditation authority, who above ICANN will sanction ICANN, and what mechanism is that? If it is the ICANN community, what is the mechanism for that? · An external auditor for ICANN could be a very expensive endeavor · May need to include something in the policy about access to the data that would be used to determine whether ICANN is doing an acceptable or unacceptable job. An audit of ICANN could be triggered under very specific circumstances, rather than including a periodic and potentially expensive audit. This conversation should be revisited when more decisions are made by this team. · Support Staff to reword language with the assumption that ICANN org is the accreditation authority and ICANN org can choose to outsource this function · It makes sense to assume for now that the assumptions in the Strawberry paper are correct, and that ICANN will retain responsibility for the central gateway · Audits of Identity Providers · The audit of the identity provider should be done by ICANN · It’s difficult to envision how this would work without knowing who the identity providers are · Disagree with removing “independent” from auditors - this should be done independently · The essential part here is that there needs to be some action taken periodically to ensure things are being done properly · Audits of Accredited Entities/Individuals · This is missing some details - for example - do all accredited entities need to be audited? How often is “periodically”? · Do not understand how you can audit an individual request - does this involve going into someone’s home to ensure they have disposed of data properly? · How does one prove a negative? No, I did not misuse the data. Perhaps there could be an ongoing representation, similar to what contracted parties have to do every year · This would work similarly to how CPs are audited today - ICANN would ask the accredited entity or individual a series of questions, and they would have to respond and show proof. If a complainant claims misuse of data, it should have to show evidence of this in its complaint. · This should be based on an audit set or a complaint set. · It is likely very few people would make a complaint, and that would be looked badly on by DPAs. · CPs are audited every 3-4 years, so perhaps timing like that could be considered. · The logging and auditing building blocks should be compared and all relevant actors should appear in each building block · Bracketed text can be entered here for now, but once the model is more solidified, this can be revisited · The auditing of logs text is duplicative and can be deleted c) Confirm next steps · Support Staff to apply the agreed-upon edits (including deletions, where applicable) and EPDP Team to review 6. 6. Response requirements [docs.google.com] (building block g) – second reading a) Review building block b) Feedback from EPDP Team · Most of the text was updated by the deadline given · Attempted to clarify the difference b/w checking that a request is syntactically correct and complete. In the case where the request is not syntactically correct, an error response would be returned noting which areas were not completed. When the request is found to be incomplete, an incomplete request response must be returned. · Might it make sense to separate out policy recommendations with implementation advice? · It may be helpful to have a diagram/flow chart to explain the different tracks c) Confirm next steps 7. 7. Wrap and confirm next EPDP Team meeting (5 minutes): a) Thursday 21 November at 14.00 UTC b) Confirm action items c) Confirm questions for ICANN Org, if any

1 0

Questions for ICANN Org from EPDP Team Chair
by Marika Konings Nov. 19, 2019

Nov. 19, 2019

Dear ICANN org liaisons, On behalf of Janis Karklins, in his capacity as EPDP Team Chair, please find hereby a number of questions for ICANN org he would appreciate a response to as soon as possible: Does ICANN have a clear preference on whether or not it will: 1. Field these requests for non-public data 2. Maintain its own RDS replica database 3. Make a/the determination of the validity of the request 4. Assume responsibility for this decision, in any scenario where ICANN doesn’t hold the data directly and must require a Contracted Party to respond to the Requestor (even if the Contracted Party disputes ICANN’s determination) 5. Consider an approach whereby ICANN acts as a more or less “gateway” for authorized data to pass through, data provided by the Contracted Party at the request of ICANN (per contractual requirement), with the responsibility for such disclosure to be assumed by ICANN. Best regards, Caitlin, Berry and Marika Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

2 1

Financial Sustainability Questions for ICANN Org
by Anderson, Marc Nov. 18, 2019

Nov. 18, 2019

EPDP team, Coming out of our Montreal sessions, James and I had the action item to take a look at the Financial sustainability building block: https://docs.google.com/document/d/1Ci-wvA1P9yoKjJ5DPeRbZ5FOHL2D8ExGsN2SV9T… and propose a letter to ICANN requesting their help. Attached is a first draft of a proposed letter to ICANN Org on the Financial Sustainability building block. I want to note that at the same time Eleeza has made comments to the Building block document asking additional questions and offering ICANN's help similar to what we are asking for in this letter. Thanks also go to Sarah and Alan W who provided help on an editing pass. Thank you, Marc and James

1 0