- Gnso-epdp-team - lists.icann.org

Purpose O - preparations for Thursday's EPDP Team meeting
by Marika Konings Dec. 4, 2018

Dec. 4, 2018

Dear All, As per the action items, please find attached the proposed Purpose O - Research and publish reports on threats to the operational stability, reliability, security, global interoperability, resilience, and openness of the DNS, as circulated to the mailing list by Benedict on 15 November (see https://mm.icann.org/pipermail/gnso-epdp-team/2018-November/000897.html) Note that in relation to registration data used by ICANN departments, ICANN Org also responded to a number of questions from the EPDP Team (see below). In order to facilitate Thursday’s discussion on this topic, please share any clarifying questions and/or comments you may have in advance of the meeting. Best regards, Caitlin, Berry and Marika Responses from ICANN Org to EPDP Team Question re. use of registration data by other ICANN Departments (see https://community.icann.org/x/ahppBQ) 2. Apart from ICANN Org Compliance, do any other ICANN departments require access to registration data and, as such, might require a specific purpose? If so, please describe in detail sufficient to provide a legal basis for such data processing. This question seems to be asking about any use by ICANN Org of registration data that is now masked pursuant to the Temporary Specification. One example of an ICANN Org activity that previously used WHOIS data elements that may now be redacted pursuant to the Temporary Specification is the WHOIS Accuracy Reporting System, which is currently under review as discussed with the EPDP Team on 26 September 2018. If additional information is needed it would be helpful if the EPDP Team could please clarify if the question is for information related to such past uses of now-masked registration data, or to any current ICANN Org (apart from Contractual Compliance) uses of non-public data, or to any future uses of non-public registration data that may be needed in order to implement GNSO-recommended policies. Also, in discussions that the EPDP Team has had regarding purposes, ICANN Office of the CTO (OCTO) has been mentioned. To inform the EPDP Team’s continued discussion on this topic, ICANN Org would like to clarify that ICANN OCTO does not require personal data in domain name registration data for its work. For example, OCTO’s Domain Abuse Activity Reporting (DAAR) project <https://www.icann.org/octo-ssr/daar> uses only the registrar and nameserver information. 3. Further input is requested to explore how WHOIS was used before the Temp Spec was adopted, in OCTO's activities. The original Org response does not address that issue. For example, did OCTO use WHOIS in its law enforcement training and outreach activities, or engagement with the cybersecurity community, or to facilitate or respond to large scale botnet attacks, such as Conficker or Avalanche? Individual members may follow up with the CTO for follow up questions, if available at ICANN63. Regarding the EPDP Team’s follow-up question on how OCTO used WHOIS data for training and outreach activities, prior to the effective date of the Temporary Specification, use of WhOIS data to identify the registrant and the technical data related to a domain name was part of the training materials. The training showed how one could use WHOIS data to attempt to contact a registrant or the hosting provider in cases of compromised machines, etc. Since the Temporary Specification became effective, the training no longer shows one how to use public WHOIS data to contact a registrant, instead as part of the training, a brief overview of where the policy discussions are and how people can get involved in the discussion is provided. The EPDP Team’s follow-up question also asks how OCTO used WHOIS data for engagement with cybersecurity community, or to facilitate or respond to large scale botnet attacks, such as Conficker or Avalanche. Conficker, Andromeda and other large-scale actions are typically managed by the Law Enforcement agencies, not OCTO. OCTO’s role in those activities does not involve the use of personal data in WHOIS. Those Law Enforcement agencies would be better placed to discuss their operational procedures and the effect of the Temporary Specification on their operations. Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

1 0

Notes, action items from EPDP Team Meeting #31 - 4 December 2018
by Caitlin Tubergen Dec. 4, 2018

Dec. 4, 2018

Dear EPDP Team, Below, please find the notes and action items from today’s EPDP Team call. Thank you. Best regards, Marika, Berry, and Caitlin EPDP Team Meeting #31 Tuesday, 4 December 2018 Notes and Action Items High-level Notes/Actions: Action item #1: EPDP Team to review updated letter to EDPB circulated by Stephanie and provide input by next meeting - 6 December. Action item #2: Continue small team deliberations on ICANN - Contracted Parties controller related issues and implementation questions. Action item #3: Staff to set up doodle poll for small meeting to further discuss controller issues. Doodle poll to go to whole team but only those interested in joining should fill out the doodle. (Completed) Action item #4: Staff to update this recommendation to reflect change from 'enter into' to 'develop' in first paragraph of recommendation #6 having to do with data processing agreements with data escrow providers. Action item #5: EPDP Team to develop message to request ICANN Org to: (a) commence development of legally compliant data processing agreements with escrow providers, and (b) create agreements that indicate that data escrow providers are in a processor (rather than controller role) or provide information to the EPDP team why that should not be the case. ICANN to share this work with the EPDP Team to help inform its deliberations. Action item #6: EPDP Team to send message to ICANN indicating that, after discussion of ICANN-raised issues with regard to data processing agreements with Dispute Resolution Providers, that no change is required to the current Initial Report recommendation and ask for a detailed explanation if ICANN Org disagrees with that assessment. Action item #7: EPDP Team to review Purpose O (Research) proposed language prior to the next meeting (see item #13) Action item #8: EPDP Team members to indicate the objective of the discussion on Whois data accuracy and how this fits within the Temporary Specification and the EPDP Team Charter? Notes & Action items These high-level notes are designed to help the EPDP Team navigate through the content of the call and are not meant as a substitute for the transcript and/or recording. The MP3, transcript, and chat are provided separately and are posted on the wiki at: https://community.icann.org/x/ZwPVBQ. 1. Roll Call & SOI Updates Attendance will be taken from Adobe Connect Remember to mute your microphones when not speaking and state your name before speaking for transcription purposes. Please remember to review your SOIs on a regular basis and update as needed. Updates are required to be shared with the EPDP Team. 2. Welcome and Updates from EPDP Team Chair (5 minutes) a. Review of outstanding action items b. Other updates, if applicable Webinar on public comment forum - some updates were made to the slide deck per the input from the EPDP Team. Main focus was to ensure broad understanding of the report as well as how to provide input to the public comment forum. Some questions were raised during Q & A session. Well attended with over 100 attendees. See https://community.icann.org/x/9grVBQ. Translations of executive summary and overview of preliminary recommendations will get posted later today on the public comment forum. If you have not received notification re. Toronto F2F travel, please let gnso-secs know and book your travel as soon as possible. Hotel information is needed for some to be able to book travel. This information is expected to be confirmed shortly and will be shared with the EPDP Team as soon as possible (note – hotel confirmation was confirmed during the meeting). 3. Letter to EDPB (20 minutes): a. Update from small team meetings (see https://mm.icann.org/pipermail/gnso-epdp-team/2018-December/001012.html) b. Any comments / input? c. Confirm next steps Two small team meetings were held to discuss next steps in relation to EDPB communication. See email summarizing outcomes of those discussions. Consider sending an abbreviated letter to the EDPB. Stephanie shared a proposed revised version which is more in the form of a notification. Not role of EDPB to provide legal advice. EPDB has indicated that they do not want to engage with individuals, but ICANN / ICANN community is not individuals. As such, EPDP Team should be free to ask any agreed upon questions. Any outreach would need to be in the most informed way. Seek further advice from outside legal counsel to answer these questions. Diane is writing a SOW, to be reviewed by ICANN. Will need to get approved by PCST. Consider using the law firm that the RDS PDP WG used. May also consider consulting with DPAs itself. SOW to be shared with the EPDP Team before it is finalized. Need to modify questions for this purpose. Consider working with those involved in the small team to modify these questions via email. May also need to involve alternates, if needed. Needs to come back to the full EPDP Team for finalization. Any work done in a smaller team will come back to the full EPDP Team for agreement / sign off. Why was Art 14 not referenced in letter to EDPB? Deals with personal data that has been collected that is not from data subject. Includes a number of requirements for the controller in such a situation. May need to be further considered by the EPDP Team. Action item #1: EPDP Team to review updated letter to EDPB circulated by Stephanie and provide input. 4. Continue review of list of topics for further discussion (60 minutes) a. Continue deliberations on topics for further discussion. Consider items #3, #4, #5 and #6 on the list (see document attached) Informal discussion of some attendees that were in attendance of a (separate) meeting that took place in Brussels last week re. joint-controllership (Daniel Halloran, Diane Plaut, Alan Woods). Eagerness to further explore whether a joint controller relationship exists and what the construct could/would look like if it would be determined that a joint controller relationship exists. Consider creating a small team to further this conversation. Note also a number of implementation related questions that ICANN Org has flagged. May also be a point that needs to be brought to the EDPB? Volunteers to date: Diane, Alan W., Thomas, Dan Halloran. Action item #2: Continue small team deliberations on controller related issues and implementation questions. Action item #3: Staff to set up doodle poll for small meeting to further discuss controller issues. Doodle poll to go to whole team but only those interested in joining should fill out the doodle. (Completed) Item #3 - data agreements are complex, some are two, others are three-way agreements. ICANN Org is a beneficiary in all these arrangements. Data escrow providers differ in their views of what their role is - some are of the view that they are processors, others view themselves as controllers. Would it be possible to have a graphic that would demonstrate how the different relationships play out? ICANN Org is putting together some materials and will consider whether a graphic could be added to that. Detail in the recommendation may not be helpful here, may just need to say that relevant discussions are held, and relevant agreements put in place, without being too specific? Who is responsible for negotiating the appropriate agreement with the escrow provider? Is that ICANN or the registrar? CPs have disaster recovery in place separately, data escrow requirements are an additional layer on top required by ICANN. In certain cases this will result in duplication. ICANN holds the contract and defines the terms with escrow providers. Responsible parties need to review agreements and make sure these are GDPR compliant - that is the underlying objective of the recommendation. Is there a way to rewrite this particular recommendation so that everyone is comfortable with it? ICANN would reach agreement on key legal and technical terms and then each registry/registrar would have some opportunity to negotiate provisions that would not impact on these legal and technical terms. Legal setup may only vary in nuances? Data escrow providers are in effect processors. Would inform EPDP Team deliberations if ICANN could share a draft data processing agreement, or an addendum that could be added to the existing escrow agreements. See "1" of recommendation #6 - may need to reflect that it is not ICANN Org that is entering in an agreement with the data escrow providers. Arrangements are more complex than this recommendation seems to imply. Other parts of the recommendation may also need further considered, but no specific issues identified at this stage. Consider updating in the first paragraph 'enter into' to 'develop' to clarify that ICANN Org does not enter in these agreements. Also ask ICANN Org to already start this development and ask for analysis / development on role of data escrow providers as most are of the view that escrow providers are processors in this scenario Action item #4: Staff to update this recommendation to reflect change from 'enter into' to 'develop' in first paragraph of recommendation #6. Action item #5: EPDP Team to develop message to request ICANN Org to already commence development of these legally compliant data processing agreements with escrow providers and share these with the EPDP Team to help inform its deliberations. Question for ICANN Org: Could ICANN Org provide further details in relation to whether data escrow providers are considered independent controllers or processors? #4 - along same lines as comment for #3. Initial Report foresees a straightforward data processing agreement but is a more complex arrangement. Need to consider this further. Need to have arrangements in place that would give reassurances that required safeguards in place to send personal data to DPRs. Would need an appropriate agreement in place to provide those assurances. Consider changing 'data processing agreements' to 'appropriate legally compliant agreements'? Leave as is as reference to "data processing agreements" leaves option open for controller or processor agreement. What is the implication of not changing the recommendation? Would be helpful for ICANN Org to specify what the impact is - for example, could it result in ICANN Org recommending to the Board that the recommendation would not be approved? In raising these areas for discussion, ICANN Org looking at what questions exist from an implementation perspective - for this one, it is looking at the current situation as currently no arrangements are in place, so this might require further thinking to be implemented or determine whether there are further concerns. Important to distinguish whether there is a concern with the spirit of the recommendation or certain details. Would also be helpful to provide specific recommendations for changes if the issue is with the details that would leave spirit of the recommendation in place. #6 - footnote 4 re. accuracy. What is the objective of the discussion and how does that fit within the Temporary Spec and the charter? Not clear how current requirements on accuracy are dealt with following Temp Spec adoption. Would be helpful to clarify if those requirements still apply. Yes, data accuracy specification in the RAA - puts the burden of accuracy on registrants and for registrars to check formatting. Challenge is that with redaction, from outside this is now opaque. Does not mean that CPs are not keeping up with these requirements – is still continuing since May 25th. What did ICANN Compliance share in relation to ARS? Not run by compliance but other part of ICANN (GDD), but compliance is responsible for addressing any issues identified. Currently ARS is on hold as it was based on publicly accessible information. Status is that ARS that it was put on hold to assess implications of that program under GDPR – ICANN Org is continuing to do this. Communication around future of ARS is expected to be published towards the end of the year or early next year. Figure out a way to carry this program forward. Note that it has been done using publicly available WHOIS data, much more limited now than previously but core part of program will remain to be in place possibly with some additional changes. Access for ICANN Org would be the question here – disclosure would only be to ICANN Org. 5.1 GDPR Accuracy – different views on what accuracy means in this context. Differing viewpoints on whether validation by controller is needed. Proponents should make the case why 5.1 would require additional validation requirements. Action item #6: EPDP Team to review Purpose O (Research) proposed language prior to the next meeting (see item #13) Action item #7: EPDP Team members to share with the list what the objective of the discussion on accuracy is and how this fits within the Temporary Specification and the EPDP Team Charter, as well as expected timing of this discussion? 5. Preview of Phase 2 work items (15 minutes): a. Review mind map (see attached) b. Confirm understanding of EPDP Team on where it is on meeting requirements to commence phase 2 work. Deferred to Thursday’s meeting 6. Wrap and confirm next meeting to be scheduled for Thursday 6 December 2018 at 14.00 UTC a. Confirm action items b. Confirm questions for ICANN Org, if any

1 0

Recordings, Attendance & AC Chat / GNSO Temp Spec gTLD RD EPDP / Tuesday, 04 December 2018
by Andrea Glandon Dec. 4, 2018

Dec. 4, 2018

Dear all, Please find the attendance and AC chat attached to this email, and the MP3 and AC recording below from the GNSO Temp Spec gTLD RD EPDP call held on Tuesday, 04 December 2018 at 14:00 UTC. These have also been posted on the agenda wiki page: https://community.icann.org/x/_ArVBQ MP3: https://audio.icann.org/gnso/gnso-epdp-gtld-registration-data-specs-04dec18… AC Recording: Part 1: https://participate.icann.org/p9pibe5aoej/<https://participate.icann.org/p9pibe5aoej/?OWASP_CSRFTOKEN=49d53bfbfb61a5c4…> Part 2: https://participate.icann.org/p54ohcb9343/<https://participate.icann.org/p54ohcb9343/?OWASP_CSRFTOKEN=49d53bfbfb61a5c4…> ** Please let me know if your name has been left off the list ** Mailing list archives of the GNSO Temp Spec gTLD RD EPDP : https://mm.icann.org/pipermail/gnso-epdp-team/ Main wiki page for the working group: https://community.icann.org/x/IYEpBQ Thank you. Kind Regards, Andrea Glandon

1 0

Meeting Invitation: Alternates & Observers / GNSO Temp Spec gTLD RD EPDP call / Thursday, 06 December 2018
by Andrea Glandon Dec. 4, 2018

Dec. 4, 2018

Dear all, Non-members can follow the EPDP call taking place on Tuesdays and Thursdays via the audio cast or view only Adobe Connect room. As requested and discussed on Tuesday's (14 August 2018) meeting, please note that an additional Adobe Connect room has been created for use by interested alternates and observers to be able to view-only the main EPDP Team Adobe Connect room. The view-only room will also broadcast the audio of the EPDP Team AC room, however, those in the view-only room will not be heard. Note that the audio cast stream will also remain available for now for those that prefer to use that option to listen live to the EPDP Team meeting. View-Only Adobe Connect room for alternates and observers: https://participate.icann.org/gnso-epdp-observers Meeting Audio Cast (for alternates and observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream01 [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Listen in application such as iTunes: http://stream.icann.org:8000/stream01.m3u [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Agenda wiki page: https://community.icann.org/x/_wrVBQ Thank you. Kind Regards, Andrea

1 0

gating questions...
by Alex Deacon Dec. 4, 2018

Dec. 4, 2018

Marika, Caitlin, Kurt, I was reviewing the Initial Report comment form and wanted to confirm that all of the "gating questions" from our charter are reflected in questions we have asked for community input. Can you verify/confirm this is the case? Thanks! Alex

2 1

Additional Topics
by Margie Milam Dec. 3, 2018

Dec. 3, 2018

Hi- as requested, here are additional topics: * Privacy/Proxy Services - how the P/P records appear in the public WHOIS (Section 2.6 of the Temp Spec) * Registrant Consent to Publication - option for registrants to request to have all of their RDS data published * Consent by the Registrant to Publish and/or Disclose for technical contact Talk to you tomorrow, Margie

2 1

EDPB Guidelines
by Kurt Pritz Dec. 3, 2018

Dec. 3, 2018

Hi Everyone: I am sure I am the last one on my block to notice this but the EPDB recently released guidelines on the geographical reach of GDPR. See, https://edpb.europa.eu/our-work-tools/public-consultations/2018/guidelines-… and https://edpb.europa.eu/sites/edpb/files/consultation/edpb_guidelines_3_2018… . Best regards, Kurt

1 0

Proposed Agenda - EPDP Team Meeting #31
by Marika Konings Dec. 3, 2018

Dec. 3, 2018

Dear All, Please find below the proposed agenda for the next EPDP Team meeting which is scheduled for Tuesday 4 December at 14.00 UTC. Best regards, Marika ===================== EPDP Meeting #31 Agenda Tuesday, 4 December 2018 1. Roll Call & SOI Updates (5 minutes) 2. Welcome and Updates from EPDP Team Chair (5 minutes) * Review of outstanding action items * Other updates, if applicable 1. Letter to EDPB (20 minutes): * Update from small team meetings (see https://mm.icann.org/pipermail/gnso-epdp-team/2018-December/001012.html) * Any comments / input? * Confirm next steps 1. Continue review of list of topics for further discussion (60 minutes) * Continue deliberations on topics for further discussion. * Consider items #3, #4, #5 and #6 on the list (see document attached) 1. Preview of Phase 2 work items (15 minutes): * Review mind map (see attached) * Confirm understanding of EPDP Team on where it is on meeting requirements to commence phase 2 work. * Confirm next steps, if any 1. Wrap and confirm next meeting to be scheduled for Thursday 6 December 2018 at 14.00 UTC * Confirm action items * Confirm questions for ICANN Org, if any Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

1 0

REMINDER--Meeting Invitation: Alternates & Observers / GNSO Temp Spec gTLD RD EPDP call / Tuesday, 04 December 2018
by Andrea Glandon Dec. 3, 2018

Dec. 3, 2018

Dear all, Non-members can follow the EPDP call taking place on Tuesdays and Thursdays via the audio cast or view only Adobe Connect room. As requested and discussed on Tuesday's (14 August 2018) meeting, please note that an additional Adobe Connect room has been created for use by interested alternates and observers to be able to view-only the main EPDP Team Adobe Connect room. The view-only room will also broadcast the audio of the EPDP Team AC room, however, those in the view-only room will not be heard. Note that the audio cast stream will also remain available for now for those that prefer to use that option to listen live to the EPDP Team meeting. View-Only Adobe Connect room for alternates and observers: https://participate.icann.org/gnso-epdp-observers Meeting Audio Cast (for alternates and observers) To join the event, click on the link: Listen in browser: http://stream.icann.org:8000/stream01 [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Listen in application such as iTunes: http://stream.icann.org:8000/stream01.m3u [stream.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__stream.icann.org-3A8000…> Agenda wiki page: https://community.icann.org/x/_ArVBQ Thank you. Kind Regards, Andrea

1 0

EPDB Communication - small group meeting
by Kurt Pritz Dec. 2, 2018

Dec. 2, 2018

Hi Everyone: A “small” team met on Thursday to discuss communication with the European Data Protection Board (EDPB). We actually met in two small groups in order to accommodate everyone’s schedule. The discussion of each “smaller” group differed somewhat although there was a large area of intersection in thought and desired actions. The agenda considered to issues: (1) whether and how we should communication to the EDPB generally, and after consideration of that, (2) what the content of a near-term communication might be. As a preamble to the ICANN staff meeting notes (attached), here are the conclusions that I noted. Please provide corrections, edits or additions so that we all have the same understanding. (1) We are not sure we need to or should communicate with the EDPB at this point. In any event, communications with the EDPB must be undertaken carefully and the current draft letter is not suitable for this purpose. We had intended to communicate with them as: (1) the EPDP Charter states that we “should’ (but not “must”) send the initial report to them; (2) we have been creating questions for possible EDPB review as part of our discussions. (2) However, we noted the EDPB web page states, "The EDPB does not provide individual consultancy services. Please note that individuals or organisations with questions related to data protection law are advised to consult the website of the Supervisory Authority in the country where they are based.” Some of the call participants noted that, from personal experience, EDPB member have expressed displeasure at the receipt of questions from ICANN and another round of questions would result in a negative, rather than constructive, reaction. When I suggested that our (EPDP) questions could be differentiated from ICANN questions, it was reasonably pointed out that the EDPB would not be able, nor care to try to differentiate between ICANN org and our team. (3) Therefore, the general agreement was that any communication to the EDPB should be fairly brief and restricted to conclusions of our team rather than in the form of questions. We might decide that we do not want to share the Initial Report with the EDPB. In that case, we should notify the GNSO Council of that intention in order to get their feedback and direction. (4) In the meantime, we will continue to draft / hone a letter to the EDPB as one way to determine if a reasonable, meaningful communication can be developed. Stephanie has undertaken an initial draft of that. Given that the EDPB more or less stated in their earlier missive to ICANN to “get on with it,” it was my opinion that our letter might state that we are doing that and provide a link to the initial report. This would provide the EDPB the opportunity to review the report if they wish and provide notice that our Final Report will be issued at a later date. (5) During the second meeting, it was indicated that there are questions requiring answers that are on the critical path to finishing our work. For example, it is unclear whether the EDPB indication that third party data could be included in a domain registration so long as the third party was “notified" by the registered name holder still requires “consent" of that third party. It was also noted that the team does not have dispositive information on whether a registrar could rely without liability on a registered name holder’s indication of whether s/he was presenting the data of a legal or natural person. Answers to certain questions must still be pursued but the existing question set requires edits. (6) Answers and advice should be pursued in two places. (a) The team should redouble its efforts to secure independent legal advice. To expedite this, it was recommended that a firm already under contract to ICANN (WSGR in Brussels) be employed. Other possibilities would be welcomed but time is of the essence. This effort will start immediately. (b) Consultation with Data Privacy Authorities should be pursued in lieu of the EDPB. It was suggested that the Belgium DPA be consulted as ICANN has an office there. Contacts with DPAs will be attempted through different channels. Thomas is working with one contact set. To briefly recap, as a result of these recent team discussions we will: continue to work on an EDPB draft letter as a way of determining whether such a communication be made; review and edit questions requiring answers to inform our work, secure outside legal counsel, approach a DPA for consultation, report those plans to the GNSO Council. Thank you to everyone that participated on the additional calls. Sorry for the long letter; I hope it was useful. Best regards, Kurt

3 2