Re: [Gnso-epdp-team] EPDP Homework: Updated Draft of Board Letter
I believe including that final sentence gets at the heart of the issue with the guidance we are seeking and removing it makes the letter less impactful IMO. Yes, we think the Board and Org do know these things but I think being as explicit as possible with our words will help ensure we get the most clear answer from the Board as possible. Regards, Matt From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org> on behalf of "Mark Svancarek (CELA) via Gnso-epdp-team" <gnso-epdp-team@icann.org> Reply-To: "Mark Svancarek (CELA)" <marksv@microsoft.com> Date: Wednesday, October 9, 2019 at 3:35 PM To: "James M. Bladel" <jbladel@godaddy.com>, "gnso-epdp-team@icann.org" <gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] EPDP Homework: Updated Draft of Board Letter I still think it’s better not to close the letter with a threat or even a prediction. The Board and Org know the critical importance of giving us a decision answering this letter. We suggest removing the final sentence. The rest of the letter is great. /marksv From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org> On Behalf Of James M. Bladel Sent: Wednesday, October 9, 2019 1:07 PM To: gnso-epdp-team@icann.org Subject: [Gnso-epdp-team] EPDP Homework: Updated Draft of Board Letter Colleagues – Regarding the draft letter to the Board presented on Tuesday, some members were uncomfortable with the wording of the last sentence. Since that call, I’ve been working with our Board liaisons (Becky and Chris) to make some edits. The resulting Revised Draft copied below. To expedite your review, please note that only the final sentence has changed. Thanks— J. ------------- James Bladel GoDaddy Letter from EPDP 2 to ICANN Board on Standardized System for Access/Disclosure (SSAD) To: ICANN Board CC: Goran CC: GNSO Council Dear ICANN Board, We are writing to you at the suggestion of the EPDP 2 Board liaisons. The working group is at a critical junction which requires clear input from the Board in order to further our work to produce realistic, timely, implementable policy recommendations. Specifically, we seek to understand the Board’s position on the scope of operational responsibility and level of liability (related to decision-making on disclosure of non-public registration data) they are willing to accept on behalf of the ICANN organization along with any prerequisites that may need to be met in order to do so. Our goal is to avoid policy recommendations that cement the current situation, where requests for non-public registration data are handled on a case-by-case basis by the registry/registrar in a non-standardized and decentralized manner. We are considering several models for a Standardized System for Access and Disclosure (SSAD), including (but not limited to) the Unified Access Model (UAM) developed by the Technical Study Group. All of the proposed “centralized” SSAD models presume that ICANN will assume an operational role, and, depending upon the model, some degree of responsibility and liability for decisions to disclose non-public data to a third-party requester. In some models, ICANN (or its designee) would approve accrediting bodies, or function as an accrediting body themselves. Some proposed models establish ICANN (or its designee) as the entity that will conduct an initial validation of disclosure requests prior to relaying this request to the appropriate registry or registrar. Other proposed models would require ICANN to play a larger role, either endorsing the legitimacy of the request, or issuing a determination of whether or not the registrar or registry should or must disclose the non-public data to the third party requester. We recognize that our questions are clouded by the uncertainty associated with constructing a model that is compliant with the General Data Protection Regulation (GDPR) and other privacy laws. We are also aware of the work of ICANN org (via the “Strawberry Team”) to engage with data protection authorities to better understand the liability involved in decisions to disclose non-public registration data. As noted above, our goal is to produce realistic, timely, and implementable policy recommendations, and our work requires Board input on the level of involvement and amount of liability they are willing to assume for ICANN org, along with any prerequisites that may need to be met in order to do so. Absent that input, the EPDP work must abandon the centralized SSAD model, and shift its focus to policy recommendations aimed at improving the existing distributed model in which each registry and registrar independently evaluates, applies their own balancing test, and responds to queries on a case by case basis. Thank you, EPDP Phase 2 working group members
We agree with MarkSv that it’s best not to make a prediction about the outcome of our work. If we are to be explicit then we must be accurate. We have not agreed to abandon working toward a centralized SSAD model absent input from the board. In fact, we all seemed to agree to work together in good faith toward that goal. Brian J. King Director of Internet Policy and Industry Affairs T +1 443 761 3726 markmonitor.com<http://www.markmonitor.com> MarkMonitor Protecting companies and consumers in a digital world From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org> On Behalf Of Matt Serlin Sent: Wednesday, October 9, 2019 6:10 PM To: Mark Svancarek (CELA) <marksv@microsoft.com>; James M. Bladel <jbladel@godaddy.com>; gnso-epdp-team@icann.org Subject: Re: [Gnso-epdp-team] EPDP Homework: Updated Draft of Board Letter I believe including that final sentence gets at the heart of the issue with the guidance we are seeking and removing it makes the letter less impactful IMO. Yes, we think the Board and Org do know these things but I think being as explicit as possible with our words will help ensure we get the most clear answer from the Board as possible. Regards, Matt From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>> on behalf of "Mark Svancarek (CELA) via Gnso-epdp-team" <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Reply-To: "Mark Svancarek (CELA)" <marksv@microsoft.com<mailto:marksv@microsoft.com>> Date: Wednesday, October 9, 2019 at 3:35 PM To: "James M. Bladel" <jbladel@godaddy.com<mailto:jbladel@godaddy.com>>, "gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Subject: Re: [Gnso-epdp-team] EPDP Homework: Updated Draft of Board Letter I still think it’s better not to close the letter with a threat or even a prediction. The Board and Org know the critical importance of giving us a decision answering this letter. We suggest removing the final sentence. The rest of the letter is great. /marksv From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>> On Behalf Of James M. Bladel Sent: Wednesday, October 9, 2019 1:07 PM To: gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> Subject: [Gnso-epdp-team] EPDP Homework: Updated Draft of Board Letter Colleagues – Regarding the draft letter to the Board presented on Tuesday, some members were uncomfortable with the wording of the last sentence. Since that call, I’ve been working with our Board liaisons (Becky and Chris) to make some edits. The resulting Revised Draft copied below. To expedite your review, please note that only the final sentence has changed. Thanks— J. ------------- James Bladel GoDaddy Letter from EPDP 2 to ICANN Board on Standardized System for Access/Disclosure (SSAD) To: ICANN Board CC: Goran CC: GNSO Council Dear ICANN Board, We are writing to you at the suggestion of the EPDP 2 Board liaisons. The working group is at a critical junction which requires clear input from the Board in order to further our work to produce realistic, timely, implementable policy recommendations. Specifically, we seek to understand the Board’s position on the scope of operational responsibility and level of liability (related to decision-making on disclosure of non-public registration data) they are willing to accept on behalf of the ICANN organization along with any prerequisites that may need to be met in order to do so. Our goal is to avoid policy recommendations that cement the current situation, where requests for non-public registration data are handled on a case-by-case basis by the registry/registrar in a non-standardized and decentralized manner. We are considering several models for a Standardized System for Access and Disclosure (SSAD), including (but not limited to) the Unified Access Model (UAM) developed by the Technical Study Group. All of the proposed “centralized” SSAD models presume that ICANN will assume an operational role, and, depending upon the model, some degree of responsibility and liability for decisions to disclose non-public data to a third-party requester. In some models, ICANN (or its designee) would approve accrediting bodies, or function as an accrediting body themselves. Some proposed models establish ICANN (or its designee) as the entity that will conduct an initial validation of disclosure requests prior to relaying this request to the appropriate registry or registrar. Other proposed models would require ICANN to play a larger role, either endorsing the legitimacy of the request, or issuing a determination of whether or not the registrar or registry should or must disclose the non-public data to the third party requester. We recognize that our questions are clouded by the uncertainty associated with constructing a model that is compliant with the General Data Protection Regulation (GDPR) and other privacy laws. We are also aware of the work of ICANN org (via the “Strawberry Team”) to engage with data protection authorities to better understand the liability involved in decisions to disclose non-public registration data. As noted above, our goal is to produce realistic, timely, and implementable policy recommendations, and our work requires Board input on the level of involvement and amount of liability they are willing to assume for ICANN org, along with any prerequisites that may need to be met in order to do so. Absent that input, the EPDP work must abandon the centralized SSAD model, and shift its focus to policy recommendations aimed at improving the existing distributed model in which each registry and registrar independently evaluates, applies their own balancing test, and responds to queries on a case by case basis. Thank you, EPDP Phase 2 working group members
I’m not sure I follow Brian’s proposal to remove the last sentence or what is meant by taking a “leap of faith”. If our recommendations for a centralized SSAD model (an idea that seems to have achieved some level of consensus), but the Board doesn’t accept this new role for ICANN…then what? Note that this would likely come to a head in January or February, and we’d either need to convince the Board to reconsider, or have nothing to show for a year’s work. I’m a bit surprised that this outcome is a risk that the IPC or GAC/NTIA would be willing to take. The last sentence isn’t a threat or prediction. It is a direct ask of the Board to consider this question now, while we still have time to change course if they shoot down the model. J. ------------- James Bladel GoDaddy From: Matt Serlin <matt@brandsight.com> Date: Wednesday, October 9, 2019 at 17:09 To: "Mark Svancarek (CELA)" <marksv@microsoft.com>, "James M. Bladel" <jbladel@godaddy.com>, "gnso-epdp-team@icann.org" <gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] EPDP Homework: Updated Draft of Board Letter Notice: This email is from an external sender. I believe including that final sentence gets at the heart of the issue with the guidance we are seeking and removing it makes the letter less impactful IMO. Yes, we think the Board and Org do know these things but I think being as explicit as possible with our words will help ensure we get the most clear answer from the Board as possible. Regards, Matt From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org> on behalf of "Mark Svancarek (CELA) via Gnso-epdp-team" <gnso-epdp-team@icann.org> Reply-To: "Mark Svancarek (CELA)" <marksv@microsoft.com> Date: Wednesday, October 9, 2019 at 3:35 PM To: "James M. Bladel" <jbladel@godaddy.com>, "gnso-epdp-team@icann.org" <gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] EPDP Homework: Updated Draft of Board Letter I still think it’s better not to close the letter with a threat or even a prediction. The Board and Org know the critical importance of giving us a decision answering this letter. We suggest removing the final sentence. The rest of the letter is great. /marksv From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org> On Behalf Of James M. Bladel Sent: Wednesday, October 9, 2019 1:07 PM To: gnso-epdp-team@icann.org Subject: [Gnso-epdp-team] EPDP Homework: Updated Draft of Board Letter Colleagues – Regarding the draft letter to the Board presented on Tuesday, some members were uncomfortable with the wording of the last sentence. Since that call, I’ve been working with our Board liaisons (Becky and Chris) to make some edits. The resulting Revised Draft copied below. To expedite your review, please note that only the final sentence has changed. Thanks— J. ------------- James Bladel GoDaddy Letter from EPDP 2 to ICANN Board on Standardized System for Access/Disclosure (SSAD) To: ICANN Board CC: Goran CC: GNSO Council Dear ICANN Board, We are writing to you at the suggestion of the EPDP 2 Board liaisons. The working group is at a critical junction which requires clear input from the Board in order to further our work to produce realistic, timely, implementable policy recommendations. Specifically, we seek to understand the Board’s position on the scope of operational responsibility and level of liability (related to decision-making on disclosure of non-public registration data) they are willing to accept on behalf of the ICANN organization along with any prerequisites that may need to be met in order to do so. Our goal is to avoid policy recommendations that cement the current situation, where requests for non-public registration data are handled on a case-by-case basis by the registry/registrar in a non-standardized and decentralized manner. We are considering several models for a Standardized System for Access and Disclosure (SSAD), including (but not limited to) the Unified Access Model (UAM) developed by the Technical Study Group. All of the proposed “centralized” SSAD models presume that ICANN will assume an operational role, and, depending upon the model, some degree of responsibility and liability for decisions to disclose non-public data to a third-party requester. In some models, ICANN (or its designee) would approve accrediting bodies, or function as an accrediting body themselves. Some proposed models establish ICANN (or its designee) as the entity that will conduct an initial validation of disclosure requests prior to relaying this request to the appropriate registry or registrar. Other proposed models would require ICANN to play a larger role, either endorsing the legitimacy of the request, or issuing a determination of whether or not the registrar or registry should or must disclose the non-public data to the third party requester. We recognize that our questions are clouded by the uncertainty associated with constructing a model that is compliant with the General Data Protection Regulation (GDPR) and other privacy laws. We are also aware of the work of ICANN org (via the “Strawberry Team”) to engage with data protection authorities to better understand the liability involved in decisions to disclose non-public registration data. As noted above, our goal is to produce realistic, timely, and implementable policy recommendations, and our work requires Board input on the level of involvement and amount of liability they are willing to assume for ICANN org, along with any prerequisites that may need to be met in order to do so. Absent that input, the EPDP work must abandon the centralized SSAD model, and shift its focus to policy recommendations aimed at improving the existing distributed model in which each registry and registrar independently evaluates, applies their own balancing test, and responds to queries on a case by case basis. Thank you, EPDP Phase 2 working group members
You have more experience with the Board than I. The wording still seemed confrontational to me, and it wasn’t clear to me that it needed to be so in order to be impactful. I also read the last sentence as saying that there is only one possible centralized model and ICANN Board must approve it or we will abandon any further discussion of alternative centralized models. I interpreted that as a prediction of a specific policy direction to the exclusion of all others. /marksv From: James M. Bladel <jbladel@godaddy.com> Sent: Wednesday, October 9, 2019 3:28 PM To: Matt Serlin <matt@brandsight.com>; Mark Svancarek (CELA) <marksv@microsoft.com>; gnso-epdp-team@icann.org Subject: Re: [Gnso-epdp-team] EPDP Homework: Updated Draft of Board Letter I’m not sure I follow Brian’s proposal to remove the last sentence or what is meant by taking a “leap of faith”. If our recommendations for a centralized SSAD model (an idea that seems to have achieved some level of consensus), but the Board doesn’t accept this new role for ICANN…then what? Note that this would likely come to a head in January or February, and we’d either need to convince the Board to reconsider, or have nothing to show for a year’s work. I’m a bit surprised that this outcome is a risk that the IPC or GAC/NTIA would be willing to take. The last sentence isn’t a threat or prediction. It is a direct ask of the Board to consider this question now, while we still have time to change course if they shoot down the model. J. ------------- James Bladel GoDaddy From: Matt Serlin <matt@brandsight.com<mailto:matt@brandsight.com>> Date: Wednesday, October 9, 2019 at 17:09 To: "Mark Svancarek (CELA)" <marksv@microsoft.com<mailto:marksv@microsoft.com>>, "James M. Bladel" <jbladel@godaddy.com<mailto:jbladel@godaddy.com>>, "gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Subject: Re: [Gnso-epdp-team] EPDP Homework: Updated Draft of Board Letter Notice: This email is from an external sender. I believe including that final sentence gets at the heart of the issue with the guidance we are seeking and removing it makes the letter less impactful IMO. Yes, we think the Board and Org do know these things but I think being as explicit as possible with our words will help ensure we get the most clear answer from the Board as possible. Regards, Matt From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>> on behalf of "Mark Svancarek (CELA) via Gnso-epdp-team" <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Reply-To: "Mark Svancarek (CELA)" <marksv@microsoft.com<mailto:marksv@microsoft.com>> Date: Wednesday, October 9, 2019 at 3:35 PM To: "James M. Bladel" <jbladel@godaddy.com<mailto:jbladel@godaddy.com>>, "gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Subject: Re: [Gnso-epdp-team] EPDP Homework: Updated Draft of Board Letter I still think it’s better not to close the letter with a threat or even a prediction. The Board and Org know the critical importance of giving us a decision answering this letter. We suggest removing the final sentence. The rest of the letter is great. /marksv From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>> On Behalf Of James M. Bladel Sent: Wednesday, October 9, 2019 1:07 PM To: gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> Subject: [Gnso-epdp-team] EPDP Homework: Updated Draft of Board Letter Colleagues – Regarding the draft letter to the Board presented on Tuesday, some members were uncomfortable with the wording of the last sentence. Since that call, I’ve been working with our Board liaisons (Becky and Chris) to make some edits. The resulting Revised Draft copied below. To expedite your review, please note that only the final sentence has changed. Thanks— J. ------------- James Bladel GoDaddy Letter from EPDP 2 to ICANN Board on Standardized System for Access/Disclosure (SSAD) To: ICANN Board CC: Goran CC: GNSO Council Dear ICANN Board, We are writing to you at the suggestion of the EPDP 2 Board liaisons. The working group is at a critical junction which requires clear input from the Board in order to further our work to produce realistic, timely, implementable policy recommendations. Specifically, we seek to understand the Board’s position on the scope of operational responsibility and level of liability (related to decision-making on disclosure of non-public registration data) they are willing to accept on behalf of the ICANN organization along with any prerequisites that may need to be met in order to do so. Our goal is to avoid policy recommendations that cement the current situation, where requests for non-public registration data are handled on a case-by-case basis by the registry/registrar in a non-standardized and decentralized manner. We are considering several models for a Standardized System for Access and Disclosure (SSAD), including (but not limited to) the Unified Access Model (UAM) developed by the Technical Study Group. All of the proposed “centralized” SSAD models presume that ICANN will assume an operational role, and, depending upon the model, some degree of responsibility and liability for decisions to disclose non-public data to a third-party requester. In some models, ICANN (or its designee) would approve accrediting bodies, or function as an accrediting body themselves. Some proposed models establish ICANN (or its designee) as the entity that will conduct an initial validation of disclosure requests prior to relaying this request to the appropriate registry or registrar. Other proposed models would require ICANN to play a larger role, either endorsing the legitimacy of the request, or issuing a determination of whether or not the registrar or registry should or must disclose the non-public data to the third party requester. We recognize that our questions are clouded by the uncertainty associated with constructing a model that is compliant with the General Data Protection Regulation (GDPR) and other privacy laws. We are also aware of the work of ICANN org (via the “Strawberry Team”) to engage with data protection authorities to better understand the liability involved in decisions to disclose non-public registration data. As noted above, our goal is to produce realistic, timely, and implementable policy recommendations, and our work requires Board input on the level of involvement and amount of liability they are willing to assume for ICANN org, along with any prerequisites that may need to be met in order to do so. Absent that input, the EPDP work must abandon the centralized SSAD model, and shift its focus to policy recommendations aimed at improving the existing distributed model in which each registry and registrar independently evaluates, applies their own balancing test, and responds to queries on a case by case basis. Thank you, EPDP Phase 2 working group members
Hi James, Sorry I wasn’t more clear. I think we’re actually on the same page here. We should absolutely tell the board what we’re considering, explain what it requires of ICANN, and ask for “Board input on the level of involvement and amount of liability they are willing to assume for ICANN org” as the penultimate sentence requests. My point on the last sentence is that we’re not ready to say what we might do if the Board fails to respond at all, or if the Board tells us they’re unwilling to accept such an outcome. It seems we don’t have consensus on that (and I really hope it doesn’t come to that). Since we don’t have consensus on that, let’s scrap it. The rest of the letter is fantastic. So let’s avoid that January/February scenario by asking the question in a way we all agree on, and let’s ask it now. Brian J. King Director of Internet Policy and Industry Affairs T +1 443 761 3726 markmonitor.com<http://www.markmonitor.com> MarkMonitor Protecting companies and consumers in a digital world From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org> On Behalf Of James M. Bladel Sent: Wednesday, October 9, 2019 6:28 PM To: Matt Serlin <matt@brandsight.com>; Mark Svancarek (CELA) <marksv@microsoft.com>; gnso-epdp-team@icann.org Subject: Re: [Gnso-epdp-team] EPDP Homework: Updated Draft of Board Letter I’m not sure I follow Brian’s proposal to remove the last sentence or what is meant by taking a “leap of faith”. If our recommendations for a centralized SSAD model (an idea that seems to have achieved some level of consensus), but the Board doesn’t accept this new role for ICANN…then what? Note that this would likely come to a head in January or February, and we’d either need to convince the Board to reconsider, or have nothing to show for a year’s work. I’m a bit surprised that this outcome is a risk that the IPC or GAC/NTIA would be willing to take. The last sentence isn’t a threat or prediction. It is a direct ask of the Board to consider this question now, while we still have time to change course if they shoot down the model. J. ------------- James Bladel GoDaddy From: Matt Serlin <matt@brandsight.com<mailto:matt@brandsight.com>> Date: Wednesday, October 9, 2019 at 17:09 To: "Mark Svancarek (CELA)" <marksv@microsoft.com<mailto:marksv@microsoft.com>>, "James M. Bladel" <jbladel@godaddy.com<mailto:jbladel@godaddy.com>>, "gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Subject: Re: [Gnso-epdp-team] EPDP Homework: Updated Draft of Board Letter Notice: This email is from an external sender. I believe including that final sentence gets at the heart of the issue with the guidance we are seeking and removing it makes the letter less impactful IMO. Yes, we think the Board and Org do know these things but I think being as explicit as possible with our words will help ensure we get the most clear answer from the Board as possible. Regards, Matt From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>> on behalf of "Mark Svancarek (CELA) via Gnso-epdp-team" <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Reply-To: "Mark Svancarek (CELA)" <marksv@microsoft.com<mailto:marksv@microsoft.com>> Date: Wednesday, October 9, 2019 at 3:35 PM To: "James M. Bladel" <jbladel@godaddy.com<mailto:jbladel@godaddy.com>>, "gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Subject: Re: [Gnso-epdp-team] EPDP Homework: Updated Draft of Board Letter I still think it’s better not to close the letter with a threat or even a prediction. The Board and Org know the critical importance of giving us a decision answering this letter. We suggest removing the final sentence. The rest of the letter is great. /marksv From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>> On Behalf Of James M. Bladel Sent: Wednesday, October 9, 2019 1:07 PM To: gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> Subject: [Gnso-epdp-team] EPDP Homework: Updated Draft of Board Letter Colleagues – Regarding the draft letter to the Board presented on Tuesday, some members were uncomfortable with the wording of the last sentence. Since that call, I’ve been working with our Board liaisons (Becky and Chris) to make some edits. The resulting Revised Draft copied below. To expedite your review, please note that only the final sentence has changed. Thanks— J. ------------- James Bladel GoDaddy Letter from EPDP 2 to ICANN Board on Standardized System for Access/Disclosure (SSAD) To: ICANN Board CC: Goran CC: GNSO Council Dear ICANN Board, We are writing to you at the suggestion of the EPDP 2 Board liaisons. The working group is at a critical junction which requires clear input from the Board in order to further our work to produce realistic, timely, implementable policy recommendations. Specifically, we seek to understand the Board’s position on the scope of operational responsibility and level of liability (related to decision-making on disclosure of non-public registration data) they are willing to accept on behalf of the ICANN organization along with any prerequisites that may need to be met in order to do so. Our goal is to avoid policy recommendations that cement the current situation, where requests for non-public registration data are handled on a case-by-case basis by the registry/registrar in a non-standardized and decentralized manner. We are considering several models for a Standardized System for Access and Disclosure (SSAD), including (but not limited to) the Unified Access Model (UAM) developed by the Technical Study Group. All of the proposed “centralized” SSAD models presume that ICANN will assume an operational role, and, depending upon the model, some degree of responsibility and liability for decisions to disclose non-public data to a third-party requester. In some models, ICANN (or its designee) would approve accrediting bodies, or function as an accrediting body themselves. Some proposed models establish ICANN (or its designee) as the entity that will conduct an initial validation of disclosure requests prior to relaying this request to the appropriate registry or registrar. Other proposed models would require ICANN to play a larger role, either endorsing the legitimacy of the request, or issuing a determination of whether or not the registrar or registry should or must disclose the non-public data to the third party requester. We recognize that our questions are clouded by the uncertainty associated with constructing a model that is compliant with the General Data Protection Regulation (GDPR) and other privacy laws. We are also aware of the work of ICANN org (via the “Strawberry Team”) to engage with data protection authorities to better understand the liability involved in decisions to disclose non-public registration data. As noted above, our goal is to produce realistic, timely, and implementable policy recommendations, and our work requires Board input on the level of involvement and amount of liability they are willing to assume for ICANN org, along with any prerequisites that may need to be met in order to do so. Absent that input, the EPDP work must abandon the centralized SSAD model, and shift its focus to policy recommendations aimed at improving the existing distributed model in which each registry and registrar independently evaluates, applies their own balancing test, and responds to queries on a case by case basis. Thank you, EPDP Phase 2 working group members
Dear Team members, Seems that divergence of views on the last sentence persist. Therefore, in my capacity of facilitator of the Team conversation, I propose to end the letter by simple courtesy phrase: *Reply to this latter would greatly facilitate the work of the Team towards Initial Report.* Pls consider this proposal by our call. If objection will be made, we will let the last sentence out of the text. Thank you JK On Thu, Oct 10, 2019 at 1:01 AM King, Brian via Gnso-epdp-team < gnso-epdp-team@icann.org> wrote:
Hi James,
Sorry I wasn’t more clear. I think we’re actually on the same page here.
We should absolutely tell the board what we’re considering, explain what it requires of ICANN, and ask for “Board input on the level of involvement and amount of liability they are willing to assume for ICANN org” as the penultimate sentence requests.
My point on the last sentence is that we’re not ready to say what we might do if the Board fails to respond at all, or if the Board tells us they’re unwilling to accept such an outcome. It seems we don’t have consensus on that (and I really hope it doesn’t come to that). Since we don’t have consensus on that, let’s scrap it. The rest of the letter is fantastic.
So let’s avoid that January/February scenario by asking the question in a way we all agree on, and let’s ask it now.
*Brian J. King * Director of Internet Policy and Industry Affairs
T +1 443 761 3726 * markmonitor.com <http://www.markmonitor.com>*
*MarkMonitor *Protecting companies and consumers in a digital world
*From:* Gnso-epdp-team <gnso-epdp-team-bounces@icann.org> *On Behalf Of *James M. Bladel *Sent:* Wednesday, October 9, 2019 6:28 PM *To:* Matt Serlin <matt@brandsight.com>; Mark Svancarek (CELA) < marksv@microsoft.com>; gnso-epdp-team@icann.org *Subject:* Re: [Gnso-epdp-team] EPDP Homework: Updated Draft of Board Letter
I’m not sure I follow Brian’s proposal to remove the last sentence or what is meant by taking a “leap of faith”.
If our recommendations for a centralized SSAD model (an idea that seems to have achieved some level of consensus), but the Board doesn’t accept this new role for ICANN…then what? Note that this would likely come to a head in January or February, and we’d either need to convince the Board to reconsider, or have nothing to show for a year’s work. I’m a bit surprised that this outcome is a risk that the IPC or GAC/NTIA would be willing to take.
The last sentence isn’t a threat or prediction. It is a direct ask of the Board to consider this question *now*, while we still have time to change course if they shoot down the model.
J.
-------------
*James Bladel*
GoDaddy
*From: *Matt Serlin <matt@brandsight.com> *Date: *Wednesday, October 9, 2019 at 17:09 *To: *"Mark Svancarek (CELA)" <marksv@microsoft.com>, "James M. Bladel" < jbladel@godaddy.com>, "gnso-epdp-team@icann.org" <gnso-epdp-team@icann.org
*Subject: *Re: [Gnso-epdp-team] EPDP Homework: Updated Draft of Board Letter
Notice: This email is from an external sender.
I believe including that final sentence gets at the heart of the issue with the guidance we are seeking and removing it makes the letter less impactful IMO.
Yes, we think the Board and Org do know these things but I think being as explicit as possible with our words will help ensure we get the most clear answer from the Board as possible.
Regards,
Matt
*From: *Gnso-epdp-team <gnso-epdp-team-bounces@icann.org> on behalf of "Mark Svancarek (CELA) via Gnso-epdp-team" <gnso-epdp-team@icann.org> *Reply-To: *"Mark Svancarek (CELA)" <marksv@microsoft.com> *Date: *Wednesday, October 9, 2019 at 3:35 PM *To: *"James M. Bladel" <jbladel@godaddy.com>, "gnso-epdp-team@icann.org" <gnso-epdp-team@icann.org> *Subject: *Re: [Gnso-epdp-team] EPDP Homework: Updated Draft of Board Letter
I still think it’s better not to close the letter with a threat or even a prediction. The Board and Org know the critical importance of giving us a decision answering this letter.
We suggest removing the final sentence. The rest of the letter is great.
/marksv
*From:* Gnso-epdp-team <gnso-epdp-team-bounces@icann.org> *On Behalf Of *James M. Bladel *Sent:* Wednesday, October 9, 2019 1:07 PM *To:* gnso-epdp-team@icann.org *Subject:* [Gnso-epdp-team] EPDP Homework: Updated Draft of Board Letter
Colleagues –
Regarding the draft letter to the Board presented on Tuesday, some members were uncomfortable with the wording of the last sentence. Since that call, I’ve been working with our Board liaisons (Becky and Chris) to make some edits. The resulting Revised Draft copied below. To expedite your review, please note that only the final sentence has changed.
Thanks—
J.
-------------
*James Bladel*
GoDaddy
Letter from EPDP 2 to ICANN Board on Standardized System for Access/Disclosure (SSAD)
To: ICANN Board CC: Goran CC: GNSO Council
Dear ICANN Board,
We are writing to you at the suggestion of the EPDP 2 Board liaisons. The working group is at a critical junction which requires clear input from the Board in order to further our work to produce realistic, timely, implementable policy recommendations. Specifically, we seek to understand the Board’s position on the scope of operational responsibility and level of liability (related to decision-making on disclosure of non-public registration data) they are willing to accept on behalf of the ICANN organization along with any prerequisites that may need to be met in order to do so.
Our goal is to avoid policy recommendations that cement the current situation, where requests for non-public registration data are handled on a case-by-case basis by the registry/registrar in a non-standardized and decentralized manner. We are considering several models for a Standardized System for Access and Disclosure (SSAD), including (but not limited to) the Unified Access Model (UAM) developed by the Technical Study Group. All of the proposed “centralized” SSAD models presume that ICANN will assume an operational role, and, depending upon the model, some degree of responsibility and liability for decisions to disclose non-public data to a third-party requester.
In some models, ICANN (or its designee) would approve accrediting bodies, or function as an accrediting body themselves. Some proposed models establish ICANN (or its designee) as the entity that will conduct an initial validation of disclosure requests prior to relaying this request to the appropriate registry or registrar. Other proposed models would require ICANN to play a larger role, either endorsing the legitimacy of the request, or issuing a determination of whether or not the registrar or registry should or must disclose the non-public data to the third party requester.
We recognize that our questions are clouded by the uncertainty associated with constructing a model that is compliant with the General Data Protection Regulation (GDPR) and other privacy laws. We are also aware of the work of ICANN org (via the “Strawberry Team”) to engage with data protection authorities to better understand the liability involved in decisions to disclose non-public registration data. As noted above, our goal is to produce realistic, timely, and implementable policy recommendations, and our work requires Board input on the level of involvement and amount of liability they are willing to assume for ICANN org, along with any prerequisites that may need to be met in order to do so.
Absent that input, the EPDP work must abandon the centralized SSAD model, and shift its focus to policy recommendations aimed at improving the existing distributed model in which each registry and registrar independently evaluates, applies their own balancing test, and responds to queries on a case by case basis.
Thank you,
EPDP Phase 2 working group members
_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.
That language works for me Janis. Thank you. Brian J. King Director of Internet Policy and Industry Affairs MarkMonitor / Part of Clarivate Analytics Phone: +1 (443) 761-3726 brian.king@markmonitor.com On Oct 10, 2019, at 7:47 AM, Janis Karklins <karklinsj@gmail.com> wrote: Dear Team members, Seems that divergence of views on the last sentence persist. Therefore, in my capacity of facilitator of the Team conversation, I propose to end the letter by simple courtesy phrase: Reply to this latter would greatly facilitate the work of the Team towards Initial Report. Pls consider this proposal by our call. If objection will be made, we will let the last sentence out of the text. Thank you JK On Thu, Oct 10, 2019 at 1:01 AM King, Brian via Gnso-epdp-team <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> wrote: Hi James, Sorry I wasn’t more clear. I think we’re actually on the same page here. We should absolutely tell the board what we’re considering, explain what it requires of ICANN, and ask for “Board input on the level of involvement and amount of liability they are willing to assume for ICANN org” as the penultimate sentence requests. My point on the last sentence is that we’re not ready to say what we might do if the Board fails to respond at all, or if the Board tells us they’re unwilling to accept such an outcome. It seems we don’t have consensus on that (and I really hope it doesn’t come to that). Since we don’t have consensus on that, let’s scrap it. The rest of the letter is fantastic. So let’s avoid that January/February scenario by asking the question in a way we all agree on, and let’s ask it now. Brian J. King Director of Internet Policy and Industry Affairs T +1 443 761 3726 markmonitor.com<http://www.markmonitor.com> MarkMonitor Protecting companies and consumers in a digital world From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>> On Behalf Of James M. Bladel Sent: Wednesday, October 9, 2019 6:28 PM To: Matt Serlin <matt@brandsight.com<mailto:matt@brandsight.com>>; Mark Svancarek (CELA) <marksv@microsoft.com<mailto:marksv@microsoft.com>>; gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] EPDP Homework: Updated Draft of Board Letter I’m not sure I follow Brian’s proposal to remove the last sentence or what is meant by taking a “leap of faith”. If our recommendations for a centralized SSAD model (an idea that seems to have achieved some level of consensus), but the Board doesn’t accept this new role for ICANN…then what? Note that this would likely come to a head in January or February, and we’d either need to convince the Board to reconsider, or have nothing to show for a year’s work. I’m a bit surprised that this outcome is a risk that the IPC or GAC/NTIA would be willing to take. The last sentence isn’t a threat or prediction. It is a direct ask of the Board to consider this question now, while we still have time to change course if they shoot down the model. J. ------------- James Bladel GoDaddy From: Matt Serlin <matt@brandsight.com<mailto:matt@brandsight.com>> Date: Wednesday, October 9, 2019 at 17:09 To: "Mark Svancarek (CELA)" <marksv@microsoft.com<mailto:marksv@microsoft.com>>, "James M. Bladel" <jbladel@godaddy.com<mailto:jbladel@godaddy.com>>, "gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Subject: Re: [Gnso-epdp-team] EPDP Homework: Updated Draft of Board Letter Notice: This email is from an external sender. I believe including that final sentence gets at the heart of the issue with the guidance we are seeking and removing it makes the letter less impactful IMO. Yes, we think the Board and Org do know these things but I think being as explicit as possible with our words will help ensure we get the most clear answer from the Board as possible. Regards, Matt From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>> on behalf of "Mark Svancarek (CELA) via Gnso-epdp-team" <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Reply-To: "Mark Svancarek (CELA)" <marksv@microsoft.com<mailto:marksv@microsoft.com>> Date: Wednesday, October 9, 2019 at 3:35 PM To: "James M. Bladel" <jbladel@godaddy.com<mailto:jbladel@godaddy.com>>, "gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Subject: Re: [Gnso-epdp-team] EPDP Homework: Updated Draft of Board Letter I still think it’s better not to close the letter with a threat or even a prediction. The Board and Org know the critical importance of giving us a decision answering this letter. We suggest removing the final sentence. The rest of the letter is great. /marksv From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>> On Behalf Of James M. Bladel Sent: Wednesday, October 9, 2019 1:07 PM To: gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> Subject: [Gnso-epdp-team] EPDP Homework: Updated Draft of Board Letter Colleagues – Regarding the draft letter to the Board presented on Tuesday, some members were uncomfortable with the wording of the last sentence. Since that call, I’ve been working with our Board liaisons (Becky and Chris) to make some edits. The resulting Revised Draft copied below. To expedite your review, please note that only the final sentence has changed. Thanks— J. ------------- James Bladel GoDaddy Letter from EPDP 2 to ICANN Board on Standardized System for Access/Disclosure (SSAD) To: ICANN Board CC: Goran CC: GNSO Council Dear ICANN Board, We are writing to you at the suggestion of the EPDP 2 Board liaisons. The working group is at a critical junction which requires clear input from the Board in order to further our work to produce realistic, timely, implementable policy recommendations. Specifically, we seek to understand the Board’s position on the scope of operational responsibility and level of liability (related to decision-making on disclosure of non-public registration data) they are willing to accept on behalf of the ICANN organization along with any prerequisites that may need to be met in order to do so. Our goal is to avoid policy recommendations that cement the current situation, where requests for non-public registration data are handled on a case-by-case basis by the registry/registrar in a non-standardized and decentralized manner. We are considering several models for a Standardized System for Access and Disclosure (SSAD), including (but not limited to) the Unified Access Model (UAM) developed by the Technical Study Group. All of the proposed “centralized” SSAD models presume that ICANN will assume an operational role, and, depending upon the model, some degree of responsibility and liability for decisions to disclose non-public data to a third-party requester. In some models, ICANN (or its designee) would approve accrediting bodies, or function as an accrediting body themselves. Some proposed models establish ICANN (or its designee) as the entity that will conduct an initial validation of disclosure requests prior to relaying this request to the appropriate registry or registrar. Other proposed models would require ICANN to play a larger role, either endorsing the legitimacy of the request, or issuing a determination of whether or not the registrar or registry should or must disclose the non-public data to the third party requester. We recognize that our questions are clouded by the uncertainty associated with constructing a model that is compliant with the General Data Protection Regulation (GDPR) and other privacy laws. We are also aware of the work of ICANN org (via the “Strawberry Team”) to engage with data protection authorities to better understand the liability involved in decisions to disclose non-public registration data. As noted above, our goal is to produce realistic, timely, and implementable policy recommendations, and our work requires Board input on the level of involvement and amount of liability they are willing to assume for ICANN org, along with any prerequisites that may need to be met in order to do so. Absent that input, the EPDP work must abandon the centralized SSAD model, and shift its focus to policy recommendations aimed at improving the existing distributed model in which each registry and registrar independently evaluates, applies their own balancing test, and responds to queries on a case by case basis. Thank you, EPDP Phase 2 working group members _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team<https://urldefense.proofpoint.com/v2/url?u=https-3A__mm.icann.org_mailman_listinfo_gnso-2Depdp-2Dteam&d=DwMFaQ&c=OGmtg_3SI10Cogwk-ShFiw&r=qQNCXqU_XE2XIdXbawYmk-YDflYH6pd8ffXlzxU37OA&m=6jHgFBo1JvL8_odK99k_IBJ0sajT80-asOIFeDKuXqk&s=1KTRstjR0KBHY1TAboQDRB801lV7kBY52xWtnxYTUHc&e=> _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_privacy_policy&d=DwMFaQ&c=OGmtg_3SI10Cogwk-ShFiw&r=qQNCXqU_XE2XIdXbawYmk-YDflYH6pd8ffXlzxU37OA&m=6jHgFBo1JvL8_odK99k_IBJ0sajT80-asOIFeDKuXqk&s=_4ZsuDoQypZI8VBAqIczHaDIiv-MqmrbhWDMEhov3Qo&e=>) and the website Terms of Service (https://www.icann.org/privacy/tos<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_privacy_tos&d=DwMFaQ&c=OGmtg_3SI10Cogwk-ShFiw&r=qQNCXqU_XE2XIdXbawYmk-YDflYH6pd8ffXlzxU37OA&m=6jHgFBo1JvL8_odK99k_IBJ0sajT80-asOIFeDKuXqk&s=a-OV9MDkgyODconcmKiiK379utU813pd0FLUwvIukTo&e=>). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.
Hi, I’m more comfortable with the revised last sentence that James recently shared. It’s far more clear, and far less ambiguous, and provides the Board members with a tangible consequence to their feedback, which I believe should be helpful to them. If the Board is not clear with us on its ability to accept some level of operational responsibility and legal liability regarding decisions to disclose personal information via the SSAD, which it can communicate to us, then I’m not sure how we can or why we should proceed to develop policy recommendations for a centralized model. However, if we are not in a position to agree on this just yet, I still don’t believe we should toss out the entirety of the last sentence altogether. Perhaps replace “abandon” with something along the lines of us re-evaluating our direction in providing recommendations towards a centralized model? Thanks. Amr
On Oct 10, 2019, at 1:47 PM, Janis Karklins <karklinsj@gmail.com> wrote:
Dear Team members, Seems that divergence of views on the last sentence persist. Therefore, in my capacity of facilitator of the Team conversation, I propose to end the letter by simple courtesy phrase: Reply to this latter would greatly facilitate the work of the Team towards Initial Report. Pls consider this proposal by our call. If objection will be made, we will let the last sentence out of the text. Thank you JK
On Thu, Oct 10, 2019 at 1:01 AM King, Brian via Gnso-epdp-team <gnso-epdp-team@icann.org> wrote:
Hi James,
Sorry I wasn’t more clear. I think we’re actually on the same page here.
We should absolutely tell the board what we’re considering, explain what it requires of ICANN, and ask for “Board input on the level of involvement and amount of liability they are willing to assume for ICANN org” as the penultimate sentence requests.
My point on the last sentence is that we’re not ready to say what we might do if the Board fails to respond at all, or if the Board tells us they’re unwilling to accept such an outcome. It seems we don’t have consensus on that (and I really hope it doesn’t come to that). Since we don’t have consensus on that, let’s scrap it. The rest of the letter is fantastic.
So let’s avoid that January/February scenario by asking the question in a way we all agree on, and let’s ask it now.
Brian J. King Director of Internet Policy and Industry Affairs
T +1 443 761 3726[markmonitor.com](http://www.markmonitor.com/)
MarkMonitorProtecting companies and consumers in a digital world
From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org> On Behalf Of James M. Bladel Sent: Wednesday, October 9, 2019 6:28 PM To: Matt Serlin <matt@brandsight.com>; Mark Svancarek (CELA) <marksv@microsoft.com>; gnso-epdp-team@icann.org Subject: Re: [Gnso-epdp-team] EPDP Homework: Updated Draft of Board Letter
I’m not sure I follow Brian’s proposal to remove the last sentence or what is meant by taking a “leap of faith”.
If our recommendations for a centralized SSAD model (an idea that seems to have achieved some level of consensus), but the Board doesn’t accept this new role for ICANN…then what? Note that this would likely come to a head in January or February, and we’d either need to convince the Board to reconsider, or have nothing to show for a year’s work. I’m a bit surprised that this outcome is a risk that the IPC or GAC/NTIA would be willing to take.
The last sentence isn’t a threat or prediction. It is a direct ask of the Board to consider this question now, while we still have time to change course if they shoot down the model.
J.
-------------
James Bladel
GoDaddy
From: Matt Serlin <matt@brandsight.com> Date: Wednesday, October 9, 2019 at 17:09 To: "Mark Svancarek (CELA)" <marksv@microsoft.com>, "James M. Bladel" <jbladel@godaddy.com>, "gnso-epdp-team@icann.org" <gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] EPDP Homework: Updated Draft of Board Letter
Notice:This email is from an external sender.
I believe including that final sentence gets at the heart of the issue with the guidance we are seeking and removing it makes the letter less impactful IMO.
Yes, we think the Board and Org do know these things but I think being as explicit as possible with our words will help ensure we get the most clear answer from the Board as possible.
Regards,
Matt
From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org> on behalf of "Mark Svancarek (CELA) via Gnso-epdp-team" <gnso-epdp-team@icann.org> Reply-To: "Mark Svancarek (CELA)" <marksv@microsoft.com> Date: Wednesday, October 9, 2019 at 3:35 PM To: "James M. Bladel" <jbladel@godaddy.com>, "gnso-epdp-team@icann.org" <gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] EPDP Homework: Updated Draft of Board Letter
I still think it’s better not to close the letter with a threat or even a prediction. The Board and Org know the critical importance of giving us a decision answering this letter.
We suggest removing the final sentence. The rest of the letter is great.
/marksv
From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org> On Behalf Of James M. Bladel Sent: Wednesday, October 9, 2019 1:07 PM To: gnso-epdp-team@icann.org Subject: [Gnso-epdp-team] EPDP Homework: Updated Draft of Board Letter
Colleagues –
Regarding the draft letter to the Board presented on Tuesday, some members were uncomfortable with the wording of the last sentence. Since that call, I’ve been working with our Board liaisons (Becky and Chris) to make some edits. The resulting Revised Draft copied below. To expedite your review, please note that only the final sentence has changed.
Thanks—
J.
-------------
James Bladel
GoDaddy
Letter from EPDP 2 to ICANN Board on Standardized System for Access/Disclosure (SSAD)
To: ICANN Board CC: Goran CC: GNSO Council
Dear ICANN Board,
We are writing to you at the suggestion of the EPDP 2 Board liaisons. The working group is at a critical junction which requires clear input from the Board in order to further our work to produce realistic, timely, implementable policy recommendations. Specifically, we seek to understand the Board’s position on the scope of operational responsibility and level of liability (related to decision-making on disclosure of non-public registration data) they are willing to accept on behalf of the ICANN organization along with any prerequisites that may need to be met in order to do so.
Our goal is to avoid policy recommendations that cement the current situation, where requests for non-public registration data are handled on a case-by-case basis by the registry/registrar in a non-standardized and decentralized manner. We are considering several models for a Standardized System for Access and Disclosure (SSAD), including (but not limited to) the Unified Access Model (UAM) developed by the Technical Study Group. All of the proposed “centralized” SSAD models presume that ICANN will assume an operational role, and, depending upon the model, some degree of responsibility and liability for decisions to disclose non-public data to a third-party requester.
In some models, ICANN (or its designee) would approve accrediting bodies, or function as an accrediting body themselves. Some proposed models establish ICANN (or its designee) as the entity that will conduct an initial validation of disclosure requests prior to relaying this request to the appropriate registry or registrar. Other proposed models would require ICANN to play a larger role, either endorsing the legitimacy of the request, or issuing a determination of whether or not the registrar or registry should or must disclose the non-public data to the third party requester.
We recognize that our questions are clouded by the uncertainty associated with constructing a model that is compliant with the General Data Protection Regulation (GDPR) and other privacy laws. We are also aware of the work of ICANN org (via the “Strawberry Team”) to engage with data protection authorities to better understand the liability involved in decisions to disclose non-public registration data. As noted above, our goal is to produce realistic, timely, and implementable policy recommendations, and our work requires Board input on the level of involvement and amount of liability they are willing to assume for ICANN org, along with any prerequisites that may need to be met in order to do so.
Absent that input, the EPDP work must abandon the centralized SSAD model, and shift its focus to policy recommendations aimed at improving the existing distributed model in which each registry and registrar independently evaluates, applies their own balancing test, and responds to queries on a case by case basis.
Thank you,
EPDP Phase 2 working group members
_______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org https://mm.icann.org/mailman/listinfo/gnso-epdp-team _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.
Hello Janis – I appreciate your efforts to find a way forward, but if fail to present a direct question on Org risk to the Board, then I think we should reconsider the value of sending the letter at all. But let’s discuss on today’s call. Thanks— J. ------------- James Bladel GoDaddy From: Janis Karklins <karklinsj@gmail.com> Date: Thursday, October 10, 2019 at 06:47 To: "King, Brian" <Brian.King@markmonitor.com> Cc: "James M. Bladel" <jbladel@godaddy.com>, Matt Serlin <matt@brandsight.com>, "Mark Svancarek (CELA)" <marksv@microsoft.com>, "gnso-epdp-team@icann.org" <gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] EPDP Homework: Updated Draft of Board Letter Notice: This email is from an external sender. Dear Team members, Seems that divergence of views on the last sentence persist. Therefore, in my capacity of facilitator of the Team conversation, I propose to end the letter by simple courtesy phrase: Reply to this latter would greatly facilitate the work of the Team towards Initial Report. Pls consider this proposal by our call. If objection will be made, we will let the last sentence out of the text. Thank you JK On Thu, Oct 10, 2019 at 1:01 AM King, Brian via Gnso-epdp-team <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> wrote: Hi James, Sorry I wasn’t more clear. I think we’re actually on the same page here. We should absolutely tell the board what we’re considering, explain what it requires of ICANN, and ask for “Board input on the level of involvement and amount of liability they are willing to assume for ICANN org” as the penultimate sentence requests. My point on the last sentence is that we’re not ready to say what we might do if the Board fails to respond at all, or if the Board tells us they’re unwilling to accept such an outcome. It seems we don’t have consensus on that (and I really hope it doesn’t come to that). Since we don’t have consensus on that, let’s scrap it. The rest of the letter is fantastic. So let’s avoid that January/February scenario by asking the question in a way we all agree on, and let’s ask it now. Brian J. King Director of Internet Policy and Industry Affairs T +1 443 761 3726 markmonitor.com<http://www.markmonitor.com> MarkMonitor Protecting companies and consumers in a digital world From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>> On Behalf Of James M. Bladel Sent: Wednesday, October 9, 2019 6:28 PM To: Matt Serlin <matt@brandsight.com<mailto:matt@brandsight.com>>; Mark Svancarek (CELA) <marksv@microsoft.com<mailto:marksv@microsoft.com>>; gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] EPDP Homework: Updated Draft of Board Letter I’m not sure I follow Brian’s proposal to remove the last sentence or what is meant by taking a “leap of faith”. If our recommendations for a centralized SSAD model (an idea that seems to have achieved some level of consensus), but the Board doesn’t accept this new role for ICANN…then what? Note that this would likely come to a head in January or February, and we’d either need to convince the Board to reconsider, or have nothing to show for a year’s work. I’m a bit surprised that this outcome is a risk that the IPC or GAC/NTIA would be willing to take. The last sentence isn’t a threat or prediction. It is a direct ask of the Board to consider this question now, while we still have time to change course if they shoot down the model. J. ------------- James Bladel GoDaddy From: Matt Serlin <matt@brandsight.com<mailto:matt@brandsight.com>> Date: Wednesday, October 9, 2019 at 17:09 To: "Mark Svancarek (CELA)" <marksv@microsoft.com<mailto:marksv@microsoft.com>>, "James M. Bladel" <jbladel@godaddy.com<mailto:jbladel@godaddy.com>>, "gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Subject: Re: [Gnso-epdp-team] EPDP Homework: Updated Draft of Board Letter Notice: This email is from an external sender. I believe including that final sentence gets at the heart of the issue with the guidance we are seeking and removing it makes the letter less impactful IMO. Yes, we think the Board and Org do know these things but I think being as explicit as possible with our words will help ensure we get the most clear answer from the Board as possible. Regards, Matt From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>> on behalf of "Mark Svancarek (CELA) via Gnso-epdp-team" <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Reply-To: "Mark Svancarek (CELA)" <marksv@microsoft.com<mailto:marksv@microsoft.com>> Date: Wednesday, October 9, 2019 at 3:35 PM To: "James M. Bladel" <jbladel@godaddy.com<mailto:jbladel@godaddy.com>>, "gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Subject: Re: [Gnso-epdp-team] EPDP Homework: Updated Draft of Board Letter I still think it’s better not to close the letter with a threat or even a prediction. The Board and Org know the critical importance of giving us a decision answering this letter. We suggest removing the final sentence. The rest of the letter is great. /marksv From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>> On Behalf Of James M. Bladel Sent: Wednesday, October 9, 2019 1:07 PM To: gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> Subject: [Gnso-epdp-team] EPDP Homework: Updated Draft of Board Letter Colleagues – Regarding the draft letter to the Board presented on Tuesday, some members were uncomfortable with the wording of the last sentence. Since that call, I’ve been working with our Board liaisons (Becky and Chris) to make some edits. The resulting Revised Draft copied below. To expedite your review, please note that only the final sentence has changed. Thanks— J. ------------- James Bladel GoDaddy Letter from EPDP 2 to ICANN Board on Standardized System for Access/Disclosure (SSAD) To: ICANN Board CC: Goran CC: GNSO Council Dear ICANN Board, We are writing to you at the suggestion of the EPDP 2 Board liaisons. The working group is at a critical junction which requires clear input from the Board in order to further our work to produce realistic, timely, implementable policy recommendations. Specifically, we seek to understand the Board’s position on the scope of operational responsibility and level of liability (related to decision-making on disclosure of non-public registration data) they are willing to accept on behalf of the ICANN organization along with any prerequisites that may need to be met in order to do so. Our goal is to avoid policy recommendations that cement the current situation, where requests for non-public registration data are handled on a case-by-case basis by the registry/registrar in a non-standardized and decentralized manner. We are considering several models for a Standardized System for Access and Disclosure (SSAD), including (but not limited to) the Unified Access Model (UAM) developed by the Technical Study Group. All of the proposed “centralized” SSAD models presume that ICANN will assume an operational role, and, depending upon the model, some degree of responsibility and liability for decisions to disclose non-public data to a third-party requester. In some models, ICANN (or its designee) would approve accrediting bodies, or function as an accrediting body themselves. Some proposed models establish ICANN (or its designee) as the entity that will conduct an initial validation of disclosure requests prior to relaying this request to the appropriate registry or registrar. Other proposed models would require ICANN to play a larger role, either endorsing the legitimacy of the request, or issuing a determination of whether or not the registrar or registry should or must disclose the non-public data to the third party requester. We recognize that our questions are clouded by the uncertainty associated with constructing a model that is compliant with the General Data Protection Regulation (GDPR) and other privacy laws. We are also aware of the work of ICANN org (via the “Strawberry Team”) to engage with data protection authorities to better understand the liability involved in decisions to disclose non-public registration data. As noted above, our goal is to produce realistic, timely, and implementable policy recommendations, and our work requires Board input on the level of involvement and amount of liability they are willing to assume for ICANN org, along with any prerequisites that may need to be met in order to do so. Absent that input, the EPDP work must abandon the centralized SSAD model, and shift its focus to policy recommendations aimed at improving the existing distributed model in which each registry and registrar independently evaluates, applies their own balancing test, and responds to queries on a case by case basis. Thank you, EPDP Phase 2 working group members _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.
Hi Janis, all. I tend to agree and as I will miss at least part oft he call today let me reiterate that we should at least give a date by which we need a response. Best, Thomas Von: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org> im Auftrag von "James M. Bladel" <jbladel@godaddy.com> Datum: Donnerstag, 10. Oktober 2019 um 14:28 An: Janis Karklins <karklinsj@gmail.com>, "King, Brian" <Brian.King@markmonitor.com> Cc: "gnso-epdp-team@icann.org" <gnso-epdp-team@icann.org> Betreff: Re: [Gnso-epdp-team] EPDP Homework: Updated Draft of Board Letter Hello Janis – I appreciate your efforts to find a way forward, but if fail to present a direct question on Org risk to the Board, then I think we should reconsider the value of sending the letter at all. But let’s discuss on today’s call. Thanks— J. ------------- James Bladel GoDaddy From: Janis Karklins <karklinsj@gmail.com> Date: Thursday, October 10, 2019 at 06:47 To: "King, Brian" <Brian.King@markmonitor.com> Cc: "James M. Bladel" <jbladel@godaddy.com>, Matt Serlin <matt@brandsight.com>, "Mark Svancarek (CELA)" <marksv@microsoft.com>, "gnso-epdp-team@icann.org" <gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] EPDP Homework: Updated Draft of Board Letter Notice: This email is from an external sender. Dear Team members, Seems that divergence of views on the last sentence persist. Therefore, in my capacity of facilitator of the Team conversation, I propose to end the letter by simple courtesy phrase: Reply to this latter would greatly facilitate the work of the Team towards Initial Report. Pls consider this proposal by our call. If objection will be made, we will let the last sentence out of the text. Thank you JK On Thu, Oct 10, 2019 at 1:01 AM King, Brian via Gnso-epdp-team <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> wrote: Hi James, Sorry I wasn’t more clear. I think we’re actually on the same page here. We should absolutely tell the board what we’re considering, explain what it requires of ICANN, and ask for “Board input on the level of involvement and amount of liability they are willing to assume for ICANN org” as the penultimate sentence requests. My point on the last sentence is that we’re not ready to say what we might do if the Board fails to respond at all, or if the Board tells us they’re unwilling to accept such an outcome. It seems we don’t have consensus on that (and I really hope it doesn’t come to that). Since we don’t have consensus on that, let’s scrap it. The rest of the letter is fantastic. So let’s avoid that January/February scenario by asking the question in a way we all agree on, and let’s ask it now. Brian J. King Director of Internet Policy and Industry Affairs T +1 443 761 3726 markmonitor.com<http://www.markmonitor.com> MarkMonitor Protecting companies and consumers in a digital world From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>> On Behalf Of James M. Bladel Sent: Wednesday, October 9, 2019 6:28 PM To: Matt Serlin <matt@brandsight.com<mailto:matt@brandsight.com>>; Mark Svancarek (CELA) <marksv@microsoft.com<mailto:marksv@microsoft.com>>; gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> Subject: Re: [Gnso-epdp-team] EPDP Homework: Updated Draft of Board Letter I’m not sure I follow Brian’s proposal to remove the last sentence or what is meant by taking a “leap of faith”. If our recommendations for a centralized SSAD model (an idea that seems to have achieved some level of consensus), but the Board doesn’t accept this new role for ICANN…then what? Note that this would likely come to a head in January or February, and we’d either need to convince the Board to reconsider, or have nothing to show for a year’s work. I’m a bit surprised that this outcome is a risk that the IPC or GAC/NTIA would be willing to take. The last sentence isn’t a threat or prediction. It is a direct ask of the Board to consider this question now, while we still have time to change course if they shoot down the model. J. ------------- James Bladel GoDaddy From: Matt Serlin <matt@brandsight.com<mailto:matt@brandsight.com>> Date: Wednesday, October 9, 2019 at 17:09 To: "Mark Svancarek (CELA)" <marksv@microsoft.com<mailto:marksv@microsoft.com>>, "James M. Bladel" <jbladel@godaddy.com<mailto:jbladel@godaddy.com>>, "gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Subject: Re: [Gnso-epdp-team] EPDP Homework: Updated Draft of Board Letter Notice: This email is from an external sender. I believe including that final sentence gets at the heart of the issue with the guidance we are seeking and removing it makes the letter less impactful IMO. Yes, we think the Board and Org do know these things but I think being as explicit as possible with our words will help ensure we get the most clear answer from the Board as possible. Regards, Matt From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>> on behalf of "Mark Svancarek (CELA) via Gnso-epdp-team" <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Reply-To: "Mark Svancarek (CELA)" <marksv@microsoft.com<mailto:marksv@microsoft.com>> Date: Wednesday, October 9, 2019 at 3:35 PM To: "James M. Bladel" <jbladel@godaddy.com<mailto:jbladel@godaddy.com>>, "gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>" <gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org>> Subject: Re: [Gnso-epdp-team] EPDP Homework: Updated Draft of Board Letter I still think it’s better not to close the letter with a threat or even a prediction. The Board and Org know the critical importance of giving us a decision answering this letter. We suggest removing the final sentence. The rest of the letter is great. /marksv From: Gnso-epdp-team <gnso-epdp-team-bounces@icann.org<mailto:gnso-epdp-team-bounces@icann.org>> On Behalf Of James M. Bladel Sent: Wednesday, October 9, 2019 1:07 PM To: gnso-epdp-team@icann.org<mailto:gnso-epdp-team@icann.org> Subject: [Gnso-epdp-team] EPDP Homework: Updated Draft of Board Letter Colleagues – Regarding the draft letter to the Board presented on Tuesday, some members were uncomfortable with the wording of the last sentence. Since that call, I’ve been working with our Board liaisons (Becky and Chris) to make some edits. The resulting Revised Draft copied below. To expedite your review, please note that only the final sentence has changed. Thanks— J. ------------- James Bladel GoDaddy Letter from EPDP 2 to ICANN Board on Standardized System for Access/Disclosure (SSAD) To: ICANN Board CC: Goran CC: GNSO Council Dear ICANN Board, We are writing to you at the suggestion of the EPDP 2 Board liaisons. The working group is at a critical junction which requires clear input from the Board in order to further our work to produce realistic, timely, implementable policy recommendations. Specifically, we seek to understand the Board’s position on the scope of operational responsibility and level of liability (related to decision-making on disclosure of non-public registration data) they are willing to accept on behalf of the ICANN organization along with any prerequisites that may need to be met in order to do so. Our goal is to avoid policy recommendations that cement the current situation, where requests for non-public registration data are handled on a case-by-case basis by the registry/registrar in a non-standardized and decentralized manner. We are considering several models for a Standardized System for Access and Disclosure (SSAD), including (but not limited to) the Unified Access Model (UAM) developed by the Technical Study Group. All of the proposed “centralized” SSAD models presume that ICANN will assume an operational role, and, depending upon the model, some degree of responsibility and liability for decisions to disclose non-public data to a third-party requester. In some models, ICANN (or its designee) would approve accrediting bodies, or function as an accrediting body themselves. Some proposed models establish ICANN (or its designee) as the entity that will conduct an initial validation of disclosure requests prior to relaying this request to the appropriate registry or registrar. Other proposed models would require ICANN to play a larger role, either endorsing the legitimacy of the request, or issuing a determination of whether or not the registrar or registry should or must disclose the non-public data to the third party requester. We recognize that our questions are clouded by the uncertainty associated with constructing a model that is compliant with the General Data Protection Regulation (GDPR) and other privacy laws. We are also aware of the work of ICANN org (via the “Strawberry Team”) to engage with data protection authorities to better understand the liability involved in decisions to disclose non-public registration data. As noted above, our goal is to produce realistic, timely, and implementable policy recommendations, and our work requires Board input on the level of involvement and amount of liability they are willing to assume for ICANN org, along with any prerequisites that may need to be met in order to do so. Absent that input, the EPDP work must abandon the centralized SSAD model, and shift its focus to policy recommendations aimed at improving the existing distributed model in which each registry and registrar independently evaluates, applies their own balancing test, and responds to queries on a case by case basis. Thank you, EPDP Phase 2 working group members _______________________________________________ Gnso-epdp-team mailing list Gnso-epdp-team@icann.org<mailto:Gnso-epdp-team@icann.org> https://mm.icann.org/mailman/listinfo/gnso-epdp-team _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.
participants (7)
-
Amr Elsadr -
James M. Bladel -
Janis Karklins -
King, Brian -
Mark Svancarek (CELA) -
Matt Serlin -
Thomas Rickert | rickert.net