Thanks Rubens. Yes that description is background but to be clear, the Deliverables for study 1 include identification of harms. Anne Sent from my Verizon 4G LTE Tablet ------ Original message------ From: Rubens Kuhl Date: Fri, Sep 20, 2019 5:23 PM To: gnso-newgtld-wg@icann.org; Cc: Subject:Re: [Gnso-newgtld-wg] GNSO Council Response to ICANN Board on Potential dependencies between the Name Collisions Analysis Project (NCAP) and New gTLD Subsequent Procedures. Anne, The quote you mentioned is not from the study 1 scope. It's a part of the November 2017 board resolution, and it's in the section "background". The scope is on the next section, and it doesn't include harms. Study 1, whether you like it or not, is just a librarian effort to consolidate previous work, with absolutely no new information added. Rubens On 20 Sep 2019, at 20:23, Aikman-Scalese, Anne <AAikman@lrrc.com<mailto:AAikman@lrrc.com>> wrote: Thanks Steve. Also just for the WG’s information, RFP for NCAP Study 1 is attached. My recollection is that the scope of NCAP Study 1 is not limited to 2012 new gTLDs, but includes legacy TLDs, at least to the extent prior data is available. (Others may recall those deliberations in the NCAP Discussion Group.) Study 1 also calls for more specific identification of the harm, including harm that can occur after controlled interruption is no longer in place: <image001.png> Anne From: Gnso-newgtld-wg <gnso-newgtld-wg-bounces@icann.org<mailto:gnso-newgtld-wg-bounces@icann.org>> On Behalf Of Steve Chan Sent: Friday, September 20, 2019 3:20 PM To: gnso-newgtld-wg@icann.org<mailto:gnso-newgtld-wg@icann.org> Subject: [Gnso-newgtld-wg] GNSO Council Response to ICANN Board on Potential dependencies between the Name Collisions Analysis Project (NCAP) and New gTLD Subsequent Procedures. Dear WG Members, Jeff and Cheryl circulated a draft version of a letter from the GNSO Council to the ICANN Board regarding potential dependencies between the Name Collisions Analysis Project (NCAP) and SubPro. Attached, please find the final version as sent to the ICANN Board. Best, Steve From: council <council-bounces@gnso.icann.org<mailto:council-bounces@gnso.icann.org>> on behalf of Terri Agnew <terri.agnew@icann.org<mailto:terri.agnew@icann.org>> Date: Friday, September 20, 2019 at 2:36 PM To: "council@gnso.icann.org<mailto:council@gnso.icann.org>" <council@gnso.icann.org<mailto:council@gnso.icann.org>> Cc: "gnso-secs@icann.org<mailto:gnso-secs@icann.org>" <gnso-secs@icann.org<mailto:gnso-secs@icann.org>> Subject: [council] GNSO Council Response to ICANN Board on Potential dependencies between the Name Collisions Analysis Project (NCAP) and New gTLD Subsequent Procedures. Dear all, Please find attached the letter sent to Cherine Chalaby, Chair of ICANN Board on the topic of Potential dependencies between the Name Collisions Analysis Project (NCAP) and New gTLD Subsequent Procedures. This will be posted on the GNSO Correspondence webpage. [gnso.icann.org]<https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_counc...> shortly. Thank you. With kind regards, Terri --- Terri Agnew Operations Support - GNSO Lead Administrator Internet Corporation for Assigned Names and Numbers (ICANN) Email: terri.agnew@icann.org<mailto:terri.agnew@icann.org> Skype ID: terri.agnew.icann Find out more about the GNSO by visiting: https://learn.icann.org/<https://urldefense.proofpoint.com/v2/url?u=https-3A__learn.icann.org_&d=DwMGaQ&c=FmY1u3PJp6wrcrwll3mSVzgfkbPSS6sJms7xcl4I5cM&r=DRa2dXAvSFpCIgmkXhFzL7ar9Qfqa0AIgn-H4xR2EBk&m=jLNFXvpu9gNdUeHi-G6sjWNCF9w4_AwhzzUDFZy2elE&s=o7Auz997kA-HPv9PHJCjFVZw7Pgo8krw4MxfqCwBrIU&e=> Follow @GNSO on Twitter: https://twitter.com/ICANN_GNSO<https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_ICANN-5FGNSO&d=DwMGaQ&c=FmY1u3PJp6wrcrwll3mSVzgfkbPSS6sJms7xcl4I5cM&r=DRa2dXAvSFpCIgmkXhFzL7ar9Qfqa0AIgn-H4xR2EBk&m=jLNFXvpu9gNdUeHi-G6sjWNCF9w4_AwhzzUDFZy2elE&s=kWw4fQPNjw2lVKy1UjTxS2F0BmjEAzaDFWNmsYywbmE&e=> Transcripts and recordings of GNSO Working Group and Council events are located on the GNSO Master Calendar <https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_group...> See All SO and AC events on the ICANN Global calendar [features.icann.org]<https://urldefense.proofpoint.com/v2/url?u=https-3A__features.icann.org_cale...> ________________________________ This message and any attachments are intended only for the use of the individual or entity to which they are addressed. If the reader of this message or an attachment is not the intended recipient or the employee or agent responsible for delivering the message or attachment to the intended recipient you are hereby notified that any dissemination, distribution or copying of this message or any attachment is strictly prohibited. If you have received this communication in error, please notify us immediately by replying to the sender. The information transmitted in this message and any attachments may be privileged, is intended only for the personal and confidential use of the intended recipients, and is covered by the Electronic Communications Privacy Act, 18 U.S.C. §2510-2521. <NCAP RFP for Study 1 - 9 July 2019 (002).pdf>_______________________________________________ Gnso-newgtld-wg mailing list Gnso-newgtld-wg@icann.org<mailto:Gnso-newgtld-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-newgtld-wg _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on. ________________________________ This message and any attachments are intended only for the use of the individual or entity to which they are addressed. If the reader of this message or an attachment is not the intended recipient or the employee or agent responsible for delivering the message or attachment to the intended recipient you are hereby notified that any dissemination, distribution or copying of this message or any attachment is strictly prohibited. If you have received this communication in error, please notify us immediately by replying to the sender. The information transmitted in this message and any attachments may be privileged, is intended only for the personal and confidential use of the intended recipients, and is covered by the Electronic Communications Privacy Act, 18 U.S.C. §2510-2521.

Thanks Rubens. I think the list you linked is merely a summary of individual reports made to ICANN in the prior round. The focus of NCAP Study 1 is much broader and will likely include, for example, the attached data from 2017 dealing with Man in the Middle (MitM) interceptions of users and the resulting opportunity for DNS abuse (scams) and security risks, such as the ability to access the user’s files and/or servers for purposes of obtaining confidential information and/or installing malware. Regarding DNS abuse and the vulnerabilities created by name collisions, see the “Board Scorecard” on CCT-RT linked below – page 5 Recommendation 15 classified as “pending” – “The Board directs ICANN org to facilitate community efforts to develop a definition of “abuse” to inform further action on this recommendation.” https://www.icann.org/en/system/files/files/resolutions-final-cct-recs-score... Separately, I am not sure when this PDP WG will reach the Board’s directions to Sub Pro on the CCT-RT topics. (See attached email from August 19.) The specific recommendations sent to Sub Pro by the Board include Nos. 12, 25, 29, 32, 33, 34, and 35 at the link above. Anne From: Gnso-newgtld-wg <gnso-newgtld-wg-bounces@icann.org> On Behalf Of Rubens Kuhl Sent: Saturday, September 21, 2019 1:15 PM To: gnso-newgtld-wg@icann.org Subject: Re: [Gnso-newgtld-wg] GNSO Council Response to ICANN Board on Potential dependencies between the Name Collisions Analysis Project (NCAP) and New gTLD Subsequent Procedures. Anne, It only includes cataloging evidenced harms. From the scope: "summarizes the known(evidenced) harm of name collisions" The evidenced harm list is an information already collected by ICANN Org and shared with WT4, accessible at: https://community.icann.org/download/attachments/58735971/Name%20collision%2... So what will be seen at study 1 about harms is exactly what was already considered by WT4. A pattern that will extend throughout study 1, by design. Rubens On 21 Sep 2019, at 16:58, Aikman-Scalese, Anne <AAikman@lrrc.com<mailto:AAikman@lrrc.com>> wrote: Thanks Rubens. Yes that description is background but to be clear, the Deliverables for study 1 include identification of harms. Anne Sent from my Verizon 4G LTE Tablet ------ Original message------ From: Rubens Kuhl Date: Fri, Sep 20, 2019 5:23 PM To: gnso-newgtld-wg@icann.org<mailto:gnso-newgtld-wg@icann.org>; Cc: Subject:Re: [Gnso-newgtld-wg] GNSO Council Response to ICANN Board on Potential dependencies between the Name Collisions Analysis Project (NCAP) and New gTLD Subsequent Procedures. Anne, The quote you mentioned is not from the study 1 scope. It's a part of the November 2017 board resolution, and it's in the section "background". The scope is on the next section, and it doesn't include harms. Study 1, whether you like it or not, is just a librarian effort to consolidate previous work, with absolutely no new information added. Rubens On 20 Sep 2019, at 20:23, Aikman-Scalese, Anne <AAikman@lrrc.com<mailto:AAikman@lrrc.com>> wrote: Thanks Steve. Also just for the WG’s information, RFP for NCAP Study 1 is attached. My recollection is that the scope of NCAP Study 1 is not limited to 2012 new gTLDs, but includes legacy TLDs, at least to the extent prior data is available. (Others may recall those deliberations in the NCAP Discussion Group.) Study 1 also calls for more specific identification of the harm, including harm that can occur after controlled interruption is no longer in place: <image001.png> Anne From: Gnso-newgtld-wg <gnso-newgtld-wg-bounces@icann.org<mailto:gnso-newgtld-wg-bounces@icann.org>> On Behalf Of Steve Chan Sent: Friday, September 20, 2019 3:20 PM To: gnso-newgtld-wg@icann.org<mailto:gnso-newgtld-wg@icann.org> Subject: [Gnso-newgtld-wg] GNSO Council Response to ICANN Board on Potential dependencies between the Name Collisions Analysis Project (NCAP) and New gTLD Subsequent Procedures. Dear WG Members, Jeff and Cheryl circulated a draft version of a letter from the GNSO Council to the ICANN Board regarding potential dependencies between the Name Collisions Analysis Project (NCAP) and SubPro. Attached, please find the final version as sent to the ICANN Board. Best, Steve From: council <council-bounces@gnso.icann.org<mailto:council-bounces@gnso.icann.org>> on behalf of Terri Agnew <terri.agnew@icann.org<mailto:terri.agnew@icann.org>> Date: Friday, September 20, 2019 at 2:36 PM To: "council@gnso.icann.org<mailto:council@gnso.icann.org>" <council@gnso.icann.org<mailto:council@gnso.icann.org>> Cc: "gnso-secs@icann.org<mailto:gnso-secs@icann.org>" <gnso-secs@icann.org<mailto:gnso-secs@icann.org>> Subject: [council] GNSO Council Response to ICANN Board on Potential dependencies between the Name Collisions Analysis Project (NCAP) and New gTLD Subsequent Procedures. Dear all, Please find attached the letter sent to Cherine Chalaby, Chair of ICANN Board on the topic of Potential dependencies between the Name Collisions Analysis Project (NCAP) and New gTLD Subsequent Procedures. This will be posted on the GNSO Correspondence webpage. [gnso.icann.org]<https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_counc...> shortly. Thank you. With kind regards, Terri --- Terri Agnew Operations Support - GNSO Lead Administrator Internet Corporation for Assigned Names and Numbers (ICANN) Email: terri.agnew@icann.org<mailto:terri.agnew@icann.org> Skype ID: terri.agnew.icann Find out more about the GNSO by visiting: https://learn.icann.org/<https://urldefense.proofpoint.com/v2/url?u=https-3A__learn.icann.org_&d=DwMGaQ&c=FmY1u3PJp6wrcrwll3mSVzgfkbPSS6sJms7xcl4I5cM&r=DRa2dXAvSFpCIgmkXhFzL7ar9Qfqa0AIgn-H4xR2EBk&m=jLNFXvpu9gNdUeHi-G6sjWNCF9w4_AwhzzUDFZy2elE&s=o7Auz997kA-HPv9PHJCjFVZw7Pgo8krw4MxfqCwBrIU&e=> Follow @GNSO on Twitter: https://twitter.com/ICANN_GNSO<https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_ICANN-5FGNSO&d=DwMGaQ&c=FmY1u3PJp6wrcrwll3mSVzgfkbPSS6sJms7xcl4I5cM&r=DRa2dXAvSFpCIgmkXhFzL7ar9Qfqa0AIgn-H4xR2EBk&m=jLNFXvpu9gNdUeHi-G6sjWNCF9w4_AwhzzUDFZy2elE&s=kWw4fQPNjw2lVKy1UjTxS2F0BmjEAzaDFWNmsYywbmE&e=> Transcripts and recordings of GNSO Working Group and Council events are located on the GNSO Master Calendar <https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_group...> See All SO and AC events on the ICANN Global calendar [features.icann.org]<https://urldefense.proofpoint.com/v2/url?u=https-3A__features.icann.org_cale...> ________________________________ This message and any attachments are intended only for the use of the individual or entity to which they are addressed. If the reader of this message or an attachment is not the intended recipient or the employee or agent responsible for delivering the message or attachment to the intended recipient you are hereby notified that any dissemination, distribution or copying of this message or any attachment is strictly prohibited. If you have received this communication in error, please notify us immediately by replying to the sender. The information transmitted in this message and any attachments may be privileged, is intended only for the personal and confidential use of the intended recipients, and is covered by the Electronic Communications Privacy Act, 18 U.S.C. §2510-2521. <NCAP RFP for Study 1 - 9 July 2019 (002).pdf>_______________________________________________ Gnso-newgtld-wg mailing list Gnso-newgtld-wg@icann.org<mailto:Gnso-newgtld-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-newgtld-wg _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on. ________________________________ This message and any attachments are intended only for the use of the individual or entity to which they are addressed. If the reader of this message or an attachment is not the intended recipient or the employee or agent responsible for delivering the message or attachment to the intended recipient you are hereby notified that any dissemination, distribution or copying of this message or any attachment is strictly prohibited. If you have received this communication in error, please notify us immediately by replying to the sender. The information transmitted in this message and any attachments may be privileged, is intended only for the personal and confidential use of the intended recipients, and is covered by the Electronic Communications Privacy Act, 18 U.S.C. §2510-2521. ________________________________ This message and any attachments are intended only for the use of the individual or entity to which they are addressed. If the reader of this message or an attachment is not the intended recipient or the employee or agent responsible for delivering the message or attachment to the intended recipient you are hereby notified that any dissemination, distribution or copying of this message or any attachment is strictly prohibited. If you have received this communication in error, please notify us immediately by replying to the sender. The information transmitted in this message and any attachments may be privileged, is intended only for the personal and confidential use of the intended recipients, and is covered by the Electronic Communications Privacy Act, 18 U.S.C. §2510-2521.

Rubens, NCAP Study 1 will provide more than a link to the attached 2017 Name Collisions report (more current than JAS Final Report by about 3 years). RE 2.3 Scope of Work in the NCAP RFP (also attached), please refer to 2.3.1, specifically Item 2 which requires a “written report from the reviewed material that…. (b) summarizes the known (evidence) harm of name collisions.” Anne [cid:image001.png@01D5722E.906D6C50] From: Gnso-newgtld-wg <gnso-newgtld-wg-bounces@icann.org> On Behalf Of Rubens Kuhl Sent: Monday, September 23, 2019 4:39 PM To: gnso-newgtld-wg@icann.org Subject: Re: [Gnso-newgtld-wg] GNSO Council Response to ICANN Board on Potential dependencies between the Name Collisions Analysis Project (NCAP) and New gTLD Subsequent Procedures. On 23 Sep 2019, at 18:52, Aikman-Scalese, Anne <AAikman@lrrc.com<mailto:AAikman@lrrc.com>> wrote: Thanks Rubens. I think the list you linked is merely a summary of individual reports made to ICANN in the prior round. The only available evidence is that evidence, so what the contractor might have access is to the individual reports. The focus of NCAP Study 1 is much broader and will likely include, for example, the attached data from 2017 dealing with Man in the Middle (MitM) interceptions of users and the resulting opportunity for DNS abuse (scams) and security risks, such as the ability to access the user’s files and/or servers for purposes of obtaining confidential information and/or installing malware. All of them either require DNS labels with _ (underscore) that are already forbidden as domain names, or require 2nd level name collisions (like WPAD), which NCAP decided not to tackle. Study 1 will likely include a link to the paper you attached, but because it's a cataloging effort, it will stop at that, so not going into evidenced harms, which was the topic at hand. Regarding DNS abuse and the vulnerabilities created by name collisions, see the “Board Scorecard” on CCT-RT linked below – page 5 Recommendation 15 classified as “pending” – “The Board directs ICANN org to facilitate community efforts to develop a definition of “abuse” to inform further action on this recommendation.” https://www.icann.org/en/system/files/files/resolutions-final-cct-recs-score... The abuse is so much larger than name collisions that it would be reckless for the PDP to try addressing it just for that. There will be plenty of upcoming cross-community discussions on abuse in proper fora, starting at ICANN 66. Rec. 15 was directed at many parties, not just SubPro. Separately, I am not sure when this PDP WG will reach the Board’s directions to Sub Pro on the CCT-RT topics. (See attached email from August 19.) The specific recommendations sent to Sub Pro by the Board include Nos. 12, 25, 29, 32, 33, 34, and 35 at the link above. Unrelated to name collisions so I will let others chime in. Rubens ________________________________ This message and any attachments are intended only for the use of the individual or entity to which they are addressed. If the reader of this message or an attachment is not the intended recipient or the employee or agent responsible for delivering the message or attachment to the intended recipient you are hereby notified that any dissemination, distribution or copying of this message or any attachment is strictly prohibited. If you have received this communication in error, please notify us immediately by replying to the sender. The information transmitted in this message and any attachments may be privileged, is intended only for the personal and confidential use of the intended recipients, and is covered by the Electronic Communications Privacy Act, 18 U.S.C. §2510-2521.

Rubens, We can agree to disagree on this. I don’t believe you were on the NCAP Discussion Group call where this was added as a requirement in the RFP language in light of the language of the Board Resolution that you identified as “background”. The plain language is what the RFP says (please don’t delete the language from the RFP shown below when you reply). [cid:image001.png@01D5722E.906D6C50] The notion that Work Track 4 already covered all the know evidence of harm is not accurate. If the Board were willing to rest on what Work Track 4 had, it would never have initiated the NCAP as an OCTO project. Anne From: Gnso-newgtld-wg <gnso-newgtld-wg-bounces@icann.org> On Behalf Of Rubens Kuhl Sent: Tuesday, September 24, 2019 1:47 PM To: gnso-newgtld-wg@icann.org Subject: Re: [Gnso-newgtld-wg] GNSO Council Response to ICANN Board on Potential dependencies between the Name Collisions Analysis Project (NCAP) and New gTLD Subsequent Procedures. Anne, This part was exactly what I quoted before, and it simply doesn't say what you believe it does. We will know when the NCAP Study 1 gets published, one day. Rubens Em 24 de set de 2019, à(s) 17:35:000, Aikman-Scalese, Anne <AAikman@lrrc.com<mailto:AAikman@lrrc.com>> escreveu: Rubens, NCAP Study 1 will provide more than a link to the attached 2017 Name Collisions report (more current than JAS Final Report by about 3 years). RE 2.3 Scope of Work in the NCAP RFP (also attached), please refer to 2.3.1, specifically Item 2 which requires a “written report from the reviewed material that…. (b) summarizes the known (evidence) harm of name collisions.” Anne <image001.png> From: Gnso-newgtld-wg <gnso-newgtld-wg-bounces@icann.org<mailto:gnso-newgtld-wg-bounces@icann.org>> On Behalf Of Rubens Kuhl Sent: Monday, September 23, 2019 4:39 PM To: gnso-newgtld-wg@icann.org<mailto:gnso-newgtld-wg@icann.org> Subject: Re: [Gnso-newgtld-wg] GNSO Council Response to ICANN Board on Potential dependencies between the Name Collisions Analysis Project (NCAP) and New gTLD Subsequent Procedures. On 23 Sep 2019, at 18:52, Aikman-Scalese, Anne <AAikman@lrrc.com<mailto:AAikman@lrrc.com>> wrote: Thanks Rubens. I think the list you linked is merely a summary of individual reports made to ICANN in the prior round. The only available evidence is that evidence, so what the contractor might have access is to the individual reports. The focus of NCAP Study 1 is much broader and will likely include, for example, the attached data from 2017 dealing with Man in the Middle (MitM) interceptions of users and the resulting opportunity for DNS abuse (scams) and security risks, such as the ability to access the user’s files and/or servers for purposes of obtaining confidential information and/or installing malware. All of them either require DNS labels with _ (underscore) that are already forbidden as domain names, or require 2nd level name collisions (like WPAD), which NCAP decided not to tackle. Study 1 will likely include a link to the paper you attached, but because it's a cataloging effort, it will stop at that, so not going into evidenced harms, which was the topic at hand. Regarding DNS abuse and the vulnerabilities created by name collisions, see the “Board Scorecard” on CCT-RT linked below – page 5 Recommendation 15 classified as “pending” – “The Board directs ICANN org to facilitate community efforts to develop a definition of “abuse” to inform further action on this recommendation.” https://www.icann.org/en/system/files/files/resolutions-final-cct-recs-score... The abuse is so much larger than name collisions that it would be reckless for the PDP to try addressing it just for that. There will be plenty of upcoming cross-community discussions on abuse in proper fora, starting at ICANN 66. Rec. 15 was directed at many parties, not just SubPro. Separately, I am not sure when this PDP WG will reach the Board’s directions to Sub Pro on the CCT-RT topics. (See attached email from August 19.) The specific recommendations sent to Sub Pro by the Board include Nos. 12, 25, 29, 32, 33, 34, and 35 at the link above. Unrelated to name collisions so I will let others chime in. Rubens ________________________________ This message and any attachments are intended only for the use of the individual or entity to which they are addressed. If the reader of this message or an attachment is not the intended recipient or the employee or agent responsible for delivering the message or attachment to the intended recipient you are hereby notified that any dissemination, distribution or copying of this message or any attachment is strictly prohibited. If you have received this communication in error, please notify us immediately by replying to the sender. The information transmitted in this message and any attachments may be privileged, is intended only for the personal and confidential use of the intended recipients, and is covered by the Electronic Communications Privacy Act, 18 U.S.C. §2510-2521. <NCAP RFP for Study 1 - 9 July 2019 (002).pdf><Name Collisions - Fall 2017 study - Verisign Labs.pdf> ________________________________ This message and any attachments are intended only for the use of the individual or entity to which they are addressed. If the reader of this message or an attachment is not the intended recipient or the employee or agent responsible for delivering the message or attachment to the intended recipient you are hereby notified that any dissemination, distribution or copying of this message or any attachment is strictly prohibited. If you have received this communication in error, please notify us immediately by replying to the sender. The information transmitted in this message and any attachments may be privileged, is intended only for the personal and confidential use of the intended recipients, and is covered by the Electronic Communications Privacy Act, 18 U.S.C. §2510-2521.

As I understand ICANN Board can not direct PDP. ⁣Maxim Alzoba​ On 24 Sep 2019, 02:39, at 02:39, Rubens Kuhl <rubensk@nic.br> wrote:

...

On 23 Sep 2019, at 18:52, Aikman-Scalese, Anne <AAikman@lrrc.com> wrote:

Thanks Rubens. I think the list you linked is merely a summary of individual reports made to ICANN in the prior round.

The only available evidence is that evidence, so what the contractor might have access is to the individual reports.

...

The focus of NCAP Study 1 is much broader and will likely include, for example, the attached data from 2017 dealing with Man in the Middle (MitM) interceptions of users and the resulting opportunity for DNS abuse (scams) and security risks, such as the ability to access the user’s files and/or servers for purposes of obtaining confidential information and/or installing malware.

All of them either require DNS labels with _ (underscore) that are already forbidden as domain names, or require 2nd level name collisions (like WPAD), which NCAP decided not to tackle. Study 1 will likely include a link to the paper you attached, but because it's a cataloging effort, it will stop at that, so not going into evidenced harms, which was the topic at hand.

...

Regarding DNS abuse and the vulnerabilities created by name

collisions, see the “Board Scorecard” on CCT-RT linked below – page 5 Recommendation 15 classified as “pending” – “The Board directs ICANN org to facilitate community efforts to develop a definition of “abuse” to inform further action on this recommendation.”

...

https://www.icann.org/en/system/files/files/resolutions-final-cct-recs-score... <https://www.icann.org/en/system/files/files/resolutions-final-cct-recs-score...> The abuse is so much larger than name collisions that it would be reckless for the PDP to try addressing it just for that. There will be plenty of upcoming cross-community discussions on abuse in proper fora, starting at ICANN 66. Rec. 15 was directed at many parties, not just SubPro.

...

Separately, I am not sure when this PDP WG will reach the Board’s

directions to Sub Pro on the CCT-RT topics. (See attached email from August 19.) The specific recommendations sent to Sub Pro by the Board include Nos. 12, 25, 29, 32, 33, 34, and 35 at the link above.

...

Unrelated to name collisions so I will let others chime in.

Rubens

------------------------------------------------------------------------

_______________________________________________ Gnso-newgtld-wg mailing list Gnso-newgtld-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-newgtld-wg _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.