March 2014 - Gnso-ppsai-pdp-wg

Re: [Gnso-ppsai-pdp-wg] apologies for Singapore meeting
by Michele Neylon - Blacknight March 26, 2014

March 26, 2014

I also won’t be able to attend due to a conflict Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting & Colocation, Domains http://www.blacknight.co/ http://blog.blacknight.com/ http://www.technology.ie Intl. +353 (0) 59 9183072 Locall: 1850 929 929 Direct Dial: +353 (0)59 9183090 Fax. +353 (0) 1 4811 763 Twitter: http://twitter.com/mneylon ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,Ireland Company No.: 370845 From: gnso-ppsai-pdp-wg-bounces(a)icann.org [mailto:gnso-ppsai-pdp-wg-bounces@icann.org] On Behalf Of h.raiche(a)internode.on.net Sent: Tuesday, March 25, 2014 9:18 PM To: gnso-ppsai-pdp-wg(a)icann.org Subject: [Gnso-ppsai-pdp-wg] apologies for Singapore meeting Hi Sorry I'll be an apology for Thursday's meeting - it directly clashes with another meeting I must attend. Holly

2 1

Agenda for Thursday meeting
by Mary Wong March 26, 2014

March 26, 2014

Hello everyone, The proposed agenda for the Working Group meeting during ICANN49 in Singapore is as follows; it differs somewhat from the usual WG meeting format as the Chairs thought this meeting would be an excellent opportunity to introduce the work of this group to the community and seek their feedback. 1. Roll Call (2 mins) 2. Introduction of WG members and affiliations (individual WG members; 20 mins) 3. Overview of goals, charter and work so far (Don Blumenthal (WG Chair); 10 mins) 4. Update on EWG survey/Q&A with WG members (Margie Milam (ICANN staff); 20 mins) 5. Open community discussion (35 mins) 6. Wrap up and next steps (3 mins) The meeting is scheduled for 0900-1030 a.m. Singapore time, in the Sophia Room. Remote participation will also be available: http://singapore49.icann.org/en/schedule/thu-ppsa Cheers Mary Mary Wong Senior Policy Director Internet Corporation for Assigned Names & Numbers (ICANN) Telephone: +1 603 574 4892 Email: mary.wong(a)icann.org * One World. One Internet. *

2 1

apologies for Singapore meeting
by h.raiche＠internode.on.net March 25, 2014

March 25, 2014

Hi Sorry I'll be an apology for Thursday's meeting - it directly clashes with another meeting I must attend. Holly

1 0

EWG Privacy and Proxy Service Provider Questionnaire
by Marika Konings March 21, 2014

March 21, 2014

Dear All, Please note that the EWG P/P Survey results have been published (see attached and https://community.icann.org/x/OgK6Ag) Best regards, Marika

1 0

For your review - updated template Cat B - question 2
by Marika Konings March 19, 2014

March 19, 2014

Dear All, Following our call earlier this week, please find attached the updated template for Category B question 2. To facilitate your review, I've posted below the draft preliminary recommendation in which we've aimed to capture the conversation to date taking into account the language of the Whois Accuracy Specification Program of the 2013 RAA. If you are of the view that this does not accurately capture the WG's view to date and/or have specific suggestions for changes / edits, please share those with the mailing list. Also, if there are any other issues that need to be addressed in relation to this question and/or the preliminary recommendation, please share those as well. Best regards, Marika Draft Preliminary Recommendation Category B question 2 (Should ICANN-accredited privacy/proxy service providers be required to conduct periodic checks to ensure accuracy of customer contact information; and if so, how?) The WG recommends that proxy and privacy customer data be validated and verified in a manner consistent with the requirements outlined in Whois Accuracy Specification Program of the 2013 RAA. The WG furthermore agrees that in the cases where validation and verification of the P/P customer data was carried out by the registrar, reverification by the P/P service of the same, identical, information should not be required. Similar to ICANN¹s Whois Data Reminder Policy (http://www.icann.org/en/resources/registrars/consensus-policies/wdrp) the P/P provider should be required to inform the P/P customer annually of his/her requirement to provide accurate and up to date contact information to the P/P provider. If the P/P provider has any information suggesting that the P/P customer information is incorrect (such as P/P service receiving a bounced email notification or non-delivery notification message in connection with compliance with data reminder notices or otherwise) for any P/P customer, the P/P provider must verify or re-verify, as applicable, the email address(es). If, within fifteen (15) calendar days after receiving any such information, P/P service does not receive an affirmative response from the P/P customer providing the required verification, the P/P service shall verify the applicable contact information manually.

15 22

MP3 PPSAI WG - Tuesday 18 March 2014 at 1500 UTC
by Terri Agnew March 18, 2014

March 18, 2014

Dear All, Please find the MP3 recording for the Privacy and Proxy Services Accreditation Issues PDP Working group call held on Tuesday 18 March 2014 at 15:00 UTC at: <http://audio.icann.org/gnso/gnso-ppsa-20140318-en.mp3> http://audio.icann.org/gnso/gnso-ppsa-20140318-en.mp3 On page: <http://gnso.icann.org/en/group-activities/calendar%23mar> http://gnso.icann.org/en/group-activities/calendar#mar The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: <http://gnso.icann.org/calendar/> http://gnso.icann.org/calendar/ Attendees: Luc Seufer - RrSG Volker Greimann - RrSG Graeme Bunton - RrSG Tim Ruiz - RrSG Sarah Wyld - RrSG Steve Metalitz - IPC Kathy Kleiman - RySGgr Darcy Southwell - RrSG Don Blumenthal - RySG Libby Baney - BC Phil Marano - IPC Griffin Barnett - IPC Valeriya Sherman - IPC Tatiana Khramtsova - RrSG Todd Williams - IPC Roy Balleste - NCUC Holly Raiche - ALAC Susan Prosser - RrSG Kristina Rosette - IPC Paul McGrady - IPC Justin Macy - BC Maria Farrell - NCUC Ben Anderson - RrSG Jim Bikoff - IPC David Heasley - IPC David Cake - NCSG Amr Elsadr - NCUC Apologies: Michele Neylon - RrSG Stephanie Perrin- NCSG Carlton Samuels - ALAC Don Moody -IPC Marie-Laure Lemineur - NPOC Statton Hammock -RySG Tobias Sattler - RrSG Marika Konings - Staff ICANN staff: Mary Wong Amy Bivins Joe Catapano Mike Zupke Terri Agnew ** Please let me know if your name has been left off the list ** Mailing list archives: <http://mm.icann.org/pipermail/gnso-ppsai-pdp-wg/> http://mm.icann.org/pipermail/gnso-ppsai-pdp-wg/ Wiki page: <https://community.icann.org/x/9iCfAg> https://community.icann.org/x/9iCfAg Thank you. Kind regards, Terri Agnew ------------------------------- Adobe Connect chat transcript for Tuesday 18 March 2014: Terri Agnew:Welcome to the PPSAI WG Meeting of 18 March 2014 Paul McGrady:Good morning, afternoon, or evening, all. Graeme Bunton:Good morning all Kathy Kleiman:Hi All! Val Sherman:Jim Bikoff and David Heasley also on the call Mary Wong:Please remember to mute if you are not speaking; and especially to mute your computer if you are on the phone bridge/speaker phone. Volker Greimann:we have some bad echo Terri Agnew:Susan Processor has joined Terri Agnew:Maria Farell has joined Terri Agnew:Ben Anderson has joined Terri Agnew:Luc Seufer has joined Mary Wong:You should be able to scroll through the document. Terri Agnew:Kristina Rosette has joined Terri Agnew:David Cake has joined Todd Williams:That's a fair characterization of what I argued, thanks Don. Kathy Kleiman:Can Mary or Marika please list the sessions/times/places that Don mentioned for our meetings at the opening of this session? Tx! Mary Wong:If it would be helpful, three distinctions to bear in mind: (1) "validate" vs "verify"; (2) the Registered Name Holder in a proxy service is not the "actual" customer but in fact is the service; and (3) the creation of a P/P accreditation program should apply regardless of whether the service may be affiliated with a Registrar under the 2009 or 2013 RAA. Mary Wong:@Kathy - GNSO weekend update is scheduled for 17:15 Singapore time on Saturday; WG F2F meeting is scheduled for Thursday 27 March from 0900-1030 local time. Kathy Kleiman:Tx Mary - perfect for distributing! Mary Wong:Both in the Sophia Room - with RP facilities. Luc Seufer:+1 Tim Kathy Kleiman:+2 Tim, especially regarding the ability to take action for clear illegalities even as contact data being sought Tim Ruiz:@Mary, and that we are only talking about validating and/or verifying data, not identities. Mary Wong:Further to my note above, there will also be an ALAC session on Monday, from 1500-1700, to cover Registration Data Directory Services - which will also include a discussion of P/P services. steve metalitz:@Kathy,how would that action be takenwithout being able to contact beneficial owner? Kathy Kleiman:@Steve, it depends on the action, doesn't it? If it is spam, malware, etc, procedures for takedown or blocking can be pursued. Terri Agnew:Amr Elsdr has joined Mary Wong:The next question that Steve mentioned reads, in part: "3. What rights and responsibilities should domain name registrants that use privacy/proxy services have? What obligations should ICANN-accredited privacy/proxy service providers have in managing these rights and responsibilities?" Graeme Bunton:Yep, good point Tim Volker Greimann:that's what happens when you share an office Paul McGrady:What is the ratio of registrars who remain under the 2009 agreement vs. 2013? Volker Greimann:got it 2009, 3.12.4: In the event that ICANN makes available a program granting recognition to resellers that escrow privacy or proxy registration data as detailed above, and reseller meets any other criteria established by ICANN in accordance with its Bylaws, reseller shall be permitted to apply to ICANN for such recognition. Tim Ruiz:@Volker, not sure exactly what that means or how it applies? Mary Wong:@Paul, we will take that back to our colleagues allong with Tim's related question. Mary Wong:@Kathy, the option to cancel the registration (though not explicitly the right to respond) is mentioned in relation to the quesitons in the Relay & Reveal categories. Mary Wong:(if that helps orient the discussion) Kathy Kleiman:@Steve - Transparency is key also. Mary Wong:BC, IPC and NCSG have sent responses so far. Paul McGrady:I have to leave for another meeting. Thank you all. I look forward to seeing many of you in Singapore. Kathy Kleiman:Are there other services or analogies people would like to discuss? Tim Ruiz:Thanks Don and all! Kathy Kleiman:Bye All and Safe Travels! Luc Seufer:Thanks Don Phil Marano:Thank you, goodbye. Graeme Bunton:thanks All

1 0

Updated template for Category B - question 3
by Mary Wong March 18, 2014

March 18, 2014

The WG wiki has been updated accordingly; you will find the previously-uploaded version of the template for Category B Question 2 (for which there is lively ongoing discussion on the list) as of 17 March; and a further updated version for Category B Question 3 (updated with the new NCSG submissions as stated in Kathy's email): https://community.icann.org/x/oR3RAg We hope they will be useful for your reference and the call later today. Cheers Mary Mary Wong Senior Policy Director Internet Corporation for Assigned Names & Numbers (ICANN) Telephone: +1 603 574 4892 Email: mary.wong(a)icann.org * One World. One Internet. * From: Marika Konings <marika.konings(a)icann.org> Date: Tuesday, March 18, 2014 6:00 PM To: Kathy Kleiman <kathy(a)kathykleiman.com>, "gnso-ppsai-pdp-wg(a)icann.org" <gnso-ppsai-pdp-wg(a)icann.org> Subject: Re: [Gnso-ppsai-pdp-wg] For your review - template Category B - question 3 > Please find attached the updated template with the additional NCSG comments > incorporated. > > Best regards, > > Marika > > From: Kathy Kleiman <kathy(a)kathykleiman.com> > Date: Tuesday 18 March 2014 04:39 > To: "gnso-ppsai-pdp-wg(a)icann.org" <gnso-ppsai-pdp-wg(a)icann.org> > Subject: Re: [Gnso-ppsai-pdp-wg] For your review - template Category B - > question 3 > > Hi All, > In answering our newest question, Category B-question 3, I would ask that an > expansion of the NCSG comments be included in the summary of comments > received. NCSG has now commented extensively on rights a domain name > registrant should have when using a proxy/privacy service -- and our focus has > been on two aspects (although there are more to discuss), namely: a) access to > proxy/privacy services, and b) due process in the limitation and/or > termination of these services. > > Access: NCSG submits that in the gTLD system, p/p is a needed and legitimate > service for noncommercial organizations, including public interest groups, > religious groups, educational organization, charities, and hobby groups, as > well as individuals, entrepreneurs and small businesses. We would like to see > that right of access protected and ensured. > > Due Process: NCSG submits that the p/p customer should be assured of the right > to engage in a dialogue with the proxy/privacy service provider before contact > data is released or published (when legally allowed), and given the > opportunity to show if the request for contact data is intended to to harm, > harass, damage competition or diminish Freedom of Expression or Assembly > rights. Further, the NSCG comments discussed (as reflected in the current > template) the importance of allowing Registrars to follow their national laws > and practices and incorporate the privacy, data protection and due process of > ther laws into their p/p contracts with customers. What is illegal in one > country is not illegal in another country -- be it speech activities, > religious activities, political activities or even comparative advertising (in > which a particular product or service specifically mentions a competitor by > name for the express purpose of showing why the competitor is inferior to the > product naming it). These robust differences must be taking into account when > drafting a general set of accreditation principles for rights and > responsibilities of Registrants. > > We respectfully submit there are many rights, as well as responsibilities, to > consider in this question tomorrow... and look forward to the discussion. > Best, > Kathy > > ------------------------------------------------------------------------ > Dear All, >> >> In preparation for our meeting tomorrow, please find attached the proposed >> template for Category B question 3 (What rights and responsibilities should >> domain name registrants that use privacy/proxy services have? What >> obligations should ICANN-accredited privacy/proxy service providers have in >> managing these rights and responsibilities? Clarify how transfers, renewals, >> and PEDNR policies should apply.) If there is any additional information that >> should be added to the background section, please let me know. >> >> In relation to transfers, renewals and PEDNR policies, we've started to >> develop a list of questions that the WG may need to consider in relation to >> these policies. If there are any additional questions that should be >> included, please feel free to suggest. We are hoping that some of the >> registrar members will be able to shed a light on how these issues are >> currently handled and whether or not these need to be factored into the WG >> recommendations. >> * Per the ERRP, 'registrars must notify the registered name holder of the >> expiration at least two times'. Should there be a requirement for the P/P >> provider to pass these notices on to the P/P customer? >> * Per the ERRP, 'if a registration is not renewed by the RAE or deleted by >> the registrar, within five days after the expiration of the registration, the >> registrar must transmit at least one additional expiration notice to the RAE >> that includes instructions for renewing the registration'. Should there be a >> requirement for the P/P provider to pass these notices on to the P/P >> customer? >> * Per the ERRP, 'beginning at the time of expiration and through the DNS >> resolution interruption period described in paragraphs 2.2.2 and 2.2.3, the >> RAE must be permitted by the registrar to renew the expired registration'. >> What if the underlying customer wants to renew the registration? Idem for >> restoration during the Redemption Grace Period. >> * In relation to the IRTP, should there be any restrictions concerning >> transfers of P/P registrations? (e.g. some of the terms and conditions >> require the P/P services to be removed during the transfer process). >> Depending on the response to this question, all communications in the IRTP >> currently go via the transfer contact (Registered Name Holder / Admin >> Contact). Should there be any requirements for this information to also be >> communicated to the P/P customer? What happens if there is a disagreement >> relating to the transfer between the P/P provider and the P/P customer? >> Best regards, >> >> Marika >> >> >> _______________________________________________ >> Gnso-ppsai-pdp-wg mailing list >> Gnso-ppsai-pdp-wg@icann.orghttps://mm.icann.org/mailman/listinfo/gnso-ppsai-p >> dp-wg >

2 1

For your review - template Category B - question 3
by Marika Konings March 18, 2014

March 18, 2014

Dear All, In preparation for our meeting tomorrow, please find attached the proposed template for Category B question 3 (What rights and responsibilities should domain name registrants that use privacy/proxy services have? What obligations should ICANN-accredited privacy/proxy service providers have in managing these rights and responsibilities? Clarify how transfers, renewals, and PEDNR policies should apply.) If there is any additional information that should be added to the background section, please let me know. In relation to transfers, renewals and PEDNR policies, we've started to develop a list of questions that the WG may need to consider in relation to these policies. If there are any additional questions that should be included, please feel free to suggest. We are hoping that some of the registrar members will be able to shed a light on how these issues are currently handled and whether or not these need to be factored into the WG recommendations. * Per the ERRP, 'registrars must notify the registered name holder of the expiration at least two times'. Should there be a requirement for the P/P provider to pass these notices on to the P/P customer? * Per the ERRP, 'if a registration is not renewed by the RAE or deleted by the registrar, within five days after the expiration of the registration, the registrar must transmit at least one additional expiration notice to the RAE that includes instructions for renewing the registration'. Should there be a requirement for the P/P provider to pass these notices on to the P/P customer? * Per the ERRP, 'beginning at the time of expiration and through the DNS resolution interruption period described in paragraphs 2.2.2 and 2.2.3, the RAE must be permitted by the registrar to renew the expired registration'. What if the underlying customer wants to renew the registration? Idem for restoration during the Redemption Grace Period. * In relation to the IRTP, should there be any restrictions concerning transfers of P/P registrations? (e.g. some of the terms and conditions require the P/P services to be removed during the transfer process). Depending on the response to this question, all communications in the IRTP currently go via the transfer contact (Registered Name Holder / Admin Contact). Should there be any requirements for this information to also be communicated to the P/P customer? What happens if there is a disagreement relating to the transfer between the P/P provider and the P/P customer? Best regards, Marika

2 2

Re: [Gnso-ppsai-pdp-wg] For your review - updated template Cat B - question 2
by Michele Neylon - Blacknight March 18, 2014

March 18, 2014

John Why should non-response lead to any action at all? Assuming that *if* there is an initial "verification" that the user of the service had verified / validated themselves. Keep it to "failure" or something requiring attention and maybe we can reach agreement on something, but there's no way that I'd suspend any service like this based solely on the lack of response from a user. Don't forget - the vast majority of domain name registrants are not "experts" Many of the registrars and hosting providers offer privacy / proxy with all domain name registrations - in some cases the option is automatically added to the shopping cart when you register the domain name. So for many registrants they may like the service, but they're probably not even fully conscious that it is an "add on". I cannot see any upside to forcing extra levels of verification / validation on p/p users. What I can see, however, is an unreasonable burden being placed on innocent users of p/p services and their providers (the entire chain) Sorry I won't get to argue with you about this today, but I'll be on a plane somewhere between Dublin and Dubai :) Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting & Colocation, Domains http://www.blacknight.co/ http://blog.blacknight.com/ http://www.technology.ie Intl. +353 (0) 59 9183072 Locall: 1850 929 929 Direct Dial: +353 (0)59 9183090 Fax. +353 (0) 1 4811 763 Twitter: http://twitter.com/mneylon ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,Ireland Company No.: 370845 From: gnso-ppsai-pdp-wg-bounces(a)icann.org [mailto:gnso-ppsai-pdp-wg-bounces@icann.org] On Behalf Of John Horton Sent: Tuesday, March 18, 2014 3:34 AM To: Graeme Bunton Cc: gnso-ppsai-pdp-wg(a)icann.org Subject: Re: [Gnso-ppsai-pdp-wg] For your review - updated template Cat B - question 2 Question, with respect to the "suspension rates being catastrophic" concerns: if, for the sake of argument, we're talking about requiring additional verification for P/P beyond what the 2013 RAA requires, a failure -- especially one based solely on non-response -- wouldn't necessarily lead to domain name suspension, would it? (Unless the failure reasonably indicates that the Whois data is actually false.) I assume that failure of any supplemental verification required by a P/P service would result in merely terminating the P/P service itself, unless the failure actually indicates that the information is falsified. In other words: * If the verification already required under the 2013 RAA fails, the Registrar may have to suspend the domain name anyway. * If any verification required for P/P providers in addition to the 2013 RAA requirements fails solely due to non-response, it doesn't seem to me that the remedy would have to be (or should be) domain name suspension; rather, it would likely only be terminating the P/P service itself, revealing the domain name registration data but leaving the domain name active and pointing to content. * However, if any verification required for P/P providers in addition to the 2013 RAA requirements fails as a result of the underlying information actually being falsified, then suspension may be appropriate anyway, in addition to the P/P service being withdrawn. My apologies if I'm missing something there, but I'm not sure that it follows that there would have to be any domain name suspensions for failures to verify the supplemental information not originally required to be verified by the 2013 RAA, as described in the Whois Accuracy Program Specification. John Horton President, LegitScript [https://static.legitscript.com/assets/logo-smaller-cdb8a6f307ce2c6172e72257…] Follow LegitScript: LinkedIn<http://www.linkedin.com/company/legitscript-com> | Facebook<https://www.facebook.com/LegitScript> | Twitter<https://twitter.com/legitscript> | YouTube<https://www.youtube.com/user/LegitScript> | Blog<http://blog.legitscript.com> | Google+<https://plus.google.com/112436813474708014933/posts> On Mon, Mar 17, 2014 at 7:50 PM, Stephanie Perrin <stephanie.perrin(a)mail.utoronto.ca<mailto:stephanie.perrin@mail.utoronto.ca>> wrote: I agree with what James and Michele have said, and I view this as extremely discriminatory and therefore highly problematic from a competition policy perspective. Stephanie Perrin On Mar 17, 2014, at 10:41 PM, Graeme Bunton <gbunton(a)tucows.com<mailto:gbunton@tucows.com>> wrote: Agreeing with what James and Michele have stated here. The suspension rates would be catastrophic, with no real gain over what the 2013 RAA ensures. Graeme On 3/17/2014 6:24 PM, James M. Bladel wrote: Everyone, this part of Michele's post is key: If there's a bounce or any other indication that the contact details are invalid then let the 2013 RAA standards apply - if any. The 2013 RAA requires registrar to re-verify the contact information if the information is known to be invalid. A bounced or undeliverable reminder email certainly qualifies. But to take this further, and claim that non-response = invalid contact information is speculation and could have catastrophic implications. As Michele notes, registrars work our tails off to drive these response rates in to the high single digits or low teens. Suspending upwards of 80% of domain names would be prohibitively disruptive and I've seen nothing in this thread/PDP to justify such a radical proposal. Thanks-- J. Sent from my iPad On Mar 17, 2014, at 15:13, "Michele Neylon - Blacknight" <michele(a)blacknight.com<mailto:michele@blacknight.com>> wrote: I cannot agree with this. Just because somebody does not reply to an annual email does not mean anything and expecting registrars or proxy / privacy providers to do anything extra based on a lack of response is completely unreasonable. If there's a bounce or any other indication that the contact details are invalid then let the 2013 RAA standards apply - if any. But expecting registrars or privacy / proxy providers to do extra validation simply because a customer hasn't responded to an annual whois data reminder simply will not fly. We send out thousands of these reminders every year. Only a tiny percentage of our clients ever reply to them - and if their details haven't changed why on earth would they have to? Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting & Colocation, Domains http://www.blacknight.co/ http://blog.blacknight.com/ http://www.technology.ie<http://www.technology.ie/> Intl. +353 (0) 59 9183072<tel:%2B353%20%280%29%2059%C2%A0%209183072> Locall: 1850 929 929 Direct Dial: +353 (0)59 9183090<tel:%2B353%20%280%2959%209183090> Fax. +353 (0) 1 4811 763<tel:%2B353%20%280%29%201%204811%20763> Twitter: http://twitter.com/mneylon ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,Ireland Company No.: 370845 From: gnso-ppsai-pdp-wg-bounces(a)icann.org<mailto:gnso-ppsai-pdp-wg-bounces@icann.org> [mailto:gnso-ppsai-pdp-wg-bounces@icann.org] On Behalf Of Valeriya Sherman Sent: Monday, March 17, 2014 8:09 PM To: Metalitz, Steven; 'Williams, Todd'; Marika Konings; gnso-ppsai-pdp-wg(a)icann.org<mailto:gnso-ppsai-pdp-wg@icann.org> Subject: Re: [Gnso-ppsai-pdp-wg] For your review - updated template Cat B - question 2 I, Jim Bikoff, David Heasley, and Griffin Barnett agree with Todd's assessment: Contact information that is ultimately revealed is valuable only if it is accurate. The validation/verification requirements should be consistent with the 2013 RAA requirements, but should go above and beyond those requirements to ensure the accuracy of contact information. Registrars already send an annual Whois Data Reminder Policy notification to registrants, reminding them to provide accurate and up-to-date information. Similarly, the privacy/proxy customer's contact information should be verified upon initial registration of the domain name (either by the registrar or the Privacy/Proxy Service Provider) and periodically thereafter by automated annual email re-verification notifications that require an affirmative response by the P/P customer. Absence of a response would trigger a follow-up, reminding the privacy/proxy customer to provide accurate and up-to-date information. Regards, Valeriya Sherman Silverberg, Goldman & Bikoff, L.L.P. 1101 30th Street, N.W. Suite 120 Washington, D.C. 20007 Tel 202.944.2330<tel:202.944.2330> Cell 303.589.7477<tel:303.589.7477> vsherman(a)sgbdc.com<mailto:vsherman@law.gwu.edu> ________________________________ From: gnso-ppsai-pdp-wg-bounces(a)icann.org<mailto:gnso-ppsai-pdp-wg-bounces@icann.org> [gnso-ppsai-pdp-wg-bounces(a)icann.org<mailto:gnso-ppsai-pdp-wg-bounces@icann.org>] on behalf of Metalitz, Steven [met(a)msk.com<mailto:met@msk.com>] Sent: Monday, March 17, 2014 6:13 AM To: 'Williams, Todd'; Marika Konings; gnso-ppsai-pdp-wg(a)icann.org<mailto:gnso-ppsai-pdp-wg@icann.org> Subject: Re: [Gnso-ppsai-pdp-wg] For your review - updated template Cat B - question 2 I agree with Todd's characterization of the status of this discussion, and that the questions he highlights are still open. Another aspect of the second question below is how the p/p service provider should handle situations in which the contact information supplied by the customer cannot be verified. In the parallel situation involving non-proxy registrations, the RAA specification calls either for suspension of the registration, or "manual verification," which is not defined. How should this apply in the p/p service scenario? Steve Metalitz From: gnso-ppsai-pdp-wg-bounces(a)icann.org<mailto:gnso-ppsai-pdp-wg-bounces@icann.org> [mailto:gnso-ppsai-pdp-wg-bounces@icann.org] On Behalf Of Williams, Todd Sent: Friday, March 14, 2014 4:53 PM To: Marika Konings; gnso-ppsai-pdp-wg(a)icann.org<mailto:gnso-ppsai-pdp-wg@icann.org> Subject: Re: [Gnso-ppsai-pdp-wg] For your review - updated template Cat B - question 2 Thanks Marika. I missed part of the call on Tuesday where this may have been discussed, but I don't see how the draft preliminary recommendation follows from the attached Word document, insofar as it concludes that p/p customer data should be validated and verified in a manner consistent with the requirements outlined in the 2013 RAA. I thought the current posture was that the WG has basically agreed to the 2013 RAA requirements as a floor, but that there was not yet agreement on: 1) whether validation/verification requirements should go beyond the 2013 RAA; and 2) if so, how. On the first question (2013 RAA vs. "more"), it appears that more of the responses in the attached argue for "more" than not. That also seems to have been an open topic in our email threads (see attached). Just to reiterate from that thread, the basic argument on the "more" side (which I agree with) is that in order to partially offset the delay that will inevitably occur when accessing p/p data, the "more" should consist of whatever reasonable validation/verification steps can be taken to increase the likelihood that the information ultimately obtained will be accurate enough to facilitate contact. I suppose that if we ultimately settle on a "reveal" procedure that is essentially instantaneous in certain cases (once we get to discussing "reveal" procedures), that may mitigate this concern. But absent assurances on that point, I would think we need to address it. On the second question: the attached appears to include multiple proposals as to what may or may not ultimately comprise the "more" (e.g., email and phone vs. or; periodic/annual re-verification vs. re-verification with information suggesting the contact information is incorrect; etc.). Have we debated the relative merits of those? Are some more likely to be effective than others? I have my thoughts, but I'm curious to hear what everybody else thinks. Thanks all. Todd. From: gnso-ppsai-pdp-wg-bounces(a)icann.org<mailto:gnso-ppsai-pdp-wg-bounces@icann.org> [mailto:gnso-ppsai-pdp-wg-bounces@icann.org] On Behalf Of Marika Konings Sent: Thursday, March 13, 2014 7:04 AM To: gnso-ppsai-pdp-wg(a)icann.org<mailto:gnso-ppsai-pdp-wg@icann.org> Subject: [Gnso-ppsai-pdp-wg] For your review - updated template Cat B - question 2 Dear All, Following our call earlier this week, please find attached the updated template for Category B - question 2. To facilitate your review, I've posted below the draft preliminary recommendation in which we've aimed to capture the conversation to date taking into account the language of the Whois Accuracy Specification Program of the 2013 RAA. If you are of the view that this does not accurately capture the WG's view to date and/or have specific suggestions for changes / edits, please share those with the mailing list. Also, if there are any other issues that need to be addressed in relation to this question and/or the preliminary recommendation, please share those as well. Best regards, Marika Draft Preliminary Recommendation - Category B - question 2 (Should ICANN-accredited privacy/proxy service providers be required to conduct periodic checks to ensure accuracy of customer contact information; and if so, how?) The WG recommends that proxy and privacy customer data be validated and verified in a manner consistent with the requirements outlined in Whois Accuracy Specification Program of the 2013 RAA. The WG furthermore agrees that in the cases where validation and verification of the P/P customer data was carried out by the registrar, reverification by the P/P service of the same, identical, information should not be required. Similar to ICANN's Whois Data Reminder Policy (http://www.icann.org/en/resources/registrars/consensus-policies/wdrp) the P/P provider should be required to inform the P/P customer annually of his/her requirement to provide accurate and up to date contact information to the P/P provider. If the P/P provider has any information suggesting that the P/P customer information is incorrect (such as P/P service receiving a bounced email notification or non-delivery notification message in connection with compliance with data reminder notices or otherwise) for any P/P customer, the P/P provider must verify or re-verify, as applicable, the email address(es). If, within fifteen (15) calendar days after receiving any such information, P/P service does not receive an affirmative response from the P/P customer providing the required verification, the P/P service shall verify the applicable contact information manually. _______________________________________________ Gnso-ppsai-pdp-wg mailing list Gnso-ppsai-pdp-wg(a)icann.org<mailto:Gnso-ppsai-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-ppsai-pdp-wg _______________________________________________ Gnso-ppsai-pdp-wg mailing list Gnso-ppsai-pdp-wg(a)icann.org<mailto:Gnso-ppsai-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-ppsai-pdp-wg -- _________________________ Graeme Bunton Information Specialist Tucows Inc. PH: 416 535 0123 ext 1634<tel:416%20535%200123%20ext%201634> _______________________________________________ Gnso-ppsai-pdp-wg mailing list Gnso-ppsai-pdp-wg(a)icann.org<mailto:Gnso-ppsai-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-ppsai-pdp-wg _______________________________________________ Gnso-ppsai-pdp-wg mailing list Gnso-ppsai-pdp-wg(a)icann.org<mailto:Gnso-ppsai-pdp-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-ppsai-pdp-wg

1 0

Re: [Gnso-ppsai-pdp-wg] For your review - updated template Cat B - question 2
by Michele Neylon - Blacknight March 18, 2014

March 18, 2014

I cannot agree with this. Just because somebody does not reply to an annual email does not mean anything and expecting registrars or proxy / privacy providers to do anything extra based on a lack of response is completely unreasonable. If there's a bounce or any other indication that the contact details are invalid then let the 2013 RAA standards apply - if any. But expecting registrars or privacy / proxy providers to do extra validation simply because a customer hasn't responded to an annual whois data reminder simply will not fly. We send out thousands of these reminders every year. Only a tiny percentage of our clients ever reply to them - and if their details haven't changed why on earth would they have to? Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting & Colocation, Domains http://www.blacknight.co/ http://blog.blacknight.com/ http://www.technology.ie Intl. +353 (0) 59 9183072 Locall: 1850 929 929 Direct Dial: +353 (0)59 9183090 Fax. +353 (0) 1 4811 763 Twitter: http://twitter.com/mneylon ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,Ireland Company No.: 370845 From: gnso-ppsai-pdp-wg-bounces(a)icann.org [mailto:gnso-ppsai-pdp-wg-bounces@icann.org] On Behalf Of Valeriya Sherman Sent: Monday, March 17, 2014 8:09 PM To: Metalitz, Steven; 'Williams, Todd'; Marika Konings; gnso-ppsai-pdp-wg(a)icann.org Subject: Re: [Gnso-ppsai-pdp-wg] For your review - updated template Cat B - question 2 I, Jim Bikoff, David Heasley, and Griffin Barnett agree with Todd's assessment: Contact information that is ultimately revealed is valuable only if it is accurate. The validation/verification requirements should be consistent with the 2013 RAA requirements, but should go above and beyond those requirements to ensure the accuracy of contact information. Registrars already send an annual Whois Data Reminder Policy notification to registrants, reminding them to provide accurate and up-to-date information. Similarly, the privacy/proxy customer's contact information should be verified upon initial registration of the domain name (either by the registrar or the Privacy/Proxy Service Provider) and periodically thereafter by automated annual email re-verification notifications that require an affirmative response by the P/P customer. Absence of a response would trigger a follow-up, reminding the privacy/proxy customer to provide accurate and up-to-date information. Regards, Valeriya Sherman Silverberg, Goldman & Bikoff, L.L.P. 1101 30th Street, N.W. Suite 120 Washington, D.C. 20007 Tel 202.944.2330 Cell 303.589.7477 vsherman(a)sgbdc.com<mailto:vsherman@law.gwu.edu> ________________________________ From: gnso-ppsai-pdp-wg-bounces(a)icann.org<mailto:gnso-ppsai-pdp-wg-bounces@icann.org> [gnso-ppsai-pdp-wg-bounces(a)icann.org] on behalf of Metalitz, Steven [met(a)msk.com] Sent: Monday, March 17, 2014 6:13 AM To: 'Williams, Todd'; Marika Konings; gnso-ppsai-pdp-wg(a)icann.org<mailto:gnso-ppsai-pdp-wg@icann.org> Subject: Re: [Gnso-ppsai-pdp-wg] For your review - updated template Cat B - question 2 I agree with Todd's characterization of the status of this discussion, and that the questions he highlights are still open. Another aspect of the second question below is how the p/p service provider should handle situations in which the contact information supplied by the customer cannot be verified. In the parallel situation involving non-proxy registrations, the RAA specification calls either for suspension of the registration, or "manual verification," which is not defined. How should this apply in the p/p service scenario? Steve Metalitz From: gnso-ppsai-pdp-wg-bounces(a)icann.org<mailto:gnso-ppsai-pdp-wg-bounces@icann.org> [mailto:gnso-ppsai-pdp-wg-bounces@icann.org] On Behalf Of Williams, Todd Sent: Friday, March 14, 2014 4:53 PM To: Marika Konings; gnso-ppsai-pdp-wg(a)icann.org<mailto:gnso-ppsai-pdp-wg@icann.org> Subject: Re: [Gnso-ppsai-pdp-wg] For your review - updated template Cat B - question 2 Thanks Marika. I missed part of the call on Tuesday where this may have been discussed, but I don't see how the draft preliminary recommendation follows from the attached Word document, insofar as it concludes that p/p customer data should be validated and verified in a manner consistent with the requirements outlined in the 2013 RAA. I thought the current posture was that the WG has basically agreed to the 2013 RAA requirements as a floor, but that there was not yet agreement on: 1) whether validation/verification requirements should go beyond the 2013 RAA; and 2) if so, how. On the first question (2013 RAA vs. "more"), it appears that more of the responses in the attached argue for "more" than not. That also seems to have been an open topic in our email threads (see attached). Just to reiterate from that thread, the basic argument on the "more" side (which I agree with) is that in order to partially offset the delay that will inevitably occur when accessing p/p data, the "more" should consist of whatever reasonable validation/verification steps can be taken to increase the likelihood that the information ultimately obtained will be accurate enough to facilitate contact. I suppose that if we ultimately settle on a "reveal" procedure that is essentially instantaneous in certain cases (once we get to discussing "reveal" procedures), that may mitigate this concern. But absent assurances on that point, I would think we need to address it. On the second question: the attached appears to include multiple proposals as to what may or may not ultimately comprise the "more" (e.g., email and phone vs. or; periodic/annual re-verification vs. re-verification with information suggesting the contact information is incorrect; etc.). Have we debated the relative merits of those? Are some more likely to be effective than others? I have my thoughts, but I'm curious to hear what everybody else thinks. Thanks all. Todd. From: gnso-ppsai-pdp-wg-bounces(a)icann.org<mailto:gnso-ppsai-pdp-wg-bounces@icann.org> [mailto:gnso-ppsai-pdp-wg-bounces@icann.org] On Behalf Of Marika Konings Sent: Thursday, March 13, 2014 7:04 AM To: gnso-ppsai-pdp-wg(a)icann.org<mailto:gnso-ppsai-pdp-wg@icann.org> Subject: [Gnso-ppsai-pdp-wg] For your review - updated template Cat B - question 2 Dear All, Following our call earlier this week, please find attached the updated template for Category B - question 2. To facilitate your review, I've posted below the draft preliminary recommendation in which we've aimed to capture the conversation to date taking into account the language of the Whois Accuracy Specification Program of the 2013 RAA. If you are of the view that this does not accurately capture the WG's view to date and/or have specific suggestions for changes / edits, please share those with the mailing list. Also, if there are any other issues that need to be addressed in relation to this question and/or the preliminary recommendation, please share those as well. Best regards, Marika Draft Preliminary Recommendation - Category B - question 2 (Should ICANN-accredited privacy/proxy service providers be required to conduct periodic checks to ensure accuracy of customer contact information; and if so, how?) The WG recommends that proxy and privacy customer data be validated and verified in a manner consistent with the requirements outlined in Whois Accuracy Specification Program of the 2013 RAA. The WG furthermore agrees that in the cases where validation and verification of the P/P customer data was carried out by the registrar, reverification by the P/P service of the same, identical, information should not be required. Similar to ICANN's Whois Data Reminder Policy (http://www.icann.org/en/resources/registrars/consensus-policies/wdrp) the P/P provider should be required to inform the P/P customer annually of his/her requirement to provide accurate and up to date contact information to the P/P provider. If the P/P provider has any information suggesting that the P/P customer information is incorrect (such as P/P service receiving a bounced email notification or non-delivery notification message in connection with compliance with data reminder notices or otherwise) for any P/P customer, the P/P provider must verify or re-verify, as applicable, the email address(es). If, within fifteen (15) calendar days after receiving any such information, P/P service does not receive an affirmative response from the P/P customer providing the required verification, the P/P service shall verify the applicable contact information manually.

6 5