Kathy: Attached is my first crack at our portion of the summary (on the Bucket Two comments). Let me know if you have any suggested edits, additions, subtractions, etc. Also, I've copied the entire sub-team mailing list on this email, for two reasons: 1) So that there is a transparent public record of any back-and-forth red-lining of the document that we may do; and 2) So that Sara and Holly for Bucket One, and Darcy for our miscellaneous bucket, can see what I envision for our summary report to the WG. If you all want to add your summaries to this one to make it consistent in terms of formatting, etc., feel free. I had one thought Sara and Holly for Bucket One (which came to me as I was conceptually dividing our Bucket Two comments into general support, specific support, suggested changes by addition, suggested edits uncontested, suggested edits contested): it may be helpful for the WG if we divide our Bucket One comments into categories along a spectrum. As I envision it (in order along the spectrum): 1) No disclosure/publication ever. 2) No disclosure/publication unless following a court order. I would put the 10,000+ "Respect our Privacy" comments here. 3) No disclosure/publication unless following a court order or other legal process (such as a UDRP). E.g., I think the Google comment would go here. 4) No disclosure/publication unless following a court order or other legal process (such as a UDRP), but with some exceptions for cases of abuse. E.g., I think the ICA and EasyDNS comments would go here. For the WG's sake, we may also want to distinguish between those Bucket One comments that couched their discussion of disclosure/publication in terms of what P/P Providers ought to be required to do (or not required to do) in response to external third-party disclosure requests such as from IP owners or LEA (e.g., the Google and Key Systems comments) vs. those Bucket One comments that simply said "no publication/disclosure absent a court order" without distinguishing b/w whether the impetus for the disclosure was an external third-party request or the P/P Provider's own desire to disclose/publish (e.g., the 10,000+ "Respect our Privacy" comments). Thanks all! TW. From: Williams, Todd Sent: Wednesday, August 05, 2015 10:06 AM To: Williams, Todd <Todd.Williams@turner.com>; Kathy Kleiman <kathy@kathykleiman.com>; gnso-ppsai3@icann.org Subject: RE: [Gnso-ppsai3] UPDATED Public Comment Review Tool - questions about inclusion Whoops, I left out Jawala at the bottom, who should go in bucket two. Sorry. From: gnso-ppsai3-bounces@icann.org<mailto:gnso-ppsai3-bounces@icann.org> [mailto:gnso-ppsai3-bounces@icann.org] On Behalf Of Williams, Todd Sent: Wednesday, August 05, 2015 10:01 AM To: Kathy Kleiman <kathy@kathykleiman.com<mailto:kathy@kathykleiman.com>>; gnso-ppsai3@icann.org<mailto:gnso-ppsai3@icann.org> Subject: Re: [Gnso-ppsai3] UPDATED Public Comment Review Tool - questions about inclusion Yes, thanks Mary. Of the highlighted additions in the attached, I've added the comments from Stefan Grunder, Reagan Lynch, Reid Baker, and the Save Domain Privacy petitioners to the second bucket that Kathy and I are reviewing/summarizing (accept premise of Annex E, but with changes). I think the highlighted comments from Dan M, Simon Kissane, Adam Creighton, Jason Weinberg, J Wilson, Dylan Henderson, M.B., and the Respect our Privacy submissions should go in the first bucket that Holly and Sara are reviewing/summarizing (reject premise of Annex E). Thanks. From: gnso-ppsai3-bounces@icann.org<mailto:gnso-ppsai3-bounces@icann.org> [mailto:gnso-ppsai3-bounces@icann.org] On Behalf Of Kathy Kleiman Sent: Tuesday, August 04, 2015 6:47 PM To: gnso-ppsai3@icann.org<mailto:gnso-ppsai3@icann.org> Subject: Re: [Gnso-ppsai3] UPDATED Public Comment Review Tool - questions about inclusion Tx Mary! Kathy : Thanks again, Todd, Kathy, Holly and everyone - this is just a note to follow up on one portion of the discussion during the WG call earlier today. I'll be going through the current WG Public Comment Review Tool (Part 1, covering the WG's preliminary recommendations #1 through #9) to pick out those additional comments that, though "attached" to a different recommendation or question, is actually more directly relevant to the scope of this Sub Team. What this means, I'm afraid, is that there will most likely be an updated version of the Sub Team's Review Tool (i.e. the Word document that you're working off of). I will try to get that to you all as soon as I possibly can - with the caveat that as I complete preparation of the WG Tool Part 2 (covering the remainder of the WG's preliminary recommendations except for those being covered by the Sub Teams) there may yet be further updates. I'm happy to help update any existing summary documents you may already have as a result, of course, and, Todd, to your point about adding an extra row to the existing Tool to reflect the Save Domain Privacy comment in their petition, I'm happy to do that (per Kathy's suggestion on the call today) while I'm doing the current update anyway. Thanks and cheers Mary Mary Wong Senior Policy Director Internet Corporation for Assigned Names & Numbers (ICANN) Telephone: +1 603 574 4889 Email: mary.wong@icann.org<mailto:mary.wong@icann.org> From: <gnso-ppsai3-bounces@icann.org<mailto:gnso-ppsai3-bounces@icann.org>> on behalf of "Williams, Todd" <Todd.Williams@turner.com<mailto:Todd.Williams@turner.com>> Date: Tuesday, August 4, 2015 at 09:55 To: Kathy Kleiman <kathy@kathykleiman.com<mailto:kathy@kathykleiman.com>>, Holly Raiche <h.raiche@internode.on.net<mailto:h.raiche@internode.on.net>> Cc: "gnso-ppsai3@icann.org<mailto:gnso-ppsai3@icann.org>" <gnso-ppsai3@icann.org<mailto:gnso-ppsai3@icann.org>> Subject: Re: [Gnso-ppsai3] UPDATED Public Comment Review Tool - questions about inclusion Thanks Kathy and Holly. Just to summarize where I think we are (and again, I've been working backward from what Sub-team 1.3.2 presented last week, which I've attached - I assume that what our sub-team will present next week will look something like that): * First there will be a paragraph (or bullet point or however we want to style it) discussing those comments that argued that the WG's proposed accreditation standards should hold that P/P Providers can never disclose and/or publish under any circumstances. This section will discuss: how many of those comments were there, who did they come from, what did they argue. * Next there will be a paragraph discussing those comments that argued that the WG's proposed accreditation standards should hold that P/P Providers can only disclose and/or publish following a court order, subpoena, or other legal process. Again, this section will discuss: how many of those comments were there, who did they come from, what did they argue, etc. I agree with Kathy that the "Respect our Privacy" submissions should be analyzed in this paragraph. I also agree with Holly's point though that in this paragraph we should note that the "Respect our Privacy" submissions took a more extreme position than others (like Google's, for example), in that they argued that P/P Providers can only disclose and/or publish following a court order, and didn't accept that other legal or ICANN-recognized processes (such as a UDRP for example) could suffice. * Next there will be a paragraph discussing those comments that argued that our WG's proposed accreditation standards should hold that P/P Providers can sometimes disclose and/or publish absent a court order, subpoena, or other legal process, but then offered thoughts as to whether and how the Disclosure Framework outlined in Annex E ought to be modified. My plan for this paragraph was to first have a general summary of whose comments fell in this category. And I agree with Kathy that the Save Domain Privacy petition signatories fit here, in that "verifiable evidence of wrongdoing" is what II(A), (B), and (C) of Annex E contemplate. Following that summary, my plan was then to list each proposed change to the language of Annex E (perhaps in a bullet point format), followed by who recommended it, and what their arguments were for it. That said, I disagree with Kathy that each of those comments and all of those suggested changes will necessarily be to a "higher standard." From my initial review, I think the comments are going to recommend changes in both directions, which we ought to reflect in the summary. * Finally there will be a paragraph discussing those comments that we're not sure what to do with. That's how I see our task anyway. So far we have Sara and Holly writing the first draft of the first two paragraphs, me and Kathy writing the third, and Darcy writing the fourth (though of course we can all edit the final before it goes to the entire WG). Let me know if anybody else wants to join. And with that, my quick thoughts on some of the bigger-picture points below: * Given that our summary will only be on what commenters said about Annex E, and given that Annex E doesn't touch on LE requests, my thought is that we should leave analysis of comments on LE to the other sub-teams (I'm pretty sure LE would fall in both sub-team 1 and sub-team 4's work). Not that I'm not interested in LE - just that we have plenty of work as it is, without duplicating work that is being handled by other sub-teams. * In response to Mary's email (attached): I agree that I'm not sure that I see the utility of adding the form-based submissions to the compiled template/matrix Word doc. As I understand it, the attached Word doc is just a tool to help us get to our final work product, which is the summary presentation to the rest of the WG. If we make a point to discuss the form-based submissions in our summary presentation to the rest of the WG (which, as I noted above, we're certainly planning to do), then I don't see why we'd need to add columns to the attached Word doc for each of those. I mean, if somebody wants to take the time to do so, that's fine. I just don't see how that helps us get to our final work product. * Finally, one quick point: I see our sub-team's role, and the role of the summary that we are to present to the entire WG next week, as purely descriptive. In other words: what did the comments say? To the extent that there is going to be any normative or substantive discussion that goes one step beyond that - OK, this is what the comments said, but now what do we do about that? - I think that has to be left to the entire WG to debate after we present our summary. I'm just throwing out that reminder b/c I think it will help keep our work easier. Thanks all! From: gnso-ppsai3-bounces@icann.org<mailto:gnso-ppsai3-bounces@icann.org> [mailto:gnso-ppsai3-bounces@icann.org] On Behalf Of Kathy Kleiman Sent: Tuesday, August 04, 2015 5:49 AM To: Holly Raiche <h.raiche@internode.on.net<mailto:h.raiche@internode.on.net>> Cc: gnso-ppsai3@icann.org<mailto:gnso-ppsai3@icann.org> Subject: Re: [Gnso-ppsai3] UPDATED Public Comment Review Tool - questions about inclusion Hi All, I support the division of comments into buckets as Todd has created and Holly has revised. Do we have four buckets now? Below (and preceeded by "==>") I show where the two large groups of missing comments might go. Tx! Hi Everyone First- sorry not to follow up sooner. And Todd - I agree with the refined break up into three buckets- with an additional element or so. The first category is clearly no, not ever, under any circumstances. All that is needed from us is to count the comments and where they are from. ==> So bucket one, no disclosure ever. The second is one I'd like to expand a bit - and see where that gets us. As Todd and I suggest, it is a category that specifically states the need for a legal process. (it is framed variously as court order court process, Subpoena) My suggestion is that the overall heading is no reveal unless there has been a legal process of some sort in the relevant jurisdiction. The wrinkle here is that, under an ICANN dispute resolution process (e.g., UDRP) where details of the customer would be revealed. Given this is a recognised ICANN process in which details are already revealed, my suggestion is to characterise th category in that way. ==> Bucket Two, disclosure of data to private parties and law enforcement only subject to court order. This is where the "Respect our Privacy" thousands of individual submissions fits: "No one's personal information should be revealed without a court order, regardless of whether the request comes from a private individual or law enforcement agency". (Mary, do we happen to have a final count of these individual submission?) My reading of both categories is to say that Annex E is not necessary for either. (and Kathy - the comments you refer to below would fit into the first or second basket) The third category is the only one that goes beyond what is already required to suggest there may be other circumstances where the contact details of the customer would be revealed to a third party that is either not part of an ICANN process or a court process. And the challenge will be to work through what those situations are. ==> Bucket Three (formerly Two) is now the one that accepts the premise of Annex E, as Holly and Todd have laid out, but offers thoughts on how to change the Disclosure Framework to the higher standards requested by commenters. The question for me is what bucket the 11,000 Save Domain Privacy petition signatories fit in: they wrote "Privacy providers should not forced to reveal my private information without verifiable evidence of wrongdoing." Can Annex E be revised to raise the standard to require "verifiable evidence of wrongdoing" w/o a court order? If so, what changes must be made in Annex E to meet this higher standard? If not, do these 11,000+ petition signatures really belong in [revised] Bucket 2, court order? I look forward to our discussions ahead! My next query is where we put Law Enforcement Agency requests. If they have a warrant, I'd suggest that we put them in the second category - in most jurisdictions, warrants are not granted without some kind of judicial oversight. Without a warrant (or some judicial oversight), requests by Law Enforcement/Security requests would be under some kind of Annex. ==> Holly, do I understand right that this might be a new Bucket Four - LE w/o CO -- Law Enforcement w/o Court Order. I think it makes sense and I would like to see where the comments fall on this issue. Plus Annex E is only for private individuals/private attorneys/private companies. So now seems to be a good time to break out informal LE requests into its own category. I"ll be having a look at that third category My other way of looking at this issue is whether or not the relevant p/p provider must make some sort of judgment call. For the first category - the answer is a simple NO. For the second category, there is either some sort of judicially approved document for that jurisdiction or an approved ICANN process - or not. It is only in the third category that the providers must make a judgment call on whether the requirements are met, or not. ==> Quick note, we still need the miscellaneous bucket that Todd created for "unclear" bucket, so [renamed] Bucket Five = unclear? Best, Kathy Happy to discuss Holly On 4 Aug 2015, at 8:44 am, Kathy Kleiman <Kathy@kathykleiman.com<mailto:Kathy@kathykleiman.com>> wrote: Hi Mary and All, Glad to be with you on this subteam 3 and looking forward to our discussion. Mary, I was very glad to see that Turner Broadcasting comments had been included in this comment summary. Let me ask about the 10,000+ comments we received, the vast majority entitled: ICANN- Respect Our Privacy. All of these comments contain a clear call: - No one's personal information should be revealed without a court order, regardless of whether the request comes from a private individual or law enforcement agency. Sorry if I missed it, but is this call from so many thousands of commenters for not disclosing p/p data to a private individual (which would include a private lawyer) reflected in our comment summary tool? Best and tx, Kathy : Dear all, Please find an updated Word document that now INCLUDES the extensive comments from Turner Broadcasting System (once again, thanks for spotting this omission, Todd!). They have been inserted into ROW 19 for the first question/topic (General Comments) on PAGE 16, and ROW 7 for the second question/topic (Specific Comments on the Framework Language) on PAGE 39. Apologies again for the inadvertent omission - they have been added to these rows and pages simply to retain the chronology of when they were received, to maintain consistency across all the templates. I'll update the Sub Team wiki page accordingly. Thanks and cheers Mary Mary Wong Senior Policy Director Internet Corporation for Assigned Names & Numbers (ICANN) Telephone: +1 603 574 4889 Email: mary.wong@icann.org<mailto:mary.wong@icann.org> From: <gnso-ppsai3-bounces@icann.org<mailto:gnso-ppsai3-bounces@icann.org>> on behalf of Mary Wong <mary.wong@icann.org<mailto:mary.wong@icann.org>> Date: Thursday, July 30, 2015 at 18:06 To: "Williams, Todd" <Todd.Williams@turner.com<mailto:Todd.Williams@turner.com>>, "gnso-ppsai3@icann.org<mailto:gnso-ppsai3@icann.org>" <gnso-ppsai3@icann.org<mailto:gnso-ppsai3@icann.org>> Subject: Re: [Gnso-ppsai3] Thoughts on a work plan Hello Todd and everyone, Welcome to the Sub Team 3 (Annex E) mailing list! Todd - I think you just found an omission from staff (me), for which I apologize. I definitely had the Turner comment in my compilation of comments and documents, but I think what happened is that in formatting the table for the Word document I somehow managed to edit that out. I am very sorry, and thanks for noting it! This is exactly why staff welcomes WG members' questions, and why we emphasize that our compilation/edits don't replace WG members' reading the comments themselves if possible. At the same time, I do hope you all know that we try our best to do as thorough and comprehensive a job as possible, so a combination of our efforts and a WG's/Sub Team's eagle eyes is the best arrangement. Basically, we read through all the comments that appeared to address specific recommendations and/or open questions, and we also read all the online template responses that do the same. The Word document is therefore the compilation of all of these, tailored to each Sub Team (or the full WG, as appropriate). I've taken a quick look through my documents/collected comments and don't believe I have missed out any others; however, I will do a more thorough check shortly on all the Word documents I've compiled to date for all the Sub Teams, just to be sure. On the approach - from the staff perspective, Todd's suggested approach seems to make sense, and would align pretty well with what we ourselves would probably have suggested. You could start with two smaller groups to tackle the two categories suggested, based on Todd's initial sweep, and in doing so also note any comments that didn't address either - so that they can either be referred to the appropriate Sub Team (if any) or considered by the full WG (if appropriate). BTW, Todd, maybe it's my machine or more likely that I haven't looked through it in detail, but I'm not seeing your comments/additions/edits in the document you circulated .... ? Thanks for kicking things off, and do let me know if you need assistance from staff in any way! Cheers Mary Mary Wong Senior Policy Director Internet Corporation for Assigned Names & Numbers (ICANN) Telephone: +1 603 574 4889 Email: mary.wong@icann.org<mailto:mary.wong@icann.org> From: <gnso-ppsai3-bounces@icann.org<mailto:gnso-ppsai3-bounces@icann.org>> on behalf of "Williams, Todd" <Todd.Williams@turner.com<mailto:Todd.Williams@turner.com>> Date: Thursday, July 30, 2015 at 16:52 To: "gnso-ppsai3@icann.org<mailto:gnso-ppsai3@icann.org>" <gnso-ppsai3@icann.org<mailto:gnso-ppsai3@icann.org>> Subject: [Gnso-ppsai3] Thoughts on a work plan Am I the first to try this out? Cool. As I mentioned in my email on Tuesday (attached), I thought that the presentation that we had on our last call from the 1.3.2 sub-team was helpful to illustrate where we'll need to be by 8-11, which in turn might help us decide what we'll need to do to get there. Specifically, I thought it helped that the 1.3.2 sub-team divided their work into two basic questions, and then presented separately on each. I'd recommend that we do the same. Here are the two that I'd propose: 1) Those comments that rejected the premise of Annex E, and instead argued that P/P Providers can never disclose and/or publish absent a court order, subpoena, or other legal process authorizing them to do so. Presumably this group would present on: * How many of these comments were there? * Who did they come from? * What arguments did they make? * What ramifications would these arguments have on other portions of the Initial Report beyond Annex E? 2) Those comments that accepted the premise of Annex E that P/P Providers can sometimes disclose and/or publish absent a court order, subpoena, or other legal process, but then offered thoughts as to whether and how the Disclosure Framework outlined in Annex E ought to be modified. Presumably this group would present on: * How many of these comments were there? * Who did they come from? * What arguments did they make? * What potential changes to Annex E could the WG make to address the arguments raised in these comments? I offer those two buckets for a couple of reasons. First, I think it will help our sub-team "divide and conquer" the work that we have before us (much like the 1.3.2 sub-team did). Second, I'm not really sure how we'd otherwise substantively reconcile those two buckets of comments. A comment that argues that P/P Providers should not be allowed to disclose and/or publish absent a court order isn't arguing for changes to Annex E; it's arguing to scrap Annex E altogether. With those two buckets in mind, I've taken a first pass through the comments in the Review Tool Word Document that Mary circulated (attached). My thoughts below. First, can everybody double-check to make sure that they agree with how I've tentatively divided the comments? Once we're comfortable with that allocation, then perhaps the next step would be to divide our sub-team into two (or three, if some members want to tackle the third "unclear" category) to start reviewing the comments in each bucket and then drafting two documents to present to the WG answering the questions outlined above (and any other questions that anybody wants to suggest). Finally, one last question for Staff: can you give us a little bit of information on the methodology of how the attached Word document was compiled? I'm just curious because I want to make sure that our sub-team is comfortable that what we are reviewing is exhaustive. For example, I know that Turner's comment (available here:http://forum.icann.org/lists/comments-ppsai-initial-05may15/pdfrXQ3VcnSR7.pd...) had some thoughts on Annex E. Yet it wasn't included in the attached. And I only know that it mentions Annex E because I drafted it. :) So I want to make sure that there aren't other comments on Annex E that we also ought to be reviewing. Thanks. Look forward to working with everybody. Todd. Todd D. Williams Counsel Turner Broadcasting System, Inc. One CNN Center, 10 North Atlanta, Georgia 30303 P: 404-827-2234 F: 404-827-1994 todd.williams@turner.com<mailto:todd.williams@turner.com> * Bucket One: rejects the premise of Annex E. 1) Internet Commerce Association (though with carve-out for breach of material service terms such as Internet abuse) 2) Google 3) 1&1 Internet SE 4) Access Now 5) Endurance Int'l Group 6) Jeff Wheelhouse 7) EasyDNS (though with same carve-out as ICA for breach of service terms such as net abuse) 8) Greg McMullen 9) Evelyn Aya Snow 10) Ralf Haring 11) Liam 12) Dr M Klinefelter 13) Sam 14) Dan M 15) Adrian Valeriu Ispas 16) Not your business 17) Simon Kissane 18) TS 19) Cort Wee 20) Alex Xu 21) Kenneth Godwin 22) Shahed Ahmmed 23) Sebastian Broussier 24) Andrew Merenbach 25) Finn Ellis 26) Aaron Holmes 27) Michael Ekstrand 28) Homer 29) Donuts 30) Michael Ho 31) Key Systems * Bucket Two: accepts the premise of Annex E, but offers thoughts on how to change the Disclosure Framework. 1) BC 2) MPAA 3) ISPCP 4) CDT, Open Technology Institute & Public Knowledge 5) INTA 6) IACC 7) NCSG 8) Shardul Amarchand Mangaldas 9) Cyberinvasion 10) Phil Crooker 11) Aaron Myers 12) Cui (ADNDRC) 13) Mike Fewings 14) Name withheld 15) Gary Miller 16) Byunghoon Choi 17) Reid Baker 18) Nick O'Dell 19) Time Warner 20) RIAA & IFPI 21) IPC 22) Thomas Smoonlock 23) Vanda Scartezini 24) Tim Kramer * Bucket Three: unclear. 1) Sven Slootweg 2) Brendan Conniff 3) Marc Schauber 4) Aaron Mason 5) Kevin Szprychel 6) Christopher 7) James Ford 8) Shantanu Gupta 9) Christopher Smith 10) Private 11) Robert Lukitsh 12) Adam Miller 13) Charles 14) Aaron Dalton 15) Stephen Black Wolf 16) Ian McNeil 17) Adam Creighton 18) Arthur Zonnenberg 19) Anand S. 20) Lucas Stadler 21) Alan _______________________________________________ Gnso-ppsai3 mailing list Gnso-ppsai3@icann.org<mailto:Gnso-ppsai3@icann.org> https://mm.icann.org/mailman/listinfo/gnso-ppsai3 _______________________________________________ Gnso-ppsai3 mailing list Gnso-ppsai3@icann.org<mailto:Gnso-ppsai3@icann.org> https://mm.icann.org/mailman/listinfo/gnso-ppsai3 _______________________________________________ Gnso-ppsai3 mailing list Gnso-ppsai3@icann.org<mailto:Gnso-ppsai3@icann.org> https://mm.icann.org/mailman/listinfo/gnso-ppsai3