Drafting Team 4 Kick-off Call Notes and Action Items Adobe Connect recording: <https://participate.icann.org/p7ns0sy3ohf/?OWASP_CSRFTOKEN=ba32205baa7d5c6f 9f2d022df27c77f6f8ad33f70eee561c5b2448cd9588aee0> https://participate.icann.org/p7ns0sy3ohf/ 1) Brief recap of DT4 goals and due date . To enable better understanding of existing purposes for WHOIS data, small drafting teams composed of WG members with diverse points of view were chosen to define each identified purpose. . This drafting team should discuss the tasks supported by the purpose "Business Domain Name Purchase or Sale," the parties involved in this purpose, and the data often used to fulfill this purpose. . It is hoped that fleshing out purpose definitions will improve communication and help the WG conduct informed discussion about all identified purposes before trying to agreement on legitimacy, etc . Our drafting team is asked to discuss our assigned purpose by phone and email over the next week, producing a draft purpose definition to be shared on the full WG mailing list no later than 26 October, for discussion during the WG's F2F meetings at ICANN60 Action Item: Benjamin and Rob to listen to call recording ( <https://participate.icann.org/p7ns0sy3ohf/?OWASP_CSRFTOKEN=ba32205baa7d5c6f 9f2d022df27c77f6f8ad33f70eee561c5b2448cd9588aee0> https://participate.icann.org/p7ns0sy3ohf/) to catch up on team's discussion, action item assignments, and plan to get this work done 2) All team members to share their level of experience with business domain name purchase/sale . Brian Scarpelli - smaller business community who buy and sell DNs to build or protect brand or grown business . Erica Varlese - work for registry for .blog domain, clients buy/sell DNs . Fabricio Vayra - partner at law firm representing software, social media, hardware companies, helping them buy and sell DNs - for past 3 years. Prior, oversaw all DN aspects for Time Warner as gen counsel - for example, launch of iPod or movies . Sam Lanfranco - perspective as academic and researcher, from civil society side 3) Introduce EWG's definition of this purpose, as starting point for discussion . When buying and selling domain name, you use WHOIS to conduct due diligence to find out who owns DN and who you're going to contact . During acquisition, you not only need to find out who you should contact, but also the registration history. Like when buying a house you do a title search to certify the records before and after sale to show ownership accurately . For example, company buying DN for 20K had not researched history of DN but ultimately couldn't use the DN for the intended purpose because the DN had been previously used for something that would have resulted in Trademark Infringement . Even just being able to identify difference between named registrant and registrant organization can be important. For example, company purchased DN, hired IT person to register DN for them, IT person died, person's estate locked company that paid for DN out of DN registration account and took position that IT person was registrant and therefore owner. If WHOIS data had been examined prior to purchase, after sale, this could have been prevented. . WHOIS plays role in knowing who you're working with, being able to verify they can sell/buy the DN, to carry out purchase/sale transaction, to verify (with third party) that DN has actually changed hands before final payment is made from escrow. 4) Team members less familiar with this purpose to ask general questions . There are several elements in those examples: intellectual property issue, who owns a DN, control over the DN - Did EWG think of separating these concerns out? For example, is there another way of solving identification of owner problem? Answer: When you buy/sell a DN, the only third-party verifiable source of ownership data is WHOIS. There are other things you can do - for example, go to court. But having a third-party database of ownership is common in other areas, and courts considering a DN case are going to go back and look at WHOIS for this data. 5) Team members more familiar with this purpose to give real-world examples of this purpose, drawn from their own experiences . Anecdotally, experiences heard from small business members: When purchasing a DN, consulting a resource like WHOIS is maybe more important for small businesses than large corporations because they don't have a lot of resources to dedicate to outside legal counsel, in many cases, small business owners are doing these things themselves. They are using contact information from WHOIS to reach out to registrants of DNs. . Example: 4 days before iPod.com launch, relied on WHOIS to know who owned and who to contact and who to broker with. The difference between what WHOIS is today vs back in 2002 - the transfer system was different back then, beyond contact had to rely on transfer agreement notarized by both parties and submitted to registrar. Somewhere along the line an optimization occurred to be able to email AuthCode to effectuate transfer without offline notarize forms. Long ago (even before that) you had to ask ICANN for a domain name and submit a paper document. ICANN and registrars moved the community to an electronic process that we now rely on. If we're not going to use WHOIS for these purposes, we'd need another process like paper certifications, which might result in less crime but would take longer and potentially be more costly for parties involved (and make buying DN harder and more expensive). Electronic processes are more streamlined but require more reliance on a system like WHOIS that's third party trusted. . Going back to paper is a non-starter, but is there something about the escrow process that could be beefed up to deter errors and abuse? There still needs to be a record (a single source of truth) - WHOIS is a public display for that source today. If you eliminate public WHOIS, the source of truth is still required, so the question is do you want to make it a self-serve tool or rely on another process to check that data? Still needs to be some source of data to verify that transaction occurred and DN ownership was transferred, and both seller and buyer need this confirmation. If party A who purchased DN doesn't reply, party B must wait for party A to reply out of band instead of relying on a trusted third party's data. . As economist, Sam notes that land registries are increasingly looking at block chain technology as method of tracking/verifying ownership - does that apply here? Way of maintaining high-quality trusted log of activity associated with an object (e.g., land title, currency) - efficient way of proving integrity of ownership. "Distributed ledger" per wikipedia definition. Blocks containing cryptographic hashes for each transaction; can't get full record - only system can do so, with keys. Block chain technology is not designed to require a name - could use another kind of identifier (PIN) for parties involved (e.g., buyer and seller would require access to their part of the block-chained record.) . Consider a Privacy/Proxy (P/P) registered DN, such as a DN registered to attack government without exposing civil society to risk: How does P/P play a role in buy/sell DN transactions today? In P/P purchase cases, you have no idea who you're contacting via P/P contact data (slightly lost from the start), and then you are at the whim of the [P/P's] system because you don't know if your emails are reaching the DN owner or not (i.e., are they not interested in selling the DN?, are they not receiving the email?) This stifles commerce. For example, case of lookalike site that's not infringing but still a desire to reach that registrant to discuss changes to reduce consumer confusion. Company reached out via P/P published email address in WHOIS but got no response. Company reached out via P/P's own website form but got no response. Before resorting to legal action, company tried to use any contact info that could be guessed at from website and discovered the lookalike site's owner had never received any email from P/P provider. Ultimately this problem was resolved with a phone call and not legal action. Return receipt in SMTP email is not reliable, so we'd need something with reliable proof-of-delivery in any alternative communication method recommended to meet the needs of this purpose. 6) Divvy up drafting and agree upon plan to flesh out template by 26 October Drafting Tasks: . Describe user(s) involved in this purpose . Identify registration data often used in this purpose . Refined definition of this purpose . As desired, team may also identify requirements involved in this purpose Note: You may but are not required to start with EWG text that has been copied into this DT's template: http://mm.icann.org/pipermail/gnso-rds-pdp-4/attachments/20171013/e371b4ae/D raftingTeam4-DNPurchaseSale-Template-0001.docx Action Item: Erica to send bullets describing users and gTLD registration data elements for "Business Domain Name Purchase or Sale" to DT6 mailing list no later than Thursday am. Lisa will assist with drafting text to reflect bullets and team discussion. Action Item: Sam to send bullets enumerating a few tasks involved in "Business Domain Name Purchase or Sale" to DT6 mailing list no later than Thursday am. Lisa will assist with drafting text to reflect bullets and team discussion. Action Item: All DT6 team members (including those not present for today's call) to review bullets from Sam and Erica, and to provide feedback on the DT6 dedicated mailing list: <mailto:gnso-rds-pdp-4@icann.org> gnso-rds-pdp-4@icann.org Action Item: GNSO-secs@icann.org to distribute a Doodle poll to schedule another DT6 call for next Monday or Tuesday. If sufficient progress is made on-list, we may not need call, but we will schedule one in anticipation of needing it to complete draft text to share with the WG by 26 October