Notes and action items from today's DT5 meeting
Dear All, Please find below the notes & action items from today’s DT5 meeting. Please take particular note of the action items. Best regards, Marika DT5 - Regulatory or Contractual Enforcement Meeting on 18 October 2017 1. Welcome & roll call * Role of coordinator is to co-ordinate & facilitate, for DT members to do the actual work 2. Brief recap of drafting team goals and due date a. Overall goal: To enable better understanding of the Regulatory or Contractual Enforcement purpose for Whois data, first in DT5 and then in the full RDS PDP WG. * See also the template that has been circulated. * Objective is NOT to determine whether or not this purpose is legitimate, but to ensure understanding of what this purpose entails * Deadline to complete tasks by Thursday 26 October - will require everyone to contribute and participate b. Tasks i. List and briefly describe tasks commonly involved in carrying out this purpose. ii. Describe the parties who often access gTLD registration data in pursuit of Regulatory or Contractual Enforcement purposes iii. List gTLD registration data often involved in this purpose. iv. Describe the purpose succinctly in one paragraph * Who are the parties that request WHOIS data today for Regulatory or Contractual Enforcement purposes? * What role does gTLD registration data play for Regulatory or Contractual Enforcement purposes? * Why is access to Whois data needed to fulfill Regulatory or Contractual Enforcement purposes? v. Prepare and submit the final deliverable to the full RDS PDP WG not later than Thursday, October 26. vi. Provide an overview of the final deliverable in the Face-to-Face WG meeting on Saturday, October 28 in Abu Dhabi and interact with WG members in that meeting to answer their questions and help them understand the Regulatory or Contractual Enforcement purpose. 3. All team members to share their level of experience with the regulatory or contractual enforcement purpose * Bastiaan Goslings - no experience in this area, hopes to gain a better understanding through asking questions * Beth Bacon - middle of the road level of experience. Previous position was US government so some familiarity with how colleagues used RDS data for these purposes, now experience from a registry perspective. * Farell Folly - more than 5 years of experience in regulatory (government) are especially in mobile telecommunications and Internet Service providers, but not especially with domain names. * Krishna Seeburn - has been part of the regulatory body, also worked with policy and LE in certain situations. Not a practicing lawyer, but good insight into what is being discussed. * Steve Metalitz - lawyer in private practice, has counseled clients involved in the scenarios outlined in the paper (contract compliance). Some direct experience and general experience in the regulatory environment. * Theo Geurts - as a registrar a lot of experience dealing with LE, IP as well as government. Been doing this since 2009 and responsible for the abuse team. 4. Introduce EWG's definition of this purpose as a starting point for discussion (see both EWG Report excerpts on page 2 of template) * See template for EWG definition and example use cases. DT may decide to use this as a starting point if deemed helpful, but no obligation to do so. * Current description is very broad, more focused on use cases. Is objective to craft a purpose statement that could be used to share with DPAs in the context of data protection legislation? Important not to get hung up on the term 'definition' for now. * Recent work on users may help inform this, namely dataflow matrix that was created as part of the small group working on GDPR issues: https://www.icann.org/resources/pages/gtld-registration-dataflow-matrix-2017... * Use case developed by RDS PDP WG may also assist in this regard (see https://community.icann.org/download/attachments/60493753/14-WHOIS%20queries...). In addition, EWG report identified a number of use cases for this purpose. 5. Initial Discussion a. Q&A between members less familiar with this purpose and those who have direct experience with it * Would be helpful to briefly describe tasks involved in this purpose? Who has been asked for what, in what context? b. Team members more familiar with this purpose to give real-world examples of this purpose drawn from their own experiences * UDRP - pretty straightforward process: registrar gets inquiry from UDRP provider, who is registrant, when was last update, etc. Info sent back to UDRP provider, following which procedure starts. Sometimes info is masked as a result of P/P services - requires review of conditions to see if unmasking is allowed. If info is not unmasked, P/P provider will be named as defendant. Some registrars will provide information to UDRP provider but will not reveal the info in WHOIS (depends on terms and conditions of P/P). The UDRP provider will look at publicly available WHOIS to send the necessary materials to registrant - even though info may not always be actionable. UDRP provider uses WHOIS info to be able to start their proceedings. The UDRP rules require the UDRP provider to send a "verification request" to registrar. UDRP provider also uses Whois data directly to send notice of the complaint to the respondent. * Intellectual property owner who identifies a site potentially infringing IP. Needs to be able to assess whether the registrant has authorisation/license to use IP. Contract enforcement issue - need to find out whether the person using IP has the right to do so. If not, it would involve next steps, for example getting ICANN compliance involved to enforce legal obligations. Would first go to WHOIS info to find a possible answer, even if info is not actionable (for example, in case of P/P). Would also include a WHOIS lookup to try and identify hosting party. * Contractual compliance - WHOIS accuracy - contractual obligation by registrars to correct info within a certain timeframe following receipt of WHOIS accuracy complaint. Received from all kinds of sources: registrants, ICANN compliance, third parties. * Registration data escrow audits - registrars need to ensure that registrant data is escrowed to an escrow provider to make sure that should a registrar go out of business, ICANN can get hold of registrant data to be able to provide continuity of service. Compliance audits are in place to ensure that data is available, complete, accurate. * Audits also in place to check how processes are applied that involve, amongst others, RDS info such as sending of FOA, transfers, etc. Action item #1: DT members to dedicate time over the course of next week to this topic and encouraged to share perspectives on the mailing list. c. Identify & discuss issues where more understanding is needed 6. Assign responsibilities for creating first drafts a. Task i: b. Task ii c. Task iii * Consider having one person doing task i, ii and iii for the different use cases. * Consider using google doc so that others can add / edit as appropriate. * Steve Metalitz: Intellectual Property owners. (Steve to send to the mailing list, Beth to turn it into a google doc). Action item #2: DT members to share first draft by end of day on Thursday 19 October. 7. Next steps and action items a. List discussion on agenda item 5.c. (Chuck will initiate this after call.) b. Volunteers for agenda items 6.a, 6.b & 6.c will submit their first drafts to the list and initiate list discussion not later than Friday, October 20 8. Next teleconference call(s) a. Suggestions: i. Next call on Monday October 23 or Tuesday October 24 ii. Third call early on Thursday October 26 if needed to finalize deliverable b. Chuck will request a Doodle Poll for the following days: i. Monday October 23 ii. Tuesday October 24 iii. Thursday October 26 Action item #3: Staff to circulate doodle poll to schedule next meeting on Monday or Tuesday next week. Doodle poll would also include possible third meeting on Thursday 26 October - but if work is completed by that date, it would be cancelled. Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings@icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<http://learn.icann.org/courses/gnso> and visiting the GNSO Newcomer pages<http://gnso.icann.org/sites/gnso.icann.org/files/gnso/presentations/policy-e...>.
Fellow subteam 5 members, Attached please find my draft on tasks i, ii and iii from the intellectual property owner perspective. Welcome your feedback/questions. (Apologies I did not note that the circulation deadline was accelerated from today to end of day yesterday.) I view this as supplementing the similar summaries for each of the other use cases identified --- the due diligence on an online merchant use case put forward by Terri Stumme, and the use cases for online tax investigation, UDRP proceedings, and RDS ecosystem contractual compliance (including data escrow audits) identified in the EWG report. The first of these could readily be extracted from Terri’s submission, and I imagine that either or both of the registry/registrar compliance specialists on our subteam could easily prepare the last two. Steve Metalitz [image001] Steven J. Metalitz | Partner, through his professional corporation T: 202.355.7902 | met@msk.com<mailto:met@msk.com> Mitchell Silberberg & Knupp LLP | www.msk.com<http://www.msk.com/> 1818 N Street NW, 8th Floor, Washington, DC 20036 THE INFORMATION CONTAINED IN THIS E-MAIL MESSAGE IS INTENDED ONLY FOR THE PERSONAL AND CONFIDENTIAL USE OF THE DESIGNATED RECIPIENTS. THIS MESSAGE MAY BE AN ATTORNEY-CLIENT COMMUNICATION, AND AS SUCH IS PRIVILEGED AND CONFIDENTIAL. IF THE READER OF THIS MESSAGE IS NOT AN INTENDED RECIPIENT, YOU ARE HEREBY NOTIFIED THAT ANY REVIEW, USE, DISSEMINATION, FORWARDING OR COPYING OF THIS MESSAGE IS STRICTLY PROHIBITED. PLEASE NOTIFY US IMMEDIATELY BY REPLY E-MAIL OR TELEPHONE, AND DELETE THE ORIGINAL MESSAGE AND ALL ATTACHMENTS FROM YOUR SYSTEM. THANK YOU. From: gnso-rds-pdp-5-bounces@icann.org [mailto:gnso-rds-pdp-5-bounces@icann.org] On Behalf Of Marika Konings Sent: Wednesday, October 18, 2017 10:09 AM To: gnso-rds-pdp-5@icann.org Subject: [Gnso-rds-pdp-5] Notes and action items from today's DT5 meeting Dear All, Please find below the notes & action items from today’s DT5 meeting. Please take particular note of the action items. Best regards, Marika DT5 - Regulatory or Contractual Enforcement Meeting on 18 October 2017 1. Welcome & roll call * Role of coordinator is to co-ordinate & facilitate, for DT members to do the actual work 2. Brief recap of drafting team goals and due date a. Overall goal: To enable better understanding of the Regulatory or Contractual Enforcement purpose for Whois data, first in DT5 and then in the full RDS PDP WG. * See also the template that has been circulated. * Objective is NOT to determine whether or not this purpose is legitimate, but to ensure understanding of what this purpose entails * Deadline to complete tasks by Thursday 26 October - will require everyone to contribute and participate b. Tasks i. List and briefly describe tasks commonly involved in carrying out this purpose. ii. Describe the parties who often access gTLD registration data in pursuit of Regulatory or Contractual Enforcement purposes iii. List gTLD registration data often involved in this purpose. iv. Describe the purpose succinctly in one paragraph * Who are the parties that request WHOIS data today for Regulatory or Contractual Enforcement purposes? * What role does gTLD registration data play for Regulatory or Contractual Enforcement purposes? * Why is access to Whois data needed to fulfill Regulatory or Contractual Enforcement purposes? v. Prepare and submit the final deliverable to the full RDS PDP WG not later than Thursday, October 26. vi. Provide an overview of the final deliverable in the Face-to-Face WG meeting on Saturday, October 28 in Abu Dhabi and interact with WG members in that meeting to answer their questions and help them understand the Regulatory or Contractual Enforcement purpose. 3. All team members to share their level of experience with the regulatory or contractual enforcement purpose * Bastiaan Goslings - no experience in this area, hopes to gain a better understanding through asking questions * Beth Bacon - middle of the road level of experience. Previous position was US government so some familiarity with how colleagues used RDS data for these purposes, now experience from a registry perspective. * Farell Folly - more than 5 years of experience in regulatory (government) are especially in mobile telecommunications and Internet Service providers, but not especially with domain names. * Krishna Seeburn - has been part of the regulatory body, also worked with policy and LE in certain situations. Not a practicing lawyer, but good insight into what is being discussed. * Steve Metalitz - lawyer in private practice, has counseled clients involved in the scenarios outlined in the paper (contract compliance). Some direct experience and general experience in the regulatory environment. * Theo Geurts - as a registrar a lot of experience dealing with LE, IP as well as government. Been doing this since 2009 and responsible for the abuse team. 4. Introduce EWG's definition of this purpose as a starting point for discussion (see both EWG Report excerpts on page 2 of template) * See template for EWG definition and example use cases. DT may decide to use this as a starting point if deemed helpful, but no obligation to do so. * Current description is very broad, more focused on use cases. Is objective to craft a purpose statement that could be used to share with DPAs in the context of data protection legislation? Important not to get hung up on the term 'definition' for now. * Recent work on users may help inform this, namely dataflow matrix that was created as part of the small group working on GDPR issues: https://www.icann.org/resources/pages/gtld-registration-dataflow-matrix-2017-07-24-en<https://www.icann.org/resources/pages/gtld-registration-dataflow-matrix-2017-07-24-en> * Use case developed by RDS PDP WG may also assist in this regard (see https://community.icann.org/download/attachments/60493753/14-WHOIS%20queries%20for%20compliance%20purposes.docx?version=1&modificationDate=1470109106000&api=v2<https://community.icann.org/download/attachments/60493753/14-WHOIS%20queries%20for%20compliance%20purposes.docx?version=1&modificationDate=1470109106000&api=v2>). In addition, EWG report identified a number of use cases for this purpose. 5. Initial Discussion a. Q&A between members less familiar with this purpose and those who have direct experience with it * Would be helpful to briefly describe tasks involved in this purpose? Who has been asked for what, in what context? b. Team members more familiar with this purpose to give real-world examples of this purpose drawn from their own experiences * UDRP - pretty straightforward process: registrar gets inquiry from UDRP provider, who is registrant, when was last update, etc. Info sent back to UDRP provider, following which procedure starts. Sometimes info is masked as a result of P/P services - requires review of conditions to see if unmasking is allowed. If info is not unmasked, P/P provider will be named as defendant. Some registrars will provide information to UDRP provider but will not reveal the info in WHOIS (depends on terms and conditions of P/P). The UDRP provider will look at publicly available WHOIS to send the necessary materials to registrant - even though info may not always be actionable. UDRP provider uses WHOIS info to be able to start their proceedings. The UDRP rules require the UDRP provider to send a "verification request" to registrar. UDRP provider also uses Whois data directly to send notice of the complaint to the respondent. * Intellectual property owner who identifies a site potentially infringing IP. Needs to be able to assess whether the registrant has authorisation/license to use IP. Contract enforcement issue - need to find out whether the person using IP has the right to do so. If not, it would involve next steps, for example getting ICANN compliance involved to enforce legal obligations. Would first go to WHOIS info to find a possible answer, even if info is not actionable (for example, in case of P/P). Would also include a WHOIS lookup to try and identify hosting party. * Contractual compliance - WHOIS accuracy - contractual obligation by registrars to correct info within a certain timeframe following receipt of WHOIS accuracy complaint. Received from all kinds of sources: registrants, ICANN compliance, third parties. * Registration data escrow audits - registrars need to ensure that registrant data is escrowed to an escrow provider to make sure that should a registrar go out of business, ICANN can get hold of registrant data to be able to provide continuity of service. Compliance audits are in place to ensure that data is available, complete, accurate. * Audits also in place to check how processes are applied that involve, amongst others, RDS info such as sending of FOA, transfers, etc. Action item #1: DT members to dedicate time over the course of next week to this topic and encouraged to share perspectives on the mailing list. c. Identify & discuss issues where more understanding is needed 6. Assign responsibilities for creating first drafts a. Task i: b. Task ii c. Task iii * Consider having one person doing task i, ii and iii for the different use cases. * Consider using google doc so that others can add / edit as appropriate. * Steve Metalitz: Intellectual Property owners. (Steve to send to the mailing list, Beth to turn it into a google doc). Action item #2: DT members to share first draft by end of day on Thursday 19 October. 7. Next steps and action items a. List discussion on agenda item 5.c. (Chuck will initiate this after call.) b. Volunteers for agenda items 6.a, 6.b & 6.c will submit their first drafts to the list and initiate list discussion not later than Friday, October 20 8. Next teleconference call(s) a. Suggestions: i. Next call on Monday October 23 or Tuesday October 24 ii. Third call early on Thursday October 26 if needed to finalize deliverable b. Chuck will request a Doodle Poll for the following days: i. Monday October 23 ii. Tuesday October 24 iii. Thursday October 26 Action item #3: Staff to circulate doodle poll to schedule next meeting on Monday or Tuesday next week. Doodle poll would also include possible third meeting on Thursday 26 October - but if work is completed by that date, it would be cancelled. Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings@icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<http://learn.icann.org/courses/gnso> and visiting the GNSO Newcomer pages<http://gnso.icann.org/sites/gnso.icann.org/files/gnso/presentations/policy-e...>.
Thank you very much Steve. All, please review Steve’s first draft and do one or both of the following today and over the weekend: * Comment and ask questions on this list * Suggest edits and/or insert comments in the Word version using the redline function and send a new version to this list Beth – if you want to put this into a Google doc, please feel free to do so. If everyone contributes to this starting today and over the weekend, we should have a reasonably good draft before our meeting on Monday. Chuck From: gnso-rds-pdp-5-bounces@icann.org [mailto:gnso-rds-pdp-5-bounces@icann.org] On Behalf Of Metalitz, Steven Sent: Friday, October 20, 2017 6:48 AM To: 'Marika Konings' <marika.konings@icann.org>; gnso-rds-pdp-5@icann.org Subject: Re: [Gnso-rds-pdp-5] Notes and action items from today's DT5 meeting Fellow subteam 5 members, Attached please find my draft on tasks i, ii and iii from the intellectual property owner perspective. Welcome your feedback/questions. (Apologies I did not note that the circulation deadline was accelerated from today to end of day yesterday.) I view this as supplementing the similar summaries for each of the other use cases identified --- the due diligence on an online merchant use case put forward by Terri Stumme, and the use cases for online tax investigation, UDRP proceedings, and RDS ecosystem contractual compliance (including data escrow audits) identified in the EWG report. The first of these could readily be extracted from Terri’s submission, and I imagine that either or both of the registry/registrar compliance specialists on our subteam could easily prepare the last two. Steve Metalitz Steven J. Metalitz | Partner, through his professional corporation T: 202.355.7902 | <mailto:met@msk.com> met@msk.com Mitchell Silberberg & Knupp LLP | <http://www.msk.com/> www.msk.com 1818 N Street NW, 8th Floor, Washington, DC 20036 THE INFORMATION CONTAINED IN THIS E-MAIL MESSAGE IS INTENDED ONLY FOR THE PERSONAL AND CONFIDENTIAL USE OF THE DESIGNATED RECIPIENTS. THIS MESSAGE MAY BE AN ATTORNEY-CLIENT COMMUNICATION, AND AS SUCH IS PRIVILEGED AND CONFIDENTIAL. IF THE READER OF THIS MESSAGE IS NOT AN INTENDED RECIPIENT, YOU ARE HEREBY NOTIFIED THAT ANY REVIEW, USE, DISSEMINATION, FORWARDING OR COPYING OF THIS MESSAGE IS STRICTLY PROHIBITED. PLEASE NOTIFY US IMMEDIATELY BY REPLY E-MAIL OR TELEPHONE, AND DELETE THE ORIGINAL MESSAGE AND ALL ATTACHMENTS FROM YOUR SYSTEM. THANK YOU. From: gnso-rds-pdp-5-bounces@icann.org <mailto:gnso-rds-pdp-5-bounces@icann.org> [mailto:gnso-rds-pdp-5-bounces@icann.org] On Behalf Of Marika Konings Sent: Wednesday, October 18, 2017 10:09 AM To: gnso-rds-pdp-5@icann.org <mailto:gnso-rds-pdp-5@icann.org> Subject: [Gnso-rds-pdp-5] Notes and action items from today's DT5 meeting Dear All, Please find below the notes & action items from today’s DT5 meeting. Please take particular note of the action items. Best regards, Marika DT5 - Regulatory or Contractual Enforcement Meeting on 18 October 2017 1. Welcome & roll call * Role of coordinator is to co-ordinate & facilitate, for DT members to do the actual work 2. Brief recap of drafting team goals and due date a. Overall goal: To enable better understanding of the Regulatory or Contractual Enforcement purpose for Whois data, first in DT5 and then in the full RDS PDP WG. * See also the template that has been circulated. * Objective is NOT to determine whether or not this purpose is legitimate, but to ensure understanding of what this purpose entails * Deadline to complete tasks by Thursday 26 October - will require everyone to contribute and participate b. Tasks i. List and briefly describe tasks commonly involved in carrying out this purpose. ii. Describe the parties who often access gTLD registration data in pursuit of Regulatory or Contractual Enforcement purposes iii. List gTLD registration data often involved in this purpose. iv. Describe the purpose succinctly in one paragraph * Who are the parties that request WHOIS data today for Regulatory or Contractual Enforcement purposes? * What role does gTLD registration data play for Regulatory or Contractual Enforcement purposes? * Why is access to Whois data needed to fulfill Regulatory or Contractual Enforcement purposes? v. Prepare and submit the final deliverable to the full RDS PDP WG not later than Thursday, October 26. vi. Provide an overview of the final deliverable in the Face-to-Face WG meeting on Saturday, October 28 in Abu Dhabi and interact with WG members in that meeting to answer their questions and help them understand the Regulatory or Contractual Enforcement purpose. 3. All team members to share their level of experience with the regulatory or contractual enforcement purpose * Bastiaan Goslings - no experience in this area, hopes to gain a better understanding through asking questions * Beth Bacon - middle of the road level of experience. Previous position was US government so some familiarity with how colleagues used RDS data for these purposes, now experience from a registry perspective. * Farell Folly - more than 5 years of experience in regulatory (government) are especially in mobile telecommunications and Internet Service providers, but not especially with domain names. * Krishna Seeburn - has been part of the regulatory body, also worked with policy and LE in certain situations. Not a practicing lawyer, but good insight into what is being discussed. * Steve Metalitz - lawyer in private practice, has counseled clients involved in the scenarios outlined in the paper (contract compliance). Some direct experience and general experience in the regulatory environment. * Theo Geurts - as a registrar a lot of experience dealing with LE, IP as well as government. Been doing this since 2009 and responsible for the abuse team. 4. Introduce EWG's definition of this purpose as a starting point for discussion (see both EWG Report excerpts on page 2 of template) * See template for EWG definition and example use cases. DT may decide to use this as a starting point if deemed helpful, but no obligation to do so. * Current description is very broad, more focused on use cases. Is objective to craft a purpose statement that could be used to share with DPAs in the context of data protection legislation? Important not to get hung up on the term 'definition' for now. * Recent work on users may help inform this, namely dataflow matrix that was created as part of the small group working on GDPR issues: https://www.icann.org/resources/pages/gtld-registration-dataflow-matrix-2017... * Use case developed by RDS PDP WG may also assist in this regard (see https://community.icann.org/download/attachments/60493753/14-WHOIS%20queries... <https://community.icann.org/download/attachments/60493753/14-WHOIS%20queries...> &modificationDate=1470109106000&api=v2). In addition, EWG report identified a number of use cases for this purpose. 5. Initial Discussion a. Q&A between members less familiar with this purpose and those who have direct experience with it * Would be helpful to briefly describe tasks involved in this purpose? Who has been asked for what, in what context? b. Team members more familiar with this purpose to give real-world examples of this purpose drawn from their own experiences * UDRP - pretty straightforward process: registrar gets inquiry from UDRP provider, who is registrant, when was last update, etc. Info sent back to UDRP provider, following which procedure starts. Sometimes info is masked as a result of P/P services - requires review of conditions to see if unmasking is allowed. If info is not unmasked, P/P provider will be named as defendant. Some registrars will provide information to UDRP provider but will not reveal the info in WHOIS (depends on terms and conditions of P/P). The UDRP provider will look at publicly available WHOIS to send the necessary materials to registrant - even though info may not always be actionable. UDRP provider uses WHOIS info to be able to start their proceedings. The UDRP rules require the UDRP provider to send a "verification request" to registrar. UDRP provider also uses Whois data directly to send notice of the complaint to the respondent. * Intellectual property owner who identifies a site potentially infringing IP. Needs to be able to assess whether the registrant has authorisation/license to use IP. Contract enforcement issue - need to find out whether the person using IP has the right to do so. If not, it would involve next steps, for example getting ICANN compliance involved to enforce legal obligations. Would first go to WHOIS info to find a possible answer, even if info is not actionable (for example, in case of P/P). Would also include a WHOIS lookup to try and identify hosting party. * Contractual compliance - WHOIS accuracy - contractual obligation by registrars to correct info within a certain timeframe following receipt of WHOIS accuracy complaint. Received from all kinds of sources: registrants, ICANN compliance, third parties. * Registration data escrow audits - registrars need to ensure that registrant data is escrowed to an escrow provider to make sure that should a registrar go out of business, ICANN can get hold of registrant data to be able to provide continuity of service. Compliance audits are in place to ensure that data is available, complete, accurate. * Audits also in place to check how processes are applied that involve, amongst others, RDS info such as sending of FOA, transfers, etc. Action item #1: DT members to dedicate time over the course of next week to this topic and encouraged to share perspectives on the mailing list. c. Identify & discuss issues where more understanding is needed 6. Assign responsibilities for creating first drafts a. Task i: b. Task ii c. Task iii * Consider having one person doing task i, ii and iii for the different use cases. * Consider using google doc so that others can add / edit as appropriate. * Steve Metalitz: Intellectual Property owners. (Steve to send to the mailing list, Beth to turn it into a google doc). Action item #2: DT members to share first draft by end of day on Thursday 19 October. 7. Next steps and action items a. List discussion on agenda item 5.c. (Chuck will initiate this after call.) b. Volunteers for agenda items 6.a, 6.b & 6.c will submit their first drafts to the list and initiate list discussion not later than Friday, October 20 8. Next teleconference call(s) a. Suggestions: i. Next call on Monday October 23 or Tuesday October 24 ii. Third call early on Thursday October 26 if needed to finalize deliverable b. Chuck will request a Doodle Poll for the following days: i. Monday October 23 ii. Tuesday October 24 iii. Thursday October 26 Action item #3: Staff to circulate doodle poll to schedule next meeting on Monday or Tuesday next week. Doodle poll would also include possible third meeting on Thursday 26 October - but if work is completed by that date, it would be cancelled. Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings@icann.org <mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses <http://learn.icann.org/courses/gnso> and visiting the GNSO Newcomer pages <http://gnso.icann.org/sites/gnso.icann.org/files/gnso/presentations/policy-e...> .
Hi folks, I’ve gone ahead and pasted Steve’s document into a google doc here: https://docs.google.com/document/d/1NvoYYmMsjqgt48mAYt5nCr8uPk-E-2IngGt50wDk.... I know some have issues using or accessing google docs but hopefully for our small group with a quick turnaround this will help us compile a document more simply. Thanks, Beth From: gnso-rds-pdp-5-bounces@icann.org [mailto:gnso-rds-pdp-5-bounces@icann.org] On Behalf Of Chuck Sent: Friday, October 20, 2017 10:14 AM To: 'Metalitz, Steven' <met@msk.com>; 'Marika Konings' <marika.konings@icann.org>; gnso-rds-pdp-5@icann.org Subject: Re: [Gnso-rds-pdp-5] Notes and action items from today's DT5 meeting Importance: High Thank you very much Steve. All, please review Steve’s first draft and do one or both of the following today and over the weekend: * Comment and ask questions on this list * Suggest edits and/or insert comments in the Word version using the redline function and send a new version to this list Beth – if you want to put this into a Google doc, please feel free to do so. If everyone contributes to this starting today and over the weekend, we should have a reasonably good draft before our meeting on Monday. Chuck From: gnso-rds-pdp-5-bounces@icann.org<mailto:gnso-rds-pdp-5-bounces@icann.org> [mailto:gnso-rds-pdp-5-bounces@icann.org] On Behalf Of Metalitz, Steven Sent: Friday, October 20, 2017 6:48 AM To: 'Marika Konings' <marika.konings@icann.org<mailto:marika.konings@icann.org>>; gnso-rds-pdp-5@icann.org<mailto:gnso-rds-pdp-5@icann.org> Subject: Re: [Gnso-rds-pdp-5] Notes and action items from today's DT5 meeting Fellow subteam 5 members, Attached please find my draft on tasks i, ii and iii from the intellectual property owner perspective. Welcome your feedback/questions. (Apologies I did not note that the circulation deadline was accelerated from today to end of day yesterday.) I view this as supplementing the similar summaries for each of the other use cases identified --- the due diligence on an online merchant use case put forward by Terri Stumme, and the use cases for online tax investigation, UDRP proceedings, and RDS ecosystem contractual compliance (including data escrow audits) identified in the EWG report. The first of these could readily be extracted from Terri’s submission, and I imagine that either or both of the registry/registrar compliance specialists on our subteam could easily prepare the last two. Steve Metalitz [image001] Steven J. Metalitz | Partner, through his professional corporation T: 202.355.7902 | met@msk.com<mailto:met@msk.com> Mitchell Silberberg & Knupp LLP | www.msk.com<http://www.msk.com/> 1818 N Street NW, 8th Floor, Washington, DC 20036 THE INFORMATION CONTAINED IN THIS E-MAIL MESSAGE IS INTENDED ONLY FOR THE PERSONAL AND CONFIDENTIAL USE OF THE DESIGNATED RECIPIENTS. THIS MESSAGE MAY BE AN ATTORNEY-CLIENT COMMUNICATION, AND AS SUCH IS PRIVILEGED AND CONFIDENTIAL. IF THE READER OF THIS MESSAGE IS NOT AN INTENDED RECIPIENT, YOU ARE HEREBY NOTIFIED THAT ANY REVIEW, USE, DISSEMINATION, FORWARDING OR COPYING OF THIS MESSAGE IS STRICTLY PROHIBITED. PLEASE NOTIFY US IMMEDIATELY BY REPLY E-MAIL OR TELEPHONE, AND DELETE THE ORIGINAL MESSAGE AND ALL ATTACHMENTS FROM YOUR SYSTEM. THANK YOU. From: gnso-rds-pdp-5-bounces@icann.org<mailto:gnso-rds-pdp-5-bounces@icann.org> [mailto:gnso-rds-pdp-5-bounces@icann.org] On Behalf Of Marika Konings Sent: Wednesday, October 18, 2017 10:09 AM To: gnso-rds-pdp-5@icann.org<mailto:gnso-rds-pdp-5@icann.org> Subject: [Gnso-rds-pdp-5] Notes and action items from today's DT5 meeting Dear All, Please find below the notes & action items from today’s DT5 meeting. Please take particular note of the action items. Best regards, Marika DT5 - Regulatory or Contractual Enforcement Meeting on 18 October 2017 1. Welcome & roll call * Role of coordinator is to co-ordinate & facilitate, for DT members to do the actual work 2. Brief recap of drafting team goals and due date a. Overall goal: To enable better understanding of the Regulatory or Contractual Enforcement purpose for Whois data, first in DT5 and then in the full RDS PDP WG. * See also the template that has been circulated. * Objective is NOT to determine whether or not this purpose is legitimate, but to ensure understanding of what this purpose entails * Deadline to complete tasks by Thursday 26 October - will require everyone to contribute and participate b. Tasks i. List and briefly describe tasks commonly involved in carrying out this purpose. ii. Describe the parties who often access gTLD registration data in pursuit of Regulatory or Contractual Enforcement purposes iii. List gTLD registration data often involved in this purpose. iv. Describe the purpose succinctly in one paragraph * Who are the parties that request WHOIS data today for Regulatory or Contractual Enforcement purposes? * What role does gTLD registration data play for Regulatory or Contractual Enforcement purposes? * Why is access to Whois data needed to fulfill Regulatory or Contractual Enforcement purposes? v. Prepare and submit the final deliverable to the full RDS PDP WG not later than Thursday, October 26. vi. Provide an overview of the final deliverable in the Face-to-Face WG meeting on Saturday, October 28 in Abu Dhabi and interact with WG members in that meeting to answer their questions and help them understand the Regulatory or Contractual Enforcement purpose. 3. All team members to share their level of experience with the regulatory or contractual enforcement purpose * Bastiaan Goslings - no experience in this area, hopes to gain a better understanding through asking questions * Beth Bacon - middle of the road level of experience. Previous position was US government so some familiarity with how colleagues used RDS data for these purposes, now experience from a registry perspective. * Farell Folly - more than 5 years of experience in regulatory (government) are especially in mobile telecommunications and Internet Service providers, but not especially with domain names. * Krishna Seeburn - has been part of the regulatory body, also worked with policy and LE in certain situations. Not a practicing lawyer, but good insight into what is being discussed. * Steve Metalitz - lawyer in private practice, has counseled clients involved in the scenarios outlined in the paper (contract compliance). Some direct experience and general experience in the regulatory environment. * Theo Geurts - as a registrar a lot of experience dealing with LE, IP as well as government. Been doing this since 2009 and responsible for the abuse team. 4. Introduce EWG's definition of this purpose as a starting point for discussion (see both EWG Report excerpts on page 2 of template) * See template for EWG definition and example use cases. DT may decide to use this as a starting point if deemed helpful, but no obligation to do so. * Current description is very broad, more focused on use cases. Is objective to craft a purpose statement that could be used to share with DPAs in the context of data protection legislation? Important not to get hung up on the term 'definition' for now. * Recent work on users may help inform this, namely dataflow matrix that was created as part of the small group working on GDPR issues: https://www.icann.org/resources/pages/gtld-registration-dataflow-matrix-2017... * Use case developed by RDS PDP WG may also assist in this regard (see https://community.icann.org/download/attachments/60493753/14-WHOIS%20queries...). In addition, EWG report identified a number of use cases for this purpose. 5. Initial Discussion a. Q&A between members less familiar with this purpose and those who have direct experience with it * Would be helpful to briefly describe tasks involved in this purpose? Who has been asked for what, in what context? b. Team members more familiar with this purpose to give real-world examples of this purpose drawn from their own experiences * UDRP - pretty straightforward process: registrar gets inquiry from UDRP provider, who is registrant, when was last update, etc. Info sent back to UDRP provider, following which procedure starts. Sometimes info is masked as a result of P/P services - requires review of conditions to see if unmasking is allowed. If info is not unmasked, P/P provider will be named as defendant. Some registrars will provide information to UDRP provider but will not reveal the info in WHOIS (depends on terms and conditions of P/P). The UDRP provider will look at publicly available WHOIS to send the necessary materials to registrant - even though info may not always be actionable. UDRP provider uses WHOIS info to be able to start their proceedings. The UDRP rules require the UDRP provider to send a "verification request" to registrar. UDRP provider also uses Whois data directly to send notice of the complaint to the respondent. * Intellectual property owner who identifies a site potentially infringing IP. Needs to be able to assess whether the registrant has authorisation/license to use IP. Contract enforcement issue - need to find out whether the person using IP has the right to do so. If not, it would involve next steps, for example getting ICANN compliance involved to enforce legal obligations. Would first go to WHOIS info to find a possible answer, even if info is not actionable (for example, in case of P/P). Would also include a WHOIS lookup to try and identify hosting party. * Contractual compliance - WHOIS accuracy - contractual obligation by registrars to correct info within a certain timeframe following receipt of WHOIS accuracy complaint. Received from all kinds of sources: registrants, ICANN compliance, third parties. * Registration data escrow audits - registrars need to ensure that registrant data is escrowed to an escrow provider to make sure that should a registrar go out of business, ICANN can get hold of registrant data to be able to provide continuity of service. Compliance audits are in place to ensure that data is available, complete, accurate. * Audits also in place to check how processes are applied that involve, amongst others, RDS info such as sending of FOA, transfers, etc. Action item #1: DT members to dedicate time over the course of next week to this topic and encouraged to share perspectives on the mailing list. c. Identify & discuss issues where more understanding is needed 6. Assign responsibilities for creating first drafts a. Task i: b. Task ii c. Task iii * Consider having one person doing task i, ii and iii for the different use cases. * Consider using google doc so that others can add / edit as appropriate. * Steve Metalitz: Intellectual Property owners. (Steve to send to the mailing list, Beth to turn it into a google doc). Action item #2: DT members to share first draft by end of day on Thursday 19 October. 7. Next steps and action items a. List discussion on agenda item 5.c. (Chuck will initiate this after call.) b. Volunteers for agenda items 6.a, 6.b & 6.c will submit their first drafts to the list and initiate list discussion not later than Friday, October 20 8. Next teleconference call(s) a. Suggestions: i. Next call on Monday October 23 or Tuesday October 24 ii. Third call early on Thursday October 26 if needed to finalize deliverable b. Chuck will request a Doodle Poll for the following days: i. Monday October 23 ii. Tuesday October 24 iii. Thursday October 26 Action item #3: Staff to circulate doodle poll to schedule next meeting on Monday or Tuesday next week. Doodle poll would also include possible third meeting on Thursday 26 October - but if work is completed by that date, it would be cancelled. Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings@icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<http://learn.icann.org/courses/gnso> and visiting the GNSO Newcomer pages<http://gnso.icann.org/sites/gnso.icann.org/files/gnso/presentations/policy-e...>.
Hello all, Would the group view a CERT as something we would want to include under this category? Thanks, Beth From: gnso-rds-pdp-5-bounces@icann.org [mailto:gnso-rds-pdp-5-bounces@icann.org] On Behalf Of Beth Bacon Sent: Friday, October 20, 2017 1:30 PM To: Chuck <consult@cgomes.com>; 'Metalitz, Steven' <met@msk.com>; 'Marika Konings' <marika.konings@icann.org>; gnso-rds-pdp-5@icann.org Subject: Re: [Gnso-rds-pdp-5] Notes and action items from today's DT5 meeting Hi folks, I’ve gone ahead and pasted Steve’s document into a google doc here: https://docs.google.com/document/d/1NvoYYmMsjqgt48mAYt5nCr8uPk-E-2IngGt50wDk.... I know some have issues using or accessing google docs but hopefully for our small group with a quick turnaround this will help us compile a document more simply. Thanks, Beth From: gnso-rds-pdp-5-bounces@icann.org<mailto:gnso-rds-pdp-5-bounces@icann.org> [mailto:gnso-rds-pdp-5-bounces@icann.org] On Behalf Of Chuck Sent: Friday, October 20, 2017 10:14 AM To: 'Metalitz, Steven' <met@msk.com<mailto:met@msk.com>>; 'Marika Konings' <marika.konings@icann.org<mailto:marika.konings@icann.org>>; gnso-rds-pdp-5@icann.org<mailto:gnso-rds-pdp-5@icann.org> Subject: Re: [Gnso-rds-pdp-5] Notes and action items from today's DT5 meeting Importance: High Thank you very much Steve. All, please review Steve’s first draft and do one or both of the following today and over the weekend: * Comment and ask questions on this list * Suggest edits and/or insert comments in the Word version using the redline function and send a new version to this list Beth – if you want to put this into a Google doc, please feel free to do so. If everyone contributes to this starting today and over the weekend, we should have a reasonably good draft before our meeting on Monday. Chuck From: gnso-rds-pdp-5-bounces@icann.org<mailto:gnso-rds-pdp-5-bounces@icann.org> [mailto:gnso-rds-pdp-5-bounces@icann.org] On Behalf Of Metalitz, Steven Sent: Friday, October 20, 2017 6:48 AM To: 'Marika Konings' <marika.konings@icann.org<mailto:marika.konings@icann.org>>; gnso-rds-pdp-5@icann.org<mailto:gnso-rds-pdp-5@icann.org> Subject: Re: [Gnso-rds-pdp-5] Notes and action items from today's DT5 meeting Fellow subteam 5 members, Attached please find my draft on tasks i, ii and iii from the intellectual property owner perspective. Welcome your feedback/questions. (Apologies I did not note that the circulation deadline was accelerated from today to end of day yesterday.) I view this as supplementing the similar summaries for each of the other use cases identified --- the due diligence on an online merchant use case put forward by Terri Stumme, and the use cases for online tax investigation, UDRP proceedings, and RDS ecosystem contractual compliance (including data escrow audits) identified in the EWG report. The first of these could readily be extracted from Terri’s submission, and I imagine that either or both of the registry/registrar compliance specialists on our subteam could easily prepare the last two. Steve Metalitz [image001] Steven J. Metalitz | Partner, through his professional corporation T: 202.355.7902 | met@msk.com<mailto:met@msk.com> Mitchell Silberberg & Knupp LLP | www.msk.com<http://www.msk.com/> 1818 N Street NW, 8th Floor, Washington, DC 20036 THE INFORMATION CONTAINED IN THIS E-MAIL MESSAGE IS INTENDED ONLY FOR THE PERSONAL AND CONFIDENTIAL USE OF THE DESIGNATED RECIPIENTS. THIS MESSAGE MAY BE AN ATTORNEY-CLIENT COMMUNICATION, AND AS SUCH IS PRIVILEGED AND CONFIDENTIAL. IF THE READER OF THIS MESSAGE IS NOT AN INTENDED RECIPIENT, YOU ARE HEREBY NOTIFIED THAT ANY REVIEW, USE, DISSEMINATION, FORWARDING OR COPYING OF THIS MESSAGE IS STRICTLY PROHIBITED. PLEASE NOTIFY US IMMEDIATELY BY REPLY E-MAIL OR TELEPHONE, AND DELETE THE ORIGINAL MESSAGE AND ALL ATTACHMENTS FROM YOUR SYSTEM. THANK YOU. From: gnso-rds-pdp-5-bounces@icann.org<mailto:gnso-rds-pdp-5-bounces@icann.org> [mailto:gnso-rds-pdp-5-bounces@icann.org] On Behalf Of Marika Konings Sent: Wednesday, October 18, 2017 10:09 AM To: gnso-rds-pdp-5@icann.org<mailto:gnso-rds-pdp-5@icann.org> Subject: [Gnso-rds-pdp-5] Notes and action items from today's DT5 meeting Dear All, Please find below the notes & action items from today’s DT5 meeting. Please take particular note of the action items. Best regards, Marika DT5 - Regulatory or Contractual Enforcement Meeting on 18 October 2017 1. Welcome & roll call * Role of coordinator is to co-ordinate & facilitate, for DT members to do the actual work 2. Brief recap of drafting team goals and due date a. Overall goal: To enable better understanding of the Regulatory or Contractual Enforcement purpose for Whois data, first in DT5 and then in the full RDS PDP WG. * See also the template that has been circulated. * Objective is NOT to determine whether or not this purpose is legitimate, but to ensure understanding of what this purpose entails * Deadline to complete tasks by Thursday 26 October - will require everyone to contribute and participate b. Tasks i. List and briefly describe tasks commonly involved in carrying out this purpose. ii. Describe the parties who often access gTLD registration data in pursuit of Regulatory or Contractual Enforcement purposes iii. List gTLD registration data often involved in this purpose. iv. Describe the purpose succinctly in one paragraph * Who are the parties that request WHOIS data today for Regulatory or Contractual Enforcement purposes? * What role does gTLD registration data play for Regulatory or Contractual Enforcement purposes? * Why is access to Whois data needed to fulfill Regulatory or Contractual Enforcement purposes? v. Prepare and submit the final deliverable to the full RDS PDP WG not later than Thursday, October 26. vi. Provide an overview of the final deliverable in the Face-to-Face WG meeting on Saturday, October 28 in Abu Dhabi and interact with WG members in that meeting to answer their questions and help them understand the Regulatory or Contractual Enforcement purpose. 3. All team members to share their level of experience with the regulatory or contractual enforcement purpose * Bastiaan Goslings - no experience in this area, hopes to gain a better understanding through asking questions * Beth Bacon - middle of the road level of experience. Previous position was US government so some familiarity with how colleagues used RDS data for these purposes, now experience from a registry perspective. * Farell Folly - more than 5 years of experience in regulatory (government) are especially in mobile telecommunications and Internet Service providers, but not especially with domain names. * Krishna Seeburn - has been part of the regulatory body, also worked with policy and LE in certain situations. Not a practicing lawyer, but good insight into what is being discussed. * Steve Metalitz - lawyer in private practice, has counseled clients involved in the scenarios outlined in the paper (contract compliance). Some direct experience and general experience in the regulatory environment. * Theo Geurts - as a registrar a lot of experience dealing with LE, IP as well as government. Been doing this since 2009 and responsible for the abuse team. 4. Introduce EWG's definition of this purpose as a starting point for discussion (see both EWG Report excerpts on page 2 of template) * See template for EWG definition and example use cases. DT may decide to use this as a starting point if deemed helpful, but no obligation to do so. * Current description is very broad, more focused on use cases. Is objective to craft a purpose statement that could be used to share with DPAs in the context of data protection legislation? Important not to get hung up on the term 'definition' for now. * Recent work on users may help inform this, namely dataflow matrix that was created as part of the small group working on GDPR issues: https://www.icann.org/resources/pages/gtld-registration-dataflow-matrix-2017... * Use case developed by RDS PDP WG may also assist in this regard (see https://community.icann.org/download/attachments/60493753/14-WHOIS%20queries...). In addition, EWG report identified a number of use cases for this purpose. 5. Initial Discussion a. Q&A between members less familiar with this purpose and those who have direct experience with it * Would be helpful to briefly describe tasks involved in this purpose? Who has been asked for what, in what context? b. Team members more familiar with this purpose to give real-world examples of this purpose drawn from their own experiences * UDRP - pretty straightforward process: registrar gets inquiry from UDRP provider, who is registrant, when was last update, etc. Info sent back to UDRP provider, following which procedure starts. Sometimes info is masked as a result of P/P services - requires review of conditions to see if unmasking is allowed. If info is not unmasked, P/P provider will be named as defendant. Some registrars will provide information to UDRP provider but will not reveal the info in WHOIS (depends on terms and conditions of P/P). The UDRP provider will look at publicly available WHOIS to send the necessary materials to registrant - even though info may not always be actionable. UDRP provider uses WHOIS info to be able to start their proceedings. The UDRP rules require the UDRP provider to send a "verification request" to registrar. UDRP provider also uses Whois data directly to send notice of the complaint to the respondent. * Intellectual property owner who identifies a site potentially infringing IP. Needs to be able to assess whether the registrant has authorisation/license to use IP. Contract enforcement issue - need to find out whether the person using IP has the right to do so. If not, it would involve next steps, for example getting ICANN compliance involved to enforce legal obligations. Would first go to WHOIS info to find a possible answer, even if info is not actionable (for example, in case of P/P). Would also include a WHOIS lookup to try and identify hosting party. * Contractual compliance - WHOIS accuracy - contractual obligation by registrars to correct info within a certain timeframe following receipt of WHOIS accuracy complaint. Received from all kinds of sources: registrants, ICANN compliance, third parties. * Registration data escrow audits - registrars need to ensure that registrant data is escrowed to an escrow provider to make sure that should a registrar go out of business, ICANN can get hold of registrant data to be able to provide continuity of service. Compliance audits are in place to ensure that data is available, complete, accurate. * Audits also in place to check how processes are applied that involve, amongst others, RDS info such as sending of FOA, transfers, etc. Action item #1: DT members to dedicate time over the course of next week to this topic and encouraged to share perspectives on the mailing list. c. Identify & discuss issues where more understanding is needed 6. Assign responsibilities for creating first drafts a. Task i: b. Task ii c. Task iii * Consider having one person doing task i, ii and iii for the different use cases. * Consider using google doc so that others can add / edit as appropriate. * Steve Metalitz: Intellectual Property owners. (Steve to send to the mailing list, Beth to turn it into a google doc). Action item #2: DT members to share first draft by end of day on Thursday 19 October. 7. Next steps and action items a. List discussion on agenda item 5.c. (Chuck will initiate this after call.) b. Volunteers for agenda items 6.a, 6.b & 6.c will submit their first drafts to the list and initiate list discussion not later than Friday, October 20 8. Next teleconference call(s) a. Suggestions: i. Next call on Monday October 23 or Tuesday October 24 ii. Third call early on Thursday October 26 if needed to finalize deliverable b. Chuck will request a Doodle Poll for the following days: i. Monday October 23 ii. Tuesday October 24 iii. Thursday October 26 Action item #3: Staff to circulate doodle poll to schedule next meeting on Monday or Tuesday next week. Doodle poll would also include possible third meeting on Thursday 26 October - but if work is completed by that date, it would be cancelled. Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings@icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<http://learn.icann.org/courses/gnso> and visiting the GNSO Newcomer pages<http://gnso.icann.org/sites/gnso.icann.org/files/gnso/presentations/policy-e...>.
NOT ONLY CERT BUT Police and interpol does the same and they keep an eye on illegal underground matters. They would fall under a different category perhaps international law enforcement. I work with them and to be honest we go beyond the the contractual agreements as we never get clear details and the criminals play hide and seek...
On Oct 20, 2017, at 22:53, Beth Bacon <bbacon@pir.org> wrote:
Hello all, Would the group view a CERT as something we would want to include under this category? Thanks, Beth <> From: gnso-rds-pdp-5-bounces@icann.org <mailto:gnso-rds-pdp-5-bounces@icann.org> [mailto:gnso-rds-pdp-5-bounces@icann.org <mailto:gnso-rds-pdp-5-bounces@icann.org>] On Behalf Of Beth Bacon Sent: Friday, October 20, 2017 1:30 PM To: Chuck <consult@cgomes.com <mailto:consult@cgomes.com>>; 'Metalitz, Steven' <met@msk.com <mailto:met@msk.com>>; 'Marika Konings' <marika.konings@icann.org <mailto:marika.konings@icann.org>>; gnso-rds-pdp-5@icann.org <mailto:gnso-rds-pdp-5@icann.org> Subject: Re: [Gnso-rds-pdp-5] Notes and action items from today's DT5 meeting
Hi folks, I’ve gone ahead and pasted Steve’s document into a google doc here:https://docs.google.com/document/d/1NvoYYmMsjqgt48mAYt5nCr8uPk-E-2IngGt50wDk... <https://docs.google.com/document/d/1NvoYYmMsjqgt48mAYt5nCr8uPk-E-2IngGt50wDk...>.
I know some have issues using or accessing google docs but hopefully for our small group with a quick turnaround this will help us compile a document more simply. Thanks, Beth
From: gnso-rds-pdp-5-bounces@icann.org <mailto:gnso-rds-pdp-5-bounces@icann.org> [mailto:gnso-rds-pdp-5-bounces@icann.org <mailto:gnso-rds-pdp-5-bounces@icann.org>] On Behalf Of Chuck Sent: Friday, October 20, 2017 10:14 AM To: 'Metalitz, Steven' <met@msk.com <mailto:met@msk.com>>; 'Marika Konings' <marika.konings@icann.org <mailto:marika.konings@icann.org>>; gnso-rds-pdp-5@icann.org <mailto:gnso-rds-pdp-5@icann.org> Subject: Re: [Gnso-rds-pdp-5] Notes and action items from today's DT5 meeting Importance: High
Thank you very much Steve.
All, please review Steve’s first draft and do one or both of the following today and over the weekend: Comment and ask questions on this list Suggest edits and/or insert comments in the Word version using the redline function and send a new version to this list
Beth – if you want to put this into a Google doc, please feel free to do so.
If everyone contributes to this starting today and over the weekend, we should have a reasonably good draft before our meeting on Monday.
Chuck
From: gnso-rds-pdp-5-bounces@icann.org <mailto:gnso-rds-pdp-5-bounces@icann.org> [mailto:gnso-rds-pdp-5-bounces@icann.org <mailto:gnso-rds-pdp-5-bounces@icann.org>] On Behalf Of Metalitz, Steven Sent: Friday, October 20, 2017 6:48 AM To: 'Marika Konings' <marika.konings@icann.org <mailto:marika.konings@icann.org>>; gnso-rds-pdp-5@icann.org <mailto:gnso-rds-pdp-5@icann.org> Subject: Re: [Gnso-rds-pdp-5] Notes and action items from today's DT5 meeting
Fellow subteam 5 members,
Attached please find my draft on tasks i, ii and iii from the intellectual property owner perspective. Welcome your feedback/questions. (Apologies I did not note that the circulation deadline was accelerated from today to end of day yesterday.)
I view this as supplementing the similar summaries for each of the other use cases identified --- the due diligence on an online merchant use case put forward by Terri Stumme, and the use cases for online tax investigation, UDRP proceedings, and RDS ecosystem contractual compliance (including data escrow audits) identified in the EWG report. The first of these could readily be extracted from Terri’s submission, and I imagine that either or both of the registry/registrar compliance specialists on our subteam could easily prepare the last two.
Steve Metalitz
<image001.gif> Steven J. Metalitz | Partner, through his professional corporation T: 202.355.7902 | met@msk.com <mailto:met@msk.com> Mitchell Silberberg & Knupp LLP | www.msk.com <http://www.msk.com/> 1818 N Street NW, 8th Floor, Washington, DC 20036
THE INFORMATION CONTAINED IN THIS E-MAIL MESSAGE IS INTENDED ONLY FOR THE PERSONAL AND CONFIDENTIAL USE OF THE DESIGNATED RECIPIENTS. THIS MESSAGE MAY BE AN ATTORNEY-CLIENT COMMUNICATION, AND AS SUCH IS PRIVILEGED AND CONFIDENTIAL. IF THE READER OF THIS MESSAGE IS NOT AN INTENDED RECIPIENT, YOU ARE HEREBY NOTIFIED THAT ANY REVIEW, USE, DISSEMINATION, FORWARDING OR COPYING OF THIS MESSAGE IS STRICTLY PROHIBITED. PLEASE NOTIFY US IMMEDIATELY BY REPLY E-MAIL OR TELEPHONE, AND DELETE THE ORIGINAL MESSAGE AND ALL ATTACHMENTS FROM YOUR SYSTEM. THANK YOU.
From: gnso-rds-pdp-5-bounces@icann.org <mailto:gnso-rds-pdp-5-bounces@icann.org> [mailto:gnso-rds-pdp-5-bounces@icann.org <mailto:gnso-rds-pdp-5-bounces@icann.org>] On Behalf Of Marika Konings Sent: Wednesday, October 18, 2017 10:09 AM To: gnso-rds-pdp-5@icann.org <mailto:gnso-rds-pdp-5@icann.org> Subject: [Gnso-rds-pdp-5] Notes and action items from today's DT5 meeting
Dear All,
Please find below the notes & action items from today’s DT5 meeting. Please take particular note of the action items.
Best regards,
Marika
DT5 - Regulatory or Contractual Enforcement Meeting on 18 October 2017
1. Welcome & roll call Role of coordinator is to co-ordinate & facilitate, for DT members to do the actual work
2. Brief recap of drafting team goals and due date a. Overall goal: To enable better understanding of the Regulatory or Contractual Enforcement purpose for Whois data, first in DT5 and then in the full RDS PDP WG. See also the template that has been circulated. Objective is NOT to determine whether or not this purpose is legitimate, but to ensure understanding of what this purpose entails Deadline to complete tasks by Thursday 26 October - will require everyone to contribute and participate b. Tasks i. List and briefly describe tasks commonly involved in carrying out this purpose. ii. Describe the parties who often access gTLD registration data in pursuit of Regulatory or Contractual Enforcement purposes iii. List gTLD registration data often involved in this purpose. iv. Describe the purpose succinctly in one paragraph Who are the parties that request WHOIS data today for Regulatory or Contractual Enforcement purposes? What role does gTLD registration data play for Regulatory or Contractual Enforcement purposes? Why is access to Whois data needed to fulfill Regulatory or Contractual Enforcement purposes? v. Prepare and submit the final deliverable to the full RDS PDP WG not later than Thursday, October 26. vi. Provide an overview of the final deliverable in the Face-to-Face WG meeting on Saturday, October 28 in Abu Dhabi and interact with WG members in that meeting to answer their questions and help them understand the Regulatory or Contractual Enforcement purpose.
3. All team members to share their level of experience with the regulatory or contractual enforcement purpose Bastiaan Goslings - no experience in this area, hopes to gain a better understanding through asking questions Beth Bacon - middle of the road level of experience. Previous position was US government so some familiarity with how colleagues used RDS data for these purposes, now experience from a registry perspective. Farell Folly - more than 5 years of experience in regulatory (government) are especially in mobile telecommunications and Internet Service providers, but not especially with domain names. Krishna Seeburn - has been part of the regulatory body, also worked with policy and LE in certain situations. Not a practicing lawyer, but good insight into what is being discussed. Steve Metalitz - lawyer in private practice, has counseled clients involved in the scenarios outlined in the paper (contract compliance). Some direct experience and general experience in the regulatory environment. Theo Geurts - as a registrar a lot of experience dealing with LE, IP as well as government. Been doing this since 2009 and responsible for the abuse team.
4. Introduce EWG's definition of this purpose as a starting point for discussion (see both EWG Report excerpts on page 2 of template) See template for EWG definition and example use cases. DT may decide to use this as a starting point if deemed helpful, but no obligation to do so. Current description is very broad, more focused on use cases. Is objective to craft a purpose statement that could be used to share with DPAs in the context of data protection legislation? Important not to get hung up on the term 'definition' for now. Recent work on users may help inform this, namely dataflow matrix that was created as part of the small group working on GDPR issues: https://www.icann.org/resources/pages/gtld-registration-dataflow-matrix-2017... <https://www.icann.org/resources/pages/gtld-registration-dataflow-matrix-2017...> Use case developed by RDS PDP WG may also assist in this regard (seehttps://community.icann.org/download/attachments/60493753/14-WHOIS%20queries... <https://community.icann.org/download/attachments/60493753/14-WHOIS%20queries...>). In addition, EWG report identified a number of use cases for this purpose.
5. Initial Discussion a. Q&A between members less familiar with this purpose and those who have direct experience with it Would be helpful to briefly describe tasks involved in this purpose? Who has been asked for what, in what context?
b. Team members more familiar with this purpose to give real-world examples of this purpose drawn from their own experiences UDRP - pretty straightforward process: registrar gets inquiry from UDRP provider, who is registrant, when was last update, etc. Info sent back to UDRP provider, following which procedure starts. Sometimes info is masked as a result of P/P services - requires review of conditions to see if unmasking is allowed. If info is not unmasked, P/P provider will be named as defendant. Some registrars will provide information to UDRP provider but will not reveal the info in WHOIS (depends on terms and conditions of P/P). The UDRP provider will look at publicly available WHOIS to send the necessary materials to registrant - even though info may not always be actionable. UDRP provider uses WHOIS info to be able to start their proceedings. The UDRP rules require the UDRP provider to send a "verification request" to registrar. UDRP provider also uses Whois data directly to send notice of the complaint to the respondent. Intellectual property owner who identifies a site potentially infringing IP. Needs to be able to assess whether the registrant has authorisation/license to use IP. Contract enforcement issue - need to find out whether the person using IP has the right to do so. If not, it would involve next steps, for example getting ICANN compliance involved to enforce legal obligations. Would first go to WHOIS info to find a possible answer, even if info is not actionable (for example, in case of P/P). Would also include a WHOIS lookup to try and identify hosting party. Contractual compliance - WHOIS accuracy - contractual obligation by registrars to correct info within a certain timeframe following receipt of WHOIS accuracy complaint. Received from all kinds of sources: registrants, ICANN compliance, third parties. Registration data escrow audits - registrars need to ensure that registrant data is escrowed to an escrow provider to make sure that should a registrar go out of business, ICANN can get hold of registrant data to be able to provide continuity of service. Compliance audits are in place to ensure that data is available, complete, accurate. Audits also in place to check how processes are applied that involve, amongst others, RDS info such as sending of FOA, transfers, etc.
Action item #1: DT members to dedicate time over the course of next week to this topic and encouraged to share perspectives on the mailing list.
c. Identify & discuss issues where more understanding is needed 6. Assign responsibilities for creating first drafts a. Task i: b. Task ii c. Task iii
Consider having one person doing task i, ii and iii for the different use cases. Consider using google doc so that others can add / edit as appropriate. Steve Metalitz: Intellectual Property owners. (Steve to send to the mailing list, Beth to turn it into a google doc).
Action item #2: DT members to share first draft by end of day on Thursday 19 October.
7. Next steps and action items a. List discussion on agenda item 5.c. (Chuck will initiate this after call.) b. Volunteers for agenda items 6.a, 6.b & 6.c will submit their first drafts to the list and initiate list discussion not later than Friday, October 20 8. Next teleconference call(s) a. Suggestions: i. Next call on Monday October 23 or Tuesday October 24 ii. Third call early on Thursday October 26 if needed to finalize deliverable b. Chuck will request a Doodle Poll for the following days: i. Monday October 23 ii. Tuesday October 24 iii. Thursday October 26
Action item #3: Staff to circulate doodle poll to schedule next meeting on Monday or Tuesday next week. Doodle poll would also include possible third meeting on Thursday 26 October - but if work is completed by that date, it would be cancelled.
Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings@icann.org <mailto:marika.konings@icann.org>
Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses <http://learn.icann.org/courses/gnso> and visiting the GNSO Newcomer pages <http://gnso.icann.org/sites/gnso.icann.org/files/gnso/presentations/policy-e...>.
_______________________________________________ Gnso-rds-pdp-5 mailing list Gnso-rds-pdp-5@icann.org <mailto:Gnso-rds-pdp-5@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-5 <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-5>
Kris Seeburn seeburn.k@gmail.com www.linkedin.com/in/kseeburn/ <http://www.linkedin.com/in/kseeburn/>
The law enforcement purpose is covered by another team just like certs. Chuck From: Kris Seeburn [mailto:seeburn.k@gmail.com] Sent: Friday, October 20, 2017 11:58 AM To: Beth Bacon <bbacon@pir.org> Cc: Chuck <consult@cgomes.com>; Metalitz, Steven <met@msk.com>; Marika Konings <marika.konings@icann.org>; gnso-rds-pdp-5@icann.org Subject: Re: [Gnso-rds-pdp-5] Notes and action items from today's DT5 meeting NOT ONLY CERT BUT Police and interpol does the same and they keep an eye on illegal underground matters. They would fall under a different category perhaps international law enforcement. I work with them and to be honest we go beyond the the contractual agreements as we never get clear details and the criminals play hide and seek... On Oct 20, 2017, at 22:53, Beth Bacon <bbacon@pir.org <mailto:bbacon@pir.org> > wrote: Hello all, Would the group view a CERT as something we would want to include under this category? Thanks, Beth From: <mailto:gnso-rds-pdp-5-bounces@icann.org> gnso-rds-pdp-5-bounces@icann.org [ <mailto:gnso-rds-pdp-5-bounces@icann.org> mailto:gnso-rds-pdp-5-bounces@icann.org] On Behalf Of Beth Bacon Sent: Friday, October 20, 2017 1:30 PM To: Chuck < <mailto:consult@cgomes.com> consult@cgomes.com>; 'Metalitz, Steven' < <mailto:met@msk.com> met@msk.com>; 'Marika Konings' < <mailto:marika.konings@icann.org> marika.konings@icann.org>; <mailto:gnso-rds-pdp-5@icann.org> gnso-rds-pdp-5@icann.org Subject: Re: [Gnso-rds-pdp-5] Notes and action items from today's DT5 meeting Hi folks, I’ve gone ahead and pasted Steve’s document into a google doc here: <https://docs.google.com/document/d/1NvoYYmMsjqgt48mAYt5nCr8uPk-E-2IngGt50wDk...> https://docs.google.com/document/d/1NvoYYmMsjqgt48mAYt5nCr8uPk-E-2IngGt50wDk.... I know some have issues using or accessing google docs but hopefully for our small group with a quick turnaround this will help us compile a document more simply. Thanks, Beth From: <mailto:gnso-rds-pdp-5-bounces@icann.org> gnso-rds-pdp-5-bounces@icann.org [ <mailto:gnso-rds-pdp-5-bounces@icann.org> mailto:gnso-rds-pdp-5-bounces@icann.org] On Behalf Of Chuck Sent: Friday, October 20, 2017 10:14 AM To: 'Metalitz, Steven' < <mailto:met@msk.com> met@msk.com>; 'Marika Konings' < <mailto:marika.konings@icann.org> marika.konings@icann.org>; <mailto:gnso-rds-pdp-5@icann.org> gnso-rds-pdp-5@icann.org Subject: Re: [Gnso-rds-pdp-5] Notes and action items from today's DT5 meeting Importance: High Thank you very much Steve. All, please review Steve’s first draft and do one or both of the following today and over the weekend: * Comment and ask questions on this list * Suggest edits and/or insert comments in the Word version using the redline function and send a new version to this list Beth – if you want to put this into a Google doc, please feel free to do so. If everyone contributes to this starting today and over the weekend, we should have a reasonably good draft before our meeting on Monday. Chuck From: <mailto:gnso-rds-pdp-5-bounces@icann.org> gnso-rds-pdp-5-bounces@icann.org [ <mailto:gnso-rds-pdp-5-bounces@icann.org> mailto:gnso-rds-pdp-5-bounces@icann.org] On Behalf Of Metalitz, Steven Sent: Friday, October 20, 2017 6:48 AM To: 'Marika Konings' < <mailto:marika.konings@icann.org> marika.konings@icann.org>; <mailto:gnso-rds-pdp-5@icann.org> gnso-rds-pdp-5@icann.org Subject: Re: [Gnso-rds-pdp-5] Notes and action items from today's DT5 meeting Fellow subteam 5 members, Attached please find my draft on tasks i, ii and iii from the intellectual property owner perspective. Welcome your feedback/questions. (Apologies I did not note that the circulation deadline was accelerated from today to end of day yesterday.) I view this as supplementing the similar summaries for each of the other use cases identified --- the due diligence on an online merchant use case put forward by Terri Stumme, and the use cases for online tax investigation, UDRP proceedings, and RDS ecosystem contractual compliance (including data escrow audits) identified in the EWG report. The first of these could readily be extracted from Terri’s submission, and I imagine that either or both of the registry/registrar compliance specialists on our subteam could easily prepare the last two. Steve Metalitz <image001.gif> Steven J. Metalitz | Partner, through his professional corporation T: 202.355.7902 | <mailto:met@msk.com> met@msk.com Mitchell Silberberg & Knupp LLP | <http://www.msk.com/> www.msk.com 1818 N Street NW, 8th Floor, Washington, DC 20036 THE INFORMATION CONTAINED IN THIS E-MAIL MESSAGE IS INTENDED ONLY FOR THE PERSONAL AND CONFIDENTIAL USE OF THE DESIGNATED RECIPIENTS. THIS MESSAGE MAY BE AN ATTORNEY-CLIENT COMMUNICATION, AND AS SUCH IS PRIVILEGED AND CONFIDENTIAL. IF THE READER OF THIS MESSAGE IS NOT AN INTENDED RECIPIENT, YOU ARE HEREBY NOTIFIED THAT ANY REVIEW, USE, DISSEMINATION, FORWARDING OR COPYING OF THIS MESSAGE IS STRICTLY PROHIBITED. PLEASE NOTIFY US IMMEDIATELY BY REPLY E-MAIL OR TELEPHONE, AND DELETE THE ORIGINAL MESSAGE AND ALL ATTACHMENTS FROM YOUR SYSTEM. THANK YOU. From: <mailto:gnso-rds-pdp-5-bounces@icann.org> gnso-rds-pdp-5-bounces@icann.org [ <mailto:gnso-rds-pdp-5-bounces@icann.org> mailto:gnso-rds-pdp-5-bounces@icann.org] On Behalf Of Marika Konings Sent: Wednesday, October 18, 2017 10:09 AM To: <mailto:gnso-rds-pdp-5@icann.org> gnso-rds-pdp-5@icann.org Subject: [Gnso-rds-pdp-5] Notes and action items from today's DT5 meeting Dear All, Please find below the notes & action items from today’s DT5 meeting. Please take particular note of the action items. Best regards, Marika DT5 - Regulatory or Contractual Enforcement Meeting on 18 October 2017 1. Welcome & roll call * Role of coordinator is to co-ordinate & facilitate, for DT members to do the actual work 2. Brief recap of drafting team goals and due date a. Overall goal: To enable better understanding of the Regulatory or Contractual Enforcement purpose for Whois data, first in DT5 and then in the full RDS PDP WG. * See also the template that has been circulated. * Objective is NOT to determine whether or not this purpose is legitimate, but to ensure understanding of what this purpose entails * Deadline to complete tasks by Thursday 26 October - will require everyone to contribute and participate b. Tasks i. List and briefly describe tasks commonly involved in carrying out this purpose. ii. Describe the parties who often access gTLD registration data in pursuit of Regulatory or Contractual Enforcement purposes iii. List gTLD registration data often involved in this purpose. iv. Describe the purpose succinctly in one paragraph * Who are the parties that request WHOIS data today for Regulatory or Contractual Enforcement purposes? * What role does gTLD registration data play for Regulatory or Contractual Enforcement purposes? * Why is access to Whois data needed to fulfill Regulatory or Contractual Enforcement purposes? v. Prepare and submit the final deliverable to the full RDS PDP WG not later than Thursday, October 26. vi. Provide an overview of the final deliverable in the Face-to-Face WG meeting on Saturday, October 28 in Abu Dhabi and interact with WG members in that meeting to answer their questions and help them understand the Regulatory or Contractual Enforcement purpose. 3. All team members to share their level of experience with the regulatory or contractual enforcement purpose * Bastiaan Goslings - no experience in this area, hopes to gain a better understanding through asking questions * Beth Bacon - middle of the road level of experience. Previous position was US government so some familiarity with how colleagues used RDS data for these purposes, now experience from a registry perspective. * Farell Folly - more than 5 years of experience in regulatory (government) are especially in mobile telecommunications and Internet Service providers, but not especially with domain names. * Krishna Seeburn - has been part of the regulatory body, also worked with policy and LE in certain situations. Not a practicing lawyer, but good insight into what is being discussed. * Steve Metalitz - lawyer in private practice, has counseled clients involved in the scenarios outlined in the paper (contract compliance). Some direct experience and general experience in the regulatory environment. * Theo Geurts - as a registrar a lot of experience dealing with LE, IP as well as government. Been doing this since 2009 and responsible for the abuse team. 4. Introduce EWG's definition of this purpose as a starting point for discussion (see both EWG Report excerpts on page 2 of template) * See template for EWG definition and example use cases. DT may decide to use this as a starting point if deemed helpful, but no obligation to do so. * Current description is very broad, more focused on use cases. Is objective to craft a purpose statement that could be used to share with DPAs in the context of data protection legislation? Important not to get hung up on the term 'definition' for now. * Recent work on users may help inform this, namely dataflow matrix that was created as part of the small group working on GDPR issues: <https://www.icann.org/resources/pages/gtld-registration-dataflow-matrix-2017...> https://www.icann.org/resources/pages/gtld-registration-dataflow-matrix-2017... * Use case developed by RDS PDP WG may also assist in this regard (see <https://community.icann.org/download/attachments/60493753/14-WHOIS%20queries...> https://community.icann.org/download/attachments/60493753/14-WHOIS%20queries...). In addition, EWG report identified a number of use cases for this purpose. 5. Initial Discussion a. Q&A between members less familiar with this purpose and those who have direct experience with it * Would be helpful to briefly describe tasks involved in this purpose? Who has been asked for what, in what context? b. Team members more familiar with this purpose to give real-world examples of this purpose drawn from their own experiences * UDRP - pretty straightforward process: registrar gets inquiry from UDRP provider, who is registrant, when was last update, etc. Info sent back to UDRP provider, following which procedure starts. Sometimes info is masked as a result of P/P services - requires review of conditions to see if unmasking is allowed. If info is not unmasked, P/P provider will be named as defendant. Some registrars will provide information to UDRP provider but will not reveal the info in WHOIS (depends on terms and conditions of P/P). The UDRP provider will look at publicly available WHOIS to send the necessary materials to registrant - even though info may not always be actionable. UDRP provider uses WHOIS info to be able to start their proceedings. The UDRP rules require the UDRP provider to send a "verification request" to registrar. UDRP provider also uses Whois data directly to send notice of the complaint to the respondent. * Intellectual property owner who identifies a site potentially infringing IP. Needs to be able to assess whether the registrant has authorisation/license to use IP. Contract enforcement issue - need to find out whether the person using IP has the right to do so. If not, it would involve next steps, for example getting ICANN compliance involved to enforce legal obligations. Would first go to WHOIS info to find a possible answer, even if info is not actionable (for example, in case of P/P). Would also include a WHOIS lookup to try and identify hosting party. * Contractual compliance - WHOIS accuracy - contractual obligation by registrars to correct info within a certain timeframe following receipt of WHOIS accuracy complaint. Received from all kinds of sources: registrants, ICANN compliance, third parties. * Registration data escrow audits - registrars need to ensure that registrant data is escrowed to an escrow provider to make sure that should a registrar go out of business, ICANN can get hold of registrant data to be able to provide continuity of service. Compliance audits are in place to ensure that data is available, complete, accurate. * Audits also in place to check how processes are applied that involve, amongst others, RDS info such as sending of FOA, transfers, etc. Action item #1: DT members to dedicate time over the course of next week to this topic and encouraged to share perspectives on the mailing list. c. Identify & discuss issues where more understanding is needed 6. Assign responsibilities for creating first drafts a. Task i: b. Task ii c. Task iii * Consider having one person doing task i, ii and iii for the different use cases. * Consider using google doc so that others can add / edit as appropriate. * Steve Metalitz: Intellectual Property owners. (Steve to send to the mailing list, Beth to turn it into a google doc). Action item #2: DT members to share first draft by end of day on Thursday 19 October. 7. Next steps and action items a. List discussion on agenda item 5.c. (Chuck will initiate this after call.) b. Volunteers for agenda items 6.a, 6.b & 6.c will submit their first drafts to the list and initiate list discussion not later than Friday, October 20 8. Next teleconference call(s) a. Suggestions: i. Next call on Monday October 23 or Tuesday October 24 ii. Third call early on Thursday October 26 if needed to finalize deliverable b. Chuck will request a Doodle Poll for the following days: i. Monday October 23 ii. Tuesday October 24 iii. Thursday October 26 Action item #3: Staff to circulate doodle poll to schedule next meeting on Monday or Tuesday next week. Doodle poll would also include possible third meeting on Thursday 26 October - but if work is completed by that date, it would be cancelled. Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: <mailto:marika.konings@icann.org> marika.konings@icann.org Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our <http://learn.icann.org/courses/gnso> interactive courses and visiting the <http://gnso.icann.org/sites/gnso.icann.org/files/gnso/presentations/policy-e...> GNSO Newcomer pages. _______________________________________________ Gnso-rds-pdp-5 mailing list <mailto:Gnso-rds-pdp-5@icann.org> Gnso-rds-pdp-5@icann.org <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-5> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-5 Kris Seeburn seeburn.k@gmail.com <mailto:seeburn.k@gmail.com> * <http://www.linkedin.com/in/kseeburn/> www.linkedin.com/in/kseeburn/
Hello Beth, If I assume that you mean CERT as Computer Emergency Response Team, I think that they are not regulatory or contractual enforcement, instead they may be seen as a mechanism or resource a regulatory agency can use. However the situation can be different from anonther perspective. Regards @__f_f__ https://www.linkedin.com/in/farellf ________________________________ Mail sent from my mobile phone. Excuse for brievety. Le 20 oct. 2017 19:54, "Beth Bacon" <bbacon@pir.org> a écrit :
Hello all,
Would the group view a CERT as something we would want to include under this category?
Thanks, Beth
*From:* gnso-rds-pdp-5-bounces@icann.org [mailto:gnso-rds-pdp-5- bounces@icann.org] *On Behalf Of *Beth Bacon *Sent:* Friday, October 20, 2017 1:30 PM *To:* Chuck <consult@cgomes.com>; 'Metalitz, Steven' <met@msk.com>; 'Marika Konings' <marika.konings@icann.org>; gnso-rds-pdp-5@icann.org *Subject:* Re: [Gnso-rds-pdp-5] Notes and action items from today's DT5 meeting
Hi folks,
I’ve gone ahead and pasted Steve’s document into a google doc here: https://docs.google.com/document/d/1NvoYYmMsjqgt48mAYt5nCr8uPk-E- 2IngGt50wDkaFU/edit?usp=sharing.
I know some have issues using or accessing google docs but hopefully for our small group with a quick turnaround this will help us compile a document more simply.
Thanks, Beth
*From:* gnso-rds-pdp-5-bounces@icann.org [mailto:gnso-rds-pdp-5- bounces@icann.org <gnso-rds-pdp-5-bounces@icann.org>] *On Behalf Of *Chuck *Sent:* Friday, October 20, 2017 10:14 AM *To:* 'Metalitz, Steven' <met@msk.com>; 'Marika Konings' < marika.konings@icann.org>; gnso-rds-pdp-5@icann.org *Subject:* Re: [Gnso-rds-pdp-5] Notes and action items from today's DT5 meeting *Importance:* High
Thank you very much Steve.
All, please review Steve’s first draft and do one or both of the following today and over the weekend:
- Comment and ask questions on this list - Suggest edits and/or insert comments in the Word version using the redline function and send a new version to this list
Beth – if you want to put this into a Google doc, please feel free to do so.
If everyone contributes to this starting today and over the weekend, we should have a reasonably good draft before our meeting on Monday.
Chuck
*From:* gnso-rds-pdp-5-bounces@icann.org [mailto:gnso-rds-pdp-5- bounces@icann.org <gnso-rds-pdp-5-bounces@icann.org>] *On Behalf Of *Metalitz, Steven *Sent:* Friday, October 20, 2017 6:48 AM *To:* 'Marika Konings' <marika.konings@icann.org>; gnso-rds-pdp-5@icann.org *Subject:* Re: [Gnso-rds-pdp-5] Notes and action items from today's DT5 meeting
Fellow subteam 5 members,
Attached please find my draft on tasks i, ii and iii from the intellectual property owner perspective. Welcome your feedback/questions. (Apologies I did not note that the circulation deadline was accelerated from today to end of day yesterday.)
I view this as supplementing the similar summaries for each of the other use cases identified --- the due diligence on an online merchant use case put forward by Terri Stumme, and the use cases for online tax investigation, UDRP proceedings, and RDS ecosystem contractual compliance (including data escrow audits) identified in the EWG report. The first of these could readily be extracted from Terri’s submission, and I imagine that either or both of the registry/registrar compliance specialists on our subteam could easily prepare the last two.
Steve Metalitz
*[image: image001]*
*Steven J. Metalitz *| *Partner, through his professional corporation*
T: 202.355.7902 <(202)%20355-7902> | met@msk.com
*Mitchell Silberberg & Knupp* *LLP* | *www.msk.com <http://www.msk.com/>*
1818 N Street NW, 8th Floor, Washington, DC 20036
*THE INFORMATION CONTAINED IN THIS E-MAIL MESSAGE IS INTENDED ONLY FOR THE PERSONAL AND CONFIDENTIAL USE OF THE DESIGNATED RECIPIENTS.** THIS MESSAGE MAY BE AN ATTORNEY-CLIENT COMMUNICATION, AND AS SUCH IS PRIVILEGED AND CONFIDENTIAL. IF THE READER OF THIS MESSAGE IS NOT AN INTENDED RECIPIENT, YOU ARE HEREBY NOTIFIED THAT ANY REVIEW, USE, DISSEMINATION, FORWARDING OR COPYING OF THIS MESSAGE IS STRICTLY PROHIBITED. PLEASE NOTIFY US IMMEDIATELY BY REPLY E-MAIL OR TELEPHONE, AND DELETE THE ORIGINAL MESSAGE AND ALL ATTACHMENTS FROM YOUR SYSTEM. THANK YOU.*
*From:* gnso-rds-pdp-5-bounces@icann.org [mailto:gnso-rds-pdp-5- bounces@icann.org <gnso-rds-pdp-5-bounces@icann.org>] *On Behalf Of *Marika Konings *Sent:* Wednesday, October 18, 2017 10:09 AM *To:* gnso-rds-pdp-5@icann.org *Subject:* [Gnso-rds-pdp-5] Notes and action items from today's DT5 meeting
Dear All,
Please find below the notes & action items from today’s DT5 meeting. Please take particular note of the action items.
Best regards,
Marika
*DT5 - Regulatory or Contractual Enforcement*
*Meeting on 18 October 2017*
1. Welcome & roll call
- Role of coordinator is to co-ordinate & facilitate, for DT members to do the actual work
2. Brief recap of drafting team goals and due date
a. Overall goal: To enable better understanding of the Regulatory or Contractual Enforcement purpose for Whois data, first in DT5 and then in the full RDS PDP WG.
- See also the template that has been circulated. - Objective is NOT to determine whether or not this purpose is legitimate, but to ensure understanding of what this purpose entails - Deadline to complete tasks by Thursday 26 October - will require everyone to contribute and participate
b. Tasks
i. List and briefly describe tasks commonly involved in carrying out this purpose.
ii. Describe the parties who often access gTLD registration data in pursuit of Regulatory or Contractual Enforcement purposes
iii. List gTLD registration data often involved in this purpose.
iv. Describe the purpose succinctly in one paragraph
- Who are the parties that request WHOIS data today for Regulatory or Contractual Enforcement purposes? - What role does gTLD registration data play for Regulatory or Contractual Enforcement purposes? - Why is access to Whois data needed to fulfill Regulatory or Contractual Enforcement purposes?
v. Prepare and submit the final deliverable to the full RDS PDP WG not later than Thursday, October 26.
vi. Provide an overview of the final deliverable in the Face-to-Face WG meeting on Saturday, October 28 in Abu Dhabi and interact with WG members in that meeting to answer their questions and help them understand the Regulatory or Contractual Enforcement purpose.
3. All team members to share their level of experience with the regulatory or contractual enforcement purpose
- Bastiaan Goslings - no experience in this area, hopes to gain a better understanding through asking questions - Beth Bacon - middle of the road level of experience. Previous position was US government so some familiarity with how colleagues used RDS data for these purposes, now experience from a registry perspective. - Farell Folly - more than 5 years of experience in regulatory (government) are especially in mobile telecommunications and Internet Service providers, but not especially with domain names. - Krishna Seeburn - has been part of the regulatory body, also worked with policy and LE in certain situations. Not a practicing lawyer, but good insight into what is being discussed. - Steve Metalitz - lawyer in private practice, has counseled clients involved in the scenarios outlined in the paper (contract compliance). Some direct experience and general experience in the regulatory environment. - Theo Geurts - as a registrar a lot of experience dealing with LE, IP as well as government. Been doing this since 2009 and responsible for the abuse team.
4. Introduce EWG's definition of this purpose as a starting point for discussion (see both EWG Report excerpts on page 2 of template)
- See template for EWG definition and example use cases. DT may decide to use this as a starting point if deemed helpful, but no obligation to do so. - Current description is very broad, more focused on use cases. Is objective to craft a purpose statement that could be used to share with DPAs in the context of data protection legislation? Important not to get hung up on the term 'definition' for now. - Recent work on users may help inform this, namely dataflow matrix that was created as part of the small group working on GDPR issues: https://www.icann.org/resources/pages/gtld- registration-dataflow-matrix-2017-07-24-en <https://www.icann.org/resources/pages/gtld-registration-dataflow-matrix-2017...> - Use case developed by RDS PDP WG may also assist in this regard (see https://community.icann.org/download/attachments/60493753/ 14-WHOIS%20queries%20for%20compliance%20purposes.docx? version=1&modificationDate=1470109106000&api=v2 <https://community.icann.org/download/attachments/60493753/14-WHOIS%20queries...>). In addition, EWG report identified a number of use cases for this purpose.
5. Initial Discussion
a. Q&A between members less familiar with this purpose and those who have direct experience with it
- Would be helpful to briefly describe tasks involved in this purpose? Who has been asked for what, in what context?
b. Team members more familiar with this purpose to give real-world examples of this purpose drawn from their own experiences
- UDRP - pretty straightforward process: registrar gets inquiry from UDRP provider, who is registrant, when was last update, etc. Info sent back to UDRP provider, following which procedure starts. Sometimes info is masked as a result of P/P services - requires review of conditions to see if unmasking is allowed. If info is not unmasked, P/P provider will be named as defendant. Some registrars will provide information to UDRP provider but will not reveal the info in WHOIS (depends on terms and conditions of P/P). The UDRP provider will look at publicly available WHOIS to send the necessary materials to registrant - even though info may not always be actionable. UDRP provider uses WHOIS info to be able to start their proceedings. The UDRP rules require the UDRP provider to send a "verification request" to registrar. UDRP provider also uses Whois data directly to send notice of the complaint to the respondent. - Intellectual property owner who identifies a site potentially infringing IP. Needs to be able to assess whether the registrant has authorisation/license to use IP. Contract enforcement issue - need to find out whether the person using IP has the right to do so. If not, it would involve next steps, for example getting ICANN compliance involved to enforce legal obligations. Would first go to WHOIS info to find a possible answer, even if info is not actionable (for example, in case of P/P). Would also include a WHOIS lookup to try and identify hosting party. - Contractual compliance - WHOIS accuracy - contractual obligation by registrars to correct info within a certain timeframe following receipt of WHOIS accuracy complaint. Received from all kinds of sources: registrants, ICANN compliance, third parties. - Registration data escrow audits - registrars need to ensure that registrant data is escrowed to an escrow provider to make sure that should a registrar go out of business, ICANN can get hold of registrant data to be able to provide continuity of service. Compliance audits are in place to ensure that data is available, complete, accurate. - Audits also in place to check how processes are applied that involve, amongst others, RDS info such as sending of FOA, transfers, etc.
*Action item #1*: DT members to dedicate time over the course of next week to this topic and encouraged to share perspectives on the mailing list.
c. Identify & discuss issues where more understanding is needed
6. Assign responsibilities for creating first drafts
a. Task i:
b. Task ii
c. Task iii
- Consider having one person doing task i, ii and iii for the different use cases. - Consider using google doc so that others can add / edit as appropriate. - Steve Metalitz: Intellectual Property owners. (Steve to send to the mailing list, Beth to turn it into a google doc).
*Action item #2*: DT members to share first draft by end of day on Thursday 19 October.
7. Next steps and action items
a. List discussion on agenda item 5.c. (Chuck will initiate this after call.)
b. Volunteers for agenda items 6.a, 6.b & 6.c will submit their first drafts to the list and initiate list discussion not later than Friday, October 20
8. Next teleconference call(s)
a. Suggestions:
i. Next call on Monday October 23 or Tuesday October 24
ii. Third call early on Thursday October 26 if needed to finalize deliverable
b. Chuck will request a Doodle Poll for the following days:
i. Monday October 23
ii. Tuesday October 24
iii. Thursday October 26
*Action item #3*: Staff to circulate doodle poll to schedule next meeting on Monday or Tuesday next week. Doodle poll would also include possible third meeting on Thursday 26 October - but if work is completed by that date, it would be cancelled.
*Marika Konings*
*Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) *
*Email: marika.konings@icann.org <marika.konings@icann.org> *
*Follow the GNSO via Twitter @ICANN_GNSO*
*Find out more about the GNSO by taking our interactive courses <http://learn.icann.org/courses/gnso> and visiting the GNSO Newcomer pages <http://gnso.icann.org/sites/gnso.icann.org/files/gnso/presentations/policy-e...>. *
_______________________________________________ Gnso-rds-pdp-5 mailing list Gnso-rds-pdp-5@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-5
There are different types of CERTs some are governmental and some commercial or even academic CERT. In general it is and has been a major important team when it comes to National Cert Many countries have them……In europe they even have a EU agency that prepares National Certs. ENISA. In Africa we have Africa CERT which tries to enforce it.
On Oct 20, 2017, at 23:01, Farell Folly <farellfolly@gmail.com> wrote:
Hello Beth,
If I assume that you mean CERT as Computer Emergency Response Team, I think that they are not regulatory or contractual enforcement, instead they may be seen as a mechanism or resource a regulatory agency can use. However the situation can be different from anonther perspective.
Regards @__f_f__ https://www.linkedin.com/in/farellf <https://www.linkedin.com/in/farellf> ________________________________ Mail sent from my mobile phone. Excuse for brievety.
Le 20 oct. 2017 19:54, "Beth Bacon" <bbacon@pir.org <mailto:bbacon@pir.org>> a écrit : Hello all,
Would the group view a CERT as something we would want to include under this category?
Thanks, Beth
<> From: gnso-rds-pdp-5-bounces@icann.org <mailto:gnso-rds-pdp-5-bounces@icann.org> [mailto:gnso-rds-pdp-5-bounces@icann.org <mailto:gnso-rds-pdp-5-bounces@icann.org>] On Behalf Of Beth Bacon Sent: Friday, October 20, 2017 1:30 PM To: Chuck <consult@cgomes.com <mailto:consult@cgomes.com>>; 'Metalitz, Steven' <met@msk.com <mailto:met@msk.com>>; 'Marika Konings' <marika.konings@icann.org <mailto:marika.konings@icann.org>>; gnso-rds-pdp-5@icann.org <mailto:gnso-rds-pdp-5@icann.org> Subject: Re: [Gnso-rds-pdp-5] Notes and action items from today's DT5 meeting
Hi folks,
I’ve gone ahead and pasted Steve’s document into a google doc here: https://docs.google.com/document/d/1NvoYYmMsjqgt48mAYt5nCr8uPk-E-2IngGt50wDk... <https://docs.google.com/document/d/1NvoYYmMsjqgt48mAYt5nCr8uPk-E-2IngGt50wDk...>.
I know some have issues using or accessing google docs but hopefully for our small group with a quick turnaround this will help us compile a document more simply.
Thanks, Beth
From: gnso-rds-pdp-5-bounces@icann.org <mailto:gnso-rds-pdp-5-bounces@icann.org> [mailto:gnso-rds-pdp-5-bounces@icann.org <mailto:gnso-rds-pdp-5-bounces@icann.org>] On Behalf Of Chuck Sent: Friday, October 20, 2017 10:14 AM To: 'Metalitz, Steven' <met@msk.com <mailto:met@msk.com>>; 'Marika Konings' <marika.konings@icann.org <mailto:marika.konings@icann.org>>; gnso-rds-pdp-5@icann.org <mailto:gnso-rds-pdp-5@icann.org> Subject: Re: [Gnso-rds-pdp-5] Notes and action items from today's DT5 meeting Importance: High
Thank you very much Steve.
All, please review Steve’s first draft and do one or both of the following today and over the weekend:
Comment and ask questions on this list Suggest edits and/or insert comments in the Word version using the redline function and send a new version to this list
Beth – if you want to put this into a Google doc, please feel free to do so.
If everyone contributes to this starting today and over the weekend, we should have a reasonably good draft before our meeting on Monday.
Chuck
From: gnso-rds-pdp-5-bounces@icann.org <mailto:gnso-rds-pdp-5-bounces@icann.org> [mailto:gnso-rds-pdp-5-bounces@icann.org <mailto:gnso-rds-pdp-5-bounces@icann.org>] On Behalf Of Metalitz, Steven Sent: Friday, October 20, 2017 6:48 AM To: 'Marika Konings' <marika.konings@icann.org <mailto:marika.konings@icann.org>>; gnso-rds-pdp-5@icann.org <mailto:gnso-rds-pdp-5@icann.org> Subject: Re: [Gnso-rds-pdp-5] Notes and action items from today's DT5 meeting
Fellow subteam 5 members,
Attached please find my draft on tasks i, ii and iii from the intellectual property owner perspective. Welcome your feedback/questions. (Apologies I did not note that the circulation deadline was accelerated from today to end of day yesterday.)
I view this as supplementing the similar summaries for each of the other use cases identified --- the due diligence on an online merchant use case put forward by Terri Stumme, and the use cases for online tax investigation, UDRP proceedings, and RDS ecosystem contractual compliance (including data escrow audits) identified in the EWG report. The first of these could readily be extracted from Terri’s submission, and I imagine that either or both of the registry/registrar compliance specialists on our subteam could easily prepare the last two.
Steve Metalitz
<image001.gif>
Steven J. Metalitz | Partner, through his professional corporation
T: 202.355.7902 <tel:(202)%20355-7902> | met@msk.com <mailto:met@msk.com> Mitchell Silberberg & Knupp LLP | www.msk.com <http://www.msk.com/> 1818 N Street NW, 8th Floor, Washington, DC 20036
THE INFORMATION CONTAINED IN THIS E-MAIL MESSAGE IS INTENDED ONLY FOR THE PERSONAL AND CONFIDENTIAL USE OF THE DESIGNATED RECIPIENTS. THIS MESSAGE MAY BE AN ATTORNEY-CLIENT COMMUNICATION, AND AS SUCH IS PRIVILEGED AND CONFIDENTIAL. IF THE READER OF THIS MESSAGE IS NOT AN INTENDED RECIPIENT, YOU ARE HEREBY NOTIFIED THAT ANY REVIEW, USE, DISSEMINATION, FORWARDING OR COPYING OF THIS MESSAGE IS STRICTLY PROHIBITED. PLEASE NOTIFY US IMMEDIATELY BY REPLY E-MAIL OR TELEPHONE, AND DELETE THE ORIGINAL MESSAGE AND ALL ATTACHMENTS FROM YOUR SYSTEM. THANK YOU.
From: gnso-rds-pdp-5-bounces@icann.org <mailto:gnso-rds-pdp-5-bounces@icann.org> [mailto:gnso-rds-pdp-5-bounces@icann.org <mailto:gnso-rds-pdp-5-bounces@icann.org>] On Behalf Of Marika Konings Sent: Wednesday, October 18, 2017 10:09 AM To: gnso-rds-pdp-5@icann.org <mailto:gnso-rds-pdp-5@icann.org> Subject: [Gnso-rds-pdp-5] Notes and action items from today's DT5 meeting
Dear All,
Please find below the notes & action items from today’s DT5 meeting. Please take particular note of the action items.
Best regards,
Marika
DT5 - Regulatory or Contractual Enforcement
Meeting on 18 October 2017
1. Welcome & roll call
Role of coordinator is to co-ordinate & facilitate, for DT members to do the actual work
2. Brief recap of drafting team goals and due date
a. Overall goal: To enable better understanding of the Regulatory or Contractual Enforcement purpose for Whois data, first in DT5 and then in the full RDS PDP WG.
See also the template that has been circulated. Objective is NOT to determine whether or not this purpose is legitimate, but to ensure understanding of what this purpose entails Deadline to complete tasks by Thursday 26 October - will require everyone to contribute and participate b. Tasks
i. List and briefly describe tasks commonly involved in carrying out this purpose.
ii. Describe the parties who often access gTLD registration data in pursuit of Regulatory or Contractual Enforcement purposes
iii. List gTLD registration data often involved in this purpose.
iv. Describe the purpose succinctly in one paragraph
Who are the parties that request WHOIS data today for Regulatory or Contractual Enforcement purposes? What role does gTLD registration data play for Regulatory or Contractual Enforcement purposes? Why is access to Whois data needed to fulfill Regulatory or Contractual Enforcement purposes? v. Prepare and submit the final deliverable to the full RDS PDP WG not later than Thursday, October 26.
vi. Provide an overview of the final deliverable in the Face-to-Face WG meeting on Saturday, October 28 in Abu Dhabi and interact with WG members in that meeting to answer their questions and help them understand the Regulatory or Contractual Enforcement purpose.
3. All team members to share their level of experience with the regulatory or contractual enforcement purpose
Bastiaan Goslings - no experience in this area, hopes to gain a better understanding through asking questions Beth Bacon - middle of the road level of experience. Previous position was US government so some familiarity with how colleagues used RDS data for these purposes, now experience from a registry perspective. Farell Folly - more than 5 years of experience in regulatory (government) are especially in mobile telecommunications and Internet Service providers, but not especially with domain names. Krishna Seeburn - has been part of the regulatory body, also worked with policy and LE in certain situations. Not a practicing lawyer, but good insight into what is being discussed. Steve Metalitz - lawyer in private practice, has counseled clients involved in the scenarios outlined in the paper (contract compliance). Some direct experience and general experience in the regulatory environment. Theo Geurts - as a registrar a lot of experience dealing with LE, IP as well as government. Been doing this since 2009 and responsible for the abuse team.
4. Introduce EWG's definition of this purpose as a starting point for discussion (see both EWG Report excerpts on page 2 of template)
See template for EWG definition and example use cases. DT may decide to use this as a starting point if deemed helpful, but no obligation to do so. Current description is very broad, more focused on use cases. Is objective to craft a purpose statement that could be used to share with DPAs in the context of data protection legislation? Important not to get hung up on the term 'definition' for now. Recent work on users may help inform this, namely dataflow matrix that was created as part of the small group working on GDPR issues: https://www.icann.org/resources/pages/gtld-registration-dataflow-matrix-2017... <https://www.icann.org/resources/pages/gtld-registration-dataflow-matrix-2017...> Use case developed by RDS PDP WG may also assist in this regard (see https://community.icann.org/download/attachments/60493753/14-WHOIS%20queries... <https://community.icann.org/download/attachments/60493753/14-WHOIS%20queries...>). In addition, EWG report identified a number of use cases for this purpose.
5. Initial Discussion
a. Q&A between members less familiar with this purpose and those who have direct experience with it
Would be helpful to briefly describe tasks involved in this purpose? Who has been asked for what, in what context?
b. Team members more familiar with this purpose to give real-world examples of this purpose drawn from their own experiences
UDRP - pretty straightforward process: registrar gets inquiry from UDRP provider, who is registrant, when was last update, etc. Info sent back to UDRP provider, following which procedure starts. Sometimes info is masked as a result of P/P services - requires review of conditions to see if unmasking is allowed. If info is not unmasked, P/P provider will be named as defendant. Some registrars will provide information to UDRP provider but will not reveal the info in WHOIS (depends on terms and conditions of P/P). The UDRP provider will look at publicly available WHOIS to send the necessary materials to registrant - even though info may not always be actionable. UDRP provider uses WHOIS info to be able to start their proceedings. The UDRP rules require the UDRP provider to send a "verification request" to registrar. UDRP provider also uses Whois data directly to send notice of the complaint to the respondent. Intellectual property owner who identifies a site potentially infringing IP. Needs to be able to assess whether the registrant has authorisation/license to use IP. Contract enforcement issue - need to find out whether the person using IP has the right to do so. If not, it would involve next steps, for example getting ICANN compliance involved to enforce legal obligations. Would first go to WHOIS info to find a possible answer, even if info is not actionable (for example, in case of P/P). Would also include a WHOIS lookup to try and identify hosting party. Contractual compliance - WHOIS accuracy - contractual obligation by registrars to correct info within a certain timeframe following receipt of WHOIS accuracy complaint. Received from all kinds of sources: registrants, ICANN compliance, third parties. Registration data escrow audits - registrars need to ensure that registrant data is escrowed to an escrow provider to make sure that should a registrar go out of business, ICANN can get hold of registrant data to be able to provide continuity of service. Compliance audits are in place to ensure that data is available, complete, accurate. Audits also in place to check how processes are applied that involve, amongst others, RDS info such as sending of FOA, transfers, etc.
Action item #1: DT members to dedicate time over the course of next week to this topic and encouraged to share perspectives on the mailing list.
c. Identify & discuss issues where more understanding is needed
6. Assign responsibilities for creating first drafts
a. Task i:
b. Task ii
c. Task iii
Consider having one person doing task i, ii and iii for the different use cases. Consider using google doc so that others can add / edit as appropriate. Steve Metalitz: Intellectual Property owners. (Steve to send to the mailing list, Beth to turn it into a google doc).
Action item #2: DT members to share first draft by end of day on Thursday 19 October.
7. Next steps and action items
a. List discussion on agenda item 5.c. (Chuck will initiate this after call.)
b. Volunteers for agenda items 6.a, 6.b & 6.c will submit their first drafts to the list and initiate list discussion not later than Friday, October 20
8. Next teleconference call(s)
a. Suggestions:
i. Next call on Monday October 23 or Tuesday October 24
ii. Third call early on Thursday October 26 if needed to finalize deliverable
b. Chuck will request a Doodle Poll for the following days:
i. Monday October 23
ii. Tuesday October 24
iii. Thursday October 26
Action item #3: Staff to circulate doodle poll to schedule next meeting on Monday or Tuesday next week. Doodle poll would also include possible third meeting on Thursday 26 October - but if work is completed by that date, it would be cancelled.
Marika Konings
Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN)
Email: marika.konings@icann.org <mailto:marika.konings@icann.org>
Follow the GNSO via Twitter @ICANN_GNSO
Find out more about the GNSO by taking our interactive courses <http://learn.icann.org/courses/gnso> and visiting the GNSO Newcomer pages <http://gnso.icann.org/sites/gnso.icann.org/files/gnso/presentations/policy-e...>.
_______________________________________________ Gnso-rds-pdp-5 mailing list Gnso-rds-pdp-5@icann.org <mailto:Gnso-rds-pdp-5@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-5 <https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-5> _______________________________________________ Gnso-rds-pdp-5 mailing list Gnso-rds-pdp-5@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-5
Kris Seeburn seeburn.k@gmail.com www.linkedin.com/in/kseeburn/ <http://www.linkedin.com/in/kseeburn/>
Note that certs are covered by another team. Chuck From: Farell Folly [mailto:farellfolly@gmail.com] Sent: Friday, October 20, 2017 12:02 PM To: Beth Bacon <bbacon@pir.org> Cc: gnso-rds-pdp-5@icann.org; Metalitz, Steven <met@msk.com>; Marika Konings <marika.konings@icann.org>; Chuck <consult@cgomes.com> Subject: Re: [Gnso-rds-pdp-5] Notes and action items from today's DT5 meeting Hello Beth, If I assume that you mean CERT as Computer Emergency Response Team, I think that they are not regulatory or contractual enforcement, instead they may be seen as a mechanism or resource a regulatory agency can use. However the situation can be different from anonther perspective. Regards @__f_f__ https://www.linkedin.com/in/farellf ________________________________ Mail sent from my mobile phone. Excuse for brievety. Le 20 oct. 2017 19:54, "Beth Bacon" <bbacon@pir.org <mailto:bbacon@pir.org> > a écrit : Hello all, Would the group view a CERT as something we would want to include under this category? Thanks, Beth From: gnso-rds-pdp-5-bounces@icann.org <mailto:gnso-rds-pdp-5-bounces@icann.org> [mailto:gnso-rds-pdp-5-bounces@icann.org <mailto:gnso-rds-pdp-5-bounces@icann.org> ] On Behalf Of Beth Bacon Sent: Friday, October 20, 2017 1:30 PM To: Chuck <consult@cgomes.com <mailto:consult@cgomes.com> >; 'Metalitz, Steven' <met@msk.com <mailto:met@msk.com> >; 'Marika Konings' <marika.konings@icann.org <mailto:marika.konings@icann.org> >; gnso-rds-pdp-5@icann.org <mailto:gnso-rds-pdp-5@icann.org> Subject: Re: [Gnso-rds-pdp-5] Notes and action items from today's DT5 meeting Hi folks, I’ve gone ahead and pasted Steve’s document into a google doc here: https://docs.google.com/document/d/1NvoYYmMsjqgt48mAYt5nCr8uPk-E-2IngGt50wDk.... I know some have issues using or accessing google docs but hopefully for our small group with a quick turnaround this will help us compile a document more simply. Thanks, Beth From: gnso-rds-pdp-5-bounces@icann.org <mailto:gnso-rds-pdp-5-bounces@icann.org> [mailto:gnso-rds-pdp-5-bounces@icann.org] On Behalf Of Chuck Sent: Friday, October 20, 2017 10:14 AM To: 'Metalitz, Steven' <met@msk.com <mailto:met@msk.com> >; 'Marika Konings' <marika.konings@icann.org <mailto:marika.konings@icann.org> >; gnso-rds-pdp-5@icann.org <mailto:gnso-rds-pdp-5@icann.org> Subject: Re: [Gnso-rds-pdp-5] Notes and action items from today's DT5 meeting Importance: High Thank you very much Steve. All, please review Steve’s first draft and do one or both of the following today and over the weekend: * Comment and ask questions on this list * Suggest edits and/or insert comments in the Word version using the redline function and send a new version to this list Beth – if you want to put this into a Google doc, please feel free to do so. If everyone contributes to this starting today and over the weekend, we should have a reasonably good draft before our meeting on Monday. Chuck From: gnso-rds-pdp-5-bounces@icann.org <mailto:gnso-rds-pdp-5-bounces@icann.org> [mailto:gnso-rds-pdp-5-bounces@icann.org] On Behalf Of Metalitz, Steven Sent: Friday, October 20, 2017 6:48 AM To: 'Marika Konings' <marika.konings@icann.org <mailto:marika.konings@icann.org> >; gnso-rds-pdp-5@icann.org <mailto:gnso-rds-pdp-5@icann.org> Subject: Re: [Gnso-rds-pdp-5] Notes and action items from today's DT5 meeting Fellow subteam 5 members, Attached please find my draft on tasks i, ii and iii from the intellectual property owner perspective. Welcome your feedback/questions. (Apologies I did not note that the circulation deadline was accelerated from today to end of day yesterday.) I view this as supplementing the similar summaries for each of the other use cases identified --- the due diligence on an online merchant use case put forward by Terri Stumme, and the use cases for online tax investigation, UDRP proceedings, and RDS ecosystem contractual compliance (including data escrow audits) identified in the EWG report. The first of these could readily be extracted from Terri’s submission, and I imagine that either or both of the registry/registrar compliance specialists on our subteam could easily prepare the last two. Steve Metalitz Steven J. Metalitz | Partner, through his professional corporation T: 202.355.7902 <tel:(202)%20355-7902> | <mailto:met@msk.com> met@msk.com Mitchell Silberberg & Knupp LLP | <http://www.msk.com/> www.msk.com 1818 N Street NW, 8th Floor, Washington, DC 20036 THE INFORMATION CONTAINED IN THIS E-MAIL MESSAGE IS INTENDED ONLY FOR THE PERSONAL AND CONFIDENTIAL USE OF THE DESIGNATED RECIPIENTS. THIS MESSAGE MAY BE AN ATTORNEY-CLIENT COMMUNICATION, AND AS SUCH IS PRIVILEGED AND CONFIDENTIAL. IF THE READER OF THIS MESSAGE IS NOT AN INTENDED RECIPIENT, YOU ARE HEREBY NOTIFIED THAT ANY REVIEW, USE, DISSEMINATION, FORWARDING OR COPYING OF THIS MESSAGE IS STRICTLY PROHIBITED. PLEASE NOTIFY US IMMEDIATELY BY REPLY E-MAIL OR TELEPHONE, AND DELETE THE ORIGINAL MESSAGE AND ALL ATTACHMENTS FROM YOUR SYSTEM. THANK YOU. From: gnso-rds-pdp-5-bounces@icann.org <mailto:gnso-rds-pdp-5-bounces@icann.org> [mailto:gnso-rds-pdp-5-bounces@icann.org] On Behalf Of Marika Konings Sent: Wednesday, October 18, 2017 10:09 AM To: gnso-rds-pdp-5@icann.org <mailto:gnso-rds-pdp-5@icann.org> Subject: [Gnso-rds-pdp-5] Notes and action items from today's DT5 meeting Dear All, Please find below the notes & action items from today’s DT5 meeting. Please take particular note of the action items. Best regards, Marika DT5 - Regulatory or Contractual Enforcement Meeting on 18 October 2017 1. Welcome & roll call * Role of coordinator is to co-ordinate & facilitate, for DT members to do the actual work 2. Brief recap of drafting team goals and due date a. Overall goal: To enable better understanding of the Regulatory or Contractual Enforcement purpose for Whois data, first in DT5 and then in the full RDS PDP WG. * See also the template that has been circulated. * Objective is NOT to determine whether or not this purpose is legitimate, but to ensure understanding of what this purpose entails * Deadline to complete tasks by Thursday 26 October - will require everyone to contribute and participate b. Tasks i. List and briefly describe tasks commonly involved in carrying out this purpose. ii. Describe the parties who often access gTLD registration data in pursuit of Regulatory or Contractual Enforcement purposes iii. List gTLD registration data often involved in this purpose. iv. Describe the purpose succinctly in one paragraph * Who are the parties that request WHOIS data today for Regulatory or Contractual Enforcement purposes? * What role does gTLD registration data play for Regulatory or Contractual Enforcement purposes? * Why is access to Whois data needed to fulfill Regulatory or Contractual Enforcement purposes? v. Prepare and submit the final deliverable to the full RDS PDP WG not later than Thursday, October 26. vi. Provide an overview of the final deliverable in the Face-to-Face WG meeting on Saturday, October 28 in Abu Dhabi and interact with WG members in that meeting to answer their questions and help them understand the Regulatory or Contractual Enforcement purpose. 3. All team members to share their level of experience with the regulatory or contractual enforcement purpose * Bastiaan Goslings - no experience in this area, hopes to gain a better understanding through asking questions * Beth Bacon - middle of the road level of experience. Previous position was US government so some familiarity with how colleagues used RDS data for these purposes, now experience from a registry perspective. * Farell Folly - more than 5 years of experience in regulatory (government) are especially in mobile telecommunications and Internet Service providers, but not especially with domain names. * Krishna Seeburn - has been part of the regulatory body, also worked with policy and LE in certain situations. Not a practicing lawyer, but good insight into what is being discussed. * Steve Metalitz - lawyer in private practice, has counseled clients involved in the scenarios outlined in the paper (contract compliance). Some direct experience and general experience in the regulatory environment. * Theo Geurts - as a registrar a lot of experience dealing with LE, IP as well as government. Been doing this since 2009 and responsible for the abuse team. 4. Introduce EWG's definition of this purpose as a starting point for discussion (see both EWG Report excerpts on page 2 of template) * See template for EWG definition and example use cases. DT may decide to use this as a starting point if deemed helpful, but no obligation to do so. * Current description is very broad, more focused on use cases. Is objective to craft a purpose statement that could be used to share with DPAs in the context of data protection legislation? Important not to get hung up on the term 'definition' for now. * Recent work on users may help inform this, namely dataflow matrix that was created as part of the small group working on GDPR issues: https://www.icann.org/resources/pages/gtld-registration-dataflow-matrix-2017... * Use case developed by RDS PDP WG may also assist in this regard (see https://community.icann.org/download/attachments/60493753/14-WHOIS%20queries... <https://community.icann.org/download/attachments/60493753/14-WHOIS%20queries...> &modificationDate=1470109106000&api=v2). In addition, EWG report identified a number of use cases for this purpose. 5. Initial Discussion a. Q&A between members less familiar with this purpose and those who have direct experience with it * Would be helpful to briefly describe tasks involved in this purpose? Who has been asked for what, in what context? b. Team members more familiar with this purpose to give real-world examples of this purpose drawn from their own experiences * UDRP - pretty straightforward process: registrar gets inquiry from UDRP provider, who is registrant, when was last update, etc. Info sent back to UDRP provider, following which procedure starts. Sometimes info is masked as a result of P/P services - requires review of conditions to see if unmasking is allowed. If info is not unmasked, P/P provider will be named as defendant. Some registrars will provide information to UDRP provider but will not reveal the info in WHOIS (depends on terms and conditions of P/P). The UDRP provider will look at publicly available WHOIS to send the necessary materials to registrant - even though info may not always be actionable. UDRP provider uses WHOIS info to be able to start their proceedings. The UDRP rules require the UDRP provider to send a "verification request" to registrar. UDRP provider also uses Whois data directly to send notice of the complaint to the respondent. * Intellectual property owner who identifies a site potentially infringing IP. Needs to be able to assess whether the registrant has authorisation/license to use IP. Contract enforcement issue - need to find out whether the person using IP has the right to do so. If not, it would involve next steps, for example getting ICANN compliance involved to enforce legal obligations. Would first go to WHOIS info to find a possible answer, even if info is not actionable (for example, in case of P/P). Would also include a WHOIS lookup to try and identify hosting party. * Contractual compliance - WHOIS accuracy - contractual obligation by registrars to correct info within a certain timeframe following receipt of WHOIS accuracy complaint. Received from all kinds of sources: registrants, ICANN compliance, third parties. * Registration data escrow audits - registrars need to ensure that registrant data is escrowed to an escrow provider to make sure that should a registrar go out of business, ICANN can get hold of registrant data to be able to provide continuity of service. Compliance audits are in place to ensure that data is available, complete, accurate. * Audits also in place to check how processes are applied that involve, amongst others, RDS info such as sending of FOA, transfers, etc. Action item #1: DT members to dedicate time over the course of next week to this topic and encouraged to share perspectives on the mailing list. c. Identify & discuss issues where more understanding is needed 6. Assign responsibilities for creating first drafts a. Task i: b. Task ii c. Task iii * Consider having one person doing task i, ii and iii for the different use cases. * Consider using google doc so that others can add / edit as appropriate. * Steve Metalitz: Intellectual Property owners. (Steve to send to the mailing list, Beth to turn it into a google doc). Action item #2: DT members to share first draft by end of day on Thursday 19 October. 7. Next steps and action items a. List discussion on agenda item 5.c. (Chuck will initiate this after call.) b. Volunteers for agenda items 6.a, 6.b & 6.c will submit their first drafts to the list and initiate list discussion not later than Friday, October 20 8. Next teleconference call(s) a. Suggestions: i. Next call on Monday October 23 or Tuesday October 24 ii. Third call early on Thursday October 26 if needed to finalize deliverable b. Chuck will request a Doodle Poll for the following days: i. Monday October 23 ii. Tuesday October 24 iii. Thursday October 26 Action item #3: Staff to circulate doodle poll to schedule next meeting on Monday or Tuesday next week. Doodle poll would also include possible third meeting on Thursday 26 October - but if work is completed by that date, it would be cancelled. Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings@icann.org <mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses <http://learn.icann.org/courses/gnso> and visiting the GNSO Newcomer pages <http://gnso.icann.org/sites/gnso.icann.org/files/gnso/presentations/policy-e...> . _______________________________________________ Gnso-rds-pdp-5 mailing list Gnso-rds-pdp-5@icann.org <mailto:Gnso-rds-pdp-5@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-5
Thanks Beth, Steve, Google doc works, now we just need some hours in a day. Theo On 20-10-2017 19:29, Beth Bacon wrote:
Hi folks,
I’ve gone ahead and pasted Steve’s document into a google doc here: https://docs.google.com/document/d/1NvoYYmMsjqgt48mAYt5nCr8uPk-E-2IngGt50wDk....
I know some have issues using or accessing google docs but hopefully for our small group with a quick turnaround this will help us compile a document more simply.
Thanks, Beth
*From:*gnso-rds-pdp-5-bounces@icann.org [mailto:gnso-rds-pdp-5-bounces@icann.org] *On Behalf Of *Chuck *Sent:* Friday, October 20, 2017 10:14 AM *To:* 'Metalitz, Steven' <met@msk.com>; 'Marika Konings' <marika.konings@icann.org>; gnso-rds-pdp-5@icann.org *Subject:* Re: [Gnso-rds-pdp-5] Notes and action items from today's DT5 meeting *Importance:* High
Thank you very much Steve.
All, please review Steve’s first draft and do one or both of the following today and over the weekend:
* Comment and ask questions on this list * Suggest edits and/or insert comments in the Word version using the redline function and send a new version to this list
Beth – if you want to put this into a Google doc, please feel free to do so.
If everyone contributes to this starting today and over the weekend, we should have a reasonably good draft before our meeting on Monday.
Chuck
*From:*gnso-rds-pdp-5-bounces@icann.org <mailto:gnso-rds-pdp-5-bounces@icann.org> [mailto:gnso-rds-pdp-5-bounces@icann.org] *On Behalf Of *Metalitz, Steven *Sent:* Friday, October 20, 2017 6:48 AM *To:* 'Marika Konings' <marika.konings@icann.org <mailto:marika.konings@icann.org>>; gnso-rds-pdp-5@icann.org <mailto:gnso-rds-pdp-5@icann.org> *Subject:* Re: [Gnso-rds-pdp-5] Notes and action items from today's DT5 meeting
Fellow subteam 5 members,
Attached please find my draft on tasks i, ii and iii from the intellectual property owner perspective. Welcome your feedback/questions. (Apologies I did not note that the circulation deadline was accelerated from today to end of day yesterday.)
I view this as supplementing the similar summaries for each of the other use cases identified --- the due diligence on an online merchant use case put forward by Terri Stumme, and the use cases for online tax investigation, UDRP proceedings, and RDS ecosystem contractual compliance (including data escrow audits) identified in the EWG report. The first of these could readily be extracted from Terri’s submission, and I imagine that either or both of the registry/registrar compliance specialists on our subteam could easily prepare the last two.
Steve Metalitz
*image001*
*Steven J. Metalitz *|***Partner, through his professional corporation*
T: 202.355.7902 | met@msk.com <mailto:met@msk.com>**
*Mitchell Silberberg & Knupp**LLP*|*www.msk.com <http://www.msk.com/>*
1818 N Street NW, 8th Floor, Washington, DC 20036
*_THE INFORMATION CONTAINED IN THIS E-MAIL MESSAGE IS INTENDED ONLY FOR THE PERSONAL AND CONFIDENTIAL USE OF THE DESIGNATED RECIPIENTS._**THIS MESSAGE MAY BE AN ATTORNEY-CLIENT COMMUNICATION, AND AS SUCH IS PRIVILEGED AND CONFIDENTIAL. IF THE READER OF THIS MESSAGE IS NOT AN INTENDED RECIPIENT, YOU ARE HEREBY NOTIFIED THAT ANY REVIEW, USE, DISSEMINATION, FORWARDING OR COPYING OF THIS MESSAGE IS STRICTLY PROHIBITED. PLEASE NOTIFY US IMMEDIATELY BY REPLY E-MAIL OR TELEPHONE, AND DELETE THE ORIGINAL MESSAGE AND ALL ATTACHMENTS FROM YOUR SYSTEM. THANK YOU.*
*From:*gnso-rds-pdp-5-bounces@icann.org <mailto:gnso-rds-pdp-5-bounces@icann.org> [mailto:gnso-rds-pdp-5-bounces@icann.org] *On Behalf Of *Marika Konings *Sent:* Wednesday, October 18, 2017 10:09 AM *To:* gnso-rds-pdp-5@icann.org <mailto:gnso-rds-pdp-5@icann.org> *Subject:* [Gnso-rds-pdp-5] Notes and action items from today's DT5 meeting
Dear All,
Please find below the notes & action items from today’s DT5 meeting. Please take particular note of the action items.
Best regards,
Marika
*DT5 - Regulatory or Contractual Enforcement*
/Meeting on 18 October 2017/
1. Welcome & roll call
* Role of coordinator is to co-ordinate & facilitate, for DT members to do the actual work
2. Brief recap of drafting team goals and due date
a. Overall goal: To enable better understanding of the Regulatory or Contractual Enforcement purpose for Whois data, first in DT5 and then in the full RDS PDP WG.
* See also the template that has been circulated. * Objective is NOT to determine whether or not this purpose is legitimate, but to ensure understanding of what this purpose entails * Deadline to complete tasks by Thursday 26 October - will require everyone to contribute and participate
b. Tasks
i. List and briefly describe tasks commonly involved in carrying out this purpose.
ii. Describe the parties who often access gTLD registration data in pursuit of Regulatory or Contractual Enforcement purposes
iii. List gTLD registration data often involved in this purpose.
iv. Describe the purpose succinctly in one paragraph
* Who are the parties that request WHOIS data today for Regulatory or Contractual Enforcement purposes? * What role does gTLD registration data play for Regulatory or Contractual Enforcement purposes? * Why is access to Whois data needed to fulfill Regulatory or Contractual Enforcement purposes?
v. Prepare and submit the final deliverable to the full RDS PDP WG not later than Thursday, October 26.
vi. Provide an overview of the final deliverable in the Face-to-Face WG meeting on Saturday, October 28 in Abu Dhabi and interact with WG members in that meeting to answer their questions and help them understand the Regulatory or Contractual Enforcement purpose.
3. All team members to share their level of experience with the regulatory or contractual enforcement purpose
* Bastiaan Goslings - no experience in this area, hopes to gain a better understanding through asking questions * Beth Bacon - middle of the road level of experience. Previous position was US government so some familiarity with how colleagues used RDS data for these purposes, now experience from a registry perspective. * Farell Folly - more than 5 years of experience in regulatory (government) are especially in mobile telecommunications and Internet Service providers, but not especially with domain names. * Krishna Seeburn - has been part of the regulatory body, also worked with policy and LE in certain situations. Not a practicing lawyer, but good insight into what is being discussed. * Steve Metalitz - lawyer in private practice, has counseled clients involved in the scenarios outlined in the paper (contract compliance). Some direct experience and general experience in the regulatory environment. * Theo Geurts - as a registrar a lot of experience dealing with LE, IP as well as government. Been doing this since 2009 and responsible for the abuse team.
4. Introduce EWG's definition of this purpose as a starting point for discussion (see both EWG Report excerpts on page 2 of template)
* See template for EWG definition and example use cases. DT may decide to use this as a starting point if deemed helpful, but no obligation to do so. * Current description is very broad, more focused on use cases. Is objective to craft a purpose statement that could be used to share with DPAs in the context of data protection legislation? Important not to get hung up on the term 'definition' for now. * Recent work on users may help inform this, namely dataflow matrix that was created as part of the small group working on GDPR issues: https://www.icann.org/resources/pages/gtld-registration-dataflow-matrix-2017... * Use case developed by RDS PDP WG may also assist in this regard (see https://community.icann.org/download/attachments/60493753/14-WHOIS%20queries...). In addition, EWG report identified a number of use cases for this purpose.
5. Initial Discussion
a. Q&A between members less familiar with this purpose and those who have direct experience with it
* Would be helpful to briefly describe tasks involved in this purpose? Who has been asked for what, in what context?
b. Team members more familiar with this purpose to give real-world examples of this purpose drawn from their own experiences
* UDRP - pretty straightforward process: registrar gets inquiry from UDRP provider, who is registrant, when was last update, etc. Info sent back to UDRP provider, following which procedure starts. Sometimes info is masked as a result of P/P services - requires review of conditions to see if unmasking is allowed. If info is not unmasked, P/P provider will be named as defendant. Some registrars will provide information to UDRP provider but will not reveal the info in WHOIS (depends on terms and conditions of P/P). The UDRP provider will look at publicly available WHOIS to send the necessary materials to registrant - even though info may not always be actionable. UDRP provider uses WHOIS info to be able to start their proceedings. The UDRP rules require the UDRP provider to send a "verification request" to registrar. UDRP provider also uses Whois data directly to send notice of the complaint to the respondent. * Intellectual property owner who identifies a site potentially infringing IP. Needs to be able to assess whether the registrant has authorisation/license to use IP. Contract enforcement issue - need to find out whether the person using IP has the right to do so. If not, it would involve next steps, for example getting ICANN compliance involved to enforce legal obligations. Would first go to WHOIS info to find a possible answer, even if info is not actionable (for example, in case of P/P). Would also include a WHOIS lookup to try and identify hosting party. * Contractual compliance - WHOIS accuracy - contractual obligation by registrars to correct info within a certain timeframe following receipt of WHOIS accuracy complaint. Received from all kinds of sources: registrants, ICANN compliance, third parties. * Registration data escrow audits - registrars need to ensure that registrant data is escrowed to an escrow provider to make sure that should a registrar go out of business, ICANN can get hold of registrant data to be able to provide continuity of service. Compliance audits are in place to ensure that data is available, complete, accurate. * Audits also in place to check how processes are applied that involve, amongst others, RDS info such as sending of FOA, transfers, etc.
*Action item #1*: DT members to dedicate time over the course of next week to this topic and encouraged to share perspectives on the mailing list.
c. Identify & discuss issues where more understanding is needed
6. Assign responsibilities for creating first drafts
a. Task i:
b. Task ii
c. Task iii
* Consider having one person doing task i, ii and iii for the different use cases. * Consider using google doc so that others can add / edit as appropriate. * Steve Metalitz: Intellectual Property owners. (Steve to send to the mailing list, Beth to turn it into a google doc).
*Action item #2*: DT members to share first draft by end of day on Thursday 19 October.
7. Next steps and action items
a. List discussion on agenda item 5.c. (Chuck will initiate this after call.)
b. Volunteers for agenda items 6.a, 6.b & 6.c will submit their first drafts to the list and initiate list discussion not later than Friday, October 20
8. Next teleconference call(s)
a. Suggestions:
i. Next call on Monday October 23 or Tuesday October 24
ii. Third call early on Thursday October 26 if needed to finalize deliverable
b. Chuck will request a Doodle Poll for the following days:
i. Monday October 23
ii. Tuesday October 24
iii. Thursday October 26
*Action item #3*: Staff to circulate doodle poll to schedule next meeting on Monday or Tuesday next week. Doodle poll would also include possible third meeting on Thursday 26 October - but if work is completed by that date, it would be cancelled.
*/Marika Konings/*
/Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) /
/Email: marika.konings@icann.org <mailto:marika.konings@icann.org> /
//
/Follow the GNSO via Twitter @ICANN_GNSO/
/Find out more about the GNSO by taking our interactive courses <http://learn.icann.org/courses/gnso> and visiting the GNSO Newcomer pages <http://gnso.icann.org/sites/gnso.icann.org/files/gnso/presentations/policy-e...>. /
_______________________________________________ Gnso-rds-pdp-5 mailing list Gnso-rds-pdp-5@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-5
Thanks Beth. If anyone has difficulty using the Google Doc, please communicate your input on the list and other can incorporate it. Chuck From: Beth Bacon [mailto:bbacon@pir.org] Sent: Friday, October 20, 2017 10:30 AM To: Chuck <consult@cgomes.com>; 'Metalitz, Steven' <met@msk.com>; 'Marika Konings' <marika.konings@icann.org>; gnso-rds-pdp-5@icann.org Subject: RE: [Gnso-rds-pdp-5] Notes and action items from today's DT5 meeting Hi folks, I’ve gone ahead and pasted Steve’s document into a google doc here: https://docs.google.com/document/d/1NvoYYmMsjqgt48mAYt5nCr8uPk-E-2IngGt50wDk.... I know some have issues using or accessing google docs but hopefully for our small group with a quick turnaround this will help us compile a document more simply. Thanks, Beth From: gnso-rds-pdp-5-bounces@icann.org <mailto:gnso-rds-pdp-5-bounces@icann.org> [mailto:gnso-rds-pdp-5-bounces@icann.org] On Behalf Of Chuck Sent: Friday, October 20, 2017 10:14 AM To: 'Metalitz, Steven' <met@msk.com <mailto:met@msk.com> >; 'Marika Konings' <marika.konings@icann.org <mailto:marika.konings@icann.org> >; gnso-rds-pdp-5@icann.org <mailto:gnso-rds-pdp-5@icann.org> Subject: Re: [Gnso-rds-pdp-5] Notes and action items from today's DT5 meeting Importance: High Thank you very much Steve. All, please review Steve’s first draft and do one or both of the following today and over the weekend: * Comment and ask questions on this list * Suggest edits and/or insert comments in the Word version using the redline function and send a new version to this list Beth – if you want to put this into a Google doc, please feel free to do so. If everyone contributes to this starting today and over the weekend, we should have a reasonably good draft before our meeting on Monday. Chuck From: gnso-rds-pdp-5-bounces@icann.org <mailto:gnso-rds-pdp-5-bounces@icann.org> [mailto:gnso-rds-pdp-5-bounces@icann.org] On Behalf Of Metalitz, Steven Sent: Friday, October 20, 2017 6:48 AM To: 'Marika Konings' <marika.konings@icann.org <mailto:marika.konings@icann.org> >; gnso-rds-pdp-5@icann.org <mailto:gnso-rds-pdp-5@icann.org> Subject: Re: [Gnso-rds-pdp-5] Notes and action items from today's DT5 meeting Fellow subteam 5 members, Attached please find my draft on tasks i, ii and iii from the intellectual property owner perspective. Welcome your feedback/questions. (Apologies I did not note that the circulation deadline was accelerated from today to end of day yesterday.) I view this as supplementing the similar summaries for each of the other use cases identified --- the due diligence on an online merchant use case put forward by Terri Stumme, and the use cases for online tax investigation, UDRP proceedings, and RDS ecosystem contractual compliance (including data escrow audits) identified in the EWG report. The first of these could readily be extracted from Terri’s submission, and I imagine that either or both of the registry/registrar compliance specialists on our subteam could easily prepare the last two. Steve Metalitz Steven J. Metalitz | Partner, through his professional corporation T: 202.355.7902 | <mailto:met@msk.com> met@msk.com Mitchell Silberberg & Knupp LLP | <http://www.msk.com/> www.msk.com 1818 N Street NW, 8th Floor, Washington, DC 20036 THE INFORMATION CONTAINED IN THIS E-MAIL MESSAGE IS INTENDED ONLY FOR THE PERSONAL AND CONFIDENTIAL USE OF THE DESIGNATED RECIPIENTS. THIS MESSAGE MAY BE AN ATTORNEY-CLIENT COMMUNICATION, AND AS SUCH IS PRIVILEGED AND CONFIDENTIAL. IF THE READER OF THIS MESSAGE IS NOT AN INTENDED RECIPIENT, YOU ARE HEREBY NOTIFIED THAT ANY REVIEW, USE, DISSEMINATION, FORWARDING OR COPYING OF THIS MESSAGE IS STRICTLY PROHIBITED. PLEASE NOTIFY US IMMEDIATELY BY REPLY E-MAIL OR TELEPHONE, AND DELETE THE ORIGINAL MESSAGE AND ALL ATTACHMENTS FROM YOUR SYSTEM. THANK YOU. From: gnso-rds-pdp-5-bounces@icann.org <mailto:gnso-rds-pdp-5-bounces@icann.org> [mailto:gnso-rds-pdp-5-bounces@icann.org] On Behalf Of Marika Konings Sent: Wednesday, October 18, 2017 10:09 AM To: gnso-rds-pdp-5@icann.org <mailto:gnso-rds-pdp-5@icann.org> Subject: [Gnso-rds-pdp-5] Notes and action items from today's DT5 meeting Dear All, Please find below the notes & action items from today’s DT5 meeting. Please take particular note of the action items. Best regards, Marika DT5 - Regulatory or Contractual Enforcement Meeting on 18 October 2017 1. Welcome & roll call * Role of coordinator is to co-ordinate & facilitate, for DT members to do the actual work 2. Brief recap of drafting team goals and due date a. Overall goal: To enable better understanding of the Regulatory or Contractual Enforcement purpose for Whois data, first in DT5 and then in the full RDS PDP WG. * See also the template that has been circulated. * Objective is NOT to determine whether or not this purpose is legitimate, but to ensure understanding of what this purpose entails * Deadline to complete tasks by Thursday 26 October - will require everyone to contribute and participate b. Tasks i. List and briefly describe tasks commonly involved in carrying out this purpose. ii. Describe the parties who often access gTLD registration data in pursuit of Regulatory or Contractual Enforcement purposes iii. List gTLD registration data often involved in this purpose. iv. Describe the purpose succinctly in one paragraph * Who are the parties that request WHOIS data today for Regulatory or Contractual Enforcement purposes? * What role does gTLD registration data play for Regulatory or Contractual Enforcement purposes? * Why is access to Whois data needed to fulfill Regulatory or Contractual Enforcement purposes? v. Prepare and submit the final deliverable to the full RDS PDP WG not later than Thursday, October 26. vi. Provide an overview of the final deliverable in the Face-to-Face WG meeting on Saturday, October 28 in Abu Dhabi and interact with WG members in that meeting to answer their questions and help them understand the Regulatory or Contractual Enforcement purpose. 3. All team members to share their level of experience with the regulatory or contractual enforcement purpose * Bastiaan Goslings - no experience in this area, hopes to gain a better understanding through asking questions * Beth Bacon - middle of the road level of experience. Previous position was US government so some familiarity with how colleagues used RDS data for these purposes, now experience from a registry perspective. * Farell Folly - more than 5 years of experience in regulatory (government) are especially in mobile telecommunications and Internet Service providers, but not especially with domain names. * Krishna Seeburn - has been part of the regulatory body, also worked with policy and LE in certain situations. Not a practicing lawyer, but good insight into what is being discussed. * Steve Metalitz - lawyer in private practice, has counseled clients involved in the scenarios outlined in the paper (contract compliance). Some direct experience and general experience in the regulatory environment. * Theo Geurts - as a registrar a lot of experience dealing with LE, IP as well as government. Been doing this since 2009 and responsible for the abuse team. 4. Introduce EWG's definition of this purpose as a starting point for discussion (see both EWG Report excerpts on page 2 of template) * See template for EWG definition and example use cases. DT may decide to use this as a starting point if deemed helpful, but no obligation to do so. * Current description is very broad, more focused on use cases. Is objective to craft a purpose statement that could be used to share with DPAs in the context of data protection legislation? Important not to get hung up on the term 'definition' for now. * Recent work on users may help inform this, namely dataflow matrix that was created as part of the small group working on GDPR issues: https://www.icann.org/resources/pages/gtld-registration-dataflow-matrix-2017... * Use case developed by RDS PDP WG may also assist in this regard (see https://community.icann.org/download/attachments/60493753/14-WHOIS%20queries... <https://community.icann.org/download/attachments/60493753/14-WHOIS%20queries...> &modificationDate=1470109106000&api=v2). In addition, EWG report identified a number of use cases for this purpose. 5. Initial Discussion a. Q&A between members less familiar with this purpose and those who have direct experience with it * Would be helpful to briefly describe tasks involved in this purpose? Who has been asked for what, in what context? b. Team members more familiar with this purpose to give real-world examples of this purpose drawn from their own experiences * UDRP - pretty straightforward process: registrar gets inquiry from UDRP provider, who is registrant, when was last update, etc. Info sent back to UDRP provider, following which procedure starts. Sometimes info is masked as a result of P/P services - requires review of conditions to see if unmasking is allowed. If info is not unmasked, P/P provider will be named as defendant. Some registrars will provide information to UDRP provider but will not reveal the info in WHOIS (depends on terms and conditions of P/P). The UDRP provider will look at publicly available WHOIS to send the necessary materials to registrant - even though info may not always be actionable. UDRP provider uses WHOIS info to be able to start their proceedings. The UDRP rules require the UDRP provider to send a "verification request" to registrar. UDRP provider also uses Whois data directly to send notice of the complaint to the respondent. * Intellectual property owner who identifies a site potentially infringing IP. Needs to be able to assess whether the registrant has authorisation/license to use IP. Contract enforcement issue - need to find out whether the person using IP has the right to do so. If not, it would involve next steps, for example getting ICANN compliance involved to enforce legal obligations. Would first go to WHOIS info to find a possible answer, even if info is not actionable (for example, in case of P/P). Would also include a WHOIS lookup to try and identify hosting party. * Contractual compliance - WHOIS accuracy - contractual obligation by registrars to correct info within a certain timeframe following receipt of WHOIS accuracy complaint. Received from all kinds of sources: registrants, ICANN compliance, third parties. * Registration data escrow audits - registrars need to ensure that registrant data is escrowed to an escrow provider to make sure that should a registrar go out of business, ICANN can get hold of registrant data to be able to provide continuity of service. Compliance audits are in place to ensure that data is available, complete, accurate. * Audits also in place to check how processes are applied that involve, amongst others, RDS info such as sending of FOA, transfers, etc. Action item #1: DT members to dedicate time over the course of next week to this topic and encouraged to share perspectives on the mailing list. c. Identify & discuss issues where more understanding is needed 6. Assign responsibilities for creating first drafts a. Task i: b. Task ii c. Task iii * Consider having one person doing task i, ii and iii for the different use cases. * Consider using google doc so that others can add / edit as appropriate. * Steve Metalitz: Intellectual Property owners. (Steve to send to the mailing list, Beth to turn it into a google doc). Action item #2: DT members to share first draft by end of day on Thursday 19 October. 7. Next steps and action items a. List discussion on agenda item 5.c. (Chuck will initiate this after call.) b. Volunteers for agenda items 6.a, 6.b & 6.c will submit their first drafts to the list and initiate list discussion not later than Friday, October 20 8. Next teleconference call(s) a. Suggestions: i. Next call on Monday October 23 or Tuesday October 24 ii. Third call early on Thursday October 26 if needed to finalize deliverable b. Chuck will request a Doodle Poll for the following days: i. Monday October 23 ii. Tuesday October 24 iii. Thursday October 26 Action item #3: Staff to circulate doodle poll to schedule next meeting on Monday or Tuesday next week. Doodle poll would also include possible third meeting on Thursday 26 October - but if work is completed by that date, it would be cancelled. Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings@icann.org <mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses <http://learn.icann.org/courses/gnso> and visiting the GNSO Newcomer pages <http://gnso.icann.org/sites/gnso.icann.org/files/gnso/presentations/policy-e...> .
Dear All, As I cannot edit the google doc (it is in view-only mode for me), I attached my inputs for each othe first three questions. Have a nice night. Le ven. 20 oct. 2017 à 20:13, Chuck <consult@cgomes.com> a écrit :
Thanks Beth. If anyone has difficulty using the Google Doc, please communicate your input on the list and other can incorporate it.
Chuck
*From:* Beth Bacon [mailto:bbacon@pir.org] *Sent:* Friday, October 20, 2017 10:30 AM *To:* Chuck <consult@cgomes.com>; 'Metalitz, Steven' <met@msk.com>; 'Marika Konings' <marika.konings@icann.org>; gnso-rds-pdp-5@icann.org *Subject:* RE: [Gnso-rds-pdp-5] Notes and action items from today's DT5 meeting
Hi folks,
I’ve gone ahead and pasted Steve’s document into a google doc here: https://docs.google.com/document/d/1NvoYYmMsjqgt48mAYt5nCr8uPk-E-2IngGt50wDk....
I know some have issues using or accessing google docs but hopefully for our small group with a quick turnaround this will help us compile a document more simply.
Thanks, Beth
*From:* gnso-rds-pdp-5-bounces@icann.org [ mailto:gnso-rds-pdp-5-bounces@icann.org <gnso-rds-pdp-5-bounces@icann.org>] *On Behalf Of *Chuck *Sent:* Friday, October 20, 2017 10:14 AM *To:* 'Metalitz, Steven' <met@msk.com>; 'Marika Konings' < marika.konings@icann.org>; gnso-rds-pdp-5@icann.org *Subject:* Re: [Gnso-rds-pdp-5] Notes and action items from today's DT5 meeting *Importance:* High
Thank you very much Steve.
All, please review Steve’s first draft and do one or both of the following today and over the weekend:
- Comment and ask questions on this list - Suggest edits and/or insert comments in the Word version using the redline function and send a new version to this list
Beth – if you want to put this into a Google doc, please feel free to do so.
If everyone contributes to this starting today and over the weekend, we should have a reasonably good draft before our meeting on Monday.
Chuck
*From:* gnso-rds-pdp-5-bounces@icann.org [ mailto:gnso-rds-pdp-5-bounces@icann.org <gnso-rds-pdp-5-bounces@icann.org>] *On Behalf Of *Metalitz, Steven *Sent:* Friday, October 20, 2017 6:48 AM *To:* 'Marika Konings' <marika.konings@icann.org>; gnso-rds-pdp-5@icann.org *Subject:* Re: [Gnso-rds-pdp-5] Notes and action items from today's DT5 meeting
Fellow subteam 5 members,
Attached please find my draft on tasks i, ii and iii from the intellectual property owner perspective. Welcome your feedback/questions. (Apologies I did not note that the circulation deadline was accelerated from today to end of day yesterday.)
I view this as supplementing the similar summaries for each of the other use cases identified --- the due diligence on an online merchant use case put forward by Terri Stumme, and the use cases for online tax investigation, UDRP proceedings, and RDS ecosystem contractual compliance (including data escrow audits) identified in the EWG report. The first of these could readily be extracted from Terri’s submission, and I imagine that either or both of the registry/registrar compliance specialists on our subteam could easily prepare the last two.
Steve Metalitz
[image: image001.gif]
*Steven J. Metalitz *| *Partner, through his professional corporation*
T: 202.355.7902 <(202)%20355-7902> | met@msk.com
*Mitchell Silberberg & Knupp* *LLP* | *www.msk.com <http://www.msk.com/>*
1818 N Street NW, 8th Floor, Washington, DC 20036
*THE INFORMATION CONTAINED IN THIS E-MAIL MESSAGE IS INTENDED ONLY FOR THE PERSONAL AND CONFIDENTIAL USE OF THE DESIGNATED RECIPIENTS.** THIS MESSAGE MAY BE AN ATTORNEY-CLIENT COMMUNICATION, AND AS SUCH IS PRIVILEGED AND CONFIDENTIAL. IF THE READER OF THIS MESSAGE IS NOT AN INTENDED RECIPIENT, YOU ARE HEREBY NOTIFIED THAT ANY REVIEW, USE, DISSEMINATION, FORWARDING OR COPYING OF THIS MESSAGE IS STRICTLY PROHIBITED. PLEASE NOTIFY US IMMEDIATELY BY REPLY E-MAIL OR TELEPHONE, AND DELETE THE ORIGINAL MESSAGE AND ALL ATTACHMENTS FROM YOUR SYSTEM. THANK YOU.*
*From:* gnso-rds-pdp-5-bounces@icann.org [ mailto:gnso-rds-pdp-5-bounces@icann.org <gnso-rds-pdp-5-bounces@icann.org>] *On Behalf Of *Marika Konings *Sent:* Wednesday, October 18, 2017 10:09 AM *To:* gnso-rds-pdp-5@icann.org *Subject:* [Gnso-rds-pdp-5] Notes and action items from today's DT5 meeting
Dear All,
Please find below the notes & action items from today’s DT5 meeting. Please take particular note of the action items.
Best regards,
Marika
*DT5 - Regulatory or Contractual Enforcement*
*Meeting on 18 October 2017*
1. Welcome & roll call
- Role of coordinator is to co-ordinate & facilitate, for DT members to do the actual work
2. Brief recap of drafting team goals and due date
a. Overall goal: To enable better understanding of the Regulatory or Contractual Enforcement purpose for Whois data, first in DT5 and then in the full RDS PDP WG.
- See also the template that has been circulated. - Objective is NOT to determine whether or not this purpose is legitimate, but to ensure understanding of what this purpose entails - Deadline to complete tasks by Thursday 26 October - will require everyone to contribute and participate
b. Tasks
i. List and briefly describe tasks commonly involved in carrying out this purpose.
ii. Describe the parties who often access gTLD registration data in pursuit of Regulatory or Contractual Enforcement purposes
iii. List gTLD registration data often involved in this purpose.
iv. Describe the purpose succinctly in one paragraph
- Who are the parties that request WHOIS data today for Regulatory or Contractual Enforcement purposes? - What role does gTLD registration data play for Regulatory or Contractual Enforcement purposes? - Why is access to Whois data needed to fulfill Regulatory or Contractual Enforcement purposes?
v. Prepare and submit the final deliverable to the full RDS PDP WG not later than Thursday, October 26.
vi. Provide an overview of the final deliverable in the Face-to-Face WG meeting on Saturday, October 28 in Abu Dhabi and interact with WG members in that meeting to answer their questions and help them understand the Regulatory or Contractual Enforcement purpose.
3. All team members to share their level of experience with the regulatory or contractual enforcement purpose
- Bastiaan Goslings - no experience in this area, hopes to gain a better understanding through asking questions - Beth Bacon - middle of the road level of experience. Previous position was US government so some familiarity with how colleagues used RDS data for these purposes, now experience from a registry perspective. - Farell Folly - more than 5 years of experience in regulatory (government) are especially in mobile telecommunications and Internet Service providers, but not especially with domain names. - Krishna Seeburn - has been part of the regulatory body, also worked with policy and LE in certain situations. Not a practicing lawyer, but good insight into what is being discussed. - Steve Metalitz - lawyer in private practice, has counseled clients involved in the scenarios outlined in the paper (contract compliance). Some direct experience and general experience in the regulatory environment. - Theo Geurts - as a registrar a lot of experience dealing with LE, IP as well as government. Been doing this since 2009 and responsible for the abuse team.
4. Introduce EWG's definition of this purpose as a starting point for discussion (see both EWG Report excerpts on page 2 of template)
- See template for EWG definition and example use cases. DT may decide to use this as a starting point if deemed helpful, but no obligation to do so. - Current description is very broad, more focused on use cases. Is objective to craft a purpose statement that could be used to share with DPAs in the context of data protection legislation? Important not to get hung up on the term 'definition' for now. - Recent work on users may help inform this, namely dataflow matrix that was created as part of the small group working on GDPR issues: https://www.icann.org/resources/pages/gtld-registration-dataflow-matrix-2017... - Use case developed by RDS PDP WG may also assist in this regard (see https://community.icann.org/download/attachments/60493753/14-WHOIS%20queries...). In addition, EWG report identified a number of use cases for this purpose.
5. Initial Discussion
a. Q&A between members less familiar with this purpose and those who have direct experience with it
- Would be helpful to briefly describe tasks involved in this purpose? Who has been asked for what, in what context?
b. Team members more familiar with this purpose to give real-world examples of this purpose drawn from their own experiences
- UDRP - pretty straightforward process: registrar gets inquiry from UDRP provider, who is registrant, when was last update, etc. Info sent back to UDRP provider, following which procedure starts. Sometimes info is masked as a result of P/P services - requires review of conditions to see if unmasking is allowed. If info is not unmasked, P/P provider will be named as defendant. Some registrars will provide information to UDRP provider but will not reveal the info in WHOIS (depends on terms and conditions of P/P). The UDRP provider will look at publicly available WHOIS to send the necessary materials to registrant - even though info may not always be actionable. UDRP provider uses WHOIS info to be able to start their proceedings. The UDRP rules require the UDRP provider to send a "verification request" to registrar. UDRP provider also uses Whois data directly to send notice of the complaint to the respondent. - Intellectual property owner who identifies a site potentially infringing IP. Needs to be able to assess whether the registrant has authorisation/license to use IP. Contract enforcement issue - need to find out whether the person using IP has the right to do so. If not, it would involve next steps, for example getting ICANN compliance involved to enforce legal obligations. Would first go to WHOIS info to find a possible answer, even if info is not actionable (for example, in case of P/P). Would also include a WHOIS lookup to try and identify hosting party. - Contractual compliance - WHOIS accuracy - contractual obligation by registrars to correct info within a certain timeframe following receipt of WHOIS accuracy complaint. Received from all kinds of sources: registrants, ICANN compliance, third parties. - Registration data escrow audits - registrars need to ensure that registrant data is escrowed to an escrow provider to make sure that should a registrar go out of business, ICANN can get hold of registrant data to be able to provide continuity of service. Compliance audits are in place to ensure that data is available, complete, accurate. - Audits also in place to check how processes are applied that involve, amongst others, RDS info such as sending of FOA, transfers, etc.
*Action item #1*: DT members to dedicate time over the course of next week to this topic and encouraged to share perspectives on the mailing list.
c. Identify & discuss issues where more understanding is needed
6. Assign responsibilities for creating first drafts
a. Task i:
b. Task ii
c. Task iii
- Consider having one person doing task i, ii and iii for the different use cases. - Consider using google doc so that others can add / edit as appropriate. - Steve Metalitz: Intellectual Property owners. (Steve to send to the mailing list, Beth to turn it into a google doc).
*Action item #2*: DT members to share first draft by end of day on Thursday 19 October.
7. Next steps and action items
a. List discussion on agenda item 5.c. (Chuck will initiate this after call.)
b. Volunteers for agenda items 6.a, 6.b & 6.c will submit their first drafts to the list and initiate list discussion not later than Friday, October 20
8. Next teleconference call(s)
a. Suggestions:
i. Next call on Monday October 23 or Tuesday October 24
ii. Third call early on Thursday October 26 if needed to finalize deliverable
b. Chuck will request a Doodle Poll for the following days:
i. Monday October 23
ii. Tuesday October 24
iii. Thursday October 26
*Action item #3*: Staff to circulate doodle poll to schedule next meeting on Monday or Tuesday next week. Doodle poll would also include possible third meeting on Thursday 26 October - but if work is completed by that date, it would be cancelled.
*Marika Konings*
*Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) *
*Email: marika.konings@icann.org <marika.konings@icann.org> *
*Follow the GNSO via Twitter @ICANN_GNSO*
*Find out more about the GNSO by taking our interactive courses <http://learn.icann.org/courses/gnso> and visiting the GNSO Newcomer pages <http://gnso.icann.org/sites/gnso.icann.org/files/gnso/presentations/policy-e...>. *
_______________________________________________ Gnso-rds-pdp-5 mailing list Gnso-rds-pdp-5@icann.org https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-5
-- Regards @__f_f__ https://www.linkedin.com/in/farellf
Beth, Is it possible for you to input Farell’s input into the Google Doc and send a version to this list for posting in Adobe in our DT5 meeting tomorrow? Chuck From: Farell Folly [mailto:farellfolly@gmail.com] Sent: Saturday, October 21, 2017 3:28 PM To: Chuck <consult@cgomes.com> Cc: Beth Bacon <bbacon@pir.org>; Metalitz, Steven <met@msk.com>; Marika Konings <marika.konings@icann.org>; gnso-rds-pdp-5@icann.org Subject: Re: [Gnso-rds-pdp-5] Notes and action items from today's DT5 meeting Dear All, As I cannot edit the google doc (it is in view-only mode for me), I attached my inputs for each othe first three questions. Have a nice night. Le ven. 20 oct. 2017 à 20:13, Chuck <consult@cgomes.com <mailto:consult@cgomes.com> > a écrit : Thanks Beth. If anyone has difficulty using the Google Doc, please communicate your input on the list and other can incorporate it. Chuck From: Beth Bacon [mailto:bbacon@pir.org <mailto:bbacon@pir.org> ] Sent: Friday, October 20, 2017 10:30 AM To: Chuck <consult@cgomes.com <mailto:consult@cgomes.com> >; 'Metalitz, Steven' <met@msk.com <mailto:met@msk.com> >; 'Marika Konings' <marika.konings@icann.org <mailto:marika.konings@icann.org> >; gnso-rds-pdp-5@icann.org <mailto:gnso-rds-pdp-5@icann.org> Subject: RE: [Gnso-rds-pdp-5] Notes and action items from today's DT5 meeting Hi folks, I’ve gone ahead and pasted Steve’s document into a google doc here: https://docs.google.com/document/d/1NvoYYmMsjqgt48mAYt5nCr8uPk-E-2IngGt50wDk.... I know some have issues using or accessing google docs but hopefully for our small group with a quick turnaround this will help us compile a document more simply. Thanks, Beth From: gnso-rds-pdp-5-bounces@icann.org <mailto:gnso-rds-pdp-5-bounces@icann.org> [mailto:gnso-rds-pdp-5-bounces@icann.org] On Behalf Of Chuck Sent: Friday, October 20, 2017 10:14 AM To: 'Metalitz, Steven' <met@msk.com <mailto:met@msk.com> >; 'Marika Konings' <marika.konings@icann.org <mailto:marika.konings@icann.org> >; gnso-rds-pdp-5@icann.org <mailto:gnso-rds-pdp-5@icann.org> Subject: Re: [Gnso-rds-pdp-5] Notes and action items from today's DT5 meeting Importance: High Thank you very much Steve. All, please review Steve’s first draft and do one or both of the following today and over the weekend: * Comment and ask questions on this list * Suggest edits and/or insert comments in the Word version using the redline function and send a new version to this list Beth – if you want to put this into a Google doc, please feel free to do so. If everyone contributes to this starting today and over the weekend, we should have a reasonably good draft before our meeting on Monday. Chuck From: gnso-rds-pdp-5-bounces@icann.org <mailto:gnso-rds-pdp-5-bounces@icann.org> [mailto:gnso-rds-pdp-5-bounces@icann.org] On Behalf Of Metalitz, Steven Sent: Friday, October 20, 2017 6:48 AM To: 'Marika Konings' <marika.konings@icann.org <mailto:marika.konings@icann.org> >; gnso-rds-pdp-5@icann.org <mailto:gnso-rds-pdp-5@icann.org> Subject: Re: [Gnso-rds-pdp-5] Notes and action items from today's DT5 meeting Fellow subteam 5 members, Attached please find my draft on tasks i, ii and iii from the intellectual property owner perspective. Welcome your feedback/questions. (Apologies I did not note that the circulation deadline was accelerated from today to end of day yesterday.) I view this as supplementing the similar summaries for each of the other use cases identified --- the due diligence on an online merchant use case put forward by Terri Stumme, and the use cases for online tax investigation, UDRP proceedings, and RDS ecosystem contractual compliance (including data escrow audits) identified in the EWG report. The first of these could readily be extracted from Terri’s submission, and I imagine that either or both of the registry/registrar compliance specialists on our subteam could easily prepare the last two. Steve Metalitz Steven J. Metalitz | Partner, through his professional corporation T: 202.355.7902 <tel:(202)%20355-7902> | <mailto:met@msk.com> met@msk.com Mitchell Silberberg & Knupp LLP | <http://www.msk.com/> www.msk.com 1818 N Street NW, 8th Floor, Washington, DC 20036 THE INFORMATION CONTAINED IN THIS E-MAIL MESSAGE IS INTENDED ONLY FOR THE PERSONAL AND CONFIDENTIAL USE OF THE DESIGNATED RECIPIENTS. THIS MESSAGE MAY BE AN ATTORNEY-CLIENT COMMUNICATION, AND AS SUCH IS PRIVILEGED AND CONFIDENTIAL. IF THE READER OF THIS MESSAGE IS NOT AN INTENDED RECIPIENT, YOU ARE HEREBY NOTIFIED THAT ANY REVIEW, USE, DISSEMINATION, FORWARDING OR COPYING OF THIS MESSAGE IS STRICTLY PROHIBITED. PLEASE NOTIFY US IMMEDIATELY BY REPLY E-MAIL OR TELEPHONE, AND DELETE THE ORIGINAL MESSAGE AND ALL ATTACHMENTS FROM YOUR SYSTEM. THANK YOU. From: gnso-rds-pdp-5-bounces@icann.org <mailto:gnso-rds-pdp-5-bounces@icann.org> [mailto:gnso-rds-pdp-5-bounces@icann.org] On Behalf Of Marika Konings Sent: Wednesday, October 18, 2017 10:09 AM To: gnso-rds-pdp-5@icann.org <mailto:gnso-rds-pdp-5@icann.org> Subject: [Gnso-rds-pdp-5] Notes and action items from today's DT5 meeting Dear All, Please find below the notes & action items from today’s DT5 meeting. Please take particular note of the action items. Best regards, Marika DT5 - Regulatory or Contractual Enforcement Meeting on 18 October 2017 1. Welcome & roll call * Role of coordinator is to co-ordinate & facilitate, for DT members to do the actual work 2. Brief recap of drafting team goals and due date a. Overall goal: To enable better understanding of the Regulatory or Contractual Enforcement purpose for Whois data, first in DT5 and then in the full RDS PDP WG. * See also the template that has been circulated. * Objective is NOT to determine whether or not this purpose is legitimate, but to ensure understanding of what this purpose entails * Deadline to complete tasks by Thursday 26 October - will require everyone to contribute and participate b. Tasks i. List and briefly describe tasks commonly involved in carrying out this purpose. ii. Describe the parties who often access gTLD registration data in pursuit of Regulatory or Contractual Enforcement purposes iii. List gTLD registration data often involved in this purpose. iv. Describe the purpose succinctly in one paragraph * Who are the parties that request WHOIS data today for Regulatory or Contractual Enforcement purposes? * What role does gTLD registration data play for Regulatory or Contractual Enforcement purposes? * Why is access to Whois data needed to fulfill Regulatory or Contractual Enforcement purposes? v. Prepare and submit the final deliverable to the full RDS PDP WG not later than Thursday, October 26. vi. Provide an overview of the final deliverable in the Face-to-Face WG meeting on Saturday, October 28 in Abu Dhabi and interact with WG members in that meeting to answer their questions and help them understand the Regulatory or Contractual Enforcement purpose. 3. All team members to share their level of experience with the regulatory or contractual enforcement purpose * Bastiaan Goslings - no experience in this area, hopes to gain a better understanding through asking questions * Beth Bacon - middle of the road level of experience. Previous position was US government so some familiarity with how colleagues used RDS data for these purposes, now experience from a registry perspective. * Farell Folly - more than 5 years of experience in regulatory (government) are especially in mobile telecommunications and Internet Service providers, but not especially with domain names. * Krishna Seeburn - has been part of the regulatory body, also worked with policy and LE in certain situations. Not a practicing lawyer, but good insight into what is being discussed. * Steve Metalitz - lawyer in private practice, has counseled clients involved in the scenarios outlined in the paper (contract compliance). Some direct experience and general experience in the regulatory environment. * Theo Geurts - as a registrar a lot of experience dealing with LE, IP as well as government. Been doing this since 2009 and responsible for the abuse team. 4. Introduce EWG's definition of this purpose as a starting point for discussion (see both EWG Report excerpts on page 2 of template) * See template for EWG definition and example use cases. DT may decide to use this as a starting point if deemed helpful, but no obligation to do so. * Current description is very broad, more focused on use cases. Is objective to craft a purpose statement that could be used to share with DPAs in the context of data protection legislation? Important not to get hung up on the term 'definition' for now. * Recent work on users may help inform this, namely dataflow matrix that was created as part of the small group working on GDPR issues: https://www.icann.org/resources/pages/gtld-registration-dataflow-matrix-2017... * Use case developed by RDS PDP WG may also assist in this regard (see https://community.icann.org/download/attachments/60493753/14-WHOIS%20queries... <https://community.icann.org/download/attachments/60493753/14-WHOIS%20queries...> &modificationDate=1470109106000&api=v2). In addition, EWG report identified a number of use cases for this purpose. 5. Initial Discussion a. Q&A between members less familiar with this purpose and those who have direct experience with it * Would be helpful to briefly describe tasks involved in this purpose? Who has been asked for what, in what context? b. Team members more familiar with this purpose to give real-world examples of this purpose drawn from their own experiences * UDRP - pretty straightforward process: registrar gets inquiry from UDRP provider, who is registrant, when was last update, etc. Info sent back to UDRP provider, following which procedure starts. Sometimes info is masked as a result of P/P services - requires review of conditions to see if unmasking is allowed. If info is not unmasked, P/P provider will be named as defendant. Some registrars will provide information to UDRP provider but will not reveal the info in WHOIS (depends on terms and conditions of P/P). The UDRP provider will look at publicly available WHOIS to send the necessary materials to registrant - even though info may not always be actionable. UDRP provider uses WHOIS info to be able to start their proceedings. The UDRP rules require the UDRP provider to send a "verification request" to registrar. UDRP provider also uses Whois data directly to send notice of the complaint to the respondent. * Intellectual property owner who identifies a site potentially infringing IP. Needs to be able to assess whether the registrant has authorisation/license to use IP. Contract enforcement issue - need to find out whether the person using IP has the right to do so. If not, it would involve next steps, for example getting ICANN compliance involved to enforce legal obligations. Would first go to WHOIS info to find a possible answer, even if info is not actionable (for example, in case of P/P). Would also include a WHOIS lookup to try and identify hosting party. * Contractual compliance - WHOIS accuracy - contractual obligation by registrars to correct info within a certain timeframe following receipt of WHOIS accuracy complaint. Received from all kinds of sources: registrants, ICANN compliance, third parties. * Registration data escrow audits - registrars need to ensure that registrant data is escrowed to an escrow provider to make sure that should a registrar go out of business, ICANN can get hold of registrant data to be able to provide continuity of service. Compliance audits are in place to ensure that data is available, complete, accurate. * Audits also in place to check how processes are applied that involve, amongst others, RDS info such as sending of FOA, transfers, etc. Action item #1: DT members to dedicate time over the course of next week to this topic and encouraged to share perspectives on the mailing list. c. Identify & discuss issues where more understanding is needed 6. Assign responsibilities for creating first drafts a. Task i: b. Task ii c. Task iii * Consider having one person doing task i, ii and iii for the different use cases. * Consider using google doc so that others can add / edit as appropriate. * Steve Metalitz: Intellectual Property owners. (Steve to send to the mailing list, Beth to turn it into a google doc). Action item #2: DT members to share first draft by end of day on Thursday 19 October. 7. Next steps and action items a. List discussion on agenda item 5.c. (Chuck will initiate this after call.) b. Volunteers for agenda items 6.a, 6.b & 6.c will submit their first drafts to the list and initiate list discussion not later than Friday, October 20 8. Next teleconference call(s) a. Suggestions: i. Next call on Monday October 23 or Tuesday October 24 ii. Third call early on Thursday October 26 if needed to finalize deliverable b. Chuck will request a Doodle Poll for the following days: i. Monday October 23 ii. Tuesday October 24 iii. Thursday October 26 Action item #3: Staff to circulate doodle poll to schedule next meeting on Monday or Tuesday next week. Doodle poll would also include possible third meeting on Thursday 26 October - but if work is completed by that date, it would be cancelled. Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings@icann.org <mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses <http://learn.icann.org/courses/gnso> and visiting the GNSO Newcomer pages <http://gnso.icann.org/sites/gnso.icann.org/files/gnso/presentations/policy-e...> . _______________________________________________ Gnso-rds-pdp-5 mailing list Gnso-rds-pdp-5@icann.org <mailto:Gnso-rds-pdp-5@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-5 -- Regards @__f_f__ https://www.linkedin.com/in/farellf
Hi Chuck, Theo very kindly put Farell’s edits into the doc. I also added a few use cases. The current draft is attached as pdf and the google doc is still open for review tomorrow. Hope everyone had a great weekend. Best, Beth https://docs.google.com/document/d/1NvoYYmMsjqgt48mAYt5nCr8uPk-E-2IngGt50wDk... From: consult@cgomes.com [mailto:consult@cgomes.com] Sent: Sunday, October 22, 2017 5:15 PM To: Beth Bacon <bbacon@pir.org> Cc: gnso-rds-pdp-5@icann.org Subject: FW: [Gnso-rds-pdp-5] Notes and action items from today's DT5 meeting Importance: High Beth, Is it possible for you to input Farell’s input into the Google Doc and send a version to this list for posting in Adobe in our DT5 meeting tomorrow? Chuck From: Farell Folly [mailto:farellfolly@gmail.com] Sent: Saturday, October 21, 2017 3:28 PM To: Chuck <consult@cgomes.com<mailto:consult@cgomes.com>> Cc: Beth Bacon <bbacon@pir.org<mailto:bbacon@pir.org>>; Metalitz, Steven <met@msk.com<mailto:met@msk.com>>; Marika Konings <marika.konings@icann.org<mailto:marika.konings@icann.org>>; gnso-rds-pdp-5@icann.org<mailto:gnso-rds-pdp-5@icann.org> Subject: Re: [Gnso-rds-pdp-5] Notes and action items from today's DT5 meeting Dear All, As I cannot edit the google doc (it is in view-only mode for me), I attached my inputs for each othe first three questions. Have a nice night. Le ven. 20 oct. 2017 à 20:13, Chuck <consult@cgomes.com<mailto:consult@cgomes.com>> a écrit : Thanks Beth. If anyone has difficulty using the Google Doc, please communicate your input on the list and other can incorporate it. Chuck From: Beth Bacon [mailto:bbacon@pir.org<mailto:bbacon@pir.org>] Sent: Friday, October 20, 2017 10:30 AM To: Chuck <consult@cgomes.com<mailto:consult@cgomes.com>>; 'Metalitz, Steven' <met@msk.com<mailto:met@msk.com>>; 'Marika Konings' <marika.konings@icann.org<mailto:marika.konings@icann.org>>; gnso-rds-pdp-5@icann.org<mailto:gnso-rds-pdp-5@icann.org> Subject: RE: [Gnso-rds-pdp-5] Notes and action items from today's DT5 meeting Hi folks, I’ve gone ahead and pasted Steve’s document into a google doc here: https://docs.google.com/document/d/1NvoYYmMsjqgt48mAYt5nCr8uPk-E-2IngGt50wDk.... I know some have issues using or accessing google docs but hopefully for our small group with a quick turnaround this will help us compile a document more simply. Thanks, Beth From: gnso-rds-pdp-5-bounces@icann.org<mailto:gnso-rds-pdp-5-bounces@icann.org> [mailto:gnso-rds-pdp-5-bounces@icann.org] On Behalf Of Chuck Sent: Friday, October 20, 2017 10:14 AM To: 'Metalitz, Steven' <met@msk.com<mailto:met@msk.com>>; 'Marika Konings' <marika.konings@icann.org<mailto:marika.konings@icann.org>>; gnso-rds-pdp-5@icann.org<mailto:gnso-rds-pdp-5@icann.org> Subject: Re: [Gnso-rds-pdp-5] Notes and action items from today's DT5 meeting Importance: High Thank you very much Steve. All, please review Steve’s first draft and do one or both of the following today and over the weekend: * Comment and ask questions on this list * Suggest edits and/or insert comments in the Word version using the redline function and send a new version to this list Beth – if you want to put this into a Google doc, please feel free to do so. If everyone contributes to this starting today and over the weekend, we should have a reasonably good draft before our meeting on Monday. Chuck From: gnso-rds-pdp-5-bounces@icann.org<mailto:gnso-rds-pdp-5-bounces@icann.org> [mailto:gnso-rds-pdp-5-bounces@icann.org] On Behalf Of Metalitz, Steven Sent: Friday, October 20, 2017 6:48 AM To: 'Marika Konings' <marika.konings@icann.org<mailto:marika.konings@icann.org>>; gnso-rds-pdp-5@icann.org<mailto:gnso-rds-pdp-5@icann.org> Subject: Re: [Gnso-rds-pdp-5] Notes and action items from today's DT5 meeting Fellow subteam 5 members, Attached please find my draft on tasks i, ii and iii from the intellectual property owner perspective. Welcome your feedback/questions. (Apologies I did not note that the circulation deadline was accelerated from today to end of day yesterday.) I view this as supplementing the similar summaries for each of the other use cases identified --- the due diligence on an online merchant use case put forward by Terri Stumme, and the use cases for online tax investigation, UDRP proceedings, and RDS ecosystem contractual compliance (including data escrow audits) identified in the EWG report. The first of these could readily be extracted from Terri’s submission, and I imagine that either or both of the registry/registrar compliance specialists on our subteam could easily prepare the last two. Steve Metalitz [image001.gif] Steven J. Metalitz | Partner, through his professional corporation T: 202.355.7902<tel:(202)%20355-7902> | met@msk.com<mailto:met@msk.com> Mitchell Silberberg & Knupp LLP | www.msk.com<http://www.msk.com/> 1818 N Street NW, 8th Floor, Washington, DC 20036 THE INFORMATION CONTAINED IN THIS E-MAIL MESSAGE IS INTENDED ONLY FOR THE PERSONAL AND CONFIDENTIAL USE OF THE DESIGNATED RECIPIENTS. THIS MESSAGE MAY BE AN ATTORNEY-CLIENT COMMUNICATION, AND AS SUCH IS PRIVILEGED AND CONFIDENTIAL. IF THE READER OF THIS MESSAGE IS NOT AN INTENDED RECIPIENT, YOU ARE HEREBY NOTIFIED THAT ANY REVIEW, USE, DISSEMINATION, FORWARDING OR COPYING OF THIS MESSAGE IS STRICTLY PROHIBITED. PLEASE NOTIFY US IMMEDIATELY BY REPLY E-MAIL OR TELEPHONE, AND DELETE THE ORIGINAL MESSAGE AND ALL ATTACHMENTS FROM YOUR SYSTEM. THANK YOU. From: gnso-rds-pdp-5-bounces@icann.org<mailto:gnso-rds-pdp-5-bounces@icann.org> [mailto:gnso-rds-pdp-5-bounces@icann.org] On Behalf Of Marika Konings Sent: Wednesday, October 18, 2017 10:09 AM To: gnso-rds-pdp-5@icann.org<mailto:gnso-rds-pdp-5@icann.org> Subject: [Gnso-rds-pdp-5] Notes and action items from today's DT5 meeting Dear All, Please find below the notes & action items from today’s DT5 meeting. Please take particular note of the action items. Best regards, Marika DT5 - Regulatory or Contractual Enforcement Meeting on 18 October 2017 1. Welcome & roll call * Role of coordinator is to co-ordinate & facilitate, for DT members to do the actual work 2. Brief recap of drafting team goals and due date a. Overall goal: To enable better understanding of the Regulatory or Contractual Enforcement purpose for Whois data, first in DT5 and then in the full RDS PDP WG. * See also the template that has been circulated. * Objective is NOT to determine whether or not this purpose is legitimate, but to ensure understanding of what this purpose entails * Deadline to complete tasks by Thursday 26 October - will require everyone to contribute and participate b. Tasks i. List and briefly describe tasks commonly involved in carrying out this purpose. ii. Describe the parties who often access gTLD registration data in pursuit of Regulatory or Contractual Enforcement purposes iii. List gTLD registration data often involved in this purpose. iv. Describe the purpose succinctly in one paragraph * Who are the parties that request WHOIS data today for Regulatory or Contractual Enforcement purposes? * What role does gTLD registration data play for Regulatory or Contractual Enforcement purposes? * Why is access to Whois data needed to fulfill Regulatory or Contractual Enforcement purposes? v. Prepare and submit the final deliverable to the full RDS PDP WG not later than Thursday, October 26. vi. Provide an overview of the final deliverable in the Face-to-Face WG meeting on Saturday, October 28 in Abu Dhabi and interact with WG members in that meeting to answer their questions and help them understand the Regulatory or Contractual Enforcement purpose. 3. All team members to share their level of experience with the regulatory or contractual enforcement purpose * Bastiaan Goslings - no experience in this area, hopes to gain a better understanding through asking questions * Beth Bacon - middle of the road level of experience. Previous position was US government so some familiarity with how colleagues used RDS data for these purposes, now experience from a registry perspective. * Farell Folly - more than 5 years of experience in regulatory (government) are especially in mobile telecommunications and Internet Service providers, but not especially with domain names. * Krishna Seeburn - has been part of the regulatory body, also worked with policy and LE in certain situations. Not a practicing lawyer, but good insight into what is being discussed. * Steve Metalitz - lawyer in private practice, has counseled clients involved in the scenarios outlined in the paper (contract compliance). Some direct experience and general experience in the regulatory environment. * Theo Geurts - as a registrar a lot of experience dealing with LE, IP as well as government. Been doing this since 2009 and responsible for the abuse team. 4. Introduce EWG's definition of this purpose as a starting point for discussion (see both EWG Report excerpts on page 2 of template) * See template for EWG definition and example use cases. DT may decide to use this as a starting point if deemed helpful, but no obligation to do so. * Current description is very broad, more focused on use cases. Is objective to craft a purpose statement that could be used to share with DPAs in the context of data protection legislation? Important not to get hung up on the term 'definition' for now. * Recent work on users may help inform this, namely dataflow matrix that was created as part of the small group working on GDPR issues: https://www.icann.org/resources/pages/gtld-registration-dataflow-matrix-2017... * Use case developed by RDS PDP WG may also assist in this regard (see https://community.icann.org/download/attachments/60493753/14-WHOIS%20queries...). In addition, EWG report identified a number of use cases for this purpose. 5. Initial Discussion a. Q&A between members less familiar with this purpose and those who have direct experience with it * Would be helpful to briefly describe tasks involved in this purpose? Who has been asked for what, in what context? b. Team members more familiar with this purpose to give real-world examples of this purpose drawn from their own experiences * UDRP - pretty straightforward process: registrar gets inquiry from UDRP provider, who is registrant, when was last update, etc. Info sent back to UDRP provider, following which procedure starts. Sometimes info is masked as a result of P/P services - requires review of conditions to see if unmasking is allowed. If info is not unmasked, P/P provider will be named as defendant. Some registrars will provide information to UDRP provider but will not reveal the info in WHOIS (depends on terms and conditions of P/P). The UDRP provider will look at publicly available WHOIS to send the necessary materials to registrant - even though info may not always be actionable. UDRP provider uses WHOIS info to be able to start their proceedings. The UDRP rules require the UDRP provider to send a "verification request" to registrar. UDRP provider also uses Whois data directly to send notice of the complaint to the respondent. * Intellectual property owner who identifies a site potentially infringing IP. Needs to be able to assess whether the registrant has authorisation/license to use IP. Contract enforcement issue - need to find out whether the person using IP has the right to do so. If not, it would involve next steps, for example getting ICANN compliance involved to enforce legal obligations. Would first go to WHOIS info to find a possible answer, even if info is not actionable (for example, in case of P/P). Would also include a WHOIS lookup to try and identify hosting party. * Contractual compliance - WHOIS accuracy - contractual obligation by registrars to correct info within a certain timeframe following receipt of WHOIS accuracy complaint. Received from all kinds of sources: registrants, ICANN compliance, third parties. * Registration data escrow audits - registrars need to ensure that registrant data is escrowed to an escrow provider to make sure that should a registrar go out of business, ICANN can get hold of registrant data to be able to provide continuity of service. Compliance audits are in place to ensure that data is available, complete, accurate. * Audits also in place to check how processes are applied that involve, amongst others, RDS info such as sending of FOA, transfers, etc. Action item #1: DT members to dedicate time over the course of next week to this topic and encouraged to share perspectives on the mailing list. c. Identify & discuss issues where more understanding is needed 6. Assign responsibilities for creating first drafts a. Task i: b. Task ii c. Task iii * Consider having one person doing task i, ii and iii for the different use cases. * Consider using google doc so that others can add / edit as appropriate. * Steve Metalitz: Intellectual Property owners. (Steve to send to the mailing list, Beth to turn it into a google doc). Action item #2: DT members to share first draft by end of day on Thursday 19 October. 7. Next steps and action items a. List discussion on agenda item 5.c. (Chuck will initiate this after call.) b. Volunteers for agenda items 6.a, 6.b & 6.c will submit their first drafts to the list and initiate list discussion not later than Friday, October 20 8. Next teleconference call(s) a. Suggestions: i. Next call on Monday October 23 or Tuesday October 24 ii. Third call early on Thursday October 26 if needed to finalize deliverable b. Chuck will request a Doodle Poll for the following days: i. Monday October 23 ii. Tuesday October 24 iii. Thursday October 26 Action item #3: Staff to circulate doodle poll to schedule next meeting on Monday or Tuesday next week. Doodle poll would also include possible third meeting on Thursday 26 October - but if work is completed by that date, it would be cancelled. Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings@icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<http://learn.icann.org/courses/gnso> and visiting the GNSO Newcomer pages<http://gnso.icann.org/sites/gnso.icann.org/files/gnso/presentations/policy-e...>. _______________________________________________ Gnso-rds-pdp-5 mailing list Gnso-rds-pdp-5@icann.org<mailto:Gnso-rds-pdp-5@icann.org> https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-5 -- Regards @__f_f__ https://www.linkedin.com/in/farellf
Thanks again Steve for an excellent first draft. As coordinator I am going to leave the content to the rest of you and limit my input to process, so any suggestions I make will relate to the template requirements and things I think will facilitate understanding by all WG members. For task iii (List gTLD registration data often involved in this purpose.), I think it would be helpful to list the data elements that are sometimes used for this purpose. On another note, if anyone would be willing to prepare a first draft of a one paragraph definition of this purpose, that would be helpful. Chuck From: gnso-rds-pdp-5-bounces@icann.org [mailto:gnso-rds-pdp-5-bounces@icann.org] On Behalf Of Metalitz, Steven Sent: Friday, October 20, 2017 6:48 AM To: 'Marika Konings' <marika.konings@icann.org>; gnso-rds-pdp-5@icann.org Subject: Re: [Gnso-rds-pdp-5] Notes and action items from today's DT5 meeting Fellow subteam 5 members, Attached please find my draft on tasks i, ii and iii from the intellectual property owner perspective. Welcome your feedback/questions. (Apologies I did not note that the circulation deadline was accelerated from today to end of day yesterday.) I view this as supplementing the similar summaries for each of the other use cases identified --- the due diligence on an online merchant use case put forward by Terri Stumme, and the use cases for online tax investigation, UDRP proceedings, and RDS ecosystem contractual compliance (including data escrow audits) identified in the EWG report. The first of these could readily be extracted from Terri’s submission, and I imagine that either or both of the registry/registrar compliance specialists on our subteam could easily prepare the last two. Steve Metalitz Steven J. Metalitz | Partner, through his professional corporation T: 202.355.7902 | <mailto:met@msk.com> met@msk.com Mitchell Silberberg & Knupp LLP | <http://www.msk.com/> www.msk.com 1818 N Street NW, 8th Floor, Washington, DC 20036 THE INFORMATION CONTAINED IN THIS E-MAIL MESSAGE IS INTENDED ONLY FOR THE PERSONAL AND CONFIDENTIAL USE OF THE DESIGNATED RECIPIENTS. THIS MESSAGE MAY BE AN ATTORNEY-CLIENT COMMUNICATION, AND AS SUCH IS PRIVILEGED AND CONFIDENTIAL. IF THE READER OF THIS MESSAGE IS NOT AN INTENDED RECIPIENT, YOU ARE HEREBY NOTIFIED THAT ANY REVIEW, USE, DISSEMINATION, FORWARDING OR COPYING OF THIS MESSAGE IS STRICTLY PROHIBITED. PLEASE NOTIFY US IMMEDIATELY BY REPLY E-MAIL OR TELEPHONE, AND DELETE THE ORIGINAL MESSAGE AND ALL ATTACHMENTS FROM YOUR SYSTEM. THANK YOU. From: gnso-rds-pdp-5-bounces@icann.org <mailto:gnso-rds-pdp-5-bounces@icann.org> [mailto:gnso-rds-pdp-5-bounces@icann.org] On Behalf Of Marika Konings Sent: Wednesday, October 18, 2017 10:09 AM To: gnso-rds-pdp-5@icann.org <mailto:gnso-rds-pdp-5@icann.org> Subject: [Gnso-rds-pdp-5] Notes and action items from today's DT5 meeting Dear All, Please find below the notes & action items from today’s DT5 meeting. Please take particular note of the action items. Best regards, Marika DT5 - Regulatory or Contractual Enforcement Meeting on 18 October 2017 1. Welcome & roll call * Role of coordinator is to co-ordinate & facilitate, for DT members to do the actual work 2. Brief recap of drafting team goals and due date a. Overall goal: To enable better understanding of the Regulatory or Contractual Enforcement purpose for Whois data, first in DT5 and then in the full RDS PDP WG. * See also the template that has been circulated. * Objective is NOT to determine whether or not this purpose is legitimate, but to ensure understanding of what this purpose entails * Deadline to complete tasks by Thursday 26 October - will require everyone to contribute and participate b. Tasks i. List and briefly describe tasks commonly involved in carrying out this purpose. ii. Describe the parties who often access gTLD registration data in pursuit of Regulatory or Contractual Enforcement purposes iii. List gTLD registration data often involved in this purpose. iv. Describe the purpose succinctly in one paragraph * Who are the parties that request WHOIS data today for Regulatory or Contractual Enforcement purposes? * What role does gTLD registration data play for Regulatory or Contractual Enforcement purposes? * Why is access to Whois data needed to fulfill Regulatory or Contractual Enforcement purposes? v. Prepare and submit the final deliverable to the full RDS PDP WG not later than Thursday, October 26. vi. Provide an overview of the final deliverable in the Face-to-Face WG meeting on Saturday, October 28 in Abu Dhabi and interact with WG members in that meeting to answer their questions and help them understand the Regulatory or Contractual Enforcement purpose. 3. All team members to share their level of experience with the regulatory or contractual enforcement purpose * Bastiaan Goslings - no experience in this area, hopes to gain a better understanding through asking questions * Beth Bacon - middle of the road level of experience. Previous position was US government so some familiarity with how colleagues used RDS data for these purposes, now experience from a registry perspective. * Farell Folly - more than 5 years of experience in regulatory (government) are especially in mobile telecommunications and Internet Service providers, but not especially with domain names. * Krishna Seeburn - has been part of the regulatory body, also worked with policy and LE in certain situations. Not a practicing lawyer, but good insight into what is being discussed. * Steve Metalitz - lawyer in private practice, has counseled clients involved in the scenarios outlined in the paper (contract compliance). Some direct experience and general experience in the regulatory environment. * Theo Geurts - as a registrar a lot of experience dealing with LE, IP as well as government. Been doing this since 2009 and responsible for the abuse team. 4. Introduce EWG's definition of this purpose as a starting point for discussion (see both EWG Report excerpts on page 2 of template) * See template for EWG definition and example use cases. DT may decide to use this as a starting point if deemed helpful, but no obligation to do so. * Current description is very broad, more focused on use cases. Is objective to craft a purpose statement that could be used to share with DPAs in the context of data protection legislation? Important not to get hung up on the term 'definition' for now. * Recent work on users may help inform this, namely dataflow matrix that was created as part of the small group working on GDPR issues: https://www.icann.org/resources/pages/gtld-registration-dataflow-matrix-2017... * Use case developed by RDS PDP WG may also assist in this regard (see https://community.icann.org/download/attachments/60493753/14-WHOIS%20queries... <https://community.icann.org/download/attachments/60493753/14-WHOIS%20queries...> &modificationDate=1470109106000&api=v2). In addition, EWG report identified a number of use cases for this purpose. 5. Initial Discussion a. Q&A between members less familiar with this purpose and those who have direct experience with it * Would be helpful to briefly describe tasks involved in this purpose? Who has been asked for what, in what context? b. Team members more familiar with this purpose to give real-world examples of this purpose drawn from their own experiences * UDRP - pretty straightforward process: registrar gets inquiry from UDRP provider, who is registrant, when was last update, etc. Info sent back to UDRP provider, following which procedure starts. Sometimes info is masked as a result of P/P services - requires review of conditions to see if unmasking is allowed. If info is not unmasked, P/P provider will be named as defendant. Some registrars will provide information to UDRP provider but will not reveal the info in WHOIS (depends on terms and conditions of P/P). The UDRP provider will look at publicly available WHOIS to send the necessary materials to registrant - even though info may not always be actionable. UDRP provider uses WHOIS info to be able to start their proceedings. The UDRP rules require the UDRP provider to send a "verification request" to registrar. UDRP provider also uses Whois data directly to send notice of the complaint to the respondent. * Intellectual property owner who identifies a site potentially infringing IP. Needs to be able to assess whether the registrant has authorisation/license to use IP. Contract enforcement issue - need to find out whether the person using IP has the right to do so. If not, it would involve next steps, for example getting ICANN compliance involved to enforce legal obligations. Would first go to WHOIS info to find a possible answer, even if info is not actionable (for example, in case of P/P). Would also include a WHOIS lookup to try and identify hosting party. * Contractual compliance - WHOIS accuracy - contractual obligation by registrars to correct info within a certain timeframe following receipt of WHOIS accuracy complaint. Received from all kinds of sources: registrants, ICANN compliance, third parties. * Registration data escrow audits - registrars need to ensure that registrant data is escrowed to an escrow provider to make sure that should a registrar go out of business, ICANN can get hold of registrant data to be able to provide continuity of service. Compliance audits are in place to ensure that data is available, complete, accurate. * Audits also in place to check how processes are applied that involve, amongst others, RDS info such as sending of FOA, transfers, etc. Action item #1: DT members to dedicate time over the course of next week to this topic and encouraged to share perspectives on the mailing list. c. Identify & discuss issues where more understanding is needed 6. Assign responsibilities for creating first drafts a. Task i: b. Task ii c. Task iii * Consider having one person doing task i, ii and iii for the different use cases. * Consider using google doc so that others can add / edit as appropriate. * Steve Metalitz: Intellectual Property owners. (Steve to send to the mailing list, Beth to turn it into a google doc). Action item #2: DT members to share first draft by end of day on Thursday 19 October. 7. Next steps and action items a. List discussion on agenda item 5.c. (Chuck will initiate this after call.) b. Volunteers for agenda items 6.a, 6.b & 6.c will submit their first drafts to the list and initiate list discussion not later than Friday, October 20 8. Next teleconference call(s) a. Suggestions: i. Next call on Monday October 23 or Tuesday October 24 ii. Third call early on Thursday October 26 if needed to finalize deliverable b. Chuck will request a Doodle Poll for the following days: i. Monday October 23 ii. Tuesday October 24 iii. Thursday October 26 Action item #3: Staff to circulate doodle poll to schedule next meeting on Monday or Tuesday next week. Doodle poll would also include possible third meeting on Thursday 26 October - but if work is completed by that date, it would be cancelled. Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings@icann.org <mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses <http://learn.icann.org/courses/gnso> and visiting the GNSO Newcomer pages <http://gnso.icann.org/sites/gnso.icann.org/files/gnso/presentations/policy-e...> .
participants (8)
-
Beth Bacon -
Chuck -
consult＠cgomes.com
-
Farell Folly -
Kris Seeburn -
Marika Konings -
Metalitz, Steven -
theo geurts