October 2017 - Gnso-rds-pdp-7

Notes & action items today's DT7 meeting
by Marika Konings Nov. 1, 2017

Nov. 1, 2017

Dear all, Thank you to those that were available to participate in today’s DT meeting. As there is little time left before people start travelling, please take note of the action items below. The objective is to submit the template to the full WG by the end of day on Thursday so the DT will need to have completed its work by then. As per action item #3, please find attached the latest draft of the legal action DT. The latest draft of the regulatory & contract enforcement can be found here: https://docs.google.com/document/d/1NvoYYmMsjqgt48mAYt5nCr8uPk-E-2IngGt50wD…. As noted, these DTs may have some overlap with the purpose described by this DT. Best regards, Marika Notes – DT7 Meeting on 24 October 2017: 1. Roll call / Welcome * On call today: Dick Leaning, Marc Anderson, Raoul Plommer, Rod Rasmussen 2. Review, discuss and confirm support and understanding of all input received to date (see https://docs.google.com/document/d/19fUlV3HEyZ0IYFOY-r4KGoN25ICHPf1wDjUA_ZM…) * See latest version at link above * Initial draft expanded by adding a number of additional use cases to give a broader flavor of this particular purpose, both for individual investigations as well as automated processes. * RDAP protocol would facilitate automated process * Description has been provided for each use case as well as the overall structure and distinction between different use cases (individual investigations vs. automated processes and various stages of an investigation) * Around automated processes for reputation services - is an area that hasn't really been discussed in the larger WG, so might be of broader interest to highlight that use case. * Is a separate category needed for copyright infringement - likely covered by another DT, but may be worth flagging to ensure that it is not lost. May need to conduct a gap analysis once all DTs have presented their work to make sure nothing is forgotten. Similarly content on web-sites (e.g. pharma) may fall in different categories even though they may follow similar steps and/or require similar information. Difference may be in the asking to determine in which DT it belongs. Info-sec and other private actors aren't usually interested in attribution, so that's a big difference. Action item #1: Rod to add additional use case concerning compromise of account / hijacking / domain shattering Action item #2: All to review template and aim to flesh out use cases to ensure a comprehensive overview and understanding of data elements required for criminal investigation / DNS Abuse Mitigation purpose. Action item #3 - Staff to share latest drafts of enforcement and legal actions DT so that the DT can see what is being covered in other DTs and flag accordingly what may require further attention. Action item #4 - DT encouraged to ask questions should certain aspects not be clear to make sure that the template is understandable for a broad audience 3. Confirm what further updates / edits need to be made prior to submission to the full WG (deadline Thursday 26 October) 4. Identify team members who will attend ICANN60 sessions: Saturday 28 October and Wednesday 1 November In person or remote Volunteer to introduce the team's output? * Consider having a high level overview on a slide - Rod to discuss with Lisa * Rod and Dick normally available to present * Aim to ensure that Rod is available to present as he is the expert Action item #5 - Rod to check breaks for SSAC session so that DT7 update could be scheduled in accordance with the breaks Action item #6 – Staff to work with the leadership team to schedule the DT7 update at a time that works with Rod’s schedule Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<http://learn.icann.org/courses/gnso> and visiting the GNSO Newcomer pages<http://gnso.icann.org/sites/gnso.icann.org/files/gnso/presentations/policy-…>.

5 17

Just added that next use case
by Rod Rasmussen Oct. 24, 2017

Oct. 24, 2017

Hey team, Just updated the working doc as promised on the call for, "1B-2 Purpose Name: Notify parties responsible for a domain name that has had its domain management account compromised”. Note to Marika: the Google Doc seems to be just accepting changes without putting them as edits, at least from my perspective. Are you seeing my changes as edits? Cheers, Rod

2 1

AC Recording, attendance & AC Chat from Next-Gen RDS drafting team #7:Criminal Investigation or DNS Abuse Mitigation call on Tuesday, 24 October 2017 17:00 UTC
by Michelle DeSmyter Oct. 24, 2017

Oct. 24, 2017

Dear all, Please find below the Adobe Connect recording, chat and attendance from the Next-Gen RDS drafting team #7:Criminal Investigation or DNS Abuse Mitigation call on Tuesday, 24 October 2017 at 17:00 UTC. Adobe Connect recording: https://participate.icann.org/p47pp16jba5/ Attendance: Dick Leaning, Rod Rasmussen, Marc Anderson, Raoul Plommer Staff: Marika Konings, Michelle DeSmyter Thank you. Kind regards, Michelle Adobe Connect Chat: Michelle DeSmyter:Welcome to the Next-Gen RDS Drafting team #7: Criminal Investigation or DNS Abuse Mitigation on Tuesday, 24 October 2017 at 17:00 UTC. Marika Konings:I can hear you Michelle dick leaning:evening form Dubai - am on a flakey hotel internet connetion ;-( Marika Konings:Hi Dick Raoul Plommer:Hello, could someone call me at +358445810005 dick leaning:and also trying to eat dodgy room service at the same time - living the dream ;-) Raoul Plommer:thanks! :) Michelle DeSmyter:Absolutely Raoul dick leaning:and sorry Rod - i just had teh time to have a proper look dick leaning:hadnt Rod Rasmussen:I am having a real problem hearing Marika and Marc - is that me? dick leaning:its ok for me Rod Rasmussen:I'll try Adobe connect Marika Konings:Rod, can we dial out to you otherwise? Raoul Plommer:I can wait, I don't have much input yet I'm afraid dick leaning:yes we can hear you Michelle DeSmyter:Not able to hear you now Marika Konings:We can hear you fine Marika Konings:Yes :-) Marc Anderson:I can hear Rod, but the connection isn't good. Marika Konings:If you can give a brief overview of where things stand and what is needed to finalise the document dick leaning:yes dick leaning:tomorrow afternoon i will become free to focus on this Rod Rasmussen:No worries - I want to make sure that folks understand how all this works in as unbiased way as possible to take some of the FUD out of our larger WG discussions. Rod Rasmussen:In other words, I'm very happy to make the time to work on this - just wish the timing was better. Rod Rasmussen:The automated stuff is really important and poorly understood even by people in LE and security. dick leaning:thats were we need Kiran Rod Rasmussen:I believe that is being covered in another WG Marika Konings:I believe that is correct Rod Rasmussen:May want to mention the overlap and point to that team. When we bring them together, we should do a gap analysis. Raoul Plommer:ok dick leaning:and content? dick leaning:ok dick leaning:thanks Rod Rasmussen:This gets dicey when you're talking about things like pharma vs. stuff like TM infringement - content on websites vs. the actual name itself. dick leaning:exaclty Rod Rasmussen:Should we coordinate with them now? Raoul Plommer:I'm still very much at learning stage and I've barely started to go through the documents and issues of RDS. Sorry for the confusion. Raoul Plommer:Some of the IP enforcement seems to get access to this data from many domains at once, automatically so I guess that would have something to do with the way how this data is accessed and over what threshold. Raoul Plommer:That could be more relevant to this group Rod Rasmussen:On more work from me - I will be putting some more cases up in the next 24 hours, but then have a long plane flight from AMS to Abu Dhabi on Thursday morning where I should be able to flesh this out fully. Rod Rasmussen:Info-sec and other private actors aren't usually interested in attribution, so that's a big difference. Rod Rasmussen:The whois is usually more of a starting point for taking other actions that may lead to attribution or mitigation or other stuff. dick leaning:yes dick leaning:more distruption is now the buzz word dick leaning:the cyber crime is very diverse dick leaning:yes Raoul Plommer:I definitely won't feel comfortable presenting this material in a week, hopefully by Puerto Rico I'll be closer to that. Rod Rasmussen:I will adding one more right after this call - so give it just a few minutes. :-) dick leaning:Rod hehehehe dick leaning:lol Marika Konings:are there any breaks in that meeting? Rod Rasmussen:lol dick leaning:sounds a plan Rod Rasmussen:I'm good Marc Anderson:thank you, safe travels Raoul Plommer:See in a few days! dick leaning:bye bye Rod Rasmussen:safe travels everyone!

1 0

Notes & action items from today's meeting
by Marika Konings Oct. 24, 2017

Oct. 24, 2017

Dear All, Thank you again for participation in today’s meeting. Please find below the notes and action items. I’ll be sharing with you shortly the google doc link to the template. As a reminder, you can use this email address (gnso-rds-pdp-7(a)icann.org<mailto:gnso-rds-pdp-7@icann.org>) for any further discussion on this topic. Best regards, Marika ============================ DT7 - Criminal Investigation or DNS Abuse Mitigation Meeting 18 October 2017 1) Brief recap of DT7 goals and due date – Marika * To enable better understanding of existing purposes for WHOIS data, small drafting teams composed of WG members with diverse points of view were chosen to define each identified purpose. * This drafting team should discuss the tasks supported by the purpose “Criminal Investigation of DNS Abuse Mitigation,” the parties involved in this purpose, and the data often used to fulfill this purpose. * It is hoped that fleshing out purpose definitions will improve communication and help the WG conduct informed discussion about all identified purposes before trying to agreement on legitimacy, etc * Our drafting team is asked to discuss our assigned purpose by phone and email over the next week, producing a draft purpose definition to be shared on the full WG mailing list no later than 26 October, for discussion during the WG’s F2F meetings at ICANN60. * A substantial amount of additional use cases & circumstances could be developed for this and probably for others. Is this the objective? 2) All team members to share their level of experience with Criminal Investigation or DNS Abuse Mitigation * Ayden Ferdeline - No experience with LE or criminal investigation. Newcomer to this purpose. Member of the NCSG, works for Internet Society. * Dic Leaning - ex law enforcement officer (retirement), Europol and Scotland Yard, deep knowledge of criminal investigation. Many different tools used by LE to investigate cybercrime, DNS is just one of the tools. Now working for RIPE. Definition in template seems accurate. * Marc Anderson - employed by Verisign, registry operator. No detailed knowledge in this purpose as it is handled by others at Verisign. * Rod Rasmussen - deep subject matter expert. Involved in the EWG. Has been doing security in private sector but also investigation, to designing software and systems to bring in data and work with data to glean information that is put into different products. * Raoul Plommer - a digital rights activist for 10 yrs now and the VC of NPOC. Been working for the pirate party, which is an international political movement. Action item #1: DT members not on the call are encouraged to share their experience and review meeting notes & recording. 3) Introduce EWG's definition of this purpose, as starting point for discussion 4) Team members less familiar with this purpose to ask general questions 5) Team members more familiar with this purpose to give real-world examples of this purpose, drawn from their own experiences * See template distributed. * Excerpts included from EWG report. EWG went into a lot of detail and background re. the various use cases. In order to make it digestible, this was rolled up into these broader categories as included in the template. DNS is used in many cases directly or indirectly to facilitate abuse, e.g. confidence scams, child pornography. Off-line crime may also include evidence connected to emails & web-sites. Criminal category. * Abuse/civil/annoying (e.g. spam) category. * Infrastructure related like command and control, botnet. DNS is also infrastructure for illegitimate purposes. * Unintended infrastructure - compromised domains/web-sites. Compromised registrar accounts which could result in the creation of new sub-domains. * Range of different things that fall within these five use cases listed. * Broad buckets from an investigation perspective: single person, group, automation (e.g. analysis tool). Starting point from which further determinations are made: is a DNS resource complicit or not in the criminal activity? From there, investigator will undertake action - e.g. reach out to someone who is compromised, reach out to registrar to delete registration if it was fraudulently registered. Then, what information can be gleaned from this info: are other registrations involved, what is the scale / scope involved. * Automation side: reputation services - make real time decisions about connectivity. Should a user on my network be able to connect to this domain name? Need to have capability to make decision on whether to connect to another network. Same for spam - do you accept email? Consideration of domain from which it emanates will factor into that consideration. * Consider developing a matrix that would outline the needs and what is needed and at what scale. * Abuse contact would be helpful in these kinds of cases - what would be more efficient for the system to do going forward. * Domain Name Generation Algorithm (DGA) - as part of running a bot-net (infected computers that talk to a central source to give them instructions). What has been developed by 'bad guys' over the last 10 years to keep infrastructure working is to create algorithms to create rendezvous domains. May or may not exist in the actual DNS but infected computers would try to connect to these domains where something could potentially happen. If that info is known, it can be used to block access to those registrations, look up domains to see who has registered those, identify potential collision, etc. * How are criminal investigations and abuse investigations typically started? From the OpsSec side, it often starts with reports of spam. Even where someone is reporting to a brand (phishing), or download of virus. Typically come in from victims or potential victims. Reverse engineering may show domain name. DDOS - domain name may be used to fire ammunition and bring down service. Scams - fake businesses set up for job recruiting or escrow services. Fairly similar for LE - any crime you can think of happening in the real world, happens in the online world, and it requires a domain name. That is why it is so important to have info on who has which domain name. * If there would be no WHOIS, how would an investigation take place? Would require going to the registrar or registry directly. Same applies currently for IP addresses. Could also go to hosting provider - whoever is providing the service. In some cases it may not matter who owns the domain name registration, but it is a starting point. Most useful in the compromised domain name registration as direct outreach can be done to the victim. Knowing that certain domain name registrations are owned by the same entity is also valuable information. * The other important bit which is sometimes is overlooked is that a potential customer can look up the WHOIS and make an informed decision if they want to hand there money over to them. 6) Divvy up drafting and agree upon plan to flesh out template by 26 October * Who needs what data for which purpose? May need to modify the template to ensure all that info is covered. * In terms of user types, try to include more granularity. Private entities do not have the same status as LE. There may be overlap, but important to distinguish between the two. Action item #2: Staff to post template as a google doc Action item #3: Rod to take a first stab at adding to the template and add matrix as outlined during the call Action item #4: Staff to circulate doodle poll with objective to find a possible meeting time/date either next Monday or Tuesday, recognising that availability may be limited. Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<http://learn.icann.org/courses/gnso> and visiting the GNSO Newcomer pages<http://gnso.icann.org/sites/gnso.icann.org/files/gnso/presentations/policy-…>.

3 9

Template now available as a google doc
by Marika Konings Oct. 18, 2017

Oct. 18, 2017

Dear All, The DT7 template has now been posted as a google doc and is available here: https://docs.google.com/document/d/19fUlV3HEyZ0IYFOY-r4KGoN25ICHPf1wDjUA_ZM…. As discussed on the call, Rod Rasmussen will take a first stab at editing / adding to the template following which you are all encouraged to share your perspectives. A doodle poll has been circulated in the meantime to try and find a time on Monday or Tuesday next week to meet to finalize the template. Thanks, Marika Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<http://learn.icann.org/courses/gnso> and visiting the GNSO Newcomer pages<http://gnso.icann.org/sites/gnso.icann.org/files/gnso/presentations/policy-…>.

1 0

Attendance, Adobe Connect recording and chat / Drafting team #7: Criminal Investigation or DNS Abuse Mitigation call on Wednesday, 18 October 2017 at 17:00
by Julie Bisland Oct. 18, 2017

Oct. 18, 2017

Dear all, Please find below the Adobe Connect recording, chat and attendance from the Next-Gen RDS drafting team #7: Criminal Investigation or DNS Abuse Mitigation call on Wednesday, 18 October 2017 at 17:00 UTC. Adobe Connect recording: https://participate.icann.org/p6upmiw6ybo/<https://participate.icann.org/p6upmiw6ybo/?OWASP_CSRFTOKEN=ba32205baa7d5c6f…> Attendance: Marika Konings Dic Leaning, Rod Rasmussen, Ayden Ferdeline, Marc Anderson, Raoul Plommer Staff: Julie Bisland Thank you. Kind regards, Julie Adobe Connect Chat: Julie Bisland: (10/18/2017 09:43) Welcome to the Next-Gen RDS Drafting team #7: Criminal Investigation or DNS Abuse Mitigation on Wednesday, 18 October 2017 at 17:00 UTC. Ayden Férdeline: (12:01) Hi all. Adobe Connect is super slow for me today... I am not sure if it is just my connection, or the platform? (Other websites are loading fine.) Dic Leaning: (12:01) HI Dic Leaning: (12:02) Mmmmm i cant connect audiio etc via my lap top Dic Leaning: (12:02) it keeps wanting me to connect via phone Julie Bisland: (12:02) ohh goodness, Dic, try now Julie Bisland: (12:02) i've enable the audio now Dic Leaning: (12:03) Thanks Julie, in Marika Konings: (12:03) Dic, I can hear you typing :-) Julie Bisland: (12:03) oh good, sorry for that. :) Raoul Plommer: (12:04) I can only participate in text at this time, but I'll try to follow Ayden Férdeline: (12:05) I cannot hear anything. Can others? Dic Leaning: (12:05) yes Julie Bisland: (12:06) Ayden, i'll private message you Rod Rasmussen: (12:06) Sound is fine Raoul Plommer: (12:20) Ok, I can type Raoul Plommer: (12:20) I'm a digital rights activist for 10 yrs now and the VC of NPOC Raoul Plommer: (12:20) Please carry on, I'll just keep typing Raoul Plommer: (12:21) I've been wotking for the pirate party, which is an international political movement Dic Leaning: (12:22) Ok forgot to mention that as from this saturday am in Dubai at our RIPE conference for the whole week, which for me my team is full on everyday,, so i just want to manage expectations of how much i can actually do in th enext coming days Raoul Plommer: (12:24) fighting for freedom of speech, open government and equality. They're quite well connected and our only MEP Julia Reda has done a terrific job Dic Leaning: (12:27) YES YES Rod - all crime has a presence on the internet Dic Leaning: (12:27) in someway Raoul Plommer: (12:28) pirates also fight against repressive copyrights and some of the law enforcement measures are used on people who are not dangerous but merely share culture Ayden Férdeline: (12:34) Article 29 WP released guidance yesterday on automated decison making re: GDPR interpretation. This could impact your automation, especially where the domain names are held by natural persons. Dic Leaning: (12:35) Rod - can you mention DGA? Dic Leaning: (12:35) are they in the whois Dic Leaning: (12:36) sorry ;-) Dic Leaning: (12:41) most seriuos cyber crime use DGA Dic Leaning: (12:41) yes Rod, thanks Dic Leaning: (12:52) the other important bit which is sometimes is over look is that a potential customer can look up th ewhois and make a inofrmed decison if they want to hand there money over to them Dic Leaning: (12:53) if they cant check who domin is registered to it will push the end user to the well knowns ones - to amazon and ebay for example Ayden Férdeline: (12:56) new hand please Raoul Plommer: (13:00) Are these notes sent to us? Dic Leaning: (13:01) remind me - is there a new mailing list on this stream? Ayden Férdeline: (13:01) thanks all Dic Leaning: (13:01) ok, thanks Dic Leaning: (13:02) bye Rod Rasmussen: (13:02) Thanks!

1 0

Proposed Agenda and materials for review
by Marika Konings Oct. 16, 2017

Oct. 16, 2017

Dear All, By now, all DT7 members should have received an email with the call details for our kickoff meeting: The next GNSO Next-Gen RDS Subteam #7 teleconference will take place on Wednesday, 18 October 2017 at 17:00 UTC for 60 minutes. 10:00 PDT, 13:00 EDT, 18:00 London, 19:00 CET. For other times: https://tinyurl.com/ycgqxusv. If you have not received that call notice, please contact gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> for call details. Most of you have indicated that you can make this time, but unfortunately it looks like we’ll have to miss Raoul and Kiran. As noted in previous messages, it would be really helpful if you can share your perspectives ahead of the meeting so the DT can make sure to factor these into the discussion. Or if someone wants to take a first stab at drafting proposed language for the template (see attached), please feel free. FYI, the AC session will be recorded and a link to that recording will be circulated to this DT email list after the call. To get us started, here's a proposed agenda for our kickoff call: 1) Brief recap of DT7 goals and due date – Marika 2) All team members to share their level of experience with Criminal Investigation or DNS Abuse Mitigation 3) Introduce EWG's definition of this purpose, as starting point for discussion 4) Team members less familiar with this purpose to ask general questions 5) Team members more familiar with this purpose to give real-world examples of this purpose, drawn from their own experiences 6) Divvy up drafting and agree upon plan to flesh out template by 26 October Questions? Suggestions? As a reminder, please familiarize yourself with the examples in the Template and the reference documents listed there: * RDS PDP WG agreements in KeyConceptsDeliberation-WorkingDraft.PDF[community.icann.org]<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_do…> and DOC[community.icann.org]<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_do…> (also listed in summary form here: List of WG Agreements to Date[community.icann.org]<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_do…> as of 3 October 2017) * Section 3 and Annex C of EWG Recommendations for a Next-Generation RDS[icann.org]<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_en_syste…> * The representative set of example use cases[community.icann.org]<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_di…> developed by the RDS PDP WG. Of specific relevance for our discussion are: * Law Enforcement - Compromised websites<https://community.icann.org/download/attachments/60493348/EUROPOL-Use_case_…> * Investigate Abusive Domain<http://mm.icann.org/pipermail/gnso-rds-pdp-wg/attachments/20160815/ab76da58…> * Reputation Services<https://community.icann.org/download/attachments/60493348/17-Reputation%20S…> * Find Domains Registered by Miscreant<http://mm.icann.org/pipermail/gnso-rds-pdp-wg/attachments/20160815/ab76da58…> Best regards, Marika Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<http://learn.icann.org/courses/gnso> and visiting the GNSO Newcomer pages<http://gnso.icann.org/sites/gnso.icann.org/files/gnso/presentations/policy-…>.

1 0

Re: [Gnso-rds-pdp-7] DT7 follow up message
by Marika Konings Oct. 16, 2017

Oct. 16, 2017

Hi DT7, Unfortunately it doesn’t look like that we’ll be able to find a time that works for all which makes it even more important for everyone to review the materials and share your views with the mailing list in advance of our first meeting. Please hold Wednesday 16.00 UTC in your calendars for now – we’ll confirm tomorrow the exact time and call details as we need to cross-check these with the other DTs to make sure that sufficient support is available to run the meeting. Thanks, Marika From: <gnso-rds-pdp-7-bounces(a)icann.org> on behalf of Marika Konings <marika.konings(a)icann.org> Date: Friday, October 13, 2017 at 14:38 To: "gnso-rds-pdp-7(a)icann.org" <gnso-rds-pdp-7(a)icann.org> Subject: [Gnso-rds-pdp-7] DT7 follow up message Hi again, Ayden and Richard, many thanks for responding so quickly to the Doodle. Marc, Kiran, Rod, Raoul, please be sure to respond to the Doodle no later than end of your Saturday: Doodle: https://icannorg.doodle.com/poll/iyv4p2kmtg7ranga[icannorg.doodle.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__icannorg.doodle.com_po…> If possible, let's get started on this team's task in advance of our kickoff call next week. Please start by reviewing the action item and template for this team (see http://mm.icann.org/pipermail/gnso-rds-pdp-7/2017-October/000000.html) If you have any questions about our assignment, raise them by replying to this message. You'll see definitions from the EWG Report included in the template for easy reference, but this team is free to re-use all, part, or none of that EWG text in fleshing out a purpose definition for Criminal Investigation or DNS Abuse Mitigation. To kick off discussion, I invite each of you to consider the EWG's definitions and reply to this list with any observations based on your own experiences. How closely do the EWG's definitions reflect your own experiences with Criminal Investigation or DNS Abuse Mitigation? - What's missing? - What's confusing? - What really needs to be fleshed out? In considering this purpose definition, please try to set aside any opinions you may already have about the legitimacy of Criminal Investigation or DNS Abuse Mitigation as a specific purpose for registration data or directory services. Please also do not limit yourself to WHOIS as it is implemented today or to the minimum public data set previously agreed by this WG. Those of you who are experienced with Criminal Investigation or DNS Abuse Mitigation, please aim to educate the rest of this team about this purpose. Those who have not been directly involved with Criminal Investigation or DNS Abuse Mitigation in the past, please ask any questions you may have about this purpose. The better we can all understand what is meant by this purpose, the more effective our future WG deliberations can be. Thanks all for volunteering to assist with this action item - Best regards, Marika Drafting Team 7 Coordinator Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses[learn.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages[gnso.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

1 0

DT7 follow up message
by Marika Konings Oct. 13, 2017

Oct. 13, 2017

Hi again, Ayden and Richard, many thanks for responding so quickly to the Doodle. Marc, Kiran, Rod, Raoul, please be sure to respond to the Doodle no later than end of your Saturday: Doodle: https://icannorg.doodle.com/poll/iyv4p2kmtg7ranga If possible, let's get started on this team's task in advance of our kickoff call next week. Please start by reviewing the action item and template for this team (see http://mm.icann.org/pipermail/gnso-rds-pdp-7/2017-October/000000.html) If you have any questions about our assignment, raise them by replying to this message. You'll see definitions from the EWG Report included in the template for easy reference, but this team is free to re-use all, part, or none of that EWG text in fleshing out a purpose definition for Criminal Investigation or DNS Abuse Mitigation. To kick off discussion, I invite each of you to consider the EWG's definitions and reply to this list with any observations based on your own experiences. How closely do the EWG's definitions reflect your own experiences with Criminal Investigation or DNS Abuse Mitigation? - What's missing? - What's confusing? - What really needs to be fleshed out? In considering this purpose definition, please try to set aside any opinions you may already have about the legitimacy of Criminal Investigation or DNS Abuse Mitigation as a specific purpose for registration data or directory services. Please also do not limit yourself to WHOIS as it is implemented today or to the minimum public data set previously agreed by this WG. Those of you who are experienced with Criminal Investigation or DNS Abuse Mitigation, please aim to educate the rest of this team about this purpose. Those who have not been directly involved with Criminal Investigation or DNS Abuse Mitigation in the past, please ask any questions you may have about this purpose. The better we can all understand what is meant by this purpose, the more effective our future WG deliberations can be. Thanks all for volunteering to assist with this action item - Best regards, Marika Drafting Team 7 Coordinator Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<http://learn.icann.org/courses/gnso> and visiting the GNSO Newcomer pages<http://gnso.icann.org/sites/gnso.icann.org/files/gnso/presentations/policy-…>.

1 0

Drafting Team #7 – Criminal Investigation or DNS Abuse Mitigation
by Marika Konings Oct. 13, 2017

Oct. 13, 2017

Dear All, Welcome. You have been selected by the RDS leadership team to serve on a drafting team to define the RDS purpose named in the subject line above. Thank you very much for volunteering to participate in this effort. Here is the list of the team members: Coordinated by: Marika Konings Members: Richard Leaning, Marc Anderson, Kiran Malancharuvil, Ayden Ferdeline, Rod Rasmussen, Raoul Plommer As you can see, this message is being sent via a dedicated mailing list that has been set up to facilitate email communications over the next two to two and half weeks. Please use the list for all of our electronic team communications. Note that this list is publicly archived. Here are the list details. Mailing list address: gnso-rds-pdp-7(a)icann.org<mailto:gnso-rds-pdp-7@icann.org> Mailing list archive: http://mm.icann.org/pipermail/gnso-rds-pdp-7/ Attached you will find a template that outlines our tasks and provides a timeline. Please review it right away so that we can start discussions as soon as possible. We plan to have at least two teleconference calls over the next two weeks, but additional ones may be scheduled as needed. At the same time, mailing list discussion is encouraged. The first call will be scheduled on Tuesday or Wednesday, October 17 or 18. Please complete the Doodle poll linked below not later than end of day on Saturday, October 14 so that a time can be identified that best meets team member availability. https://icannorg.doodle.com/poll/iyv4p2kmtg7ranga Teams were formed using results from this week’s poll which can be found on the WG wiki. Every team includes: * At least one person from each of the perspectives named in the poll wherever possible, but without assigning members to more than one team. * A mix of members who have direct experience regarding the proposed purpose and those who have little or no experience about the proposed purpose. Remember that the purpose of this work is not to make decisions but rather to facilitate communication and understanding. The team is expected to deliver a one to two-page document to the full WG that will be used in our face to face meeting on Saturday, October 28 to help all WG members understand the applicable purpose. If you have any questions, please feel free to ask them on this list. Thanks in advance for completing the Doodle Poll promptly and for participating in our discussions starting today and in the days ahead. Marika Konings Drafting Team Coordinator Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<http://learn.icann.org/courses/gnso> and visiting the GNSO Newcomer pages<http://gnso.icann.org/sites/gnso.icann.org/files/gnso/presentations/policy-…>.

1 0