November 2017 - Gnso-rds-pdp-7

Re: [Gnso-rds-pdp-7] Notes and action items from today's DT7 meeting
by Marika Konings Nov. 14, 2017

Nov. 14, 2017

Per action item 1, I checked with my GAC colleagues and they indicated that these were the two main sessions during which GDPR / Purpose were discussed: https://schedule.icann.org/event/CbIF/gac-discussion-on-whoisrds-and-gdpr https://schedule.icann.org/event/CbIC/gac-public-safety-working-group-meeti… These links can be added as a reference to the DT’s final output? Best regards, Marika From: <gnso-rds-pdp-7-bounces(a)icann.org> on behalf of Marika Konings <marika.konings(a)icann.org> Date: Tuesday, November 7, 2017 at 11:07 To: "gnso-rds-pdp-7(a)icann.org" <gnso-rds-pdp-7(a)icann.org> Subject: [Gnso-rds-pdp-7] Notes and action items from today's DT7 meeting Dear All, Please find below the notes and action items from today’s meeting. Please look out for next iterations of the Criminal Investigation/DNS Abuse Mitigation Use Case & Purpose statement by Rod. As the turnaround time is short, please share your feedback as soon as possible with the mailing list. The objective is to finalise the draft by Thursday so it can be submitted to the full WG for review by Friday 10 November. Best regards, Marika ============ DT7 Meeting on Tuesday 7 November 2017 Notes: 1. Roll Call * On the call, Dick Leaning, Rod Rasmussen and Marc Anderson 2. Reactions to ICANN60 feedback – any edits that are required as a result? * See notes from F2F meeting in Abu Dhabi * Consider extracting discussion that was held with the GAC to annex. Action item #1: Staff to add links to relevant GAC sessions to the document as another venue in which similar use cases were discussed. 3. Edits to address action item from ICANN60 (see a-e below) * One purpose of multiple purposes? One high level purpose, or does it make sense to break it out in multiple purposes? * At least 3, but probably more: identification of a domain name has been registered maliciously, notification of certain action associated with abuse, risk assessment of domains (investigate, notify the appropriate party, automate reputation). Each of these need different data and have different actors involved so would warrant different purposes. * Further sub-categories may need to be identified to allow for differentiated access (roll-based access). * Need to distinguish between name that has been registered maliciously and a name that has been compromised? * Check EWG report as it identified a number of contact points in relation to criminal investigation. * Keep details but roll up to higher level statement. * Should focus be on existing data collected or future ones – latter, forward looking approach as per the WG charter. * Consider including the consequences of not providing consent so that it is clear to registrants of what may happen if they opt-out. Important for end-users to be able to make an informed decision also based on the consequences of no consent. Possible example for notification purpose: “The following information is collected for the purpose of enabling notification by regulatory authorities, law enforcement, cybersecurity professionals, IT administrators, automated protection systems and other incident responders of the appropriate party (registrant, providers of associated services, registrar, etc), of abuse linked to a certain domain name registration to allow for mitigation and resolution of the abuse identified: Registrant contact information, Registrar contact Information, DNS contact, etc.. The possible consequences of not collecting / allowing access to this information are: [include examples]. 4. Plan to complete drafting team’s work: a. Volunteer needed to apply final edits by Wednesday 8 Nov Action item #2: Rod Rasmussen will send current interim draft to DT for input today and will circulate additional draft purpose statements as completed, for DT review at the latest by COB Wednesday 8 November. Action item #3: All DT7 members to review and finalize output on Thursday 9 Nov Action item #4: Marika to submit final output to WG no later than Friday 10 Nov d. Volunteer needed to present to WG on 5.Tuesday 14 Nov call Rod Rasmussen will present the DT output during next week's WG meeting. 6. AOB/Adjourn Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses[learn.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages[gnso.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

2 1

Proposed roll-up purposes
by Rod Rasmussen Nov. 11, 2017

Nov. 11, 2017

I’m going to leave off the “consequences of not providing information" for now - that’s not part of the purpose. However, we should work on that separately and include that feedback as part of our final product. Investigation: The following information is to be made available to regulatory authorities, law enforcement, cybersecurity professionals, IT administrators, automated protection systems and other incident responders for the purpose of enabling identification of the nature of the registration and operation of a domain name linked to abuse and/or criminal activities to facilitate the eventual mitigation and resolution of the abuse identified: Domain metadata (registrar, registration date, nameservers, etc.), Registrant contact information, Registrar contact Information, DNS contact, etc.. Notification: The following information is collected and made available for the purpose of enabling notification by regulatory authorities, law enforcement, cybersecurity professionals, IT administrators, automated protection systems and other incident responders of the appropriate party (registrant, providers of associated services, registrar, etc), of abuse linked to a certain domain name registration to facilitate the mitigation and resolution of the abuse identified: Registrant contact information, Registrar contact Information, DNS contact, etc.. Reputation: The following information is to be made available to organizations running automated protection systems for the purpose of enabling the establishment of reputation for a domain name to facilitate the provision of services and acceptance of communications from the domain name examined: Domain metadata (registrar, registration date, nameservers, etc.), Registrant contact information, Registrar contact Information, DNS contact, etc.. We should chat more about the particulars here, but these cover the concepts. I would argue that the first and third are purely a “display” purpose, but the second could be used as justification of collection. If nothing else, collecting an “abuse contact” requires number two for justification at all. Cheers, Rod

4 11

Fwd: [gnso-rds-pdp-wg] Final Deliverable from DT6, Legal Actions
by Richard Leaning Nov. 11, 2017

Nov. 11, 2017

This and group 5 findings are very similar to ours. Richard Leaning External Relations RIPE NCC Begin forwarded message: > From: "Chuck" <consult(a)cgomes.com> > Date: 8 November 2017 at 22:48:47 GMT > To: <gnso-rds-pdp-wg(a)icann.org> > Cc: gnso-rds-pdp-6(a)icann.org > Subject: [gnso-rds-pdp-wg] Final Deliverable from DT6, Legal Actions > > Here is the final deliverable for Drafting Team 6 for the Legal Actions Purpose/Use Case. DT6 will provide an overview of this in the 14 November WG meeting. In addition, DT6 concurs with a suggestion made by DT5 that the WG may want to consider combining Legal Actions with the Regulatory Purpose/Use Case because they largely overlap.” > > Chuck > _______________________________________________ > gnso-rds-pdp-wg mailing list > gnso-rds-pdp-wg(a)icann.org > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg

1 0

Notes and action items from today's DT7 meeting
by Marika Konings Nov. 8, 2017

Nov. 8, 2017

Dear All, Please find below the notes and action items from today’s meeting. Please look out for next iterations of the Criminal Investigation/DNS Abuse Mitigation Use Case & Purpose statement by Rod. As the turnaround time is short, please share your feedback as soon as possible with the mailing list. The objective is to finalise the draft by Thursday so it can be submitted to the full WG for review by Friday 10 November. Best regards, Marika ============ DT7 Meeting on Tuesday 7 November 2017 Notes: 1. Roll Call * On the call, Dick Leaning, Rod Rasmussen and Marc Anderson 2. Reactions to ICANN60 feedback – any edits that are required as a result? * See notes from F2F meeting in Abu Dhabi * Consider extracting discussion that was held with the GAC to annex. Action item #1: Staff to add links to relevant GAC sessions to the document as another venue in which similar use cases were discussed. 3. Edits to address action item from ICANN60 (see a-e below) * One purpose of multiple purposes? One high level purpose, or does it make sense to break it out in multiple purposes? * At least 3, but probably more: identification of a domain name has been registered maliciously, notification of certain action associated with abuse, risk assessment of domains (investigate, notify the appropriate party, automate reputation). Each of these need different data and have different actors involved so would warrant different purposes. * Further sub-categories may need to be identified to allow for differentiated access (roll-based access). * Need to distinguish between name that has been registered maliciously and a name that has been compromised? * Check EWG report as it identified a number of contact points in relation to criminal investigation. * Keep details but roll up to higher level statement. * Should focus be on existing data collected or future ones – latter, forward looking approach as per the WG charter. * Consider including the consequences of not providing consent so that it is clear to registrants of what may happen if they opt-out. Important for end-users to be able to make an informed decision also based on the consequences of no consent. Possible example for notification purpose: “The following information is collected for the purpose of enabling notification by regulatory authorities, law enforcement, cybersecurity professionals, IT administrators, automated protection systems and other incident responders of the appropriate party (registrant, providers of associated services, registrar, etc), of abuse linked to a certain domain name registration to allow for mitigation and resolution of the abuse identified: Registrant contact information, Registrar contact Information, DNS contact, etc.. The possible consequences of not collecting / allowing access to this information are: [include examples]. 4. Plan to complete drafting team’s work: a. Volunteer needed to apply final edits by Wednesday 8 Nov Action item #2: Rod Rasmussen will send current interim draft to DT for input today and will circulate additional draft purpose statements as completed, for DT review at the latest by COB Wednesday 8 November. Action item #3: All DT7 members to review and finalize output on Thursday 9 Nov Action item #4: Marika to submit final output to WG no later than Friday 10 Nov d. Volunteer needed to present to WG on 5.Tuesday 14 Nov call Rod Rasmussen will present the DT output during next week's WG meeting. 6. AOB/Adjourn Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<http://learn.icann.org/courses/gnso> and visiting the GNSO Newcomer pages<http://gnso.icann.org/sites/gnso.icann.org/files/gnso/presentations/policy-…>.

3 2

AC Recording, attendance & AC chat from Next-Gen RDS drafting team #7:Criminal Investigation or DNS Abuse Mitigation call on Tuesday, 07 November 2017 16:00 UTC
by Michelle DeSmyter Nov. 7, 2017

Nov. 7, 2017

Dear all, Please find below the Adobe Connect recording, chat and attendance from the Next-Gen RDS drafting team #7:Criminal Investigation or DNS Abuse Mitigation call on Tuesday, 07 November 2017 at 16:00 UTC. Adobe Connect recording: https://participate.icann.org/p9qxcaro729/ Attendance: Dick Leaning, Rod Rasmussen, Marc Anderson Apologies: Kiran Malancharuvil Staff: Marika Konings, Michelle DeSmyter Thank you. Kind regards, Michelle Adobe Connect Chat: Michelle DeSmyter:Welcome to the Next-Gen RDS Drafting team #7: Criminal Investigation or DNS Abuse Mitigation on Tuesday, 07 November 2017 at 16:00 UTC. Dick Leaning:afternoon guys Dick Leaning:do we ever get a day off ;-( Michelle DeSmyter:Hi there Dick, welcome! Marika Konings:Not at ICANN! ;-) Dick Leaning:lol Dick Leaning:its just not the ICANN way, right Marika Konings:Sorry for being late - am waiting for my dial out to come through. Marika Konings:For some reason there is no dial in number for Costa Rica with Verizon. Rod Rasmussen:Still waiting for an operator to let me on the call Marc Anderson:Still dialing in here as well Michelle DeSmyter:I will alert them. that you are both dialing in, Dick Leaning:ok - get it Rod Rasmussen:I don't think we have just one - at least 3, but probably more. Dick Leaning:investigation? rod Dick Leaning:where would that sort of fall Dick Leaning:in the bundle Dick Leaning:Notification? Marika Konings:I've noted them on the right hand side Marika Konings:At least 3, but probably more: identification of a domain name has been registered maliciously, notification of certain action associated with abuse, risk assessment of domains. Rod Rasmussen:Investigate, notify, automate reputation Dick Leaning:ok Rod Rasmussen:Investigate is ALL investigation, not just criminal Dick Leaning:i was just about to say that Rod Rasmussen:notify is notify the appropriate party (registrant, hoster, registrar, etc.) Rod Rasmussen:You can argue that identify is part of investigate Dick Leaning:lets not use criminal as word Dick Leaning:in this Marika Konings:"The following information is collected for the purpose of enabling notification by law enforcement, cybersecurity professionals and IT administrators of the appropriate party (registrant, hoster, registrar, etc), of abuse linked to a certain domain name registration to allow for mitigation and resolution of the abuse identified: [add data elements] Dick Leaning:we need capture the spirt tha there are others Dick Leaning:yes Rod Rasmussen:Instead of "hoster" use "providers of associated services" Rod Rasmussen:That would cover hosting, email, DNS, and other things that may be being abused. Rod Rasmussen:Yes Marc - for example, DNS contact Rod Rasmussen:SSAC is likely to propose that a future RDS have that for operational issues around DNSSEC for example but would also be applicable for some abuse issues. Marika Konings:Present the consequences of not giving consent? Dick Leaning:yep Dick Leaning:great Dick Leaning:bye buye

1 0

Re: [Gnso-rds-pdp-7] Next deliverable expected by Friday 10 November
by Marika Konings Nov. 6, 2017

Nov. 6, 2017

Hi All, You should have received an invitation by now for the next DT7 meeting which has been scheduled for Tuesday 7 November at 16.00 UTC. Unfortunately, it was not possible to find a time that would work for all those that responded to the doodle poll, but hopefully having the meeting tomorrow will allow for enough time for those that cannot make the call to weigh in on the mailing list before the due date. The proposed agenda for tomorrow’s meeting is as follows: 1. Roll Call 2. Reactions to ICANN60 feedback – any edits that are required as a result? 3. Edits to address action item from ICANN60 (see a-e below) 4. Plan to complete drafting team’s work: * Volunteer needed to apply final edits by Wednesday 8 Nov * All DT7 members to review and finalize output on Thursday 9 Nov * Marika to submit final output to WG no later than Friday 10 Nov * Volunteer needed to present to WG on Tuesday 14 Nov call 5. AOB/Adjourn Best regards, Marika From: <gnso-rds-pdp-7-bounces(a)icann.org> on behalf of Marika Konings <marika.konings(a)icann.org> Date: Thursday, November 2, 2017 at 09:58 To: "gnso-rds-pdp-7(a)icann.org" <gnso-rds-pdp-7(a)icann.org> Subject: [Gnso-rds-pdp-7] Next deliverable expected by Friday 10 November Hello DT7, Thank you all for your contributions this week. I know you are eager to get some rest after an intense ICANN meeting, but the next DT’s task already awaits. From the presentation that was provided during the 1 November meeting (see ICANN60 RDS PDP F2F v6.PDF[community.icann.org]<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_do…>): Next Steps and Action items Continue Drafting Teams through next week to address these points: 1. Summarize each purpose in one sentence: “Information collected to enable contact between the registrant and <who> <to accomplish what>” 2. Think in terms of explaining to the data subject why data is being collected for this purpose – keep it concise and simple. 3. Are the tasks/users identified by your team so diverse and distinct that they may be more than one purpose? If so, split them up and describe each purpose separately. 4. Which purposes covered by other teams are closely related to or overlap the purpose(s) covered by your team? 5. Is there any data collected specifically for the stated purpose? Or does that purpose use only data collected for other purposes? Action: Drafting teams to deliver final outputs by Friday 10 November Action: Drafting teams to present results to full WG on 14 Nov call I’ll work with the GNSO-Secs team to get a doodle set up for next week to find a time to discuss. However, if someone has a long flight ahead of them and would like to take a first stab at answering these questions, you are of course more than welcome! As a reminder, you will find the latest version of the DT7 output attached. Thanks, Marika Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses[learn.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages[gnso.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

1 0

Next deliverable expected by Friday 10 November
by Marika Konings Nov. 2, 2017

Nov. 2, 2017

Hello DT7, Thank you all for your contributions this week. I know you are eager to get some rest after an intense ICANN meeting, but the next DT’s task already awaits. From the presentation that was provided during the 1 November meeting (see ICANN60 RDS PDP F2F v6.PDF<https://community.icann.org/download/attachments/69280637/ICANN60%20RDS%20P…>): Next Steps and Action items Continue Drafting Teams through next week to address these points: 1. Summarize each purpose in one sentence: “Information collected to enable contact between the registrant and <who> <to accomplish what>” 2. Think in terms of explaining to the data subject why data is being collected for this purpose – keep it concise and simple. 3. Are the tasks/users identified by your team so diverse and distinct that they may be more than one purpose? If so, split them up and describe each purpose separately. 4. Which purposes covered by other teams are closely related to or overlap the purpose(s) covered by your team? 5. Is there any data collected specifically for the stated purpose? Or does that purpose use only data collected for other purposes? Action: Drafting teams to deliver final outputs by Friday 10 November Action: Drafting teams to present results to full WG on 14 Nov call I’ll work with the GNSO-Secs team to get a doodle set up for next week to find a time to discuss. However, if someone has a long flight ahead of them and would like to take a first stab at answering these questions, you are of course more than welcome! As a reminder, you will find the latest version of the DT7 output attached. Thanks, Marika Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<http://learn.icann.org/courses/gnso> and visiting the GNSO Newcomer pages<http://gnso.icann.org/sites/gnso.icann.org/files/gnso/presentations/policy-…>.

1 0

Notes & action items today's DT7 meeting
by Marika Konings Nov. 1, 2017

Nov. 1, 2017

Dear all, Thank you to those that were available to participate in today’s DT meeting. As there is little time left before people start travelling, please take note of the action items below. The objective is to submit the template to the full WG by the end of day on Thursday so the DT will need to have completed its work by then. As per action item #3, please find attached the latest draft of the legal action DT. The latest draft of the regulatory & contract enforcement can be found here: https://docs.google.com/document/d/1NvoYYmMsjqgt48mAYt5nCr8uPk-E-2IngGt50wD…. As noted, these DTs may have some overlap with the purpose described by this DT. Best regards, Marika Notes – DT7 Meeting on 24 October 2017: 1. Roll call / Welcome * On call today: Dick Leaning, Marc Anderson, Raoul Plommer, Rod Rasmussen 2. Review, discuss and confirm support and understanding of all input received to date (see https://docs.google.com/document/d/19fUlV3HEyZ0IYFOY-r4KGoN25ICHPf1wDjUA_ZM…) * See latest version at link above * Initial draft expanded by adding a number of additional use cases to give a broader flavor of this particular purpose, both for individual investigations as well as automated processes. * RDAP protocol would facilitate automated process * Description has been provided for each use case as well as the overall structure and distinction between different use cases (individual investigations vs. automated processes and various stages of an investigation) * Around automated processes for reputation services - is an area that hasn't really been discussed in the larger WG, so might be of broader interest to highlight that use case. * Is a separate category needed for copyright infringement - likely covered by another DT, but may be worth flagging to ensure that it is not lost. May need to conduct a gap analysis once all DTs have presented their work to make sure nothing is forgotten. Similarly content on web-sites (e.g. pharma) may fall in different categories even though they may follow similar steps and/or require similar information. Difference may be in the asking to determine in which DT it belongs. Info-sec and other private actors aren't usually interested in attribution, so that's a big difference. Action item #1: Rod to add additional use case concerning compromise of account / hijacking / domain shattering Action item #2: All to review template and aim to flesh out use cases to ensure a comprehensive overview and understanding of data elements required for criminal investigation / DNS Abuse Mitigation purpose. Action item #3 - Staff to share latest drafts of enforcement and legal actions DT so that the DT can see what is being covered in other DTs and flag accordingly what may require further attention. Action item #4 - DT encouraged to ask questions should certain aspects not be clear to make sure that the template is understandable for a broad audience 3. Confirm what further updates / edits need to be made prior to submission to the full WG (deadline Thursday 26 October) 4. Identify team members who will attend ICANN60 sessions: Saturday 28 October and Wednesday 1 November In person or remote Volunteer to introduce the team's output? * Consider having a high level overview on a slide - Rod to discuss with Lisa * Rod and Dick normally available to present * Aim to ensure that Rod is available to present as he is the expert Action item #5 - Rod to check breaks for SSAC session so that DT7 update could be scheduled in accordance with the breaks Action item #6 – Staff to work with the leadership team to schedule the DT7 update at a time that works with Rod’s schedule Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<http://learn.icann.org/courses/gnso> and visiting the GNSO Newcomer pages<http://gnso.icann.org/sites/gnso.icann.org/files/gnso/presentations/policy-…>.

5 17