- Gnso-rds-pdp-7 - lists.icann.org

Re: [Gnso-rds-pdp-7] [Ext] RE: ICANN61 Prep Assignment
by Marika Konings March 7, 2018

March 7, 2018

Thanks, Marc. Noting the deadline for submissions, I’ll go ahead and submit this now to the full WG noting that due to other commitments not everyone was able to weigh in but is expected to do so as part of the full WG review and deliberations. Best regards, Marika From: "Anderson, Marc" <mcanderson(a)verisign.com> Date: Wednesday, March 7, 2018 at 15:25 To: Marika Konings <marika.konings(a)icann.org>, "gnso-rds-pdp-7(a)icann.org" <gnso-rds-pdp-7(a)icann.org> Subject: [Ext] RE: [Gnso-rds-pdp-7] ICANN61 Prep Assignment All, I took a crack at responding to the questions using Marika’s document as a starting point. I took the concepts I started with below and tried to apply them to the three DT7 uses cases (Investigation, notification and reputation services). This is really not my area of expertise so I relied heavily on my recollections from our group meetings before ICANN 60. I’d prefer more time and the opportunity for everyone on the group to provide input but I know that time and bandwidth are short. Hopefully I’ve done an adequate job representing our group. I’ll be at the Saturday RDS PDP meeting and am happy to speak to the report. Thank you, Marc From: Gnso-rds-pdp-7 [mailto:gnso-rds-pdp-7-bounces@icann.org] On Behalf Of Anderson, Marc via Gnso-rds-pdp-7 Sent: Friday, March 02, 2018 4:53 PM To: marika.konings(a)icann.org; gnso-rds-pdp-7(a)icann.org Subject: [EXTERNAL] Re: [Gnso-rds-pdp-7] ICANN61 Prep Assignment Marika, thanks for the recap of the assignment. I’ve been swamped as I’m sure the rest of you are, but I wanted to send out a few thoughts before we get into the weekend to try and kick start the conversation. Based on our discussions last time I’d say the answers to these questions depend on the use case. We identified a number of use cases but I think for these questions they can probably be divided between two categories. 1) RDS data used to notify a victim and 2) RDS data used to identify/prosecute a criminal. I know this is over simplifying things and ignores the gray area in between where (especially initially) it might not be know if the domain registrant is the victim or the abuser, but given the short time frame until ICANN 61, it might be helpful to frame our answers around those two scenarios. Any thoughts… does that sound reasonable? I’ll take a first pass at some answers for the victim notification use case (mostly because I think those will be easier to answer ☺ ). 1. Who associated with the domain name registration needs to be identified and/or contacted for each purpose? With traditional Whois data fields I would answer this by saying the Registrant, Admin and Technical contact. As I’m a proponent of trying not to think in terms of the legacy data fields (and like the roles based approach suggested by the EWG) I’d answer with the domain name owner and the admin, tech and abuse roles for the domain. Here I think “contact-ability” is key and so what’s important for this use case if having accurate and up to date information about how to contact someone with authority for the domain name is what is needed. 1. What is the objective achieved by identifying and/or contacting each of those entities? The objective seems to be basically stated in the use case: notify the domain name owner and/or someone with authority for the domain name of abuse associated with the domain name registration. 1. What might be expected of that entity with regard to the domain name? Here I think the expected action is for the domain name owner or person with authority for the domain name to take action to correct the abuse associated with the domain name. Hopefully I’m on the right track and that gets us started. Thanks, Marc From: Gnso-rds-pdp-7 <gnso-rds-pdp-7-bounces(a)icann.org<mailto:gnso-rds-pdp-7-bounces@icann.org>> on behalf of Marika Konings <marika.konings(a)icann.org<mailto:marika.konings@icann.org>> Date: Tuesday, February 27, 2018 at 14:27 To: "gnso-rds-pdp-7(a)icann.org<mailto:gnso-rds-pdp-7@icann.org>" <gnso-rds-pdp-7(a)icann.org<mailto:gnso-rds-pdp-7@icann.org>> Subject: [Gnso-rds-pdp-7] ICANN61 Prep Assignment Dear Drafting Team 7, As those who were on today’s call heard, we have decided to take a week to prep for ICANN61 by working on a specific assignment in drafting team mode. Our team’s assignment is to reexamine our past output on Criminal Activity/ DNS Abuse Mitigation: https://community.icann.org/download/attachments/74580010/DraftingTeam7-Cri…<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_do…> to answer the following questions more explicitly and conceptually: 1. Who associated with the domain name registration needs to be identified and/or contacted for each purpose? 2. What is the objective achieved by identifying and/or contacting each of those entities? 3. What might be expected of that entity with regard to the domain name? To prep for ICANN61, it is imperative that we discuss these questions and produce output over the next week – ideally by 5 March but no later than 7 March. We know this is a tall order, give a short timeframe. However, the leadership believes that this will help us use our F2F time at ICANN61 more effectively, which I hope we all agree would be a terrific idea. To give us a head start, attached please find a first draft at answers, prepared by me from our past output, and raising a few potential gaps for discussion. To learn more about this assignment, please read these instructions: https://community.icann.org/download/attachments/79432608/Drafting%20Team%2…<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_do…>. If you were unable to attend today’s WG call, please catch up by reading or listening to the call recording/notes/transcript: https://community.icann.org/x/oAu8B[community.icann.org]<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_x_…>. To get started, please ask any questions you may have about this assignment within the next 24 hours. If you have any suggested edits or additions or deletions to the attached first draft, even better! I encourage you to share them in reply to this message, copying the DT mailing list gnso-rds-pdp-7(a)icann.org<mailto:gnso-rds-pdp-7@icann.org>. Thanks for doing what you can to help this drafting team come through on this new assignment. Best regards, Marika Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses[learn.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages[gnso.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

1 0

Re: [Gnso-rds-pdp-7] ICANN61 Prep Assignment
by Marika Konings March 7, 2018

March 7, 2018

Hi All, Just a quick reminder to please share your thoughts on the draft answers with the mailing list. Thanks, Marika From: Gnso-rds-pdp-7 <gnso-rds-pdp-7-bounces(a)icann.org> on behalf of Marika Konings <marika.konings(a)icann.org> Date: Tuesday, February 27, 2018 at 14:27 To: "gnso-rds-pdp-7(a)icann.org" <gnso-rds-pdp-7(a)icann.org> Subject: [Gnso-rds-pdp-7] ICANN61 Prep Assignment Dear Drafting Team 7, As those who were on today’s call heard, we have decided to take a week to prep for ICANN61 by working on a specific assignment in drafting team mode. Our team’s assignment is to reexamine our past output on Criminal Activity/ DNS Abuse Mitigation: https://community.icann.org/download/attachments/74580010/DraftingTeam7-Cri…<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_do…> to answer the following questions more explicitly and conceptually: 1. Who associated with the domain name registration needs to be identified and/or contacted for each purpose? 2. What is the objective achieved by identifying and/or contacting each of those entities? 3. What might be expected of that entity with regard to the domain name? To prep for ICANN61, it is imperative that we discuss these questions and produce output over the next week – ideally by 5 March but no later than 7 March. We know this is a tall order, give a short timeframe. However, the leadership believes that this will help us use our F2F time at ICANN61 more effectively, which I hope we all agree would be a terrific idea. To give us a head start, attached please find a first draft at answers, prepared by me from our past output, and raising a few potential gaps for discussion. To learn more about this assignment, please read these instructions: https://community.icann.org/download/attachments/79432608/Drafting%20Team%2…<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_do…>. If you were unable to attend today’s WG call, please catch up by reading or listening to the call recording/notes/transcript: https://community.icann.org/x/oAu8B[community.icann.org]<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_x_…>. To get started, please ask any questions you may have about this assignment within the next 24 hours. If you have any suggested edits or additions or deletions to the attached first draft, even better! I encourage you to share them in reply to this message, copying the DT mailing list gnso-rds-pdp-7(a)icann.org<mailto:gnso-rds-pdp-7@icann.org>. Thanks for doing what you can to help this drafting team come through on this new assignment. Best regards, Marika Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses[learn.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages[gnso.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

5 10

Re: [Gnso-rds-pdp-7] [Ext] RE: ICANN61 Prep Assignment
by Marika Konings March 5, 2018

March 5, 2018

Thanks, Marc. It looks like most others on the team are unable to weigh in prior to Puerto Rico. Would you be in a position to continue your line of thought for the identification / prosecution of a criminal? In relation to your proposed responses, instead of referring to the traditional roles, you may want to try and describe what you are looking for in the person(s) that you are trying to identify and/or contact in the response to question 1? Presumably in the victim notification use case you are looking for the person who is able to mitigate the abuse and as such is in control of the domain name registration or able to demonstrate ownership of the registration to reclaim control? Is it helpful/necessary to describe the type of abuse that is involved, e.g. whether the domain name registration is still under the control of the domain name registrant or whether control has been taken over by the abuser? Best regards, Marika From: "Anderson, Marc" <mcanderson(a)verisign.com> Date: Friday, March 2, 2018 at 15:53 To: Marika Konings <marika.konings(a)icann.org>, "gnso-rds-pdp-7(a)icann.org" <gnso-rds-pdp-7(a)icann.org> Subject: [Ext] RE: [Gnso-rds-pdp-7] ICANN61 Prep Assignment Marika, thanks for the recap of the assignment. I’ve been swamped as I’m sure the rest of you are, but I wanted to send out a few thoughts before we get into the weekend to try and kick start the conversation. Based on our discussions last time I’d say the answers to these questions depend on the use case. We identified a number of use cases but I think for these questions they can probably be divided between two categories. 1) RDS data used to notify a victim and 2) RDS data used to identify/prosecute a criminal. I know this is over simplifying things and ignores the gray area in between where (especially initially) it might not be know if the domain registrant is the victim or the abuser, but given the short time frame until ICANN 61, it might be helpful to frame our answers around those two scenarios. Any thoughts… does that sound reasonable? I’ll take a first pass at some answers for the victim notification use case (mostly because I think those will be easier to answer ☺ ). 1. Who associated with the domain name registration needs to be identified and/or contacted for each purpose? With traditional Whois data fields I would answer this by saying the Registrant, Admin and Technical contact. As I’m a proponent of trying not to think in terms of the legacy data fields (and like the roles based approach suggested by the EWG) I’d answer with the domain name owner and the admin, tech and abuse roles for the domain. Here I think “contact-ability” is key and so what’s important for this use case if having accurate and up to date information about how to contact someone with authority for the domain name is what is needed. 1. What is the objective achieved by identifying and/or contacting each of those entities? The objective seems to be basically stated in the use case: notify the domain name owner and/or someone with authority for the domain name of abuse associated with the domain name registration. 1. What might be expected of that entity with regard to the domain name? Here I think the expected action is for the domain name owner or person with authority for the domain name to take action to correct the abuse associated with the domain name. Hopefully I’m on the right track and that gets us started. Thanks, Marc From: Gnso-rds-pdp-7 <gnso-rds-pdp-7-bounces(a)icann.org<mailto:gnso-rds-pdp-7-bounces@icann.org>> on behalf of Marika Konings <marika.konings(a)icann.org<mailto:marika.konings@icann.org>> Date: Tuesday, February 27, 2018 at 14:27 To: "gnso-rds-pdp-7(a)icann.org<mailto:gnso-rds-pdp-7@icann.org>" <gnso-rds-pdp-7(a)icann.org<mailto:gnso-rds-pdp-7@icann.org>> Subject: [Gnso-rds-pdp-7] ICANN61 Prep Assignment Dear Drafting Team 7, As those who were on today’s call heard, we have decided to take a week to prep for ICANN61 by working on a specific assignment in drafting team mode. Our team’s assignment is to reexamine our past output on Criminal Activity/ DNS Abuse Mitigation: https://community.icann.org/download/attachments/74580010/DraftingTeam7-Cri…<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_do…> to answer the following questions more explicitly and conceptually: 1. Who associated with the domain name registration needs to be identified and/or contacted for each purpose? 2. What is the objective achieved by identifying and/or contacting each of those entities? 3. What might be expected of that entity with regard to the domain name? To prep for ICANN61, it is imperative that we discuss these questions and produce output over the next week – ideally by 5 March but no later than 7 March. We know this is a tall order, give a short timeframe. However, the leadership believes that this will help us use our F2F time at ICANN61 more effectively, which I hope we all agree would be a terrific idea. To give us a head start, attached please find a first draft at answers, prepared by me from our past output, and raising a few potential gaps for discussion. To learn more about this assignment, please read these instructions: https://community.icann.org/download/attachments/79432608/Drafting%20Team%2…<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_do…>. If you were unable to attend today’s WG call, please catch up by reading or listening to the call recording/notes/transcript: https://community.icann.org/x/oAu8B[community.icann.org]<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_x_…>. To get started, please ask any questions you may have about this assignment within the next 24 hours. If you have any suggested edits or additions or deletions to the attached first draft, even better! I encourage you to share them in reply to this message, copying the DT mailing list gnso-rds-pdp-7(a)icann.org<mailto:gnso-rds-pdp-7@icann.org>. Thanks for doing what you can to help this drafting team come through on this new assignment. Best regards, Marika Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses[learn.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages[gnso.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

1 0

ICANN61 Prep Assignment
by Marika Konings Feb. 27, 2018

Feb. 27, 2018

Dear Drafting Team 7, As those who were on today’s call heard, we have decided to take a week to prep for ICANN61 by working on a specific assignment in drafting team mode. Our team’s assignment is to reexamine our past output on Criminal Activity/ DNS Abuse Mitigation: https://community.icann.org/download/attachments/74580010/DraftingTeam7-Cri… to answer the following questions more explicitly and conceptually: 1. Who associated with the domain name registration needs to be identified and/or contacted for each purpose? 2. What is the objective achieved by identifying and/or contacting each of those entities? 3. What might be expected of that entity with regard to the domain name? To prep for ICANN61, it is imperative that we discuss these questions and produce output over the next week – ideally by 5 March but no later than 7 March. We know this is a tall order, give a short timeframe. However, the leadership believes that this will help us use our F2F time at ICANN61 more effectively, which I hope we all agree would be a terrific idea. To give us a head start, attached please find a first draft at answers, prepared by me from our past output, and raising a few potential gaps for discussion. To learn more about this assignment, please read these instructions: https://community.icann.org/download/attachments/79432608/Drafting%20Team%2…. If you were unable to attend today’s WG call, please catch up by reading or listening to the call recording/notes/transcript: https://community.icann.org/x/oAu8B. To get started, please ask any questions you may have about this assignment within the next 24 hours. If you have any suggested edits or additions or deletions to the attached first draft, even better! I encourage you to share them in reply to this message, copying the DT mailing list gnso-rds-pdp-7(a)icann.org<mailto:gnso-rds-pdp-7@icann.org>. Thanks for doing what you can to help this drafting team come through on this new assignment. Best regards, Marika Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<http://learn.icann.org/courses/gnso> and visiting the GNSO Newcomer pages<http://gnso.icann.org/sites/gnso.icann.org/files/gnso/presentations/policy-…>.

1 0

Re: [Gnso-rds-pdp-7] Notes and action items from today's DT7 meeting
by Marika Konings Nov. 14, 2017

Nov. 14, 2017

Per action item 1, I checked with my GAC colleagues and they indicated that these were the two main sessions during which GDPR / Purpose were discussed: https://schedule.icann.org/event/CbIF/gac-discussion-on-whoisrds-and-gdpr https://schedule.icann.org/event/CbIC/gac-public-safety-working-group-meeti… These links can be added as a reference to the DT’s final output? Best regards, Marika From: <gnso-rds-pdp-7-bounces(a)icann.org> on behalf of Marika Konings <marika.konings(a)icann.org> Date: Tuesday, November 7, 2017 at 11:07 To: "gnso-rds-pdp-7(a)icann.org" <gnso-rds-pdp-7(a)icann.org> Subject: [Gnso-rds-pdp-7] Notes and action items from today's DT7 meeting Dear All, Please find below the notes and action items from today’s meeting. Please look out for next iterations of the Criminal Investigation/DNS Abuse Mitigation Use Case & Purpose statement by Rod. As the turnaround time is short, please share your feedback as soon as possible with the mailing list. The objective is to finalise the draft by Thursday so it can be submitted to the full WG for review by Friday 10 November. Best regards, Marika ============ DT7 Meeting on Tuesday 7 November 2017 Notes: 1. Roll Call * On the call, Dick Leaning, Rod Rasmussen and Marc Anderson 2. Reactions to ICANN60 feedback – any edits that are required as a result? * See notes from F2F meeting in Abu Dhabi * Consider extracting discussion that was held with the GAC to annex. Action item #1: Staff to add links to relevant GAC sessions to the document as another venue in which similar use cases were discussed. 3. Edits to address action item from ICANN60 (see a-e below) * One purpose of multiple purposes? One high level purpose, or does it make sense to break it out in multiple purposes? * At least 3, but probably more: identification of a domain name has been registered maliciously, notification of certain action associated with abuse, risk assessment of domains (investigate, notify the appropriate party, automate reputation). Each of these need different data and have different actors involved so would warrant different purposes. * Further sub-categories may need to be identified to allow for differentiated access (roll-based access). * Need to distinguish between name that has been registered maliciously and a name that has been compromised? * Check EWG report as it identified a number of contact points in relation to criminal investigation. * Keep details but roll up to higher level statement. * Should focus be on existing data collected or future ones – latter, forward looking approach as per the WG charter. * Consider including the consequences of not providing consent so that it is clear to registrants of what may happen if they opt-out. Important for end-users to be able to make an informed decision also based on the consequences of no consent. Possible example for notification purpose: “The following information is collected for the purpose of enabling notification by regulatory authorities, law enforcement, cybersecurity professionals, IT administrators, automated protection systems and other incident responders of the appropriate party (registrant, providers of associated services, registrar, etc), of abuse linked to a certain domain name registration to allow for mitigation and resolution of the abuse identified: Registrant contact information, Registrar contact Information, DNS contact, etc.. The possible consequences of not collecting / allowing access to this information are: [include examples]. 4. Plan to complete drafting team’s work: a. Volunteer needed to apply final edits by Wednesday 8 Nov Action item #2: Rod Rasmussen will send current interim draft to DT for input today and will circulate additional draft purpose statements as completed, for DT review at the latest by COB Wednesday 8 November. Action item #3: All DT7 members to review and finalize output on Thursday 9 Nov Action item #4: Marika to submit final output to WG no later than Friday 10 Nov d. Volunteer needed to present to WG on 5.Tuesday 14 Nov call Rod Rasmussen will present the DT output during next week's WG meeting. 6. AOB/Adjourn Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses[learn.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages[gnso.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

2 1

Proposed roll-up purposes
by Rod Rasmussen Nov. 11, 2017

Nov. 11, 2017

I’m going to leave off the “consequences of not providing information" for now - that’s not part of the purpose. However, we should work on that separately and include that feedback as part of our final product. Investigation: The following information is to be made available to regulatory authorities, law enforcement, cybersecurity professionals, IT administrators, automated protection systems and other incident responders for the purpose of enabling identification of the nature of the registration and operation of a domain name linked to abuse and/or criminal activities to facilitate the eventual mitigation and resolution of the abuse identified: Domain metadata (registrar, registration date, nameservers, etc.), Registrant contact information, Registrar contact Information, DNS contact, etc.. Notification: The following information is collected and made available for the purpose of enabling notification by regulatory authorities, law enforcement, cybersecurity professionals, IT administrators, automated protection systems and other incident responders of the appropriate party (registrant, providers of associated services, registrar, etc), of abuse linked to a certain domain name registration to facilitate the mitigation and resolution of the abuse identified: Registrant contact information, Registrar contact Information, DNS contact, etc.. Reputation: The following information is to be made available to organizations running automated protection systems for the purpose of enabling the establishment of reputation for a domain name to facilitate the provision of services and acceptance of communications from the domain name examined: Domain metadata (registrar, registration date, nameservers, etc.), Registrant contact information, Registrar contact Information, DNS contact, etc.. We should chat more about the particulars here, but these cover the concepts. I would argue that the first and third are purely a “display” purpose, but the second could be used as justification of collection. If nothing else, collecting an “abuse contact” requires number two for justification at all. Cheers, Rod

4 11

Fwd: [gnso-rds-pdp-wg] Final Deliverable from DT6, Legal Actions
by Richard Leaning Nov. 11, 2017

Nov. 11, 2017

This and group 5 findings are very similar to ours. Richard Leaning External Relations RIPE NCC Begin forwarded message: > From: "Chuck" <consult(a)cgomes.com> > Date: 8 November 2017 at 22:48:47 GMT > To: <gnso-rds-pdp-wg(a)icann.org> > Cc: gnso-rds-pdp-6(a)icann.org > Subject: [gnso-rds-pdp-wg] Final Deliverable from DT6, Legal Actions > > Here is the final deliverable for Drafting Team 6 for the Legal Actions Purpose/Use Case. DT6 will provide an overview of this in the 14 November WG meeting. In addition, DT6 concurs with a suggestion made by DT5 that the WG may want to consider combining Legal Actions with the Regulatory Purpose/Use Case because they largely overlap.” > > Chuck > _______________________________________________ > gnso-rds-pdp-wg mailing list > gnso-rds-pdp-wg(a)icann.org > https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg

1 0

Notes and action items from today's DT7 meeting
by Marika Konings Nov. 8, 2017

Nov. 8, 2017

Dear All, Please find below the notes and action items from today’s meeting. Please look out for next iterations of the Criminal Investigation/DNS Abuse Mitigation Use Case & Purpose statement by Rod. As the turnaround time is short, please share your feedback as soon as possible with the mailing list. The objective is to finalise the draft by Thursday so it can be submitted to the full WG for review by Friday 10 November. Best regards, Marika ============ DT7 Meeting on Tuesday 7 November 2017 Notes: 1. Roll Call * On the call, Dick Leaning, Rod Rasmussen and Marc Anderson 2. Reactions to ICANN60 feedback – any edits that are required as a result? * See notes from F2F meeting in Abu Dhabi * Consider extracting discussion that was held with the GAC to annex. Action item #1: Staff to add links to relevant GAC sessions to the document as another venue in which similar use cases were discussed. 3. Edits to address action item from ICANN60 (see a-e below) * One purpose of multiple purposes? One high level purpose, or does it make sense to break it out in multiple purposes? * At least 3, but probably more: identification of a domain name has been registered maliciously, notification of certain action associated with abuse, risk assessment of domains (investigate, notify the appropriate party, automate reputation). Each of these need different data and have different actors involved so would warrant different purposes. * Further sub-categories may need to be identified to allow for differentiated access (roll-based access). * Need to distinguish between name that has been registered maliciously and a name that has been compromised? * Check EWG report as it identified a number of contact points in relation to criminal investigation. * Keep details but roll up to higher level statement. * Should focus be on existing data collected or future ones – latter, forward looking approach as per the WG charter. * Consider including the consequences of not providing consent so that it is clear to registrants of what may happen if they opt-out. Important for end-users to be able to make an informed decision also based on the consequences of no consent. Possible example for notification purpose: “The following information is collected for the purpose of enabling notification by regulatory authorities, law enforcement, cybersecurity professionals, IT administrators, automated protection systems and other incident responders of the appropriate party (registrant, providers of associated services, registrar, etc), of abuse linked to a certain domain name registration to allow for mitigation and resolution of the abuse identified: Registrant contact information, Registrar contact Information, DNS contact, etc.. The possible consequences of not collecting / allowing access to this information are: [include examples]. 4. Plan to complete drafting team’s work: a. Volunteer needed to apply final edits by Wednesday 8 Nov Action item #2: Rod Rasmussen will send current interim draft to DT for input today and will circulate additional draft purpose statements as completed, for DT review at the latest by COB Wednesday 8 November. Action item #3: All DT7 members to review and finalize output on Thursday 9 Nov Action item #4: Marika to submit final output to WG no later than Friday 10 Nov d. Volunteer needed to present to WG on 5.Tuesday 14 Nov call Rod Rasmussen will present the DT output during next week's WG meeting. 6. AOB/Adjourn Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses<http://learn.icann.org/courses/gnso> and visiting the GNSO Newcomer pages<http://gnso.icann.org/sites/gnso.icann.org/files/gnso/presentations/policy-…>.

3 2

AC Recording, attendance & AC chat from Next-Gen RDS drafting team #7:Criminal Investigation or DNS Abuse Mitigation call on Tuesday, 07 November 2017 16:00 UTC
by Michelle DeSmyter Nov. 7, 2017

Nov. 7, 2017

Dear all, Please find below the Adobe Connect recording, chat and attendance from the Next-Gen RDS drafting team #7:Criminal Investigation or DNS Abuse Mitigation call on Tuesday, 07 November 2017 at 16:00 UTC. Adobe Connect recording: https://participate.icann.org/p9qxcaro729/ Attendance: Dick Leaning, Rod Rasmussen, Marc Anderson Apologies: Kiran Malancharuvil Staff: Marika Konings, Michelle DeSmyter Thank you. Kind regards, Michelle Adobe Connect Chat: Michelle DeSmyter:Welcome to the Next-Gen RDS Drafting team #7: Criminal Investigation or DNS Abuse Mitigation on Tuesday, 07 November 2017 at 16:00 UTC. Dick Leaning:afternoon guys Dick Leaning:do we ever get a day off ;-( Michelle DeSmyter:Hi there Dick, welcome! Marika Konings:Not at ICANN! ;-) Dick Leaning:lol Dick Leaning:its just not the ICANN way, right Marika Konings:Sorry for being late - am waiting for my dial out to come through. Marika Konings:For some reason there is no dial in number for Costa Rica with Verizon. Rod Rasmussen:Still waiting for an operator to let me on the call Marc Anderson:Still dialing in here as well Michelle DeSmyter:I will alert them. that you are both dialing in, Dick Leaning:ok - get it Rod Rasmussen:I don't think we have just one - at least 3, but probably more. Dick Leaning:investigation? rod Dick Leaning:where would that sort of fall Dick Leaning:in the bundle Dick Leaning:Notification? Marika Konings:I've noted them on the right hand side Marika Konings:At least 3, but probably more: identification of a domain name has been registered maliciously, notification of certain action associated with abuse, risk assessment of domains. Rod Rasmussen:Investigate, notify, automate reputation Dick Leaning:ok Rod Rasmussen:Investigate is ALL investigation, not just criminal Dick Leaning:i was just about to say that Rod Rasmussen:notify is notify the appropriate party (registrant, hoster, registrar, etc.) Rod Rasmussen:You can argue that identify is part of investigate Dick Leaning:lets not use criminal as word Dick Leaning:in this Marika Konings:"The following information is collected for the purpose of enabling notification by law enforcement, cybersecurity professionals and IT administrators of the appropriate party (registrant, hoster, registrar, etc), of abuse linked to a certain domain name registration to allow for mitigation and resolution of the abuse identified: [add data elements] Dick Leaning:we need capture the spirt tha there are others Dick Leaning:yes Rod Rasmussen:Instead of "hoster" use "providers of associated services" Rod Rasmussen:That would cover hosting, email, DNS, and other things that may be being abused. Rod Rasmussen:Yes Marc - for example, DNS contact Rod Rasmussen:SSAC is likely to propose that a future RDS have that for operational issues around DNSSEC for example but would also be applicable for some abuse issues. Marika Konings:Present the consequences of not giving consent? Dick Leaning:yep Dick Leaning:great Dick Leaning:bye buye

1 0

Re: [Gnso-rds-pdp-7] Next deliverable expected by Friday 10 November
by Marika Konings Nov. 6, 2017

Nov. 6, 2017

Hi All, You should have received an invitation by now for the next DT7 meeting which has been scheduled for Tuesday 7 November at 16.00 UTC. Unfortunately, it was not possible to find a time that would work for all those that responded to the doodle poll, but hopefully having the meeting tomorrow will allow for enough time for those that cannot make the call to weigh in on the mailing list before the due date. The proposed agenda for tomorrow’s meeting is as follows: 1. Roll Call 2. Reactions to ICANN60 feedback – any edits that are required as a result? 3. Edits to address action item from ICANN60 (see a-e below) 4. Plan to complete drafting team’s work: * Volunteer needed to apply final edits by Wednesday 8 Nov * All DT7 members to review and finalize output on Thursday 9 Nov * Marika to submit final output to WG no later than Friday 10 Nov * Volunteer needed to present to WG on Tuesday 14 Nov call 5. AOB/Adjourn Best regards, Marika From: <gnso-rds-pdp-7-bounces(a)icann.org> on behalf of Marika Konings <marika.konings(a)icann.org> Date: Thursday, November 2, 2017 at 09:58 To: "gnso-rds-pdp-7(a)icann.org" <gnso-rds-pdp-7(a)icann.org> Subject: [Gnso-rds-pdp-7] Next deliverable expected by Friday 10 November Hello DT7, Thank you all for your contributions this week. I know you are eager to get some rest after an intense ICANN meeting, but the next DT’s task already awaits. From the presentation that was provided during the 1 November meeting (see ICANN60 RDS PDP F2F v6.PDF[community.icann.org]<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_do…>): Next Steps and Action items Continue Drafting Teams through next week to address these points: 1. Summarize each purpose in one sentence: “Information collected to enable contact between the registrant and <who> <to accomplish what>” 2. Think in terms of explaining to the data subject why data is being collected for this purpose – keep it concise and simple. 3. Are the tasks/users identified by your team so diverse and distinct that they may be more than one purpose? If so, split them up and describe each purpose separately. 4. Which purposes covered by other teams are closely related to or overlap the purpose(s) covered by your team? 5. Is there any data collected specifically for the stated purpose? Or does that purpose use only data collected for other purposes? Action: Drafting teams to deliver final outputs by Friday 10 November Action: Drafting teams to present results to full WG on 14 Nov call I’ll work with the GNSO-Secs team to get a doodle set up for next week to find a time to discuss. However, if someone has a long flight ahead of them and would like to take a first stab at answering these questions, you are of course more than welcome! As a reminder, you will find the latest version of the DT7 output attached. Thanks, Marika Marika Konings Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) Email: marika.konings(a)icann.org<mailto:marika.konings@icann.org> Follow the GNSO via Twitter @ICANN_GNSO Find out more about the GNSO by taking our interactive courses[learn.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses…> and visiting the GNSO Newcomer pages[gnso.icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gn…>.

1 0