- gnso-rds-pdp-purpose - lists.icann.org

3 final purpose summaries
by Kathy Kleiman April 21, 2016

April 21, 2016

Hi All, These are fairly short and sweet: -- Current documents on our list: 1. European Commission Website: Obligations of Data Controllers <http://ec.europa.eu/justice/data-protection/data-collection/obligations/ind…> 2. Privacy & Information Security Law Blog: Article 29 Working Party Clarifies Purpose Limitation Principles <https://www.huntonprivacyblog.com/2013/04/09/article-29-working-party-clari…><https://www.huntonprivacyblog.com/2013/04/09/article-29-working-party-clari…> -- Additional document for our list (found in the work above): 3. European Commission Website: Definition Data Controllers All attached as summaries. Best, Kathy

1 0

Purpose Team Checklist - 20 April
by Lisa Phifer April 20, 2016

April 20, 2016

1 0

Team outputs - Summaries
by Susan Kawaguchi April 20, 2016

April 20, 2016

During the 20 April RDS PDP WG call, each team will be asked to report on its progress and share preliminary thoughts about the questions posed during last week?s WG call. To kick-start this discussion, I ask that each of you try to answer this question: Which top 5 inputs summarized by this team are likely to be the most helpful to this PDP and why? For example, does the input define potential requirements that this WG should take into consideration during phase 1 of this PDP? Does the input identify dependencies that will shape our work plan? The following are personal choices and I am using these as an example of what we need to discuss BUT each sub team member needs to provide their input. WHOIS Policy Review Team Final Report<https://www.icann.org/en/system/files/files/final-report-11may12-en.pdf> (2012) SAC055, WHOIS: Blind Men and an Elephant<https://www.icann.org/en/system/files/files/sac-055-en.pdf> (September 2012) EWG Recommendations for a Next-Generation RDS<https://www.icann.org/en/system/files/files/final-report-06jun14-en.pdf>, especially - Section 3, Users and Purposes - Annex C, Example Use Cases Annex A, Board Questions Registrar Accreditation Agreement<https://www.icann.org/resources/pages/approved-with-specs-2013-09-17-en> (2013) Our team will have an opportunity to share initial answers during the WG call. Please reply to this list today with your own initial thoughts so that we can prepare to contribute to discussion during the WG call. We will not be expected to have a team-agreed answer this week, but we need to at least begin this discussion.Gnso-rds-pdp-purpose(a)icann.org <Gnso-rds-pdp-purpose(a)icann.org> Looking forward to a lively discussion. Susan Kawaguchi Domain Name Manager Facebook Legal Dept.

7 8

Purpose Team Summaries - Single PDF - 19 April
by Lisa Phifer April 20, 2016

April 20, 2016

Dear purpose team, Attached please find a single PDF containing all of the summaries drafted by members of the purpose team thus far. Hopefully I have faithfully copied in all of your summaries, listed in the same order as they appear in the purpose team checklist. For each summary, the "Title" or "Correspondence" is hyperlinked to the orginal document being summarized, while "Summarized by" is hyperlinked to the data team email message from which the summary was copied. Best, Lisa Ps. For those of you also on the privacy team...yep, I'm working on that PDF as well...

1 0

Purpose Team Checklist - 19 April 13:00
by Lisa Phifer April 19, 2016

April 19, 2016

1 0

new doc summary: "Advisory on Utilization of Whois Data For Phishing Site Take Down."
by Greg Aaron April 19, 2016

April 19, 2016

This is another new doc that is not on our current list, but should be added. --Greg "Advisory on Utilization of Whois Data For Phishing Site Take Down." Anti-Phishing Working Group. March 2008 http://docs.apwg.org/reports/apwg-ipc_Advisory_WhoisDataForPhishingSiteTake… "Given fundamental policy changes regarding accessibility of both domain and IP Whois data currently under consideration by ICANN, RIPE and others, and the evolving environment surrounding the Whois system, the APWG Internet Policy Committee (IPC) has updated this industrial advisory, comprised of a set of real-world case studies in which Whois data has been instrumental in neutralizing phishing sites in order to help ICANN, RIPE and others comprehensively inform their policy deliberations. The intent is to better inform the broader internet policy community of the invaluable assistance the full range of Whois data provides in shutting down nearly 1,000 phishing sites per day (and climbing) at current rates.... In a majority of phishing cases, published Whois data of the domain name(s) and Internet Protocol (IP) network addresses involved have been irreplaceable components of the take down process -- invaluable resources, in fact, necessary to the resolution of most of the cited cases. For cases in which legitimate machines or services have been hacked or defrauded, published domain name or IP network address Whois information is an important tool used to quickly locate and communicate with site owners and service providers. For cases in which domain names are fraudulently registered, the published domain name Whois information can often be tied to other bogus registrations or proven false to allow for quick shut down.... It is the hope of the APWG's IPC that exposure to this information and the following case studies will allow the relevant committees of ICANN, RIPE and other governance bodies to make better informed decisions on Whois policy and promote policy modifications that will not result in reduced access to Whois data for those who use it to respond to phishing events.... In all, over 80% of phishing site take-downs involve using the domain name Whois system to find a contact for assistance via e-mail, phone and/or fax, or to prove the registration to be fraudulent through any or all portions of the available Whois information."

1 0

summary of new document: U.S Government General Accounting Office
by Greg Aaron April 19, 2016

April 19, 2016

This is a new doc that is not on our current list, but should be added. --Greg "INTERNET MANAGEMENT: Prevalence of False Contact Information for Registered Domain Names." United States Government Accountability Office. Report to the Subcommittee on Courts, the Internet, and Intellectual Property, U.S. House of Representatives. November 2005. http://www.gao.gov/assets/250/248452.pdf "The Whois service was originally intended as a source of contact information that technicians could use to reach each other when necessary to troubleshoot problems with Internet connectivity or functionality. However, users of the Whois service have broadened over time to include law enforcement officials, owners of intellectual property, and others seeking contact information about Web site owners for a variety of reasons." (page 4) "Created in the 1970s, Whois began as a service that Internet operators could use to identify and contact individuals or entities responsible for the operation of a computer on the Internet when an operational problem arose. Since then, the Whois service has evolved into a tool used for many purposes, such as determining whether a domain name is available for registration, identifying the source of spam e-mail, enforcing intellectual property rights, and identifying and verifying online merchants." (page 19) "Data accuracy is important to the effectiveness of the Whois service in helping Internet operators to resolve technical network issues, as well as helping law enforcement officers to investigate such things as intellectual property misuse or online fraud. According to federal agency officials, accurate Whois data have the potential to allow law enforcement officials to identify individuals involved in criminal activities on the Internet more quickly than if such information were not available." (page 20)

1 0

Fwd: Consolidate Summaries and Complete Team Outputs
by Susan Kawaguchi April 18, 2016

April 18, 2016

Hello All I don't think anyone received this sending again with the correct email address. Lisa can you confirm you received it? Sent from my iPhone Begin forwarded message: From: Susan kawaguchi <susank(a)fb.com<mailto:susank@fb.com>> Date: April 16, 2016 at 4:20:10 PM GMT+1 To: "gnso-rds-pdp-purpose-bounces(a)icann.org<mailto:gnso-rds-pdp-purpose-bounces@icann.org>" <gnso-rds-pdp-purpose-bounces(a)icann.org<mailto:gnso-rds-pdp-purpose-bounces@icann.org>> Subject: Consolidate Summaries and Complete Team Outputs Thank you all for continuing to finish up the document summaries. We are almost complete on that part of our work. As we discussed on the last call we need to move on to consolidate the summaries and agree on the input and answer the questions in (b.) below. Lisa has kindly updated our documents as of yesterday and provided links below: Today's purpose team checklist (attached) has been posted to the wiki at: https://community.icann.org/x/p4xlAw <https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_x_…>Just one new doc added to the list, already assigned. Everyone should now be reviewing the summaries already submitted, thinking about questions posed to each team in https://community.icann.org/x/iTeAAw<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_x_…> You are encouraged to share possible purpose team answers to these questions on this list. For easy review of email threads, see this list's archive: http://mm.icann.org/pipermail/gnso-rds-pdp-purpose/<https://urldefense.proofpoint.com/v2/url?u=http-3A__mm.icann.org_pipermail_…> Plan to Consolidate Summaries and Complete & Present Team Outputs: In the near-term, team outputs will inform finalization of the WG’s work plan and early outreach to SO/ACs and GNSO SG/Cs – tasks required at the start of every GNSO PDP WG. Longer-term, team outputs will help the full WG find and absorb relevant input documents to inform its deliberations. To achieve both these objectives, the leadership team proposes the following next steps: a. Staff to update team checklists to track all summaries as they are submitted and consolidate those summaries (with hyperlinks to each input and email) into a single PDF per team. b. Each team to consider that consolidated PDF to address the following questions: (i) Did this input inventory produce any insights to inform the WG’s work plan? (ii) Which inputs are likely to be the most important during WG deliberations and why? (iii) Which inputs generated the most discussion within the small team? (iv) Which inputs may be obsolete or super-ceded by subsequent work? (v) Is the input list complete? If not, what gaps should be addressed later? (vi) Other key takeaways from this input inventory the team wishes to share with the WG c. Each team to discuss the above questions via email over the next week and present their draft answers to the full WG during the 20 April WG call. d. Each team to use input lists, summaries, and answers to these questions complete their team’s output template before the end of April. That output will be available for reference as the full WG returns to finalizing its Phase 1 work plan and initial outreach message, and during the WG’s Phase 1 deliberations to follow. Please review the summaries that are submitted and answer the questions in (b). Hoping to complete this via email discussion but if you think we should schedule a call to discuss please let me know. Thanks again, Susan Kawaguchi Domain Name Manager Facebook Legal Dept.

3 2

Purpose Team Checklist - 18 April 13:00
by Lisa Phifer April 18, 2016

April 18, 2016

Dear purpose team, Today's updated purpose team checklist is attached and also posted to the wiki at: https://community.icann.org/x/p4xlAw Please refer to Susan's email for next-step instructions: http://mm.icann.org/pipermail/gnso-rds-pdp-purpose/2016-April/000070.html Best, Lisa

1 0

Purpose Document Review: EWG Tutorial & FAQ
by Prosser, Susan April 15, 2016

April 15, 2016

Hello team, Sincere apologies for the tardiness of the two of the final review documents. Below are the EWG Tutorial and FAQ content related to Purpose. EWG Tutorial, Pages 17-20, 37-41 http://london50.icann.org/en/schedule/mon-ewg-final-overview/presentation-e… Associated audio & transcript: http://audio.icann.org/meetings/london2014/ewg-final-overview-23jun14-en.mp3 https://london50.icann.org/en/schedule/mon-ewg-final-overview/transcript-ew… Page 17 This page presents the purposes surfaced through EWG work. It is noted in the audio and on the presentation the purposes presented may not meet *all* use cases. Any solution must be flexible to allow for future purpose needs. Page 18 Recognition is made every permissible purpose as data needs, but they vary. Some may be widely used with minimal control standards whereas others will require higher scrutiny and authority for access. Also introduced are the potential provisions for whowas (history) or reverse (related domains) queries. Page 19 Purpose based contact (PBC) is a proposal to offer better control of personal information and more efficient portability of contact data. Page 20 Workflow example of Gate access in a legal action is presented. It walks through how the process would operate with authentication service. If the requestor was authorized for access and to what level, then provide data only relevant to their need and their approval level. Page 21 Presentation page contains what could be in PBC data, noting that PBC may still be a proxy service. It offers users choices to determine what they want for contact information, what information willing to share at what level, and ability to update information once not across multiple platforms. (not on audio or transcript I could find): Page 38 Provides a chart with identified Purpose and associated Task for each. Page 39 Purposed Based Contacts (PBC) examples are provided as backup to the presentation. The EWG supplied three specific examples of use as Individual using own data, Individual or Org using a Privacy service and a Business using 3rd party PBC. Page 40 The table of Purposes and Needs is provided as backup to the presentation. The table defines the query scope, type of contacts needed based on purpose, registrant data availability level and other queries that may be needed for specific purposes, such as Reverse and WhoWas. Page 41 The PBC and their responsibilities are defined and provided as backup to the presentation. These are the proposed referenced throughout the presentation. ~~~~~ Expert Working Group on gTLD Directory Services (EWG) Frequently Asked Questions (FAQs) – 2014 Final Report Update https://community.icann.org/display/EWG/EWG+FAQs Five (5) FAQ’s specifically addressed Purpose, captured below. (Page 5) *Registration Data Users and Purposes * 9) Who are the users of the RDS? How did the EWG determine this? The EWG analyzed previous reports and use cases to identify users who want access to gTLD registration data, including registrants, protected registrants, on-line service providers, business Internet users, intellectual property owners, law enforcement agencies and OpSec staff, Internet technical staff, individual Internet users, Internet researchers, non-LEA investigators of malicious activity, the general public, and bad actors. 10) Why do those users need access to registration data? Use cases also shed light on rationale and purposes served by gTLD registration data, including domain name control, regulatory/contract enforcement, academic/public interest domain name research, domain name purchase/sale, personal data protection, individual Internet use, technical issue resolution, domain name certification, legal action, regulatory and contractual enforcement, criminal investigation and DNS abuse mitigation, DNS transparency, and malicious Internet activities. 11) Which purposes should not be permissible? Given no rationale for accommodating the needs of some users but not others that access WHOIS today, the EWG recommended the RDS accommodate all non-malicious uses. 12) Why didn’t the EWG consider user X or purpose Y? Use cases examined by the EWG were not exhaustive, but representative enough of existing and potential uses to establish RDS needs. The EWG also recommended a process for adding new purposes as may be required to address future global Internet needs. 67) How will members of the press and bloggers gain access to RDS data? The DNS Transparency purpose was intended to cover media needs for registration data. However, if the data available for that permissible purpose does not prove sufficient, the EWG also recommended an on-going process for users to suggest new permissible purposes. ~~~~ Susan Prosser VP, Client Services DomainTools, LLC T: (206) 838-9060 E: susan(a)domaintools.com PGP: A2C4D2A4

1 0