Dear All, Please find the attendance of the call attached to this email and the MP3 recording below for the Next-Gen RDS PDP Working group call held on Tuesday, 25 April 2017 at 16:00 UTC. MP3: http://audio.icann.org/gnso/gnso-nextgen-rds-pdp-25apr17-en.mp3 AC recording: https://participate.icann.org/p49hhqnpgvv/ The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: http://gnso.icann.org/en/group-activities/calendar<https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_en_group-2Dactivities_calendar-23nov&d=DwMF-g&c=FmY1u3PJp6wrcrwll3mSVzgfkbPSS6sJms7xcl4I5cM&r=PDd_FX3f4MVgkEIi9GHvVoUhbecsvLhgsyXrxgtbL10DTBs0i1jYiBM_uTSDzgqG&m=GJMkY4Fbi9sry9Z53DaSWJm-mHxMfFxg7MEVDf2JU90&s=FI3QJYH6DWWCDQir6NDMSjPkzdqfTTUmf9Ua-AYpc14&e=> ** Please let me know if your name has been left off the list ** Mailing list archives:http://mm.icann.org/pipermail/gnso-rds-pdp-wg/ Wiki page: https://community.icann.org/x/DcPRAw Thank you. Kind regards, Michelle ——————————————— AC Chat Next-Gen RDS PDP WG Tuesday, 25 April 2017 Michelle DeSmyter:Dear all, welcome to the GNSO Next-Gen RDS PDP Working Group call on Tuesday 25 April 2017 at 16:00 UTC. Michelle DeSmyter:Meeting agenda page: https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_x_D... Michelle DeSmyter:We would like to introduce Julie Bisland as GNSO SO/AC Support coordinator. She has started training with us this week. Lisa Phifer:Welcome Julie! Julie Bisland:Thank you! Chris Pelling:afternoon all Maxim Alzoba (FAITID):Hello All Michelle DeSmyter:Hello, Welcome! :) Maxim Alzoba (FAITID):yes, adobe audio works Juan Manuel Rojas:Hi everyone.. I will be hearing through AC Ayden Férdeline:Hi all Nathalie Coupet:Hi Andrew Sullivan:im on The mobile app & already had connectivity problems so if I drop I apologize Chuck Gomes:Hello Farell FOLLY (Africa 2.0):hello Michael Hammer:Hello everyone. Sam Lanfranco:Sound good! Jim Galvin (Afilias):Jim just joined Adobe. Leaving audio bridge. Was working without power here and it just got restored! Michael Hammer:I use the audio bridge for speech because Adobe drops out for me and can take a minute or so to recover. Jim Galvin (Afilias):@michael - fortunately for me that's normally not a problem. Lisa Phifer:When are WG comments on draft questions expected? Susan Kawaguchi:Thanks Lisa for asking by the next meeting. I will make sure that is clear in the email to the WG Lisa Phifer:We still need a definition for a term to reflect the concept that the WG was trying to reflect in the purpose statement Susan Kawaguchi:Welcome Julie! Lisa Phifer:We are holding off re-polling on that purpose (from the purpose sattement) pending the definition of "authoritative" or a replacement term Scott Hollenbeck (Verisign):@Lisa: one possibility: definitive Andrew Sullivan:I had a few different formulations, and can send to the list. (Sorry I keep Andrew Sullivan:dropping. AC seems to hate me today) David Cake:Please, Andrew, that woudl be very helpful Lisa Phifer:It would be helpful if the small team can consolidate your thoughts before sending to full WG to make feedback more efficient Andrew Sullivan:I think this approach is a good one. Disagree strongly about thick vs thin. Jim Galvin (Afilias):+1 to andrew's comment, i.e., address the thin access issue separate from the thick access issue. Maxim Alzoba (FAITID):note: open access to persons data helps criminals too Jim Galvin (Afilias):+1 to maxim's comment - it is a double edged sword - data can be used for good or bad so we need to be careful not to give too much weight to either side of the discussion. Alex Deacon:i'm pretty sure we are not on the "open access" path.... Maxim Alzoba (FAITID):I hope so Lisa Phifer:The goal of deliberation is to share different perspectives and attempt to derive agreements that strike a balance. Our process is structured to facilitate that, but it is a difficult task that will require compromise Volker Greimann:I am not sure that this is a game or should be treated as such Volker Greimann:and legal requirements are not subject to stakeholder negotiations Lisa Phifer:Charter: https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_dis... Farell FOLLY (Africa 2.0):Agree with Lisa Farell FOLLY (Africa 2.0):+1 Lisa Lisa Phifer:GNSO PDP Process: https://urldefense.proofpoint.com/v2/url?u=http-3A__www.icann.org_en_about_g... Amr Elsadr:@Andrew: On your comment of bundling collection and processing of data; in the answers to the question provided by the data protection experts, they answered several questions on data collection in the context of purpose of processing the data. So they might agree with you. :-) Chris Pelling:Sorry to say, the Law comes first as we cannot break it. Maxim Alzoba (FAITID):doing good by reaching the law is illegal though Maxim Alzoba (FAITID):*breaching Paul Keating:That is a silly statement Chris Pelling:@Paul - which statement ? Ayden Férdeline:Michael, is the insinuation that privacy advocates are here for money? I’m not otherwise sure what you mean when you say you “question what [privacy advocates] are doing because for many of us it is not simply about money.” Volker Greimann:We will put privacy law ahead of security Maxim Alzoba (FAITID):I hope it is not the suggestion to limit EU access to the internet :) Volker Greimann:because we are law abiding operators Volker Greimann:if you want us to put security ahead of privacy laws, we need a different law, so lobbying to governments is necessary Lisa Phifer:The process framework developed for this PDP directs us to deliberate on all 5 fundamental questions before trying to answer the WHOIS or NextGen question. It was hoped that by establishing requirements in all 5 areas, the WG could look at the totality of those requirements to break through the historical impasse. The answer will have to balance requirements, but we cannot strike a balance without understanding requirements across all areas. Paul Keating:BUT the EU privacy laws are NOT global. Chris Pelling:actually Paul, the "user data" is gloval Chris Pelling:global * Paul Keating:Sorry but we are all not on the same page/. Volker Greimann:Pauul: You are mistaken. They apply globally to every operator dealing with European customers Volker Greimann:(for those customers) Chris Pelling:Paul, it is very simple, GDPR is here - you arent going to get around it Nathalie Coupet:How can we conciliate Allison's view (no change, just switch to RDAP json format) with privacy concerns to obtain a negotiated solution? Maxim Alzoba (FAITID):formally saying that local laws should be violated ... is illegal too Nathalie Coupet:Why should Allison want to compromise if it will make her job more difficult/impossible? Paul Keating:Volker, you are mistaken. Laws are jurisdictional only. They apply inside the country having adopted them. The countries may try to enforce the laws by use of force based upon assets contained inside their countries but not more Ayden Férdeline:Nathalie, how do you feel about exposing the name, address and phone number of innocent individuals to criminals on the global Internet, along with the information about their interests which may be gleaned from registration data? Michael Hammer:It's not jsut about the EU. Basically, if you are saying complying with local laws, you are saying that it is the lowest common denominator that we end up. Volker Greimann:Paul: You may want to re-read European data privacy regulations then Alex Deacon:But to be clear GDPR does not say that the users right to privacy trumps all others....its a balance. We need to find the right balance..... Volker Greimann:local law is not sufficient. Applicable law is the one we need to heed Chris Pelling:So Paul, as a director of DomainTools, are you going to comply with GDPR or not ? Nathalie Coupet:@Ayden: How is that more serious than preventing the cybersecurity sector to do its job? I believe this is equally serious. Ayden Férdeline:More countries have privacy and data protection laws than just those within the EU. Myanmar passed a similar law last month, for instance... Volker Greimann:Some reading on the topic: https://urldefense.proofpoint.com/v2/url?u=http-3A__safedatamatters.com_gdpr... Volker Greimann:TL;DR: GDPR sets out rules for non-EU data controllers who do business with data subjects in the EU Volker Greimann:It doesn’t matter where your company is based. If you do business with data subjects in the EU then you need to comply with EU regulation. Chris Pelling:So Paul, as a director of DomainTools, are you going to comply with GDPR or not ? Farell FOLLY (Africa 2.0):+1 Volker Chris Pelling:lots of echo Maxim Alzoba (FAITID):I am afraid , that not many of us will be here after our companies paying 20M EUR fines Fabricio Vayra:Re: Privacy -- Reminder that the EWG recommended a system that enabled compliance with applicable laws while still allowing controlled access to data to meet the needs of each purpose. I bring this up as my continuing theme of not recreating the wheel. Maxim Alzoba (FAITID):Note: I do not think that we are in the position to set rules for the governments worldwide Michael Hammer:+1 Paul Volker Greimann:@Paul: Se we now get to decide which laws and regulations apply to us? That would be very interesting but sadly, the real world has different thoughts. Lisa Phifer:It is possible to adopt requirements that are qualified with "subject to applicable law" (the EWG took this approach) Ayden Férdeline:@Nathalie: Much of the cybersecurity sector with which you refer does not consist of law enforcement. I would also note that private investigators are often not bound to the same ethical or operational rules and regulations with which law enforcement must comply with. David Cake:We have to create a system that is flexible enough for registrtars to comply woth local laws. We do not get to pick and choose which laws we like. Theo Geurts:Paul or we agree to the right of privacy as set out by the united nations, article 12 and stop the discussion. wich is going to be part of the ICANN bylaws Ayden Férdeline:+1 David Volker Greimann:@David: Applicable law! Chris Pelling:+1 to David and Theo Fabricio Vayra:Again, we wresteled with this for months within the EWG. Perhaps look there? Ayden Férdeline:@Paul: 109 countries have privacy laws, not just the EU... Michael Hammer:To what Paul said. I'm looking for a throat to choke. You want to hide behind a private registration service then they should be held accountable for your actions. Alex Deacon:we must ensure the ability for both civil and legal investigators have the means to access some TBD set of whois data. Chris Pelling:Can someone please turn off their speackers as there is echo Maxim Alzoba (FAITID):if investigators breach some of local laws ... they join the other side Andrew Sullivan:to me, the answer is "both". it should be public, but controls for access should be available to limit rates and so on Volker Greimann:@Paul: We are talking about thin data now! Lisa Phifer:COMMENT from Vicky Scheckler who could not make today's call: based on the discussion we’ve had to date, I believe all thin whois data should be publicly available as it is either not personally identifiable information, or, in extreme edge cases (such as a long domain name that includes personal information), then it is clear that that individual has chosen to make such information public. Alex Deacon:there are systems already in place for investigators who breach local laws. Volker Greimann:We can all believe in church... Volker Greimann:this is not about belief Jim Galvin (Afilias):sorry come back to me Jim Galvin (Afilias):here is my comment Scott Hollenbeck (Verisign):+1 Andrew Roger Carney:+1 Andrew, but with the caveat that we are defining "thin data" which may or may not the exact definition that people use today Farell FOLLY (Africa 2.0):Thin data can be made public, but access can be controlled to limit rate, etc.. Jim Galvin (Afilias):I want to tease the question into two parts. First, I think that thin data should be openly available to any requestor. However, with respect to "control", I want to be careful not to exclude the fact that service providers are permitted to take steps to mitigate abusive queries. Scott Hollenbeck (Verisign):+1 Jim Alex Deacon:+1 Jim Chris Pelling:+1 Jim Volker Greimann:That is why the data of the publisher belongs on the website. We Europeans have good laws and having a legal notice on the website is one of them Nathalie Coupet:+1 Marina Michael Hammer:+1 Marina Volker Greimann:Regarding the publication of thin data: Depends - I see no need to publish it, but there may be technical arguments for it. After all, ownership of phone numbers is not public, land ownership data is gated, even company registration data is gated in some countries and public in others Ayden Férdeline:The Internet is also global. It is not difficult to imagine the repercussions that the “website operator” of, say, a political blog posting dissident material could face in a less stable region of the world. Michael Hammer:If you publicly register your thermostat on the internet you probably deserve what you get. Volker Greimann:True Lisa Phifer:Question from Chuck: If you think that any THIN data elements should not be public, put a red X in AC and explain why Ayden Férdeline:@Michael: People are not always aware as to how connected the devices they purchase are, let alone precisely how they work. The privacy policies and terms of service of many IoT devices are often confusing to read and sometimes even non-existent. Amr Elsadr:Definition of "thin" data as per the "thick" WHOIS PDP WG: A thin registry only stores and manages the information associated with the domain name.This set includes data sufficient to identify the sponsoring registrar, status of theregistration, creation and expiration dates for each registration, name server data, the lasttime the record was updated in its Whois data store, and the URL for the registrar’s Whoisservice. Lisa Phifer:Thin data definition appears at top of window Chris Pelling:Lisa please release doc as I cannot read it Lisa Phifer:See also Amr's text above which copied the definition into chat Chris Pelling:Here is an example of Thin Data : Chris Pelling: Domain Name: NETEARTH.NET Registrar: NETEARTH ONE INC. D/B/A NETEARTH Sponsoring Registrar IANA ID: 1005 Whois Server: whois.advancedregistrar.com Referral URL: https://urldefense.proofpoint.com/v2/url?u=http-3A__www.netearthone.com&d=Dw... Name Server: NS1.NETEARTH.NET Name Server: NS2.NETEARTH.NET Name Server: NS4.NETEARTH.NET Name Server: NS5.NETEARTH.NET Status: clientTransferProhibited https://urldefense.proofpoint.com/v2/url?u=https-3A__icann.org_epp-23clientT... Updated Date: 31-jan-2016 Creation Date: 02-jan-1998 Expiration Date: 01-jan-2021>>> Last update of whois database: Tue, 25 Apr 2017 17:04:54 GMT <<<AlexDeacon:Letsnotconfuseratelimiting(andotherformsofcontrol)with"gatedaccess"MarikaKonings:PleaseremembertomuteyourmicrophoneswhennotspeakingChrisPelling:pleassomeonemutetheirMICMarikaKonings:@Paul-yourmicrophoneappearsopenAlexDeacon:cansomeonepleasemutePaul.ChrisPelling:someoneistalkingonaphonetosomeoneelseVolkerGreimann:AnorganisationbasedoutsidetheEUissubjecttotheGDPRifiteither:(a)offersgoodsorservicestoEUdatasubjects;or(b)monitorsthebehaviourofEUdatasubjects.MichaelHammer:@Ayden,whileImightsympathizewiththosepeople,thatshouldnotdrivepolicyfortheInternet.Youarebetteroffpassinglawsinyourjurisdictionspecifyingwhatvendorsshouldprovidetotheircustomers.ForreferenceIpointtohttp://otalliance.actonsoftware.com/acton/attachment/6361/f-008d/1/-/-/-/-/IoT%20Trust%20Framework.pdfChrisPelling:ThinwhoisChrisPelling:DomainName:NETEARTH.NETRegistrar:NETEARTHONEINC.D/B/ANETEARTHSponsoringRegistrarIANAID:1005WhoisServer:whois.advancedregistrar.comReferralURL:http://www.netearthone.comNameServer:NS1.NETEARTH.NETNameServer:NS2.NETEARTH.NETNameServer:NS4.NETEARTH.NETNameServer:NS5.NETEARTH.NETStatus:clientTransferProhibitedhttps://icann.org/epp#clientTransferProhibitedUpdatedDate:31-jan-2016CreationDate:02-jan-1998ExpirationDate:01-jan-2021>>> Last update of whois database: Tue, 25 Apr 2017 17:04:54 GMT <<< Volker Greimann:Micheal: The internet is international. EU regulation recognizes that and is designed to protect EU residents. Volker Greimann:regardless where the data processor resides Chris Pelling:Thats part of the RAA if memory serves Lisa Phifer:Note charter question: (1) Should registration data be entirely public or should access be controlled? (2) Hoe many levels of access should be provided? (public, non-public, multi-tiered) (3) Should access be based on authenticated identity? (4) Should access be based on purpose or other criteria? Michael Hammer:@volker, you put your information in public on linkedin - https://urldefense.proofpoint.com/v2/url?u=https-3A__www.linkedin.com_in_vol... Volker Greimann:As is my choice Lisa Phifer:"Gated" is a higher level concept Volker Greimann:I consent to that publication and can withdraw that consent at any time and still have a linked-in account Lisa Phifer:There are many ways once can "gate" access - but the question on the table is should access remain NON gated (that is, entirely public) Volker Greimann:and that service does not publish the data I consider private Ayden Férdeline:@Michael: I’d rather keep regulation at bay, and think existing legal liability mechanisms are sufficient for now. But you may be right that further regulatory action is needed if self-regulation and existing instruments do not prove sufficient. Chris Pelling:rate limiting will not stop specific sections of the thin data being displayed, it will simply either block or allow access Lisa Phifer:Question to Working Group members: Are there any "thin" data elements that should not be publicly displayed in a new RDS system as they are today in WHOIS? And if yes, why not? Andrew Sullivan:long as we keep the distinction and don't forestall rate limitations I'm good with the question Ayden Férdeline:Also, Volker voluntarily CHOOSES to put that information on LinkedIn, he is not required to have a LinkedIn profile to use the Internet... Maxim Alzoba (FAITID):I sugest we try to ask participants- if there was a single breach of any local laws by showing thin data ? Alex Deacon:@andrew +1 Michael Hammer:When discussing gate keeping one also has to consider who the gatekeepers will be. Lisa Phifer:@Marc - I think you are arguing the data elements themselves may not all be needed, not that they should not be publicly accessible? Lisa Phifer:@Marc - is your point that there must be a purpose to publish data, and you do not think there is a purpose for some elements? Marc Anderson:@Lisa - yes, that is the point I'm trying to make, and part of my problem with looking at traditional thin data Lisa Phifer:Can we split this into two pieces, to answer one piece at a time. That is, assuming thin data elements have a legit purpose, should all of them be public or should any of them have access controlled? Chris Pelling:+1 Chuck :p Lisa Phifer:Separately, we need to go back to the list of thin data elements and determine if each has a legit purpose. Michael Hammer:I keep track of (what I consider) critical hsots by IP Address... so no, we don't need domain names at all. I recognize some folks might not agree. Roger Carney:@Theo, are you saying that WHOIS/RDS does not need to display NS, as that is obtainable from another public source? Ayden Férdeline:good analogy re: cell phone numbers Chris Pelling:Roger, DIG + TRACE on the domain name Chris Pelling:and that gives you the NS Michael Hammer:How many people do you know that host websites on cell phones? Roger Carney:@Chris, correct, so we don't need it in WHOIS? Chris Pelling:Roger, I am on Theos and Chucks side of turn it off Chris Pelling:ie. WHOIS Theo Geurts:Roger, name servers do not have to be displayed in the WHOIS for the domain name to function Chris Pelling:Rate limiting Chuck Lisa Phifer:public = unauthenticated, available to anyone for any reason Roger Carney:@Chris, is "resolving technical issues" still valid for some type of WHOIS data? Lisa Phifer:(rate limiting can still be applied to public access, as it is today) Fabricio Vayra:Chuck, you're right re: EWG Chris Pelling:@Roger, I would say no, simply because I know how to find things out if I need too, but, sadly im tech savy some people are not Alex Deacon:again lets not confuse "gated access" with technical measures to ensure the service is up and running (rate limiting and the like) Lisa Phifer:From EWG report, here are some basic concepts... Lisa Phifer:From Pages 58-59:A minimum set of data elements, at least in line with the most stringent privacy regime, must be accessible by unauthenticated RDS users.Multiple levels of authenticated data access must be supported, consistent with stated permissible purposes.From Page 47 (how access principles apply to thick vs. thin data elements):To maximize Registrant privacy, Registrant-supplied data must be gated by default, except where there is a compelling need for public access that exceeds resulting risk. Registrants can opt into making any gated Registrant-supplied data public with informed consent.To maximize Internet stability, all Registry or Registrar-supplied registration data must be always public, except where doing so results in unacceptable risk. Registrants can opt into making any public Registry/Registrar-supplied data gated, except as noted below to enable basic domain control.To meet basic domain control needs, the following Registrant-supplied data, which is mandatory to collect and low-risk to dis Lisa Phifer:low-risk to disclose, must be included in the minimum public data set. [Refer to EWG Report Page 46 for list of data elements; refer to section 3 of this document for the RDS PDP WG’s agreements on thin data element requirements.] Lisa Phifer:You can find this text in https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_dow... Andrew Sullivan:there's no way to tell on the Internet who operates infrastructure. so that means "everyone " Volker Greimann:@Paul: Can you access number plate records, telephone number databases from a public database or is there gated access? Amr Elsadr:Thin data: A thin registry only stores and manages the information associated with the domain name.This set includes data sufficient to identify the sponsoring registrar, status of theregistration, creation and expiration dates for each registration, name server data, the lasttime the record was updated in its Whois data store, and the URL for the registrar’s Whoisservice. Chris Pelling:aha historical whois records - storing whois data ? Michael Hammer:We use all of these elements in identifying and tracking abuse. Volker Greimann:@Paul: Does your wanting of information equate a right to the information though? Andrew Sullivan:"when i buy a domain name" is actually a better example of obvious criterion for gated access: you're dealing with the seller Nathalie Coupet:So, this would preclude consumers from finding the name og the registrant, but only for individuals, but not for companies, right? Nathalie Coupet:Are we still making his distinction? Nathalie Coupet:ths Nathalie Coupet:this Chris Pelling:whoever is huffing or breathing heavy please mute your mic out of respect for the current talker Lisa Phifer:I'd also recommend WG members review the EWG text on this topic in the new working document Section 5 https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_dow... Chris Pelling:Thank you all, nice healthy debate Maxim Alzoba (FAITID):bye all Ayden Férdeline:thanks all Theo Geurts:thanks good discussion Chris Pelling:bye Fabricio Vayra:Thanks, Chuck Andrew Sullivan:bye! Michael Hammer:Thanks Nathalie Coupet:Thank you Amr Elsadr:Thanks all. Bye. Nathalie Coupet:Bye Sam Lanfranco:By to all Juan Manuel Rojas:Bye to all Sam Lanfranco:Quite a dust up!