- GNSO-RPM-WG - lists.icann.org

Re: [gnso-rpm-wg] Sunrise & Trademark Claims Survey Launched
by Ariel Liang Sept. 13, 2018

Sept. 13, 2018

Hello Maxim, GDD informed us that when they had the GSC send mass emails to both Registrars and Registries, they have them de-dup the list so that one person does not receive the same message numerous times. Yesterday, Analysis Group informed us that they have received close to a couple dozens of responses from Registries. Maxim – could you please confirm whether both of your Registry and Registrar use your email as the primary contact? If so, you would only get the announcement message once. If there are different emails used for your Registry and Registrar, we will ask GDD to investigate further. Please be so kind to let us know. Best Regards, Ariel Ariel Xinyue Liang GNSO Policy Support Specialist Internet Corporation for Assigned Names and Numbers (ICANN) From: Maxim Alzoba <m.alzoba(a)gmail.com> Date: Monday, September 10, 2018 at 11:54 PM To: Ariel Liang <ariel.liang(a)icann.org> Cc: "gnso-rpm-wg(a)icann.org" <gnso-rpm-wg(a)icann.org> Subject: [Ext] Re: [gnso-rpm-wg] Sunrise & Trademark Claims Survey Launched Dear Ariel, For some reason it seems to be that we have received the survey as Registrars but not as Registries (there were no e-mails from GDD for our TLDs) and it is strange. Could you check with GDD Team? Sincerely Yours, Maxim Alzoba Special projects manager, International Relations Department, FAITID m. +7 916 6761580(+whatsapp) skype oldfrogger Current UTC offset: +3.00 (.Moscow) On 7 Sep 2018, at 03:59, Ariel Liang <ariel.liang(a)icann.org<mailto:ariel.liang@icann.org>> wrote: Dear RPM Working Group members, Staff are happy to report that the Sunrise & Trademark Claims survey has been launched today and is scheduled to run until Friday, 28 September 2018. * Registry Operator: http://icannregistryoperators.cloudssi.com/login.html [icannregistryoperators.cloudssi.com]<https://urldefense.proofpoint.com/v2/url?u=http-3A__icannregistryoperators.…> * Registrar: http://icannregistrar.cloudssi.com/login.html [icannregistrar.cloudssi.com]<https://urldefense.proofpoint.com/v2/url?u=http-3A__icannregistrar.cloudssi…> * Trademark Owner/Representative: http://icanntrademarkholders.cloudssi.com/login.html [icanntrademarkholders.cloudssi.com]<https://urldefense.proofpoint.com/v2/url?u=http-3A__icanntrademarkholders.c…> * Actual/Potential Registrant: https://online.ssisurveys.com/wix/p3964574.aspx?hSamp=1 [online.ssisurveys.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__online.ssisurveys.com_…> The survey is being circulated according to the distribution plans jointly developed by the Data Sub Team, Analysis Group, and staff: https://community.icann.org/x/aQ9pBQ. In summary, the survey targeting actual/potential registrants would be promoted as widely as possible; the survey targeting registries, registrars, and trademark owners would be promoted using a targeted approach. According to the plans, the following activities were conducted today: * An announcement on GNSO website has been published: https://gnso.icann.org/en/announcements/announcement-06sep18-en.htm [gnso.icann.org]<https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_anno…> * An ICANN.org [icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__icann.org_&d=DwMFaQ&c=F…> announcement has been published (it features the actual/potential registrant survey, but makes reference to the others): https://www.icann.org/news/announcement-2-2018-09-06-en [icann.org]<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_news_ann…> * The GDD Team sent the survey announcement directly to their registry and registrar contacts, and circulated it with the CPH/RySG/RrSG. * The GNSO Secretariat Team, GSE Team, Analysis Group, and a few WG members (Brian Beckham, Lori Schulman, and Susan Payne) will help promote the survey inside and outside of ICANN. For instance, you should be able to see the survey announcement message being circulated on the mailing lists of various SOs/ACs/SGs/Cs shortly. External organizations would also be contacted to circulate the survey. * ICANN Comms Team will promote the survey on various social media channels tomorrow day time. Last, staff are sharing the Inception Report from Analysis Group. The Inception Report documents the work plan, proposed project schedule, survey targets, outreach plan, and final survey design and questions. Staff would like to thank the Data Sub Team members, especially Kristine Dorrain, Susan Payne, Michael Graham, and Rebecca Tushnet, who devoted tremendous amount of time and effort in developing and finalizing the survey in collaboration with Analysis Group. We also greatly appreciate the time and help from all the beta testers, who provided extensive and useful feedback! WG members are welcome to fill out the survey yourselves, if appropriate. Please also help promote the survey by sharing the web announcements, as well as social media posts from ICANN and GNSO’s channels. Analysis Group will monitor the response rates while the surveys are in the field. Again, big thanks to the members who have contributed to the Sunrise & Trademark Claims survey! Best Regards, Mary, Julie, Ariel & Berry

3 2

Recordings, attendance & AC chat from Review of all Rights Protection Mechanisms (RPMs) PDP Working Group call on Wednesday, 12 September 2018 at 17:00 UTC
by Michelle DeSmyter Sept. 12, 2018

Sept. 12, 2018

Dear all, Please find the attendance and AC Chat attached to this email, and the MP3 & AC recording below for the Review of all Rights Protection Mechanisms (RPMs) PDP Working Group call held Wednesday, 12 September 2018 at 17:00 UTC. Attendance and recording of the call is also posted on agenda wiki page: https://community.icann.org/x/YgKNBQ MP3: https://audio.icann.org/gnso/gnso-rpm-review-12sep18-en.mp3 AC Recording: https://participate.icann.org/p82b8i69mtb/ The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: https://gnso.icann.org/en/group-activities/calendar [gnso.icann.org]<https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_grou…> ** Please let me know if your name has been left off the list ** Mailing list archives: http://mm.icann.org/pipermail/gnso-rpm-wg/ Main wiki page for the working group: https://community.icann.org/x/wCWAAw [community.icann.org]<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_x_…> Thank you. Kind Regards, Michelle DeSmyter

1 0

Actions & Notes: RPM PDP WG Meeting 12 Sept 2018
by Julie Hedlund Sept. 12, 2018

Sept. 12, 2018

Dear All, Please see below the action items and notes captured by staff from the RPM PDP Working Group call held on 12 September 2018 (17:00-19:00 UTC). Staff have posted to the wiki space the action items and notes. Please note that these will be high-level notes and are not meant as a substitute for the recording. The recording, AC chat, and attendance records are posted on the wiki at: https://community.icann.org/display/RARPMRIAGPWG/2018-09-12+Review+of+all+R…. See also the attached referenced document. Best Regards, Julie Julie Hedlund, Policy Director == ACTION ITEMS: A. THE COMPLAINT – 6. Amending the Complaint in light of GDPR/Temp Spec Page 5-6: ACTION ITEM: Change the language to "data required to advance the complaint" or similar (Lori Schulman’s suggestion). B. NOTICE – 1. Receipt by Registrant Notice (feedback from Complainant & Respondent) Page 10: ACTION ITEM: Change to "via the online form [if available]..." J. LANGUAGE ISSUES -- 1. Language issues, including current requirements for complaint, notice of complaint, response, determination Page 34: ACTION ITEM: 1st Bullet Point: Documents Sub Team should reconsider the recommendation in light of Maxim's earlier feedback. NOTES: 1. Review Agenda/Statements of Interest Updates: -- Kathy Kleiman joined as a visiting scholar at Princeton. 2. Discussion of URS Draft Policy Recommendations (see attached Super Consolidated URS Topics Table): A. THE COMPLAINT – 6. Amending the Complaint in light of GDPR/Temp Spec Page 5-6: -- Technical recommendation for GDPR and also outreach re Doe Complaints -- But the Provider may not be receiving the "full registration data" from the Registrars and thus may not be "disclosing" the "full registration data" to the Complainant. Full WHOIS registration data includes *phone number* which is not a piece of data needed by Providers or Complainants. This something we should address, maybe with just a little modification. -- This also should be a phase 2 topic to be considered in Phase 2 on UDRP as it covers both systems. Suggest deferring to Phase 2. -- Disagree: Have an issue with URS. The Temp Spec doesn't address this. We can have the same suggestions in both phases. Each phase addresses different mechanisms and each mechanism can have similar recommendation. Also support the argument about timeliness of issue. -- Agree that can have the same suggestions in both phases. Also, if we don’t put such (obvious) options out to public comment, I think it’s pretty sure that some of said public will comment on them, albeit questioning why the WG hasn’t considered them. ACTION ITEM: change to "relevant registration data" or "data required to advance the complaint" since providers may not be getting "full registration data". -- Because of the urgency there is not harm, and since we are on URS, to have a recommendation that relates to URS -- and shouldn't wait until a Phase 2 Initial Report. Could be superseded by the Temp Spec though. The WG Agrees to move the recommendations into the Initial Report with background, as well as the suggestion to defer to Phase 2. B. NOTICE – 1. Receipt by Registrant Notice (feedback from Complainant & Respondent) Page 10: -- Another technical recommendation tied to implementation and enforcement of GDPR. Suggest putting it out for public comment. -- EDPDP Team may also have recommendations relating to this issue. -- Not urgent and could wait until Phase 2 and not all registries have implemented the online form. ACTION ITEM: Change to "via the online form [if available]..." The WG agrees to move the recommendations into the Initial Report with background, as well as the suggestion to defer to Phase 2. E. DEFENSES -- 1. Scope of Defenses and 2. Unreasonable delay in filing a complaint (i.e. laches) Page 19: -- Suggest moving this to Phase 2 as it also relates to UDRP. -- Support getting public comment on these two recs on page 19. -- Put out these draft policy recommendations as they exists and ask for comment. -- Could also include for public comment the suggestion to address these in Phase 2. -- Uniform guidance could be developed by ICANN. The WG agrees to move the recommendations into the Initial Report with background, as well as the suggestion to defer to Phase 2. F. REMEDIES – 1. Scope of remedies. Page 23: The WG agrees to use this as a placeholder/umbrella for other recommendations that are related. 2. Duration of Suspension Period and 3. Review of Implementation Pages 26-27: -- Registrars issues with renewals -- Need to have accounts in the bank with the same currency with the payer. Maybe not be able to accept certain payments. Should be some other way of registering the same name through some other registrar. Need this feedback in public comment. -- If there are recommendations about obligations for registrars this could affect contracts, so must be considered whether it is in scope. The WG agrees to include in the Initial Report with a question about the option to use another registrar. G. APPEAL – 1. Appeals process Page 30: The WG agrees to include in the Initial Report. 2. De novo review Pages 30-31: The WG agrees to include as an umbrella topic, but will need to address the details, or call out this as a separate category in the Initial Report (perhaps not a recommendation, but a question); wait until the WG goes through the individual proposals. H. POTENTIALLY OVERLAPPING PROCESS STEPS -- 1. Potential overlap concerning duration of respondent appeal, review and extended reply periods along the URS process timeline Page 31-32: The WG agrees to include as an umbrella topic, but will need to address the details, or call out this as a separate category in the Initial Report (perhaps not a recommendation, but a question); wait until we go through the individual proposals. J. LANGUAGE ISSUES -- 1. Language issues, including current requirements for complaint, notice of complaint, response, determination Page 34: ACTION ITEM: 1st Bullet Point: Documents Sub Team should reconsider the recommendation in light of Maxim's earlier feedback. 2nd Bullet Point: The WG agrees to include in the Initial Report. L. EDUCATION & TRAINING -- 1. Responsibility for education and training of complainants, registrants, registry operators and registrars Pages 38-39: The WG agrees to include the recommendations in the Initial Report. Include a question about who should compile the FAQ and where it should be hosted/published.

1 0

Order and Schedule for Individual URS Proposal Presentations
by Julie Hedlund Sept. 11, 2018

Sept. 11, 2018

Dear RPM PDP Working Group members, As reported last week, the deadline for individual Working Group members to submit Proposals for URS policy and operational recommendations closed on COB 06 September. By the deadline, thirty-three (33) URS Proposals were submitted. In preparation for the Working Group meeting on Monday, 17 September, the RPM PDP Working Group Co-Chairs, in coordination with staff, have reviewed the individual URS proposals and have grouped them by type as follows: Operational Fixes, Policy Recommendations, and Other. In addition, the proposals have been mapped to the topics in the Super Consolidated URS Topic Table. Per the attached Procedures for URS Policy and Operational Recommendations, the Co-Chair propose to schedule the presentations in the following order, organized by URS topic: Operational Fixes; Policy Recommendations; Other proposals. The order and schedule for individual URS proposal presentations is subject to the following procedures as described in the attached document: To the maximum extent possible, presentations will be rotated to ensure that the same Working Group member is not making more than two (2) proposals per meeting. When a proposal is up for discussion, its proponent will be accorded a maximum of five (5) minutes to orally present the proposal, rationale, and supporting evidence. The floor will then be open to other Working Group members to comment on the proposal for a maximum of two (2) minutes each, with total discussion limited to twenty (20) minutes. However, if there is exceptionally high interest in a topic, the Co-Chairs would have discretion to increase the discussion time. At the end of twenty (20) minutes, or when there are no more commenters in queue, the proponent will have up to four (4) minutes to respond and/or propose a modification of the proposal based upon the discussion. After the presentation: Shortly following the conclusion of the call (i.e. as soon as attendance, chat, and link to mp3 recording are available), staff shall post to the email list the final text and rationale of considered proposals. All Working Group members will be invited to comment on the proposals on the Working Group email list. In addition, per the attached procedures proponents will receive advance notice of the date on which their proposal is scheduled for presentation to ensure they will be available. Proponents will be permitted to request an alternate date if they have a conflict. Also, as requested, proponents will be able to designate an alternate to present on their behalf if they are unable to present at any of the available meetings. The Co-Chairs would like to re-emphasize that the Working Group faces a significant challenge in adhering to its current timeline and completing its URS work for the Initial Report before ICANN63. Consequently, the Co-Chairs also propose expediting the handling of the 33 proposals to keep to the Phase 1 timeline in the following manner: Deferring discussion of proposals designated by their proponent as Phase 2 items until we reach Phase 2, with an assurance they will be listed in the Initial Report as reserved for Phase 2 consideration, and that they will be brought up for discussion during Phase 2 in a manner consistent with any procedures for consideration of WG member proposals adopted for Phase 2. To be clear, the acceptance of any Phase II proposals submitted presently for preservation purposes does not foreclose the additional submission of future Phase II proposals by WG members when the WG is at that stage of its work. Any proponents who have designated their current URS proposals Phase 2 items will be contacted separately to confirm their agreement with this approach. Possibly holding two meetings per week to complete consideration of all items before ICANN63. The Co-Chairs appreciate the time that WG members are already making through their participation in WG meetings and will only utilize this option if it appears absolutely necessary. Please see the attached table of the order and schedule of Individual URS Proposals and on the wiki at: https://community.icann.org/x/aACNBQ. Staff have reorganized the wiki page and renamed the document files to reflect the order of the individual URS proposal presentation. The tentative presentation date of each proposal is included, subject to change depending on actual progress. The proposals about topics that can be deferred to Phase 2 are colored in grey; no presentation date has been assigned to these proposals. You may view and download all URS proposals quickly by clicking the “Quick Download” tab. As noted previously, the Co-Chairs believe that these procedures will efficiently and fairly facilitate the RPM PDP Working Group discussion and development of URS policy and operational recommendations over the course of the upcoming Working Group meetings in September and October, beginning on Monday, 17 September. Finally, the Co-Chairs reiterate that the next Working Group meeting on 12 September is for the consideration of the URS Sub Team suggested draft policy recommendations. Working Group members who have submitted proposals similar to or on the same subject as a sub-team policy proposal are asked to hold any comments regarding their individual proposals until their scheduled presentations. The acceptance of a sub-team proposal will not preempt that of a related individual proposal; if such an individual proposal elicits adequate support, the co-chairs may suggest that it be combined with a related sub-team proposal or, if appropriate, both proposals may be included in the Initial Report for public comment. Best regards, Mary, Julie, Ariel & Berry On behalf of the RPM PDP Working Group Co-Chairs

3 5

Re: [gnso-rpm-wg] URS / UDRP proposals -- data on registrar/registry compliance costs
by Maxim Alzoba Sept. 11, 2018

Sept. 11, 2018

Hello Jonathan, I am resending it (was not processed by gnso-rpm-wg@ list). I think lifetime lock (if at all) should be limited to the lifetime of the TM registration, to avoid dumping of some strings for no reason (when there is no TM holder to protect, what is the reason for locking?) Also, all registrations terms are limited to the time of Registry contract with ICANN (10 years), so at the best it can be 10 years, and not a single day more. So either we do not use this idea, or we will have to create mechanism of removing such lifetime-10years-lock, preferably using the current system (for example, TM database to which URS complainant of that time referred to , does not have the entry no more, so the party seeking for the registration can start a process, might be even with the same price of filing via the same URS provider, or it's successor). p.s: any kind of such lock can be overridden by a simple village court in the same jurisdiction as the particular registry is based. Sincerely Yours, Maxim Alzoba Special projects manager, International Relations Department, FAITID m. +7 916 6761580(+whatsapp) skype oldfrogger Current UTC offset: +3.00 (.Moscow) > On 5 Sep 2018, at 20:59, Jonathan Frost <jonathan(a)get.club <mailto:jonathan@get.club>> wrote: > > For instance, there is ambiguity about what action a registry should take when a domain which is already the subject of a URS judgement & lifetime lock receives a UDPR judgement that requires unlock & transfer. The URS rules don't account for this situation, and by their letter, require that the domain not be unlocked. However, the registries are also required to comply with consensus policies (such as UDRP). > > Jonathan > > On Wed, Sep 5, 2018 at 1:47 PM Doug Isenberg <Doug(a)giga.law <mailto:Doug@giga.law>> wrote: > What are some of the “ambiguities in complying with the rules”? > > > > Doug > > > > > > From: gnso-rpm-wg <gnso-rpm-wg-bounces(a)icann.org <mailto:gnso-rpm-wg-bounces@icann.org>> On Behalf Of Jonathan Frost > Sent: Wednesday, September 5, 2018 1:15 PM > To: icann(a)leap.com <mailto:icann@leap.com> > Cc: gnso-rpm-wg <gnso-rpm-wg(a)icann.org <mailto:gnso-rpm-wg@icann.org>> > Subject: Re: [gnso-rpm-wg] URS / UDRP proposals -- data on registrar/registry compliance costs > > > > I agree that Registries and Registrars need to be able to recover the cost of administering the URS/UDRPs, as part of the filing fee. > > > > The costs that the Registries/Registrars bear actually goes beyond what Reg has said. There are situations where we have to go to outside counsel or even ICANN to resolve ambiguities in complying with the rules. Additionally, the 24 hour action requirement on locking a domain that has received a URS complaint actually increases the resources that have to be dedicated, beyond the actual number of minutes per complaint, because compliance personal has to allocate/reserve a certain time per day to perform the tasks, even if no complaint is received that day. > > > > Just like the arbitration administrators charge a cost recovery fee for administration as part of the filing fee, it's just common since that the Registries/Registrars would too. > > > > Jonathan Frost > > _______________________________________________ > gnso-rpm-wg mailing list > gnso-rpm-wg(a)icann.org <mailto:gnso-rpm-wg@icann.org> > https://mm.icann.org/mailman/listinfo/gnso-rpm-wg <https://mm.icann.org/mailman/listinfo/gnso-rpm-wg>_______________________________________________ > gnso-rpm-wg mailing list > gnso-rpm-wg(a)icann.org <mailto:gnso-rpm-wg@icann.org> > https://mm.icann.org/mailman/listinfo/gnso-rpm-wg

7 17

Sunrise & Trademark Claims Survey Launched
by Ariel Liang Sept. 11, 2018

Sept. 11, 2018

Dear RPM Working Group members, Staff are happy to report that the Sunrise & Trademark Claims survey has been launched today and is scheduled to run until Friday, 28 September 2018. * Registry Operator: http://icannregistryoperators.cloudssi.com/login.html * Registrar: http://icannregistrar.cloudssi.com/login.html * Trademark Owner/Representative: http://icanntrademarkholders.cloudssi.com/login.html * Actual/Potential Registrant: https://online.ssisurveys.com/wix/p3964574.aspx?hSamp=1 The survey is being circulated according to the distribution plans jointly developed by the Data Sub Team, Analysis Group, and staff: https://community.icann.org/x/aQ9pBQ. In summary, the survey targeting actual/potential registrants would be promoted as widely as possible; the survey targeting registries, registrars, and trademark owners would be promoted using a targeted approach. According to the plans, the following activities were conducted today: * An announcement on GNSO website has been published: https://gnso.icann.org/en/announcements/announcement-06sep18-en.htm * An ICANN.org announcement has been published (it features the actual/potential registrant survey, but makes reference to the others): https://www.icann.org/news/announcement-2-2018-09-06-en * The GDD Team sent the survey announcement directly to their registry and registrar contacts, and circulated it with the CPH/RySG/RrSG. * The GNSO Secretariat Team, GSE Team, Analysis Group, and a few WG members (Brian Beckham, Lori Schulman, and Susan Payne) will help promote the survey inside and outside of ICANN. For instance, you should be able to see the survey announcement message being circulated on the mailing lists of various SOs/ACs/SGs/Cs shortly. External organizations would also be contacted to circulate the survey. * ICANN Comms Team will promote the survey on various social media channels tomorrow day time. Last, staff are sharing the Inception Report from Analysis Group. The Inception Report documents the work plan, proposed project schedule, survey targets, outreach plan, and final survey design and questions. Staff would like to thank the Data Sub Team members, especially Kristine Dorrain, Susan Payne, Michael Graham, and Rebecca Tushnet, who devoted tremendous amount of time and effort in developing and finalizing the survey in collaboration with Analysis Group. We also greatly appreciate the time and help from all the beta testers, who provided extensive and useful feedback! WG members are welcome to fill out the survey yourselves, if appropriate. Please also help promote the survey by sharing the web announcements, as well as social media posts from ICANN and GNSO’s channels. Analysis Group will monitor the response rates while the surveys are in the field. Again, big thanks to the members who have contributed to the Sunrise & Trademark Claims survey! Best Regards, Mary, Julie, Ariel & Berry

2 1

Second internet court set up in Beijing
by George Kirikos Sept. 10, 2018

Sept. 10, 2018

Hi folks, I read an interesting story in the Chinese media today: http://www.chinadaily.com.cn/a/201809/10/WS5b95b8e4a31033b4f46550e9.html "China opened a second internet court on Sunday to address the rising disputes and problems caused by its ever-growing reliance on cyberspace. The Beijing Internet Court, situated in a Fengtai district technology zone in the southwest of the capital, will mainly handle internet and intellectual property rights cases, such as disputes involving online loans, online shopping contracts and online copyright issues, the Supreme People's Court wrote in an online judicial interpretation. The IP rulings of the district-level court, which has 38 judges, can be appealed at the Beijing Intellectual Property Court, and its other cases at the Beijing No 4 Intermediate People's Court. .... Liu Shuhan, a judge at the court, said one of its key features is that litigants can handle their lawsuits entirely online－they are not required to go to the court in person at any point from the case filing to the hearing." I think this reinforces the call to eliminate the URS and/or the UDRP (one of the proposals I submitted last week was for the elimination of the URS), given that the court alternative appears to be fast, convenient, and inexpensive (at least for Chinese parties; for the URS, that was a significant fraction of disputes). As more and more jurisdictions modernize their court systems to include online offerings like this, the justification for creating alternatives to the courts decreases. Sincerely, George Kirikos 416-588-0269 http://www.leap.com/

1 0

Agenda and Materials for 12 Sept Working Group Meeting 1700 UTC
by Julie Hedlund Sept. 7, 2018

Sept. 7, 2018

Dear RPM PDP Working Group members, On behalf of the Co-Chairs, please see the draft agenda below for the Working Group meeting on Wednesday, 12 September at 1700 UTC for 120 minutes. For this next meeting, the Working Group will discuss the URS Sub Teams’ suggested draft policy recommendations as detailed in the attached Super Consolidated URS Topics Table (highlighted in green). Please note that the discussion of individual URS proposals will begin with the meeting on 17 September (replacing the regular meeting on 19 September). Early next week staff will send on behalf of the Co-Chairs the order and schedule of the individual proposal presentations. Working Group members who have submitted proposals similar to or on the same subject as a sub-team policy proposal are asked to hold any comments regarding their individual proposals until their scheduled presentations. The acceptance of a sub-team proposal will not preempt that of a related individual proposal; if such an individual proposal elicits adequate support, the co-chairs may suggest that it be combined with a related sub-team proposal or, if appropriate, both proposals may be included in the Initial Report for public comment. Draft Agenda: Review Agenda/Statements of Interest Updates Discussion of URS Draft Policy Recommendations (see attached Super Consolidated URS Topics Table) AOB Best, Mary, Ariel, Berry, and Julie On Behalf of the RPM PDP WG Co-Chairs

1 0

Identity Theft -- how it affects various proposals submitted
by George Kirikos Sept. 7, 2018

Sept. 7, 2018

Hi folks, Reviewing some of the proposals that were submitted by last night's deadline, I think that they'd encounter some very serious problems in terms of implementation, because of lack of WHOIS verification and vulnerabilities associated with identity theft. For example, there were multiple "loser pays" submissions (I too am on the record as being strongly in favour of "loser pays" as a concept, but I qualified my support, noting (without going into too much detail): https://mm.icann.org/pipermail/gnso-rpm-wg/2018-August/003226.html that (in point #11) the system had to be carefully constructed, with systems of checks and balances in place. While I made submissions on other topics, folks will note I didn't submit one on "loser pays" at this time, because I realized that in order to properly implement a loser pays system one would need to solve a whole series of other problems first. And to solve those other problems first might become a monumental task (I'd be up to that monumental task, but not sure the rest of the PDP members would be willing to do it! If the rest of the group does want to solve them, I'd love to rise to the challenge too). So, here's just one of the major problems that would need to be solved before implementing "loser pays" or penalties --- lack of WHOIS verification which relates to identity theft. Registrars generally don't have any "Know Your Client" requirements and there is no real verification of the true identity of the person/entity that purports to be the registrant. There might be verification that the email address and/or the telephone number are verified. But, all the rest of the fields in the WHOIS can easily be faked, or used to impersonate others to commit identity theft. This is not some theoretical issue. I know first hand, as someone using a Chinese registrar copied my company's WHOIS for a malware domain, see the historical WHOIS at: https://research.domaintools.com/research/whois-history/search/?q=antivirus… (I had a Google Alert triggered, and that's how I noticed it; the attacker changed the phone number by 1 digit from my real phone number, but copied my name, company name, fax, address, and used a gkirikos@ address (obviously not matching my real email address). [I complained to the registrar, and also using an ICANN WHOIS complaint] [NB: with GDPR and redacted WHOIS out there, it could be happening *now* -- how would I know??] This has even happened within UDRP cases, where there has been identity theft, see: http://www.udrpsearch.com/search?query=identity%20theft&search=text&results… for various matches. e.g.: http://www.adrforum.com/domaindecisions/1774660.htm http://www.wipo.int/amc/en/domains/search/text.jsp?case=D2017-1843 So, let's consider various scenarios. If there's a "loser pays" system, new vulnerabilities would be created if a system is not carefully constructed. An attacker could copy someone else's name/identity, use it for cybersquatting, and "lose" a UDRP/URS. Now that victim of identity theft would potentially have a liability for damages on a domain they never actually registered, using a registrar that they never had any relationship with. Most of the time, the registrar simply has a relationship with a purported identity, not a verified identity with a verified relationship (i.e. "Tom Cruise" is a real person, but the famous actor Tom Cruise is unlikely to be the actual registrant with a real relationship with a registrar, if that actor's name is placed into the WHOIS by an attacker). One of the proposals went even further, saying: https://community.icann.org/display/RARPMRIAGPWG/URS+Proposals "the penalties should include (i) a requirement that the registrant deposit funds into an escrow account, or provide an equivalent authorization on a credit card, with each new domain registration (such funds could be dispersed to prevailing complainants in future domain name disputes against that registrant as part of a “loser pays” system), and (ii) a universal blocking of all domain registrations for a set period for the registrant (i.e. “blacklisting” the registrant on a temporary basis)" (from proposal #30) It should be fairly obvious that such a scheme would enable an attacker to engage in a Denial of Service attack against a victim, by impersonating them (stealing their identity). e.g. (a) spend $20 total on a few dozen "throwaway" domains that have a sub-$1 dollar promo price (b) copy the victim's identity on a series of "famousbrand-authorized-store.newgtld" domains (c) wait for the victim to lose the URS/UDRP and be labelled a "repeat offender" or "high volume cybersquatter" Now when the *real* victim wants to register a domain at their real registrar, they'll suddenly encounter their name on a "blacklist"!! To show how truly vulnerable the system is to an attack, there's likely no real verification by the URS/UDRP providers that a *Complainant* is who they say they are! So, let's suppose the "victim" is "John Smith". The attacker has created the cybersquatting domains under the "John Smith" name, using multiple trademarks of Amazon, for example. Instead of waiting for the brandholder Amazon to file a URS (i.e. step (c) above), a truly motivated attacker (think state-funded actors, as an example, that want to interfere with a business competitor or an election) could go even further, and go impersonate the brandholder and file the URS or UDRP actions as a complaint! This email's getting long, and the more sophisticated readers can see where this takes us. I won't go into too much more detail now (can expand later, if desired), but you'd need to develop a system not only to verify identity properly, but also a system to *DISAVOW* domain name registrations. That disavowal system would be very hard for domains (a disavowal system was developed by Google for backlinks, https://support.google.com/webmasters/answer/2648487?hl=en , but that's much easier). [Real verification could take place via a digital signature system, like the one that exists in Estonia, for example] And even if one did verify identity properly (e.g. "John Smith" is labelled a serial cybersquatter), there are so many people that share common names (think China, India) that the blacklist would have collateral damage on many innocent registrants. And here's the thing -- an attacker can simply create a new real identity (even a "verified" one) very cheaply. For £12, (USD $15.59 at the time of this post), one can create a real UK company online within 24 hours: https://www.gov.uk/limited-company-formation/register-your-company (or effectively "free" if one uses a stolen credit card, as criminals tend to do!) So, even a "properly" implemented system would not be effective, if one can create new verified identities at low cost. The only real parties within the ICANN system that *are* verified are registrars and registries, and I think they would likely push back very hard if they are the "losers" who have to pay up. [an unverified Complainant can put up a security bond before filing a complaint, and to that extent that bond could also represent security if the Complainant loses, albeit the Complainant themselves may not be who they say they are. [by the way, I do like the idea of posting security bonds, but not in the manner that the proposals have suggested --- I would want security bonds as a means for registrants to completely *opt-out* of URS/UDRP, so that any disputes for a "bonded" registrant/domain can be handled only by the courts] Even the real legal system (court system) could be subject to attempts at foul play using these kinds of tricks. However, real courts have much stronger due process mechanisms and machinery (e.g. court orders, contempt, etc.) to deal with them (e.g. subpoena the registrar who enabled the identity theft, discovery, etc.) and the real victim would have to be properly served, etc.. URS/UDRP providers don't have those strong mechanisms or powers. So, I'm very sympathetic to the motivation behind these proposals, and the objective to go after the bad guys. I want loser pays too, in order to protect my company from frivolous complaints. I know others with valuable domains want the same thing. But, the proposals on the table right now will need much, much more work before I can support them. All the various vulnerabilities that are present in the system *today* will be magnified if "loser pays" or "penalties" are adopted without addressing issues like verification and identity theft first. Sincerely, George Kirikos 416-588-0269 http://www.leap.com/ P.S. I don't know if we have any SSAC members on this PDP, but the broader issue of vulnerabilities and identity theft might be passed on to them for advice.

2 1

URS Proposal Submissions - 06 Sep 2018 & Final Count
by Ariel Liang Sept. 7, 2018

Sept. 7, 2018

Dear RPM WG members, This is to let you know that fourteen (14) URS Proposals were submitted by COB today (06 Sep 2018). Today is the deadline for individual WG members to submit Proposals for URS policy and operational recommendations. The SurveyMonkey form has been closed. By the deadline, thirty-three (33) URS Proposals have been submitted. You may see all the Proposals uploaded to the wiki page here: https://community.icann.org/x/aACNBQ Best Regards, Mary, Julie, Ariel & Berry

1 0