October 2021 - GNSO-TPR - lists.icann.org

Notes and action items - TPR WG Meeting #20 - 5 Oct 2021
by Caitlin Tubergen Oct. 5, 2021

Oct. 5, 2021

Dear TPR WG Members, Please find below the notes and action items from today’s call. The next TPR WG meeting will be Tuesday, 12 October at 16:00 UTC. Best regards, Emily, Julie, Berry, and Caitlin Action Items 1. Working Group Members to review the table on p. 14 of the Gaining FOA working document<https://docs.google.com/document/d/1QOCzbLh7w4hdijpAsg6_lybddr0nlsFDcWjdz5e…>, which sets out the purposes/functions of the pre-GDPR Gaining FOA. The purposes/functions are listed in an effort to ensure that if the Gaining FOA is ultimately eliminated, any important purpose/function is covered elsewhere or in an updated step of the transfer process by Monday, 11 October. 2. TPR Support Staff to review the transcript from today's call and document the rationales described for why the Gaining FOA may be technically feasible, but it is NOT commercially feasible or legally authorized under the current data protection landscape. 3. Working Group Members to review the TAC Candidate Recommendations, beginning on p. 17 of the Auth-Info Code working document<https://docs.google.com/document/d/1O9PAnxWFUuPofLQCWIQXz8lT7KEj1HgH3b_obh0…>, and provide comments, concerns, and proposed edits, etc., by Monday, 11 October. Transfer Policy Review Phase 1 - Meeting #20 Tuesday 5 October 2021 at 16:00 UTC 1. Roll Call & SOI Updates (5 minutes) * Tucows has recently purchased the registry platform of another company. Sarah will continue to represent the RrSG but wanted to note this. * Thomas Keller has left the RrSG, and accordingly, has left the WG. 2. Welcome & Chair updates (5 minutes) 3. Upcoming meeting schedule and ICANN72 (5 minutes) * TPR session will be Tuesday, 26 October at 10:30-12:00 UTC. This will function as a normal WG meeting. * The Tuesday, 2 November meeting immediately following ICANN72 will be cancelled. 4. Gaining FOA (40 minutes) · Gaining FOA working document [docs.google.com]<https://urldefense.com/v3/__https:/docs.google.com/document/d/1QOCzbLh7w4hd…> · In reviewing the Gaining FOA, support staff has outlined the functions of the Gaining FOA to see if the functions and security measures are covered. * 1. Provides a verification step that is distinct from any processes with the Losing Registrar. * The Gaining and Losing FOA were methods of how to transfer the domain name. These were not really a verification step. With the verification of the TAC, this would be covered. * If the Gaining FOA is removed and the team is relying on stronger security features, wonder if now is a good time to discuss what some of those additional security features may be. For example, when thinking about the entire transfer process, is it worth giving initial indications about what additional security measures could be explored in the context of the Gaining FOA being removed. With respect to Charter question a3, the Temp Spec references other secure methods – is this something that should be explored here? * The team already put in details regarding the TAC – does anyone believe this requires more discussion? * The process the WG is going through is trying to capture the deliberation and rationale that is being proposed by the WG. Part of that process is trying to consider other possible aspects. For example, Charter question a3 – until such time as the RDAP service or other secure method…the Temp Spec is pointing to RDAP and/or some secure method for transferring the data. For now, set aside the questions of lawfulness – the group needs to provide appropriate rationale for why the Gaining FOA is no longer required. As a practical matter, pre-GDPR, the Gaining Registrar got information automated via Port43, and registrars whitelisted each other to facilitate this. Could it be conceivable that now that RDAP is partially initiated that in two years – could a whitelist function be implemented that would allow registrars to still obtain the email address of an registered name holder? Or if not as simple as whitelisting, is there some sort of authentication mechanism that could be considered? This is the kind of deliberation that needs to happen here to provide the rationale for why the Gaining FOA could be removed. * The technical answer is yes – there are many ways to facilitate this; however, we must consider data protection law. * There will not be a legal basis for this transfer – the Gaining FOA is not needed. This is also probably not commercially feasible. * This could end up being very confusing for the registrant. In some jurisdictions, this is not possible, and transfers would be handled differently from registrar to registrar – this is not ideal. * Could the SSAD, if it were to be approved, be a way for registrars to gain access to the registered name holder’s data? UDRP providers are envisioned to use SSAD to verify the respondent in a UDRP complaint; similarly, could gaining registrars use SSAD to verify the identity of the registered name holder for purposes of a transfer? * Prior to GDPR, there was a system called RADAR that registrars could use. The problem would be the level of effort where you are potentially losing a paying customer could be cost-prohibitive. This does not overcome the risk of the transfer of personal information under GDPR. * Worthy to note that yes, there may be technical solutions. Is legal advice necessary to make a determination about the lawfulness of the processing of data? One member noted that there is not a lawful basis to process this data. This warrants an action by this group to document the lawfulness or lack thereof of processing this data. This is important to document for the purpose of public comment and the board. The response that this is not lawful will not be adequate. In today’s world, there is still a balancing for disclosure to UDRP providers. Recommend the group is very technically and legally precise and makes this understandable for those outside of this group. * Support Staff to pull out the relevant portions of this conversation to document rationales discussed * It is not that the gaining FOA is not obtaining the PII. It used to be that the public WHOIS was used to send the FOA to the domain owner. The Team has to ground this transfer in necessity. Unlike the UDRP, where the data is necessary, the transfer process has functioned properly without the Gaining FOA for years without instances of increased domain name theft. * ICANN community seems to be very easy going on the data that is collected and processed. The data registrars have, in general, is high level data, and it poses a huge security risk. * Transfers used to be just FOAs and then auth-info codes were added to make it more secure. Auth-info codes obviated the need for Gaining FOAs, and the last three years have additionally proven this point. * Gaining FOA also provides notice that registrant will need to enter into Registration Agreement with new Registrar * The registrant will need to enter into a registration agreement, but the Gaining FOA is not the first interaction between the gaining registrar and the registrant. The terms of service and registration agreement should happen before the Gaining FOA step. * Confirm the transfer in a 5-day window – have to actively knowledge the transfer – this may be a security feature that is not covered in future-state. * Loosely provides instructions about how to stop the transfer. * This chart is helpful – the 5-day window is already covered (item 2) and provides instructions about to stop the transfer is already covered in item 5. * Encourage members to continue adding reasons to the right side of the column so that the rationale is clearly documented. * 2. Transfer may proceed only when RNH has responded to this notification, therefore the notification is always well in advance of the transfer taking place. * 3. Gaining Rr obtains PII from Losing Rr and uses it to send Gaining FOA. * 4. Express authorization by RNH is needed for transfer to proceed. * 5. If the RNH takes no action in response to the Gaining FOA, transfer does not proceed. * 6. The Gaining FOA provides documentation that RNH has authorized the transfer. 1. Review of draft responses to charter questions and candidate recommendations for AuthInfo Codes (30 minutes) · AuthInfo Codes working document [docs.google.com]<https://urldefense.com/v3/__https:/docs.google.com/document/d/1O9PAnxWFUuPo…> · Based on the Team’s previous discussions, Support Staff drafted responses to the charter questions and accompanying candidate recommendations for the WG to review. · Note: these are not draft recommendations at this stage. · Candidate Recommendation 1: The Working Group recommends that the Transfer Policy and all related policies use the term “Transfer Authorization Code (TAC)” in place of the currently-used term “AuthInfo Code.” This recommendation is for an update to terminology only and does not imply any other changes to the substance of the policies. · Candidate Recommendation 2: The Working Group recommends that the Transfer Authorization Code be defined as follows: “A Transfer Authorization Code (TAC) is a code created by a Registrar of Record to validate that a request to transfer domain name in a generic top-level domain (gTLD) is submitted by the authorized person. A TAC is required for a Registered Name Holder to transfer a domain name from one Registrar to another.” * It is reasonable in some situations where someone other than the domain owner would have the TAC. Not sure this should be limited to authorized person. WG considered that having the TAC makes someone an authorized person. · Candidate Recommendation 3: The Working Group recommends that the Transfer Policy require that the TAC must be a minimum of [16 characters] [32 characters] in length or any alternative minimum length prescribed by ICANN from time to time. * There were two suggestions for length, so both options are included in brackets. · Candidate Recommendation 4: The Working Group recommends that the Transfer Policy require that the TAC include at a minimum of one uppercase letter, one lowercase letter, one number, and one special character. * ICANN internal colleagues noted that entropy is important – for example, 128 bits of entropy. * Instead of specifying, perhaps reference a security standard like NIST. * The problem with specifying a current standard is what happens when the standard changes – how long do registrars have to implement the new standard? * Could consider adding – or different length as prescribed by ICANN * Could the policy recommendation be for ICANN to set the specific standard as prescribed by NIST – in other words, the policy itself would be specific, but the policy recommendation would not be specific to allow for flexibility. · Candidate Recommendation 5: The Working Group recommends that the registry verify that the TAC meets the requirements specified in Recommendations 3 and 4. * When should this verification take place? If anyone has comments, please populate in the document. · Candidate Recommendation 6: [The Working Group recommends that the Registrar of Record [and registrant] receive a notification after [number] failed attempts to enter the TAC. ICANN Org may change from time to time the number of failed attempts that trigger a notification.] OR [The Working Group recommends that after [number] failed attempts to enter the TAC, it is not possible to attempt a transfer for [period of time]. ICANN Org may change from time to time the number of failed attempts that trigger this result.]. 5. AOB (5 minutes) · Next meeting: 12 October 2021 @ 16.00 UTC

1 0

Post Call | Transfer Policy Review PDP WG | Tuesday, 05 October 2021
by Julie Bisland Oct. 5, 2021

Oct. 5, 2021

Dear all, All recordings for the Transfer Policy Review PDP WG call held on Tuesday, 05 October 2021 at 16:00 UTC can be found on the agenda wiki page <https://community.icann.org/x/LAA_Cg> (attendance included) and the GNSO Master calendar [gnso.icann.org]<https://urldefense.com/v3/__https:/gnso.icann.org/en/group-activities/calen…>. These include: * Attendance (please let me know if your name has been left off the attendance list) * Audio recording * Zoom chat archive * Zoom recording (including audio, visual, rough transcript) * Transcript As a reminder only members and alternates can join the call as a Panelist, observers can join as an Attendee to listen. For additional information, you may consult the mailing list archives <https://mm.icann.org/pipermail/gnso-tpr/> and the main wiki page<https://community.icann.org/x/P4aUCQ>. Thank you. With kind regards, Julie

1 0

Meeting Invitation | Transfer Policy Review PDP WG call | Tuesday, 12 October 2021 at 16:00 UTC
by Julie Bisland Oct. 5, 2021

Oct. 5, 2021

Dear all, The next Transfer Policy Review PDP WG call is scheduled for Tuesday, 12 October 2021 at 16:00 UTC for 90 minutes. Zoom Room Information: Main Zoom Webinar link: https://icann.zoom.us/j/95363727469?pwd=N3A3OWFSaTlUME9wZzlGajk5VUI3QT09 [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/j/95363727469?pwd=N3A3OWFS…> Passcode: @TP/^*4wg# If you are joining via audio only: One tap mobile: US: +19294362866,,95363727469#,,,,*7490739013# or +13017158592,,95363727469#,,,,*7490739013# Telephone: Dial (for higher quality, dial a number based on your current location): US: +1 929 436 2866 or +1 301 715 8592 or +1 312 626 6799 or +1 669 900 6833 or +1 253 215 8782 or +1 346 248 7799 or 888 788 0099 (Toll Free) or 877 853 5247 (Toll Free) Webinar ID: 953 6372 7469 Passcode: 7490739013 International numbers available: https://icann.zoom.us/u/acdLFXPLp6 [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/u/acdLFXPLp6__;!!PtGJab4!v…> Members, alternates, and observers all have different access and participation directions, please read below! ALL: Before joining the call: * Please send apologies and dial out requests to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only * Please be sure you have read the ICANN Expected Standards of Behavior<https://www.icann.org/resources/pages/expected-standards-2016-06-28-en> * Visit the Wiki Agenda meeting page: https://community.icann.org/x/LgA_Cg * Check your time zone: https://tinyurl.com/5znrvb37 ONLY FOR MEMBERS & ALTERNATES: * Please join via the Main Zoom Webinar link above and staff will promote you to panelist. * Chat: Members (and alternates replacing members), please select Everyone so everyone can see and so it’s captured afterwards. * Alternate replacement confirmations – For tracking alternate replacements, use the google form [docs.google.com]<https://urldefense.com/v3/__https:/docs.google.com/forms/d/e/1FAIpQLScXP3-H…> to communicate the replacement (alternate) and the duration. This information will be publicly posted to the Alternate Log-Transfer Policy Review PDP<https://community.icann.org/x/V4aUCQ> wiki page. * Alternates (not replacing a member): Rename your line by adding THREE Zs (zzz) before your name and add, in parentheses (your affiliation - alternate) after your name. To rename in Zoom, hover over your name and click ‘rename’. * Alternates (not replacing a member) are not allowed to engage in the chat or use any of the other zoom room functionalities such as raising hands or agreeing/disagreeing. ONLY FOR OBSERVERS: * Observers will have ability to view member chat and information shared in the zoom webinar room. Observers will not be able to use chat or raise hands. Thank you. Kind regards, Julie

1 0

TPR-P1 // 30 Sep 2021 Project Package
by Berry Cobb Oct. 5, 2021

Oct. 5, 2021

Dear WG, Please find a link below to project package for the TPR-P1 PDP (30 Sep 2021). This package is a snap-shot at the close of each month and developed by the leadership team to report on the working group’s activities and status of the project. It is also distributed to the GNSO Council to keep them informed as managers of the PDP. The package is deposited on the wiki so that we can track access statistics. Link: https://community.icann.org/x/MQDQCQ 1. Page 01 – Summary dashboard 2. Page 02 – Project Sitrep – an extract from the Council’s Project List 3. Page 03,4 – Group roster 4. Page 05 – Work and activity metrics 5. Page 06 – Group attendance for plenary meetings 6. Page 07 – Project Plan, Gantt chart 7. Page 08-09 – Work plan & Action items for the period Key points: * The WG is proceeding according to plan against the charter topics/questions; nothing substantive to report for this period. Please let us know if you have questions. Thank you. B Berry Cobb Policy Development - Portfolio Manager Internet Corporation for Assigned Names and Numbers (ICANN) berry.cobb(a)icann.org

1 0

**On in 12 minutes** Meeting Invitation | Transfer Policy Review PDP WG call | Tuesday, 05 October 2021 at 16:00 UTC
by Julie Bisland Oct. 5, 2021

Oct. 5, 2021

Dear all, The next Transfer Policy Review PDP WG call is scheduled for Tuesday, 05 October 2021 at 16:00 UTC for 90 minutes. Zoom Room Information: Main Zoom Webinar link: https://icann.zoom.us/j/95363727469?pwd=N3A3OWFSaTlUME9wZzlGajk5VUI3QT09 [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/j/95363727469?pwd=N3A3OWFS…> Passcode: @TP/^*4wg# If you are joining via audio only: One tap mobile: US: +19294362866,,95363727469#,,,,*7490739013# or +13017158592,,95363727469#,,,,*7490739013# Telephone: Dial (for higher quality, dial a number based on your current location): US: +1 929 436 2866 or +1 301 715 8592 or +1 312 626 6799 or +1 669 900 6833 or +1 253 215 8782 or +1 346 248 7799 or 888 788 0099 (Toll Free) or 877 853 5247 (Toll Free) Webinar ID: 953 6372 7469 Passcode: 7490739013 International numbers available: https://icann.zoom.us/u/acdLFXPLp6 [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/u/acdLFXPLp6__;!!PtGJab4!v…> Members, alternates, and observers all have different access and participation directions, please read below! ALL: Before joining the call: * Please send apologies and dial out requests to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only * Please be sure you have read the ICANN Expected Standards of Behavior<https://www.icann.org/resources/pages/expected-standards-2016-06-28-en> * Visit the Wiki Agenda meeting page: https://community.icann.org/x/LAA_Cg * Check your time zone: https://tinyurl.com/xj8cpk8d [tinyurl.com]<https://urldefense.com/v3/__https:/tinyurl.com/xj8cpk8d__;!!PtGJab4!rgneDUX…> ONLY FOR MEMBERS & ALTERNATES: * Please join via the Main Zoom Webinar link above and staff will promote you to panelist. * Chat: Members (and alternates replacing members), please select Everyone so everyone can see and so it’s captured afterwards. * Alternate replacement confirmations – For tracking alternate replacements, use the google form [docs.google.com]<https://urldefense.com/v3/__https:/docs.google.com/forms/d/e/1FAIpQLScXP3-H…> to communicate the replacement (alternate) and the duration. This information will be publicly posted to the Alternate Log-Transfer Policy Review PDP<https://community.icann.org/x/V4aUCQ> wiki page. * Alternates (not replacing a member): Rename your line by adding THREE Zs (zzz) before your name and add, in parentheses (your affiliation - alternate) after your name. To rename in Zoom, hover over your name and click ‘rename’. * Alternates (not replacing a member) are not allowed to engage in the chat or use any of the other zoom room functionalities such as raising hands or agreeing/disagreeing. ONLY FOR OBSERVERS: * Observers will have ability to view member chat and information shared in the zoom webinar room. Observers will not be able to use chat or raise hands. Thank you. Kind regards, Julie

1 0

Transfer PDP - Your participation is needed
by Roger D Carney Oct. 4, 2021

Oct. 4, 2021

Dear Working Group members, As we wrap up our initial discussions on the Gaining FOA and prepare to draft candidate recommendations on this topic, I want to remind all members how important it is to participate in the deliberations taking place right now. Since the Temp Spec was put in place in May 2018, the requirements of the Gaining FOA have been deferred but are technically still part of the current Transfer Policy. We are discussing and leaning towards elimination (specifically the sharing of PII data, the exact content of the Gaining FOA, and changing from an active response required to a passive notification) of the Gaining FOA, which is a significant change from the existing policy. If you have not already spoken up on this topic, now is the time. Please coordinate with the groups you represent to get their input and attend the calls to weigh in. As a reminder: * If you can’t attend a call, please make sure an alternate is appointed to attend in your place. * If an alternate can’t step in for you, please listen to the recording and provide input on the mailing list. * If you frequently find yourself unable to attend calls and participate on list, please coordinate with your appointing group and decide together whether it might make sense for another person to serve as a member instead. We are making great progress in this PDP, and we want to make sure that all points of view are included in the recommendations that are being drafted. Thanks for your commitment to this effort. Kind regards, Roger

1 0

**REMINDER** Meeting Invitation | Transfer Policy Review PDP WG call | Tuesday, 05 October 2021 at 16:00 UTC
by Julie Bisland Oct. 4, 2021

Oct. 4, 2021

Dear all, The next Transfer Policy Review PDP WG call is scheduled for Tuesday, 05 October 2021 at 16:00 UTC for 90 minutes. Zoom Room Information: Main Zoom Webinar link: https://icann.zoom.us/j/95363727469?pwd=N3A3OWFSaTlUME9wZzlGajk5VUI3QT09 [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/j/95363727469?pwd=N3A3OWFS…> Passcode: @TP/^*4wg# If you are joining via audio only: One tap mobile: US: +19294362866,,95363727469#,,,,*7490739013# or +13017158592,,95363727469#,,,,*7490739013# Telephone: Dial (for higher quality, dial a number based on your current location): US: +1 929 436 2866 or +1 301 715 8592 or +1 312 626 6799 or +1 669 900 6833 or +1 253 215 8782 or +1 346 248 7799 or 888 788 0099 (Toll Free) or 877 853 5247 (Toll Free) Webinar ID: 953 6372 7469 Passcode: 7490739013 International numbers available: https://icann.zoom.us/u/acdLFXPLp6 [icann.zoom.us]<https://urldefense.com/v3/__https:/icann.zoom.us/u/acdLFXPLp6__;!!PtGJab4!v…> Members, alternates, and observers all have different access and participation directions, please read below! ALL: Before joining the call: * Please send apologies and dial out requests to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only * Please be sure you have read the ICANN Expected Standards of Behavior<https://www.icann.org/resources/pages/expected-standards-2016-06-28-en> * Visit the Wiki Agenda meeting page: https://community.icann.org/x/LAA_Cg * Check your time zone: https://tinyurl.com/xj8cpk8d [tinyurl.com]<https://urldefense.com/v3/__https:/tinyurl.com/xj8cpk8d__;!!PtGJab4!rgneDUX…> ONLY FOR MEMBERS & ALTERNATES: * Please join via the Main Zoom Webinar link above and staff will promote you to panelist. * Chat: Members (and alternates replacing members), please select Everyone so everyone can see and so it’s captured afterwards. * Alternate replacement confirmations – For tracking alternate replacements, use the google form [docs.google.com]<https://urldefense.com/v3/__https:/docs.google.com/forms/d/e/1FAIpQLScXP3-H…> to communicate the replacement (alternate) and the duration. This information will be publicly posted to the Alternate Log-Transfer Policy Review PDP<https://community.icann.org/x/V4aUCQ> wiki page. * Alternates (not replacing a member): Rename your line by adding THREE Zs (zzz) before your name and add, in parentheses (your affiliation - alternate) after your name. To rename in Zoom, hover over your name and click ‘rename’. * Alternates (not replacing a member) are not allowed to engage in the chat or use any of the other zoom room functionalities such as raising hands or agreeing/disagreeing. ONLY FOR OBSERVERS: * Observers will have ability to view member chat and information shared in the zoom webinar room. Observers will not be able to use chat or raise hands. Thank you. Kind regards, Julie

1 0

Proposed agenda for meeting #20 on Tuesday 5 October 2021 at 16:00 UTC
by Emily Barabas Oct. 1, 2021

Oct. 1, 2021

Dear Working Group members, Please find below the proposed agenda for the meeting scheduled to take place on Tuesday 5 October 2021 at 16:00 UTC. For agenda item 5, we will be focusing on draft responses to charter questions and “candidate” recommendations on AuthInfo Codes beginning on page 16: https://docs.google.com/document/d/1O9PAnxWFUuPofLQCWIQXz8lT7KEj1HgH3b_obh0…. Kind regards, Julie, Caitlin, Berry, and Emily Transfer Policy Review Phase 1 - Meeting #20 Proposed Agenda Tuesday 5 October 2021 at 16:00 UTC 1. Roll Call & SOI Updates (5 minutes) 2. Welcome & Chair updates (5 minutes) 3. Upcoming meeting schedule and ICANN72 (5 minutes) 4. Gaining FOA (40 minutes) * Gaining FOA working document<https://docs.google.com/document/d/1QOCzbLh7w4hdijpAsg6_lybddr0nlsFDcWjdz5e…> 1. Review of draft responses to charter questions and candidate recommendations for AuthInfo Codes (30 minutes) * AuthInfo Codes working document<https://docs.google.com/document/d/1O9PAnxWFUuPofLQCWIQXz8lT7KEj1HgH3b_obh0…> 5. AOB (5 minutes) * Next meeting: 12 October 2021 @ 16.00 UTC

1 0