April 2022 - GNSO-TPR - lists.icann.org

suggested text for TAC composition
by James Galvin 29 Apr '22

29 Apr '22

At our last meeting on 26 April, I agreed to provide some suggested text for the composition of the TAC. I have attached a PDF document with my suggestions. I use the plural because it turns out that specifying minimum requirements for the TAC effects 3 preliminary recommendations, #7, #9, and #11. In the attached document I have highlighted my suggestions, and included the appropriate references. Unfortunately I will not be able to attend the next two meetings of the PDP, although I will be available via email to answer any questions or concerns that can not wait until my return on 17 May. Thanks, Jim

1 0

Draft Initial Report - Input Due 14 May 2022
by Emily Barabas 29 Apr '22

29 Apr '22

Dear working group members, As discussed on Tuesday’s call, staff had an action item to provide the draft Initial Report to the Working Group today for review. Please see the draft attached. Please carefully review this draft Initial Report in coordination with the groups you represent. If you feel that there are items that need to be revised, please enter them here<https://docs.google.com/document/d/1s9xumJ1XBPdTb7kQmc5sAC2AkszvfAF0freMvnx…>. For each item, please include: * Report version (the date listed in the header of the Initial Report draft) and applicable line numbers ( these are listed along the left margin of the document). * Name and group you represent: If multiple WG members represent a group, input should be in coordination with these other members. * Rationale: please provide a clear explanation for why you are proposing the revision. * Specific proposed revision: Provide the language you would like to see added/removed/edited. The deadline for submitting input is 14 May 2022. After the deadline, the working group will spend the following four working group meetings reviewing the items submitted in the input document. If your groups are unable to provide input by 14 May, feedback on the Initial Report can be provided during the public comment period. As you review, please note that some sections of the report are highlighted: * Text highlighted in purple is relatively new and should be reviewed closely. * Text highlighted in orange is still under discussion and may change. * Yellow highlights are administrative in nature can be ignored. Please do not hesitate to reach out with any questions about the review process. Kind regards, Caitlin, Julie, Berry, and Emily Emily Barabas Policy Development Support Senior Manager Internet Corporation for Assigned Names and Numbers (ICANN) Phone: +31 (0)6 84507976 www.icann.org [nam10.safelinks.protection.outlook.com]<https://urldefense.com/v3/__https:/nam10.safelinks.protection.outlook.com/?…>

1 0

Pre-Reading and Proposed agenda for meeting #45 on Tuesday 3 May 2022 at 16:00 UTC
by Emily Barabas 28 Apr '22

28 Apr '22

Dear Working Group members, Please find below the proposed agenda for the meeting scheduled to take place on Tuesday 3 May 2022 at 16:00 UTC. Before the meeting, please review the draft recommendations on NACK Charter Question h1 produced by the small group (see working document pages 16-23 here<https://docs.google.com/document/d/1L2bZnhJUY3VxyAjVCrkyVqdttOPn2EaqBARRRnE…>) Kind regards, Julie, Caitlin, Berry, and Emily Transfer Policy Review Phase 1 - Meeting #45 Proposed Agenda 1. Roll Call & SOI updates 2. Welcome & Chair updates 1. Draft recommendations on NACK Charter Question h1 produced by the small group (see working document pages 16-23 here<https://docs.google.com/document/d/1L2bZnhJUY3VxyAjVCrkyVqdttOPn2EaqBARRRnE…>) 2. AOB * Next call: Tuesday 10 May 2022 at 16:00 UTC

1 0

Post Call | Transfer Policy Review PDP WG | Tuesday, 26 April 2022
by Julie Bisland 26 Apr '22

26 Apr '22

Dear all, All recordings for the Transfer Policy Review PDP WG call held on Tuesday, 26 April 2022 at 16:00 UTC can be found on the agenda wiki page <https://community.icann.org/x/MhAiCw> (attendance included) and the GNSO Master calendar <https://urldefense.com/v3/__https:/gnso.icann.org/en/group-activities/calen…> . These include: * Attendance * Audio recording * Zoom chat archive * Zoom recording (including audio, visual, rough transcript) * Transcript As a reminder only members and alternates can join the call as a Panelist, observers can join as an Attendee to listen. For additional information, you may consult the mailing list archives <https://mm.icann.org/pipermail/gnso-tpr/> and the main wiki page<https://community.icann.org/x/P4aUCQ>. Thank you. With kind regards, Julie

1 0

Meeting Invitation | Transfer Policy Review PDP WG call | Tuesday, 03 May 2022
by Julie Bisland 26 Apr '22

26 Apr '22

Dear all, The next Transfer Policy Review PDP WG call is scheduled for Tuesday, 03 May 2022 at 16:00 UTC for 90 minutes. Zoom Room Information: Main Zoom Webinar link: https://icann.zoom.us/j/95363727469?pwd=N3A3OWFSaTlUME9wZzlGajk5VUI3QT09 <https://urldefense.com/v3/__https:/icann.zoom.us/j/95363727469?pwd=N3A3OWFS…> Passcode: @TP/^*4wg# If you are joining via audio only: One tap mobile: US: +19294362866,,95363727469#,,,,*7490739013# or +13017158592,,95363727469#,,,,*7490739013# Telephone: Dial (for higher quality, dial a number based on your current location): US: +1 929 436 2866 or +1 301 715 8592 or +1 312 626 6799 or +1 669 900 6833 or +1 253 215 8782 or +1 346 248 7799 or 888 788 0099 (Toll Free) or 877 853 5247 (Toll Free) Webinar ID: 953 6372 7469 Passcode: 7490739013 International numbers available: https://icann.zoom.us/u/acdLFXPLp6 <https://urldefense.com/v3/__https:/icann.zoom.us/u/acdLFXPLp6__;!!PtGJab4!v…> Members, alternates, and observers all have different access and participation directions, please read below! ALL: Before joining the call: * Please send apologies and dial out requests to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only * Please be sure you have read the ICANN Expected Standards of Behavior<https://www.icann.org/resources/pages/expected-standards-2016-06-28-en> * Visit the Wiki Agenda meeting page: https://community.icann.org/x/4BB1Cw * Check your time zone: https://tinyurl.com/mt3pwwny ONLY FOR MEMBERS & ALTERNATES: * Please join via the Main Zoom Webinar link above; staff will promote you to panelist. * Chat: Members (and alternates replacing members), please select Everyone so everyone can see and so it’s captured afterwards. * Alternate replacement confirmations – For tracking alternate replacements, use the google form [docs.google.com]<https://urldefense.com/v3/__https:/docs.google.com/forms/d/e/1FAIpQLScXP3-H…> to communicate the replacement (alternate) and the duration. This information will be publicly posted to the Alternate Log-Transfer Policy Review PDP<https://community.icann.org/x/V4aUCQ> wiki page. * Alternates (not replacing a member): Rename your line by adding THREE Zs (zzz) before your name and add, in parentheses (your affiliation - alternate) after your name. To rename in Zoom, hover over your name and click ‘rename’. * Alternates (not replacing a member) are not allowed to engage in the chat or use any of the other zoom room functionalities such as raising hands or agreeing/disagreeing. ONLY FOR OBSERVERS: * Observers will have ability to view member chat and information shared in the zoom webinar room. Observers will not be able to use chat or raise hands. Thank you. Kind regards, Julie

1 0

Notes and action items - TPR WG Meeting #44 - 26 April 2022 at 16:00 UTC
by Julie Hedlund 26 Apr '22

26 Apr '22

Dear TPR WG Members, Please find below the notes and action items from today’s meeting. The next TPR WG meeting will be on Tuesday, 03 May 2022 at 16:00 UTC. Best regards, Emily, Julie, Berry, and Caitlin Action Items: Discussion of Outstanding Items on TAC: 1. Recommendation 7 (TAC Security) Jim Galvin to suggest revisions to Sarah Wyld’s suggested text for WG members to review. 2.. Additional Candidate Recommendation xx under CQ b1 -- Staff to delete the recommendation. 3. Formerly Recommendation 6, now Recommendation 9: SME input on Recommendation 6.2: Jim Galvin to suggest some functional language for WG review. 4. Recommendation 13 --- Jim Galvin and Rick Wilhelm to consult with the RySG and either provide suggested alternative language or a rationale for why this recommendation should not be included. Previous Action Items: 1. WG members are encouraged to review the overview of proposed response to Charter Question h2 (see page 13 and 14 here [docs.google.com]<https://urldefense.com/v3/__https:/docs.google.com/document/d/1L2bZnhJUY3Vx…>) and provide comments and/or suggestions. 2. WG members are encouraged to review the overview of proposed responses to EPDP Phase 1, Recommendation 27 “Wave 1” Report items (see document here [docs.google.com]<https://urldefense.com/v3/__https:/docs.google.com/document/d/1ZLkSqD2bHDBo…>) and add comments in the column “Additional Notes/Discussion”. 3. Staff to suggest a definition along the lines of Designated Agent as referenced in the COR. Could say, “Working Group understands the Designated Representative to mean an individual or entity that the Registered Name Holder explicitly authorizes to obtain the TAC on their behalf.” Notes: Transfer Policy Review Phase 1 - Meeting #44 Tuesday, 26 April 2022 at 16:00 UTC Proposed Agenda 1. Roll Call & SOI updates 2. Welcome & Chair updates * Next few weeks will have quite a bit of reading in between our regular sessions. Staff are ramping up production of our documents for review. * Good time to touch base with your SGs/Cs so that if anyone has any comments or concerns let’s get them documented over the next two or three weeks, so that we can get the Initial Report wrapped up. 3. Upcoming milestones and deliverables for Initial Report: Initial Report Delivery 15 June 2022: * To the extent that SO/AC/SG/Cs want to provide input on the proposed recommendations to be included in the Initial Report, now is the time to provide that input through their members. * Members should be coordinating with the groups they represent. * If unable to provide input in the next three weeks, SO/AC/SG/Cs will have an additional opportunity to provide input during the public comment period on the Initial Report. Key Dates: * 29 April: Working Group members receive full draft of Initial Report for review. * 14 May: Deadline for member input on full draft of Initial Report. * 2 June: Community Webinar on Initial Report proposed recommendations. * 15 June: Publication on Initial Report for public comment. Upcoming Working Group Meetings: 3 May 2022 NACK 10 May 2022 Post-registration and post-transfer locks; Additional security measures 17 May 2022 Review of outstanding items 24 May 2022 Review of outstanding items 31 May 2022 Review of outstanding items 7 June 2022 Review of outstanding items 13 June 2022 ICANN74 session – Introduction to Change of Registrant (COR) - Phase 1(b) Highlights: * Highlight the fact that this is an Initial Report so there will be the opportunity to provide comments during the public comment period, if not before. Preferably WG members should liaise with their groups and provide any comments or concerns before the Initial Report is finalized. * Staff sent draft recommendations and the boilerplate language for the Initial Report for review. Can use line numbers to reference. * 29 April: WG members to receive full draft of the Initial Report for review for two weeks. * The two weeks are for the big type of items in the draft recommendations that the WG has been discussing for a while and the WG members should have been liaising on these during discussions, not at the end of discussions. * Note that we are avoiding using the term “lock” but instead referencing a restriction on transfers. 4. Discussion of Outstanding Items on TAC (see summary in tab 1 here [docs.google.com]<https://urldefense.com/v3/__https:/docs.google.com/spreadsheets/d/1VAeYHzXu…> and working document pages 15-19 here [docs.google.com]<https://urldefense.com/v3/__https:/docs.google.com/document/d/1O9PAnxWFUuPo…>) Row 11 -- Formerly Recommendation 3, now Recommendation 7 -- From Sarah Wyld, suggested text for Recommendation 7 (TAC Security) – See recent email: Here is the current shared draft text [docs.google.com]<https://urldefense.com/v3/__https:/docs.google.com/document/d/1O9PAnxWFUuPo…>: The Working Group recommends that ICANN org establish minimum requirements for the composition of the TAC (for example, minimum length, syntax, or entropy value) based on current applicable technical security standards. ICANN org may change these requirements in response to new or updated standards, but any changes to the requirements must go in effect with sufficient notification and time for contracted parties to implement the necessary updates. Here is my suggested updated version: The Working Group recommends that Registrars and Registry Operators follow best practices for the composition of the TAC (for example, minimum length, syntax, or entropy value) based on current applicable technical security standards such as RFC9154 or subsequent or similar RFCs. These best practices may be updated in response to new or updated standards as appropriate. Discussion: * Remove ICANN org as setting the standard? Who is in charge of updating/maintaining the best practices? * How to use the RFCs and keep them updated? * There are two things going on – like the text in principle but it needs to be split. Jim Galvin will propose some text. First, concerns around how randomness is done and to capture that properly. The other thing with 9154 is it is about being able to exchange the new TAC value between the registrar and registry, as well as TAC management (with reference to randomness RFC 4086). This is a technical issue that we need to call out. WG members should consider this. See RFC 9154 at: https://datatracker.ietf.org/doc/html/rfc9154#section-4.3. * Need to think about enforceability or compliance. How would ICANN org make sure that contracted parties are meeting the requirements of best practices. Needs to be enforceable. * Maybe there should be some mention that ICANN org could moderate? * Not sure that every requirement in contracts is testable by compliance. * Question: Don’t think we’ve settled yet on the issue of one TAC per domain name. Talked about multiple/bulk transfers – did we settle on having on TAC per package? Answer: We have settled on one TAC per domain; have some language to consider from Sarah on one TAC per package, so this is still an open item. * Need to make sure that we highlight the security implications of having one TAC per multi-domain transfer. * There is a gray area of implementation of technical standards. There is no specific enforcement of RFCs, so not sure what ICANN org could do if there was a transfer incident. * We can ask Steve Crocker on behalf of the SSAC, but they don’t really have a process to provide quick input on random topics. We need to be careful because these are commercial topics that impact the registry/registrar businesses. Maybe get feedback from TechOps and then see if there is an open item. * Might need to make clear if there isn’t agreement that this isn’t a consensus policy. * As a reminder, we are pointing to this recommendation as part of the justification for removing requirements for the Losing and Gaining FOA. ACTION ITEMS: Recommendation 7 (TAC Security) Jim Galvin to suggest revisions to Sarah Wyld’s suggested text for WG members to review. Row 12 -- Additional Candidate Recommendation xx under CQ b1: If a Gaining Registrar requests a transfer and an inter-registrar transfer lock is in place, the transfer must not proceed. * Don’t think we need a recommendation on this. * Question: Are we talking about ClientTransferProhibited or ServerTransferProhibited? Answer: Maybe both? * Question: Thought that registry locks were out of scope? Answer: It shouldn’t matter – it’s up to the registrar to resolve the lock. * Shouldn’t use the word “stop”. * We do have a recommendation in denial of transfers/NACKing that could address this – but that is on the sponsoring side, not the gaining side. * If a registry lock is out of scope then there can’t be a recommendation that says if there is a registry lock then you can’t transfer. * Think that there is some agreement for dropping this recommendation. ACTION ITEM: Additional Candidate Recommendation xx under CQ b1 -- Staff to delete the recommendation. Row 13 -- Response to CQ b2: Compliance input: For Contractual Compliance to be able to enforce the requirements, all requirements must be clearly enumerated and described within the text of the policy. * This is a general comment. * No need to revise. Row 14 -- SME input on Recommendation 6.2: The Registry MUST securely store the TAC per the requirements specified in recommendation 3. Recommendation text: “When the Registrar of Record sets the TAC at the Registry, the Registry MUST securely store the TAC using a one-way hash that protects the TAC from disclosure.” * Misunderstanding in reading the recommendation – no need for a change to the recommendation. * One-way hash means the registry stores it, but can’t recover it. * Including the specific requirement of a “one-way hash” is inconsistent with the goal to not be prescriptive. We don’t go into details in other handling of the TAC. * Suggested language from Jim Galvin: “the policy should speak to the functional requirement of cryptographically protecting the TAC such that its value cannot be recovered or disclosed once stored.” * #2 gets into more detail. And there are also security requirements for TAC handling that (should) exist for registrars. ACTION ITEM: Formerly Recommendation 6, now Recommendation 9: SME input on Recommendation 6.2: Jim Galvin to suggest some functional language for WG review. Row 15 -- input on Recommendation 6.3: Compliance recommends detailing how this information must be provided and that the provision of this information must be documented. Recommendation text: “When the Registrar of Record provides the TAC to the RNH or their designated representative, the Registrar of Record MUST also provide information about when the TAC will expire.” * Don’t have to tell the Registrar of Record how they have to track when the TAC will expire. So no recording requirement. * No need for changes to the recommendation. Row 16 -- SME input on Recommendation 6.3: Consider developing standard easy to understand language for registrants around this additional info about when the TAC will expire, etc. * No need for changes to the recommendation. Row 17 -- Formerly Recommendation 9, now Recommendation 11: Compliance input: If this is an obligation to be added to the Transfer Policy for registries, Compliance recommends that the text in the policy explains what “clear” means (what actions this entails) so that Compliance is able to enforce it against registries where applicable. Recommendation text: “The working group recommends that the TAC MUST be “one-time use.” In other words, it MUST be used no more than once per domain name. The Registry Operator MUST clear the TAC as part of completing the successful transfer request.” * It should be clear to the RNH, but the registrar can figure out how best to explain it. * No need for changes to the recommendation. Row 18 -- Formerly Recommendation 11, now Recommendation 13: SME input on Recommendation 11.1: Suggestion to use hours instead of calendar days to avoid confusion. Recommendation text: 13.1: A standard Time to Live (TTL) for the TAC MUST be 14 calendar days from the time it is set at the Registry, enforced by the Registries. 13.2: The Registrar of Record MAY set the TAC to null: · At any time in response to a request from the RNH. · After a period of less than 14 days by agreement by the Registrar of Record and the RNH. * Not sure when we settled on this text with respect to registries. The problem is that one of two things have to be true: registrars won’t have any information why this failed, and someone will have to do some research. You will want to talk to the registry to see what happens, but this means that the registry will have to keep logs. Don’t think registries are comfortable with this. * Another alternative if the registries could reject a transfer if the user didn’t provide an AuthInfo code or presented an expired TAC, then they would have to track the time stamp and reason rejection. ACTION ITEM: Recommendation 13 --- Jim Galvin and Rick Wilhelm to consult with the RySG and either provide suggested alternative language or a rationale for why this recommendation should not be included. 5. AOB * Next call: Tuesday 3 May 2022 at 16:00 UTC

1 0

**On in 15 minutes** Meeting Invitation | Transfer Policy Review PDP WG call | Tuesday, 26 April 2022
by Julie Bisland 26 Apr '22

26 Apr '22

**On in 15 minutes** Dear all, The next Transfer Policy Review PDP WG call is scheduled for Tuesday, 26 April 2022 at 16:00 UTC for 90 minutes. Zoom Room Information: Main Zoom Webinar link: https://icann.zoom.us/j/95363727469?pwd=N3A3OWFSaTlUME9wZzlGajk5VUI3QT09 <https://urldefense.com/v3/__https:/icann.zoom.us/j/95363727469?pwd=N3A3OWFS…> Passcode: @TP/^*4wg# If you are joining via audio only: One tap mobile: US: +19294362866,,95363727469#,,,,*7490739013# or +13017158592,,95363727469#,,,,*7490739013# Telephone: Dial (for higher quality, dial a number based on your current location): US: +1 929 436 2866 or +1 301 715 8592 or +1 312 626 6799 or +1 669 900 6833 or +1 253 215 8782 or +1 346 248 7799 or 888 788 0099 (Toll Free) or 877 853 5247 (Toll Free) Webinar ID: 953 6372 7469 Passcode: 7490739013 International numbers available: https://icann.zoom.us/u/acdLFXPLp6 <https://urldefense.com/v3/__https:/icann.zoom.us/u/acdLFXPLp6__;!!PtGJab4!v…> Members, alternates, and observers all have different access and participation directions, please read below! ALL: Before joining the call: * Please send apologies and dial out requests to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only * Please be sure you have read the ICANN Expected Standards of Behavior<https://www.icann.org/resources/pages/expected-standards-2016-06-28-en> * Visit the Wiki Agenda meeting page: https://community.icann.org/x/MhAiCw * Check your time zone: https://tinyurl.com/53s57jmh [tinyurl.com]<https://urldefense.com/v3/__https:/tinyurl.com/53s57jmh__;!!PtGJab4!tfUiVud…> ONLY FOR MEMBERS & ALTERNATES: * Please join via the Main Zoom Webinar link above; staff will promote you to panelist. * Chat: Members (and alternates replacing members), please select Everyone so everyone can see and so it’s captured afterwards. * Alternate replacement confirmations – For tracking alternate replacements, use the google form [docs.google.com]<https://urldefense.com/v3/__https:/docs.google.com/forms/d/e/1FAIpQLScXP3-H…> to communicate the replacement (alternate) and the duration. This information will be publicly posted to the Alternate Log-Transfer Policy Review PDP<https://community.icann.org/x/V4aUCQ> wiki page. * Alternates (not replacing a member): Rename your line by adding THREE Zs (zzz) before your name and add, in parentheses (your affiliation - alternate) after your name. To rename in Zoom, hover over your name and click ‘rename’. * Alternates (not replacing a member) are not allowed to engage in the chat or use any of the other zoom room functionalities such as raising hands or agreeing/disagreeing. ONLY FOR OBSERVERS: * Observers will have ability to view member chat and information shared in the zoom webinar room. Observers will not be able to use chat or raise hands. Thank you. Kind regards, Devan

1 0

For WG Review: All draft recommendations and Initial Report "boilerplate" language
by Emily Barabas 25 Apr '22

25 Apr '22

Dear Working Group members, As discussed on our recent calls, staff has an action item to consolidate all preliminary recommendations in a single document to support your review and consideration of the TPR recommendations package as a whole. You can find the document here<https://docs.google.com/document/d/1clAqB1wBeOf9ZC5RMMxKrrUTs3N2WyaVYTIyVy_…>. To assist with version control, please use this version as a reference but do not comment or redline directly in the document. On tomorrow’s call, we will discuss methods that the WG will use for additional input on the recommendations going forward. In addition, to help members get a head start on reviewing the Initial Report, staff is providing a PDF version of the “boilerplate” portions of the Initial Report. This document gives you a sense of the structure of the report and the sections that will be included. Staff has filled in text for the standard sections including background, methodology, membership, etc. If, in reviewing this boilerplate text, you think edits are needed, please enter them here<https://docs.google.com/spreadsheets/d/1NwOtAOal-emcaRTr__ic0vOlQoitNUp8zoh…>. Kind regards, Caitlin, Julie, Berry, and Emily Emily Barabas Policy Development Support Senior Manager Internet Corporation for Assigned Names and Numbers (ICANN) Phone: +31 (0)6 84507976 www.icann.org<http://www.icann.org/>

1 0

**REMINDER** Meeting Invitation | Transfer Policy Review PDP WG call | Tuesday, 26 April 2022
by Julie Bisland 25 Apr '22

25 Apr '22

Dear all, The next Transfer Policy Review PDP WG call is scheduled for Tuesday, 26 April 2022 at 16:00 UTC for 90 minutes. Zoom Room Information: Main Zoom Webinar link: https://icann.zoom.us/j/95363727469?pwd=N3A3OWFSaTlUME9wZzlGajk5VUI3QT09 <https://urldefense.com/v3/__https:/icann.zoom.us/j/95363727469?pwd=N3A3OWFS…> Passcode: @TP/^*4wg# If you are joining via audio only: One tap mobile: US: +19294362866,,95363727469#,,,,*7490739013# or +13017158592,,95363727469#,,,,*7490739013# Telephone: Dial (for higher quality, dial a number based on your current location): US: +1 929 436 2866 or +1 301 715 8592 or +1 312 626 6799 or +1 669 900 6833 or +1 253 215 8782 or +1 346 248 7799 or 888 788 0099 (Toll Free) or 877 853 5247 (Toll Free) Webinar ID: 953 6372 7469 Passcode: 7490739013 International numbers available: https://icann.zoom.us/u/acdLFXPLp6 <https://urldefense.com/v3/__https:/icann.zoom.us/u/acdLFXPLp6__;!!PtGJab4!v…> Members, alternates, and observers all have different access and participation directions, please read below! ALL: Before joining the call: * Please send apologies and dial out requests to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only * Please be sure you have read the ICANN Expected Standards of Behavior<https://www.icann.org/resources/pages/expected-standards-2016-06-28-en> * Visit the Wiki Agenda meeting page: https://community.icann.org/x/MhAiCw * Check your time zone: https://tinyurl.com/53s57jmh [tinyurl.com]<https://urldefense.com/v3/__https:/tinyurl.com/53s57jmh__;!!PtGJab4!tfUiVud…> ONLY FOR MEMBERS & ALTERNATES: * Please join via the Main Zoom Webinar link above; staff will promote you to panelist. * Chat: Members (and alternates replacing members), please select Everyone so everyone can see and so it’s captured afterwards. * Alternate replacement confirmations – For tracking alternate replacements, use the google form [docs.google.com]<https://urldefense.com/v3/__https:/docs.google.com/forms/d/e/1FAIpQLScXP3-H…> to communicate the replacement (alternate) and the duration. This information will be publicly posted to the Alternate Log-Transfer Policy Review PDP<https://community.icann.org/x/V4aUCQ> wiki page. * Alternates (not replacing a member): Rename your line by adding THREE Zs (zzz) before your name and add, in parentheses (your affiliation - alternate) after your name. To rename in Zoom, hover over your name and click ‘rename’. * Alternates (not replacing a member) are not allowed to engage in the chat or use any of the other zoom room functionalities such as raising hands or agreeing/disagreeing. ONLY FOR OBSERVERS: * Observers will have ability to view member chat and information shared in the zoom webinar room. Observers will not be able to use chat or raise hands. Thank you. Kind regards, Devan

1 0

Suggested text for Rec 7 (TAC Security)
by Sarah Wyld 25 Apr '22

25 Apr '22

Hello Team, I am here to propose new text for our Recommendation #7 (was #3) which sets out security requirements for the TAC. Here is the current shared draft text: The Working Group recommends that ICANN org establish minimum requirements for the composition of the TAC (for example, minimum length, syntax, or entropy value) based on current applicable technical security standards. ICANN org may change these requirements in response to new or updated standards, but any changes to the requirements must go in effect with sufficient notification and time for contracted parties to implement the necessary updates. Here is my suggested updated version: The Working Group recommends that Registrars and Registry Operators follow best practices for the composition of the TAC (for example, minimum length, syntax, or entropy value) based on current applicable technical security standards such as RFC9154 or subsequent or similar RFCs. These best practices may be updated in response to new or updated standards as appropriate. Or if redline is preferred: The Working Group recommends that ICANN org establish minimum requirements Registrars and Registry Operators follow best practices for the composition of the TAC (for example, minimum length, syntax, or entropy value) based on current applicable technical security standards such as RFC9154 or subsequent or similar RFCs. These best practices may be updated ICANN org may change these requirements in response to new or updated standards as appropriate, but any changes to the requirements must go in effect with sufficient notification and time for contracted parties to implement the necessary updates. This has been discussed (with generally positive sentiment) in the CPH TechOps team. Thank you! -- Sarah Wyld, CIPP/E Policy & Privacy Manager Pronouns: she/they swyld(a)tucows.com

1 0