July 2022 - GNSO-TPR - lists.icann.org

TPR member homework - due Monday 1 August 2022
by Emily Barabas Aug. 1, 2022

Aug. 1, 2022

Dear Working Group members, As discussed on today’s call, please find attached the analysis matrix for each Working Group member to complete either individually or in a small group of your choosing. As you work through the sheet, please feel free to refer to the Google Doc version<https://docs.google.com/spreadsheets/d/1eB3cowSoEp4ERoqQmlc3hc5dpV4g5NzP/ed…>, which includes example text in italics. Please fill in the full sheet, from your own perspective, and send to emily.barabas(a)icann.org<mailto:emily.barabas@icann.org> no later than Monday 1 August 2022. This will allow us to discuss the aggregate responses on our next call scheduled for Tuesday 2 August. If you have any questions about the exercise or need assistance as you go through it, please feel free to contact the staff support team. Thanks in advance for your input. Kind regards, Julie, Caitlin, Berry, and Emily Emily Barabas Policy Development Support Senior Manager Internet Corporation for Assigned Names and Numbers (ICANN) Phone: +31 (0)6 84507976 www.icann.org<http://www.icann.org/>

2 2

Meeting Invitation | Transfer Policy Review PDP WG call | Tuesday, 02 August 2022
by Julie Bisland July 27, 2022

July 27, 2022

Dear all, The next Transfer Policy Review PDP WG call is scheduled for Tuesday, 02 August 2022 at 16:00 UTC for 90 minutes. Zoom Room Information: Main Zoom Webinar link: https://icann.zoom.us/j/95363727469?pwd=N3A3OWFSaTlUME9wZzlGajk5VUI3QT09 <https://urldefense.com/v3/__https:/icann.zoom.us/j/95363727469?pwd=N3A3OWFS…> Passcode: @TP/^*4wg# If you are joining via audio only: One tap mobile: US: +19294362866,,95363727469#,,,,*7490739013# or +13017158592,,95363727469#,,,,*7490739013# Telephone: Dial (for higher quality, dial a number based on your current location): US: +1 929 436 2866 or +1 301 715 8592 or +1 312 626 6799 or +1 669 900 6833 or +1 253 215 8782 or +1 346 248 7799 or 888 788 0099 (Toll Free) or 877 853 5247 (Toll Free) Webinar ID: 953 6372 7469 Passcode: 7490739013 International numbers available: https://icann.zoom.us/u/acdLFXPLp6 <https://urldefense.com/v3/__https:/icann.zoom.us/u/acdLFXPLp6__;!!PtGJab4!v…> Members, alternates, and observers all have different access and participation directions, please read below! ALL: Before joining the call: * Please send apologies and dial out requests to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only * Please be sure you have read the ICANN Expected Standards of Behavior<https://www.icann.org/resources/pages/expected-standards-2016-06-28-en> * Visit the Wiki Agenda meeting page: https://community.icann.org/x/5wIVD * Check your time zone: https://tinyurl.com/2p9xevtn ONLY FOR MEMBERS & ALTERNATES: * Please join via the Main Zoom Webinar link above; staff will promote you to panelist. * Chat: Members (and alternates replacing members), please select Everyone so everyone can see and so it’s captured afterwards. * Alternate replacement confirmations – For tracking alternate replacements, use the google form [docs.google.com]<https://urldefense.com/v3/__https:/docs.google.com/forms/d/e/1FAIpQLScXP3-H…> to communicate the replacement (alternate) and the duration. This information will be publicly posted to the Alternate Log-Transfer Policy Review PDP<https://community.icann.org/x/V4aUCQ> wiki page. * Alternates (not replacing a member): Rename your line by adding THREE Zs (zzz) before your name and add, in parentheses (your affiliation - alternate) after your name. To rename in Zoom, hover over your name and click ‘rename’. * Alternates (not replacing a member) are not allowed to engage in the chat or use any of the other zoom room functionalities such as raising hands or agreeing/disagreeing. ONLY FOR OBSERVERS: * Observers will have ability to view member chat and information shared in the zoom webinar room. Observers will not be able to use chat or raise hands. Thank you. Kind regards, Julie

3 2

Post Call | Transfer Policy Review PDP WG | Tuesday, 26 July 2022
by Julie Bisland July 26, 2022

July 26, 2022

Dear all, All recordings for the Transfer Policy Review PDP WG call held on Tuesday, 26 July 2022 at 16:00 UTC can be found on the agenda wiki page <https://community.icann.org/x/5AIVD> (attendance included) and the GNSO Master calendar <https://urldefense.com/v3/__https:/gnso.icann.org/en/group-activities/calen…> . These include: * Attendance * Audio recording * Zoom chat archive * Zoom recording (including audio, visual, rough transcript) * Transcript As a reminder only members and alternates can join the call as a Panelist, observers can join as an Attendee to listen. For additional information, you may consult the mailing list archives <https://mm.icann.org/pipermail/gnso-tpr/> and the main wiki page<https://community.icann.org/x/P4aUCQ>. Thank you. With kind regards, Julie

1 0

Notes and action items - TPR WG Meeting #55 - 26 July 2022 at 16:00 UTC
by Julie Hedlund July 26, 2022

July 26, 2022

Dear TPR WG members, Please find below the notes and action items from today’s meeting. The next meeting will be Tuesday, 02 August at 16:00 UTC. Best regards, Emily, Julie, Berry, and Caitlin Action Items: HOMEWORK/ACTION ITEMS: 1. After the Tuesday, 26 July call: Staff to send out a blank spreadsheet/table. 2. By Monday, 01 August: WG members to complete the spreadsheet/table. 3. By Tuesday, 02 August: Staff to compile responses for discussion at the meeting on 02 August at 16:00 UTC. Notes: Transfer Policy Review Phase 1(b) - Meeting #55 Proposed Agenda 26 July 2022 1. Roll Call & SOI updates 2. Welcome and Chair Updates 3. Detailed Analysis of CoR Triggers and Actions – Present and Future See: https://docs.google.com/spreadsheets/d/1eB3cowSoEp4ERoqQmlc3hc5dpV4g5NzP/ed… [docs.google.com]<https://urldefense.com/v3/__https:/docs.google.com/spreadsheets/d/1eB3cowSo…> Introduction: * Possible proposed approach. * If we look at the inter-registrant policy – back in the day the IRTP-C/-D had the “luxury” of starting from scratch, but we don’t have that. * Because we have an existing policy, even if there is full consensus to get rid of the policy we still have to provide a rationale. * We do have the ability to ask ourselves: would the change of registrant policy be developed the way it is taking into account the TAC only being revealed on request, and if there was a post-transfer restriction (30 or 60 days), would that have addressed the problems the CoR policy was trying to overcome. * We also realize that we don’t have any data to work with, so we have to proceed with a systematic analysis, hence the table. * Current policy – two key components: Trigger of Section C, Change of Registrant – we will be analyzing the trigger and then the possible actions in response. See: https://www.icann.org/resources/pages/transfer-policy-2016-06-01-en. * Table to aid analysis: These are sample responses, not meant to be staff positions. * Triggers are the first column on the left. Dissecting each of the triggers in isolation. * Trying to draw solid lines around key components of the policy as they exist today. * First one: looking at rows 4-5 – is that particular transaction legitimate or illegitimate. We will get into whether it’s possible to distinguish that. * Second line: columns F-G – possible action with the understanding that there is no intention to move to another registrar. * Moving to H-I – in connection with a change of ownership. So not just a change in contact information. Challenging because some of these triggers may have an action before that potential change. * Looking at J-K – inter-registrant change with intent to change registrars: could leverage Phase 1A recommendations. * Column L – Outcomes: substance for further recommendations. * In summary: 1) what are the triggers and actions, 2) what are the impacts on the market, 3) what are the outcomes. Discussion: * Previously we didn’t have much information, such as with two-factor authentication (TFA), to go on. Now we see that larger registrars are using TFA, but not sure about smaller registrars. Those data points are available. That could be a good start. * Good point because we always look at how the landscape has changed. Good to know that TFA is very well used throughout the industry. Deeper dive into the example (Emily): * We start with triggers and the first use case is a prior registrant name change – II.A.1.1.1 Prior Registrant name + II.A.1.3.1 A change to the Registered Name Holder's name or organization that does not appear to be merely a typographical correction * Helpful distinction is that we want to be weighing the impact on everyday users and on malicious uses – does this action mitigate malicious actions but also what is the impact on users? * Probably will not be able to tell if a trigger is illegitimate or not. * More relevant in some cases or others, whether you can distinguish a typographical correction. * Important to note the intent might be hard or impossible to know, when we look at the action later on would be important. * The other thing that is tricky is the concept of “change of control”. This term is the genesis of where this all came from, but it doesn’t have a clear definition. Regardless of how you define it, we can consider whether it matters whether change of control is happening or not. * Looking at columns F & G – simplest case: Remains w/ Registrar & No Change of Control * Are the actions fit for purpose? Risk are lower. Current policy language makes it hard to tell when certain updates trigger additional requirements. * Replace confirmation with notification; eliminate the 60-day lock. * Columns H & I: In close proximity to or as part of change of control * Columns J & K: Followed by inter-registrar transfer * Column L: Possible recommendations and rationale Discussion: * Good to go into the example of malicious actions and impacts. * Next steps: Does this group want to go through this on a call, or fill out the table separately and staff can compile to discuss on a call? Is it easier to go horizontally through the table? * If we do this offline: At some point we need to go through this to produce the rationale? At the end of the day we should go through it anyway. Answer: Even if we complete it offline we’ll still walk through the responses on a call and by doing so we are answering the charter questions. * Let’s plan to do this as a homework assignment and then staff can compile and eliminate duplications; also can more easily focus on areas of agreement. Timeline/Next Steps: * We have two more calls before the summer pause. * Need feedback from the WG on what is feasible. * Can team up with a “buddy” to work on it, but want to get different perspectives. * Can the WG have responses (or partial responses) by end of day next Monday, 01 August for staff to compile for discussion next Tuesday? HOMEWORK/ACTION ITEMS: 1. After the Tuesday, 26 July call: Staff to send out a blank spreadsheet/table. 2. By Monday, 01 August: WG members to complete the spreadsheet/table. 3. By Tuesday, 02 August: Staff to compile responses for discussion at the meeting on 02 August at 16:00 UTC. 4. AOB * Next session: Tuesday 2 August at 16:00 UTC

1 0

**AT THE TOP OF THE HOUR** Meeting Invitation | Transfer Policy Review PDP WG call | Tuesday, 26 July 2022
by Julie Bisland July 26, 2022

July 26, 2022

**AT THE TOP OF THE HOUR** Dear all, The next Transfer Policy Review PDP WG call is scheduled for Tuesday, 26 July 2022 at 16:00 UTC for 90 minutes. Zoom Room Information: Main Zoom Webinar link: https://icann.zoom.us/j/95363727469?pwd=N3A3OWFSaTlUME9wZzlGajk5VUI3QT09 <https://urldefense.com/v3/__https:/icann.zoom.us/j/95363727469?pwd=N3A3OWFS…> Passcode: @TP/^*4wg# If you are joining via audio only: One tap mobile: US: +19294362866,,95363727469#,,,,*7490739013# or +13017158592,,95363727469#,,,,*7490739013# Telephone: Dial (for higher quality, dial a number based on your current location): US: +1 929 436 2866 or +1 301 715 8592 or +1 312 626 6799 or +1 669 900 6833 or +1 253 215 8782 or +1 346 248 7799 or 888 788 0099 (Toll Free) or 877 853 5247 (Toll Free) Webinar ID: 953 6372 7469 Passcode: 7490739013 International numbers available: https://icann.zoom.us/u/acdLFXPLp6 <https://urldefense.com/v3/__https:/icann.zoom.us/u/acdLFXPLp6__;!!PtGJab4!v…> Members, alternates, and observers all have different access and participation directions, please read below! ALL: Before joining the call: * Please send apologies and dial out requests to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only * Please be sure you have read the ICANN Expected Standards of Behavior<https://www.icann.org/resources/pages/expected-standards-2016-06-28-en> * Visit the Wiki Agenda meeting page: https://community.icann.org/x/5AIVD * Check your time zone: https://tinyurl.com/3m9ehb73 [tinyurl.com]<https://urldefense.com/v3/__https:/tinyurl.com/3m9ehb73__;!!PtGJab4!-D_RzcT…> ONLY FOR MEMBERS & ALTERNATES: * Please join via the Main Zoom Webinar link above; staff will promote you to panelist. * Chat: Members (and alternates replacing members), please select Everyone so everyone can see and so it’s captured afterwards. * Alternate replacement confirmations – For tracking alternate replacements, use the google form [docs.google.com]<https://urldefense.com/v3/__https:/docs.google.com/forms/d/e/1FAIpQLScXP3-H…> to communicate the replacement (alternate) and the duration. This information will be publicly posted to the Alternate Log-Transfer Policy Review PDP<https://community.icann.org/x/V4aUCQ> wiki page. * Alternates (not replacing a member): Rename your line by adding THREE Zs (zzz) before your name and add, in parentheses (your affiliation - alternate) after your name. To rename in Zoom, hover over your name and click ‘rename’. * Alternates (not replacing a member) are not allowed to engage in the chat or use any of the other zoom room functionalities such as raising hands or agreeing/disagreeing. ONLY FOR OBSERVERS: * Observers will have ability to view member chat and information shared in the zoom webinar room. Observers will not be able to use chat or raise hands. Thank you. Kind regards, Devan

1 0

Proposed agenda for meeting #55 on Tuesday 26 July at 16:00 UTC
by Emily Barabas July 25, 2022

July 25, 2022

Dear Working Group members, Please find below the proposed agenda for the next meeting scheduled to take place on Tuesday 26 July 2022 at 16:00 UTC. We will send along shortly a link to the working document that will be used for tomorrow’s discussion. Kind regards, Julie, Berry, Caitlin, and Emily Transfer Policy Review Phase 1(b) - Meeting #55 Proposed Agenda 26 July 2022 1. Roll Call & SOI updates 2. Welcome and Chair Updates 3. Detailed Analysis of CoR Triggers and Actions – Present and Future 4. AOB * Next session: Tuesday 2 August at 16:00 UTC

1 1

REMINDER - Meeting Invitation | Transfer Policy Review PDP WG call | Tuesday, 26 July 2022
by Julie Bisland July 25, 2022

July 25, 2022

Dear all, The next Transfer Policy Review PDP WG call is scheduled for Tuesday, 26 July 2022 at 16:00 UTC for 90 minutes. Zoom Room Information: Main Zoom Webinar link: https://icann.zoom.us/j/95363727469?pwd=N3A3OWFSaTlUME9wZzlGajk5VUI3QT09 <https://urldefense.com/v3/__https:/icann.zoom.us/j/95363727469?pwd=N3A3OWFS…> Passcode: @TP/^*4wg# If you are joining via audio only: One tap mobile: US: +19294362866,,95363727469#,,,,*7490739013# or +13017158592,,95363727469#,,,,*7490739013# Telephone: Dial (for higher quality, dial a number based on your current location): US: +1 929 436 2866 or +1 301 715 8592 or +1 312 626 6799 or +1 669 900 6833 or +1 253 215 8782 or +1 346 248 7799 or 888 788 0099 (Toll Free) or 877 853 5247 (Toll Free) Webinar ID: 953 6372 7469 Passcode: 7490739013 International numbers available: https://icann.zoom.us/u/acdLFXPLp6 <https://urldefense.com/v3/__https:/icann.zoom.us/u/acdLFXPLp6__;!!PtGJab4!v…> Members, alternates, and observers all have different access and participation directions, please read below! ALL: Before joining the call: * Please send apologies and dial out requests to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only * Please be sure you have read the ICANN Expected Standards of Behavior<https://www.icann.org/resources/pages/expected-standards-2016-06-28-en> * Visit the Wiki Agenda meeting page: https://community.icann.org/x/5AIVD * Check your time zone: https://tinyurl.com/3m9ehb73 [tinyurl.com]<https://urldefense.com/v3/__https:/tinyurl.com/3m9ehb73__;!!PtGJab4!-D_RzcT…> ONLY FOR MEMBERS & ALTERNATES: * Please join via the Main Zoom Webinar link above; staff will promote you to panelist. * Chat: Members (and alternates replacing members), please select Everyone so everyone can see and so it’s captured afterwards. * Alternate replacement confirmations – For tracking alternate replacements, use the google form [docs.google.com]<https://urldefense.com/v3/__https:/docs.google.com/forms/d/e/1FAIpQLScXP3-H…> to communicate the replacement (alternate) and the duration. This information will be publicly posted to the Alternate Log-Transfer Policy Review PDP<https://community.icann.org/x/V4aUCQ> wiki page. * Alternates (not replacing a member): Rename your line by adding THREE Zs (zzz) before your name and add, in parentheses (your affiliation - alternate) after your name. To rename in Zoom, hover over your name and click ‘rename’. * Alternates (not replacing a member) are not allowed to engage in the chat or use any of the other zoom room functionalities such as raising hands or agreeing/disagreeing. ONLY FOR OBSERVERS: * Observers will have ability to view member chat and information shared in the zoom webinar room. Observers will not be able to use chat or raise hands. Thank you. Kind regards, Devan

1 0

Post Call | Transfer Policy Review PDP WG | Tuesday, 19 July 2022
by Devan Reed July 19, 2022

July 19, 2022

Dear all, All recordings for the Transfer Policy Review PDP WG call held on Tuesday, 19 July 2022 at 16:00 UTC can be found on the agenda wiki page <https://community.icann.org/x/4QIVD> (attendance included) and the GNSO Master calendar <https://urldefense.com/v3/__https:/gnso.icann.org/en/group-activities/calen…> . These include: * Attendance * Audio recording * Zoom chat archive * Zoom recording (including audio, visual, rough transcript) * Transcript As a reminder only members and alternates can join the call as a Panelist, observers can join as an Attendee to listen. For additional information, you may consult the mailing list archives <https://mm.icann.org/pipermail/gnso-tpr/> and the main wiki page<https://community.icann.org/x/P4aUCQ>. Thank you. With kind regards, Devan

1 0

Meeting Invitation | Transfer Policy Review PDP WG call | Tuesday, 26 July 2022
by Devan Reed July 19, 2022

July 19, 2022

Dear all, The next Transfer Policy Review PDP WG call is scheduled for Tuesday, 26 July 2022 at 16:00 UTC for 90 minutes. Zoom Room Information: Main Zoom Webinar link: https://icann.zoom.us/j/95363727469?pwd=N3A3OWFSaTlUME9wZzlGajk5VUI3QT09 <https://urldefense.com/v3/__https:/icann.zoom.us/j/95363727469?pwd=N3A3OWFS…> Passcode: @TP/^*4wg# If you are joining via audio only: One tap mobile: US: +19294362866,,95363727469#,,,,*7490739013# or +13017158592,,95363727469#,,,,*7490739013# Telephone: Dial (for higher quality, dial a number based on your current location): US: +1 929 436 2866 or +1 301 715 8592 or +1 312 626 6799 or +1 669 900 6833 or +1 253 215 8782 or +1 346 248 7799 or 888 788 0099 (Toll Free) or 877 853 5247 (Toll Free) Webinar ID: 953 6372 7469 Passcode: 7490739013 International numbers available: https://icann.zoom.us/u/acdLFXPLp6 <https://urldefense.com/v3/__https:/icann.zoom.us/u/acdLFXPLp6__;!!PtGJab4!v…> Members, alternates, and observers all have different access and participation directions, please read below! ALL: Before joining the call: * Please send apologies and dial out requests to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only * Please be sure you have read the ICANN Expected Standards of Behavior<https://www.icann.org/resources/pages/expected-standards-2016-06-28-en> * Visit the Wiki Agenda meeting page: https://community.icann.org/x/5AIVD * Check your time zone: https://tinyurl.com/3m9ehb73 ONLY FOR MEMBERS & ALTERNATES: * Please join via the Main Zoom Webinar link above; staff will promote you to panelist. * Chat: Members (and alternates replacing members), please select Everyone so everyone can see and so it’s captured afterwards. * Alternate replacement confirmations – For tracking alternate replacements, use the google form [docs.google.com]<https://urldefense.com/v3/__https:/docs.google.com/forms/d/e/1FAIpQLScXP3-H…> to communicate the replacement (alternate) and the duration. This information will be publicly posted to the Alternate Log-Transfer Policy Review PDP<https://community.icann.org/x/V4aUCQ> wiki page. * Alternates (not replacing a member): Rename your line by adding THREE Zs (zzz) before your name and add, in parentheses (your affiliation - alternate) after your name. To rename in Zoom, hover over your name and click ‘rename’. * Alternates (not replacing a member) are not allowed to engage in the chat or use any of the other zoom room functionalities such as raising hands or agreeing/disagreeing. ONLY FOR OBSERVERS: * Observers will have ability to view member chat and information shared in the zoom webinar room. Observers will not be able to use chat or raise hands. Thank you. Kind regards, Devan

1 0

Notes and action items - TPR WG Meeting #54 - 19 July 2022 at 16:00 UTC
by Julie Hedlund July 19, 2022

July 19, 2022

Dear TPR WG members, Please find below the notes and action items from today’s meeting. The next meeting will be Tuesday, 26 July at 16:00 UTC. Best regards, Emily, Julie, Berry, and Caitlin Action Items: WG members to consider the best way to frame the discussion of the CoR policy and review the Cor Foundation Brainstorm document at: https://docs.google.com/document/d/1Fjkdk6VSWHw-ZjRfHHL0vGeWw9NKcf7IsT8eT8T…. Notes: Transfer Policy Review Phase 1(b) - Meeting #54 Proposed Agenda 19 July 2022 1. Roll Call & SOI updates 2. Welcome and Chair Updates * Phase 1A created several new mechanisms that apply to the CoR concepts as well in a positive way. WG should take note of those things, such as the 5-day window to provide the TAC. * While it is Phase 2, everyone can assume we will create a more robust dispute mechanism not just for change of registrar, but could also be for CoR. * As a reminder, PC closes 2 August. 4 submissions thus far. https://www.icann.org/en/public-comment/proceeding/initial-report-on-the-tr…. We have three meetings before we take a break and then staff write up the public comment summary. * Re: Mike Rodenbaugh sent an email last week Tuesday about the 60-day lock being optional and since it’s optional why do we need recommendations – any comments? * From Mike: “I want to get clear on the effect of this proposed change. This 60-day lock is optional now. We are talking about removing that optional lock from the IRTP, and it seems we are getting to consensus to remove it. I suppose that removing it from the Policy is not the same as prohibiting registrars from imposing such a lock anyway via their TOS. So, are we also talking about prohibiting registrars from imposing any such lock upon Change of Registrant? Otherwise, I guess I do not see the point of removing it from the Policy. Maybe I am just missing something here...” * Discussion: * If you can opt out of it, what reason would there be to have a 30-day lock as a default? * Makes sense to remove it entirely. Registrars could still choose to do that and registrants could pick registrars accordingly. * Not a comment to Mike's email, but CoR was something that guarded against parties that had made a malicious registration from rotating the registrant of record frequently as a means of evasion - but this was more of a thing when more of the whois information was public. * +1 Jothan, and with a 30 day lock on transfers, it would remain at that registrar. * Good thing to think about, whether it even belongs or not. * Does the lock even need to exist for the CoR? * Locks from Phase 1a – transfer can’t occur 30 days from registration or transfer. It is a delay, not a lock per se. If you have a case where a name has changed to another registrant a lock would prevent moves to another registrar, but not a registrant within a registrar. We may need to diagram the different scenarios. * We don’t have any numbers so it’s not clear how much a problem are domain name hijacks. * Still a large impact (hijacks) even if there aren’t many of them. * The current Registrar of Record on a given domain name is the party with the highest ability to resolve matters related to that domain name. Change of Registrant, as long as the name remains at the most recent gaining registrar, does not introduce additional challenge to transfer related matters. * If we remove the locks it can be gamed and it is a little bit more risky. * The majority of CoRs are legitimate, but there can be a big impact from a few illegitimate changes. * We already have some security mechanisms, particularly from Phase 1a. * How to evaluate the impact from illegitimate CoRs: even if it is an intra-registrar transfer the rules should be the same – have the same locks. * GDPR (and subsequent Privacy Regulation) - and the affectation on the amount of redaction it caused to RDAP/WHOIS - have lowered the impact of Change of Registrant (CoR) related matters, because the majority of the information has become redacted or otherwise is not displayed publicly. * When providing a service to the registrant, you want some type of lock to mitigate hijacking. If you are going to have a lock in both cases, maybe 30 days is too long, or maybe not. It’s about providing a good service and keeping things the same. * I don’t think I agree that the transfers are similar enough to require the same locks for both...I like consistency (lock periods should be uniform) but I think updating owner data is different enough from changing Rrs that they're not the same thing. * It is not just about Registrar Hopping and domain theft, but preventing fraud on the Internet. If a registrant is doing something bad, the registrar knows that. If the registrar prevents fraud, the domain should not be able to move for a period of time to prevent the fraudster / phisher / bad guy continuing the fraud they are committing. * What is the criteria for a material change that today triggers a CoR lock? * 1.1 "Change of Registrant" means a Material Change to any of the following: 1.1.1 Prior Registrant name, 1.1.2 Prior Registrant organization, 1.1.3 Prior Registrant email address, 1.1.4 Administrative Contact email address, if there is no Prior Registrant email address. 3. Risk-based approach: What problems are we trying to solve with CoR? Here is the document we will use for today's discussion: Cor Foundation Brainstorm -- https://docs.google.com/document/d/1Fjkdk6VSWHw-ZjRfHHL0vGeWw9NKcf7IsT8eT8T… * This is an open-ended table. We can rank these and see if they help us get to the same spot. * Context: One of the things we are hoping to do is to take a step back from the current policy, think about the problems we are trying to solve and the risks. If a registrant name is changed, for example, is that something we need to worry about. We also don’t need to come up with solutions at this point. Discussion: * There is a big difference between changing the information about a registrant (name, etc.) then if there is a move to a different account (intra-registrar transfer). Not sure we need to care about changes to an account. * Account is difficult as that might not be in scope. Only if there is a true change of ownership. * If there is going to be a change that causes a lock a user should be warned before they commit to that. * Propose that we limit what we do to transfers. Some changes in a registrant’s account aren’t a transfer. * Change of ownership is valid to discuss. * See the definitions at: https://docs.google.com/document/d/1gu4sXGvyJeWJIfvaK_I7GKA6lAdfKFPQKaN4UMg…. * What we are trying to do is to determine the problems, not the solutions. * Also, registrars are responsible for keeping their accounts accurate, while registrants have rights to make changes. * At the end of the day the WG has to have consensus recommendations to change any of the CoR policy. * For example, does the change of a name warrant restrictions on subsequent changes or change of registrar? * Another example, if the WG agrees that a material change should no longer include a registrant name change then we need to thoroughly document the reason for the change. * 60-day lock is the action based on what is considered a “material change.” The WG could decide that something isn’t a “material change” but keep the subsequent action (lock), or decide to scrap both what are material changes as well as the actions – once we go through the various scenarios. * Maybe we decide something else is better than a lock. * If we look at today’s environment it doesn’t seem that there is much policy to prevent an illegitimate transaction. And the AuthInfo Code has been there since the name was created. But with the Phase 1A recommendations the TAC will not be sitting there, but not provisioned until requested. * Any transaction from column 1 with no other follow-on action would not invoke the TAC. But others would invoke the inter-registrar transfer policy. * The policy today originated through a discussion of change of control. * There has to be a way for registrants to dispute a change, beyond an intra-registrant policy. * No matter the original intent the policy has not worked well. * Should look at why an action was put in place and whether it is still needed. * We need to come up with a way to get to a rationale—either to keep the policy or to change it. * Example: If there is an illegitimate name change that stays within the registrar is that a problem particularly if easily corrected? * Could say that we don’t need to look at the definition or trigger, but maybe the possible action (notification, lock, dispute mechanism). * However the contact is made between the registrar and registrant, what is important is when that contact changes. * Can we create a baseline? * Don’t think the trigger is the update to the communication, but the owner. We will at least have to update the list of changes to remove the Administrative Contact. ACTION ITEM: WG members to consider the best way to frame the discussion of the CoR policy and review the Cor Foundation Brainstorm document at: https://docs.google.com/document/d/1Fjkdk6VSWHw-ZjRfHHL0vGeWw9NKcf7IsT8eT8T…. 4. AOB

1 0