May 2024 - GNSO-TPR - lists.icann.org

Proposed Agenda - TPR Working Group Meeting #132 - 4 June 2024
by Christian Wheeler 30 May '24

30 May '24

Dear TPR WG members, Please find below the proposed agenda for our next call, taking place on Tuesday, 4 June 2024 at 16:00 UTC. As a reminder, the current WG Action Item is to (1) review the consolidated draft recommendations, rationale, and impact ratings provided here<https://docs.google.com/document/d/1xUJMqgb096HXIJ6xWNpNC_w5g6TukZxIbcN7_PT…> and (2) identify any “CANNOT LIVE WITH” text for purposes of publication in the Initial Report. Please complete this assignment by Monday, 3 June, before our next WG call. Thank you and we look forward to seeing you all virtually. Kind regards, Caitlin, Julie, Feodora, Berry, and Christian ---------- Transfer Policy Review - Meeting #132 Proposed Agenda 4 June 2024 Proposed Agenda: 1. Welcome and Chair Updates 2. Preparation for ICANN80 a. Review any "Cannot Live With" recommendations b. If none/few, discuss presentation of “High Impact” recommendations c. Speaker volunteers 3. Discuss post-ICANN80 plans 4. AOB

1 0

UPDATED LINK | Please share: ICANN80 Policy Outlook Report is now available
by Terri Agnew 30 May '24

30 May '24

**Updated link below. Dear All, The ICANN80 Policy Outlook Report is now available! https://go.icann.org/outlook80 Happy reading! Kind regards, Terri Policy Team Supporting the GNSO

1 0

Please share: ICANN80 Policy Outlook Report is now available
by Terri Agnew 30 May '24

30 May '24

Dear All, The ICANN80 Policy Outlook Report is now available! http://go.icann.org/gnsobriefing [go.icann.org]<https://urldefense.com/v3/__http:/go.icann.org/gnsobriefing__;!!PtGJab4!-Yi…>. Happy reading! Kind regards, Terri Policy Team Supporting the GNSO

1 0

Rec 26 Inquiry - related Charter Questions
by Christian Wheeler 29 May '24

29 May '24

Hello TPR WG members, We recently received an inquiry concerning the reference to Charter Questions d4-d8 in Recommendation 26’s rationale (found in the current working document<https://docs.google.com/document/d/1xUJMqgb096HXIJ6xWNpNC_w5g6TukZxIbcN7_PT…>). The end of the rationale paragraph states that: “…Rationale regarding the working group’s proposed elimination of the 60-day lock can be found in its responses to Charter Questions d4-d8.” For your reference, please find Charter Questions d4-d8 and the proposed draft responses below, noting that the WG has not yet reviewed or approved this draft text. If you have any further questions, please do not hesitate to contact us. Kind regards, Caitlin, Berry, Julie, Feodora, and Christian ---------- Draft responses to Charter Questions d4-d8 (still to be reviewed by TPR WG): Charter Question d4 Survey responses and data provided by ICANN’s Global Support Center indicate that registrants do not understand the 60-day lock and express frustration when it prevents them from completing an inter-registrar transfer. Does the 60-day lock meet the objective of reducing the incidence of domain hijacking? What data is available to help answer this question? Is it the 60-day lock the most appropriate and efficient mechanism for reducing the incidence of hijacking? If not, what alternative mechanisms might be used to meet the same goals? Are there technical solutions, such as those using the control panel or two-factor authentication, or other alternatives that should be explored? Working Group Response: The working group reviewed the complaint metrics from ICANN Global Support and Contractual Compliance and, after discussing the metrics at length, has determined that the 60-day lock following a Change of Registrant appears to be a greater source of registrant frustration than proven registrant security. Furthermore, available data suggests that valid reports of domain hijacking are not as numerous as may be expected. For example, according to complaint metrics shared by ICANN Contractual Compliance, from September 2020 to October 2023 ICANN Compliance received: * 205 complaints regarding Unauthorized Changes of Registrant * 169 were closed as invalid (without addressing with the Contracted Party) * 42 were sent to the Contracted Party * 780 complaints regarding Unauthorized Inter-Registrar Transfers * 679 were closed as invalid (without addressing with the Contracted Party) * 88 were sent to the Contracted Party The working group considered the number of complaints received by ICANN Compliance and sent to Contracted Parties to be relatively low, particularly when considering the vast number of domain names, changes of registrant, and inter-registrar transfers that occur worldwide. While most complaints of domain hijacking may be addressed internally with Registrars and are not escalated to ICANN Compliance, such issue tracking and reporting across Registrars may not be consistent or readily available and was not provided to the Working Group when requested. Based on available data, it is not clear that the 60-day lock demonstrably reduces instances of domain hijacking. However, the working group noted that from the perspective of registrars, it is often difficult, if not impossible, to determine whether a registrant’s email address or account login credentials have been compromised until after a complaint is received. While the 60-day lock temporarily prevents the registrant (and possible hijacker) from transferring the domain to another Registrar (also assuming the transfer lock was not opted-out of by the hijacker prior to the change of registrant), the lock does not prevent any initial hijacking of the registrant’s credentials or account. The working group discussed various ways that Registrars could address domain hijacking proactively rather than reactively, such as through additional requirements around accounts, control panels, and multifactor authentication. However, the working group noted that given the variety of Registrars and their business models, there is no one-size-fits-all security apparatus, and that flexibility should be given to Registrars to secure registrant data and accounts in ways that work best for them and their customers. That being said, the working group has proposed several preliminary recommendations within this Initial Report which would increase the security of inter-registrar transfers and help registrants catch and combat domain hijacking (such as required notifications to the RNH, instructions for how an RNH may reverse an invalid transfer, additional TAC requirements, implementation of a 30-day post-transfer restriction, etc.). Charter Question d5 Survey responses and data provided by ICANN’s Global Support Center and Contractual Compliance Department indicate that registrants have expressed significant frustration with their inability to remove the 60-day lock. If the 60-day lock is retained, to what extent should there be a process or options to remove the 60-day lock? Working Group Response: Rather than retaining the 60-day inter-registrar transfer lock following a Change of Registrant, the working group recommends eliminating it from the future Change of Registrant Data Policy (See Preliminary Recommendation 26.4). The working group has noted several reasons why this 60-day post Change of Registrant inter-registrar transfer restriction/lock should be eliminated. 1. The working group discussed at length about the confusion and frustration from registrants around this restriction. Input from the Transfer Policy survey, which was administered as part of the Transfer Policy Status Report, also noted the inconsistency with which this lock is applied. Specifically, the language provides that registrars MAY offer an opt-out, but not all registrars choose to offer this, which ultimately leads to confusion among Registered Name Holders. Additionally, the working group noted that the common occurrence of a Registrar acting as the Designated Agent and opting out of the lock on behalf of the RNH, which is permitted in the COR policy, has rendered the security value of the 60-day lock meaningless or of negligible value. 2. In recognition of the diminished security value of the 60-day post-COR lock, the working group instead recommends requiring a 30-day post inter-registrar transfer restriction, which is detailed in Preliminary Recommendation 19. Barring an exception as described in Recommendation 19, domain names will remain at a registrar for 30 days following an inter-registrar transfer, allowing for any fraudulent changes to be unwound during this restriction period. 3. The working group notes that the “clientTransferProhibited” status can be applied to a domain name at any time to prevent unwanted transfer. The 60-day COR lock is an unnecessary trigger, as such a lock is already available without additional requirements. 4. The working group further notes that it has recommended a series of measures to increase the security of the Transfer Authorization Code (TAC) and reduce the risk that the TAC is obtained by an unauthorized party, as detailed in Preliminary Recommendations 2-15. With the added security measures, the TAC becomes a stronger means to demonstrate that the TAC holder is an appropriate party to request the transfer, which makes the post-COR transfer restriction less important. 5. The working group notes that when a Material Change to specified registration data elements occurs, the Registrar MUST send notifications to the Registered Name Holder further to Preliminary Recommendation 27. Charter Question d6 Due to requirements under privacy law, certain previously public fields, such as registrant name and email may be redacted by the registrar. Is there data to support the idea that the lack of public access to this information has reduced the risk of hijacking and has therefore obviated the need for the 60-day lock when underlying registrant information is changed? Working Group Response: The working group believes that the widespread removal of public access to registrant data has indeed reduced the risk of hijacking. Working group members anecdotally observed that since 2018 and the redaction of registrant data from public lookup tools, there has been a noticeable drop in reports of domain data theft. This increased security of registrant data was a factor the working group considered when developing its recommendation to eliminate the 60-day lock from the future Change of Registrant Data Policy (See Preliminary Recommendation 26.4). Charter Question d7 In its survey response, the Registrar Stakeholder Group indicated that the 60-day lock hinders corporate acquisitions, consolidations, and divestitures of large lists of domains to new legal entities. To what extent should this concern be taken into consideration in reviewing the 60-day lock? Working Group Response: The working group considered the 60-day lock’s hindrance on legitimate domain transfers, including transfers resulting from corporate acquisitions, consolidations, and divestitures of large domain portfolios. In such circumstances, it is not uncommon that a Registrar transfer request follows a recent change of registrant, triggering the 60-day transfer lock much to the registrant’s frustration. Having considered the concerns of registrants and the situations where it is necessary to readily transfer Registrars following a change of registrant, the working group recommends eliminating the 60-day lock from the future Change of Registrant Data Policy (See Preliminary Recommendation 26.4). Charter Question d8 If the policy is retained, are there areas of the existing policy that require clarification? For example, based on complaints received by ICANN Contractual Compliance, the following areas of the policy may be appropriate to review and clarify: * There have been different interpretations of footnote 4 in the Transfer Policy, which states: “The Registrar may, but is not required to, impose restrictions on the removal of the lock described in Section II.C.2. For example, the Registrar will only remove the lock after five business days have passed, the lock removal must be authorized via the Prior Registrant’s affirmative response to email, etc.” Is the language in footnote 4 sufficiently clear as to whether registrars are permitted to remove the 60-day lock once imposed under the existing policy? If not, what revisions are needed? * Should additional clarification be provided in Section II.C.1.3, which addresses how the information about the lock must be provided in a clear and conspicuous manner? Does the policy contemplate enough warning for registrants concerning the 60-day lock where they are requesting a COR? * Should clarification be provided in Section II.C.2 that the option to opt-out is provided only to the Prior Registrant? For example, would the following revision be appropriate: “The Registrar must impose a 60-day inter-registrar transfer lock following a Change of Registrant, provided, however, that the Registrar may allow the Prior Registrant to opt out of the 60-day inter-registrar transfer lock prior to any Change of Registrant request.”? Working Group Response: The working group recommends eliminating from the future Change of Registrant Data Policy the requirement that the Registrar impose a 60-day inter-registrar transfer lock following a Change of Registrant. Additionally, the working group recommends eliminating the option to opt-out of the 60-day lock, as there would no longer be a 60-day lock to opt-out of (See Preliminary Recommendation 26.4). This elimination obviates the need to further clarify the 60-day lock and opt-out policy text. However, the working group has identified other areas of the existing change of registrant policy (namely concerning notifications of a change of registrant) that it believes should be clarified and expanded on within the new standalone Change of Registrant Data Policy.

1 0

Action Item reminder: Recommendations for Initial Report
by Christian Wheeler 29 May '24

29 May '24

Hello TPR WG Members, As a reminder, the current Action Item for all WG members is to (1) review the consolidated draft recommendations, rationale, and impact ratings provided here<https://docs.google.com/document/d/1xUJMqgb096HXIJ6xWNpNC_w5g6TukZxIbcN7_PT…> and (2) identify any “CANNOT LIVE WITH” text for purposes of publication in the Initial Report. Please complete this assignment by Monday, 3 June, before our next WG call. Thank you, and if you have any questions, please let us know. Kind regards, Caitlin, Berry, Julie, Feodora, and Christian

1 0

ICANN80 GNSO Policy Briefing
by Julie Bisland 28 May '24

28 May '24

Dear All, On behalf of the GNSO Team, I am happy to report that the GNSO Policy Briefing for ICANN80 is now available for download at http://go.icann.org/gnsobriefing [go.icann.org]<https://urldefense.com/v3/__http:/go.icann.org/gnsobriefing__;!!PtGJab4!-Yi…>. Happy reading! Best Regards, Julie -- Julie Bisland Policy Operations Sr. Coordinator (GNSO) Internet Corporation for Assigned Names and Numbers (ICANN) Skype ID: 79613b691cb8a6c1 Find out more about the GNSO by visiting: https://learn.icann.org/<https://urldefense.proofpoint.com/v2/url?u=https-3A__learn.icann.org_&d=DwM…> Follow @GNSO on Twitter: https://twitter.com/ICANN_GNSO<https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_ICANN-5FGN…> Transcripts and recordings of GNSO Working Group and Council events are located on the GNSO Master Calendar <https://urldefense.proofpoint.com/v2/url?u=https-3A__gnso.icann.org_en_grou…> [signature_2510144026]

1 0

2024-05-21 Transfer Policy Review PDP WG Call
by Feodora Hamza 22 May '24

22 May '24

Dear TPR WG members, Please find below the brief notes and action items from yesterday’s meeting. The next meeting will take place on Tuesday 4 June 2024 at 16:00 UTC. Kind regards, Christian, Caitlin, Berry, Julie and Feodora 2024-05-21 Transfer Policy Review PDP WG Call<https://community.icann.org/display/TPRPDP/2024-05-21+Transfer+Policy+Revie…> Action Item: WG to review initial impact assessment rating in Initial Report Recommendations Google Doc<https://docs.google.com/document/d/1xUJMqgb096HXIJ6xWNpNC_w5g6TukZxIbcN7_PT…> and propose changes if needed answers to charter questions. Action Item: WG will have two weeks to identify any CANNOT LIVE WITH items (focus on Group 1b and Group 2 recs) Deadline: 3rd of June 1. Welcome and Chair Updates * Action Item update: registries to re-confirm if BTAPPA recs are acceptable for publishing 2. Review consolidated Draft Initial Report * Discuss layout options i. At this stage it seems, like all of the recommendations, are ready for inclusion in the comprehensive initial report which will include all of the groups, charter questions, deliberations, and policy recommendations. ii. Staff explained currently, WG will probably have a couple of additional annexes to include in the report that will need to be updated. iii. Current draft of initial report is at 121 pages. iv. Staff opened the discussion on “how to make the report digestible” for public comment. v. Staff introduced the Initial Report Recommendations Google Doc<https://docs.google.com/document/d/1xUJMqgb096HXIJ6xWNpNC_w5g6TukZxIbcN7_PT…> and explained the doc is “missing” the deliberation, rationale and impact assessment of each recommendation. vi. Each recommendation would have an anchor link to an annex in the report that would go over that more detailed deliberation of the working group for those that are interested. vii. Staff has gone in and put in a draft policy impact rating as well as a short sentence on why, the policy impact might be low versus high versus medium. viii. Legend Options [LOW MEDIUM HIGH]: An example of a LOW impact would be a definitional change, e.g., “Change of Registrant” to “Change of Registrant Data.” An example of a MEDIUM impact would be a change to an existing requirement or a new requirement. An example of a HIGH impact would be removing a previous requirement, such as the removal of the Post Change of Registrant 60-day transfer restriction. Criteria to consider when gauging impact: Degree of change from existing requirement? [No change or confirm existing; Modification to existing req.; or New req.] Security enhancement or detraction Level of technical change (impact to CPs) ICANN Contractual Compliance enforcement capability RNH impacts (such as increased or reduced protections; level of confusion) ix. A high impact doesn't necessarily mean that it's bad. And a low impact doesn't necessarily mean it's good. It's just to serve as an indication to the reader that this is a big change from the status quo. Action Item: WG to review initial impact assessment rating in Initial Report Recommendations Google Doc<https://docs.google.com/document/d/1xUJMqgb096HXIJ6xWNpNC_w5g6TukZxIbcN7_PT…> and propose changes if needed. 1. Once the feedback from WG is received, staff will update the initial report format so that the body of the report will have a shorter explanation of the recommendations and rationals, and then the Annex will include all of those detailed answers to charter questions. 1. Then the WG would have time to review all of the the text of the deliberations and provide any edits or things that might make the group uncomfortable. 2. Staff will will likely reorder the recommendations to make it more readable and logical. 1. Introduce plan for ICANN80 session * Session discussion will focus on rec or changes the WG cannot live with in the draft initial report. 1. Review Initial Report Recommendations Google Doc<https://docs.google.com/document/d/1xUJMqgb096HXIJ6xWNpNC_w5g6TukZxIbcN7_PT…> Action Item: WG will have two weeks to identify any CANNOT LIVE WITH items (focus on Group 1b and Group 2 recs) 1. AOB Feodora Hamza Policy Development Support Manager (GNSO) Internet Corporation for Assigned Names and Numbers (ICANN) Mobile: +32 496 30 24 15 Email: feodora.hamza(a)icann.org<mailto:feodora.hamza@icann.org> Website: www.icann.org<http://www.icann.org>

1 0

Post Call | Transfer Policy Review PDP WG | Tuesday, 21 May 2024
by Julie Bisland 21 May '24

21 May '24

Dear all, All recordings for the Transfer Policy Review PDP WG call held on Tuesday, 21 May 2024 at 16:00 UTC can be found on the agenda wiki page <https://community.icann.org/x/egATEw> (attendance included) and the GNSO Master calendar<https://urldefense.com/v3/__https:/gnso.icann.org/en/group-activities/calen…>. These include: * Attendance * Audio recording * Zoom recording (including audio, visual, rough transcript, and chat.) * Transcript * Agenda and Notes/Action Items As a reminder only members and alternates can join the call as a Panelist, observers can join as an Attendee to listen. For additional information, you may consult the mailing list archives [lists.icann.org]<https://urldefense.com/v3/__https:/lists.icann.org/hyperkitty/list/gnso-tpr…>and the main wiki page<https://community.icann.org/x/P4aUCQ>. Thank you. With kind regards, Julie

1 0

Meeting Invitation | Transfer Policy Review PDP WG call | Tuesday, 04 June 2024
by Julie Bisland 21 May '24

21 May '24

Reminder: the 28 May call has been cancelled. Please remove it from your calendar. Dear all, The next Transfer Policy Review PDP WG call is scheduled for Tuesday, 04 June 2024 at 16:00 UTC for 90 minutes. * If unable to attend, members must communicate their alternate replacement using this google form<https://urldefense.com/v3/__https:/docs.google.com/forms/d/e/1FAIpQLScXP3-H…>. Zoom Information: Main Zoom Webinar link: https://icann.zoom.us/j/95363727469?pwd=N3A3OWFSaTlUME9wZzlGajk5VUI3QT09 <https://urldefense.com/v3/__https:/icann.zoom.us/j/95363727469?pwd=N3A3OWFS…> Passcode: @TP/^*4wg# If you are joining via audio only: One tap mobile: US: +19294362866,,95363727469#,,,,*7490739013# or +13017158592,,95363727469#,,,,*7490739013# Telephone: Dial (for higher quality, dial a number based on your current location): US: +1 929 436 2866 or +1 301 715 8592 or +1 312 626 6799 or +1 669 900 6833 or +1 253 215 8782 or +1 346 248 7799 or 888 788 0099 (Toll Free) or 877 853 5247 (Toll Free) Webinar ID: 953 6372 7469 Passcode: 7490739013 International numbers available: https://icann.zoom.us/u/acdLFXPLp6 <https://urldefense.com/v3/__https:/icann.zoom.us/u/acdLFXPLp6__;!!PtGJab4!v…> Members, alternates, and observers all have different access and participation directions, please read below! ALL: Before joining the call: * Please send apologies and dial out requests to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only * Please be sure you have read the ICANN Expected Standards of Behavior<https://www.icann.org/resources/pages/expected-standards-2016-06-28-en> * Visit the Wiki Agenda meeting page: https://community.icann.org/x/gQATEw * Time conversion link: https://tinyurl.com/ys6nzm4b ONLY FOR MEMBERS & ALTERNATES: * Staff will promote members and alternates to panelist once joined. * Chat: Please select Everyone so everyone can see your chat, and so it’s captured in the recording. * If unable to attend, members must communicate their alternate replacement using this google form<https://urldefense.com/v3/__https:/docs.google.com/forms/d/e/1FAIpQLScXP3-H…>. * Alternate assignments will be publicly posted to the Alternate Log-Transfer Policy Review PDP<https://community.icann.org/x/V4aUCQ> wiki page. * Alternates (not replacing a member): Rename your line by adding 3 Zs (zzz) before your name and add, your affiliation - alternate after your name. * Alternates (not replacing a member) are not allowed to engage in the chat or use any of the other zoom room functionalities such as raising hands or agreeing/disagreeing. ONLY FOR OBSERVERS: * Observers will have ability to view member chat and information shared in the zoom webinar room. * Observers will not be able to use chat or raise hands. Thank you. Kind regards, Julie Policy Team Supporting the GNSO

1 0

Canceled: Transfer Policy Review PDP WG
by ICANN Policy Calendar 21 May '24

21 May '24

Meeting: Transfer Policy Review PDP WG Date/time: Occurs every Tuesday at 16:00 UTC for 90 minutes, 02 April – 04 June 2024 (note: 07 May – no meeting due to CPH Summit) (One time call set up on 25 June 2025) Alternate replacement confirmations – Members who are unable to attend, please complete the google form<https://docs.google.com/forms/d/e/1FAIpQLScXP3-H595xH4EFgaR3ydOr-1o9BLAVGUI…> to communicate who the alternate is replacing you. Join the Zoom Webinar: https://icann.zoom.us/j/95363727469?pwd=N3A3OWFSaTlUME9wZzlGajk5VUI3QT09 Passcode: @TP/^*4wg# ALL: Before joining the call: * Please send apologies and dial out requests to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only * Please be sure you have read the ICANN Expected Standards of Behavior<https://www.icann.org/resources/pages/expected-standards-2016-06-28-en> * 2024 Wiki page: https://community.icann.org/x/S4BFE ONLY for Members & Alternates: * Please join via the above Zoom Webinar link and staff will promote you to Panelist * Alternate assignments will be posted to the Alternate Log-Transfer Policy Review PDP wiki page<https://community.icann.org/x/V4aUCQ>. * Chat: Please select Everyone when posting to the chat in order for everyone to see and to be captured afterwards. * Alternates (not replacing a member): Please rename your line in Zoom by adding THREE Zs “zzz” before your name, and in parentheses, (your affiliation - alternate), after your name. * Alternates (not replacing a member) are not allowed to engage in the chat or use any of the other zoom room functionalities such as raising hands or agreeing/disagreeing. ONLY for Observers: * Observers will have ability to view member chat and information shared in the zoom webinar room. Observers will not be able to use chat or raise hands. For Audio only: One tap mobile: US: +19294362866,,95363727469#,,,,*7490739013# or +13017158592,,95363727469#,,,,*7490739013# Webinar ID: 953 6372 7469 Passcode: 7490739013 International numbers available: https://icann.zoom.us/u/acdLFXPLp6

1 0