- GNSO-TPR - lists.icann.org

Re: [GNSO-TPR] Please respond - attendance for WG meeting on 4 October
by Emily Barabas Sept. 29, 2022

Sept. 29, 2022

Dear all, Thanks to those who have already responded. Given the anticipated interest in the webinar, Tuesday’s WG call will be cancelled. The next WG call will be on 11 October at 16:00 UTC. Kind regards, Julie, Berry, Caitlin, and Emily From: GNSO-TPR <gnso-tpr-bounces(a)icann.org> on behalf of Emily Barabas <emily.barabas(a)icann.org> Date: Thursday, 29 September 2022 at 20:12 To: "gnso-tpr(a)icann.org" <gnso-tpr(a)icann.org> Subject: [GNSO-TPR] Please respond - attendance for WG meeting on 4 October Dear WG members, As you may have seen, there is a Webinar on the Proposed WHOIS Disclosure System Design Paper<https://www.icann.org/en/announcements/details/icann-will-host-webinars-on-…> this coming Tuesday, 4 October from 15:30-17:00 UTC, which conflicts with our weekly WG meeting. Note that there will be a second webinar on Tuesday, 11 October from 1:00-3:30 UTC. If you are planning to miss Tuesday’s WG call to attend the webinar, can you kindly respond on list? This will assist the leadership team in determining whether to go forward with the call as scheduled. Thanks, Emily Emily Barabas Policy Development Support Senior Manager Internet Corporation for Assigned Names and Numbers (ICANN) Phone: +31 (0)6 84507976 www.icann.org<http://www.icann.org/>

1 0

Input on the break through proposal
by Theo Geurts Sept. 18, 2022

Sept. 18, 2022

Hello, Some high-level observations on the breakthrough proposal. Step 1 goto gaining registrar. This excludes resellers, making it a highly complex process as resellers use different registrars for different TLDs for various reasons. Coding this into systems will be difficult., if not impossible. Also, registrants know who their reseller or hosting company is. They usually have no idea who the underlying registrar is. This issue is usually related to the wholesale registrar industry. Generating the PTID. The suggested method is to log in to the registrar's account and generate the PTID on the website. While logical, Wholesale registrars have zero control/interaction with registrant accounts at a reseller level. The proposal does not cover the complexity of sub sub resellers. If the PTID is compromised, it is still possible for an attacker to set up an account at the registrar and continue the transfer to that registrar and move the domain name to another registrar when the lock period expires. Regarding the proposal for making the losing FOA visible by using consent from the data subject, consent is a very shaky legal option. Plus, I have a hard time imagining how this system would work, without creating all kinds of new risks and possible data breaches by people who did not understand what the consequences could be. Again everything in an ICANN policy is public, and attackers will modify or create new TTPs to get around the barriers/security requirements mentioned in the policy. And we have not considered all the operational and security effects of the proposals. Best. Theo

1 0

Brief Notes - TPR WG Meeting at ICANN75 - 17 September 2022 at 10:30 MYT
by Julie Hedlund Sept. 17, 2022

Sept. 17, 2022

Dear TPR WG members, Please find below the brief notes from today’s meeting. Please note that these brief notes are not a substitute for the recording or transcript. The next meeting will be on Tuesday, 04 October at 16:00 UTC. Best regards, Emily, Julie, Berry, and Caitlin Notes: Transfer Policy Review – ICANN75 Session Proposed Agenda 17 September 2022 1. Welcome 2. PDP Introduction and Status * Not going to go through everything; just to give you some background to follow. * See the slides at: https://community.icann.org/download/attachments/208208420/Transfer%20Polic… 3. Discussion of Public Comments<https://community.icann.org/display/TPRPDP/Phase+1A+-+Public+Comment+Review…> on the Working Group's Phase 1A Initial Report [itp.cdn.icann.org]<https://urldefense.com/v3/__https:/itp.cdn.icann.org/en/files/inter-registr…> * Focus: Recommendation 1 to Eliminate the Gaining Form of Authorization and Recommendation 2 to Eliminate the Losing Form of Authorization (FOA) * Materials to review for this discussion: Pages 12-18 of the Working Group’s Phase 1A Initial Report [itp.cdn.icann.org]<https://urldefense.com/v3/__https:/itp.cdn.icann.org/en/files/inter-registr…> Recommendation 1 Public Comment Working Document [docs.google.com]<https://urldefense.com/v3/__https:/docs.google.com/document/d/1xBQpbMbbJgaB…> Recommendation 2 Public Comment Working Document [docs.google.com]<https://urldefense.com/v3/__https:/docs.google.com/document/d/1gyy9xfe0-ymW…> Public Comment Review Tool – Recommendation 1<https://community.icann.org/download/attachments/201949311/gnso-TPR-P1A-pcr…>: All Comments Public Comment Review Tool - Recommendation 2<https://community.icann.org/download/attachments/201949311/gnso-TPR-P1A-pcr…>: All Comments Public Comment Review Tool - Recommendation 3<https://community.icann.org/download/attachments/201949311/gnso-TPR-P1A-pcr…>: Comments #10, #11, #12 Public Comment Review Tool - Recommendation 4:<https://community.icann.org/download/attachments/201949311/gnso-TPR-P1A-pcr…> Comment #10 Public Comment Review Tool – Additional Input<https://community.icann.org/download/attachments/201949311/gnso-TPR-P1A-pcr…>: Comments #1-#11 Leap of Faith Financial Services Comment [itp.cdn.icann.org]<https://urldefense.com/v3/__https:/itp.cdn.icann.org/public-comment/proceed…> (full text, especially pages 11-24, 31-39) Summary of WG Discussion on 13 September: WG discussion and agreement: In initial discussions, working group members did not believe that the relevant comments present new information. Working group members expressed that the recommendations remain appropriate, but that the rationale for recommendation 2 should be augmented to fully explain why the recommended approach offers an appropriate level of security to registrants. Points to emphasize in rationale: · The first and most important line of defense and the primary point of control is logging into the account at the Registrar. This is the “affirmative consent” to initiate the transfer. · Once an attacker has logged into the control panel, they can change the points of contact, including who receives the FOA/notifications, eliminating the utility of the FOA/notifications in that scenario. This is true with FOA and will also be true with notifications. The properties of the two are very similar. · Additional security is provided in the recommended approach because the TAC is generated on demand and is therefore less vulnerable to theft. · The Losing Registrar still has 5 days to provision the TAC. As a business decision, the Registrar has the discretion to delay provision of the take additional steps including to perform due diligence during that window. Registrars will decide if and how to use that period based on their chosen approach as well as the type/value of the domain. Registrar due diligence can give extra protection to the registrant. Delayed provision of the TAC also gives registrants more time to respond to notifications, to the extent they are receiving notifications (attacker has not updated contact into). Registrants have the choice to pick a Registrar that fits their needs. · The proposed 30-day post-transfer lock helps to ensure that if a domain is stolen, domain hopping will be slowed, allowing the Losing and Gaining Registrars to work together to resolve the problem. This recommendation may prompt registrars to take a “backdoor security measure” by delaying the time between people asking for Transfer Authorization Codes (TACs) and issuing them to customers, which will ultimately burden domain registrants. They would not be able to complete the domain transfer process in one sitting. WG discussion and agreement: In initial discussions, WG members noted that they see optional delayed provision of the TAC as a feature, not a bug. · As a business decision, the Registrar has the discretion to delay provision of the take additional steps including to perform due diligence during that window. · Registrars will decide if and how to use that period based on their chosen approach as well as the type/value of the domain. · Registrar due diligence can give extra protection to the registrant. Delayed provision of the TAC also gives registrants more time to respond to notifications, to the extent they are receiving notifications (attacker has not updated contact into). Registrants have the choice to pick a Registrar that fits their needs. The authorization of Losing FOA should remain with the Registrant, not the Registrar. RFC 9154 is unequivocal: "A transfer is coordinated by the REGISTRANT to transfer the sponsorship of the object from one registrar to another." Any transfer coordinated by a losing registrar (or a gaining registrar), or registry, or anyone other than the REGISTRANT violates RFC 9154. WG discussion and agreement: One of the co-authors of RFC9154 who is a member of the WG disagreed with the commenter’s interpretation of the RFC. The RFC is not making a normative statement that would impose policy on the ICANN process. In addition, the registrant is still coordinating the process with the new proposed process, so the new process would be consistent with the RFC language. Measures to increase security of the TAC are insufficient to justify elimination of the Losing FOA. The TAC is an extremely valuable asset that is vulnerable to theft or use by third parties once it has been generated. The WG’s recommendations to strengthen elements of TAC security do not address this vulnerability. WG discussion and agreement: In initial discussion, members emphasized that with the new recommendations, the TAC will be generated on demand and will only be available for 14 days after being generated. This is significant improvement to the security of the TAC. While it is true that the TAC can be stolen once it has been generated, WG members noted that is the case in the current environment, as well. Additional data/reference points that the respondent believes the WG should review in considering retention of the Losing FOA: NACKed transfers as listed in TPSR, data on Canadian mobile phone number transfers/thefts, ARIN's procedures for the transfer of IP addresses, SSAC Advice: SAC040, SAC044, SAC074. WG discussion and agreement: In initial discussions, WG members noted that the number of NACKed transfers can’t be used to understand the number of domain thefts, because transfers are also NACKed for other reasons. Discussion of Leap of Faith Comments: Link to Leap of Faith Financial Services Comment [itp.cdn.icann.org]<https://urldefense.com/v3/__https:/itp.cdn.icann.org/public-comment/proceed…> (full text, especially pages 11-24, 31-39) * Keep the 5-day window that registrars can roll back – minimum standard for registrars. * Talked about when a request for a transfer is made that a notice has to be sent (mandatory). WG should consider whether this makes sense. * Also discussed having the gaining IANA ID. Would help know where it was going – asked this as a question in the public comments. * Need to retain the losing FOA --- once the TAC is generated the registrants are on their own. * Need to think about what we are talking about as a practical matter. The TAC is ephemeral. The TTL can be set to very low levels. Help registrants to restrict transfers. * The majority of the recommendations go together. * Comments center on the registrant no longer getting a 5-day window. * You could have an secure PTID that the domain is being transferred to. * Many registrants don’t log into their registrar very frequently, so lose the ability to NACK. * If we keep the existing approach and improve the rationale – see 2.2 existing text seems to suggest there is a means to NACK the transfer, but we may need to make it clear that while this is true, it is a very small window. But before that even happens is there a chance to stop it? The comments are getting to allowing the registrant to NACK the transfer – and making that window (to NACK, be it 5-day or otherwise) mandatory. * What is the argument against having some window that allows the registrant to NACK the transfer. * Give registrants the choice to have the losing FOA; this report suffers from lack of data – giving a choice would allow ICANN to see who opted in. * Question to George Kirikos: Would having a transfer window plus an embedded Gaining Registrar IANA ID be better than the WG’s current proposal? Answer: Yes to the IANA ID but not the transfer window. George’s breakthrough proposal is still preferable. * Just have a few options: 1) keep the recommendation as is with no changes; 2) keep the recommendation but provide better rationale to address the comments/concerns; 3) modify it so it supports what the commenters are proposing. * There are problems identifying the registrar from the embedded IANA ID for most registrants. * Problems would be eliminated if you “push” the ID. * It is a problem today that registrants don’t know where the transfer is going. * Might be that the WG members should look at what can happen at the gaining registrar. * Section E of George Kirikos proposal: Registrant would go to the Gaining Registrar that would create an ID (ends to a destination account, like a wire transfer), registrant would take that to the Losing Registrar and enter the name – still need to preserve the Losing FOA step. * Couldn’t someone still hack and get the ID? Yes, and that is why you need the Losing FOA. * But then the Losing FOA would go to the hacker. * Just need to create a somewhat secure transfer system because it seems that the security is in the multi-factor authentication, which is outside of the transfer policy. * Registries offer additional security mechanisms such as locks. 4. Wrap up

1 0

Guidelines for speakers ICANN75
by Nathalie Peregrine Sept. 14, 2022

Sept. 14, 2022

Dear all, ICANN75 will begin in a few days. For all those joining, be it on-site or remotely, please take a few moments to review the attached guidelines. Whether you are a scheduled speaker, or planning to attend sessions, these guidelines ensure your audio will be loud and clear, and that meetings can run smoothly. Thank you all! Kind regards, Nathalie

1 0

Proposed agenda for ICANN75 session on Saturday, 17 September at 10:30 MYT
by Emily Barabas Sept. 13, 2022

Sept. 13, 2022

Dear Working Group members, Please find below the proposed agenda for ICANN75 session<https://community.icann.org/display/TPRPDP/2022-09-17+ICANN75+Transfer+Poli…> scheduled to take place on Saturday, 17 September at 10:30 MYT. Prior to the call, please re-read pages 12-18 of the Working Group’s Phase 1A Initial Report<https://itp.cdn.icann.org/en/files/inter-registrar-transfer-policy-irtp/tra…>. Please also make sure to review the following and come prepared to discuss: * Recommendation 1 Public Comment Working Document<https://docs.google.com/document/d/1xBQpbMbbJgaBHth2fucmEElQTc-pbaqbQIkAYS_…> * Recommendation 2 Public Comment Working Document<https://docs.google.com/document/d/1gyy9xfe0-ymW-irtY2gKSEy3za8IcG-GrF8EcCG…> * Public Comment Review Tool – Recommendation 1<https://community.icann.org/download/attachments/201949311/gnso-TPR-P1A-pcr…>: All Comments * Public Comment Review Tool - Recommendation 2<https://community.icann.org/download/attachments/201949311/gnso-TPR-P1A-pcr…>: All Comments * Public Comment Review Tool - Recommendation 3<https://community.icann.org/download/attachments/201949311/gnso-TPR-P1A-pcr…>: Comments #10, #11, #12 * Public Comment Review Tool - Recommendation 4:<https://community.icann.org/download/attachments/201949311/gnso-TPR-P1A-pcr…> Comment #10 * Public Comment Review Tool – Additional Input<https://community.icann.org/download/attachments/201949311/gnso-TPR-P1A-pcr…>: Comments #1-#11 * Leap of Faith Financial Services Comment<https://itp.cdn.icann.org/public-comment/proceeding/Initial%20Report%20on%2…> (full text, especially pages 11-24, 31-39) Kind regards, Julie, Berry, Caitlin, and Emily Transfer Policy Review – ICANN75 Session Proposed Agenda 17 September 2022 1. Welcome 2. PDP Introduction and Status 3. Discussion of Public Comments<https://community.icann.org/display/TPRPDP/Phase+1A+-+Public+Comment+Review…> on the Working Group's Phase 1A Initial Report<https://itp.cdn.icann.org/en/files/inter-registrar-transfer-policy-irtp/tra…> - Focus: Recommendation 1 to Eliminate the Gaining Form of Authorization and Recommendation 2 to Eliminate the Losing Form of Authorization (FOA) - Materials to review for this discussion: Pages 12-18 of the Working Group’s Phase 1A Initial Report<https://itp.cdn.icann.org/en/files/inter-registrar-transfer-policy-irtp/tra…> Recommendation 1 Public Comment Working Document<https://docs.google.com/document/d/1xBQpbMbbJgaBHth2fucmEElQTc-pbaqbQIkAYS_…> Recommendation 2 Public Comment Working Document<https://docs.google.com/document/d/1gyy9xfe0-ymW-irtY2gKSEy3za8IcG-GrF8EcCG…> Public Comment Review Tool – Recommendation 1<https://community.icann.org/download/attachments/201949311/gnso-TPR-P1A-pcr…>: All Comments Public Comment Review Tool - Recommendation 2<https://community.icann.org/download/attachments/201949311/gnso-TPR-P1A-pcr…>: All Comments Public Comment Review Tool - Recommendation 3<https://community.icann.org/download/attachments/201949311/gnso-TPR-P1A-pcr…>: Comments #10, #11, #12 Public Comment Review Tool - Recommendation 4:<https://community.icann.org/download/attachments/201949311/gnso-TPR-P1A-pcr…> Comment #10 Public Comment Review Tool – Additional Input<https://community.icann.org/download/attachments/201949311/gnso-TPR-P1A-pcr…>: Comments #1-#11 Leap of Faith Financial Services Comment<https://itp.cdn.icann.org/public-comment/proceeding/Initial%20Report%20on%2…> (full text, especially pages 11-24, 31-39) 1. Wrap up

1 0

Post Call | Transfer Policy Review PDP WG | Tuesday, 13 September 2022
by Julie Bisland Sept. 13, 2022

Sept. 13, 2022

Dear all, All recordings for the Transfer Policy Review PDP WG call held on Tuesday, 13 September 2022 at 16:00 UTC can be found on the agenda wiki page <https://community.icann.org/x/CQVpD> (attendance included) and the GNSO Master calendar <https://urldefense.com/v3/__https:/gnso.icann.org/en/group-activities/calen…> . These include: * Attendance * Audio recording * Zoom chat archive * Zoom recording (including audio, visual, rough transcript) * Transcript As a reminder only members and alternates can join the call as a Panelist, observers can join as an Attendee to listen. For additional information, you may consult the mailing list archives <https://mm.icann.org/pipermail/gnso-tpr/> and the main wiki page<https://community.icann.org/x/P4aUCQ>. Thank you. With kind regards, Julie

1 0

Notes and action items - TPR WG Meeting #59 - 13 September 2022 at 16:00 UTC
by Julie Hedlund Sept. 13, 2022

Sept. 13, 2022

Dear TPR WG members, Please find below the notes and action items from today’s meeting. The next meeting will be at ICANN75 on Saturday, 17 September at 10:30-12:00 MYT (local time KL). Best regards, Emily, Julie, Berry, and Caitlin ACTION ITEMS/HOMEWORK -- Preparation for ICANN75: 1. Staff to incorporate points raised in discussion during the meeting on 13 September on recommendation #2 for WG members to review. 2. WG members to review the proposed edits in the Recommendation 2 Public Comment Working Document [docs.google.com]<https://urldefense.com/v3/__https:/docs.google.com/document/d/1gyy9xfe0-ymW…> and also the following documents: * Public Comment Review Tool – Recommendation 1<https://community.icann.org/download/attachments/201949311/gnso-TPR-P1A-pcr…>: Comment #5 * Public Comment Review Tool - Recommendation 2<https://community.icann.org/download/attachments/201949311/gnso-TPR-P1A-pcr…>: All Comments * Public Comment Review Tool - Recommendation 3<https://community.icann.org/download/attachments/201949311/gnso-TPR-P1A-pcr…>: Comments #10, #11, #12 * Public Comment Review Tool - Recommendation 4:<https://community.icann.org/download/attachments/201949311/gnso-TPR-P1A-pcr…> Comment #10 * Public Comment Review Tool – Additional Input<https://community.icann.org/download/attachments/201949311/gnso-TPR-P1A-pcr…>: Comments #1-#11 * Leap of Faith Financial Services Comment [itp.cdn.icann.org]<https://urldefense.com/v3/__https:/itp.cdn.icann.org/public-comment/proceed…> (full text, especially pages 19-24, 31-39) Notes: Proposed Agenda 13 September 2022 1. Roll Call & SOI updates 2. Welcome and Chair Updates * Today’s discussion will be continued into ICANN75. * Do have a pretty big topic here. We knew we would get some comments back on it. Nothing unexpected, but a lot of good comments to go through. * Question: What are we discussing in Kuala Lumpur? Answer: There will be a quick overview of the status of the work followed by a working session. 3. Approach to Public Comment Review -- Begin Discussion of Comments on Elimination of the Losing FOA: Overview: * Discussion with staff and leadership on how best to support the review of public comments. * Last week we began a discussion in the WG on Rec 19 and we’ll come back to that. * But now we’ll focus on early recommendations and determined that it would be helpful to give the WG some discussion papers to call out proposals for changes to the recommendations and/or current policy. * Staff to describe the working document for Recommendation 2 and welcome feedback. Recommendation 2 Public Comment Working Document [docs.google.com]<https://urldefense.com/v3/__https:/docs.google.com/document/d/1gyy9xfe0-ymW…> * Top of document – recommendation text. * Staff will avoid doing any synthesis of the comments so WG members should review and be familiar with comments, but staff will highlight key points or areas of agreements, proposals. Key Principles for Public Comment Review: * If suggested edits are minor and editorial in nature, focus on whether you can live with them. * If suggested edits are substantive, focus on what new information or insights that have been provided by the commenter. * If concerns, information, or perspectives have already been considered in the development of the recommendations, consider how the report can strengthen the rationale by showing how these have been addressed and why the WG took the approach it did. * Members are representing their groups, not their individual or employer positions/perspectives. Now is the time to make sure you are aligned. * The goal is to make recommendations that achieve consensus support. If there isn’t consensus to change the policy, the existing policy remains in place. Proposal for using these documents: * Staff prepared documents ahead of time. * Use last 15 minutes of the call for homework -- review comments and working documents, and then prep for the next week’s call, including coordination with their groups as necessary. * After deliberations staff will collect key points and agreements, update the report with suggested edits to review over the mailing list. * Alternative: more offline homework with WG expected to take time every week to review comments and provide written analysis for staff to synthesize. For the EPDP this required WG members to meet in between meetings to do homework, but we aren’t sure that’s needed here. Discussion on Process: * Question: If a proposal is nearly the same as a recommendation or policy, do WG members have to go back to their groups for approval? Answer: Each group will have its own procedures, but we just want to guard against a representative from advocating for a position that is at odds with their group. WG members should ask their groups how they want to address proposals discussed in reviewing the comments. * Timing: Try to work through dependencies first, with consolidated elements of the comments; staff will capture the discussions and incorporate them into the working documents and set a time frame for discussions/responses from groups. * As we review the comments and as on last week’s call, there was momentum building to adjust the recommendation #19 to something that the WG can agree on taking into consideration the comments. This isn’t the last chance to develop final recommendations – there will be time later for the full WG to consider the new revised recommendation and to reconfirm with their respective groups. Where there is agreement on a change to a recommendation we want to determine where we have general agreement on the text. * Hard to get input from our groups incrementally without seeing the impact on the full policy. WG members should have flexibility with their groups to bring forward proposals and suggest how the group should approach them – WG members need to understand what their group wants to see in the final product. There will be time to review and discuss any draft final language with their groups. * We can adjust the process as necessary as we go. Summary of public comments – see: Recommendation 2 Public Comment Working Document [docs.google.com]<https://urldefense.com/v3/__https:/docs.google.com/document/d/1gyy9xfe0-ymW…> * A number of people (registrants and BC) said that registrants need a way to NACK/deny the transfer before it takes place. For some of these the recommendation eliminates the ability of a registrant to deny a transfer. * Consider whether these concerns are new and whether they need to be address. * Concern that if the losing FOA is eliminated some registrars may adopt security measures that would delay the provision of the TAC making the process slower. * Another element is about the security of the TAC – that measures to increase the security of the TAC are not sufficient to replace the security of the FOA, and the recommendations don’t safeguard the security of the TAC. * References supporting the security of the consent model. Request for data from registrars. Discussion points: * Whether these concerns are new and how to address them – consider whether to revise the recommendations. * Not sure we discussed all of these ideas and if we didn’t we should think about whether or how to address them. * Encourage WG members to look at the responses to the charter questions in relation to this recommendation. * Make sure we address the issue that the dispute resolution process is not the same as stopping a fraudulent transfer before it happens. * Consider whether we need to be more direct even if it is in our current rationale. * Should be able to document how the group consider the comment (see below as an example re: violation of RFC9154). WG Comments: * Not persuaded by these arguments, think we address them. But maybe we need a better rationale for the recommendations – to explain how the WG addressed with their recommendations the concerns being raised. * Note how the Losing FOA didn’t really go away, it is addressed by the TAC. Maybe ask the registrars for data. * A NACK isn’t necessarily a negative thing. NACKing doesn’t happen often to begin with and not all is related to fraud. * In terms of explaining the recommendations – we are making sure that fraudulent transfers don’t even get off the ground. * Re: assertion that RFC9154 is being violated – disagree with the commenter. There is no RFC problem here. * On the issue of affirmative response, the reality is the "affirmative response" is the fact that an RNH logged in to the registrar account. That's the first line of defense and the FOA doesn't fix that. If someone gets into your account they change all those points of contact and the FOA serves no purpose. I hope that's clear enough. The point is the issue is still covered, the same as always. * These concerns are interlinked and difficult to talk about them in isolation. For example, could increase the number of days before the TAC is revealed. * Staff will need help from WG members to confirm if the rationale in the Final Report properly addresses the concerns raised in public comment – the rationale has to address these directly. * Well of course it's vulnerable to theft once it's generated. That's always been true. If the RNH doesn't do their part to keep it safe, well, oh well. This proposed system works better because the TAC doesn't exist until it's needed, which is different than history. That's a significant improvement, in my opinion. * Those who have concerns about recommendation #2 should look at recommendation #3 – specifically 3.2 – elements of TAC provision, steps the RNH can take to NACK the transfer. * Think that there is a misunderstanding about the security properties of the Losing FOA. The reality is that the first line of defense is that fact that you’ve logged into the registrar account. People are misattributing security properties to the FOA. * The losing FOA did provide something that we aren’t requiring today, particularly a 5-day window for an action. So that needs additional rationale. * Should highlight that this is a huge advancement. * If an account got hacked you’d never see a NACK anyway. You have ACKs that are fraudulent that you don’t see. * So, yes the 5 day window to NACK has been removed from today's traditional transfer process. But isn't this what the TTL of the TAC is meant to compensate for? * No it doesn't. They are solving different problems. * There still can be a 5-day window to provide the TAC, it’s just not mandatory. Registrants can choose a registrar with that level of security if they wish, or not. That is the flexibility we built in. * The TAC TTL is just providing some protection for the TAC, limiting the overall window of vulnerability when a domain is eligible for a transfer. the 5 days window is an extra step for a registrant at a cost of the delay waiting for the transfer. 4. Planning for ICANN75 session: Saturday, 17 September at 10:30 MYT * Staff will send the agenda shortly and WG members should review. * WG will continue the discussion from today’s meeting, starting with recommendation #2. ACTION ITEMS/HOMEWORK -- Preparation for ICANN75: 1. Staff to incorporate points raised in discussion during the meeting on 13 September on recommendation #2 for WG members to review. 2. WG members to review the proposed edits in the Recommendation 2 Public Comment Working Document [docs.google.com]<https://urldefense.com/v3/__https:/docs.google.com/document/d/1gyy9xfe0-ymW…> and also the following documents: * Public Comment Review Tool – Recommendation 1<https://community.icann.org/download/attachments/201949311/gnso-TPR-P1A-pcr…>: Comment #5 * Public Comment Review Tool - Recommendation 2<https://community.icann.org/download/attachments/201949311/gnso-TPR-P1A-pcr…>: All Comments * Public Comment Review Tool - Recommendation 3<https://community.icann.org/download/attachments/201949311/gnso-TPR-P1A-pcr…>: Comments #10, #11, #12 * Public Comment Review Tool - Recommendation 4:<https://community.icann.org/download/attachments/201949311/gnso-TPR-P1A-pcr…> Comment #10 * Public Comment Review Tool – Additional Input<https://community.icann.org/download/attachments/201949311/gnso-TPR-P1A-pcr…>: Comments #1-#11 * Leap of Faith Financial Services Comment [itp.cdn.icann.org]<https://urldefense.com/v3/__https:/itp.cdn.icann.org/public-comment/proceed…> (full text, especially pages 19-24, 31-39) 6. AOB

1 0

Meeting Invitation | Transfer Policy Review PDP WG call | Tuesday, 04 October 2022
by Julie Bisland Sept. 13, 2022

Sept. 13, 2022

NOTE: The TPR PDP WG will meet at ICANN75 on Saturday, 17 September at 10:30 MYT. Please see the ICANN75 Session page<https://75.schedule.icann.org/meetings/hNdkMxTP2FLu93z6h> for join information (you must be registered for ICANN75; Zoom participation links will be published here 24 hours before the session starts.) and the Agenda wiki page<https://community.icann.org/x/JAJpD>. See the invite below for the next regularly scheduled call taking place after ICANN75. ************************* Dear all, The next Transfer Policy Review PDP WG call is scheduled for Tuesday, 04 October 2022 at 16:00 UTC for 90 minutes. Zoom Room Information: Main Zoom Webinar link: https://icann.zoom.us/j/95363727469?pwd=N3A3OWFSaTlUME9wZzlGajk5VUI3QT09 <https://urldefense.com/v3/__https:/icann.zoom.us/j/95363727469?pwd=N3A3OWFS…> Passcode: @TP/^*4wg# If you are joining via audio only: One tap mobile: US: +19294362866,,95363727469#,,,,*7490739013# or +13017158592,,95363727469#,,,,*7490739013# Telephone: Dial (for higher quality, dial a number based on your current location): US: +1 929 436 2866 or +1 301 715 8592 or +1 312 626 6799 or +1 669 900 6833 or +1 253 215 8782 or +1 346 248 7799 or 888 788 0099 (Toll Free) or 877 853 5247 (Toll Free) Webinar ID: 953 6372 7469 Passcode: 7490739013 International numbers available: https://icann.zoom.us/u/acdLFXPLp6 <https://urldefense.com/v3/__https:/icann.zoom.us/u/acdLFXPLp6__;!!PtGJab4!v…> Members, alternates, and observers all have different access and participation directions, please read below! ALL: Before joining the call: * Please send apologies and dial out requests to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only * Please be sure you have read the ICANN Expected Standards of Behavior<https://www.icann.org/resources/pages/expected-standards-2016-06-28-en> * Visit the Wiki Agenda meeting page: https://community.icann.org/x/DQVpD * Check your time zone: https://tinyurl.com/3cba46wf ONLY FOR MEMBERS & ALTERNATES: * Please join via the Main Zoom Webinar link above; staff will promote you to panelist. * Chat: Members (and alternates replacing members), please select Everyone so everyone can see and so it’s captured afterwards. * Alternate replacement confirmations – For tracking alternate replacements, use the google form [docs.google.com]<https://urldefense.com/v3/__https:/docs.google.com/forms/d/e/1FAIpQLScXP3-H…> to communicate the replacement (alternate) and the duration. This information will be publicly posted to the Alternate Log-Transfer Policy Review PDP<https://community.icann.org/x/V4aUCQ> wiki page. * Alternates (not replacing a member): Rename your line by adding THREE Zs (zzz) before your name and add, in parentheses (your affiliation - alternate) after your name. To rename in Zoom, hover over your name and click ‘rename’. * Alternates (not replacing a member) are not allowed to engage in the chat or use any of the other zoom room functionalities such as raising hands or agreeing/disagreeing. ONLY FOR OBSERVERS: * Observers will have ability to view member chat and information shared in the zoom webinar room. Observers will not be able to use chat or raise hands. Thank you. Kind regards, Julie

1 0

**AT THE TOP OF THE HOUR** Meeting Invitation | Transfer Policy Review PDP WG call | Tuesday, 13 September 2022
by Julie Bisland Sept. 13, 2022

Sept. 13, 2022

**AT THE TOP OF THE HOUR** Dear all, The next Transfer Policy Review PDP WG call is scheduled for Tuesday, 13 September 2022 at 16:00 UTC for 90 minutes. Zoom Room Information: Main Zoom Webinar link: https://icann.zoom.us/j/95363727469?pwd=N3A3OWFSaTlUME9wZzlGajk5VUI3QT09 <https://urldefense.com/v3/__https:/icann.zoom.us/j/95363727469?pwd=N3A3OWFS…> Passcode: @TP/^*4wg# If you are joining via audio only: One tap mobile: US: +19294362866,,95363727469#,,,,*7490739013# or +13017158592,,95363727469#,,,,*7490739013# Telephone: Dial (for higher quality, dial a number based on your current location): US: +1 929 436 2866 or +1 301 715 8592 or +1 312 626 6799 or +1 669 900 6833 or +1 253 215 8782 or +1 346 248 7799 or 888 788 0099 (Toll Free) or 877 853 5247 (Toll Free) Webinar ID: 953 6372 7469 Passcode: 7490739013 International numbers available: https://icann.zoom.us/u/acdLFXPLp6 <https://urldefense.com/v3/__https:/icann.zoom.us/u/acdLFXPLp6__;!!PtGJab4!v…> Members, alternates, and observers all have different access and participation directions, please read below! ALL: Before joining the call: * Please send apologies and dial out requests to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only * Please be sure you have read the ICANN Expected Standards of Behavior<https://www.icann.org/resources/pages/expected-standards-2016-06-28-en> * Visit the Wiki Agenda meeting page: https://community.icann.org/x/CQVpD * Check your time zone: https://tinyurl.com/ycwjfk6t [tinyurl.com]<https://urldefense.com/v3/__https:/tinyurl.com/ycwjfk6t__;!!PtGJab4!5hD4G4b…> ONLY FOR MEMBERS & ALTERNATES: * Please join via the Main Zoom Webinar link above; staff will promote you to panelist. * Chat: Members (and alternates replacing members), please select Everyone so everyone can see and so it’s captured afterwards. * Alternate replacement confirmations – For tracking alternate replacements, use the google form [docs.google.com]<https://urldefense.com/v3/__https:/docs.google.com/forms/d/e/1FAIpQLScXP3-H…> to communicate the replacement (alternate) and the duration. This information will be publicly posted to the Alternate Log-Transfer Policy Review PDP<https://community.icann.org/x/V4aUCQ> wiki page. * Alternates (not replacing a member): Rename your line by adding THREE Zs (zzz) before your name and add, in parentheses (your affiliation - alternate) after your name. To rename in Zoom, hover over your name and click ‘rename’. * Alternates (not replacing a member) are not allowed to engage in the chat or use any of the other zoom room functionalities such as raising hands or agreeing/disagreeing. ONLY FOR OBSERVERS: * Observers will have ability to view member chat and information shared in the zoom webinar room. Observers will not be able to use chat or raise hands. Thank you. Kind regards, Julie

1 0

REMINDER | Meeting Invitation | Transfer Policy Review PDP WG call | Tuesday, 13 September 2022
by Devan Reed Sept. 12, 2022

Sept. 12, 2022

Dear all, The next Transfer Policy Review PDP WG call is scheduled for Tuesday, 13 September 2022 at 16:00 UTC for 90 minutes. Zoom Room Information: Main Zoom Webinar link: https://icann.zoom.us/j/95363727469?pwd=N3A3OWFSaTlUME9wZzlGajk5VUI3QT09 <https://urldefense.com/v3/__https:/icann.zoom.us/j/95363727469?pwd=N3A3OWFS…> Passcode: @TP/^*4wg# If you are joining via audio only: One tap mobile: US: +19294362866,,95363727469#,,,,*7490739013# or +13017158592,,95363727469#,,,,*7490739013# Telephone: Dial (for higher quality, dial a number based on your current location): US: +1 929 436 2866 or +1 301 715 8592 or +1 312 626 6799 or +1 669 900 6833 or +1 253 215 8782 or +1 346 248 7799 or 888 788 0099 (Toll Free) or 877 853 5247 (Toll Free) Webinar ID: 953 6372 7469 Passcode: 7490739013 International numbers available: https://icann.zoom.us/u/acdLFXPLp6 <https://urldefense.com/v3/__https:/icann.zoom.us/u/acdLFXPLp6__;!!PtGJab4!v…> Members, alternates, and observers all have different access and participation directions, please read below! ALL: Before joining the call: * Please send apologies and dial out requests to gnso-secs(a)icann.org<mailto:gnso-secs@icann.org> only * Please be sure you have read the ICANN Expected Standards of Behavior<https://www.icann.org/resources/pages/expected-standards-2016-06-28-en> * Visit the Wiki Agenda meeting page: https://community.icann.org/x/CQVpD * Check your time zone: https://tinyurl.com/ycwjfk6t<https://urldefense.com/v3/__https:/tinyurl.com/ycwjfk6t__;!!PtGJab4!4tbcTnn…> ONLY FOR MEMBERS & ALTERNATES: * Please join via the Main Zoom Webinar link above; staff will promote you to panelist. * Chat: Members (and alternates replacing members), please select Everyone so everyone can see and so it’s captured afterwards. * Alternate replacement confirmations – For tracking alternate replacements, use the google form<https://urldefense.com/v3/__https:/docs.google.com/forms/d/e/1FAIpQLScXP3-H…> to communicate the replacement (alternate) and the duration. This information will be publicly posted to the Alternate Log-Transfer Policy Review PDP<https://community.icann.org/x/V4aUCQ> wiki page. * Alternates (not replacing a member): Rename your line by adding THREE Zs (zzz) before your name and add, in parentheses (your affiliation - alternate) after your name. To rename in Zoom, hover over your name and click ‘rename’. * Alternates (not replacing a member) are not allowed to engage in the chat or use any of the other zoom room functionalities such as raising hands or agreeing/disagreeing. ONLY FOR OBSERVERS: * Observers will have ability to view member chat and information shared in the zoom webinar room. Observers will not be able to use chat or raise hands. Thank you. Kind regards, Julie

1 0