24 hr time to respond to urgent requests
Dear colleagues, For the record, as indicated in the GAC Public comment (and other public comments), the GAC favors retaining the currently proposed 24 hour timing to respond to "Urgent Requests" as commensurate with the emergency nature of these requests. Our remarks from our public comment are set forth here: GAC Comments on the Draft Registration Data Consensus Policy for gTLDs - 21 November 2022 Pages 6-7 Section 10. Disclosure Requests Paragraph 10.6 regarding Urgent Requests for Disclosure misapplies the approved Phase 1 policy recommendations by failing to implement expedited timeframes consistent with the nature of responding to emergency requests for disclosure. For context, EPDP Recommendation 18 stated that: A separate timeline of [less than X business days] will [be] considered for the response to 'Urgent' Reasonable Disclosure Requests, those Requests for which evidence is supplied to show an immediate need for disclosure [time frame to be finalized and criteria set for Urgent requests during implementation]. [Emphasis added]. Notably, the Phase 1 Recommendations highlighted that these urgent requests relate to "an immediate need for disclosure." The implementation team defined urgent requests (Definition 3.8) in a manner consistent with such an immediate need: "Urgent Requests for Lawful Disclosure" are limited to circumstances that pose an imminent threat to life, serious bodily injury, critical infrastructure, or child exploitation in cases where disclosure of the data is necessary in combatting or addressing this threat. Critical infrastructure means the physical and cybersystems that are vital in that their incapacity or destruction would have a debilitating impact on economic security or public safety. As stressed in the section pertaining to definition, the GAC recommends to include in the scope of urgent requests other circumstances generating an immediate need for disclosure and which would otherwise be included in the regular requests (maximum response time of 30 days), in particular significant cybersecurity threats or incidents (such as those deriving from large scale ransomware, malware or botnet campaigns) regardless of whether the target is critical infrastructure. Furthermore, in relation to the timeline, the GAC notes that despite the immediate need for such information, the implementation team construed the Phase 1 recommendations to permit a two business-day response period followed by one business-day extension under certain circumstances. Put simply, three business days (which could stretch to seven calendar days depending on weekends and intervening holidays) is not a reasonable time period for responding to urgent requests. This is especially true because "urgent" requests apply only to emergency situations involving imminent threats to life and critical infrastructure among other things. The implementation team misinterpreted the Phase 1 recommendations by applying the same two business-day acknowledgment period for general requests to urgent requests. This flawed interpretation had the effect of prolonging the timeframe to respond to an urgent request. However, the foundational logic of dealing with "urgent" requests separately was to streamline the entire process because these requests deal with time-sensitive matters that involve threats to life, safety, or vital infrastructure. Hence, it would be neither reasonable nor logical to view the 2-day acknowledgement provision as overriding or extending the separate timeline for responding to urgent requests. More specifically, the acknowledgement time for general requests should not delay the contemplated expedited timeline for urgent requests. The GAC believes that this interpretation conflicts with the clear Phase 1 directive to develop "a separate timeline" for the response to urgent requests. The GAC recommends that the implementation team must revisit this issue to ensure that responses to urgent requests are in fact expedited in a manner consistent with an emergency response. We support the outcome of ICANN.Org's assessment and response to the public comments on this important public safety issue. Kind regards, Laureen Kapin Assistant Director for International Consumer Protection Office of International Affairs Federal Trade Commission lkapin@ftc.gov
The implementation team misinterpreted the Phase 1 recommendations by applying the same two business-day acknowledgment period for general requests to urgent requests. This flawed interpretation had the effect of prolonging the timeframe to respond to an urgent request. However, the foundational logic of dealing with “urgent” requests separately was to streamline the entire process because these requests deal with time-sensitive matters that involve threats to life, safety, or vital infrastructure. Hence, it would be neither reasonable nor logical to view the 2-day acknowledgement provision as overriding or extending the separate timeline for responding to urgent requests. More specifically, the acknowledgement time for general requests should not delay the contemplated expedited timeline for urgent requests. The GAC believes that this interpretation conflicts with the clear Phase 1 directive to develop “a separate timeline” for the response to urgent requests. The GAC recommends that the implementation team must revisit this issue to ensure that responses to urgent requests are in fact expedited in a manner consistent with an emergency response.
Actually, it is not misinterpretation. The two timelines, normal and urgent requests, are mentioned separately in the final report (approved by WG, Council and Board): 30 days for normal requests, less than X number of business days for urgent requests. It’s logical that urgent requests are to acted upon faster, and that’s exactly what’s in the PDP output. Trying to relitigate policy decisions only contribute to further delays of policy implementation. Rubens
Thank you for the clarification Rubens. we need to face reality and especially for some judicial impact for the small internet industry. *Betty FAUSTA -* Mobile : +590 (0) 690 4973 09 (Guadeloupe) Fax : +33 (0) 972 2278 55 Contacts : Skype BETFAU | Pin BBM : 76521821 | Whats'app &Viber Le sam. 10 juin 2023, à 00 h 22, Rubens Kuhl via IRT.RegDataPolicy < irt.regdatapolicy@icann.org> a écrit :
The implementation team misinterpreted the Phase 1 recommendations by applying the same two business-day acknowledgment period for general requests to urgent requests. This flawed interpretation had the effect of prolonging the timeframe to respond to an urgent request. However, the foundational logic of dealing with “urgent” requests separately was to streamline the entire process because these requests deal with time-sensitive matters that involve threats to life, safety, or vital infrastructure. Hence, it would be neither reasonable nor logical to view the 2-day acknowledgement provision as overriding or extending the separate timeline for responding to urgent requests. More specifically, the acknowledgement time for general requests should not delay the contemplated expedited timeline for urgent requests. The GAC believes that this interpretation conflicts with the clear Phase 1 directive to develop “a separate timeline” for the response to urgent requests. The GAC recommends that the implementation team must revisit this issue to ensure that responses to urgent requests are in fact expedited in a manner consistent with an emergency response.
Actually, it is not misinterpretation. The two timelines, normal and urgent requests, are mentioned separately in the final report (approved by WG, Council and Board): 30 days for normal requests, less than X number of business days for urgent requests. It’s logical that urgent requests are to acted upon faster, and that’s exactly what’s in the PDP output.
Trying to relitigate policy decisions only contribute to further delays of policy implementation.
Rubens
_______________________________________________ IRT.RegDataPolicy mailing list IRT.RegDataPolicy@icann.org https://mm.icann.org/mailman/listinfo/irt.regdatapolicy
_______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.
participants (3)
-
BF -
Kapin, Laureen -
Rubens Kuhl