July 2008 - NA-Discuss - lists.icann.org

Google Caches Retain Stolen Data - Shouldn't ICANN require Googles registry shut down google until this is fixed?
by Jeffrey A. Williams July 10, 2008

July 10, 2008

All, Well seems Google has again been exposed for it's errant and inconsiderate as well as violation of privacy ways... Shouldn't ICANN request in the best interest of users to temporarily shut down Google until Google permanently fixes this and clearly demonstrates it has done so? Or does ICANN fear the mighty power of Google?!? How can members of the public, trust Google or ICANN if Google is allowed to continually disregard the publics privacy in light also of Google purporting to be now handling Electronic medical records and exposing users, especially the elderly, indigent children, and the disabled, or their families, to massive potential fraud and/or medical blackmail? And FWIW, where is DOC/NTIA, USDOJ, and DHS on this? I hope it is not "ho hum, twiddle my thumb"... I for one and very glad SANS at least, is on the job! >:) Perhaps they should be retained by ICANN, DOC/NTIA, USDOJ, and DHS in a mentoring program on a VERY long term basis. See from Sans: (July 7, 2008) Stolen sensitive personal data, including financial account information, have been found to linger in Google caches for months even after the server holding the stolen information has been disabled. Cyber criminals collect information through keystroke loggers and store the data on servers. When the servers are discovered, they are taken down, but the Google pages are not unless specific requests are made. A Google spokesperson said that in general, the company does not remove cached information, but that it eventually disappears on its own after the original source is no longer accessible. http://www.sfgate.com/cgi-bin/article.cgi?f=/c/a/2008/07/07/BUHR11CK6Q.DTL&… Regards, Spokesman for INEGroup LLA. - (Over 281k members/stakeholders strong!) "Obedience of the law is the greatest freedom" - Abraham Lincoln "Credit should go with the performance of duty and not with what is very often the accident of glory" - Theodore Roosevelt "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== Updated 1/26/04 CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of Information Network Eng. INEG. INC. ABA member in good standing member ID 01257402 E-Mail jwkckid1(a)ix.netcom.com My Phone: 214-244-4827

1 0

Re: [NA-Discuss] [ga] 67 Registrars Still in Undisclosed Locations
by Jeffrey A. Williams July 10, 2008

July 10, 2008

Joe and all, In this case, yes it is about public trust and confidance mostly. But it is also about accountability and transparency as well as competance. Did ICANN do it's due diligance before accrediting these "Secret" registrars, and when did they do it? Where is the data regarding the particulars of this due diligance documented? What was the nature ( specifics ) of that due diligance? When, if ever, will ICANN make publically avaliable the locations of these Registrars and the contact information for each? And finnaly, why wasn't or isn't this information publically avaliable now? There may be very reasonable reasons why these 67 Registrars locations are not publically known. If so, ICANN should make that information also avaliable for public review and perhaps questions in those regards. We all have to remember the decisions on some if not most of these undocumented Registrars were made by a ICANN GNSO and Bod that in part does not now exist and that may not have been given accreditation today. I don't offer this as an excuse or reason, only as food for thought. I and many of our members have often thought that ICANN has acted as if it is not bound by US law and policy and that it is a US Non-Profit California 501(c3) corporation. When it even appears that it is or has done so, it should be open to be made aware by any member of the public that it has or is possibly acting or considering to act in such a manner, and address that preception or relitive fact immediately and with the open participation of the public. Failure to do so, as ICANN has too often done, engenders distrust and creates more problems for ICANN's Bod and staff than it is worth. Joe Baptista wrote: > > On Thu, Jul 10, 2008 at 4:35 PM, Danny Younger > <dannyyounger(a)yahoo.com> wrote: > > This is about building public trust and confidence. > > > ICANN buried the public trust and confidence a long time ago. Of > course its never too late to start. > > regards > joe baptista > > > -- > Joe Baptista > www.publicroot.org > PublicRoot Consortium > ---------------------------------------------------------------- > The future of the Internet is Open, Transparent, Inclusive, > Representative & Accountable to the Internet community @large. > ---------------------------------------------------------------- > Office: +1 (360) 526-6077 (extension 052) > Fax: +1 (509) 479-0084 Regards, Spokesman for INEGroup LLA. - (Over 281k members/stakeholders strong!) "Obedience of the law is the greatest freedom" - Abraham Lincoln "Credit should go with the performance of duty and not with what is very often the accident of glory" - Theodore Roosevelt "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== Updated 1/26/04 CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of Information Network Eng. INEG. INC. ABA member in good standing member ID 01257402 E-Mail jwkckid1(a)ix.netcom.com My Phone: 214-244-4827

1 0

Post Paris Briefing?
by Dharma Dailey July 9, 2008

July 9, 2008

Is anyone interested in getting a post-Paris briefing from those who attended? Please express your interest, yeah or nay. If there is interest we will schedule an unofficial conference call. -Dharma Dailey

4 5

FYI:New type of online scam. But yet not really all that new
by Jeffrey A. Williams July 9, 2008

July 9, 2008

All, A newly recognized, but not all that new online scam that you may want to make known. I've seen and been a victim of this scam myself. Remember, anyone can become a victim! It yet again demonstrates that some of our fellow users continue to be up to no good. >:( See: http://www.networkworld.com/community/node/29625?netht=rn_070808&nladname=0… Regards, Spokesman for INEGroup LLA. - (Over 281k members/stakeholders strong!) "Obedience of the law is the greatest freedom" - Abraham Lincoln "Credit should go with the performance of duty and not with what is very often the accident of glory" - Theodore Roosevelt "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== Updated 1/26/04 CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of Information Network Eng. INEG. INC. ABA member in good standing member ID 01257402 E-Mail jwkckid1(a)ix.netcom.com My Phone: 214-244-4827

1 0

Re: [NA-Discuss] [ga] Re: .info Abuse Policy as a "New Service" might be barred by ICANN's agreement with Afilias
by Jeffrey A. Williams July 9, 2008

July 9, 2008

George and all, Your correct on your analysis and conclusion IMHO. FWIW though, it is clear that ICANN cannot or will not do the oversight of it's registrars, or for that matter registries and indeed may prefer to defer those duties and responsibilities back to the Registrar and/or Registry. Ergo a circular round-robbin endless dysfunctional self regulation methodology. LEA's at various levels are not wanted by ICANN nor Registrars and Registires for obvious and some nefarious reasons which many of us are all too well aware of or have personally experienced. Just as frankly however, LEA's don't seem to be able to properly, securely or reasonably manage their own Domain Names either as recent GAO reports and breaches that have been reported clearly demonstrate. ( I can easily provide many examples if requested ) Given Afilias's history, IMO it's long past time to dis-accredit Affilias as a registry. They can't even "Police" their own domain name's DNS or web site, let alone serve as defacto police of their registrants. They also seem to have serious problems in their DNS services for other domain names despite their BS marketing jargon. I consider Afilias a significant infrastructure security risk of significant proportion. George Kirikos wrote: > Hi again, > > I forgot to add, that paragraph 3.1.(b)(iv)(F) of the agreement dealing > with Consensus Policies specifically mentions: > > http://www.icann.org/tlds/agreements/info/registry-agmt-08dec06.htm > > "(F)resolution of disputes regarding whether particular parties may > register or maintain registration of particular domain names." > > An allegation of abuse, affecting whether a particular party may > maintain a registration of a domain name, clearly falls under that > description above. > > Furthermore the last section of 3.6.5 of the appendix (i.e. > registry-registrar agreement) says: > > http://www.icann.org/tlds/agreements/info/appendix-08-08dec06.htm > > "Afilias also reserves the right to place upon registry lock, hold or > similar status a domain name during resolution of a dispute." > > I would suggest that again an allegation of "abuse" is equivalent to a > "dispute" in the above language, and that does not permit cancellation, > but only registry lock, hold or similar status. 3.6.5 puts law > enforcement and government (and courts) above the registry operator. > This new proposal makes the registry operator become the policeman, the > prosecution, judge, jury and executioner. > > Sincerely, > > George Kirikos > http://www.kirikos.com/ > > --- George Kirikos <gkirikos(a)yahoo.com> wrote: > > > Hi folks, > > > > According to paragraph 3.1.(d)(iii) of the .info agreement: > > > > http://www.icann.org/tlds/agreements/info/registry-agmt-08dec06.htm > > > > "(c) any other products or services that only a registry operator is > > capable of providing, by reason of its designation as the registry > > operator; > > > > Obviously the registrar is currently *equally* capable of cancelling > > or > > removing a domain name from the zone file, and handling abuse issues. > > So *by definition* this can't be a product or service that only the > > registry operator is capable of providing. > > > > Furthermore, 3.1.(d)(iv)(G) provides specific definitions of > > "Security" > > and "Stability" that I do not believe are met by this proposal. > > > > I believe the proper course forward is for Afilias to cancel its > > proposal as a "new service", and instead propose a Consensus Policy > > for > > review by the GNSO Council. I would invite them to do so, as I'm > > against abuse. Through a Consensus Policy we can ensure that the > > rights > > of registrants to due process will be protected through input from > > all > > constituencies, and ensure that a policy that has proportionality and > > predictability is created. > > > > Sincerely, > > > > George Kirikos > > http://www.kirikos.com/ > > Regards, Spokesman for INEGroup LLA. - (Over 281k members/stakeholders strong!) "Obedience of the law is the greatest freedom" - Abraham Lincoln "Credit should go with the performance of duty and not with what is very often the accident of glory" - Theodore Roosevelt "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== Updated 1/26/04 CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of Information Network Eng. INEG. INC. ABA member in good standing member ID 01257402 E-Mail jwkckid1(a)ix.netcom.com My Phone: 214-244-4827

1 0

Proposed GNSO Top Level Implementation Plan
by At-Large Staff July 9, 2008

July 9, 2008

REMINDER: Please submit comments by 17 July 2008 http://www.icann.org/public_comment/#gnso-tlp Proposed GNSO Top Level Implementation Plan Explanation: At its 25 June 2008 meeting in Paris, France the GNSO Council voted to invite public comments on the 21 June 2008 version of the GNSO Improvements - Top Level Plan prepared by the GNSO Improvements Planning Team. The document contains some initial documentation on methods that can be followed in beginning the work required to transition from the current GNSO organization to the type of organization ultimately recommended by the ICANN Board - including the areas of process, operations and collaboration with other ICANN entities. Before any methods can be put into practice, the plan needs to be reviewed by the GNSO and the ICANN community at large and approved by the GNSO Council and endorsed by the ICANN Board. A copy of the document: can be found here: http://gnso.icann.org/drafts/gnso-improvements-top-level-plan-21jun08.pdf [PDF, 148K] See a web page with more information about the overall GNSO Improvements process here: http://www.icann.org/topics/gnso-improvements/.

1 0

LA Times BLog: ACTA: Turning ISPs into enforcers
by Jeffrey A. Williams July 9, 2008

July 9, 2008

All, You may want to contact your ISP in this regard as well as your legal representative. I personally find this to be a very dangerous idea. It seems to have originated from organizations such as the RIAA and MPAA. http://opinion.latimes.com/bitplayer/2008/06/acta-turning-is.html Los Angeles Times - Home Blogs Bit Player - latimes.com ACTA: Turning ISPs into enforcers Riaa_logo Knowledge Ecology International, a group that seeks to reduce the control wielded by patent and copyright holders, recently posted a list of suggestions that the RIAA purportedly sent to the U.S. Trade Representative for what to include in the proposed Anti-Counterfeiting Trade Agreement. Ars Technica's Nate Anderson took up the issue today, accusing the record companies of trying to disembowel the safe harbor provisions of the DMCA. I checked the legitimacy of the Knowledge Ecology post with Neil Turkewitz, the RIAA's point man on such things, and he said it looked accurate. Not surprisingly, however, he offered a somewhat different take than Ars. Yet he acknowledged that some aspects of the RIAA's proposal for ACTA go beyond U.S. law on the enforcement of copyrights online. ACTA, which aims to establish a multinational standard for anti-piracy enforcement, has generated a fair amount of concern in the blogosphere because a) it's being negotiated in secret, as are all trade pacts, and b) some media outlets have suggested that it could lead to people's laptops and iPods being searched at the border. Here's the RIAA's position, according to the Knowledge Ecology post: Provide that competent authorities have the authority to initiate border measures ex officio, with respect to imported, exported, or in-transit merchandise suspected of being counterfeit or confusingly similar trademark goods, or pirated copyright goods, without the need for a formal complaint from a private party or right holder, and regardless of whether the relevant right that is being infringed is recorded with Customs otherwise registered. What that means is, border agents wouldn't have to wait for a complaint from Warner Bros. Studios to be on the lookout for a few hundred bootlegged DVDs of "The Dark Knight." U.S. border agents already search laptops at random and without warrants, yet it's hard to picture them spending the time and energy to catch people smuggling camcorded films on their iPods. Much more problematic is the RIAA's wish list for online enforcement. The suggestions would seem to shift the legal ground in favor of copyright holders on issues that remain in dispute in U.S. courts, and possibly on a few that have been settled here or in other countries. Two examples of the latter are suggestions to make manufacturers liable for products and services whose "predominant application" is aiding piracy -- a more onerous standard than the one the Supreme Court laid out in the Sony Betamax case -- and to insure that copyright holders have access to the data they need from ISPs to bring lawsuits -- a potential conflict with some European court rulings. In an e-mail, Turkewitz said the RIAA wasn't trying to make a wholesale shift in the balance of legal power. "The bulk of this section is devoted to trying to secure harmonization around fundamental US legal principles of secondary liability and contributory infringement, including adoption of the `induce' standard articulated by the Supreme Court in Grokster," he wrote (link added). The RIAA's proposal would also ratchet up the pressure on ISPs and search engines to weed out infringements. According to the Knowledge Ecology post, one RIAA suggestion would require ISPs "to employ readily available measures to inhibit infringement in instances where both legitimate and illegitimate uses were facilitated by their services, including filtering out infringing materials, provided that such measures are not unduly burdensome and do not materially affect the cost or efficiency of delivering legitimate services." Another would require them to clamp down on or banish repeat infringers. The RIAA and MPAA have pressed U.S. courts to oblige ISPs to police their networks, but judges haven't exactly agreed. Wrote Turkewitz, "The Supreme Court in Grokster suggested that in the appropriate circumstances, an entity that is aware of the fact that they are facilitating piracy may assume an obligation to filter, although there is clearly no separate and independent legal obligation to do so. Likewise, termination of a repeat infringer may or may not form a part of an ISP's current responsibility." To Turkewitz, the point isn't to turn ISPs into copyright cops ("No one is suggesting that ISPs monitor their networks," he said in an interview). It's to address rampant online piracy in a more efficient way than the broad measures ISPs currently use, such as traffic shaping. Similarly, having ISPs notify suspected infringers could actually reduce the amount of enforcement done, Turkewitz said, by educating Internet users about copyright law. Yet there's no magic bullet to identifying and stopping pirated material as it's traveling from one PC to another online, at least not yet. Even if ISPs could automatically identify when a song was being transmitted, technology alone can't discern an infringement from a likely fair use (e.g., a parody or a transfer among family members). And one non-trivial problem with the notice and escalating penalties idea is that it can be hard to identify who actually was using a particular broadband account when an infringement occurred. IP addresses can be faked, wireless routers can be hijacked. But Turkewitz was not deterred. "You can deal with all of those issues," he said of the potential notification problems. "I think the critical thing is that you canât let everything just stop forward motion. There are always issues. You have to advance in a reasonable way, and be flexible and accommodating in making sure all reasonable expectations are met." "Reasonable," "flexible" and "accommodating" aren't words often used in connection with the RIAA's campaign against individual file-sharers. But while the RIAA may be the most aggressive in trying to stop piracy by individual Internet users, it's hardly alone in seeking to force ISPs to play a greater role in protecting intellectual property. "This is early in the ACTA process, and we have no idea how this will develop," Turkewitz wrote. "Does RIAA want the parties to discuss the role of ISP's in the fight against piracy? Absolutely. How can you talk about fighting piracy in 2008 without talking about a key aspect of this challenge?" He added, "Having said that, there is zero chance that the [U.S. government] would agree to a binding obligation on an issue of this magnitude without the consent of Congress -- and most importantly for present purposes -- we are not asking them to do so.... Our submission to the US negotiators should certainly not be construed as asking the US to legislate. These are some of our ideas about how to enhance enforcement." Addendum: Having talked about ACTA entirely in the context of pirated entertainment, I neglected to make a point that bloggers often overlook about contemporary piracy. There's much more at stake than just music and movie industry profits. All sorts of branded products -- medicines, batteries, auto parts, toys, apparel, etc. -- have become targets for counterfeiters. In some cases, those fakes pose a real risk to health and safety. That's why there's broad support from U.S. industry for a crackdown, as evidenced by the involvement of the U.S. Chamber of Commerce. There are also complex issues involving how developing nations compete, but that's a subject for an even longer post. Regards, Spokesman for INEGroup LLA. - (Over 281k members/stakeholders strong!) "Obedience of the law is the greatest freedom" - Abraham Lincoln "Credit should go with the performance of duty and not with what is very often the accident of glory" - Theodore Roosevelt "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== Updated 1/26/04 CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of Information Network Eng. INEG. INC. ABA member in good standing member ID 01257402 E-Mail jwkckid1(a)ix.netcom.com My Phone: 214-244-4827

1 0

REMINDER: NARALO Teleconference 14 July 1900 UTC
by At-Large Staff July 8, 2008

July 8, 2008

Dear all, This is to remind you about the upcoming NARALO teleconference scheduled for Monday, 14 July at 1900 UTC. Please find additional information about this meeting on the meeting page: https://st.icann.org/naralo/index.cgi?14_july_2008 We will post the agenda shortly. Regards, Nick Ashton-Hart, Matthias Langenegger, Frederic Teboul ICANN At-Large Staff email: staff(a)atlarge.icann.org

1 0

Domain Name Warehousing - No rules, why not?
by Jeffrey A. Williams July 8, 2008

July 8, 2008

All, ICANN Not Enforcing Rules Against Registrar Warehousing Because There Are No Rules July 6th, 2008 Now I wonder when new gTLD's and especially IDN gTLD's begin to be introduced, how and what will be done or considered to thwart this ugly and regressive practice? Will ICANN drag it's feet yet again in accepting proposals in doing away with this practice by registrars and registries? In any event, if you want to get some action on this bad business practice by registrars and registries, you can let ICANN know at raa-consultation(a)icann.org. Regards, Art. ref.: http://www.thedomains.com/2008/07/06/icann-not-enforcing-rules-against-regi… Spokesman for INEGroup LLA. - (Over 281k members/stakeholders strong!) "Obedience of the law is the greatest freedom" - Abraham Lincoln "Credit should go with the performance of duty and not with what is very often the accident of glory" - Theodore Roosevelt "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== Updated 1/26/04 CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of Information Network Eng. INEG. INC. ABA member in good standing member ID 01257402 E-Mail jwkckid1(a)ix.netcom.com My Phone: 214-244-4827

1 0

Re: [NA-Discuss] [At-Large] New gTLDs and e-mail
by Jeffrey A. Williams July 7, 2008

July 7, 2008

Bret and all, Than you need to review Yahoo.com's DNS configuration, for example. I certainly believe that Apple or Yahoo would do just exactly whatever they wanted irrespective of compliancy of major RFC's. So either you are not paying attention very closely or just unaware for whatever reason. For yahoo.com's DNS see: http://private.dnsstuff.com/tools/dnsreport.ch?domain=yahoo.com&token=27a01… Bret Fausett wrote: > I have a hard time believing that Apple or Yahoo or any other major > customer-facing business would roll out a branded TLD with an email > service that wasn't compliant with major RFCs. > > Bret > > > > _______________________________________________ > ALAC mailing list > ALAC(a)atlarge-lists.icann.org > http://atlarge-lists.icann.org/mailman/listinfo/alac_atlarge-lists.icann.org > > At-Large Official Site: http://atlarge.icann.org Regards, Spokesman for INEGroup LLA. - (Over 281k members/stakeholders strong!) "Obedience of the law is the greatest freedom" - Abraham Lincoln "Credit should go with the performance of duty and not with what is very often the accident of glory" - Theodore Roosevelt "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== Updated 1/26/04 CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of Information Network Eng. INEG. INC. ABA member in good standing member ID 01257402 E-Mail jwkckid1(a)ix.netcom.com My Phone: 214-244-4827

1 0