August 2008 - NA-Discuss - lists.icann.org

Draft NARALO statement on ALAC review
by Evan Leibovitch Sept. 22, 2008

Sept. 22, 2008

NOTE: This is a draft, produced as a result of interest expressed in my earlier query of this list. Even though it says "reached by consensus", that of course will not be the case if we do not reach consensus. Please -- SOON -- offer changes of any kind as well as any other comments. If at least rough consensus is possible, I would like to have a final version ready for presentation by Saturday night. If it sounds to strong, or not strong enough, or you just don't like the tone, etc. please suggest changes. - Evan --------------------------------------------------------- NARALO, by consensus agreement, urges ALAC to take every measure possible to encourage rejection of the report of the 2008 ALAC review by the ICANN board and other members of the ICANN community. The ALAC Review process has been flawed from the initial choice of review consultants, which we believe may have adversely affected the independence of the review itself. Such suspicions appear to be warranted by the complete lack of consideration of the needs of At-Large in the reviewers' draft recommendations. While the report indicates we were heard, we were clearly not listened to. The logic behind the recommendation to deny At-Large voting membership on the ICANN Board is puzzling; even in its best possible interpretation the rationale emphasizes rigidity over good and responsible governance. Not only do the ALAC review recommendations fail to progress the needs of ICANN's At-Large community, they take a significant step backwards by requesting that an even larger proportion of ALAC than currently exists be composed of unaccountable, non-representative appointees of the Nominating Committee. The result is a real and visible reduction of the voice of the community for whom ALAC is supposed to speak. Indeed, most of the report's recommendations appear designed to deny the vision ICANN originally had for At-Large, to reduce the influence of At-Large within ICANN, to reduce transparency, and to obstruct community outreach. The review fails totally to address the fact that ICANN's relationship with At-Large is bi-directional. What is at issue is not only what the community must offer to ICANN, but also what ICANN _owes_ to the community of Internet users who have neither financial nor academic interest in Internet operation. For these reasons, we call upon ALAC and other members of the ICANN community to challenge the recommendations of the current ALAC review, as well as the very frames of reference upon which they were constructed. We believe that such actions are required for the betterment of ICANN's public constituency. This statement was reached by consensus of NARALO members on June 20, 2008 after efforts to solicit opinion from its organizational and individual members.

8 13

ICANN Geographic Regions
by Danny Younger Sept. 5, 2008

Sept. 5, 2008

For discussion at the NARALO monthly meeting: Pursuant to ICANN Board Resolution 07.92, the GNSO and other ICANN bodies were invited to provide input to the ICANN staff on a proposal by the ccNSO recommending that the ICANN Board appoint a community-wide working group to review the structure of ICANN's present Geographic Regions and related issues. Concern over the proper formulation of the ICANN Geographic Regions has long been a significant part of At-Large structure-building considerations with the earliest recommendations dating back to the 2001 proposal of the At-Large Study Committee to create a Central/West/South Asia Region (CWSA) comprising India (.in), Pakistan (.pk), Afghanistan (.af), Kazakhstan (.kz), Uzbekistan (.uz), Kyrgyzstan (.kg), Turkmenistan (.tm), Tajikistan (.tj), Sri Lanka (.lk), Maldives (.mv), Iraq (.iq), Iran (.ir), Israel (.il), Syria (.sy), Jordan (.jo), Lebanon (.lb), Palestine Territories (.ps), Kuwait (.kw), UAE (.ae), Yemen (.ye), Oman (.om), Bahrain (.bh), Qatar (.qa), Saudi Arabia (.sa). The recent recommendations of the Westlake Consulting Team charged with the current ALAC review follow in this spirit by recognizing that ICANN’s geographic regional structure is not well aligned with global population distribution and is increasingly unrepresentative of world-wide Internet usage, leading Westlake to recommend increasing the number of NomCom appointees to the ALAC by two members, both of whom would be from Asia. As any change in the total number or composition of ICANN geographic Regions will impact ICANN's At-Large Structures, we formally request that an at-large representative from each current ICANN Geographic Region be included in the Board-appointed community-wide working group to review the structure of ICANN's present Geographic Regions and related issues.

6 13

Proposed ALAC statement on new amendments to RAA -- please read
by Brendler, Beau Sept. 2, 2008

Sept. 2, 2008

Hello, everyone. Attached is a draft of a proposed statement on behalf of ALAC regards the registrar accreditation agreement. This follows our briefing from Tim Cole a couple of weeks ago. As I mentioned in that briefing, I think a number of consumer and user community concerns can be traced back to this agreement and its enforcement. I think it's important to stay on top of the process and make as strong a statement as possible regarding the user community's concerns. The document is brief, and in two parts: The first part addresses possible concerns with the new amendments, as described by Tim. Some of these items are taken from the briefing discussion, some are taken from the general pool of user comments, and some have been re-worded and re-applied from "Section F" of the summary document (you can find links to all these referenced documents on the briefing page here: https://st.icann.org/alac/index.cgi?draft_amendments_to_raa) Danny Younger's expertise on this is of course acknowledged as well and you'll see some ideas and language in here from his own public comment document. I hope he will have some additions and suggestions for this. The second part revisits some of the initial comments made by the ALAC when the consultation period began. Some of these were placed in section F, but I reworded them to perhaps make them more timely and possibly acceptable for consideration. I also omitted some of the recommendations from Section F that seemed stale or probably just not doable at this point. If you have anything to add, please do so! This represents a starting point, we can add whatever else we want, but we promised to get this to Tim Cole by the end of August, and it's here. Nick has been very helpful to me in putting this together, so please send any additions or comments to this list, and/or Nick or me and we will integrate them into the final. **************************************************************************** ******** SCANNED **************************************************************************** ********

4 7

Statement on proposed amendments to RAA, version II
by Brendler, Beau Aug. 30, 2008

Aug. 30, 2008

Here's the next version incorporating comments from Danny, Wendy and Carlton. I tried to recast the whole document and added introduction and conclusion, in which some of the more passionate reflections are made, though I modulated those a bit. I believe this needs to be to Tim Cole today. At this point I'm going to ask Nick, who's probably started his weekend by now, to give this a second read and then proceed with Spanish translation (and French if that's now possible). I will cc Tim so he has an idea of what's coming, but that he should be aware the final might not be completed until early next week. I'll be out Monday and with limited time online during the holiday weekend. Thanks for your contributions... Beau **************************************************************************** ******** SCANNED **************************************************************************** ********

3 3

Re: [NA-Discuss] [ALAC] Proposed ALAC statement on new amendments to RAA -- please read
by Brendler, Beau Aug. 29, 2008

Aug. 29, 2008

Thanks, Carlton, I will make sure those get into the next draft, which I'm working on now -- I erroneously responded to Wendy's last note as if she were responding to the fast flux document, however, it doesn't really change the content, just ignore the reference to Mike O'Connor. Apologies for confusion. BB -----Original Message----- From: Carlton Samuels [mailto:carlton.samuels@gmail.com] Sent: Friday, August 29, 2008 2:00 PM To: Wendy Seltzer Cc: Brendler, Beau; ALAC(a)atlarge-lists.icann.org; NA Discuss Subject: Re: [ALAC] Proposed ALAC statement on new amendments to RAA -- please read LACRALO has not returned a consensus position that we can report but I would wish to associate and endorse the document prepared by Beau's team. We believe that any breach of a solemn agreement must identify those that are harmed,set it right and find ways to deter the aggressor. Markets generally recognize these tenets with punitive fines for the culprits and monetary compensation for those harmed. In this context, I fully endorse Wendy's additional comments, especially the call for beneficiary status for all users affected by registrar misbehaviour. Kind regards, Carlton Samuels UWI On Fri, Aug 29, 2008 at 10:35 AM, Wendy Seltzer <wendy(a)seltzer.com> wrote: > Thanks Beau, > A few points of question: > >> ICANN should require standardized Acceptable Use Policy in registration agreements to address criminal fraud, when this directly affects the operational stability, reliability, security and global interoperability of the Internet. > > I believe it is not ICANN's or registrars' role to address criminal > activity, beyond not knowingly aiding it. > >> Enforce and make public the results of dispute mechanisms in place that obligate registrars to facilitate enforcement of abusive registration policies, such as the UDRP. > > Without endorsing any of those dispute resolution policies, I think > transparency about their effects is useful. ICANN, rather than the > registrars, should be responsible for the enforcement and disclosure, > though. > > I would still prefer to see concrete information-forcing mechanisms, > e.g., requiring prominent notification of deviations from a standard > set of contract terms. Market competition only works when consumers > know they are making a choice and understand the terms of the choice. > > Finally, I'll repeat my call for third-party beneficiary status for > the affected public. > > > Thanks, > --Wendy > > > Brendler, Beau wrote: >> Hello, everyone. Attached is a draft of a proposed statement on behalf of ALAC regards the registrar accreditation agreement. This follows our briefing from Tim Cole a couple of weeks ago. >> >> As I mentioned in that briefing, I think a number of consumer and user community concerns can be traced back to this agreement and its enforcement. I think it's important to stay on top of the process and make as strong a statement as possible regarding the user community's concerns. >> >> The document is brief, and in two parts: The first part addresses possible concerns with the new amendments, as described by Tim. Some of these items are taken from the briefing discussion, some are taken from the general pool of user comments, and some have been re-worded and re-applied from "Section F" of the summary document (you can find links to all these referenced documents on the briefing page here: >> https://st.icann.org/alac/index.cgi?draft_amendments_to_raa) >> Danny Younger's expertise on this is of course acknowledged as well and you'll see some ideas and language in here from his own public comment document. I hope he will have some additions and suggestions for this. >> >> The second part revisits some of the initial comments made by the ALAC when the consultation period began. Some of these were placed in section F, but I reworded them to perhaps make them more timely and possibly acceptable for consideration. I also omitted some of the recommendations from Section F that seemed stale or probably just not doable at this point. >> >> If you have anything to add, please do so! This represents a starting point, we can add whatever else we want, but we promised to get this to Tim Cole by the end of August, and it's here. >> >> Nick has been very helpful to me in putting this together, so please send any additions or comments to this list, and/or Nick or me and we will integrate them into the final. >> >> ********************************************************************* >> ******* >> ******** >> SCANNED >> >> ********************************************************************* >> ******* >> ******** >> >> >> --------------------------------------------------------------------- >> --- >> >> _______________________________________________ >> ALAC mailing list >> ALAC(a)atlarge-lists.icann.org >> http://atlarge-lists.icann.org/mailman/listinfo/alac_atlarge-lists.ic >> ann.org >> >> At-Large Online: http://www.atlarge.icann.org ALAC Working Wiki: >> http://st.icann.org/alac > > > -- > Wendy Seltzer -- wendy(a)seltzer.org > phone: +1.914.374.0613 > Visiting Professor, American University Washington College of Law > Fellow, Berkman Center for Internet & Society > http://cyber.law.harvard.edu/seltzer.html > http://www.chillingeffects.org/ > https://www.torproject.org/ > > _______________________________________________ > ALAC mailing list > ALAC(a)atlarge-lists.icann.org > http://atlarge-lists.icann.org/mailman/listinfo/alac_atlarge-lists.ica > nn.org > > At-Large Online: http://www.atlarge.icann.org ALAC Working Wiki: > http://st.icann.org/alac > *** Scanned **************************************************************************** ******** SCANNED **************************************************************************** ********

1 0

REMINDER: 5 September 1300 UTC: Board Liaison Candidates Presentation
by At-Large Staff Aug. 29, 2008

Aug. 29, 2008

Dear all, We would like to remind about the presentation of the ALAC Board Liaison candidates next Friday 5 September from 1300 UTC until 1400 UTC. Please find participation instructions for this teleconference and a short biography of the candidates on the meeting page: https://st.icann.org/alac/index.cgi?board_liaison_candidates_presentation Regards, Nick Ashton-Hart, Matthias Langenegger, Frederic Teboul ICANN At-Large Staff email: staff(a)atlarge.icann.org ------ Forwarded Message From: At-Large Staff <staff(a)atlarge.icann.org> Date: Fri, 22 Aug 2008 02:56:28 -0700 To: <alac-announce(a)atlarge-lists.icann.org> Cc: Wendy Seltzer <wendy(a)seltzer.com>, "Brendler, Beau" <Brenbe(a)consumer.org> Subject: [ALAC-Announce] 5 September 1300 UTC: Board Liaison Candidates Presentation Dear all, We would like to invite you to a conference call with the ALAC Board Liaison candidates. Following a short introduction of the candidates, Wendy Seltzer and Beau Brendler will be available to answer your questions. The conference will be Friday September 5th from 1300 UTC to 1400 UTC . There will be simultaneous interpretation into French and Spanish. Participants are requested to provide their comments or questions in advance, to the extent possible, at the following URL by using the ŒComment¹ button at the top of the page: https://st.icann.org/alac/index.cgi?board_liaison_candidates_presentation You may also find participation instructions and the curricula vitae of the candidates on this page. Regards, Nick Ashton-Hart, Matthias Langenegger, Frederic Teboul ICANN At-Large Staff email: staff(a)atlarge.icann.org _______________________________________________ ALAC-Announce mailing list ALAC-Announce(a)atlarge-lists.icann.org http://atlarge-lists.icann.org/mailman/listinfo/alac-announce_atlarge-lists. icann.org At-Large Official Site: http://atlarge.icann.org ------ End of Forwarded Message

1 0

Fast Flux Scoping Poll
by Brendler, Beau Aug. 29, 2008

Aug. 29, 2008

Greetings. I have attached the spreadsheet containing my answers to this questionnaire to help determine how the fast flux working group should proceed. Once again, deadlines are tight, and I had hoped to get to this before today, but: If anyone has any comments or objections to the answers I have put into the spreadsheet, please let me know as soon as possible, since it represents an ALAC position on the matter (though is preliminary to moving forward with this issue; it's more a poll of the working group to figure out how, and even if, to move forward). I will send an accompanying note to Mike describing any differences. As you can see by the note below, he wants to review the results over the weekend this weekend. Personally, I believe the user community is concerned about fraud and abuse issues associated with fast flux, and I think we should encourage this working group to continue. Fast flux is used for criminal activity, so I tend to see this issue in perhaps a more binary fashion than others. Beau Brendler -----Original Message----- From: owner-gnso-ff-pdp-may08(a)icann.org [mailto:owner-gnso-ff-pdp-may08@icann.org] On Behalf Of Mike O'Connor Sent: Tuesday, August 26, 2008 8:39 AM To: gnso-ff-pdp-May08(a)icann.org Subject: [gnso-ff-pdp-may08] here's my little poll -- please try to get them back to me by end-of-day Friday hi all, i humbly submit my little questionnaire and hope that you'll take a moment to fill it out. i've added one question to let people express a view as to whether they would like to focus on Fast Flux, or broaden the scope to include "fraud and abuse". again, let's not belabor the words at this point -- it's just trying to get at a sense of scope. to avoid mailing-list clutter, why don't you send your response files to me directly -- i'll smash them into a single worksheet, do some analysis, and push the whole thing back to the list. i'll finish that over the weekend and put together 3-5 options based on whatever clumps i find in there (plus some Kentucky windage) and try to get those options out to you early next week so you will have some time to look them over before the call next Wednesday. thanks! m voice: 651-647-6109 fax: 866-280-2356 web: www.haven2.com *** Scanned **************************************************************************** ******** SCANNED **************************************************************************** ********

1 0

Fw: Phantom Registrars, Fake Pharmacies, and the Secret Infrastructure
by Danny Younger Aug. 28, 2008

Aug. 28, 2008

Forwarded message. Danny, In our continuing effort to shed light on the dark corners of the Internet we have produced this report on the Directi Group, a fairly large player in the Registrar world. We have highlighted their use of the controversial service PrivacyProtect.org, their continued sponsorship of fake pharmacy domains, and their apparent ability to get Registrar accreditations for 48 Phantom Companies. The full report with documentation, data and links to supporting articles is here: http://www.knujon.com/news.html#directi PDF version: http://www.knujon.com/KnujonReport_directi_fakeRX_privacyprotect082808.pdf ******************************************** 48 Phantom Registrars KnujOn has found at least 48 ICANN-accredited Registrars that do not seem to exist. All of the Registrars in question are affiliated with the Directi Group (Directi, PublicDomainsRegistry, Answerable, LogicBoxes). Our attention was first brought to them when we released our report of the Ten Worst Registrars for illicit domains, spam, and false registrations. At the time, in some records Directi’s address was listed as: “14525 SW Millikan #48732 Beaverton Oregon”. Directi has since denied this and now disclosed its address as being in Mumbai, India. This prompted us to take a closer look at all the Registrars in Internic’s (ICANN) directory affiliated with Directi and presenting themselves as being located in the United States. 8 Directi–affiliated Registrars list their address on the Internic Registrar Directory as: 14525 SW Millikan #48732 Beaverton Oregon. In examining the directory for the other 40 Direct-affiliated Registrars, we find an even more confusing address: 15 West 47th Street New York, NY 10036 Oregon United States +1-650-331-0716 The first line is obviously ambiguous with “Oregon” on the end of a New York address. An additional layer of confusion is added by the fact that “650-331-0716” is a San Mateo, California phone number. So, where are these companies? New York, Oregon, California or Mumbai? There is nothing wrong with having multiple business locations, but this fact is not disclosed on any their websites or at Internic. Next, we set out to verify if any of these companies were real. Because of the confusing addresses we researched the New York, Oregon, California and India business registries. None of the Directi-affiliated companies listed in the Internic Registrar Directory are real licensed companies: Jumbo Name, Inc. Your Domain King, Inc. Fenominal, Inc. Game For Names, Inc. Ever Ready Names, Inc. Find Good Domains, Inc. Go Full House, Inc. Instinct Solutions, Inc. Name Perfections, Inc. Need Servers, Inc. Network Savior, Inc. Power Carrier, Inc. Power Namers, Inc. Super Name World, Inc. Tech Tyrants, Inc. The Registrar Service, Inc. Trade Starter, Inc. Unpower, Inc. Venus Domains, Inc. Yellow Start, Inc. Zone Casting, Inc. Extend Names, Inc. Extremely Wild Key Registrar, Inc. Magic Friday, Inc. Name To Fame, Inc. Net Juggler, Inc. Unified Servers, Inc. Names Bond, Inc. Specific Name, Inc. Genuine Names, Inc. Best Site Names, Inc. Get Real Names, Inc. Global Names Online, Inc. Naming Associate, Inc. The Names Registration, Inc. Cool Ocean, Inc. Names Real, Inc. Big Domain Shop, Inc. Colossal Names, Inc. Click Registrar, Inc. Cotton Water, Inc. Crystal Coal, Inc. Curious Net, Inc. Domain Band, Inc. Domain Mantra, Inc. Platinum Registrar, Inc. There is an expression that a company can “exist only on paper”, but in this case we don’t even have that. ******************************************** The Fake Pharmacies We have collected content and data for the 19,000 plus domains using the PrivacyProtect.org service that have been advertised through spam and narrowed the analysis down to 9,156 domains that are currently active. What has been found is very interesting and helps explain how a rogue Registrar can play a big role in supporting massive fake pharmacy networks. Starting with a list of 1,820 fake pharmacy domains all using PrivacyProtect.org and all registered through Directi/PublicDomainsRegistry we find these sites are all served from 132.206.106.15, an IP at the McGill University (likely a compromised machine, maybe even that of a student). Half of the content for the sites is served from an IP in Austria, the other half from an IP in the UK. (See the full list) We could call McGill today and get this IP closed but it would only be a temporary obstacle for the criminals. In fact, since KnujOn collected this data the sites have already moved to 61.153.209.98, which is Donghai University in China. These networks are very nimble, the content is highly portable and deployed by scripted kits. This is where the Registrar comes in. They have to make the sites resolve at a new location quickly. The IP addresses of the fake pharmacies change, but the Registrar and proxy registration service are constants. The nameservers for these sites are all at Directi/PublicDomainsRegistry and also shielded by PrivacyProtect.org. Their subtle misdirection provides cover. If a consumer complains to Directi/PublicDomainsRegistry about these sites they simply direct them to the ISP host that serves the content. If and when the site content is closed by the ISP host, Directi/PublicDomainsRegistry just helps them set up at a new IP. The true owners are of course shielded by PrivacyProtect.org. It’s a cycle they have adapted to, so the fake online pharmacy business continues with minimal interruptions. (Download full list of Directi/PrivacyProtect Rx domains with most recent IP) ******************************************** Secret Infrastructure The service that shields ownership of the unlicensed pharmacies, PrivacyProtect.org, is itself a phantom with undisclosed ownership. It was revealed in a Washington Post article that the Directi Group actually owns PrivacyProtect.org, a fact they did not deny when they responded to the article. In summary, we have thousands of illicit domains cloaked by a company which is also anonymously owned. The domains are all sponsored by the Directi Group which is affiliated with 48 Registrars that cannot be proven to be real entities. Clearly there are serious problems with oversight, due diligence, and accountability. How can the consumer be protected under these conditions? While Directi claims they will suspend illicit domains, KnujOn has found on many occasions Directi sponsored domains being removed temporarily only to be restored after a brief period with the same content (See "Suspended" Pharmacy Domains Reappear at Same Registrar & Nameserver). The sheer volume of fake pharmacies at Directi is daunting, and given the fact that they can all be traced to one source: PrivacyProtect.org, would it not be time for Directi to reconsider its relationship with PrivacyProtect.org if they are serious about solving the problem? As for ICANN, how is it possible that so many companies can be granted accreditation with unverified credentials? -Garth ------------------------------------- Collect, analyze, enforce, repeat... Garth Bruen gbruen(a)knujon.com http://www.knujon.com Presenting at the NYC OWASP 09.24.08 http://www.owasp.org/index.php/OWASP_NYC_AppSec_2008_Conference

1 0

Suspension of Jeff Williams
by Evan Leibovitch Aug. 28, 2008

Aug. 28, 2008

Based on numerous complaints and a continued insistence on posting personal attacks and irrelevant messages, I have exercised my discretion as Chair to once again suspend postings by Jeff Williams to the NA-Discuss list. As this is his third infraction, the current suspension will last one year and end August 29, 2009. This action is supported by the Secretariat of NARALO as well as many (most?) other participants in the region. While this is an action that I do not take lightly, I have reduced tolerance for efforts which appear designed to provoke and obstruct rather than to inform or engage. - Evan

1 0

Re: [NA-Discuss] Report of the WHOIS Study Hypothesis Group attached
by Brendler, Beau Aug. 28, 2008

Aug. 28, 2008

Since I was a part of this group (contributing to its earlier incarnation, but not to the "hypotheses" phase that began June 25 or so), I'd like to volunteer to help facilitate discussion and comment within ALAC. Some of the GAC hypotheses mirror what I believe are user community concerns/perceptions of WHOIS. I think the ALAC should review the whole document, but at minimum focus on what the GAC has put forward. Even if the ALAC can't agree, the user community's voice needs to be heard on this issue. For additional perspective I have attached the final version (in its entirety, no longer preliminary) of the New York state study we conducted that I presented to the ALAC in Paris, including the questions on WHOIS and other ICANN issues (grouped towards the end). The study is statistically significant for New York state only, but I believe the results should encourage us to look beyond the traditional "privacy vs. law enforcement" deadlock. Please do not distribute any of this data outside these groups, as we are planning to release it to the press as part of an anti-fraud campaign in Sept., Oct. and November. BB -----Original Message----- From: at-large-bounces(a)atlarge-lists.icann.org [mailto:at-large-bounces@atlarge-lists.icann.org] On Behalf Of Nick Ashton-Hart Sent: Wednesday, August 27, 2008 3:02 AM To: whois-wg(a)atlarge-lists.icann.org Cc: at-large(a)atlarge-lists.icann.org Subject: [At-Large] FW: Report of the WHOIS Study Hypothesis Group attached Dear Working Group Members and At-Large Community Members: Attached please find the report of the WHOIS Study Hypothesis Group to the GNSO Council as requested by the Council in its resolution of 26 June 2008. -- Regards, Nick Ashton-Hart Director for At-Large Internet Corporation for Assigned Names and Numbers (ICANN) Main Tel: +33 (450) 40 46 88 USA DD: +1 (310) 578-8637 Fax: +41 (22) 594-85-44 Mobile: +41 (79) 595 54-68 email: nick.ashton-hart(a)icann.org Win IM: ashtonhart(a)hotmail.com / AIM/iSight: nashtonhart(a)mac.com / Skype: nashtonhart Online Bio: https://www.linkedin.com/in/ashtonhart *** Scanned **************************************************************************** ******** SCANNED **************************************************************************** ********

4 10