September 2010 - NA-Discuss

REMINDER: NARALO TELECONFERENCE - Monday, 09 August 2010 @ 19:00 UTC
by ICANN At-Large Staff Nov. 5, 2010

Nov. 5, 2010

Dear All, The next NARALO Teleconference is scheduled for Monday, 09 August 2010 at 1900 UTC. The agenda (to be updated) and call details can be found at: https://st.icann.org/naralo/index.cgi?09_august_2010 If you are unable to attend the call please send an email indicating your absence and we will note this information on the agenda. If you require a dial-out please contact At-Large staff at: staff(a)atlarge.icann.org. -- Regards, Heidi Ullrich, Matthias Langenegger, Seth Greene, Gisella Gruber-White, Marilyn Vernon, Kristina Nordström ICANN At-Large Staff

2 5

Re: [NA-Discuss] Policy Failure Enables Mass Malware: Part II(ICANN and OnlineNIC)
by Garth Bruen at KnujOn Sept. 30, 2010

Sept. 30, 2010

Update to the update: SECURETABS[DOT]NET replaced with SECURETABS[DOT]ORG, still at OnlineNIC! > -------- Original Message -------- > Subject: Re: [NA-Discuss] Policy Failure Enables Mass Malware: Part > II(ICANN and OnlineNIC) > From: <gbruen(a)knujon.com> > Date: Thu, September 30, 2010 8:12 am > To: <na-discuss(a)atlarge-lists.icann.org> > > > SECURETABS[DOT]NET is now finally offline after 74 days, but there are still > three other malware-redirected domains in this scheme: GENERICTAB.COM > (TUCOWS), CHEAPDRUGSNORX.COM (OnlineNIC), BESTGENERICPHARMA.COM (DIRECTNIC). > The domain that controls the rotation of these sites: PHARM-TRACKER.COM is > also sponsored by OnLineNIC. All described in the full report: > http://www.knujon.com/WDPRS_failures_malware_intrusion_securetabsDOTnet_Knu… > > -------------------------------------------------- > From: <gbruen(a)knujon.com> > Sent: Wednesday, September 29, 2010 7:21 PM > To: "Michele Neylon :: Blacknight" <michele(a)blacknight.ie> > Cc: <na-discuss(a)atlarge-lists.icann.org> > Subject: Re: [NA-Discuss] Policy Failure Enables Mass Malware: Part II(ICANN > and OnlineNIC) > > > Michele, > > > > I've made it quite clear. The unlicensed pharmacy domain promoted through > > thousands of hacked websites has false WHOIS which they failed to correct > > within the stipulated time. The sponsoring Registrar failed to investigate > > and suspend the domain within the stipulated time. ICANN failed to address > > the original complaint against the domain with the Registrar and > > completely > > botched the complaint against the Registrar. > > > > Would you still feel the same if it were your site that was hacked on > > behalf > > of a non-compliant sponsored by a non-compliant Registrar? > > > > You'll see in our follow-up next week how a Registrar was actually the > > VICTIM of such a scheme. Some might even say this was an "attack" from a > > competing domain company. > > > > -Garth > > > > -------------------------------------------------- > > From: "Michele Neylon :: Blacknight" <michele(a)blacknight.ie> > > Sent: Wednesday, September 29, 2010 4:43 PM > > To: "Garth Bruen at KnujOn" <gbruen(a)knujon.com> > > Cc: <wendy(a)seltzer.com>; <na-discuss(a)atlarge-lists.icann.org> > > Subject: Re: [NA-Discuss] Policy Failure Enables Mass Malware: Part II > > (ICANN and OnlineNIC) > > > >> And what exactly are those roles? > >> > >> I know I may live to regret asking, but I would love to know. > >> > >> Or is this one of those "let's make it ICANN's problem since registrars > >> are obviously evil"? > >> > >> > >> Mr. Michele Neylon > >> Blacknight > >> http://Blacknight.tel > >> > >> Via iPhone so excuse typos and brevity > >> > >> On 29 Sep 2010, at 22:34, "Garth Bruen at KnujOn" <gbruen(a)knujon.com> > >> wrote: > >> > >>> That's kind of a leap in logic, we're talking about specific icann roles > >>> > >>> > >>>> -------- Original Message -------- > >>>> Subject: Re: [NA-Discuss] Policy Failure Enables Mass Malware: Part II > >>>> (ICANN and OnlineNIC) > >>>> From: Wendy Seltzer <wendy(a)seltzer.com> > >>>> Date: Wed, September 29, 2010 4:26 pm > >>>> To: Garth Bruen at KnujOn <gbruen(a)knujon.com> > >>>> Cc: Evan Leibovitch <evan(a)telly.org>, > >>>> na-discuss(a)atlarge-lists.icann.org > >>>> > >>>> And I suppose you'd support COICA, the US proposal to censor domain > >>>> names "dedicated to infringing activity" too? > >>>> > >>>> I certainly would not want to see ICANN in here. > >>>> <http://wendy.seltzer.org/blog/archives/2010/09/21/copyright-censorship-and-…> > >>>> > >>>> --Wendy > >>>> > >>>> On 09/29/2010 03:34 PM, Garth Bruen at KnujOn wrote: > >>>>> I believe there is an ATRT meeting next month here in Boston, not sure > >>>>> where yet, would be happy to participate. > >>>>> > >>>>> > >>>>> > >>>>>> -------- Original Message -------- > >>>>>> Subject: Re: [NA-Discuss] Policy Failure Enables Mass Malware: Part > >>>>>> II > >>>>>> (ICANN and OnlineNIC) > >>>>>> From: Evan Leibovitch <evan(a)telly.org> > >>>>>> Date: Wed, September 29, 2010 3:22 pm > >>>>>> To: Beau Brendler <beaubrendler(a)earthlink.net> > >>>>>> Cc: Garth Bruen at KnujOn <gbruen(a)knujon.com>, > >>>>>> na-discuss(a)atlarge-lists.icann.org > >>>>>> > >>>>>> > >>>>>> On 29 September 2010 15:11, Beau Brendler > >>>>>> <beaubrendler(a)earthlink.net>wrote: > >>>>>> > >>>>>>> > >>>>>>> "ICANN’s vice president of government affairs for the Americas, > >>>>>>> Jamie > >>>>>>> Hedlund, said the meeting was “outside the scope of our role as the > >>>>>>> technical coordinator of the Internet’s unique identifiers.” > >>>>>>> > >>>>>>> How is enforcing the provisions of the RAA outside the scope of its > >>>>>>> role? > >>>>>>> > >>>>>>> > >>>>>> I smell another ATRT submission.... > >>>>>> > >>>>>> This is worth escalating to the global At-Large lists, IMO. > >>>>>> > >>>>>> - Evan > >>>>> > >>>>> > >>>>> ------ > >>>>> NA-Discuss mailing list > >>>>> NA-Discuss(a)atlarge-lists.icann.org > >>>>> https://atlarge-lists.icann.org/mailman/listinfo/na-discuss > >>>>> > >>>>> Visit the NARALO online at http://www.naralo.org > >>>>> ------ > >>>> > >>>> > >>>> -- > >>>> Wendy Seltzer -- wendy(a)seltzer.org +1 914-374-0613 > >>>> Fellow, Princeton Center for Information Technology Policy > >>>> Fellow, Berkman Center for Internet & Society at Harvard University > >>>> http://cyber.law.harvard.edu/seltzer.html > >>>> http://www.chillingeffects.org/ > >>>> https://www.torproject.org/ > >>>> http://www.freedom-to-tinker.com/ > >>> ------ > >>> NA-Discuss mailing list > >>> NA-Discuss(a)atlarge-lists.icann.org > >>> https://atlarge-lists.icann.org/mailman/listinfo/na-discuss > >>> > >>> Visit the NARALO online at http://www.naralo.org > >>> ------ > >> > > ------ > > NA-Discuss mailing list > > NA-Discuss(a)atlarge-lists.icann.org > > https://atlarge-lists.icann.org/mailman/listinfo/na-discuss > > > > Visit the NARALO online at http://www.naralo.org > > ------ > > > ------ > NA-Discuss mailing list > NA-Discuss(a)atlarge-lists.icann.org > https://atlarge-lists.icann.org/mailman/listinfo/na-discuss > > Visit the NARALO online at http://www.naralo.org > ------

1 0

Re: [NA-Discuss] Policy Failure Enables Mass Malware: Part II (ICANN and OnlineNIC)
by Garth Bruen at KnujOn Sept. 30, 2010

Sept. 30, 2010

That's kind of a leap in logic, we're talking about specific icann roles > -------- Original Message -------- > Subject: Re: [NA-Discuss] Policy Failure Enables Mass Malware: Part II > (ICANN and OnlineNIC) > From: Wendy Seltzer <wendy(a)seltzer.com> > Date: Wed, September 29, 2010 4:26 pm > To: Garth Bruen at KnujOn <gbruen(a)knujon.com> > Cc: Evan Leibovitch <evan(a)telly.org>, > na-discuss(a)atlarge-lists.icann.org > > And I suppose you'd support COICA, the US proposal to censor domain > names "dedicated to infringing activity" too? > > I certainly would not want to see ICANN in here. > <http://wendy.seltzer.org/blog/archives/2010/09/21/copyright-censorship-and-…> > > --Wendy > > On 09/29/2010 03:34 PM, Garth Bruen at KnujOn wrote: > > I believe there is an ATRT meeting next month here in Boston, not sure > > where yet, would be happy to participate. > > > > > > > >> -------- Original Message -------- > >> Subject: Re: [NA-Discuss] Policy Failure Enables Mass Malware: Part II > >> (ICANN and OnlineNIC) > >> From: Evan Leibovitch <evan(a)telly.org> > >> Date: Wed, September 29, 2010 3:22 pm > >> To: Beau Brendler <beaubrendler(a)earthlink.net> > >> Cc: Garth Bruen at KnujOn <gbruen(a)knujon.com>, > >> na-discuss(a)atlarge-lists.icann.org > >> > >> > >> On 29 September 2010 15:11, Beau Brendler <beaubrendler(a)earthlink.net>wrote: > >> > >>> > >>> "ICANN’s vice president of government affairs for the Americas, Jamie > >>> Hedlund, said the meeting was “outside the scope of our role as the > >>> technical coordinator of the Internet’s unique identifiers.” > >>> > >>> How is enforcing the provisions of the RAA outside the scope of its role? > >>> > >>> > >> I smell another ATRT submission.... > >> > >> This is worth escalating to the global At-Large lists, IMO. > >> > >> - Evan > > > > > > ------ > > NA-Discuss mailing list > > NA-Discuss(a)atlarge-lists.icann.org > > https://atlarge-lists.icann.org/mailman/listinfo/na-discuss > > > > Visit the NARALO online at http://www.naralo.org > > ------ > > > -- > Wendy Seltzer -- wendy(a)seltzer.org +1 914-374-0613 > Fellow, Princeton Center for Information Technology Policy > Fellow, Berkman Center for Internet & Society at Harvard University > http://cyber.law.harvard.edu/seltzer.html > http://www.chillingeffects.org/ > https://www.torproject.org/ > http://www.freedom-to-tinker.com/

3 3

Policy Failure Enables Mass Malware: Part II (ICANN and OnlineNIC)
by Garth Bruen at KnujOn Sept. 29, 2010

Sept. 29, 2010

Folks, On Wednesday September 29th at 1PM there will be a meeting in the Old Executive Building in Washington D.C. with Registries and domain Registrars to discuss illegal Internet sales of prescription drugs (http://techdailydose.nationaljournal.com/2010/09/white-house-to-meet-with-i…) ICANN was originally invited but declined citing “inappropriateness” (http://domainincite.com/icann-will-not-attend-white-house-drugs-meeting/) One “U.S.” Registrar who definitely will not be in attendance is OnlineNIC. It has been known for some time that OnlineNIC’s purported Oakland California address is false (http://dotsnews.com/domain-name-news/184) and that they have been caught directly involved in cyber-squatting and counterfeiting schemes that cost them millions in out-of-court settlements (http://www.thedomains.com/2009/03/12/onlinenic-settles-with-microsoft-appea…) However, the core issue relates to an illicit pharmacy domain sponsored by OnlineNIC which has been found in thousands of hacked websites infected with a PHP redirection. KnujOn first found this malicious redirection in July, 2010 and discovered the target domain, SECURETABS[DOT]NET, had a false WHOIS record and we appropriately filed a complaint with ICANN on July 18, 2010. Under the ICANN Registrar Accreditation Agreement the domain owner has 15 days to correct WHOIS inaccuracies and the Registrar has 45 days to investigate the complaint (http://www.icann.org/en/registrars/ra-agreement-21may09-en.htm#3) If the registrant fails to respond their domain must be deleted. The Registrar is required to investigate and if they fail to it could be considered a material breach of their contract with ICANN. In this case both deadlines have passed without correction or deletion. OnlineNIC has yet to respond to multiple inquires about this. The Malicious Intrusions Continue As with our last report on Malware and Policy Failure (http://www.circleid.com/posts/20100922_policy_failure_enables_mass_malware_…) single illegal pharmacy shop sites that somehow evade detection and policy enforcement impact thousands or even millions of innocent websites. It provides motivation and opportunity to keep spreading the malware that drives Internet users to illegal transaction sites without their consent. This particular malicious code has been found at Earlham College, the University of Illinois, the University of Delaware, Lord Fairfax Community College, the University of Alaska, and Toccoa Falls College. While public institutions are frequent targets of these attacks because of their typically large networks, multiple access points, and constantly changing student populations private sites are just as vulnerable. We even found one infection on a local Fox News affiliate in Houston. KnujOn currently estimates the number of websites infected with some kind of illicit pharmacy-related redirect to be in the millions. Policy Enforcement from ICANN While ICANN has continuously stated they have no enforcement powers, this type of domain abuse is actually within their mandate. Because OnlineNIC is itself a rogue Registrar they cannot be counted on to follow policy, it is ICANN’s role to hold the Registrar responsible. In the case of OnlineNIC it should be an easy call considering their history, but ICANN recently renewed OnlineNIC’s contract for another five years even though they have failed to comply with RAA 3.16 (http://www.icann.org/en/registrars/ra-agreement-21may09-en.htm#3) and may be de-accredited under RAA 5.3.2 (http://www.icann.org/en/registrars/ra-agreement-21may09-en.htm#5) because of a judgment against them in a suit filed by Louis Vuitton (http://docs.justia.com/cases/federal/district-courts/california/candce/3:20…) Because OnlineNIC is allowed to exist SECURETABS[DOT]NET exists. Because SECURETABS[DOT]NET exists the Internet is being flooded with silent intrusions and malicious code injections. Rejection of Registrar Complaint by ICANN ICANN has a secondary process for filing complaints against Registrars but in this case it failed. KnujOn followed ICANN’s instructions (http://www.icann.org/en/compliance/faq.html) for filing a complaint against a Registrar. On September 16, 2010 after OnlineNIC failed to comply with the contracted obligations concerning SECURETABS[DOT]NET. Instead of seeing SECURETABS[DOT]NET suspended and OnlineNIC admonished, our complaint was rejected with the claim we had filed the wrong form. It has now been 73 days since our initial complaint about SECURETABS[DOT]NET, and the site is still active and continues to appear in new website intrusions. Until ICANN fully grasps the nature of this threat and their ability to thwart it through their normal duties, the problem will grow. In Part III we reveal a notorious intrusion and malware download traced right to another policy failure at another troubled Registrar. -Garth More information: http://www.circleid.com/posts/20100929_policy_failure_enables_mass_malware_… http://www.knujon.com/blog.html ------------------------------------- Garth Bruen gbruen(a)knujon.com http://www.knujon.com http://www.linkedin.com/pub/4/149/724 Linkedin Group: http://www.linkedin.com/groups?gid=1870205 Blog: http://www.circleid.com/members/3296/ Twitter: @Knujon

3 2

Re: [NA-Discuss] Policy Failure Enables Mass Malware: Part II (ICANN and OnlineNIC)
by Beau Brendler Sept. 29, 2010

Sept. 29, 2010

We're talking about the RAA, and Oakland-based, uh, excuse me, Xiamen-based [http://www.icann.org/en/tlds/pro1/pdf/rop_exhibit_a5.pdf] OnlineNIC. Is someone going to tell me with a straight face that RAA compliance is outside ICANN's scope? Is ICANN now some sort of compact of free association among the 195-odd countries of the world with the GAC as suzerain? And no, I don't support COICA, in much the same way as my opinion on ICANN's role in contractual compliance doesn't mean that I listen to Barry Manilow or won't eat green curry. -----Original Message----- >From: "Michele Neylon :: Blacknight" <michele(a)blacknight.ie> >Sent: Sep 29, 2010 4:43 PM >To: Garth Bruen at KnujOn <gbruen(a)knujon.com> >Cc: "na-discuss(a)atlarge-lists.icann.org" <na-discuss(a)atlarge-lists.icann.org> >Subject: Re: [NA-Discuss] Policy Failure Enables Mass Malware: Part II (ICANN and OnlineNIC) > >And what exactly are those roles? > >I know I may live to regret asking, but I would love to know. > >Or is this one of those "let's make it ICANN's problem since registrars are obviously evil"? > > >Mr. Michele Neylon >Blacknight >http://Blacknight.tel > >Via iPhone so excuse typos and brevity > >On 29 Sep 2010, at 22:34, "Garth Bruen at KnujOn" <gbruen(a)knujon.com> wrote: > >> That's kind of a leap in logic, we're talking about specific icann roles >> >> >>> -------- Original Message -------- >>> Subject: Re: [NA-Discuss] Policy Failure Enables Mass Malware: Part II >>> (ICANN and OnlineNIC) >>> From: Wendy Seltzer <wendy(a)seltzer.com> >>> Date: Wed, September 29, 2010 4:26 pm >>> To: Garth Bruen at KnujOn <gbruen(a)knujon.com> >>> Cc: Evan Leibovitch <evan(a)telly.org>, >>> na-discuss(a)atlarge-lists.icann.org >>> >>> And I suppose you'd support COICA, the US proposal to censor domain >>> names "dedicated to infringing activity" too? >>> >>> I certainly would not want to see ICANN in here. >>> <http://wendy.seltzer.org/blog/archives/2010/09/21/copyright-censorship-and-…> >>> >>> --Wendy >>> >>> On 09/29/2010 03:34 PM, Garth Bruen at KnujOn wrote: >>>> I believe there is an ATRT meeting next month here in Boston, not sure >>>> where yet, would be happy to participate. >>>> >>>> >>>> >>>>> -------- Original Message -------- >>>>> Subject: Re: [NA-Discuss] Policy Failure Enables Mass Malware: Part II >>>>> (ICANN and OnlineNIC) >>>>> From: Evan Leibovitch <evan(a)telly.org> >>>>> Date: Wed, September 29, 2010 3:22 pm >>>>> To: Beau Brendler <beaubrendler(a)earthlink.net> >>>>> Cc: Garth Bruen at KnujOn <gbruen(a)knujon.com>, >>>>> na-discuss(a)atlarge-lists.icann.org >>>>> >>>>> >>>>> On 29 September 2010 15:11, Beau Brendler <beaubrendler(a)earthlink.net>wrote: >>>>> >>>>>> >>>>>> "ICANN’s vice president of government affairs for the Americas, Jamie >>>>>> Hedlund, said the meeting was “outside the scope of our role as the >>>>>> technical coordinator of the Internet’s unique identifiers.” >>>>>> >>>>>> How is enforcing the provisions of the RAA outside the scope of its role? >>>>>> >>>>>> >>>>> I smell another ATRT submission.... >>>>> >>>>> This is worth escalating to the global At-Large lists, IMO. >>>>> >>>>> - Evan >>>> >>>> >>>> ------ >>>> NA-Discuss mailing list >>>> NA-Discuss(a)atlarge-lists.icann.org >>>> https://atlarge-lists.icann.org/mailman/listinfo/na-discuss >>>> >>>> Visit the NARALO online at http://www.naralo.org >>>> ------ >>> >>> >>> -- >>> Wendy Seltzer -- wendy(a)seltzer.org +1 914-374-0613 >>> Fellow, Princeton Center for Information Technology Policy >>> Fellow, Berkman Center for Internet & Society at Harvard University >>> http://cyber.law.harvard.edu/seltzer.html >>> http://www.chillingeffects.org/ >>> https://www.torproject.org/ >>> http://www.freedom-to-tinker.com/ >> ------ >> NA-Discuss mailing list >> NA-Discuss(a)atlarge-lists.icann.org >> https://atlarge-lists.icann.org/mailman/listinfo/na-discuss >> >> Visit the NARALO online at http://www.naralo.org >> ------ > >------ >NA-Discuss mailing list >NA-Discuss(a)atlarge-lists.icann.org >https://atlarge-lists.icann.org/mailman/listinfo/na-discuss > >Visit the NARALO online at http://www.naralo.org >------

1 0

Re: [NA-Discuss] Policy Failure Enables Mass Malware: Part II (ICANN and OnlineNIC)
by Garth Bruen at KnujOn Sept. 29, 2010

Sept. 29, 2010

I believe there is an ATRT meeting next month here in Boston, not sure where yet, would be happy to participate. > -------- Original Message -------- > Subject: Re: [NA-Discuss] Policy Failure Enables Mass Malware: Part II > (ICANN and OnlineNIC) > From: Evan Leibovitch <evan(a)telly.org> > Date: Wed, September 29, 2010 3:22 pm > To: Beau Brendler <beaubrendler(a)earthlink.net> > Cc: Garth Bruen at KnujOn <gbruen(a)knujon.com>, > na-discuss(a)atlarge-lists.icann.org > > > On 29 September 2010 15:11, Beau Brendler <beaubrendler(a)earthlink.net>wrote: > > > > > "ICANN’s vice president of government affairs for the Americas, Jamie > > Hedlund, said the meeting was “outside the scope of our role as the > > technical coordinator of the Internet’s unique identifiers.” > > > > How is enforcing the provisions of the RAA outside the scope of its role? > > > > > I smell another ATRT submission.... > > This is worth escalating to the global At-Large lists, IMO. > > - Evan

2 1

Re: [NA-Discuss] Policy Failure Enables Mass Malware: Part II (ICANN and OnlineNIC)
by Beau Brendler Sept. 29, 2010

Sept. 29, 2010

"ICANN’s vice president of government affairs for the Americas, Jamie Hedlund, said the meeting was “outside the scope of our role as the technical coordinator of the Internet’s unique identifiers.” How is enforcing the provisions of the RAA outside the scope of its role? This is nonsensical, and an embarrassment. Obviously there was some other political conversation that was had high up about -- something -- that we're not being told. Oh, that and the fact ICANN has a dys(non)functional compliance section. -----Original Message----- >From: Garth Bruen at KnujOn <gbruen(a)knujon.com> >Sent: Sep 29, 2010 2:21 PM >To: na-discuss(a)atlarge-lists.icann.org >Subject: [NA-Discuss] Policy Failure Enables Mass Malware: Part II (ICANN and OnlineNIC) > >Folks, > >On Wednesday September 29th at 1PM there will be a meeting in the Old >Executive Building in Washington D.C. with Registries and domain >Registrars to discuss illegal Internet sales of prescription drugs >(http://techdailydose.nationaljournal.com/2010/09/white-house-to-meet-with-i…) >ICANN was originally invited but declined citing “inappropriateness” >(http://domainincite.com/icann-will-not-attend-white-house-drugs-meeting/) >One “U.S.” Registrar who definitely will not be in attendance is >OnlineNIC. It has been known for some time that OnlineNIC’s purported >Oakland California address is false >(http://dotsnews.com/domain-name-news/184) and that they have been >caught directly involved in cyber-squatting and counterfeiting schemes >that cost them millions in out-of-court settlements >(http://www.thedomains.com/2009/03/12/onlinenic-settles-with-microsoft-appea…) >However, the core issue relates to an illicit pharmacy domain sponsored >by OnlineNIC which has been found in thousands of hacked websites >infected with a PHP redirection. KnujOn first found this malicious >redirection in July, 2010 and discovered the target domain, >SECURETABS[DOT]NET, had a false WHOIS record and we appropriately filed >a complaint with ICANN on July 18, 2010. Under the ICANN Registrar >Accreditation Agreement the domain owner has 15 days to correct WHOIS >inaccuracies and the Registrar has 45 days to investigate the complaint >(http://www.icann.org/en/registrars/ra-agreement-21may09-en.htm#3) If >the registrant fails to respond their domain must be deleted. The >Registrar is required to investigate and if they fail to it could be >considered a material breach of their contract with ICANN. In this case >both deadlines have passed without correction or deletion. OnlineNIC has >yet to respond to multiple inquires about this. > > >The Malicious Intrusions Continue > >As with our last report on Malware and Policy Failure >(http://www.circleid.com/posts/20100922_policy_failure_enables_mass_malware_…) >single illegal pharmacy shop sites that somehow evade detection and >policy enforcement impact thousands or even millions of innocent >websites. It provides motivation and opportunity to keep spreading the >malware that drives Internet users to illegal transaction sites without >their consent. This particular malicious code has been found at Earlham >College, the University of Illinois, the University of Delaware, Lord >Fairfax Community College, the University of Alaska, and Toccoa Falls >College. While public institutions are frequent targets of these attacks >because of their typically large networks, multiple access points, and >constantly changing student populations private sites are just as >vulnerable. We even found one infection on a local Fox News affiliate in >Houston. KnujOn currently estimates the number of websites infected with >some kind of illicit pharmacy-related redirect to be in the millions. > > >Policy Enforcement from ICANN > >While ICANN has continuously stated they have no enforcement powers, >this type of domain abuse is actually within their mandate. Because >OnlineNIC is itself a rogue Registrar they cannot be counted on to >follow policy, it is ICANN’s role to hold the Registrar responsible. >In the case of OnlineNIC it should be an easy call considering their >history, but ICANN recently renewed OnlineNIC’s contract for another >five years even though they have failed to comply with RAA 3.16 >(http://www.icann.org/en/registrars/ra-agreement-21may09-en.htm#3) and >may be de-accredited under RAA 5.3.2 >(http://www.icann.org/en/registrars/ra-agreement-21may09-en.htm#5) >because of a judgment against them in a suit filed by Louis Vuitton >(http://docs.justia.com/cases/federal/district-courts/california/candce/3:20…) >Because OnlineNIC is allowed to exist SECURETABS[DOT]NET exists. Because >SECURETABS[DOT]NET exists the Internet is being flooded with silent >intrusions and malicious code injections. > > >Rejection of Registrar Complaint by ICANN > >ICANN has a secondary process for filing complaints against Registrars >but in this case it failed. KnujOn followed ICANN’s instructions >(http://www.icann.org/en/compliance/faq.html) for filing a complaint >against a Registrar. On September 16, 2010 after OnlineNIC failed to >comply with the contracted obligations concerning SECURETABS[DOT]NET. >Instead of seeing SECURETABS[DOT]NET suspended and OnlineNIC admonished, >our complaint was rejected with the claim we had filed the wrong form. >It has now been 73 days since our initial complaint about >SECURETABS[DOT]NET, and the site is still active and continues to appear >in new website intrusions. > >Until ICANN fully grasps the nature of this threat and their ability to >thwart it through their normal duties, the problem will grow. In Part >III we reveal a notorious intrusion and malware download traced right to >another policy failure at another troubled Registrar. > >-Garth > > >More information: >http://www.circleid.com/posts/20100929_policy_failure_enables_mass_malware_… >http://www.knujon.com/blog.html > > >------------------------------------- >Garth Bruen >gbruen(a)knujon.com >http://www.knujon.com >http://www.linkedin.com/pub/4/149/724 >Linkedin Group: http://www.linkedin.com/groups?gid=1870205 >Blog: http://www.circleid.com/members/3296/ >Twitter: @Knujon > > > >------ >NA-Discuss mailing list >NA-Discuss(a)atlarge-lists.icann.org >https://atlarge-lists.icann.org/mailman/listinfo/na-discuss > >Visit the NARALO online at http://www.naralo.org >------

2 1

"Rough Consensus"
by Evan Leibovitch Sept. 27, 2010

Sept. 27, 2010

Hi Gordon, Thanks for your comments on the Draft proposal for revising the NARALO Operating Principles<https://st.icann.org/alac-docs/index.cgi?na_2007_1_1rev1_draft_naralo_opera…>. I'd like to address the issue you raised, The one thing I find worrisome, though, is this use of "rough consensus". > Since I cannot think of a better process right now, I will simply ask if > there is a precedent for this in ICANN and, if so, how was it defined. > > As far as I can tell, "rough consensus" has been used in quite a few of the ICANN working groups in which I've participated. First used by the IEFT, "rough consensus" has been a term used to reflect when the collective opinion of a group is overwhelmingly -- but not unanimously -- in favour or opposed to a particular point. While "full consensus" -- unanimity -- is desired, it isn't always possible. In these cases, "Rough consensus" is used to reflect the decision-making sense of the group even though some minimal opposition may exist. Rough consensus has been the decision-making standard in NARALO since its inception, though in the vast majority of situations we have achieved unanimity after ensuring that the points of view of all participants have been taken into account. Using this process in our meetings -- as opposed to having formal votes -- has saved us substantial amounts of time in our decision-making process. This in turn has allowed us to react quickly at times when speed has been a factor in being properly heard. Still, we also have formal procedures in place -- some of which are part of the proposed changes -- to have formal votes on important issues such as elections. Although we have not yet had serious (and un-reconcilable) divergence of opinion on any specific issue or motion, we must be ready with a formal voting process should this happen. As always, the preference is for full consensus. Rough consensus (which I personally would consider to be less than 10% opposition) is usable but far less desirable than unanimity. If there is greater divergence than that on an issue and if such divergence is impossible to reconcile, a formal vote would be called for. That's at least my interpretation as Chair. I hope this addresses your concerns. This process is indeed used elsewhere within ICANN; a Google search for "ICANN 'rough consensus' " produces more than 7,000 hits. Please don't hesitate to let me know if you still consider our use of this technique "worrisome". I hope you will vote to support the new bylaw changes. - Evan

4 3

At-Large wiki migration to Confluence - update
by ICANN At-Large Staff Sept. 25, 2010

Sept. 25, 2010

Dear All, The migration of the At-Large wiki pages from Social Text to Confluence is nearly complete. Staff have been working closely with the ALAC Chair, Cheryl Langdon-Orr, over the last several weeks to ensure that the migration meets all of the requested elements in terms of content and format. To allow IT to staff to fully migrate all At-Large pages as well as to give all members of the At-Large community the opportunity to participate in two At-Large Confluence training sessions scheduled for Wednesday, 29 September and Thursday, 30 September, the official go-live date of the At-Large Confluence wiki will now be Friday, 1 October. During the next week, we encourage you to browse the At-Large Confluence site. To access this page, log in to your Confluence account by going to: http://community.icann.org <http://community.icann.org/> and clicking on the Log In link on the right hand side of the page. If you need a log-in, please send your request to Naveed Tahir-Kheli (naveed(a)icann.org) Once you have logged-in, the At-Large Community tab is located on the upper left hand side of the page. We look forward to your comments! Please feel free to write to At-Large staff at staff(a)atlarge.icann.org if you have any questions regarding the migration of the At-Large wiki pages to Confluence. Regards, Heidi Ullrich, Matthias Langenegger, Seth Greene, Gisella Gruber-White, Marilyn Vernon, Kristina Nordström ICANN At-Large Staff

1 0

NOW OPEN: NARALO Vote on Revised Operating Principles
by ICANN At-Large Staff Sept. 24, 2010

Sept. 24, 2010

Dear All, The NARALO Vote on the Revised Operating Principles has recently started and will remain open until Friday, 1 October at 2359 UTC. A separate email with their voting credentials has been sent to the representatives of the ALSes and the Unaffiliated Users (see list attached below). The question to be put will be the following: Should the NARALO Operating Principles be amended according to the first draft revision ? With possible options: Yes No Abstain You can review the draft revision 1 of the NARALO Operating Principles under: https://st.icann.org/alac-docs/index.cgi?na_2007_1_1rev1_draft_naralo_opera… Modifications to the current version are either highlighted using bold text (additional text) or strikethrough (deleted text). Please note that according to clause 15 of the current Operating Principles, the document will need the endorsement of 70% of the active ALSes to take effect. -- Regards, Heidi Ullrich, Matthias Langenegger, Seth Greene, Gisella Gruber-White, Marilyn Vernon, Kristina Nordström ICANN At-Large Staff email: staff[at]atlarge.icann.org website: www.atlarge.icann.org ******* Unaffiliated User Representative: Beau Brendler ALS Representatives: 22 (1 ALS currently without representation) America@Large Randy Glass Association for Community Networking (AFCN) Michael Maranda Canadian Association for Open Sorce (CLUE) Evan Leibovitch Coalition Against Unsolicited Commercial E-mail (CAUCE North America) John Levine Communautique Monique Chartrand Foundation for Building Sustainable Communities (FBSC) Glenn McKnight Greater Toronto Area Linux User Group (GTALug) Myles Braithwaite ISOC Colorado Chris Grundemann ISOC New York David Solomonoff ISOC Puerto Rico Eduardo Diaz ISOC Quebec Louis Houle Knujon Garth Bruen N-CAP Darlene Thompson Pacific Community Networks Association Alan Skuce People Who Sylvia Caras Privatera Robert Guerra San Franciso Bay ISOC Annalisa Roger Telecommunities Canada Gareth Shearman The Alberta Community Network Association Stephen Soucy The Intellectual Property & Technology Section of the Hawaii State Bar Association Seth Reiss Web405 Dennis Wilen Youth Helping Youth Inc dba: Emerging Futures Network Ted Ernst

1 0

Policy Failure Enables Mass Malware: Part I (Rx-Partners/VIPMEDS)
by Garth Bruen at KnujOn Sept. 23, 2010

Sept. 23, 2010

Folks, This is the first in a series of releases that tie extensive code injection campaigns directly to policy failures within the Internet architecture. In this report we detail a PHP injection (http://en.wikipedia.org/wiki/Code_injection) found on dozens of university and non-profit websites which redirected visitor's browsers to illicit pharmacies controlled by the VIPMEDS/Rx-Partners affiliate network(http://www.cyveillanceblog.com/general-cyberintel/online-pharmacy-n…. This is not a unique problem, however the pharmacy shop sites in question: HEALTHCUBE[DOT]US and GETPILLS[DOT]US should not even exist under the .US Nexus Policy(http://www.nic.us/faqs/index.html#who_can_register). The owners of the two malware-redirected domains are in Russia and policy reserves dotUS for U.S. persons and entities. I wish we could say this is the only policy failure allowing the malicious pharmacy network to endure, but it is one of many. Multiple forged WHOIS records, a Registrar blocking access to WHOIS records, rejected emails to abuse contacts, and Registrars without any apparent policy help create an environment for hackers, spammers, and drug-dealers to act with impunity.)All of this is detailed in our report: http://www.knujon.com/malware_policyfailure_knujon092310.pdf. PHP, SQL or simply code injections are intrusions at the database, server or website level that place a simple redirect command in the existing code that redirects the user's browser to another website, in this case our illicit .US Rx shops. This malicious code was found on the websites of several schools within the Arizona State University system, Rochester Institute of Technology, Universidade de Santiago de Compostela, Northern Marianas College, The University of Utah, Universita Mediterranea di Reggio Calabria, The International Association of Judges, earthportal.org and many other educational or non-profit entities. KnujOn notified all impacted parties prior to publishing this report and we continue to search for new infections. Malware and intrusions are not new news, but rarely reported is the true purpose of such attacks. Viruses and hacks no longer exist for their own benefit, but are part of sophisticated criminal toolkit, which drive Internet users to sites that deal in contraband. And these sites, for the most part, would not exist if effective policy and procedure were implemented. This all comes out as ICANN's CEO Rod Beckstrom declares that the domain name system is under threat (http://arstechnica.com/web/news/2010/09/icann-boss-international-domain-sys…) , USA Today reports on the booming counterfeit drugs industry (http://www.usatoday.com/money/industries/health/2010-09-12-asia-counterfeit…) Panda Security reports tens of thousands of new malicious websites appear each week (http://press.pandasecurity.com/news/every-week-hackers-are-creating-57000-n…) and of course the White House call for ICANN, Registries and Registrars to help develop online drug control policy (http://krebsonsecurity.com/2010/08/white-house-calls-meeting-on-rogue-onlin…) The VIPMEDS/Rx-Partners network has many other sites examined in this report, among those is toppharmacy[dot]org. While the Pubic Interest Registry(PIR) no longer has a non-profit requirement, this illicit pharmacy domain is not an organization (at least not a legal one). Toppharmacy[dot]org is sponsored by UKRNAMES and when we first queried their Port 43 engine we received the response: No match for domain "toppharmacy.org." This is very odd and could be a violation of RAA 3.3.1 (http://www.icann.org/en/registrars/ra-agreement-21may09-en.htm#3) After filing a complaint with ICANN, UKRNAMES WHOIS began giving out the proper information. Two other domains in this affiliate network are: ameritrustpharmacy[DOT]net and indiangenericspharmacy[DOT]com hosted by Sharktech. When we tried to contact Sharktech abuse our email was rejected. Then there the 11 pharmacy domains in this network with blatant false WHOIS. What ties all these domains and the malware together is the actual transaction domain: ebillsafe[dot]com, which as of this writing is thankfully offline. The transaction domain is where thousands, maybe even more, illicit pharmacy shop sites transfer customers once their shopping cart is full, it is where the money actually changes hands for drugs. One of the shop domains that points there is a Moniker-sponsored domain called cheapestpharma[DOT]net which uses Moniker's privacy protection. We made several unsuccessful attempts to get a copy of Monker's policy concerning illicit pharmacies from their senior staff and to get the site terminated. No policy is bad policy. But there is good news. The main VIPMEDS shop site and transaction domains are offline, suspended by their hosts for policy violations. Some Registrars we contacted addressed the threat directly and terminated domains within the network. And nearly all of the infected networks have removed the malicious code. This means if someone is still unlucky enough to end up at one of the existing shop sites their transaction will fail (http://www.knujon.com/images/pharmacrash.png) This is critical to understanding the problem, without domains to move cash through, the array of illicit sites and malware deployments are meaningless. In Part 2 we will examine in detail a case that relates directly to ICANN compliance procedures. More Info: http://www.circleid.com/posts/20100922_policy_failure_enables_mass_malware_… http://www.knujon.com/blog.html#09232010 ------------------------------------- What is the Doomsday Book? http://knujon.com/doomsday Garth Bruen gbruen(a)knujon.com http://www.knujon.com http://www.linkedin.com/pub/4/149/724 Linkedin Group: http://www.linkedin.com/groups?gid=1870205 Blog: http://www.circleid.com/members/3296/ Twitter: @Knujon

1 0

NARALO ALS Representative List
by ICANN At-Large Staff Sept. 21, 2010

Sept. 21, 2010

Dear All, In view of the upcoming vote on the Draft Modifications of the NARALO Operating Principles, we would like to confirm the ALS representatives participating in the online elections and their email contacts where the voting credentials will be sent to. Attached below you find to list with all regional representatives and the corresponding contacts according to our current information. You can review the Draft Modifications of the Operating Principles under: https://st.icann.org/alac-docs/index.cgi?na_2007_1_1rev1_draft_naralo_opera… This email is sent to the NARALO mailing list and blind copied to all ALS representatives. Please respond to us by Thursday, September 23rd COB if the information for your ALS need to be changed. You ONLY need to reply to this message if the information is INCORRECT. Please do not reply to to entire list, you can simply send a message to staff(a)atlarge.icann.org . We will send out an updated list and detailed instruction about the election process before the start of the elections. Please note that Consumer Reports WebWatch is not on the list below as it does not currently have a representative. -- Regards, Heidi Ullrich, Matthias Langenegger, Seth Greene, Gisella Gruber-White, Marilyn Vernon, Kristina Nordström ICANN At-Large Staff email: staff[at]atlarge.icann.org website: www.atlarge.icann.org ******* ALS Representatives: 22 (1 ALS currently without representation) America@Large Randy Glass jipshida2(a)yahoo.com Association for Community Networking (AFCN) Michael Maranda mmaranda(a)afcn.org Canadian Association for Open Sorce (CLUE) Evan Leibovitch evan(a)telly.org Coalition Against Unsolicited Commercial E-mail (CAUCE North America) John Levine johnl(a)iecc.com Communautique Monique Chartrand direction(a)communautique.qc.ca Foundation for Building Sustainable Communities (FBSC) Glenn McKnight mcknight.glenn(a)gmail.com Greater Toronto Area Linux User Group (GTALug) Myles Braithwaite myles(a)monkeyinyoursoul.com ISOC Colorado Chris Grundemann cgrundemann(a)coisoc.org, ISOC New York David Solomonoff president(a)isoc-ny.org ISOC Puerto Rico Eduardo Diaz ediaz(a)prtc.net ISOC Quebec Louis Houle louis.houle(a)oricom.ca Knujon Garth Bruen gbruen(a)knujon.com N-CAP Darlene Thompson dthompson(a)gov.nu.ca Pacific Community Networks Association Alan Skuce allan(a)avpbc.com People Who Sylvia Caras sylvia(a)peoplewho.org Privatera Robert Guerra lists(a)privaterra.info San Franciso Bay ISOC Annalisa Roger annalisa(a)sfbayisoc.org, Telecommunities Canada Gareth Shearman shearman(a)victoria.tc.ca The Alberta Community Network Association Stephen Soucy stephen(a)albertacna.ca The Intellectual Property & Technology Section of the Hawaii State Bar Association Seth Reiss seth.reiss(a)lex-ip.com Web405 Dennis Wilen dwilen(a)yahoo.com Youth Helping Youth Inc dba: Emerging Futures Network Ted Ernst ted(a)emergingfutures.net

1 0

FOR REVIEW: Proposed Modifications of NARALO Operating Principles
by ICANN At-Large Staff Sept. 20, 2010

Sept. 20, 2010

Dear All, Based on input from the last conference call, the proposed modifications to the NARALO Operating Principles are now available under: https://st.icann.org/alac-docs/index.cgi?na_2007_1_1rev1_draft_naralo_opera… Modifications to the current version are either highlighted using bold text (additional text) or strikethrough (deleted text). Please click on the “edit” button to add your comments and suggested changes. As agreed during the NARALO call on 13 September, the draft modifications will be open for comments before they will be put to a formal online vote. The deadline for comments is Thursday, 23 September COB. If necessary, a revision of the document will be published before the start of the vote incorporating comments received on the draft modifications. A 7-day online vote on the document will start on Friday, 24 September. The document will need the endorsement of 70% of the ALS representatives to take effect. -- Regards, Heidi Ullrich, Matthias Langenegger, Seth Greene, Gisella Gruber-White, Marilyn Vernon, Kristina Nordström ICANN At-Large Staff email: staff[at]atlarge.icann.org website: www.atlarge.icann.org

1 0

Fwd: Comment on: ccNSO Working Group Paper on Delegation, Redelegation and Retirement of ccTLDs
by Eduardo Diaz Sept. 13, 2010

Sept. 13, 2010

We have submitted the following comment to the ccNSO DRDWG. -ed ---------- Forwarded message ---------- From: Eduardo Diaz <eduardodiazrivera(a)gmail.com> Date: Mon, Sep 13, 2010 at 5:53 PM Subject: Comment on: ccNSO Working Group Paper on Delegation, Redelegation and Retirement of ccTLDs To: drd-analysis-report(a)icann.org To whom it may concern: This is my feedback regarding the work done by the DRDWG and published for comments. Q1: Is the methodology developed and employed adequate for the purposes of the DRDWG? Feedback1: It seems to be adequate but convoluted. Q2: Do the policy statements identified provide an adequate baseline to evaluate the actual practices of IANA and the ICANN Board relative to delegation, re-delegation and retirement of ccTLDs? Feedback2: Yes, however if IANA is directed by its own set of by-laws similar to what ICANN has, they should have been included as part of the the analysis. Q3: Are there other policy statements which are applicable to the work of the DRDWG? Should they be included in the baseline? Feedback3: Same as comment in Q2. Q4: Does the documentation identified provide an adequate representation of the actual practices of IANA and the ICANN Board relative to delegation, redelegation and retirement of ccTLDs? Q5:Should other cases be included for analyses? Q6: Is there other documentation which is applicable to the work of the DRDWG which should be analyzed? Feedback4/5/6: I would like to bring to the DRDWG attention the case of the ccTLD .pr. This ccTLD was redelegated by IANA in 2007 from University of Puerto Rico (who was the Sponsoring Organization at that time) to Gauss Research Laboratory, Inc (a new for-profit Sponsoring Organization) without the consent of the University of Puerto Rico. In this case, IANA made the redelegation without informing ICANN Board for they said (IANA) that it was made to and quote: “...reflect a structural reorganization...”. The DRDWG should analyze: Was the action taken based on current policy?, Is a full-redelegation vs. an administrative one clearly defined?, Should there be policies in place to prevent making decisions based on a possible policy interpretation and/or when appropriate due diligence is not performed? More recently, we received the following words from Kim Davies clarifying some aspects of the 2007 .pr redelegation: “With respect to the administrative change of the Sponsoring Organisation of .PR in 2007, such change met the criteria for such a change at that time. As it is a requirement that the Sponsoring Organisation does not object to such a change, ICANN was satisfied that the University of Puerto Rico did not disapprove of that change at that time. Other than that, it is ICANN's practice to keep working dialogue between the parties in executing root zone changes in confidence. You should contact the University or Gauss if you wish them to disclose documentation concerning that request. Kim Davies Internet Assigned Numbers Authority Mon, Apr 12, 2010 at 6:34 PM” I have included the letter from the University of Puerto Rico stating that they did not authorized the redelegation and an email communication from David Conrad explaining why IANA allowed the re-delegation without any announcement or ICAN's board approval. Q7:Was the methodology properly applied to the cases? Feedback7: Yes, however in a couple of instances, for example 2.4.4 where it says in the last sentence : “This is of interest to the DRDWG. ” there should be a definition or clarification as to what this statement means. Overall I believe that the DRDWG has done an excellent and important job here. Eduardo Diaz ISOC-PR -- NOTICE: The information contained in this e-mail message is intended only for the personal and confidential use of the recipient(s) named above. If you have received this communication by error, please notify us immediately by e-mail, and delete the original message. -- NOTICE: The information contained in this e-mail message is intended only for the personal and confidential use of the recipient(s) named above. If you have received this communication by error, please notify us immediately by e-mail, and delete the original message.

1 0

Mentioned during the 13 September NARALO Teleconference ... VI PDP WG
by Eric Brunner-Williams Sept. 13, 2010

Sept. 13, 2010

Dear All, At the close of today's call Evan mentioned the Vertical Integration Working Group and his impression of it, which I expect are shared by several others. As I see it there is one fundamental issue: will the registrar function remain mostly indifferent to registry ownership or will the registry function partition into several disjoint patterns? The general proposal promoted by registrars wanting to acquire registry margins, and also by registries wanting to acquire registrar margins, is to have both registrar function and registry function held by the same investors. With each of {GoDaddy, eNom, TuCows, NSI, ...} and each of {VGRS, Afilias, NeuStar, CORE-RSP, ...} holding portfolios of new gTLD properties, and affiliated registrars, respectively, this will lead to a market in which each actor promotes their portfolio interests. The resulting market, independent of the value of the commercial propositions of the dominant registrars and the incumbent registry operators, will be "Balkanized". A variant of this proposal is also promoted by registrars wanting to acquire registry margins, and also by registries wanting to acquire registrar margins, is the "Not in your own TLD" modification, which is described by some (me included) as lipstick on a pig. Under NiyoT, any pair of {GoDaddy, eNom, TuCows, NSI, ...} and/or {VGRS, Afilias, NeuStar, CORE-RSP, ...} may cross sell the portfolio interests of their partner, or more generally, the corporations within their trust or combine. Again, resulting market, independent of the value of the commercial propositions of the dominant registrars and the incumbent registry operators, will be "Balkanized", into larger commercial clumps than in the original cross-ownership proposal. These are adverse outcomes for consumer choice, however, the effect does not stop at the certainty of price gouging and limited choices. The real harm is not the immediate "consumer harm", but the failure of the competitive portion of a formerly monopoly market, now an oligopoly, to transform the monopoly market to a competitive market. Thank you all for your time reading this. I don't expect to change anyone's mind, only to explain why I don't think the most important issue is some claim of merit advanced either by a registrar looking to own one or more registries, or by a registry looking to own one or more registrars, and why I think the Board made the correct choice at Nairobi and lowered the allowed cross-ownership from 15% generally in the 2001 and later registry contracts to a strict separation of 0% cross-ownership. Eric

1 0

Summary Minutes 13 September NARALO Teleconference
by ICANN At-Large Staff Sept. 13, 2010

Sept. 13, 2010

Dear All, The summary minutes and action items from today’s NARALO teleconference have been posted under: https://st.icann.org/naralo/index.cgi?13_september_2010 The summary minutes are also attached below. -- Regards, Heidi Ullrich, Matthias Langenegger, Seth Greene, Gisella Gruber-White, Marilyn Vernon, Kristina Nordström ICANN At-Large Staff email: staff[at]atlarge.icann.org website: www.atlarge.icann.org Summary Minutes 13 September 2010 Participants: Evan Leibovitch, Seth Reiss, Alan Greenberg, Allan Skuce, Chris Grundemann, Gareth Shearman, Monique Chartrand, Joly MacFie, Eduard Diaz, Seth Reiss, Annalisa Roger, Glenn McKnight Apologies: Darlene Thompson Staff: Matthias Langenegger, Heidi Ullrich Discussion of draft ROP modification A discussion was held on the draft ROP modifications: https://st.icann.org/naralo/index.cgi?na_2007_1_1rev1_draft_naralo_operatin… Rule 17: The modified rule 17 would require all unaffiliated members to state that they are not employed by or have direct financial interest in an ICANN contractual partner registry or registrar. It was decided that only the representatives of the individual members are required to be free of financial ties to registries and registrars. AI: Alan and Evan will work offline to redraft the modification of the ROP rule 17 to ensure that only the representatives of the individual members are required not to be employed by or have direct financial interest in an ICANN contractual partner registry or registrar. It was decided that the draft modified ROP will be submitted to the ALSes for adoption. There will be an online BigPulse vote. The modified ROP will need to be endorsed by 70% active ALSes to take effect. Rules 2,3, 4, 5, 6,7,8,9 were accepted as is. Rule 10 Alan: the current draft modification would allow an ALAC member to serve almos 6 years Chris: I agree with the intent but I think the rule needs to be rephrased It was agreed to modify the first sentence of rule 10 to: "These members will serve for terms of two (2) years at most and may not serve more than two consecutive terms totalling more than 40 months." Rules 11, 12,13,14,15 were accepted as is. Rule 16: It was agreed that the first sentence will be changed to:"When an ALS representative does not vote in 3 consecutive NARALO elections or does not contribute a comment on ICANN policy through collaboration on the NARALO discussion list the At-Large discussion lists in 12 consecutive months, it automatically loses its voting rights and active status within the NARALO." It was suggested that the second sentence of rule 16 shall be changed to something along the line of the following proposed sentence: "The ALS should be notified of the status change and may regain its voting rights and active status if within the next 12 month it votes or participates to online discussions, otherwise the Chair will submit to ALAC a request for de-certification of that ALS." Rule 17 was already discussed and rule 18 was unchanged. Alan: I suggest that we redefine quorum. We define it as 50% of members whereas most ALSes have set it at 30%. Evan: Rule 16 intents to factor in the notion of active ALSes. The qurorum rule states that the ALS must be active. AI: Darlene, Evan and Staff will re-draft the ROP within the next week and publish it on the list for a couple of days before putting it to a vote. The call was then adjourned.

1 0

NARALO Teleconference 13 September at 1900 UTC
by ICANN At-Large Staff Sept. 10, 2010

Sept. 10, 2010

Dear All, This is to remind of the NARALO call scheduled on Monday, 13 September at 1900 UTC. You can find the draft agenda for this call under: https://st.icann.org/naralo/index.cgi?13_september_2010 On Evan’s behalf of, we would like to draw your attention to the following two agenda items in particular: 1. At-Large Board Director Selection Process Should the votes of the NARALO representatives in the At-Large Board Director election be "guided" by NARALO? The application for the At-Large selected Board Director position ended on 6 September and the Board Candidate Evaluation Committee (BCEC) is currently reviewin the received candidatures. The final slate of candidates will be published in October. The electorate will be comprised of the 15 ALAC members and the 5 RALO Chairs. The RALOs have the option to poll their members and give voting instructions to their regional representatives for the election. 2. Draft Modifications of NARALO Rules of Procedure (see https://st.icann.org/naralo/index.cgi?na_2007_1_1rev1_draft_naralo_operatin…) Background Information: During the NARALO call on 12 July two amendments to the NARALO RoP were discussed: * unaffiliated NARALO members need to register by submitting a Statement of Interest. * the voting weight of all unaffiliated NARALO members combined will be equal to that of one ALS representative. During the NARALO call on 09 August, two additional points were raised: * incorporate the position of unaffiliated NARALO member representative in the RoP. The representative will have one vote at the NARALO GA and online votes. * the rules pertaining to the decision-making processes need to sufficiently flexible and should not be tied to one particular process such as online voting In addition to the modifications outlined above, the draft modified RoP also includes the following suggested changes: * reduce the number of ALS and unaffiliated member representatives participating to the GA and online votes from 2 to 1 to be consistent with past practice. * make ALAC members eligible to serve for two FULL two-year terms. * allow the NARALO Chair and the Secretariat to register as an unaffiliated member. During the meeting on Monday, the participants to the call will be asked to reach consensus on the final wording. For the modifications to take effect, they need to be endorsed by no less than 70% of the active ALSes. It is suggested that online vote be held to poll the NARALO members on the modified RoP. -- Regards, Heidi Ullrich, Matthias Langenegger, Seth Greene, Gisella Gruber-White, Marilyn Vernon, Kristina Nordström ICANN At-Large Staff email: staff[at]atlarge.icann.org website: www.atlarge.icann.org

1 0

Announcement of At-Large Director Applicants
by ICANN At-Large Staff Sept. 9, 2010

Sept. 9, 2010

Dear All, A total of 43 Statements of Interest were received by the Board Candidate Evaluation Committee for the position of At-Large Board Director. Out of these 43 applications, 21 were deemed to be too incomplete to proceed further. The remaining 22 Statements of the Interest will be considered based on the established criteria. The names of the 22 applicants and the BCEC selected slate of 5-7 candidates will be released in October. Statistics of the 22 completed Statements of Interest show a globally diverse pool with a wide array of professional backgrounds. From the 22 completed Statements of Interest, 16 applicants are not currently active in the At-Large community while 6 are currently active. Male applicants (18) make up the vast majority of applicants with only 4 female applicants. Details of the statistics are available below: Geographical diversity: AF AP EU LAC NA Country of citizenship* 3 (14%) 4 (18%) 7 (32%) 1 (4%) 7 (32%) Country of residence* 4 (17%) 4 (17%) 7 (29%) 1 (4%) 8 (33%) * Total numbers are GREATER than 22 given dual citizenship or multiple locations of residence of some applicants Gender : M F 18 (82%) 4 (18%) Current position: For Profit Non-Profit Consultancy Academia Government Agency Other 5 (23%) 2 (9%) 7 (32%) 3 (14%) 1 (4%) 4 (18%) Currently active member of At-Large community Y N 6 (27%) 16 (73%) You also find this announcement attached as a PDF file for your convenience. -- Regards, Heidi Ullrich, Matthias Langenegger, Seth Greene, Gisella Gruber-White, Marilyn Vernon, Kristina Nordström ICANN At-Large Staff email: staff[at]atlarge.icann.org website: www.atlarge.icann.org

1 0

REMINDER: NARALO TELECONFERENCE - Monday, 13 September 2010 @ 19:00 UTC
by ICANN At-Large Staff Sept. 8, 2010

Sept. 8, 2010

Dear All, The next NARALO Teleconference is scheduled for Monday, 13 September 2010 at 1900 UTC. The agenda (to be updated) and call details can be found at: https://st.icann.org/naralo/index.cgi?13_september_2010 If you are unable to attend the call please send an email indicating your absence and we will note this information on the agenda. If you require a dial-out please contact At-Large staff at: staff(a)atlarge.icann.org. -- Regards, Heidi Ullrich, Matthias Langenegger, Seth Greene, Gisella Gruber-White, Marilyn Vernon, Kristina Nordström ICANN At-Large Staff

1 0

Schedule of At-Large wiki migration to Confluence
by Heidi Ullrich Sept. 4, 2010

Sept. 4, 2010

Dear All, As requested by the Chair of ALAC, we are moving ahead with the At-Large wiki migration from Social Text to Confluence. At-Large will be the first of the AC/SOs to migrate. We have been working closely with IT staff on the steps for the At-Large migration to Confluence. In order to ensure a smooth transition with the least amount of disruption of access to At-Large wiki pages, IT staff will be taking a 'snapshot' of the At-Large Social Text wiki this Monday, 6 September between 0:00-02:00 UTC. During this 2-hour window, there will be no public access to the At-Large Social Text wiki pages. However, following this brief period, the At-Large Social Text wiki pages will be able to be used until the At-Large Confluence wiki pages go live on Friday, 24 September. Between 7-12 September, migration of the At-Large Social text wikis (based on the 6 September snapshot) to Confluence workspaces will occur. Between 13-24 September, the At-Large workspaces and links will be placed in an order similar to the current At-Large Social Text wiki spaces. Currently, it is planned that the At-Large Confluence wiki pages will be able to go live, as noted above, on 24 September. During the week of the 27th of September there will be two 2-hour At-Large community Confluence training calls. There will be a Beginner's level call and an Intermediate level call. There will also be an opportunity for At-Large representatives to review the At-Large Confluence site with IT staff during a 2-hour session during the 39th ICANN Meeting in Cartagena de Indias. Please feel free to write to At-Large staff at staff(a)atlarge.icann.org<mailto:staff@atlarge.icann.org> if you have any questions regarding the migration of the At-Large wiki pages to Confluence. Regards, Heidi Ullrich, Matthias Langenegger, Seth Greene, Gisella Gruber-White, Marilyn Vernon, Kristina Nordström ICANN At-Large Staff Email: staff[at]atlarge.icann.org Website: www.atlarge.icann.org<http://www.atlarge.icann.org>

1 0