- ODP-SSAD - lists.icann.org

WDS/RDRS Naming Clarification
by Hong-Fu(Tom) Meng May 2, 2023

May 2, 2023

To SSAD ODP Team, Thank you for the wonderful explanation at the ICANN 76 Cancun Meeting. I email you to seek clarification on Yuko Yokoyama's statement on WDS/RDRS, I would like to know which of the statement "I lead the implementation team for the system called registration data request service which is formerly known as who is disclosure system" or "I lead the implementation team for the system called registration data request service, which is formally known as WHOIS Disclosure System" is correct? Thank you and wish you a great weekend ahead. Best regards, Hong-Fu(Tom) Meng Hong-Fu(Tom) Meng / Net-Chinese Co., Ltd. & NETalent Co., Ltd. Phone: +886-225319696 E-mail: hfmeng(a)net-chinese.com.tw CONFIDENTIALITY NOTICE: This electronic message and any attachments may be confidential. If you are not the intended recipient, please do not disclose the contents to anyone, and notify the sender by e-mail; delete the message and destroy all printed hard copies. Thank you for your cooperation. 孟紅福 / 網路中文資訊股份有限公司 & 網中智庫股份有限公司電話：(02)25319696 信箱：hfmeng(a)net-chinese.com.tw 地址：台北市中山北路二段46號2樓保密警語：本信件及附件內容可能為機密性資料，若您並非被指定之收信人或在任何原因未經授權的情形之下收到本信件，請勿揭曉本信件內容於任何人，並請告知原發信人，以及請從您的電腦刪除此信件和任何已列印的文件。謝謝您的合作。

2 1

SSAD ODP completion
by Yuko Yokoyama Jan. 26, 2022

Jan. 26, 2022

Dear Janis, I am pleased to inform you that ICANN org has delivered<https://www.icann.org/en/announcements/details/icann-delivers-operational-d…> the Operational Design Assessment<https://www.icann.org/en/system/files/files/ssad-oda-25jan22-en.pdf> (ODA), the final deliverable of the Operational Design Phase (ODP), to the ICANN Board today. The ODA was sent to the GNSO Council as well, and published on our webpage at www.icann.org/ssadodp<http://www.icann.org/ssadodp>. This marks the end of the SSAD ODP. On behalf of the entire project team, I would like to thank you for your collaboration as well as your help on facilitating the communication with the Council. I wish you well and hope our paths cross again. Yuko Yokoyama Program Director Strategic Initiatives, Global Domains & Strategy Internet Corporation for Assigned Names and Numbers (ICANN) Direct Line: +1 310 578 8693 Mobile: +1 310 745 1517 E-mail: yuko.green(a)icann.org<mailto:yuko.green@icann.org> www.icann.org<http://www.icann.org/>

2 1

Monthly call for January
by Yuko Yokoyama Jan. 14, 2022

Jan. 14, 2022

Dear Janis, Happy new year! I hope you had a great holiday break. As you may recall, we have shared the implementation timeline, costs, and fee structures of the SSAD during our webinar with the GNSO Council on 20 December and we are planning on the community webinar #5 on the same topics on 18 January at 15:00 UTC. The community webinar will provide further details about how the ODP team reached to those findings, however no new design concept or figures will be introduced. Also to note, the project team also met with the GAC on 11 January to provide the same briefing we provided the Council. If interested, the recording is available here<https://icann.zoom.us/rec/play/WIeifvJCnbhdFXk6ttx6_PAqc3suErPGfxlwrPK8uIUo…>. This community webinar #5 marks our last webinar with the community on the ODP team’s analysis. The Operational Design Assessment (ODA), the final deliverable report to the ICANN Board, is in its final review process and is on track to be delivered to the Board later this month or early February. Subsequently, the ODA will be published for the community view. We understand that the ICANN Board and the Council will start the consultation process and the first meeting is expected to be scheduled for late January. As we do not have any new information to share beyond that, I wanted to ask if you’d still like to meet in January as a part of our monthly cadence. Please let me know. Regards, Yuko Yokoyama Program Director Strategic Initiatives, Global Domains & Strategy Internet Corporation for Assigned Names and Numbers (ICANN)

2 1

Re: [ODP-SSAD] [Ext] Re: gathering potential use information
by Yuko Yokoyama Jan. 5, 2022

Jan. 5, 2022

Dear Paul, The community survey opened on 5 July 2021 and ICANN org conducted the outreach through various avenues to promote it. In order to obtain additional feedback from the community, the deadline was extended and the survey remained open for a little over a month, closing on 6 August 2021. While we appreciate your suggestion, the SSAD Operational Design Phase is close to completion. That said, as noted during the presentation to the Council on 20 December 2021, ICANN org is engaging with a market researcher to better gauge the demand. This work is expected to take place outside the scope of the SSAD ODP, in early 2022. Regards, Yuko Yokoyama From: "McGrady, Paul D." <PMcGrady(a)taftlaw.com> Date: Tuesday, January 4, 2022 at 4:00 PM To: Yuko Green <yuko.green(a)icann.org> Cc: "odp-ssad(a)icann.org" <odp-ssad(a)icann.org> Subject: [Ext] Re: [ODP-SSAD] gathering potential use information Thanks Yuko, Thank you for your email. I know the survey that you’re referring to appears to have been open for less than two weeks. I do not wish to speak for INTA but as you can imagine attempting to survey a 10,000 member organization for that kind of data within less than a two week period during the major July holiday season is not practical. I encourage you to reconsider the suggestion I am making and reach out to a INTA to see if you can get the information. So many of your models rely on information that is simply missing and INTA, given enough time, might actually help you refine those models so that you’re not stuck with usage and dollar ranges that are so broad. However if ICANN is not open to that approach I understand. But I do believe however that it is a missed opportunity to get some clarity for your project. Best, Paul Sent from my iPhone On Jan 4, 2022, at 5:54 PM, Yuko Yokoyama <yuko.green(a)icann.org> wrote: [EXTERNAL MESSAGE] Dear Paul, Thank you for your inquiry and your patience during our holiday office closure. The SSAD ODP team did not specifically reach out to INTA to survey their membership, however, we did invite the full community to participate in the requestor-focused survey<https://www.icann.org/en/announcements/details/community-input-needed-ssad-…> in July 2021. In the survey, some of the questions we asked were the monthly average of query for 2019 and 2020, and the type of organization they represented. The SSAD ODP team thanks you for your question, as well as your participation in the discussion we held on 20 December 2021. Regards, Yuko Yokoyama From: ODP-SSAD <odp-ssad-bounces(a)icann.org> on behalf of Diana Middleton <diana.middleton(a)icann.org> Date: Thursday, December 23, 2021 at 12:05 PM To: "McGrady, Paul D." <PMcGrady(a)taftlaw.com>, "ODP-SSAD(a)icann.org" <ODP-SSAD(a)icann.org> Subject: Re: [ODP-SSAD] gathering potential use information Dear Paul, I am acknowledging receipt of your email. We will respond to your inquiry upon return from the holiday break. Best, Diana Middleton Diana Middleton (she/her) Program Manager Internet Corporation for Assigned Names and Numbers (ICANN) diana.middleton(a)icann.org<mailto:diana.middleton@icann.org> [Image removed by sender. cidimage001.jpg(a)01D693FE.E33B2A10] One World. One Internet. Direct: (202) 570-7128 Mobile: (571) 329-8830 From: ODP-SSAD <odp-ssad-bounces(a)icann.org> on behalf of "McGrady, Paul D." <PMcGrady(a)taftlaw.com> Date: Thursday, December 23, 2021 at 12:03 To: "ODP-SSAD(a)icann.org" <ODP-SSAD(a)icann.org> Subject: [ODP-SSAD] gathering potential use information Hi Staff! I didn’t want to raise this question in front of Goran, in case the answer was “no.” Did Staff reach out to INTA to survey its membership regarding how many SSAD requests per year each member was likely to submit? I expect that would give Staff a good baseline to peg the estimates on usage. If you didn’t, I am sure that Lori Schulman from INTA would be happy to guide you on how to make that ask. Best, Paul Taft / Paul D. McGrady / Partner Taft Stettinius & Hollister LLP 111 E. Wacker Drive, Suite 2800 Chicago, Illinois 60601-3713 Tel: 312.527.4000 • Fax: 312.754.2354 Direct: 312.836.4094 • Cell: 312.882.5020 www.taftlaw.com<https://urldefense.com/v3/__http:/www.taftlaw.com__;!!Hj9Y_P0nvg!FNKvIEyshx…> / PMcGrady(a)taftlaw.com<mailto:PMcGrady@taftlaw.com> This message may contain information that is attorney-client privileged, attorney work product or otherwise confidential. If you are not an intended recipient, use and disclosure of this message are prohibited. If you received this transmission in error, please notify the sender by reply e-mail and delete the message and any attachments.

2 2

Re: [ODP-SSAD] gathering potential use information
by Diana Middleton Jan. 4, 2022

Jan. 4, 2022

Dear Paul, I am acknowledging receipt of your email. We will respond to your inquiry upon return from the holiday break. Best, Diana Middleton Diana Middleton (she/her) Program Manager Internet Corporation for Assigned Names and Numbers (ICANN) diana.middleton(a)icann.org<mailto:diana.middleton@icann.org> [cidimage001.jpg(a)01D693FE.E33B2A10] One World. One Internet. Direct: (202) 570-7128 Mobile: (571) 329-8830 From: ODP-SSAD <odp-ssad-bounces(a)icann.org> on behalf of "McGrady, Paul D." <PMcGrady(a)taftlaw.com> Date: Thursday, December 23, 2021 at 12:03 To: "ODP-SSAD(a)icann.org" <ODP-SSAD(a)icann.org> Subject: [ODP-SSAD] gathering potential use information Hi Staff! I didn’t want to raise this question in front of Goran, in case the answer was “no.” Did Staff reach out to INTA to survey its membership regarding how many SSAD requests per year each member was likely to submit? I expect that would give Staff a good baseline to peg the estimates on usage. If you didn’t, I am sure that Lori Schulman from INTA would be happy to guide you on how to make that ask. Best, Paul Taft / Paul D. McGrady / Partner Taft Stettinius & Hollister LLP 111 E. Wacker Drive, Suite 2800 Chicago, Illinois 60601-3713 Tel: 312.527.4000 • Fax: 312.754.2354 Direct: 312.836.4094 • Cell: 312.882.5020 www.taftlaw.com<https://urldefense.com/v3/__http:/www.taftlaw.com__;!!Hj9Y_P0nvg!FNKvIEyshx…> / PMcGrady(a)taftlaw.com<mailto:PMcGrady@taftlaw.com> This message may contain information that is attorney-client privileged, attorney work product or otherwise confidential. If you are not an intended recipient, use and disclosure of this message are prohibited. If you received this transmission in error, please notify the sender by reply e-mail and delete the message and any attachments.

3 2

gathering potential use information
by McGrady, Paul D. Dec. 22, 2021

Dec. 22, 2021

Hi Staff! I didn’t want to raise this question in front of Goran, in case the answer was “no.” Did Staff reach out to INTA to survey its membership regarding how many SSAD requests per year each member was likely to submit? I expect that would give Staff a good baseline to peg the estimates on usage. If you didn’t, I am sure that Lori Schulman from INTA would be happy to guide you on how to make that ask. Best, Paul Taft / Paul D. McGrady / Partner Taft Stettinius & Hollister LLP 111 E. Wacker Drive, Suite 2800 Chicago, Illinois 60601-3713 Tel: 312.527.4000 • Fax: 312.754.2354 Direct: 312.836.4094 • Cell: 312.882.5020 www.taftlaw.com<https://urldefense.com/v3/__http:/www.taftlaw.com__;!!Hj9Y_P0nvg!FNKvIEyshx…> / PMcGrady(a)taftlaw.com<mailto:PMcGrady@taftlaw.com> This message may contain information that is attorney-client privileged, attorney work product or otherwise confidential. If you are not an intended recipient, use and disclosure of this message are prohibited. If you received this transmission in error, please notify the sender by reply e-mail and delete the message and any attachments.

1 0

Follow-up question from 20 Dec 2021 meeting
by Caitlin Tubergen Dec. 21, 2021

Dec. 21, 2021

SENT ON BEHALF OF ELEEZA AGOPIAN Dear Amr and GNSO Council members, We are writing to follow up on the question Amr posed during our 20 Dec. 2021 meeting updating the GNSO Council on the SSAD ODP. I captured the following question from Amr in the chat: “I recall that webinar and the three levels of verification you highlighted (and the middle ground). I’m asking about details on these verification standards. Could you share what you’re thinking/what you’re looking at?” As you noted, the SSAD ODP project team provided details on each of these levels during our webinar on 28 Oct. 2021. I would suggest reviewing those presentation materials again. In addition, as was noted in that presentation, there are levels of risk associated with identity verification. Generally, the greater the value associated with an identity, the more value there is in higher cost methods of identification to reduce risk. The levels presented represent a conceptual continuum of effort, cost and risk. The high level definition is helpful to design real-world methods specific to a particular situation or system. For example, at higher levels there might be a requirement for in-person certification, multiple forms of official identification, etc. While the team did not develop specific models for each of the levels, the analysis led the team to propose a moderate level. It offers a degree of comfort related to the level of confidence that an identified person is who they say they are. Regardless, it’s important to note that no system is ever perfect with regard to verification of identification. However, the team felt that a moderate level offers a reasonable degree of assurance that an individual has been identified relative to the nature of the data sought and related requirements As we noted in the 20 Dec. discussion, the team is working to finalize the Operational Design Assessment, which contains our detailed findings, and plans to publish it in February 2022. In mid-January, we also plan to host a community webinar that delves into greater depth regarding the costs and fee structure. We’d welcome your participation in that webinar. If you have further questions or we can clarify any of these points, please feel free to write to the team at odp-ssad(a)icann.org. We will be happy to reply to you in the new year. Best, Eleeza Agopian Senior Director, Strategic Initiatives

1 0

Response to the question asked during the Webinar #4
by Yuko Yokoyama Nov. 30, 2021

Nov. 30, 2021

Dear Mr. Palage, As you recall, SSAD ODP team ran out of time to address your question that was asked at the end of the last SSAD ODP webinar (18 November 2021). As promised, here is our response to your question. Your question: The term "technically and commercially feasible" is currently used in the 2013 RRA. Is ICANN stating that the term in Recommendation in 9.1 is equivalent to the RRA term. Goran stated that it was up to Registrars to make that determination under 9.1, who makes that determination under the RAA? ICANN Compliance or the Registrar? Our answer: No. ICANN is not stating that the term “technically and commercially feasible” in Recommendation 9.1 is equivalent to the term used in the Registrar Accreditation Agreement. The RAA’s Transition Addendum<https://www.icann.org/resources/pages/approved-with-specs-2013-09-17-en#tra…>, at Section 6, set out a process for determining technical and commercial feasibility of an across-field validation requirement in the RAA’s WHOIS Accuracy Program Specification<https://www.icann.org/resources/pages/approved-with-specs-2013-09-17-en#who…>, at Section 1(e). The EPDP Team did not reference or incorporate that process into its SSAD recommendations. This question was asked in follow-up to a question read aloud and answered during the webinar: “How does ICANN intend to resolve ambiguity and recommendation 9.1 around who gets to determine whether it is technically and commercially feasible and legally permissible to automate responses?” (see recording<https://icann.zoom.us/rec/play/FHihm9cTRrAyV9hlrP6T1bSXmcGs4Dc5s4rzpWfFZiXQ…> at approximately 1hr:21min). During the webinar, Göran Marby responded that, under the General Data Protection Regulation (GDPR), the contracted parties would be responsible for deciding whether or not to disclose nonpublic registration data requested via the SSAD. When a contracted party’s disclosure of registration data is subject to the GDPR, and that processing is performed pursuant to the GDPR’s “legitimate interest” legal basis (e.g. requiring the application of the GDPR’s Article 6(1)f’s “balancing test”), the contracted party (not ICANN) is responsible for applying that test and determining whether or not it may disclose the data in compliance with the GDPR). Göran also said that “the policy making process cannot change that fundamental fact because it's one of the more important parts of the actual law.” I hope this answered your question, but if further clarification is needed, please do not hesitate to contact us at odp-ssad(a)icann.org<mailto:odp-ssad@icann.org>. Please note, this email is also posted on our publicly archived email<https://mm.icann.org/pipermail/odp-ssad/>. Regards, Yuko Yokoyama Program Director Strategic Initiatives, Global Domains & Strategy Internet Corporation for Assigned Names and Numbers (ICANN)

1 0

18 November Webinar - Deck Published
by Diana Middleton Nov. 16, 2021

Nov. 16, 2021

Our fourth SSAD ODP Community Webinar on the business process and system designs of the SSAD will be this Thursday, 18 November 2021 from 16:00 to 17:30 UTC. You can still register here<https://www.icann.org/en/announcements/details/register-for-icanns-next-ssa…>. With the aim of maximizing community feedback, we have published the webinar presentation in advance here<https://www.icann.org/en/system/files/files/presentation-ssad-odp-project-u…>. This way, you can choose to submit questions in advance to odp-ssad(a)icann.org<mailto:odp-ssad@icann.org> or alternatively ask them during the webinar. Our team will be happy to answer them. We look forward to your participation.

1 0

Request for verification/feedback on SSAD recommendations
by Yuko Yokoyama Nov. 12, 2021

Nov. 12, 2021

Dear Janis, We identified 2 additional questions/assumptions that we would like GNSO Council’s confirmation and/or clarifications. Question 1: Recommendation 9.4 states: Per the legal guidance obtained (see Advice on use cases re automation in the context of disclosure of non-public registrant data<https://community.icann.org/download/attachments/111388744/ICANN_Automation…> - April 2020), the EPDP Team recommends that the following types of disclosure requests, for which legal permissibility has been indicated under GDPR for full automation (in-take as well as processing of disclosure decision) MUST be automated from the time of the launch of the SSAD: Recommendation 9.4.4 states: No personal data on registration record that has been previously disclosed by the Contracted Party. ICANN org understands this mandatory automated use case 4 to apply only when a contracted party has notified the central gateway operator that this use case applies for a specific domain name, as the central gateway operator would not know which domain names’ registration data contain no persona data, or if the CPs have previously disclosed the data on the ground of use case 4. Can you please confirm this is the intent of the Policy Recommendation? Question 2: As you can see in our briefing from ICANN72 presentation concerning identity verification, ICANN org understands the EPDP recommendations to contemplate two different types of accredited SSAD users who may be associated with a legal person: (a) individuals who are affiliated with an org (e.g. an employee), and (b) individuals who represent an org (such as an outside counsel, brand management firm, etc). For each of these types of individuals, we are expecting that the accreditation authority will first verify the individual’s identity, and then the individual’s association with the legal person. The individual’s association with the legal person would be a “declaration” tied to the individual’s accreditation, which takes into account that one individual could be associated with more than one legal entity who has individuals using the SSAD. This is the “signed assertion” concept referenced in the EPDP Team’s Final Report. One issue we will need to resolve during implementation is how to manage multiple individuals’ associations with the same legal entity. Can you let us know if the approaches we’ve identified are aligned with the community expectations in this regard, if not, can you share any additional thinking regarding the community expectations? The first approach we identified was that each individual’s association with a legal entity will need to be individually verified (so that even if one person has demonstrated an association with an entity, the second, third, fourth, etc individuals will also need to do the same). Alternatively, a second, alternative, approach would be that once one person is accredited and associated with a legal entity in the SSAD, additional individuals claiming association with the legal entity could be added (or verified) by the initial individual to gain accreditation and be associated with the entity. However, this approach may raise operational challenges, particularly in large, global entities that may have many individuals seeking SSAD accreditation. This also may not work in cases where the first individual accredited and associated with an organization is an organizational representative, since a representative may not be able to verify individuals within the org, or other individuals who represent the org. We look forward to discussing this matter during our next call with you. Regards, Yuko Yokoyama Program Director Strategic Initiatives, Global Domains & Strategy Internet Corporation for Assigned Names and Numbers (ICANN) E-mail: yuko.green(a)icann.org<mailto:yuko.green@icann.org> www.icann.org<http://www.icann.org/>

1 0