Dear Dmitry and all, Thanks for bringing the CCT Review outcome in, it’s helpful. At the moment, I do have the similar impression and early assessment as the CCT Review Team on the WHOIS accuracy topic. The facts of progress on WHOIS accuracy verification and ARS project are there, I believe the responsibility of this sub-group is to review whether these measures effectively met the recommendations, where are the gaps? And then we could propose new recommendations. I’m now collating the relevant pieces of information into the template. If you have other findings or references, please give me a heads up. Thank you! Regards, Lili From: Dmitry Belyavsky [mailto:beldmit@gmail.com] Sent: Monday, 12 March, 2018 12:03 AM To: SUN Lili <L.SUN@interpol.int> Cc: rds-whois2-dataaccuracy@icann.org; Jean-Baptiste Deroulez <jean-baptiste.deroulez@icann.org> Subject: Re: [RDS-WHOIS2-DataAccuracy] WHOIS1 Rec #5-9: Data Accuracy subgroup | 6 March | 11:00 UTC Dear Lili and all, Here is a summary of the https://www.icann.org/en/system/files/files/cct-rt-draft-report-07mar17-en.p... related to questions 1-2: WHOIS accuracy complaints remain the largest category of complaints to ICANN Contractual Compliance. The information about such complaints is not disclosed by ICANN, but the statistics is available via the reports https://www.icann.org/en/system/files/files/annual-2014-13feb15-en.pdf and https://www.icann.org/en/system/files/files/annual-2015-27jan16-en.pdf. "For example, of the 41,790 total complaints received in 2014, 29,857 related to WHOIS (most complained about lack of accuracy) (about 71%). Of the 48,106 total complaints received in 2015, 36,354 related to WHOIS (again, accuracy) (about 75%)." According to RA-2013, new gTLD registrars are required to engage in “reasonable and commercially practicable” WHOIS accuracy verification at the time of registration and periodic reverification thereafter. Specifically, registrars are required to verify the syntax accuracy of registrant provided postal addresses, email addresses, and telephone numbers and verify the validity of the phone number and email address of the registrant. These provisions limit registrants to 7 days for correcting or updating such information and a total of 15 days for responding to inquiries by the registrar. The consequences imposed by a registrar for a registrant’s failure to comply include the suspension or cancellation of the domain name registration. The ICANN ARS project aims are declared as "The project aims to: proactively identify inaccurate gTLD registration data, explore the use of automated tools, forward potentially inaccurate records to registrars for action, and publicly report on the resulting actions to encourage improvement." For now ICANN ARS has only deals with accuracy of syntax and operability (i.e., is the contact information in the correct format and is it an operating email, address or telephone number). The latest ARS Report was issued in June 2016 and contains findings on the accuracy of syntax (proper format) and operability (can it be used to communicate) of telephone numbers, postal address, and email address for a sample of both new and legacy gTLDs. (https://whois.icann.org/en/file/whois-ars-phase-2-cycle-1-report-syntax-and-...) ICANN has not committed to progressing to the identity validation phase (i.e., is the individual listed responsible for the domain?). Hence, the current documentation effort will only detect syntax and operability issues but will not detect and therefore not document inaccurate identity. It's worth mentioning the highly regulated domains where Registry rules require “provide appropriate jurisdictional authorities with the capability at their option and at no cost to make designations in the WHOIS record relevant to the registrant’s organizational status in the registrant’s jurisdiction.” It should provide more accurate data. The ARS project page link: https://whois.icann.org/en/whoisars According to the page, there should be 3 stages of the study: Phase 1: Syntax Accuracy Phase 2: Syntax + Operability Accuracy Phase 3: Syntax + Operability + Identity (TBD; requires further consultation with the community as to if and how this phase would be implemented) The phase 1 seems to be completed, phase 2 seems to be ongoing. I do not think that we are interested in the results of the phase 1 separately. Finding of stage 2 are available here: https://whois.icann.org/en/whois-ars-phase-2-reporting On Thu, Mar 8, 2018 at 8:06 AM, SUN Lili <L.SUN@interpol.int<mailto:L.SUN@interpol.int>> wrote: Hi Dmitry and all, Following the discussion during the 1st subgroup call, I detailed Q1&Q2 somehow and raised several further questions for briefing, for your review and comments, the deadline for your inputs is next week. 1. The implementation progress of “WHOIS ACCURACY PROGRAM SPECIFICATION” in 2013 RAA. 1.1. What have been done for the implementation of “WHOIS ACCURACY PROGRAM SPECIFICATION”? Further questions for briefing: i. Are there any documents on the implementation of WHOIS ACCURACY PROGRAM SPECIFICATION? ii. Besides the WHOIS Accuracy Reporting System (ARS), are there any contractual compliance tools/means for ICANN Org to trace the implementation of “WHOIS ACCURACY PROGRAM SPECIFICATION”? iii. Any updates on the commercial feasible tools/services that focus on global address validation? 1.2. The gap between the implementation so far and the “WHOIS ACCURACY PROGRAM SPECIFICATION” in 2013 RAA Further questions for briefing: What is in common behind the bulk WHOIS inaccuracy complaint (3,199 tickets in 2017), i.e. sponsored by same Registrar, from same Registrant? 2. The progress of WHOIS Accuracy Reporting System (ARS) project and to what extent the inaccuracy has been reduced. 2.1 Are the types of validation and implementation methods identified in SAC058<https://www.icann.org/en/system/files/files/sac-058-en.pdf> , deployed in WHOIS ARS effective to report inaccuracy? 2.2 The progress of WHOIS ARS? Further questions for briefing: i. What’s the latest progress of WHOIS ARS Phase 3? Are there any means identified how to conduct identity validation? ii. The road map of WHOIS ARS, e.g. when will the ARS cover the entire gTLD population, not only the sample selection? 2.3 How to evaluate the impact of WHOIS ARS on reducing the WHOIS inaccuracy? Further questions for briefing: i. How would ICANN Org assess the achievement and impact of WHOIS ARS on reducing the WHOIS inaccuracy? Thanks, Lili From: SUN Lili Sent: Wednesday, 7 March, 2018 11:27 PM To: 'Cathrin.BAUER-BULST@ec.europa.eu<mailto:Cathrin.BAUER-BULST@ec.europa.eu>' <Cathrin.BAUER-BULST@ec.europa.eu<mailto:Cathrin.BAUER-BULST@ec.europa.eu>> Cc: 'Jean-Baptiste Deroulez' <jean-baptiste.deroulez@icann.org<mailto:jean-baptiste.deroulez@icann.org>>; rds-whois2-dataaccuracy@icann.org<mailto:rds-whois2-dataaccuracy@icann.org> Subject: RE: [RDS-WHOIS2-DataAccuracy] WHOIS1 Rec #5-9: Data Accuracy subgroup | 6 March | 11:00 UTC Hi Cathrin, Following the subgroup call yesterday, please find here after my prosed questions for briefing on Question 3, for your collective information: 1. What’s the proportion of WHOIS inaccuracy complaints falling in Proxy & Privacy Service? 2. Have there been any measures for ICANN Org or Registrars or Proxy & Privacy Service Providers to validate and verify the WHOIS data collected from Registrants by Proxy & Privacy Service Providers? 3. Besides the PPSAI under implementation, are there any contractual requirements on Proxy & Privacy Service Providers through ICANN or Registrars? Regards, Lili From: RDS-WHOIS2-DataAccuracy [mailto:rds-whois2-dataaccuracy-bounces@icann.org] On Behalf Of Jean-Baptiste Deroulez Sent: Tuesday, 6 March, 2018 9:32 PM To: rds-whois2-dataaccuracy@icann.org<mailto:rds-whois2-dataaccuracy@icann.org> Subject: Re: [RDS-WHOIS2-DataAccuracy] WHOIS1 Rec #5-9: Data Accuracy subgroup | 6 March | 11:00 UTC Dear Data Accuracy subgroup members, Please find below the identified action items and decisions reached from today’s subgroup call #1<https://community.icann.org/display/WHO/WHOIS1+Rec+%235-9%3A+Data+Accuracy>: DECISIONS REACHED * Lili/Dmitry to focus on following questions: 1) The implementation progress of "WHOIS ACCURACY PROGRAM SPECIFICATION" in 2013 RAA. 2) The progress of WHOIS Accuracy Reporting System (ARS) project and to what extent the inaccuracy has been reduced * Cathrin to focus on the following question: 3) The accurate rate of WHOIS data which uses Privacy/Proxy service. * Subgroup to focus on Q4 "Are the measures which have been taken effective in achieving the objective?'" once questions 1,2,3 have been dealt with * Question 5 (Whether we can measure data accuracy when data becomes mostly hidden?) to be included in briefing questions to the ARS team for 1-2. ACTION ITEMS * Cathrin to participate in the 20 March briefing on P/P compliance * Subgroup members to Develop specific questions not covered in existing briefing and materials (if any) to be addressed by a further briefing by ICANN Org * Subgroup members to submit first draft briefing questions by this Thursday, subgroup review/comment on questions by next week, to submit questions to ICANN Org for answers to be received no later than the end of March * Lili to collect key findings from each subgroup member into the report template by the end of March. Kind regards, Jean-Baptiste From: RDS-WHOIS2-DataAccuracy <rds-whois2-dataaccuracy-bounces@icann.org<mailto:rds-whois2-dataaccuracy-bounces@icann.org>> on behalf of Jean-Baptiste Deroulez <jean-baptiste.deroulez@icann.org<mailto:jean-baptiste.deroulez@icann.org>> Date: Monday, March 5, 2018 at 7:51 PM To: "rds-whois2-dataaccuracy@icann.org<mailto:rds-whois2-dataaccuracy@icann.org>" <rds-whois2-dataaccuracy@icann.org<mailto:rds-whois2-dataaccuracy@icann.org>> Subject: [RDS-WHOIS2-DataAccuracy] WHOIS1 Rec #5-9: Data Accuracy subgroup | 6 March | 11:00 UTC Dear Data Accuracy subgroup members, We would like to confirm your first subgroup call is scheduled for tomorrow, Tuesday 6 March at 11:00 UTC. Kind regards, Jean-Baptiste *************************************************************************************************** This message, and any attachment contained, are confidential and subject of legal privilege. It may be used solely for the designated police/justice purpose and by the individual or entity to whom it is addressed. The information is not to be disseminated to another agency or third party without the author’s consent, and must not be retained longer than is necessary for the fulfilment of the purpose for which the information is to be used. All practicable steps shall be taken by the recipients to ensure that information is protected against unauthorised access or processing. INTERPOL reserves the right to enquire about the use of the information provided. If you are not the intended recipient, be advised that you have received this message in error. In such a case, you should not print it, copy it, make any use of it or disclose it, but please notify us immediately and delete the message from any computer. ************************************************************************************************* -- SY, Dmitry Belyavsky