May 2018 - RDS-WHOIS2-REC4-Compliance

Meeting #7 - Rec 4: Compliance (30 May 2018 @ 16:00 UTC)
by Jean-Baptiste Deroulez May 30, 2018

May 30, 2018

Dear Rec #4 Compliance subgroup members, This is to kindly remind you that your subgroup call #7<https://community.icann.org/x/2yUFBQ> is scheduled for tomorrow at 16:00 UTC. Please share in advance any document you would like us to project in Zoom. You should all have received dial-in details to join this call. If not, please contact us (off list) at rds-whois2-staff(a)icann.org<mailto:rds-whois2-staff@icann.org>. Please find below the list of open action items: * Subgroup to try testing recommendation on WHOIS policies that are being examined by this review (e.g., PP, IDN) to see if metrics/monitoring/reporting and enforcement have been defined for those * Susan to formulate recommendation to include compliance taking a risk-based approach that is not just reactive - addressing systemic complaints and taking a risk-based approach * Susan to examine CCT recommendation on DAAR to build this subgroup’s recommendation * Susan to research 2013 RAA negotiation materials to determine any reasons for allowing grandfathering. * Question 1: Susan to formulate a follow-up question for Compliance (possibly also GDD) regarding counting of null fields and the subset of null fields that occur for grandfathered domains. * Carlton to draft finding/recommendation on use of DAAR to improve accuracy of WHOIS. As always, let us know if you have any questions or concerns. Kind regards, Jean-Baptiste

1 1

apologies for today
by Erika Mann May 30, 2018

May 30, 2018

Dear Team - I will not be able to join the call today. Kind regards, Erika

3 2

ACTION REQUIRED: Doodle poll for next RDS-WHOIS2-WHOIS1 Rec #4 Compliance call
by MSSI Secretariat May 24, 2018

May 24, 2018

Hello RDS-WHOIS2 - WHOIS1 Rec #4: Compliance subgroup members, Please see the doodle poll link below for organizing the next WHOIS1 Rec #4-Compliance Subteam meeting. Poll will close at 17:00 UTC tomorrow, Friday, 25 May. Calendar invites will be sent out accordingly. Thank you! https://doodle.com/poll/v3e37buqkd3csg8h With kind regards, Brenda Brewer, Projects & Operations Assistant Multistakeholder Strategy & Strategic Initiatives (MSSI) Internet Corporation for Assigned Names and Numbers (ICANN) [cid:image001.png@01D3F331.AA0381E0] Skype: brenda.brewer.icann Phone: 1-310-745-1107

1 0

Reminder: deadline to submit subgroup report & open action items
by Jean-Baptiste Deroulez May 23, 2018

May 23, 2018

Dear WHOIS1 Rec #4: Compliance subgroup members, We would like to kindly remind you that tomorrow – 24 May 23:59 UTC is the agreed deadline to submit your subgroup report to the review team. The latest version of your report is saved here: http://mm.icann.org/pipermail/rds-whois2-rec4-compliance/attachments/201804…. Your dedicated subgroup wiki page: https://community.icann.org/x/55lEB. Please find below the list of open action items for your subgroup: * ICANN org to schedule a follow-up call for compliance subgroup * Carlton to draft finding/recommendation on use of DAAR to improve accuracy of WHOIS. * Question 1: Susan to formulate a follow-up question for Compliance (possibly also GDD) regarding counting of null fields and the subset of null fields that occur for grandfathered domains. * Susan to research 2013 RAA negotiation materials to determine any reasons for allowing grandfathering. * Susan to examine CCT recommendation on DAAR to build this subgroup’s recommendation * Susan to formulate recommendation to include compliance taking a risk-based approach that is not just reactive - addressing systemic complaints and taking a risk-based approach * Subgroup to try testing recommendation on WHOIS policies that are being examined by this review (e.g., PP, IDN) to see if metrics/monitoring/reporting and enforcement have been defined for those Similar to the preparatory work for the draft report you presented in Brussels, your ICANN support team is available to help you reflect Brussels discussions into your final report. If you need ICANN org to provide suggested language, please reach out to us at rds-whois2-staff(a)icann.org<mailto:rds-whois2-staff@icann.org>. Kind regards, Jean-Baptiste

1 0

Compliance Subteam 4 meeting
by Susan Kawaguchi May 17, 2018

May 17, 2018

Hello All, I have copied the F2F agreements and to do's below along with the response from the compliance team to our latest set of questions. I have put in a few comments in red below for discussion. F2F agreements ● Subgroup analyzed findings for rec 4 implementation but has not formulated recommendations yet . ● Subgroup has not documented findings/analysis for its second objective yet, although it put forward two recommendations associated with that objective. ● The compliance and accuracy subgroups need to consider how to reconcile overlaps between their findings and recommendations. ● Accuracy-related findings/issues remain in the accuracy subgroup report; however, recommendations related to compliance will be integrated into the compliance subgroup report. ● Rec (4)1: All policies implemented should require metrics, measurement, auditing, tracking, reporting and enforcement by the compliance team. Rec (4)2: All DN registrations should be required to adhere to the WHOIS requirements in the 2013 RAA To DO ● Susan to confirm questions for ICANN compliance. Done ● RDS-WHOIS2 Questions to Contractual Compliance ● WHOIS1 Rec #4: Compliance Subgroup Follow-up emails to maguy.serad(a)icann.org from Alice Jansen on 20 April 2018 ● 1. Is it known (or can it be determined from ARS-sampled data) how often Registrant Contact data elements such as Registrant email address, Registrant postal address, and Registrant telephone number are absent from WHOIS records for grandfathered domain names? ● WHOIS Inaccuracy complaints created from the WHOIS Accuracy Reporting System (ARS) are processed in parallel with single and bulk submission of WHOIS Inaccuracy complaints. ICANN Contractual Compliance tracks and reports based on Syntax, Operability and Identity; more information about each category can be found at this link - https://features.icann.org/compliance/dashboard/archives#annual-detailsor on the WHOIS ARS reports. In addition, WHOIS Inaccuracy complaints are tracked for legacy and for new gTLDs. This data can be found in the monthly dashboards at this link: https://features.icann.org/compliance/dashboard/report-list. ● Contractual Compliance’s participation in the WHOIS ARS is limited to providing guidance for Registrar Accreditation Agreement obligations regarding syntax and accuracy, and processing complaints with inaccuracies identified by the WHOIS ARS. The WHOIS ARS program is managed by ICANN’s Global Domains Division. ● Interesting that the compliance team does not have an answer to this question They do not seem to track the lack of information in the grandfathered domain names. Still have no idea if this is a problem. ● 2. Why are a significant number of WHOIS Inacccuracy Complaints closed without any action being taken? What does Compliance treat as valid reasons for immediate ticket closure and are there any metrics for how often tickets are closed for each of those reasons? ● According to the ICANN Contractual Compliance 2017 Annual Reports ● https://features.icann.org/compliance/dashboard/2017/complaints-approach-pr… registrars, out of approximately 25,000 WHOIS Inaccuracy complaints received during 2017, approximately 12,000 were closed before contacting the registrar. Common reasons for closing a complaint before a 1st notice is sent to the registrar include: ● - The reporter not providing information requested to validate the complaint, - The domain name is suspended when the complaint was received, or - The complaint is outside of the scope of ICANN’s contractual authority (e.g., it is too broad or incomplete or is a request to change a registrant’s own domain name information). ● While certain WHOIS Inaccuracy complaints are automatically closed by the complaint processing system (including complaints for country code top-level domains and suspended domain names), for those that are not automatically closed, Contractual Compliance will attempt to validate the information in the complaint or obtain more information before closing the complaint. ● ● 1 ● ICANN Contractual Compliance recently began reporting on closure reasons by complaint type, including those for WHOIS Inaccuracy complaints. These metrics are reported on a quarterly basis and the first quarter of 2018’s report is found at https://features.icann.org/compliance/dashboard/2018/q1/registrar-resolved-… . In reviewing the additional information in the dashboard report it appears that many inaccuracy reports are not valid reports. One issue we should look at is closing of inaccuracy reports due to the domain names being suspended previously. The WHOIS record still exists with suspended domain names and the registrar can choose to unsuspend at any moment. The inaccuracy issue remains and should be addressed. ● 3. What additional evidence in WHOIS Inaccuracy Complaints would Compliance find useful? ● Additional evidence in WHOIS Inaccuracy complaints that compliance might find useful if the reporter provides are listed below: ● - Evidence of returned mail sent to the postal address listed in the WHOIS information - Evidence of a bounceback or undeliverable email notification for email sent to the email address listed in the WHOIS information - Evidence or explanation why the telephone number listed in the public WHOIS is not accurate - Evidence or explanation why the person or entity listed in the public WHOIS does not exist or is not the registered name holder (RNH) ● 4. Does Compliance do any analysis of WHOIS Inaccuracy trends? If not, why not? For example, would a policy be necessary to enable trend analysis? ● ICANN Contractual Compliance does attempt to identify patterns and systemic issues of noncompliance within and across all of the complaint types. This effort is useful in identifying trends of issues and most importantly in identifying opportunities to conduct outreach or additional proactive monitoring. ● 5. It shows that one of Compliance activities is ICANN-initiated monitoring to take proactive actions. What kind of monitoring programs have been conducted or planned? ● Please provide more information on what “It” refers to, so that Contractual Compliance may provide an accurate response. ● To address the question about the kind of monitoring programs – Proactive monitoring is ICANN’s effort to take initiative in identifying potential issues instead of waiting for issues to happen. Proactive monitoring actions, to list a few, are: the audit program, review of blogs and social media, observed behavior from complaints, WHOIS Quality Review, review related to the DNS infrastructure for example, usability and format of data escrow files, or the automated monitoring system to ensure compliance with Specification 10 of the Registry Agreement. Contractual Compliance reports on the proactive monitoring activities in the Quarterly and Annual Report published on ICANN.org under Report & Blogs. ● ● 2 ● 6. Is there any monitoring program to check some common grounds or linkages among ARS, Audit Program, public complaints received, e.g. from specific registrar, gTLD, region? ● As stated in the response to question 5, ICANN monitors the observed behavior from complaints. For example, based on trends identified by Contractual Compliance (including review of WHOIS inaccuracy complaints submitted by the public and generated as a result of the WHOIS ARS), WHOIS Inquiry efforts were taken in 2016 that focused on registrars in China and Korea. These inquiries focused on issues with the 2013 RAA WHOIS Accuracy Specification Program (WAPS) requirements. These efforts continued for registrars in China, the United States, and other regions. Please refer to the annual update published at this link https://www.icann.org/en/system/files/files/annual-2016-31jan17-en.pdf. ● 7. Does compliance credit-rate registrars or just treat all of them equally? ● ICANN treats all registrars equally and does not rate them. ● Please refer to the WHOIS1 Recommnedation 5-9 Data accuracy Subgroup for additional questions and responses regarding WHOIS ARS. ● ● 2) WHOIS verification review out reach focused on the APAC region to ensure compliance with the 2013 RAA requirement to verify and validate WHOIS information. Registrars that could not demonstrate initial compliance collaborated with the team to update systems and processes to ensure future compliance. ● . ● Subgroup to try testing recommendation on WHOIS policies that are being examined by this review (e.g., PP, IDN) to see if metrics/monitoring/reporting and enforcement have been defined for those – In process ● Susan to formulate recommendation to include compliance taking a risk-based approach that is not just reactive - addressing systemic complaints and taking a risk-based approach – One of the follow up questions to the compliance team #6 they report that they have performed proactive monitoring of the WHOIS verification review in the APAC region. There does not seem to be any other proactive approach concerning the WHOIS. We should recommend that they expand this monitoring to other areas of WHOIS compliance. What does the team recommend? ● Susan to examine CCT recommendation on DAAR to build this subgroup’s recommendation CCT Recommendation C: Further study the relationship between specific registry operators, registrars and DNS abuse by commissioning ongoing data collection, including but not limited to, ICANN Domain Abuse Activity Reporting (DAAR) initiatives. For transparency purposes, this information should be regularly published in order to be able to identify registries and registrars that need to come under greater scrutiny and higher priority by ICANN Compliance. Upon identifying abuse phenomena, ICANN should put in place an action plan to respond to such studies, remediate problems identified, and define future ongoing data collection. ● Susan to research 2013 RAA negotiation materials to determine any reasons for allowing grandfathering. Have not found out any additional information on this but will continue to pursue Additional Points ICANN should publicize the Bulk Whois inaccuracy submissions tool more widely. Currently only 10 users have gone through the process to be able to submit. Last year only 3 submitters used the tool. 300 domain names at a time. Background Information: ICANN Contractual Compliance provides a mechanism for bulk WHOIS inaccuracy complaint submissions, which allows a user to submit multiple complaints through a single file upload. Each user can submit up to 300 total complaints per week. The complaints are processed in the same method and queue for WHOIS inaccuracy complaints. Users of the bulk system must agree to mandatory terms of use, and their complaint quality is monitored by ICANN to ensure submission of complaints are within scope of the RAA and WHOIS requirements. There are currently approximately ten approved users for the bulk system, and within the past six months, three were active users. Look forward to our discussion tomorrow. Susan

1 0

ACTION REQUIRED: Doodle poll for next WHOIS1 Rec #4 Compliance meeting
by MSSI Secretariat May 15, 2018

May 15, 2018

Hello RDS-WHOIS2 - WHOIS1 Rec #4: Compliance subgroup members, Please see the doodle poll link below for organizing the next WHOIS1 Rec #4-Compliance Subteam meeting. Poll will close in 24 hours @ 14:00 UTC tomorrow, Wednesday, 16 May. Calendar invites will be sent out accordingly. Thank you! https://doodle.com/poll/whqdpbt8tp8t4srz With kind regards, Brenda Brewer, Projects & Operations Assistant Multistakeholder Strategy & Strategic Initiatives (MSSI) Internet Corporation for Assigned Names and Numbers (ICANN) [cid:image001.png@01D3EC28.22C725C0] Skype: brenda.brewer.icann Phone: 1-310-745-1107

1 1

ICANN compliance input on your questions
by Alice Jansen May 2, 2018

May 2, 2018

Dear Compliance Subgroup, Attached to this email you will ICANN Compliance’s answers to your list of questions below. Thanks so much, Kind regards Alice From: Susan Kawaguchi <susankpolicy(a)gmail.com> Date: Thursday 19 April 2018 at 13:36 To: Alice Jansen <alice.jansen(a)icann.org>, "rds-whois2-rec4-compliance(a)icann.org" <rds-whois2-rec4-compliance(a)icann.org>, RDS WHOIS2-RT List <rds-whois2-rt(a)icann.org> Cc: SUN Lili <L.SUN(a)interpol.int>, Jean-Baptiste Deroulez <jean-baptiste.deroulez(a)icann.org>, Lisa Phifer <lisa(a)corecom.com> Subject: Re: [Ext] RE: CONFIRMATION NEEDED - Questions for ICANN Compliance Hello All, Thank you Lili for the list of additional questions. These all relate to our discussions at the F2F. Please submit to the compliance team on our behalf. Best regards, Susan On Thu, Apr 19, 2018 at 11:52 AM, Alice Jansen <alice.jansen(a)icann.org<mailto:alice.jansen@icann.org>> wrote: Many thanks, Lili and Susan. We will send these over to ICANN compliance and will get back to you on the estimated delivery date. Could I ask you to send a note out to your subroups to inform them of the list of questions? That way, the request will also be official. Thanks so much and safe travels! It was great to have you in Brussels! Kind regards Alice From: SUN Lili <L.SUN(a)interpol.int<mailto:L.SUN@interpol.int>> Date: Thursday 19 April 2018 at 07:05 To: Susan Kawaguchi <susankpolicy(a)gmail.com<mailto:susankpolicy@gmail.com>>, Alice Jansen <alice.jansen(a)icann.org<mailto:alice.jansen@icann.org>> Cc: Jean-Baptiste Deroulez <jean-baptiste.deroulez(a)icann.org<mailto:jean-baptiste.deroulez@icann.org>>, Lisa Phifer <lisa(a)corecom.com<mailto:lisa@corecom.com>> Subject: [Ext] RE: CONFIRMATION NEEDED - Questions for ICANN Compliance Hi Alice, hi Susan, Please check below the updated questions for ICANN Compliance, 2 questions from Data-Accuracy Subgroup have been solved, I added 3 more questions relating to compliance for Susan’s consideration. Thanks and best regards, Lili * Data-Accuracy Subgroup Follow-up Questions for ICANN Compliance: 1. Does the Compliance Team attempt to identify patterns within ARS-detected inaccuracies to enable proactive remediation of underlying causes? 2. If a domain registration is suspended due to a reported or detected WHOIS inaccuracy, can the domain name be un-suspended without the inaccuracy being remediated? 3. Does the WHOIS Quality Review (or any other program) audit how often un-suspension without accuracy remediation occurs? If so, for how long after suspension are those follow-up accuracy checks performed? 4. Considering ARS compliance metrics: Why are the percentage of ticketed domains that end up being suspended or cancelled is increasing? [cid:image002.jpg@01D3D7DE.F0100690] 5. ( Solved, delete) What percentage of ARS-initiated WHOIS Inaccuracy compliance tickets result in updates to correct WHOIS data prior to 3rd failure & breach notices? This is already provided by WHOIS ARS Contractual Compliance Metrics[whois.icann.org]<https://urldefense.proofpoint.com/v2/url?u=https-3A__whois.icann.org_en_who…>. 6. ( Solved, delete) Is WDRP compliance being audited and reported? If so where? WDRP compliance has been audited since 2012 as one of the many 2009 & 2013 RAA provisions, see more detail at Contractual Compliance Audit Program[icann.org]<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_resource…>. However, only selected (or sampled) registrars were audited during each round, and besides a general percentage (20%-35%) of registrars with a deficiency on this, there was no further detail about the deficiency. See below the specific audit reports: 2016 May Contractual Compliance Registrar Audit Report[icann.org]<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_en_syste…> [PDF, 372 KB] 2016 September Contractual Compliance Registrar Audit Report[icann.org]<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_en_syste…> [PDF, 238 KB] 2015 September Contractual Compliance Registrar Audit Report[icann.org]<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_en_syste…> [PDF, 258 KB] 2014 Contractual Compliance Year Three Audit Program Report[icann.org]<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_en_resou…> [PDF, 851 KB] 2013 Contractual Compliance Year Two Audit Program Report[icann.org]<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_en_syste…> [PDF, 900 KB] 2012 Contractual Compliance Year One Audit Program Report[icann.org]<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_en_syste…> [PDF, 322 KB] * Compliance Subgroup Follow-up Questions for ICANN Compliance 1. Is it known (or can it be determined from ARS-sampled data) how often Registrant Contact data elements such as Registrant email address, Registrant postal address, and Registrant telephone number are absent from WHOIS records for grandfathered domain names? 2. Why are a significant number of WHOIS Inacccuracy Complaints closed without any action being taken? What does Compliance treat as valid reasons for immediate ticket closure and are there any metrics for how often tickets are closed for each of those reasons? 3. What additional evidence in WHOIS Inaccuracy Complaints would Compliance find useful? 4. Does Compliance do any analysis of WHOIS Inaccuracy trends? If not, why not? For example, would a policy be necessary to enable trend analysis? 5. ( Newly added) It shows that one of Compliance activities is ICANN-initiated monitoring to take proactive actions. What kind of monitoring programs have been conducted or planned? 6. ( Newly added) Is there any monitoring program to check some common grounds or linkages among ARS, Audit Program, public complaints received, e.g. from specific registrar, gTLD, region? 7. ( Newly added) Does compliance credit-rate registrars or just treat all of them equally? From: Susan Kawaguchi [mailto:susankpolicy@gmail.com<mailto:susankpolicy@gmail.com>] Sent: Wednesday, 18 April, 2018 7:34 PM To: Alice Jansen <alice.jansen(a)icann.org<mailto:alice.jansen@icann.org>> Cc: SUN Lili <L.SUN(a)interpol.int<mailto:L.SUN@interpol.int>>; Jean-Baptiste Deroulez <jean-baptiste.deroulez(a)icann.org<mailto:jean-baptiste.deroulez@icann.org>>; Lisa Phifer <lisa(a)corecom.com<mailto:lisa@corecom.com>> Subject: Re: CONFIRMATION NEEDED - Questions for ICANN Compliance Thanks Alice and Jean-Baptiste, All the questions seem fine to me. Susan On Tue, Apr 17, 2018 at 11:29 AM, Alice Jansen <alice.jansen(a)icann.org<mailto:alice.jansen@icann.org>> wrote: Hi Lili, Hi Susan, Below you will find the list of questions we extracted from the data accuracy and compliance subgroups related discussions yesterday. Please review and let us know if you have any edits at your earliest convenience. We will send to ICANN compliance once we have received your confirmations. Thanks, Kind regards Alice * Data-Accuracy Subgroup Follow-up Questions for ICANN Compliance: 1. What percentage of ARS-initiated WHOIS Inaccuracy compliance tickets result in updates to correct WHOIS data prior to 3rd failure & breach notices? 2. Does the Compliance Team attempt to detect patterns within ARS-detected inaccuracies to enable proactive remediation of underlying causes? 3. Is WDRP compliance being audited and reported? If so where? 4. If a domain registration is suspended due to a reported or detected WHOIS inaccuracy, can the domain name be un-suspended without the inaccuracy being remediated? 5. Does the WHOIS Quality Review (or any other program) audit how often un-suspension without accuracy remediation occurs? If so, for how long after suspension are those follow-up accuracy checks performed? 6. Considering ARS compliance metrics: Why are the percentage of ticketed domains that end up being suspended or cancelled is increasing? * Compliance Subgroup Follow-up Questions for ICANN Compliance 1. Is it known (or can it be determined from ARS-sampled data) how often Registrant Contact data elements such as Registrant email address, Registrant postal address, and Registrant telephone number are absent from WHOIS records for grandfathered domain names? 2. Why are a significant number of WHOIS Inacccuracy Complaints closed without any action being taken? What does Compliance treat as valid reasons for immediate ticket closure and are there any metrics for how often tickets are closed for each of those reasons? 3. What additional evidence in WHOIS Inaccuracy Complaints would Compliance find useful? 4. Does Compliance do any analysis of WHOIS Inaccuracy trends? If not, why not? For example, would a policy be necessary to enable trend analysis? *************************************************************************************************** This message, and any attachment contained, are confidential and subject of legal privilege. It may be used solely for the designated police/justice purpose and by the individual or entity to whom it is addressed. The information is not to be disseminated to another agency or third party without the author’s consent, and must not be retained longer than is necessary for the fulfilment of the purpose for which the information is to be used. All practicable steps shall be taken by the recipients to ensure that information is protected against unauthorised access or processing. INTERPOL reserves the right to enquire about the use of the information provided. If you are not the intended recipient, be advised that you have received this message in error. In such a case, you should not print it, copy it, make any use of it or disclose it, but please notify us immediately and delete the message from any computer. *************************************************************************************************

2 1

Action Needed: Rec #4: Compliance: Face-to-Face Meeting #2 Open Action Items
by Jean-Baptiste Deroulez May 1, 2018

May 1, 2018

Dear Rec #4: Compliance Subgroup members, Please find below your subgroup open action items identified during the face-to-face meeting #2 in Brussels: * Subgroup to try testing recommendation on WHOIS policies that are being examined by this review (e.g., PP, IDN) to see if metrics/monitoring/reporting and enforcement have been defined for those * Susan to formulate recommendation to include compliance taking a risk-based approach that is not just reactive - addressing systemic complaints and taking a risk-based approach * Susan to examine CCT recommendation on DAAR to build this subgroup’s recommendation * Susan to research 2013 RAA negotiation materials to determine any reasons for allowing grandfathering. Attached to this email, you will find agreements and actions items confirmed in Brussels. Meeting archives can be found at: https://community.icann.org/x/kA_8B. Dedicated subgroup page including background documents, actions items, decisions reached: https://community.icann.org/x/55lEB. Kind regards, Jean-Baptiste

1 0