February 2018 - RDS-WHOIS2-RT

Call # 21 report, and Blog Post now online
by Jean-Baptiste Deroulez Feb. 28, 2018

Feb. 28, 2018

Dear RDS-WHOS2 Review Team, Thank you for attending plenary call #21. Attached to this email you will find your meeting report, including identified action items for your review. Archives are available at: https://community.icann.org/display/WHO/Meeting+%2321+-+23+February+2018. We also would like to let you know that the blog post is now published, as no edits/comments were received. Please find it here: https://www.icann.org/news/blog/rds-whois2-review-team-submits-terms-of-ref…. We encourage you to spread the word. Thanks! Kind regards, Jean-Baptiste

1 0

Fwd: Prosecutor rails at Big Tech as EU prepares to unveil new police powers
by Erika Mann Feb. 27, 2018

Feb. 27, 2018

Please don't forward this information, it's from a paid service! Sending this to you because it shows how legally challenging a prudent interpretation of the GDPR can become. Best, Erika > Subject: Fwd: Prosecutor rails at Big Tech as EU prepares to unveil new police powers > > Subject: Prosecutor rails at Big Tech as EU prepares to unveil new police powers > Reply-To: POLITICO Pro Article <proarticles(a)politico.eu<mailto:proarticles@politico.eu>> > > > Prosecutor rails at Big Tech as EU prepares to unveil new police powers > > -- By Laurens Cerulus > 2/27/18, 4:43 PM CET > > MECHELEN, Belgium — Belgian investigative judge Philippe Van Linthout is tired of knocking heads with Big Tech while trying to solve crimes. > > In his office near Brussels, the investigator in charge of serious crimes points to piles of unsolved cases on his desk which he says all have one thing in common: They won’t be solved unless firms like Facebook, Google and Apple start coughing up more data-based evidence. > > “Pick a file, any file,” Van Linthout told POLITICO at his office in Mechelen, referring to open cases that range from terrorism to murder and organized drug smuggling. “Nine out of 10 cases can’t be solved without access to data.” > > Van Linthout’s plea echoes growing frustration among EU investigators who find themselves increasingly at odds with Big Tech — and are cheering a European Commission push to introduce new legislation as early as the end of March that would grant them new powers to pry “e-evidence” from the world’s biggest tech companies. > > Law enforcement officials point out that use of encrypted messaging is now standard among terrorists and criminal gangs. Thanks to competition among big and small tech companies<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdb…>, they can choose among half a dozen ultra-secure messaging systems, from Telegram to Facebook-owned WhatsApp. > > Yet when Van Linthout asks those firms for information about suspects, he said the response from the companies was all too often “sorry, can’t help.” In the case of smaller firms, there was often no response at all. > > Unless an investigator could prove imminent danger to human life — not easy in a murder case with a cooling corpse — tech firms were reluctant to provide clues that undermine their encryption sales pitch. “You’re left with the corpse, the suspect and no information,” he said. > > Help from Jourová > > Facebook representatives, speaking on condition of anonymity to discuss confidential interactions with law enforcement, said the obstacle to accessing messages on encrypted services was first and foremost technical. > > It was not possible to access end-to-end encrypted messages on WhatsApp without breaking encryption for all users, they argued late last year, adding that investigators were aware of such constraints. > > Facebook regularly assists law EU enforcement, without specifying any cases, one representative added. Big Tech also faces limits in U.S. law that require it to demonstrate immediate and urgent danger before sending bits of data to European legislators. > > For Van Linthout, however, cooperation still falls short. What he wants is access to metadata — information about who is in contact with whom, not what’s inside the exchange. Too often, it’s denied. > > Luckily for Van Linthout and his peers, a new legislative proposal from the Commission may soon give them greater leverage against the companies. > > After years of pressure from law enforcement and national justice and home affairs representatives — which focused in particular on the role of encrypted messages in the planning of terrorist bombings in Brussels and Paris — the Commission is due to propose a cross-border European “production order” that would force IT providers to give data to law enforcement if they can demonstrate the data is linked to a crime. > > The proposal is expected to be unveiled at the end of March or mid-April, according to two people close to the file. > > “It is clear the Commission needs to act here and come with pan-European rules,” Justice Commissioner Vera Jourová said at the end of last year, adding that the proposal called for giving law enforcement “direct access” to the information they need. > > A senior Commission official who asked not to be named said the proposal was “probably the boldest thing we can do on criminal law.” > > Even the tech companies may find the proposal useful, as it aims to clarify their obligations before the law. Apple, Google, Facebook and Microsoft have all held meetings with Jourová<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdb…> in the past few months, with Google dispatching its General Counsel Kent Walker to Brussels to lobby her on the matter. > > Europe’s data schizophrenia > > But there’s another obstacle standing in Van Linthout’s way: Europe’s schizophrenic attitude toward data. > > On one hand, lawmakers want to give police a free hand in fighting crime. On the other, citizens have increasingly pushed back against governments and big companies snooping through their personal data unrestricted, and will soon come under the sway of the strictest privacy regulations in the world, the General Data Protection Regulation.<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdb…> > > EU privacy rules have proved just as restrictive for Van Linthout as the resistance of big tech firms. He cites one example from 2015, when investigators were chasing a terrorist plotter in Brussels who was planning an attack on New Year’s Eve and left a trail of evidence on several web pages. > > The problem was that some of it was too old. “We had him. His Internet Protocol address led to Belgium, but the data was older than two years, so data retention [meant] the data was thrown away,” he said, adding that the suspect could not be caught as a result. > > Data retention is a common gripe among investigators, after two major rulings by the European Court of Justice that said countries cannot force firms to store their data for law enforcement purposes without setting strict limits and safeguards. > > The Commission’s proposal is unlikely to clear up confusion over data retention, as the rulings are part of a broader push to strengthen privacy rules following Edward Snowden’s 2013 revelations on the extent of surveillance by the U.S. National Security Agency. > > Which is why investigators like Van Linthout feel hostage to geopolitical considerations. > > EU investigators Europe and the U.S. now find themselves engaged in a race to draw the lines of what law applies on the web. Microsoft is fighting a U.S. warrant<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdb…> in a key court case that has gone all the way to the U.S. Supreme Court. > > The U.S. wants Microsoft to hand over data stored in Ireland. The Commission says Microsoft would risk violating the EU’s data protection laws if it complies. > > Both sides would like the power to ask for data to solve crimes and stop terrorist networks. But current processes to get data for law enforcement purposes, through Mutual Legal Assistance Treaties<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdb…>, are too slow, lawmakers agree. Google estimates<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdb…> show it takes an average of 10 months of waiting time for the data to be processed legally. > > The Commission’s proposal would suggest ways for prosecutors to ask for data stored outside of their jurisdiction, and even outside of Europe, too. > > “We need to get the balance right … The tricky thing is that, if we’d do it only for the EU territory, we wouldn’t catch much,” the senior official said. “We’d address IT providers who are offering services here … They are making big profits here, they are building their client base here, but they also have to be responsible.” > > Related stories on these topics: Big data (in Data and Digitization)<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdb…>, Big data (in Technology)<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdb…>, Cybercrime<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdb…>, Cybersecurity (in Data and Digitization)<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdb…>, Cybersecurity (in Technology)<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdb…>, Data protection (in Data and Digitization)<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdb…>, Data protection (in Technology)<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdb…>, Encryption (in Data and Digitization)<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdb…>, Encryption (in Technology)<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdb…>, Facebook<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdb…>, Hackers<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdb…>, Information technology (in Data and Digitization)<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdb…>, Information technology (in Technology)<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdb…>, Law enforcement<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdb…>, Platforms<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdb…>, Privacy (in Data and Digitization)<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdb…>, Privacy (in Technology)<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdb…>, Regulation (in Data and Digitization)<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdb…>, Regulation (in Technology)<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdb…>, Article 29 Working Party (in Data and Digitization)<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdb…>, Article 29 Working Party (in Technology)<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdb…>, European Commission (in Data and Digitization)<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdb…>, European Commission (in Technology)<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdb…> > > To view online: https://www.politico.eu/pro/philippe-van-linthout-online-crime-data-privacy…<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdb…> > > To update your POLITICO Pro notification preferences, visit www.politico.eu/notification<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdb…> > > ** Tell us what you think: Was this Pro content helpful? Yes<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdb…> | No<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdb…> ** > > View the Pro calendar at www.politico.eu/calendar<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdb…>. Submit an event here<https://politico.us8.list-manage.com/track/click?u=e26c1a1c392386a968d02fdb…>. > > Only POLITICO Pro subscribers have access to POLITICO Pro content. If you are interested in learning more about a POLITICO Pro subscription for your organization, please contact pro(a)politico.eu<mailto:pro@politico.eu>. > > > > > > This email was sent to emann(a)cov.com<mailto:emann@cov.com> > why did I get this?<https://politico.us8.list-manage.com/about?u=e26c1a1c392386a968d02fdbc&id=1…> unsubscribe from all POLITICO SPRL emails<https://politico.us8.list-manage.com/unsubscribe?u=e26c1a1c392386a968d02fdb…> update subscription preferences<https://politico.us8.list-manage.com/profile?u=e26c1a1c392386a968d02fdbc&id…> > POLITICO SPRL · Rue de la Loi 62 · Brussels 1040 · Belgium >

1 0

REMINDER: REVIEW NEEDED: Blog Post
by Jean-Baptiste Deroulez Feb. 27, 2018

Feb. 27, 2018

Dear review team members, We would like to kindly remind you to review the attached blog post and share your edits/comments via this mailing list by today, 23:59 UTC. Kind regards, Jean-Baptiste From: Jean-Baptiste Deroulez <jean-baptiste.deroulez(a)icann.org> Date: Friday, February 23, 2018 at 7:20 PM To: "rds-whois2-rt(a)icann.org" <rds-whois2-rt(a)icann.org> Subject: REVIEW NEEDED: Blog Post Dear review team members, Following today’s plenary call, please review the attached blog post and share your edits/comments via this mailing list by Tuesday 27 February 23:59 UTC. If no edits are received, blog post will be considered approved for publication. Kind regards, Jean-Baptiste

1 0

REVIEW NEEDED: Blog Post
by Jean-Baptiste Deroulez Feb. 23, 2018

Feb. 23, 2018

Dear review team members, Following today’s plenary call, please review the attached blog post and share your edits/comments via this mailing list by Tuesday 27 February 23:59 UTC. If no edits are received, blog post will be considered approved for publication. Kind regards, Jean-Baptiste

1 0

WHOIS Rec #4 Compliance
by Susan Kawaguchi Feb. 23, 2018

Feb. 23, 2018

WHOIS Rec #4 Compliance Has your subgroup identified any needed briefings/resources? No How will your subgroup review/analyze relevant documentation? (for example, will you divide review between subgroup members) Each member will review WHOIS policies and what compliance reports pertain to each policy to make a determination if there are issues we should delve into. We will divide up the policies amongst the subgroup members Summarize each Compliance report or process to determine if there are additional questions to ask. How will you conduct investigation of identified objectives?(for example, will you need calls or conduct work via email) We will work via email and calls. How will you conduct relevant interviews (as appropriate)? We have conducted one initial interview with Compliance team management and will schedule additional calls. How will your subgroup produce its summary of key findings? We are summarizing each compliance report and review of policies. Subgroup will decide upon the key findings to be included in the report to the full group.

1 0

RDS/WHOIS2 RT Plenary #21 | 23 February | 13:30 UTC
by Jean-Baptiste Deroulez Feb. 22, 2018

Feb. 22, 2018

Dear Review Team Members, In preparation for your call #21<https://community.icann.org/display/WHO/Meeting+%2321+-+23+February+2018>, scheduled for tomorrow, 23 February 2018 – 13:30-15:00 UTC, please find below the meeting agenda: 1. Welcome, roll-call, SoI updates 2. Outreach Plan: Blog Post (see attached) 3. Subgroups Discussion * Answers to Next Steps Questions: * Anything New: Stephanie * Law Enforcement Needs: Thomas * Discussion on facts found and additional research needed: * WHOIS1 Rec #3: Outreach: Alan * WHOIS1 Rec #4: Compliance: Susan 1. Plenary Call Schedule and Timing 2. ICANN62 Face-to-Face Meeting 3. A.O.B. 4. Confirm Decisions Reached and Action Items Please note that If any other subgroup is at a stage that they would like to discuss their work during the call, they should let the review team leadership know. You should all have received dial-in details to join this call. If not, please contact us (off list) at rds-whois2-staff(a)icann.org<mailto:rds-whois2-staff@icann.org>. As always, let us know if you have any questions or concerns. Kind regards, Jean-Baptiste

1 0

Next Monday's meeting
by Alan Greenberg Feb. 21, 2018

Feb. 21, 2018

We have 3 more meetings prior to the ICANN61 meeting, and 3 or 4 after ICANN61 and before we meeting in Brussels. According to the workplan we approved, the period from mid-next week until the end of the ICANN meeting we would assembling our findings and beginning to draft recommendations. As I read things, we are now WAY behind on most topics. Prior to and at our last Brussels meeting, we made a conscious choice to tackle most of the parts of the review described in the Bylaws, and we also added a number of other areas. We are now going to have to commit to actually deliver this work. There is no doubt that all of us are busy and no doubt over-committed, but we all applied to work on this Review and now have to carve out the time to do it, or accept that we cannot and resign. A quick check of the subgroup mailing lists shows that for February, we have had a total of 25 messages posted by RT Members to all 13 lists. If that is an indication of the work going on, then we seem to have a problem. If work is preceding off-list, please move it to the list so that everyone can follow it. If will be on the call, please be prepared to discuss all of your subgroups, and particularly the one(s) you are leading. If you cannot make one or both of the calls next week, PLEASE send your apologies ahead of time so we know who will be on the call, and please make sure that someone on your subgroup(s) will be there do discuss the issues. Alan

3 2

Call # 20 report
by Alice Jansen Feb. 20, 2018

Feb. 20, 2018

Dear RDS-WHOS2 Review Team, Thank you for attending plenary call #20. Attached to this email you will find your meeting report. Archives are available at: https://community.icann.org/display/WHO/Meeting+%2320+-+19+February+2018 @ Cathrin, Susan, Stephanie, Thomas, please be kindly reminded to address the planning questions listed below for your subgroup as soon as possible: * Has your subgroup identified any needed briefings/resources? * How will your subgroup review/analyze relevant documentation? (for example, will you divide review between subgroup members) * How will you conduct investigation of identified objectives? (for example, will you need calls or conduct work via email) * How will you conduct relevant interviews (as appropriate)? * How will your subgroup produce its summary of key findings? Your input should be posted to this mailing-list. @ all, please keep an eye on your subgroups mailing-lists this week. We will be in touch! In the meantime, here are useful links and work plan deadlines: 22 February – Draft summary note of key findings 15 March – Approve key findings and assemble draft recommendations 22 March – Produce subgroup report for subgroup approval 5 April – Circulate your subgroup report to full review team 16-17-18 April, Brussels – Meeting to discuss your findings and recommendations Subgroup report template (incl. recommendations template): https://community.icann.org/download/attachments/71604702/Proposed%20Subgro… For WHOIS1 recommendations subgroups<https://community.icann.org/display/WHO/Subgroup+1+-+WHOIS1+Review+Team+Rec…> WHOIS1 implementation assessment tool https://community.icann.org/download/attachments/71604697/FinalRDS-WHOISRT2… Thanks, Best regards Alice

1 0

Plenary Call #20 | 19 February | 14:30 UTC
by Jean-Baptiste Deroulez Feb. 19, 2018

Feb. 19, 2018

Dear Review Team Members, In preparation for your call #20<https://community.icann.org/display/WHO/Meeting+%2320+-+19+February+2018>, scheduled for Monday, 19 February 2018 – 14:30-16:00 UTC, please find below the meeting agenda: 1. Welcome, roll-call, SoI updates 2. Subgroups Status Update •WHOIS1 Rec #1 - Strategic Priority: Cathrin •WHOIS1 Rec #4: Compliance: Susan •WHOIS Rec #10: Privacy/Proxy Services: Volker •WHOIS Rec #11: Common Interface: Volker •Anything New: Stephanie •Law Enforcement Needs: Thomas •Consumer Trust: Erika 3. Subgroups Membership Review 4. Safeguarding Registrant Data 5. Outreach Plan: Blog Post 6. Face-to-Face Meeting 7. Confirm Decisions Reached and Action Items 8. A.O.B. You should all have received dial-in details to join this call. If not, please contact us (off list) at rds-whois2-staff(a)icann.org<mailto:rds-whois2-staff@icann.org>. If you cannot attend the plenary call, please kindly let us know now in reply to this email. If you are a rapporteur and cannot attend the plenary call, please assign a deputy to provide a status on your subgroup status. As always, let us know if you have any questions or concerns. Kind regards, Jean-Baptiste

4 3

Brian Krebs on WHOIS, GDPR and security
by Dmitry Belyavsky Feb. 16, 2018

Feb. 16, 2018

Worth reading: https://krebsonsecurity.com/2018/02/new-eu-privacy-law-may-weaken-security/

1 0