November 2011 - Rt4-whois - lists.icann.org

Definitions of Privacy and Proxy
by Susan Kawaguchi Nov. 29, 2011

Nov. 29, 2011

Hello All, We seem to use varying definitions of privacy and proxy. I found these two definitions of both terms in our draft report In Chapter 4 page 43 u Privacy Services provide the Registrant's Name, but the Privacy Service's contact information. The Privacy Service passes on non-spam messages to the Registrant, particularly legal notices, acting as a type of "registered agent." u Proxy Services register the domain name and license it to another for use. Chapter 8 Page 80 Privacy services limit certain user details from WHOIS by offering alternate contact information and mail forwarding services, while not actually shielding the user's identity. Proxy services have a third-party register domain names on the user's behalf and then license the use of the domain name so that a third-party's contact information (and not the licensee's) is published in WHOIS. I prefer the definitions from the Sept. 28, 2009 NORC report. Background To ensure that the community can identify who is responsible for a domain name, a registered name holder is required to provide and update, as needed, their contact information with their registrar of record. Registrars are required by ICANN to collect and provide free public access to the name of the registered domain name and its name servers and registrar, the date the domain was created and when its registration expires, and the contact information for the Registered Name Holder, the technical contact, and the administrative contact. In some instances, a registered name holder chooses to limit the amount of personal information that its registrar of record makes available to the public via a Whois query of their database. To do so, a registered name holder generally uses a privacy or proxy registration service. For the purpose of this study, the definitions of privacy and proxy services, as they relate to their use in the domain name system, are as follows: A privacy service provider offers the registrant an opportunity to register a domain name while concealing some personal identifying information listed in a WHOIS directory, such as his or her address, telephone number, or email address, by providing alternate contact information, often that of the privacy service provider. A proxy service provider registers the domain name on the registrant's behalf and then licenses the use of the domain name to the registrant. The contact information in a WHOIS directory for a domain name registered with a proxy service is that of the proxy service provider. There may be an intentional use of the other definitions that I am not aware of but I feel we should provide an extremely clear definition of each term since they are currently used interchangeably in the marketplace. Susan Susan Kawaguchi Domain Name Manager Facebook Inc. 1601 California Avenue Palo Alto, CA Phone - 650 485-6064 Cell - 650 387 3904 Please note my email address has changed to skawaguchi(a)fb.com NOTICE: This email (including any attachments) may contain information that is private, confidential, or protected by attorney-client or other privilege. Unless you are the intended recipient, you may not use, copy, or retransmit the email or its contents.

5 4

Re: [Rt4-whois] Definitions of Privacy and Proxy
by Susan Kawaguchi Nov. 29, 2011

Nov. 29, 2011

Good catch! Until I read it aloud I did not read it correctly Do you prefer either of the other two? My point is that we decide on a standard definition Sent from my iPhone On Nov 28, 2011, at 9:56 PM, "Seth M Reiss" <seth.reiss(a)lex-ip.com<mailto:seth.reiss@lex-ip.com>> wrote: I feel there is a very large problem with adopting the NORC report’s definition of proxy, although I find the NORC report’s definition of privacy service eloquent and accurate. The problem with the NORC report’s definition of proxy is that it designates the licensee as the “registrant” and in doing so, shifts all legal responsibilities and risks from the retail proxy service onto the hidden licensee. This definition is unfortunate, and can only lead to confusion and contradiction as we attempt to move forward. Seth From: rt4-whois-bounces(a)icann.org<mailto:rt4-whois-bounces@icann.org> [mailto:rt4-whois-bounces@icann.org] On Behalf Of Susan Kawaguchi Sent: Monday, November 28, 2011 2:40 PM To: <mailto:rt4-whois@icann.org> rt4-whois(a)icann.org<mailto:rt4-whois@icann.org> Subject: [Rt4-whois] Definitions of Privacy and Proxy Hello All, We seem to use varying definitions of privacy and proxy. I found these two definitions of both terms in our draft report In Chapter 4 page 43 u Privacy Services provide the Registrant's Name, but the Privacy Service's contact information. The Privacy Service passes on non-spam messages to the Registrant, particularly legal notices, acting as a type of “registered agent.” u Proxy Services register the domain name and license it to another for use. Chapter 8 Page 80 Privacy services limit certain user details from WHOIS by offering alternate contact information and mail forwarding services, while not actually shielding the user’s identity. Proxy services have a third-party register domain names on the user’s behalf and then license the use of the domain name so that a third-party’s contact information (and not the licensee’s) is published in WHOIS. I prefer the definitions from the Sept. 28, 2009 NORC report. Background To ensure that the community can identify who is responsible for a domain name, a registered name holder is required to provide and update, as needed, their contact information with their registrar of record. Registrars are required by ICANN to collect and provide free public access to the name of the registered domain name and its name servers and registrar, the date the domain was created and when its registration expires, and the contact information for the Registered Name Holder, the technical contact, and the administrative contact. In some instances, a registered name holder chooses to limit the amount of personal information that its registrar of record makes available to the public via a Whois query of their database. To do so, a registered name holder generally uses a privacy or proxy registration service. For the purpose of this study, the definitions of privacy and proxy services, as they relate to their use in the domain name system, are as follows: A privacy service provider offers the registrant an opportunity to register a domain name while concealing some personal identifying information listed in a WHOIS directory, such as his or her address, telephone number, or email address, by providing alternate contact information, often that of the privacy service provider. A proxy service provider registers the domain name on the registrant’s behalf and then licenses the use of the domain name to the registrant. The contact information in a WHOIS directory for a domain name registered with a proxy service is that of the proxy service provider. There may be an intentional use of the other definitions that I am not aware of but I feel we should provide an extremely clear definition of each term since they are currently used interchangeably in the marketplace. Susan Susan Kawaguchi Domain Name Manager Facebook Inc. 1601 California Avenue Palo Alto, CA Phone - 650 485-6064 Cell - 650 387 3904 Please note my email address has changed to skawaguchi(a)fb.com<mailto:skawaguchi@fb.com> NOTICE: This email (including any attachments) may contain information that is private, confidential, or protected by attorney-client or other privilege. Unless you are the intended recipient, you may not use, copy, or retransmit the email or its contents.

1 0

Updated Policy Chapter
by Kathy Kleiman Nov. 28, 2011

Nov. 28, 2011

Hi All, I want to share a re-written policy chapter. I read the Executive Summary for inspiration (it has such a good tone) and revised the policy chapter to flow with the rest of the report. It now has a fuller discussion of thin and thick registries, registrar agreement sections, as well as a section called 4 Consensus Policies and One Consensus Procedure. Many, many thanks to the small group that reviewed this chapter so quickly last night, and sent back edits and proofing. It is much better thanks to your editing input! I hope you find this chapter interesting and useful. Best, Kathy --

2 1

Re: [Rt4-whois] Proxy provider recommendation 112311 susan draft(2).doc [SEC=UNCLASSIFIED]
by Smith, Bill Nov. 28, 2011

Nov. 28, 2011

Eminently reasonable. I really don't know how to "resolve" this issue, but I am strongly drawn to the simpler text we had agreed to in Dakar, as Emily recently suggested. This may be the best we can hope for given the complexity and messiness of the issue. In my opinion, it also happens to address the issues, as we understand them, from those wishing to "protect" themselves. It may not be perfect but it handles most of the cases we identified. Moving from the current (complex) state to a (simpler) state we might recommend will likely take time and may be difficult. On Nov 25, 2011, at 9:01 AM, Seth M Reiss wrote: I find myself closely aligned with Peter ‘s thoughts and analysis. I prefer the simplicity of what I thought we had agreed to in Dakar as well as how that model promoted the underlying interests that we were concerned with: (1) protecting individual’s privacy particularly in those countries that had legal regimes that implicate WHOIS data appear to require such protection; and (2) not permitting registrants or proxy services to avoid WHOIS accountability without justification and without significant risk. While I appreciate that there is a concern on the part of members of our Team to acknowledge the proxy industry and regulate it, I am not persuaded that the AOC mandate requires that we accommodate existing interests simply because they exist. My other concern is that what I will term the more “involved solution” does not appear to be going in a direction that is likely to reach consensus. It seems we are mixing privacy and proxy again or at least treating them too much alike, and I think this is something that has plagued the privacy/proxy debate from day one. I have a rather large project this weekend that keeps my away from a computer and means that I am not keeping up with the emails. Meanwhile, I did want to let all you know my perspective. I will of course work with the direction the group decides to go, and I will be checking my emails in the late evening to determine what direction that is. Good luck! Seth From: rt4-whois-bounces(a)icann.org<mailto:rt4-whois-bounces@icann.org> [mailto:rt4-whois-bounces@icann.org] On Behalf Of Kathy Kleiman Sent: Friday, November 25, 2011 6:04 AM To: rt4-whois(a)icann.org<mailto:rt4-whois@icann.org> Subject: Re: [Rt4-whois] Proxy provider recommendation 112311 susan draft(2).doc [SEC=UNCLASSIFIED] Peter, You email below is eloquent, and I urge everyone to read it. We really have to wrestle with these issues, and quickly. I truly wish we had more information, and note there are two very complex studies now taking place in the GNSO right now because the community, as a whole, felt it needed much more information in this area. It is a confusing one! I share the concerns that Peter is raising, but from a somewhat different perspective. If we are "blessing" the existence of proxy and privacy services, then I think we need to make it very clear *to registrants* what is happening. E.g., From a registrant perspective: - when is their name going to be disclosed (privacy service), - when do they have legal liability (privacy service), - when is someone else the "owner" of their domain name (proxy service). I submitted some changes consistent with this goal of the most basic education and information. I think we have to be very, very clear because, from the perspective of .ORG political groups, for example, people's lives may be on the line. Best, Kathy : Thanks Emily, that’s very useful, and I think I understand where its coming from. I have a few follow on questions, as I’m trying to understand the big picture/strategy, and to try to work through the new proposal fully as this is a key area of interest for me. To be honest, I’m a bit nervous about reopening such a major issue so late in the piece, with only limited time to think through and discuss all the implications. That said, I’m not opposed, just cautious. In terms of questions: is the intention to retain our ‘privacy’ recommendations from Dakar? i.e. so that we would in effect have three different arrangements: i.e. privacy, ‘known’ proxies, and ‘unknown’ proxies? I ask this because if we are to recommend the establishment of parallel ‘known proxy’ and ‘privacy’ regimes, we would need to clearly explain and justify any differences between the two (I note that many of the recommendations we agreed for privacy services have been adopted for the proposed proxy recommendations). I expect that a key question we would face is why we were advocating for two different types of privacy-related services? In what circumstances are privacy services not sufficient? Understanding the reason for this may address some of my concerns. Separate to the question of privacy services, we also need to consider the implications of endorsing proxy services. In Dakar, we discussed at length the risks of ICANN explicitly acknowledging (and effectively endorsing) the practice of completely limiting access to a registrant’s identity. I had thought that was one of the reasons why we agreed that ICANN should not endorse this practice, and instead that we would argue that: • the full rights and responsibilities of the registrant should accrue to the registered name holder; and • ICANN should endorse and regulate ‘privacy’ services which could limit the availability of sensitive personal data, without completely obfuscating the registrant’s identity. This approach seemed to address the privacy concerns expressed by a range of stakeholders, and to clarify (perhaps for the first time) the chain of contractual rights and responsibilities. Much of this revolves around the question of whether tighter regulation of proxies is needed, or whether simply removing the endorsement and clarifying the chain of legal responsibilities would be more effective. In effect, the new proposal is to advocate the replacement of one mechanism which attempts to regulate proxies (i.e. the current RAA provisions) with another. The intent is obviously to have a tighter set of regulations this time, to reduce gaming/abuse etc. At one level this seems logical, but I am concerned that by introducing doubt into the chain of rights and responsibilities, anything we then do will be like trying to patch a leak that we in effect created. Given that both previous versions of the RAA have tried the endorsement/regulation route with very limited success, I think we would need a strong case to propose a third attempt at this approach as the best way to go. Do we think that this is something we can achieve in practice, and why is it better than the simpler alternative? I hope I’m not making this unnecessarily complicated – I just want to make sure that we don’t make a rushed change that has not been fully discussed. I look forward to the views of other team members on this issue. Cheers, Peter From: Emily Taylor [mailto:emily@emilytaylor.eu] Sent: Thursday, 24 November 2011 8:30 PM To: Nettlefold, Peter Cc: Susan Kawaguchi; rt4-whois(a)icann.org<mailto:rt4-whois@icann.org> Subject: Re: [Rt4-whois] Proxy provider recommendation 112311 susan draft(2).doc [SEC=UNCLASSIFIED] Hi Peter As it's Thanksgiving, our US colleagues will (should) be offline for a couple of days. My understanding from last night's call is that our proposal is to combine these proxy recommendations with the ones from Dakar. In other words, instead of saying "we never acknowledge proxies" we say this. Susan explained that they are currently working on defining what is meant by a proxy, and as you rightly point out there are different flavours of proxy. There is the "deep" arrangement based on an ongoing trusting relationship (eg solicitor, client) where a proxy might not be obvious. My understanding is that we're not attempting to lift the veil on these. They are not viewed as problematic. What is viewed as within the ambit of these new draft recommendations are the higher volume, commercialised proxy services, where there is not really a pre-existing relationship between registrant and proxy provider, but this is a low cost add on at the point of registration. The two parties don't really know each other that well. These are the ones we're hoping to describe in our definitions, and they are the target of these recommendations. I hope that this makes it clear, but obviously I do recommend you listen to Susan's description of their thinking from the audio when it's up. Thanks Emily On 24 November 2011 02:32, Nettlefold, Peter <Peter.Nettlefold(a)dbcde.gov.au<mailto:Peter.Nettlefold@dbcde.gov.au>> wrote: Hi Susan and all, Thanks very much to all who worked on this new series of recommendations. I’m sorry I missed the teleconference this morning, but just wanted to see if I understand this proposal correctly. In short, is this a supplement to the position we agreed in Dakar? i.e. will the situation generally be that the registered name holder assumes all rights and responsibilities (as we discussed in Dakar), but in a special subset of cases (i.e. where the registrar clearly knows that a ‘proxy’ is being used) then some special rules apply? Or to put it another way, will we be recommending that there should be special new rules for ‘known’ proxies (however defined), and in all other cases we do not acknowledge proxies? I’m sorry if this was discussed this morning, but I’m just trying to understand the position. As there isn’t a recording up yet that I’ve seen, any advice on whether other team members have already commented on this would be appreciated. Cheers, Peter From: rt4-whois-bounces(a)icann.org<mailto:rt4-whois-bounces@icann.org> [mailto:rt4-whois-bounces@icann.org<mailto:rt4-whois-bounces@icann.org>] On Behalf Of Susan Kawaguchi Sent: Thursday, 24 November 2011 6:18 AM To: rt4-whois(a)icann.org<mailto:rt4-whois@icann.org> Subject: [Rt4-whois] Proxy provider recommendation 112311 susan draft(2).doc Hello All, I apologize for the delay in sending this and that it is still in rough draft. The attached document contains Kathy’s revisions and comments to my original proposed recommendation. I have added proposed definitions for the terms we are struggling with. These came out of discussions between James and I. I feel that we must provide a clear recommendation on the proxy issue but I personally seem to keep moving towards drafting policy. I am hoping we will have time to discuss on the call today as I have several questions for the team. Susan ------------------------------------------------------------------------------- NOTICE: This email message is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message. This message has been content scanned by the Axway MailGate. MailGate uses policy enforcement to scan for known viruses, spam, undesirable content and malicious code. For more information on Axway products please visit www.axway.com<http://www.axway.com>. ------------------------------------------------------------------------------- _______________________________________________ Rt4-whois mailing list Rt4-whois(a)icann.org<mailto:Rt4-whois@icann.org> https://mm.icann.org/mailman/listinfo/rt4-whois -- <image001.jpg> 76 Temple Road, Oxford OX4 2EZ UK t: +44 (0)1865 582 811 • m: +44 (0)7540 049 322 emily(a)emilytaylor.eu<mailto:emily@emilytaylor.eu> www.etlaw.co.uk<http://www.etlaw.co.uk> Emily Taylor Consultancy Limited is a company registered in England and Wales No. 730471. VAT No. 114487713. ------------------------------------------------------------------------------- NOTICE: This email message is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message. This message has been content scanned by the Axway MailGate. MailGate uses policy enforcement to scan for known viruses, spam, undesirable content and malicious code. For more information on Axway products please visit www.axway.com<http://www.axway.com>. ------------------------------------------------------------------------------- _______________________________________________ Rt4-whois mailing list Rt4-whois(a)icann.org<mailto:Rt4-whois@icann.org> https://mm.icann.org/mailman/listinfo/rt4-whois -- _______________________________________________ Rt4-whois mailing list Rt4-whois(a)icann.org<mailto:Rt4-whois@icann.org> https://mm.icann.org/mailman/listinfo/rt4-whois

1 0

Newest version of our Reprt
by Kathy Kleiman Nov. 28, 2011

Nov. 28, 2011

Dear All, I hope you had a great weekend, and a good holiday. In the background, I see many groups working, exchanging email, and talking. Tx you! Emily and I have been talking on a daily basis to massage the report into shape, and she, I would like to share and wanted to share the most up-to-date version of our edited report./*Alice, could you kindly post this to our Wiki?*/ Quick notes; - report follows editing format we we agreed on Wednesday -- not using track changes, but instead a format that keeps all the text within the report to show the proposed changes: e.g., [KK Add: ] [KK Delete: ]. - chapter breaks, titles, and material rearranged a bit into a different order. It's all still there! Lynn's chapter, Sarmad's chapter, all given prominence in new chapters - More and bolded subtitles, etc., to make the document easier to scan Longer note: Emily, Peter and I have worked this weekend on the Gap Analysis, and breaking it into two chapters. Please note that Chapters 7/8 are not updated in the current draft -- and we'll be circulating a proposed draft within the day. All the best and enjoy, Kathy --

2 2

Re: [Rt4-whois] Newest version of our Reprt
by lynn＠goodsecurityconsulting.com Nov. 28, 2011

Nov. 28, 2011

1 0

Re: [Rt4-whois] A word on proxies
by James M. Bladel Nov. 28, 2011

Nov. 28, 2011

1 0

Re: [Rt4-whois] A word on proxies
by James M. Bladel Nov. 28, 2011

Nov. 28, 2011

2 1

Re: [Rt4-whois] Proxy provider recommendation 112311 susan draft(2).doc [SEC=UNCLASSIFIED]
by Nettlefold, Peter Nov. 28, 2011

Nov. 28, 2011

Hello all, Thanks to Susan and Seth for keeping this important conversation moving. It seems clear that this is one of the most difficult parts of our report, in part because we are having to consider and balance two important, high-profile and sometimes conflicting needs. I've put comments directly into your email Susan, in a different font and colour, to try to explain my thinking on your points. I've tried to do this as simply and clearly as possible, and hope that by being so direct we can get closer to the heart of the issue. I hope this explains where I'm coming from, and helps to move this conversation forward. Cheers, Peter From: Seth M Reiss [mailto:seth.reiss@lex-ip.com] Sent: Sunday, 27 November 2011 3:41 AM To: 'Susan Kawaguchi'; Nettlefold, Peter; 'Emily Taylor' Cc: rt4-whois(a)icann.org Subject: RE: [Rt4-whois] Proxy provider recommendation 112311 susan draft(2).doc [SEC=UNCLASSIFIED] Susan If the chain of legal responsibilities were clarified, don't you think there would be an immediate chilling effect on the industry? Only those registrars willing to go out of business as a result of entering into a retail proxy relationship with a naughty registrant would continue the retail proxy practice. The responsible ones I would expect to stop the practice. Seth From: rt4-whois-bounces(a)icann.org [mailto:rt4-whois-bounces@icann.org] On Behalf Of Susan Kawaguchi Sent: Friday, November 25, 2011 7:24 PM To: Nettlefold, Peter; Emily Taylor Cc: rt4-whois(a)icann.org Subject: Re: [Rt4-whois] Proxy provider recommendation 112311 susan draft(2).doc [SEC=UNCLASSIFIED] Hello Peter, I am not proposing to change the privacy service recommendations although I did use language from the agreed upon recommendation since I thought it was a good place to start. Also I do not understand why there is concern with regulating proxy registrations and no concern with regulating privacy registrations. To my mind, in important ways these two types of services are quite distinct. In the case of a privacy service, it should be clear from the WHOIS record (inaccuracy aside) who is legally responsible for a domain from the outset. There should be no question as to finding a responsible entity on who to serve notice etc, as this data is not hidden/withheld with a privacy service. What a privacy service should instead do is restrict sensitive personal information about that responsible entity from general public availability. With a proxy service, in the current regime, the identity of the responsible entity is not clear, and it appears that this aspect has been gamed or otherwise abused. It is also not clear to me what the situation would be even if this were more tightly regulated. As soon as we say, 'you're responsible, except...', it seems that we risk some form of uncertainty, delay and gaming. If we want to do that, we would need to be very careful about how we address those risks. I did raise this before the November 9th call but was not able to participate on that call so I understand your concern that is this may appear last minute. II have given this so much thought over the last 6 months and you saw how uncomfortable I was with not addressing the proxy issues in our discussions in Dakar. My concern with the 'last minute' issue is not that it hasn't come up (I hope I didn't suggest that), and as you know I am very interested to make sure we get this right. It's just that we're discussing actual text very late in the piece - and again, I want to make sure we get it right. I simply do not feel that recommending to ICANN that they completely ignore the proxy issue is the way we should be proceeding. I don't think we're proposing that ICANN 'ignore' proxies. We all acknowledge that they will likely exist in one form or another regardless of what we do: the question is on what basis. In Dakar, we agreed that we would recommend that ICANN not only remove the current provisions which endorse proxies, but also make an affirmative statement to clarify the legal chain of responsibilities - i.e. from ICANN's point of view, the buck stops with the registered name holder. Rather than ignoring, I would see this as saying something like: 'if you're out there doing this, ICANN sees you as legally responsible'. My aim with this recommendation is to target the proxy services run by a registrar. They have a direct contractual relationship with ICANN. The argument that we do not understand all the contractual agreements involved in a proxy service makes sense for deeply integrated proxy services where the registrant and service have agreed upon contractual elements. The "retail" proxy service which is offered to anyone who will pay and agreed to the TOS for the most part are owned or controlled by a registrar. Although, we have to be careful to not try and regulate any other business the registrar may enter into the proxy service directly relates to the most critical information of the domain name registration which should be controlled by ICANN. I'm interested in whether a 'retail' proxy service would continue to offer the same sorts of service if they were held responsible for the domain. What would a registrar do if a domain they had registered in their own name was used for criminal purposes, and the RAA no longer explicitly offered the option of pointing the finger elsewhere, but instead affirmatively stated that they were responsible? The NORC study estimates that proxy registrations may be used in as much as 25% of the .com registrations. That is a significant number. Currently, several registrars run proxy services that are responsive and professional. GoDaddy is the gold standard from my experience. They have very well defined processes and when you run into a proxy registration that is a concern I know exactly what I have to do to request the information. The registrant is protected but if they are acting badly then there is a standardized process for receiving the website owners information. Below I pulled out from your email "Much of this revolves around the question of whether tighter regulation of proxies is needed, or whether simply removing the endorsement and clarifying the chain of legal responsibilities would be more effective." Clarifying the chain of legal responsibilities leaves little recourse for someone impacted by a domain name serving content with a proxy service registration on the WHOIS. If the proxy service provider does not want to reveal the information ( as many refuse to do now) then the only recourse is to file litigation against the proxy service provider. If we went ahead with our Dakar recommendations, I expect that filing against the registered name holder would be the first action instead of the last recourse. Then when the WHOIS record changes midstream, they are forced to go back to court to amend the complaint. It is extremely burdensome and expensive. Would this still be the case? If ICANN clarified that the responsible entity was the registered name holder, and removed any caveats etc, what would be the basis for changing the WHOIS record midstream? There has been some litigation that has held the proxy service provider legally responsible but nothing that has had a chilling effect on the industry. If in the current ambiguous contractual environment some proxy service providers have been held legally responsible, wouldn't what we have proposed significantly increase the likelihood of that? Wouldn't this in turn have a flow on 'chilling' effect on the use of proxies? I cannot open James document on my laptop but once I have a copy I will review his latest revisions. Best regards, Susan From: Nettlefold, Peter [mailto:Peter.Nettlefold@dbcde.gov.au] Sent: Thursday, November 24, 2011 9:59 PM To: Emily Taylor Cc: Susan Kawaguchi; rt4-whois(a)icann.org Subject: RE: [Rt4-whois] Proxy provider recommendation 112311 susan draft(2).doc [SEC=UNCLASSIFIED] Thanks Emily, that's very useful, and I think I understand where its coming from. I have a few follow on questions, as I'm trying to understand the big picture/strategy, and to try to work through the new proposal fully as this is a key area of interest for me. To be honest, I'm a bit nervous about reopening such a major issue so late in the piece, with only limited time to think through and discuss all the implications. That said, I'm not opposed, just cautious. In terms of questions: is the intention to retain our 'privacy' recommendations from Dakar? i.e. so that we would in effect have three different arrangements: i.e. privacy, 'known' proxies, and 'unknown' proxies? I ask this because if we are to recommend the establishment of parallel 'known proxy' and 'privacy' regimes, we would need to clearly explain and justify any differences between the two (I note that many of the recommendations we agreed for privacy services have been adopted for the proposed proxy recommendations). I expect that a key question we would face is why we were advocating for two different types of privacy-related services? In what circumstances are privacy services not sufficient? Understanding the reason for this may address some of my concerns. Separate to the question of privacy services, we also need to consider the implications of endorsing proxy services. In Dakar, we discussed at length the risks of ICANN explicitly acknowledging (and effectively endorsing) the practice of completely limiting access to a registrant's identity. I had thought that was one of the reasons why we agreed that ICANN should not endorse this practice, and instead that we would argue that: * the full rights and responsibilities of the registrant should accrue to the registered name holder; and * ICANN should endorse and regulate 'privacy' services which could limit the availability of sensitive personal data, without completely obfuscating the registrant's identity. This approach seemed to address the privacy concerns expressed by a range of stakeholders, and to clarify (perhaps for the first time) the chain of contractual rights and responsibilities. Much of this revolves around the question of whether tighter regulation of proxies is needed, or whether simply removing the endorsement and clarifying the chain of legal responsibilities would be more effective. In effect, the new proposal is to advocate the replacement of one mechanism which attempts to regulate proxies (i.e. the current RAA provisions) with another. The intent is obviously to have a tighter set of regulations this time, to reduce gaming/abuse etc. At one level this seems logical, but I am concerned that by introducing doubt into the chain of rights and responsibilities, anything we then do will be like trying to patch a leak that we in effect created. Given that both previous versions of the RAA have tried the endorsement/regulation route with very limited success, I think we would need a strong case to propose a third attempt at this approach as the best way to go. Do we think that this is something we can achieve in practice, and why is it better than the simpler alternative? I hope I'm not making this unnecessarily complicated - I just want to make sure that we don't make a rushed change that has not been fully discussed. I look forward to the views of other team members on this issue. Cheers, Peter From: Emily Taylor [mailto:emily@emilytaylor.eu] Sent: Thursday, 24 November 2011 8:30 PM To: Nettlefold, Peter Cc: Susan Kawaguchi; rt4-whois(a)icann.org Subject: Re: [Rt4-whois] Proxy provider recommendation 112311 susan draft(2).doc [SEC=UNCLASSIFIED] Hi Peter As it's Thanksgiving, our US colleagues will (should) be offline for a couple of days. My understanding from last night's call is that our proposal is to combine these proxy recommendations with the ones from Dakar. In other words, instead of saying "we never acknowledge proxies" we say this. Susan explained that they are currently working on defining what is meant by a proxy, and as you rightly point out there are different flavours of proxy. There is the "deep" arrangement based on an ongoing trusting relationship (eg solicitor, client) where a proxy might not be obvious. My understanding is that we're not attempting to lift the veil on these. They are not viewed as problematic. What is viewed as within the ambit of these new draft recommendations are the higher volume, commercialised proxy services, where there is not really a pre-existing relationship between registrant and proxy provider, but this is a low cost add on at the point of registration. The two parties don't really know each other that well. These are the ones we're hoping to describe in our definitions, and they are the target of these recommendations. I hope that this makes it clear, but obviously I do recommend you listen to Susan's description of their thinking from the audio when it's up. Thanks Emily On 24 November 2011 02:32, Nettlefold, Peter <Peter.Nettlefold(a)dbcde.gov.au<mailto:Peter.Nettlefold@dbcde.gov.au>> wrote: Hi Susan and all, Thanks very much to all who worked on this new series of recommendations. I'm sorry I missed the teleconference this morning, but just wanted to see if I understand this proposal correctly. In short, is this a supplement to the position we agreed in Dakar? i.e. will the situation generally be that the registered name holder assumes all rights and responsibilities (as we discussed in Dakar), but in a special subset of cases (i.e. where the registrar clearly knows that a 'proxy' is being used) then some special rules apply? Or to put it another way, will we be recommending that there should be special new rules for 'known' proxies (however defined), and in all other cases we do not acknowledge proxies? I'm sorry if this was discussed this morning, but I'm just trying to understand the position. As there isn't a recording up yet that I've seen, any advice on whether other team members have already commented on this would be appreciated. Cheers, Peter From: rt4-whois-bounces(a)icann.org<mailto:rt4-whois-bounces@icann.org> [mailto:rt4-whois-bounces@icann.org<mailto:rt4-whois-bounces@icann.org>] On Behalf Of Susan Kawaguchi Sent: Thursday, 24 November 2011 6:18 AM To: rt4-whois(a)icann.org<mailto:rt4-whois@icann.org> Subject: [Rt4-whois] Proxy provider recommendation 112311 susan draft(2).doc Hello All, I apologize for the delay in sending this and that it is still in rough draft. The attached document contains Kathy's revisions and comments to my original proposed recommendation. I have added proposed definitions for the terms we are struggling with. These came out of discussions between James and I. I feel that we must provide a clear recommendation on the proxy issue but I personally seem to keep moving towards drafting policy. I am hoping we will have time to discuss on the call today as I have several questions for the team. Susan ------------------------------------------------------------------------------- NOTICE: This email message is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message. This message has been content scanned by the Axway MailGate. MailGate uses policy enforcement to scan for known viruses, spam, undesirable content and malicious code. For more information on Axway products please visit www.axway.com<http://www.axway.com>. ------------------------------------------------------------------------------- _______________________________________________ Rt4-whois mailing list Rt4-whois(a)icann.org<mailto:Rt4-whois@icann.org> https://mm.icann.org/mailman/listinfo/rt4-whois -- [cid:image001.jpg@01CCADAE.162FAE00] 76 Temple Road, Oxford OX4 2EZ UK t: +44 (0)1865 582 811 * m: +44 (0)7540 049 322 emily(a)emilytaylor.eu<mailto:emily@emilytaylor.eu> www.etlaw.co.uk<http://www.etlaw.co.uk> Emily Taylor Consultancy Limited is a company registered in England and Wales No. 730471. VAT No. 114487713. ------------------------------------------------------------------------------- NOTICE: This email message is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message. This message has been content scanned by the Axway MailGate. MailGate uses policy enforcement to scan for known viruses, spam, undesirable content and malicious code. For more information on Axway products please visit www.axway.com. ------------------------------------------------------------------------------- ------------------------------------------------------------------------------- NOTICE: This email message is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message. This message has been content scanned by the Axway MailGate. MailGate uses policy enforcement to scan for known viruses, spam, undesirable content and malicious code. For more information on Axway products please visit www.axway.com. -------------------------------------------------------------------------------

2 3

Re: [Rt4-whois] A word on proxies
by lynn＠goodsecurityconsulting.com Nov. 27, 2011

Nov. 27, 2011

1 0

Compliance recommendations
by Emily Taylor Nov. 27, 2011

Nov. 27, 2011

Hi all On reading the draft report through, I think I've over-edited the compliance text, and would like to bring one or two of the recommendations and text back in to the main body. I would not alter the language of the recommendations which have been around since July, and were most recently considered in the call before last as part of the letter to Compliance. James has rightly noted that there are a couple which should be policy recommendations (eg the ones about the WHOIS Data Reminder Policy not being effective and needing review). So, I'm going to send out some renewed text on this, and highlight the recommendations that should go in (very few). Before I do this, can I hear any screams of protest please? Kind regards Emily -- * * 76 Temple Road, Oxford OX4 2EZ UK t: +44 (0)1865 582 811 • m: +44 (0)7540 049 322 emily(a)emilytaylor.eu *www.etlaw.co.uk* Emily Taylor Consultancy Limited is a company registered in England and Wales No. 730471. VAT No. 114487713.

1 0

A word on proxies
by Emily Taylor Nov. 27, 2011

Nov. 27, 2011

Hi all I've been following the exchanges with interest. On proxies, our default position should be what we agreed in Dakar. We all (including Susan) agreed those recommendations, despite virtually everyone having reservations on some of the issues. James and Susan (and latterly Kathy) were tasked to see whether they could agree additional text on proxies, and agreement wasn't possible. To me, this indicates that we have pushed the consensus as far as it can go at this stage. I think that we could add a paragraph in our findings to say that we wrestled with the issue of proxies, and set out a summary of both positions (ie concern that it will just be continuation of what we have; vs concern about bringing in an regulating non-contracted parties). We should definitely label this as one to watch, and an area where the community should build up good practices voluntarily. We welcome the study/work/whatever on reveal and relay, and anticipate that it will highlight many of the issues that we have encountered about patchy standards amongst commercial proxy providers: from gold standard (eg Domains by Proxy, [ others? Moniker?]) to others such as Above.com (an ICANN accredited registrar) which does not reveal until after UDRP or other proceedings have started, and has been found against in over 100 UDRP cases. It is an area where improved standards are necessary to promote consumer trust, and we look to the industry initially to work on these. The next WHOIS Review will have more information (ie the outcome of many of the studies which are just started now), and will be able to evaluate how well the industry has done. Susan - I appreciate, and share many of your concerns. However, we committed to a hard-won consensus on this issue in Dakar. You have rightly explored whether it's possible to do more, and it isn't at this stage. You can see from the responses of others in the group (eg Seth, Peter) that the preservation of our consensus is the most important thing at this stage of our study. I hope you will recognise how much we have achieved in this regard. Reading the draft report as a whole, I feel very proud of all of our work, and our teamwork. Kind regards Emily -- * * 76 Temple Road, Oxford OX4 2EZ UK t: +44 (0)1865 582 811 • m: +44 (0)7540 049 322 emily(a)emilytaylor.eu *www.etlaw.co.uk* Emily Taylor Consultancy Limited is a company registered in England and Wales No. 730471. VAT No. 114487713.

1 0

Proxy provider recommendation 112311 susan draft(2).doc
by Susan Kawaguchi Nov. 26, 2011

Nov. 26, 2011

Hello All, I apologize for the delay in sending this and that it is still in rough draft. The attached document contains Kathy's revisions and comments to my original proposed recommendation. I have added proposed definitions for the terms we are struggling with. These came out of discussions between James and I. I feel that we must provide a clear recommendation on the proxy issue but I personally seem to keep moving towards drafting policy. I am hoping we will have time to discuss on the call today as I have several questions for the team. Susan

5 7

Re: [Rt4-whois] Proxy provider recommendation 112311 susan draft(2).doc [SEC=UNCLASSIFIED]
by James M. Bladel Nov. 25, 2011

Nov. 25, 2011

3 2

Re: [Rt4-whois] Thoughts/edits on the Full Report
by lynn＠goodsecurityconsulting.com Nov. 25, 2011

Nov. 25, 2011

1 0

Re: [Rt4-whois] Proxy provider recommendation 112311 susan draft(2).doc [SEC=UNCLASSIFIED]
by Nettlefold, Peter Nov. 25, 2011

Nov. 25, 2011

Classification: UNCLASSIFIED Hi all Like Seth, I will be monitoring emails periodically through the weekend and will send comments as I can. Cheers Peter From: Seth M Reiss [mailto:seth.reiss@lex-ip.com] Sent: Saturday, November 26, 2011 04:01 AM To: 'Kathy Kleiman' <kathy(a)kathykleiman.com>; rt4-whois(a)icann.org <rt4-whois(a)icann.org> Subject: Re: [Rt4-whois] Proxy provider recommendation 112311 susan draft(2).doc [SEC=UNCLASSIFIED] I find myself closely aligned with Peter ‘s thoughts and analysis. I prefer the simplicity of what I thought we had agreed to in Dakar as well as how that model promoted the underlying interests that we were concerned with: (1) protecting individual’s privacy particularly in those countries that had legal regimes that implicate WHOIS data appear to require such protection; and (2) not permitting registrants or proxy services to avoid WHOIS accountability without justification and without significant risk. While I appreciate that there is a concern on the part of members of our Team to acknowledge the proxy industry and regulate it, I am not persuaded that the AOC mandate requires that we accommodate existing interests simply because they exist. My other concern is that what I will term the more “involved solution” does not appear to be going in a direction that is likely to reach consensus. It seems we are mixing privacy and proxy again or at least treating them too much alike, and I think this is something that has plagued the privacy/proxy debate from day one. I have a rather large project this weekend that keeps my away from a computer and means that I am not keeping up with the emails. Meanwhile, I did want to let all you know my perspective. I will of course work with the direction the group decides to go, and I will be checking my emails in the late evening to determine what direction that is. Good luck! Seth From: rt4-whois-bounces(a)icann.org [mailto:rt4-whois-bounces@icann.org] On Behalf Of Kathy Kleiman Sent: Friday, November 25, 2011 6:04 AM To: rt4-whois(a)icann.org Subject: Re: [Rt4-whois] Proxy provider recommendation 112311 susan draft(2).doc [SEC=UNCLASSIFIED] Peter, You email below is eloquent, and I urge everyone to read it. We really have to wrestle with these issues, and quickly. I truly wish we had more information, and note there are two very complex studies now taking place in the GNSO right now because the community, as a whole, felt it needed much more information in this area. It is a confusing one! I share the concerns that Peter is raising, but from a somewhat different perspective. If we are "blessing" the existence of proxy and privacy services, then I think we need to make it very clear *to registrants* what is happening. E.g., From a registrant perspective: - when is their name going to be disclosed (privacy service), - when do they have legal liability (privacy service), - when is someone else the "owner" of their domain name (proxy service). I submitted some changes consistent with this goal of the most basic education and information. I think we have to be very, very clear because, from the perspective of .ORG political groups, for example, people's lives may be on the line. Best, Kathy : Thanks Emily, that’s very useful, and I think I understand where its coming from. I have a few follow on questions, as I’m trying to understand the big picture/strategy, and to try to work through the new proposal fully as this is a key area of interest for me. To be honest, I’m a bit nervous about reopening such a major issue so late in the piece, with only limited time to think through and discuss all the implications. That said, I’m not opposed, just cautious. In terms of questions: is the intention to retain our ‘privacy’ recommendations from Dakar? i.e. so that we would in effect have three different arrangements: i.e. privacy, ‘known’ proxies, and ‘unknown’ proxies? I ask this because if we are to recommend the establishment of parallel ‘known proxy’ and ‘privacy’ regimes, we would need to clearly explain and justify any differences between the two (I note that many of the recommendations we agreed for privacy services have been adopted for the proposed proxy recommendations). I expect that a key question we would face is why we were advocating for two different types of privacy-related services? In what circumstances are privacy services not sufficient? Understanding the reason for this may address some of my concerns. Separate to the question of privacy services, we also need to consider the implications of endorsing proxy services. In Dakar, we discussed at length the risks of ICANN explicitly acknowledging (and effectively endorsing) the practice of completely limiting access to a registrant’s identity. I had thought that was one of the reasons why we agreed that ICANN should not endorse this practice, and instead that we would argue that: · the full rights and responsibilities of the registrant should accrue to the registered name holder; and · ICANN should endorse and regulate ‘privacy’ services which could limit the availability of sensitive personal data, without completely obfuscating the registrant’s identity. This approach seemed to address the privacy concerns expressed by a range of stakeholders, and to clarify (perhaps for the first time) the chain of contractual rights and responsibilities. Much of this revolves around the question of whether tighter regulation of proxies is needed, or whether simply removing the endorsement and clarifying the chain of legal responsibilities would be more effective. In effect, the new proposal is to advocate the replacement of one mechanism which attempts to regulate proxies (i.e. the current RAA provisions) with another. The intent is obviously to have a tighter set of regulations this time, to reduce gaming/abuse etc. At one level this seems logical, but I am concerned that by introducing doubt into the chain of rights and responsibilities, anything we then do will be like trying to patch a leak that we in effect created. Given that both previous versions of the RAA have tried the endorsement/regulation route with very limited success, I think we would need a strong case to propose a third attempt at this approach as the best way to go. Do we think that this is something we can achieve in practice, and why is it better than the simpler alternative? I hope I’m not making this unnecessarily complicated – I just want to make sure that we don’t make a rushed change that has not been fully discussed. I look forward to the views of other team members on this issue. Cheers, Peter From: Emily Taylor [mailto:emily@emilytaylor.eu] Sent: Thursday, 24 November 2011 8:30 PM To: Nettlefold, Peter Cc: Susan Kawaguchi; rt4-whois(a)icann.org<mailto:rt4-whois@icann.org> Subject: Re: [Rt4-whois] Proxy provider recommendation 112311 susan draft(2).doc [SEC=UNCLASSIFIED] Hi Peter As it's Thanksgiving, our US colleagues will (should) be offline for a couple of days. My understanding from last night's call is that our proposal is to combine these proxy recommendations with the ones from Dakar. In other words, instead of saying "we never acknowledge proxies" we say this. Susan explained that they are currently working on defining what is meant by a proxy, and as you rightly point out there are different flavours of proxy. There is the "deep" arrangement based on an ongoing trusting relationship (eg solicitor, client) where a proxy might not be obvious. My understanding is that we're not attempting to lift the veil on these. They are not viewed as problematic. What is viewed as within the ambit of these new draft recommendations are the higher volume, commercialised proxy services, where there is not really a pre-existing relationship between registrant and proxy provider, but this is a low cost add on at the point of registration. The two parties don't really know each other that well. These are the ones we're hoping to describe in our definitions, and they are the target of these recommendations. I hope that this makes it clear, but obviously I do recommend you listen to Susan's description of their thinking from the audio when it's up. Thanks Emily On 24 November 2011 02:32, Nettlefold, Peter <Peter.Nettlefold(a)dbcde.gov.au<mailto:Peter.Nettlefold@dbcde.gov.au>> wrote: Hi Susan and all, Thanks very much to all who worked on this new series of recommendations. I’m sorry I missed the teleconference this morning, but just wanted to see if I understand this proposal correctly. In short, is this a supplement to the position we agreed in Dakar? i.e. will the situation generally be that the registered name holder assumes all rights and responsibilities (as we discussed in Dakar), but in a special subset of cases (i.e. where the registrar clearly knows that a ‘proxy’ is being used) then some special rules apply? Or to put it another way, will we be recommending that there should be special new rules for ‘known’ proxies (however defined), and in all other cases we do not acknowledge proxies? I’m sorry if this was discussed this morning, but I’m just trying to understand the position. As there isn’t a recording up yet that I’ve seen, any advice on whether other team members have already commented on this would be appreciated. Cheers, Peter From: rt4-whois-bounces(a)icann.org<mailto:rt4-whois-bounces@icann.org> [mailto:rt4-whois-bounces@icann.org<mailto:rt4-whois-bounces@icann.org>] On Behalf Of Susan Kawaguchi Sent: Thursday, 24 November 2011 6:18 AM To: rt4-whois(a)icann.org<mailto:rt4-whois@icann.org> Subject: [Rt4-whois] Proxy provider recommendation 112311 susan draft(2).doc Hello All, I apologize for the delay in sending this and that it is still in rough draft. The attached document contains Kathy’s revisions and comments to my original proposed recommendation. I have added proposed definitions for the terms we are struggling with. These came out of discussions between James and I. I feel that we must provide a clear recommendation on the proxy issue but I personally seem to keep moving towards drafting policy. I am hoping we will have time to discuss on the call today as I have several questions for the team. Susan ------------------------------------------------------------------------------- NOTICE: This email message is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message. This message has been content scanned by the Axway MailGate. MailGate uses policy enforcement to scan for known viruses, spam, undesirable content and malicious code. For more information on Axway products please visit www.axway.com<http://www.axway.com>. ------------------------------------------------------------------------------- _______________________________________________ Rt4-whois mailing list Rt4-whois(a)icann.org<mailto:Rt4-whois@icann.org> https://mm.icann.org/mailman/listinfo/rt4-whois -- [cid:image001.jpg@01CCAB3E.68F15430] 76 Temple Road, Oxford OX4 2EZ UK t: +44 (0)1865 582 811 • m: +44 (0)7540 049 322 emily(a)emilytaylor.eu<mailto:emily@emilytaylor.eu> www.etlaw.co.uk<http://www.etlaw.co.uk> Emily Taylor Consultancy Limited is a company registered in England and Wales No. 730471. VAT No. 114487713. ------------------------------------------------------------------------------- NOTICE: This email message is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message. This message has been content scanned by the Axway MailGate. MailGate uses policy enforcement to scan for known viruses, spam, undesirable content and malicious code. For more information on Axway products please visit www.axway.com<http://www.axway.com>. ------------------------------------------------------------------------------- _______________________________________________ Rt4-whois mailing list Rt4-whois(a)icann.org<mailto:Rt4-whois@icann.org> https://mm.icann.org/mailman/listinfo/rt4-whois -- ------------------------------------------------------------------------------- NOTICE: This email message is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message. This message has been content scanned by the Axway MailGate. MailGate uses policy enforcement to scan for known viruses, spam, undesirable content and malicious code. For more information on Axway products please visit www.axway.com. -------------------------------------------------------------------------------

1 0

Draft report + appendices - 25 Nov
by Alice Jansen Nov. 25, 2011

Nov. 25, 2011

Dear Review Team Members, Please find attached revised versions of the draft report and appendices document which reflect Emily's comments and the latest version of the policy report (circulated earlier today, thanks Kathy!). I believe these documents are up-to-date. The notebook layout should have disappeared now (if not, please let me know). Wiki link: https://community.icann.org/display/whoisreviewprivate/Draft+report Note that I have taken the liberty to add the ICANN glossary to the glossary appendix to get the ball rolling. Please feel free to delete terms you believe should not be there and to send me a list of those you would like to see in that section. Thanks in advance for your help. Have a nice weekend! Kind regards Alice -- Alice Jansen Assistant, Organizational Reviews 6 Rond Point Schuman, Bt.5 B-1040 Brussels Belgium Direct dial: +32 2 234 78 64 Mobile: +32 4 73 31 76 56 Skype: alice_jansen_icann

1 0

Thoughts/edits on the Full Report
by Kathy Kleiman Nov. 25, 2011

Nov. 25, 2011

Hi All, I wanted to share a running stream of edits as I review the full document: - I like it. I think all the elements are there! - We need to consolidate in interesting ways. - We need a flow --- a rearranged order to lay out a very clear picture of our work, research and analysis for new and older readers Specific ideas 1. Too many Definitions. I brought "5) WHOIS PARTICIPANTS: Data Producers; Data Controllers; Data Processors" into the Policy chapter and put it in a table. Recommendation: this section from the Definitions. 2. Remove Scope of Work, Section 7, as a section covering the same definitions above. 3. Relocate the Consumer Study to a later chapter, complete with its definitions (please see below). It deserves a home all its own, not stuck at the bottom of the Scope of Work Chapter. 4. Start a new page for every new chapter. 5. After Policy Chapter, keep the Compliance Chapter (as compliance flows from Policy). 6. After Policy Chapter, consider placing the IDN chapter. IDN issues are closely related to policy and compliance -- it's an existing policy issue complicated by translations and transcription problems. Then I would enter the "Study Part of the Report." Is Existing Policy serving the Legitimate Needs of LE and promoting consumer trust? Here I would recommend: 7. A Law Enforcement Chapter: with a write-up of Sharon's Law Enforcement study and its findings. Am I missing it within the text? 8. Include in LE Chapter the sections of Peter's current Gap Analysis extensively discussing input from Law Enforcement. 9. A Consumer Trust Chapter (following the order of the AOC, LE then CT), and include the full text of Lynn and Sharon's writeup right up including its Definitions. Now the Gap Analysis Part of the Report 10. Here Peter's Gap Analysis could flow. It already shows us how, based on all the above, we still have gaps, problems, concerns, etc. a. I like using the additional facts, discussions, Constituency thoughts, written comments, etc., to share insights and information. Could this be a bit more streamlined? b. Perhaps subtitles, some already there, can help readers track our gap analysis with the Recommendations that we wrote, e.g., proxy/privacy. Perhaps some Compliance and Policy Gap Analysis too (briefly to be inclusive). Appendices: Should my Methodology section hit the trash can? Best and take care, Kathy --

1 0

Re: [Rt4-whois] Proxy provider recommendation 112311 susan draft(2).doc [SEC=UNCLASSIFIED]
by James M. Bladel Nov. 25, 2011

Nov. 25, 2011

3 2

Re: [Rt4-whois] Proxy provider recommendation 112311 susan draft(2).doc [SEC=UNCLASSIFIED]
by James M. Bladel Nov. 25, 2011

Nov. 25, 2011

2 1

Re: [Rt4-whois] Centralized Whois Query system run by ICANN [SEC=UNCLASSIFIED]
by lynn＠goodsecurityconsulting.com Nov. 25, 2011

Nov. 25, 2011

2 1

Draft report - 24 Nov - please use this
by Alice Jansen Nov. 24, 2011

Nov. 24, 2011

Dear Review Team Members, First of all, Happy Thanksgiving to our US Members :-). May you enjoy this day with your loved ones (and the turkey)! Please find attached the following: * Appendices – V1 – 24 Nov * Draft report clean – 24 Nov As always, these documents are available at: https://community.icann.org/display/whoisreviewprivate/Draft+report Please make sure to read documents using print layout: Macs tend to switch to Notebook (unsure why but am looking into it). For any new edits, please use this version. Be kindly reminded to stop using track changes (per the decision reached during your call yesterday) and to insert your contribution directly into the text while making sure to add your initials and to highlight it (color code: yellow). You will find an example page 2 (thanks, Emily! :-)). Also, I have noticed this placeholder " The roles and responsibilities of contracted parties" in the Gap Analysis section and am unsure what it should entail and whether it still needs to be there. Could anyone enlighten me? It may have been superseded by later drafts… Thanks for your help, Kind regards Alice -- Alice Jansen Assistant, Organizational Reviews 6 Rond Point Schuman, Bt.5 B-1040 Brussels Belgium Direct dial: +32 2 234 78 64 Mobile: +32 4 73 31 76 56 Skype: alice_jansen_icann

2 1

Updated Exec Summary, and ideas for the clean, consolidated report.
by Emily Taylor Nov. 24, 2011

Nov. 24, 2011

Hi Alice, Hi All We had some to-ing and fro-ing on the Executive Summary, and the attachment dated 20 October is the latest version that I'm aware of. This is of the whole report, and is prone to misbehave/crash. So, I'm also attaching a clean copy with the changes accepted and Bill's request (that we acknowledge that WHOIS was done by default) taken in. As discussed on the latest call, I have highlighted additional text which I have put in. Some of this fills in place holders (eg the one describing our work), another section which was missing was some discussion of consumer trust. I have made a first attempt here. Alice - please can you add this version into your consolidated draft of the report. I also suggest that we get rid of the "notebook" format in Word. I find it difficult to work with, and am convinced that all it's weird formatting might be responsible for the instability that we're finding in the document. Alice - please would you also keep the appendices as a separate document for now, this will focus our attention on the core report in the coming days. Many thanks Emily ---------- Forwarded message ---------- From: Emily Taylor <emily(a)emilytaylor.eu> Date: 8 November 2011 17:54 Subject: Executive Summary To: "Smith, Bill" <bill.smith(a)paypal-inc.com>, Alice Jansen < alice.jansen(a)icann.org> Cc: Kathy Kleiman <kathy(a)kathykleiman.com>, lynn(a)goodsecurityconsulting.com, Sharon Lemon <sharonchallis(a)aol.com> Hi there Thanks for this - I've read it many times now, and love it. I started editing in the consolidated document posted on the private wiki, and it's crashed, corrupted and whatever. Anyway, tried to copy the content into a single file so that it's not too huge, but it died. Anyway, here's the whole report, with some suggested edits for the Exec Summary. I think the file might be dodgy so let me know if you can't open it. I think I agree with Sharon's original comment that (to a Brit at least) it reads quite emotionally. Over this side of the Atlantic, we are suspicious of emotion and immediately mistrust it. That's our hang up, not yours, but I did want to try and make the point so that we can reach as broad an audience as possible. Thanks Emily -- * * 76 Temple Road, Oxford OX4 2EZ UK t: +44 (0)1865 582 811 • m: +44 (0)7540 049 322 emily(a)emilytaylor.eu *www.etlaw.co.uk* Emily Taylor Consultancy Limited is a company registered in England and Wales No. 730471. VAT No. 114487713. -- * * 76 Temple Road, Oxford OX4 2EZ UK t: +44 (0)1865 582 811 • m: +44 (0)7540 049 322 emily(a)emilytaylor.eu *www.etlaw.co.uk* Emily Taylor Consultancy Limited is a company registered in England and Wales No. 730471. VAT No. 114487713.

1 0

Note Pod Content from WHOIS call - 23Nov2011
by Alice Jansen Nov. 24, 2011

Nov. 24, 2011

Dear Review Team Members, For your convenience, please find enclosed the note pod content of your call held on 9 November. Kindly note that these are draft notes and that Staff will create a preliminary report. Please be kindly reminded that conference call material is posted at: https://community.icann.org/display/whoisreview/Call+24+-+23+November+2011 Thanks, Kind regards Alice -- Alice Jansen Assistant, Organizational Reviews 6 Rond Point Schuman, Bt.5 B-1040 Brussels Belgium Direct dial: +32 2 234 78 64 Mobile: +32 4 73 31 76 56 Skype: alice_jansen_icann From: Alice Jansen <alice.jansen(a)icann.org<mailto:alice.jansen@icann.org>> Reply-To: Alice Jansen <alice.jansen(a)icann.org<mailto:alice.jansen@icann.org>> Date: Wed, 23 Nov 2011 13:36:26 -0800 To: Alice Jansen <alice.jansen(a)icann.org<mailto:alice.jansen@icann.org>> Subject: Adobe Connect - Note Pod Content from WHOIS-Review AGENDA * Roll-call & Apologies * Preliminary reports to adopt: Dakar meeting & 9 November conference call * Review IDN recommendations (Michael & Sarmad) * Sign-off the letter to compliance and discuss sending modalities * Review Emily's suggestions for cuts * Review and discuss James & Susan's proposals on Proxies * Discuss the thread on Thick/Thin or repository of WHOIS * Discuss any comments on the Policy section * Agree/discuss text on the consumer research (Lynn, Seth &Susan) * A.O.B PARTICIPANTS Lynn Goodendorf, Emily Taylor, Michael Yakushev, Sharon Lemon, Seth Reiss, Susan Kawaguchi, Kathy Kleiman, Lutz Donnerhacke, Bill Smith APOLOGIES James Bladel, Omar Kaminski, Olof Nordling NOTES 1. Dakar preliminary report - Adopted 2. Preliminary report 9 Nov - Adopted 3. Letter as appendix to report - no urgency to send the report. Finalize the draft report and letter. (SK) volunteered to provide comments on the letter by next Wednesday - Emily invites Members to submit their final comments. 4. Team thanks Michael and Sarmad. Susan: interest in recommendation 1 - would this fall within the category of PDP? Suggestions from Denise or ICANN Staff on most effective way to have recommendations implementation. Lynn -- for ICANN staff to figure out. Emily: we are addressing the Board - up to them to figure who to task to do what. We need to make sure we review the wording of recommendation. Let's not be specific and let the Board decide. Lynn: recommendations need to be actionnable and implementable. Kathy on recommendation 3: is this a translation requirement we are talking about or an accuracy issue? Accuracy in terms of translation and transcription - local languages. transcribed to ASCII codes without ambiguity. Kathy to work with Michael and Sarmad on legal wording. Bill - recommendation 1 - mechanisms exist. 5. Comments on draft report - AJ to circulate a document containing comments + matching contentious sections of the report. Agree to avoid track changes. Commitment: 30 Nov Sharon to read report (fresh eye), to share with LE colleagues. 6. Agreement needed on these recommendations. Do look like policy but there is some middleground. Lynn: Definition help clarify that - this section very useful in evaluating WHOIS. Consistent with AoC --> services not intended to restrict the access because language does say unrestricted public access.. Susan: go through this document one more time, get on phone with James and Kathy and deliver to group on Monday evening. 7. Should identify problems not make policy. Lutz proposes a central access to repositories - Lutz to take another look at his text to make it more generalized: ICANN nominates suitable provider. Develop language and circulate it. Kathy and James can review. Lynn: this section has linkage with consumer trust section 7. Policy section deferred - to be finished asap 8. Lynn: ntent of AoC is a very broad group of people. If have more limited people (those who something about it), it is not consistent with AoC. Need to bring out potential value of WHOIS to consumer. Awareness program/communication program that promotes WHOIS. Emily: consumers - people close to LE, registrants, trademark - driving the volumes and reliant on it. Lutz: WHOIS does not help if serious organized crime. Lynn: broader education. Lynn: Sanity check. Kathy: Not overconclude from qualitative.. Seth and Lynn to refine draft (redline) and to come back with draft by Monday

1 1

idns
by Sarmad Hussain Nov. 24, 2011

Nov. 24, 2011

Dear All, Sorry to have missed the meeting (as I was sick), for this belated information (as I was aiming to still attend meeting). Please let me know if I can help in addressing any queries around the IDN draft. Regards, Sarmad

1 0