November 2011 - Rt4-whois - lists.icann.org

Recommendations - SOURCE EXPLANATION (2).doc
by Susan Kawaguchi Nov. 30, 2011

Nov. 30, 2011

HI Emily, James and I had a quick phone call to discuss the proxy recommendation. He made a great point that we should include in the recommendation reviewing the existing proxy practices so I have added the following point. 1) Review existing practices by reaching out to proxy providers and foster a discussion to develop, clarify and enhance the current processes Please see the whole recommendation incorporated in the attached document. Susan

3 2

Re: [Rt4-whois] Updated Recommendation 14 - Centralized Database
by lynn＠goodsecurityconsulting.com Nov. 30, 2011

Nov. 30, 2011

4 3

Re: [Rt4-whois] Centralized Whois Query system run by ICANN - Scope and concerns [SEC=UNCLASSIFIED]
by Susan Kawaguchi Nov. 30, 2011

Nov. 30, 2011

I will not oppose it if we include all gTlds but my gut feeling is that the other registries may be opposed to being included in this web portal. If we keep it as uncomplicated as possible we are more likely to gain the consensus of the community. From: Seth M Reiss [mailto:seth.reiss@lex-ip.com] Sent: Wednesday, November 30, 2011 1:25 PM To: Susan Kawaguchi; 'Nettlefold, Peter'; jbladel(a)godaddy.com; emily(a)emilytaylor.eu Cc: rt4-whois(a)icann.org Subject: RE: [Rt4-whois] Centralized Whois Query system run by ICANN - Scope and concerns [SEC=UNCLASSIFIED] I agree with Peter. I do not know why we would want to limit it to .com and .net even though these GTLDs present the greatest challenge to the WHOIS consumer. I think the smart portal idea that Lutz proposed avoid the concerns Kathy expressed regarding management; I am not sure I understand Susan’s concerns that it be limited to only to the two GTLDs most in need of the service. Seth From: rt4-whois-bounces(a)icann.org [mailto:rt4-whois-bounces@icann.org] On Behalf Of Susan Kawaguchi Sent: Wednesday, November 30, 2011 11:15 AM To: Nettlefold, Peter; 'jbladel(a)godaddy.com'; 'emily(a)emilytaylor.eu' Cc: 'rt4-whois(a)icann.org' Subject: Re: [Rt4-whois] Centralized Whois Query system run by ICANN - Scope and concerns [SEC=UNCLASSIFIED] That was my understanding when we discussed previously but this would only be for .com and .net registrations. Is this feasible ? From: Nettlefold, Peter [mailto:Peter.Nettlefold@dbcde.gov.au] Sent: Wednesday, November 30, 2011 1:12 PM To: Susan Kawaguchi; 'jbladel(a)godaddy.com'; 'emily(a)emilytaylor.eu' Cc: 'rt4-whois(a)icann.org' Subject: Re: [Rt4-whois] Centralized Whois Query system run by ICANN - Scope and concerns [SEC=UNCLASSIFIED] Classification: UNCLASSIFIED Hello all, I've missed a lot of discussion on this overnight my time, so I apologise if I've missed something that answers my question. The references to an ICANN database are confusing to me, and may be part of the contention here. I had understood that we would recommend that ICANN create a smart web portal for consumers that would effectively do a WHOIS search for them. As I understood it, ICANN would not need to make its own database, thereby avoiding some of the data protection issues, and instead purely focus on the user experience. Is this what others had understood? If so, does this address the concerns about scope - ie why wouldn't ICANN provide a comprehensive search tool for all gTLDs? Please let me know if I've got this wrong. Cheers Peter From: Susan Kawaguchi [mailto:susank@fb.com] Sent: Thursday, December 01, 2011 03:27 AM To: James M. Bladel <jbladel(a)godaddy.com>; Emily Taylor <emily(a)emilytaylor.eu> Cc: rt4-whois(a)icann.org <rt4-whois(a)icann.org> Subject: Re: [Rt4-whois] Centralized Whois Query system run by ICANN - Scope and concerns I agree that we should not try and answer all the questions but I was under the impression that the centralized WHOIS was only targeting .com and .net to solve the problem of having to search for the correct registrar out of the almost 1000 possible. I do not agree to include all gtlds. From: rt4-whois-bounces(a)icann.org [mailto:rt4-whois-bounces@icann.org] On Behalf Of James M. Bladel Sent: Wednesday, November 30, 2011 8:21 AM To: Emily Taylor Cc: rt4-whois(a)icann.org Subject: Re: [Rt4-whois] Centralized Whois Query system run by ICANN - Scope and concerns No, I don't think we should attempt to answer these questions in RT4, nor presume that we have even identified all of the dependent questions. I believe our recommendation should task the Board, within a reasonable timeframe (90 days?), to request an issues report on a Centralized WHOIS system for all gTLDs, including how it should be operated and what measures would be adopted to protect against abuse / privacy violations / data harvesting. (This will initiate a PDP which, while slower, will be a more comprehensive approach) -------- Original Message -------- Subject: Re: [Rt4-whois] Centralized Whois Query system run by ICANN - Scope and concerns From: Emily Taylor <emily(a)emilytaylor.eu<mailto:emily@emilytaylor.eu>> Date: Wed, November 30, 2011 10:15 am To: "James M. Bladel" <jbladel(a)godaddy.com<mailto:jbladel@godaddy.com>> Cc: Kathy Kleiman <kathy(a)kathykleiman.com<mailto:kathy@kathykleiman.com>>, rt4-whois(a)icann.org<mailto:rt4-whois@icann.org> Hi James Thanks for raising these points. Can you suggest some language which you think would work? Also, Kathy raised a good point about whether this is limited to thin registries (.com, .net) or all? I don't think we've ever discussed this. Kind regards Emily On 30 November 2011 16:06, James M. Bladel <jbladel(a)godaddy.com<mailto:jbladel@godaddy.com>> wrote: I don't oppose this recommendation, but my issue with this is that we are once again being too vague in what we're asking. ICANN: Who? Staff? The Board? The GNSO? Contracted 3rd party? Set up: How? By launching a PDP? Sending out an RFP? Deadline? Are we confident that this group has considered all of the consequences to privacy, security, access, SLAs, etc.? (Reasons why a PDP can be more helpful for things like this...) Thanks-- J. -------- Original Message -------- Subject: Re: [Rt4-whois] Centralized Whois Query system run by ICANN - Scope and concerns From: Kathy Kleiman <kathy(a)kathykleiman.com<mailto:kathy@kathykleiman.com>> Date: Wed, November 30, 2011 9:56 am To: rt4-whois(a)icann.org<mailto:rt4-whois@icann.org> All, Is this the current version of the Lutz proposal now in circulation? I thought it applied only to a centralized database of the current "thin registries," namely .COM and .NET. If so, I can see the advantages and support sending it out as a recommendation in the draft report. But if this is a single database of all registries, thick and thin, now and in the future, I think we creating a database problem. It's an enormous amount of data and creates a focal point for abuse, for warehousing, etc. It's the type of policing job that ICANN has never had to do, and is not operationally set up to do. So thought summary: If ICANN is helping remedy a bad situation by operating a single registry for .COM and .NET to fix a historical problem, I think I am OK for now (pending review of the draft with registries -- after publication is fine). One database of all Whois information to Rule the World, not so good. RECOMMENDATION EDIT: Detailed recommendation: ICANN should set up a dedicated, multilingual website to allow "unrestricted and public access to accurate and complete WHOIS information" **FOR .COM AND .NET, THE EXISTING "THIN REGISTRIES"** even for those people which have problems with the plain WHOIS protocol. The WHOIS information should be collected by following the thin WHOIS approach starting at whois.iana.org<http://whois.iana.org>. The service should display the contractural relationships which are revealed by the WHOIS referals in a clear and understandable way. The results should be mark clearly the relevant information "including registrant, technical, ** DELETE BILLING** billing, and administrative contact" data. ** NOTE: Billing data, which includes credit cards Folks, is simply not displayed in any other Whois search results. It is only registrant, technical, and admin contact.** Best, Kathy > Proposal: > > Summary: > ICANN should set up and maintain a web interface to access > all the WHOIS services in order to ease access to the WHOIS data. > > Presumption: > The AoC requires that "ICANN implement measures to maintain timely, > unrestricted and public access to accurate and complete WHOIS information, > including registrant, technical, billing, and administrative contact > information." > > Observation: > An User Insight Report came up with the following results: > + Almost nobody is aware of whois > + Almost nobody is able to query a whois server correctly > + Whois queries were done on websites which occur first in the search > engine results. Usually those pages are overloaded with advertisments. > > Detailed recommendation: > ICANN should set up a dedicated, multilingual website to allow > "unrestricted and public access to accurate and complete WHOIS > information" even for those people which have problems with the plain > WHOIS protocol. > > The WHOIS information should be collected by following the thin WHOIS > approach starting at whois.iana.org<http://whois.iana.org>. The service should display the > contractural relationships which are revealed by the WHOIS referals in > a clear and understandable way. The results should be mark clearly the > relevant information "including registrant, technical, billing, and > administrative contact" data. > > The server needs to be run by ICANN itself, because the "timely, > unrestricted and public access" is usually rate limited, stripped or even > blocked by the various WHOIS server administrators for uncontractual > third party access. ICANN itself is the only party having the power to > overcome those limits using its contratual compliance. > _______________________________________________ > Rt4-whois mailing list > Rt4-whois(a)icann.org<mailto:Rt4-whois@icann.org> > https://mm.icann.org/mailman/listinfo/rt4-whois -- _______________________________________________ Rt4-whois mailing list Rt4-whois(a)icann.org<mailto:Rt4-whois@icann.org> https://mm.icann.org/mailman/listinfo/rt4-whois _______________________________________________ Rt4-whois mailing list Rt4-whois(a)icann.org<mailto:Rt4-whois@icann.org> https://mm.icann.org/mailman/listinfo/rt4-whois -- [http://www.etlaw.co.uk/images/stories/etlaw/etclogo250x60.gif] 76 Temple Road, Oxford OX4 2EZ UK t: +44 (0)1865 582 811 • m: +44 (0)7540 049 322 emily(a)emilytaylor.eu<mailto:emily@emilytaylor.eu> www.etlaw.co.uk<http://www.etlaw.co.uk> Emily Taylor Consultancy Limited is a company registered in England and Wales No. 730471. VAT No. 114487713. ------------------------------------------------------------------------------- NOTICE: This email message is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message. This message has been content scanned by the Axway MailGate. MailGate uses policy enforcement to scan for known viruses, spam, undesirable content and malicious code. For more information on Axway products please visit www.axway.com. -------------------------------------------------------------------------------

5 5

Re: [Rt4-whois] Centralized Whois Query system run by ICANN - Scope and concerns [SEC=UNCLASSIFIED]
by lynn＠goodsecurityconsulting.com Nov. 30, 2011

Nov. 30, 2011

1 0

WHOIS Policy RT - Law Enforcement comments.
by LEMON, Sharon Nov. 30, 2011

Nov. 30, 2011

NOT PROTECTIVELY MARKED Dear Emily, Alice and All, Sorry for arriving at the party late, I have been watching in awe the hundreds of emails flying about. We gave until today for our international colleagues to comment and we have just had our own internal meeting to finalise the comments on the paper. The paper complemented our ongoing law enforcement work within the ICANN community and there are not comments of major significance -ours are in green. I know that Alice is currently going through the nightmare of trying to organise the version control. (Good Luck and thanks Alice). I have replaced the definition of law enforcement with: Any entity with a responsibility to enforce or ensure observance to or obedience of the law, whether mandated by government or otherwise. We could go on forever with this - but let me know if there are any show stopping objections. I hope we make the deadline of 5pm ;-) Sharon Sharon LEMON OBE Deputy Director Cyber and Forensics Serious and Organised Crime Agency (SOCA) 07768 290902 0207 855 2800 -----Original Message----- From: KIBBEY, Gary Sent: 30 November 2011 13:16 To: LEMON, Sharon Subject: FW: Emailing: WHOIS Policy RT - Draft report - 24 Nov - Clean CC GK Comments NOT PROTECTIVELY MARKED Gary Kibbey/ Senior Manager Cyber Serious Organised Crime Agency / Tel +44(0)207 855 2863 +44(0)7876790990 gary.kibbey(a)soca.x.gsi.gov.uk -----Original Message----- From: FLAHERTY, Jonathan Sent: 29 November 2011 17:54 To: KIBBEY, Gary; ADDIS, Benedict Cc: CURLEY, Cliona Subject: RE: Emailing: WHOIS Policy RT - Draft report - 24 Nov - Clean CC GK Comments NOT PROTECTIVELY MARKED My comments added. Jon Flaherty | HVOM | SOCA Cyber & Forensics | 0207 855 2808 | 07919 218439 | jonathan.flaherty(a)soca.x.gsi.gov.uk -----Original Message----- From: KIBBEY, Gary Sent: 29 November 2011 14:34 To: FLAHERTY, Jonathan; ADDIS, Benedict Cc: CURLEY, Cliona Subject: FW: Emailing: WHOIS Policy RT - Draft report - 24 Nov - Clean CC GK Comments NOT PROTECTIVELY MARKED Gents If you have any comments -can you drop onto this working copy. Don't track changes - just comments. Ta Gary Gary Kibbey/ Senior Manager Cyber Serious Organised Crime Agency / Tel +44(0)207 855 2863 +44(0)7876790990 gary.kibbey(a)soca.x.gsi.gov.uk -----Original Message----- From: KIBBEY, Gary Sent: 29 November 2011 14:31 To: KIBBEY, Gary Subject: Emailing: WHOIS Policy RT - Draft report - 24 Nov - Clean CC GK Comments NOT PROTECTIVELY MARKED The message is ready to be sent with the following file or link attachments: WHOIS Policy RT - Draft report - 24 Nov - Clean CC GK Comments Note: To protect against computer viruses, e-mail programs may prevent sending or receiving certain types of file attachments. Check your e-mail security settings to determine how attachments are handled. This information is supplied in confidence by SOCA, and is exempt from disclosure under the Freedom of Information Act 2000. It may also be subject to exemption under other UK legislation. Onward disclosure may be unlawful, for example, under the Data Protection Act 1998. Requests for disclosure to the public must be referred to the SOCA FOI single point of contact, by email on PICUEnquiries(a)soca.x.gsi.gov.uk or by telephoning 0870 268 8677. All E-Mail sent and received by SOCA is scanned and subject to assessment. Messages sent or received by SOCA staff are not private and may be the subject of lawful business monitoring. E-Mail may be passed at any time and without notice to an appropriate branch within SOCA, on authority from the Director General or his Deputy for analysis. This E-Mail and any files transmitted with it are intended solely for the individual or entity to whom they are addressed. If you have received this message in error, please contact the sender as soon as possible. The original of this email was scanned for viruses by the Government Secure Intranet virus scanning service supplied by Cable&Wireless Worldwide in partnership with MessageLabs. (CCTM Certificate Number 2009/09/0052.) On leaving the GSi this email was certified virus free. Communications via the GSi may be automatically logged, monitored and/or recorded for legal purposes.

5 8

Re: [Rt4-whois] Applicable law updated with comments
by Omar Kaminski Nov. 30, 2011

Nov. 30, 2011

Seems I made my considerations in the wrong email, but they are the same, besides one more point on privacy laws: if the Whois system should be kept public and accessible, the problems should arise specially - surprise! in fact, not - on proxy servers and services that keep personal data on private, or under certain conditions (usually paying a tax). Omar 2011/11/30 Seth M Reiss <seth.reiss(a)lex-ip.com>: > Good > > > > From: rt4-whois-bounces(a)icann.org [mailto:rt4-whois-bounces@icann.org] On > Behalf Of Kathy Kleiman > Sent: Wednesday, November 30, 2011 10:15 AM > To: rt4-whois(a)icann.org > Subject: [Rt4-whois] Applicable law updated with comments > > > > Hi All, On a key definition applicable law, Alice and I adopted the edits > proposed: > > ==> Now: The Team understands the “applicable laws” reference as > encompassing all laws, but mainly focused on privacy laws and regulations, > and notes ICANN’s existing consensus policy relating to conflicts with > privacy laws. The Team considered, but determined not to include within the > definition, international agreements and regional laws recognizing that such > laws are enforceable only to the extent incorporated into the domestic laws > of contracting states. > > OK? Raise a flag if not. Tx! Kathy & Alice > > ORIGINAL ===> The Team understands the “applicable laws” reference as > limited to privacy laws and regulation (SK) comment: I agree with Emily > should change to “encompass all laws but many mainly focus on privacy laws > and regulations” and notes ICANN’s existing consensus policy relating to > conflicts with privacy laws. The Team considered but determined not to > include within the definition international agreements and regional laws, > recognizing that such laws are enforceable only to the extent incorporated > into the domestic laws of contracting states. > > -- > > > > > > > _______________________________________________ > Rt4-whois mailing list > Rt4-whois(a)icann.org > https://mm.icann.org/mailman/listinfo/rt4-whois >

1 0

Applicable law updated with comments
by Kathy Kleiman Nov. 30, 2011

Nov. 30, 2011

Hi All, On a key definition applicable law, Alice and I adopted the edits proposed: ==> Now: The Team understands the "applicable laws" reference as encompassing all laws, but mainly focused on privacy laws and regulations, and notes ICANN's existing consensus policy relating to conflicts with privacy laws. The Team considered, but determined not to include within the definition, international agreements and regional laws recognizing that such laws are enforceable only to the extent incorporated into the domestic laws of contracting states. OK? Raise a flag if not. Tx! Kathy & Alice ORIGINAL ===> The Team understands the "applicable laws" reference as limited to privacy laws and regulation (SK) comment: I agree with Emily should change to "encompass all laws but many mainly focus on privacy laws and regulations" and notes ICANN's existing consensus policy relating to conflicts with privacy laws. The Team considered but determined not to include within the definition international agreements and regional laws, recognizing that such laws are enforceable only to the extent incorporated into the domestic laws of contracting states. --

2 1

Clean copy
by Alice Jansen Nov. 30, 2011

Nov. 30, 2011

Dear Review Team Members, Please find attached the latest versions of the master document and appendices. (clean copy – 30 November 16:30 UTC – Alice Jansen) Since I have applied formatting suggestions Kathy emailed me to the document, I would be very grateful if penholders of chapters could please check the formatting structure of their chapters. Does this match your train on thought? If not, please email me asap so that I can rectify it for the subsequent version. Documents will be available on the wiki in a couple of minutes. The files need additional work (typo hunting etc) but I would be very grateful if you could please read these documents very carefully and flag any missing piece of information or inconsistency you notice. Many thanks in advance, Kind regards Alice -- Alice Jansen Assistant, Organizational Reviews 6 Rond Point Schuman, Bt.5 B-1040 Brussels Belgium Direct dial: +32 2 234 78 64 Mobile: +32 4 73 31 76 56 Skype: alice_jansen_icann

5 5

WHERE ARE WE NOW? UPDATE
by Emily Taylor Nov. 30, 2011

Nov. 30, 2011

Hi all Thanks for your amazing productivity and dedication today. I have heard from more than 1 member of the Team at 5am their local time today. Very, very much appreciated. OK - this is what we needed to do today: (1) Definitions of law enf. and applicable laws. Minor changes requested by Peter - are we comfortable, or not? DONE (2) Where are we on proxies? - is there some agreed text to go into the recommendations now (thanks for your work on this Susan, James and others) IN PROGRESS (3) How much of the consumer chapter stays in the full report, and how much goes into an appendix. DONE (4) Background on WHOIS chapter - does it stay where it is, or does it go into an appendix? DONE (5) any final comments on the compliance letter, please? Alice, please can you produce a clean copy of this. IN PROGRESS _ ALICE HAS BEEN WRESTLING WITH THE FULL REPORT TODAY. Well done, all. Thank you Alice for producing the consolidated version. *Outstanding open issues on recommendations: (1) The recommendation on "interface" (Lutz's one). James has suggested that we frame this as an issues report, and this has found support from me, Kathy, Omar, Mikhail and Bill. Can we do this please? (2) Proxy recommendations. Bill has raised a problem with the proposed best practices; Susan has acknowledged that she and James would be happy with less detail - waiting for proposed language here. Susan has just circulated an additional proposed recommendation on reviewing existing practices. (3) The Person - Bill raised a query whether this should be a member of the Compliance team, or someone else. *I see (1) and (3) are easy and (2) is difficult. On a more general level, James has repeatedly and rightly raised that our recommendations need to have time frames, and be correctly targeted. I agree, and I'm sure we all do, but we're struggling to know how to do this. I have one suggestion, which would be to task the Board to consider our recommendations within 3 months, and present an action plan for implementation within another 3 months, together with budgetary impact and the identity of who has been tasked. James -would this work? *Rest of the document *This is mainly in good shape, but it needs a proof-read now, and the elimination of the remaining highlighted text - I do not see these as contentious. Bill is working to pull together the language of the findings/conclusions just before the recommendations. *What's the plan now? *I want us to sign off definitively on the recommendations, and stabilise the text in the next hour, please. To do this, folks, we're going to sort out the proxies. Please note that there is already one team member (Bill) expressing concern on these; as I read Peter's mails on the subject he was also expressing concerns that we are introducing very detailed text very late in the day. We have a strong statement on proxy liability from Dakar. Can we have proposals to close this down, please? Over the next two days, I would like Alice and Kathy to carefully proof-read, and tidy up the text in the main body of the report. If there are any volunteers to assist them (Bill - you mentioned that you may have some time? Others?? ). Then we can get it published, but we need to sign off on the substantive recommendations in the *next hour!* Kind regards Emily -- * * 76 Temple Road, Oxford OX4 2EZ UK t: +44 (0)1865 582 811 • m: +44 (0)7540 049 322 emily(a)emilytaylor.eu *www.etlaw.co.uk* Emily Taylor Consultancy Limited is a company registered in England and Wales No. 730471. VAT No. 114487713.

1 0

Re: [Rt4-whois] Centralized Whois Query system run by ICANN - Scope and concerns
by James M. Bladel Nov. 30, 2011

Nov. 30, 2011

4 3