October 2017 - Ssr2-review - lists.icann.org

Action Required Today - SSR2 Plenary Call Thursday, 12 October - Doodle Poll
by Yvette Guigneaux Oct. 5, 2017

Oct. 5, 2017

Hi All - Good day. Below is a doodle poll link for availability for an SSR2 Plenary call - Thursday, 12 October - as the usual Tuesday Plenary call was cancelled due to the ICANN SSR meeting in Los Angeles - please advise on your availability. Doodle Link: http://doodle.com/poll/nkqvmpfy8pgs8utd | Poll closes: Wednesday, 11 October @ 19:00 UTC. Kind Regards, Yvette Guigneaux (MSSI) Multistakeholder Strategy & Strategic Initiatives Projects & Operations Assistant. ICANN - Internet Corporation for Assigned Names and Numbers Email: yvette.guigneaux(a)icann.org Cell: +1-310-460-8432 Skype: yvette.guigneaux.icann www.icann.org<http://www.icann.org/> [cid:image001.png@01D33DEB.817A6F50]

1 0

Draft Agenda: ICANN SSR LA Meeting
by Jennifer Bryce Oct. 5, 2017

Oct. 5, 2017

Hi all, Please find attached a draft agenda for the ICANN SSR subgroup meeting in LA, 9-10 October. Please note that the agenda is subject to change. Best, Jennifer -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

2 1

SSAC letter to the Board
by James Gannon Oct. 4, 2017

Oct. 4, 2017

Im sure some of you have seen this but important for everyone to read this. https://www.icann.org/en/system/files/correspondence/faltstrom-to-icann-boa… I copy the core text below: Dear ICANN Board, The SSAC is strongly committed to the aims of the quintennial Security, Stability and Resiliency of the DNS Review (now SSR2) and our members have given and will continue to give, considerable time in support of SSR2. It is therefore with considerable regret that we inform you that SSAC has serious concerns that the SSR2 effort may fail, and we request that you give it urgent and serious attention. One basic problem with the SSR2 work is that the review team seems neither to have sufficient external instruction about what to study nor to have been able to formulate a clear direction for itself. Whatever the case, the Review Team has spent hundreds of hours engaged in procedural matters and almost no progress has been made on substantive matters, which in turn has damaged the goodwill and forbearance of its members, some of whom are SSSAC members. We are concerned that, left to its own devices, SSR2 is on a path to almost certain failure bringing a consequential loss of credibility in the accountability processes of ICANN and its community. Some seven months into the review process, the last SSR2 scorecard shows 15% of milestones being accomplished, but all of these accomplishments have been process issues – for example, determining the role of observers, adopting terms of reference, determine terms of communications with the Board, and so on. On 28 September 2017, ICANN called for proposals by external consultants to perform a gap analysis of the Implementation of SSR1 Recommendations , but this analysis will not necessarily identify new or emerging SSR issues. While it may provide useful input to the SSR2 work, it does not change the view of the SSAC. The SSAC believes that the existing composition, structure, and processes of the SSR2 Review Team lack the necessary effectiveness to achieve the desired results. The SSAC recommendation to the ICANN Board of Directors and the ICANN Community is to take immediate action to temporarily halt the SSR2 review and produce a detailed plan before resuming work. The current approach, if continued without significant change, will ultimately result in a report that does not have the quality expected by the ICANN Community

2 1

Re: [Ssr2-review] [EXT] Question on definition of "security"
by Barrett, Kerry-Ann Oct. 4, 2017

Oct. 4, 2017

Dear All Apologies if I missed the answer to my question, but have we satisfied the redefinition of the scope of 'security' for the purposes of our Review and submitted same ot the Baord as yet? If not can we include a discussion item about this for our next plenary. Thanks for the clarification Kaveh and have a great weekend everyone. Sincerely, Kerry-Ann Barrett Cyber Security Policy Specialist Inter-American Committee against Terrorism Secretariat for Multidimensional Security Organization of American States 1889 F Street N.W., Washington, D.C. 20006 T. 202-370-4675 F. 202-458-3857 kabarrett(a)oas.org www.oas.org/cyber Register to our distribution list here! -----Original Message----- From: ssr2-review-bounces(a)icann.org [mailto:ssr2-review-bounces@icann.org] On Behalf Of Kaveh Ranjbar Sent: Tuesday, September 5, 2017 6:10 AM To: SSR2 Review Team Email List <ssr2-review(a)icann.org> Subject: [EXT] [Ssr2-review] Question on definition of "security" Hello team, Going through action items we had this open question from SSR2 Review Team: "The ICANN security team (now OCTO/SSR) developed a framework that provided a definition for "security". The SSR2 team used that definition. The Board response to the Terms of Reference expressed that this definition is too broad for the Review Team’s use. Is Board asking staff to redefine definition of “security”?” Although I have answered this in person, to have a record of the answer on the list, please find my written response below: “Thank you for this question. The answer is no, the board is not asking staff to redefine current working definition of “security”. As I clarified in the SSR2’s meeting in Johannesburg, on 26th of June 2017, aim of the board's question was to ensure that -given how broad the definition of “security” could be- the SSR2 Review Team focuses its efforts on a manageable set of issues properly within ICANN’s mission and remit.” Please let me know if you have any further questions or comments. All the best, Kaveh. _______________________________________________ Ssr2-review mailing list Ssr2-review(a)icann.org https://mm.icann.org/mailman/listinfo/ssr2-review

2 1

Fwd: Board letter on Subgroup 2's scope
by Bernard Turcotte Oct. 4, 2017

Oct. 4, 2017

---------- Forwarded message ---------- From: Žarko Kecić <Zarko.Kecic(a)rnids.rs> Date: Tue, Oct 3, 2017 at 7:00 PM Subject: RE: [Ssr2-review] Board letter on Subgroup 2's scope To: Bernard Turcotte <turcotte.bernard(a)gmail.com> Hi Bernie, For some reason ICANN mailing list service doesn’t like me (even my mail does have correct spf, DKIM and DMARC to proof authenticity). I have asked Karen to raise this issue to the tech staff but it is even worse now. Can you please forward the message bellow to the group. I hope I’ll have time in La to fix this with ICANN staff. Thanks! Hello RT, In principle, I agree with the position of the Board that SRR RT has no mandate to check the operational capability and safety of ICANN's internal systems. However, I personally do not know to what extent ICANN systems are used for operational tasks related to unique Internet identifiers. I believe that the meeting in Los Angeles will solve some of these dilemmas and will help us to include in the final report only the findings that are within our scope. Also, in order to carry out tasks from the parts of the plan that are OK’ed by the Board, some inputs are needed from those parts that they have identified as inadequate for the mission that this RT has. Basically I agree, having in mind short time left until LA meeting, that we continue as planned, and work with staff, Legal Dept. and the Board what should be in our final report and what is out of scope. Anyway, those findings that are not within RT mission, as stated in bylaws, may be useful for future improvements of the security and stability of ICANN internal systems and processes. Zarko *From:* Bernard Turcotte [mailto:turcotte.bernard@gmail.com] *Sent:* Wednesday, October 4, 2017 12:53 AM *To:* Žarko Kecić <Zarko.Kecic(a)rnids.rs> *Subject:* Re: [Ssr2-review] Board letter on Subgroup 2's scope email was empty Zarko. B. 2017-10-03 18:50 GMT-04:00 Žarko Kecić <Zarko.Kecic(a)rnids.rs>: _______________________________________________ Ssr2-review mailing list Ssr2-review(a)icann.org https://mm.icann.org/mailman/listinfo/ssr2-review

1 0

Re: [Ssr2-review] SSR2 RT
by Osterweil, Eric Oct. 3, 2017

Oct. 3, 2017

Sorry to be losing you, Cathy. Take care. Eric From: <ssr2-review-bounces(a)icann.org> on behalf of James Gannon <james(a)cyberinvasion.net> Date: Tuesday, October 3, 2017 at 3:50 PM To: Cathy Handley <chandley(a)arin.net> Cc: Brad Verd <bverd(a)verisign.com>, SSR2 <ssr2-review(a)icann.org> Subject: [EXTERNAL] Re: [Ssr2-review] SSR2 RT Sorry to see you go Cathy. It was a pleasure working with you. Sent from my iPhone On 3 Oct 2017, at 21:49, Cathy Handley <chandley(a)arin.net<mailto:chandley@arin.net>> wrote: SSR2 RT and associated ICANN Staff, Effective today, I am stepping down from the Review Team and all associated activities. I am copying Brad Verd, as chair of the RSSAC and the organization that sponsored me. Regards, Cathy Cathy Handley Executive Director Government Affairs American Registry for Internet Numbers (ARIN) Mobile: +1 703 341 7996 Fax: +1 703 263 0111 Email: chandley(a)arin.net<mailto:chandley@arin.net> Confidentiality Notice: This message is intended only for the use of the individual or entity to which it is addressed, and may contain information that is privileged, confidential, and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, please delete.. Thank you. _______________________________________________ Ssr2-review mailing list Ssr2-review(a)icann.org<mailto:Ssr2-review@icann.org> https://mm.icann.org/mailman/listinfo/ssr2-review

1 0

SSR2 RT
by Cathy Handley Oct. 3, 2017

Oct. 3, 2017

SSR2 RT and associated ICANN Staff, Effective today, I am stepping down from the Review Team and all associated activities. I am copying Brad Verd, as chair of the RSSAC and the organization that sponsored me. Regards, Cathy Cathy Handley Executive Director Government Affairs American Registry for Internet Numbers (ARIN) Mobile: +1 703 341 7996 Fax: +1 703 263 0111 Email: chandley(a)arin.net<mailto:chandley@arin.net> Confidentiality Notice: This message is intended only for the use of the individual or entity to which it is addressed, and may contain information that is privileged, confidential, and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, please delete.. Thank you.

2 1

Connectivity - SSR2 Review Team - Meeting #30 | 21:00 UTC | Tuesday, 03 October 2017
by MSSI Secretariat Oct. 3, 2017

Oct. 3, 2017

Hello SSR2 Review Team - Good day. I just wanted to touch base regarding connectivity for our next SSR2 Review Team - Meeting #30 | 21:00 UTC | Tuesday, 03 October 2017. We have conquered many of the noise disturbances previously present and would like to ensure continued connectivity on future calls. For the best results in regions with connectivity, we suggest doing the following... * Connect to the Adobe Connect (https://participate.icann.org/ssrreview) 20-30 minutes before the scheduled call - the Adobe Connect room will be open and I will be available to assist you - in addition we can resolve any microphone/static/connection issues ahead of time - including connecting with international operators if need be. The goal is to have all connection concerns resolved by the top of the hour for the benefit of the team. * Be located (if possible) in an area that has proper broadband connection and is quiet - thus creating a strong signal connection, making it possible to see and hear in the Adobe Connect Room. * Feel free to Skype me either before, during or after the call - my skype address is yvette.guigneaux.icann - this way I can respond to you almost immediately for whatever you may need - including having the Adobe Connect Room dial out to you if need be. As your SSR2 Review Team Secretariat, I am determined to create an atmosphere where you can clearly participate in the Adobe Connect Room. Thank you everyone and I look forward to seeing you all on our upcoming call. :) Kind Regards, Yvette Guigneaux (MSSI) Multistakeholder Strategy & Strategic Initiatives Projects & Operations Assistant. ICANN - Internet Corporation for Assigned Names and Numbers Email: yvette.guigneaux(a)icann.org<mailto:yvette.guigneaux@icann.org> Cell: +1-310-460-8432 Skype: yvette.guigneaux.icann www.icann.org<http://www.icann.org/> [cid:image001.png@01D33C2C.EA924B40]

1 0

Gap analysis document published
by Jennifer Bryce Oct. 3, 2017

Oct. 3, 2017

Hi all, We wanted to let you know that the ‘Specifications for Gap Analysis of the Implementation of SSR1 Review Recommendations’ has been posted to ICANN.org. The document is attached here. We have also prepared an email which you can feel free to share with those you think may be interested. See below. Thanks! Jennifer -------------- Hello, The Review Team for the Second Security, Stability, and Resiliency Review (SSR2) is seeking an independent expert to perform a gap analysis of the first SSR Review recommendations. An announcement was posted on ICANN.org on 28 September. Please read the full announcement here: https://www.icann.org/news/announcement-2-2017-09-28-en. Thank you for showing an interest in participating in this process. The Specifications for Gap Analysis of the Implementation of SSR1 Review Recommendations document is attached for ease of reference. Other required documents: 1. Non-Disclosure Agreement (NDA) 2. ICANN'S Contractor Conflicts of Interest Disclosure 3. Contractor Consulting Agreement Contact ssr2-gap-analysis(a)icann.org<mailto:ssr2-gap-analysis@icann.org> to indicate your expression of interest and to obtain a copy of these documents. Note that a signed and executed NDA is necessary for further discussions on the initiative and to advance in the process. Please ensure that the NDA document is signed and included before the proposal deadline. The following dates have been established as milestones. The SSR2 Review Team or ICANN reserves the right to modify or change this timeline at any time as necessary. Activity Dates Announcement posted on ICANN.org 28 September 2017 Proposals Due 16 October 2017 Contractor starts project 6 November 2017 Gap analysis outline and presentation to SSR2 Review Team to collect input 13 November 2017 Draft gap analysis report 11 December 2017 Meeting with SSR2 Review Team to present Draft gap analysis report and collect input 19 December 2017 Final Report 16 January 2018 Meeting with SSR2 Review Team to present Final gap analysis Report 23 January 2018 All expressions of interest must be submitted to ssr2-gap-analysis(a)icann.com<mailto:ssr2-gap-analysis@icann.com> by 16 October 2017. Ensure that you provide your expression of interest before the deadline indicated. Do not provide your response via postal mail or other means. Best of luck, and we look forward to receiving your proposal. Thank you, -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

2 1

LA meeting: NDA and SMEs
by Jennifer Bryce Oct. 3, 2017

Oct. 3, 2017

Dear SSR2 Review Team members, In preparation for the face-to-face meeting scheduled in Los Angeles on 9-10 October 2017, we would like to highlight a few items for your information: Non-Disclosure Agreement There have been concerns raised in recent conversations regarding the need for SSR2 RT members to execute a non-disclosure agreement (or NDA) in order to access certain information or documents that are not publicly available but are likely to be pertinent to the RT’s work. When the reviews were incorporated into the Bylaws, the need for NDAs to facilitated openness and transparency amongst the review team was specifically identified at Section 4.6 (a)(vi)(A): (vi) Confidential Disclosure to Review Teams (A) To facilitate transparency and openness regarding ICANN's deliberations and operations, the review teams, or a subset thereof, shall have access to ICANN internal information and documents pursuant to the Confidential Disclosure Framework set forth in the Operating Standards (the "Confidential Disclosure Framework"). The Confidential Disclosure Framework must be aligned with the following guidelines: (1) ICANN must provide a justification for any refusal to reveal requested information. ICANN's refusal can be appealed to the Ombudsman and/or the ICANN Board for a ruling on the disclosure request. (2) ICANN may designate certain documents and information as "for review team members only" or for a subset of the review team members based on conflict of interest. ICANN's designation of documents may also be appealed to the Ombudsman and/or the ICANN Board. (3) ICANN may require review team members to sign a non-disclosure agreement before accessing documents. ICANN organization, in beginning its preparations for conversations with the sub-team, noted that there might be certain information discussed for which an NDA would be appropriate. If the sub-team wishes for all conversations at its October 9-10 meeting in L.A. to be on information that is publicly available, that can be arranged. If the subgroup wishes to have the ability to discuss more sensitive information with the ICANN organization reps while onsite, then if topics of conversation come up that are deemed to be confidential, those who have not yet signed the NDA will be requested to step out of the room for that portion of the conversation. We will accommodate either path the sub-team wishes to take for the onsite meeting. Separately, there is the possibility that the sub-team will request documentation for which an NDA would be required. ICANN is committed to following the Confidential Disclosure Framework in identifying the minimum amount of information as “Confidential” as possible. If the sub-team prefers, the decision to sign an NDA can be deferred until such time said documentation is ready to be distributed upon signature. Subject Matter Experts Below, please find the list of subject matter experts who will attend the upcoming meeting in Los Angeles: Steve Conte -- Director, Office of the CTO Programs James Caulfield -- VP, Enterprise Risk Management Christine Willett -- VP, GDD Operations Francisco Arias – Sr. Director, GDD Technical Services Russ Weinstein – Director, Registry Services Darren Kara – DNS Engineering Strategy Manager Gary Petzer -- VP, Strategic IT Program Management Samuel Suh -- VP, Back Office Solutions Maguy Serad -- VP, Contractual Compliance Services Thank you for your time, and please do not hesitate to reach out to us with any questions you might have. -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

1 0