February 2019 - Ssr2-review

Apologies
by Scott McCormick Feb. 28, 2019

Feb. 28, 2019

Hi folks, Apologies, I have a conflicting call this morning for the upcoming council EPDP vote. I will join if the call concludes early. -Scott -- -Scott *Scott McCormick* Security Compliance mobile 443.691.2013 smccormick(a)hackerone.com <https://www.hackerone.com> *Check out the 2018 Hacker Powered Security Report <https://www.hackerone.com/sites/default/files/2018-07/The%20Hacker-Powered%…>* [image: linkedin3.png] <https://www.linkedin.com/company/hackerone> [image: twitter-xxl.png] <http://t.yesware.com/tt/324020b77f436d605944dd917f93cf8de45fe242/62c45ebe13…> [image: facebook-symbol_318-37686.jpg] <http://t.yesware.com/tt/324020b77f436d605944dd917f93cf8de45fe242/62c45ebe13…>

1 0

Message from the ICANN Board
by Kaveh Ranjbar Feb. 28, 2019

Feb. 28, 2019

Dear SSR2 Review Team, Thank you for your submission of the SSR2 Review Team work plan to the ICANN Board on 14 November 2018. We understand that the work plan is an evolving document which is being updated as your work advances. To that end, thank you for your 13 February 2019 email informing us of your continued progress and the outcomes of your most recent face-to-face meeting in Los Angeles. We are encouraged to see that the Review Team continues to work productively towards completion of key milestones. We propose that an informal discussion between the Review Team and the SSR2 Caucus Group of the ICANN Board be scheduled during ICANN64. The goals would be to have an open dialogue about the Review Team’s progress and planning efforts to date, determine any additional support the team may need, and highlight areas of the work plan and Terms of Reference that are of particular interest to the ICANN Board. Many thanks for your continued dedication and hard work towards successful completion of the SSR2 Review. All the best, Kaveh, on behalf of the ICANN Board.

1 0

SSR2 Agenda: 28 February
by Jennifer Bryce Feb. 27, 2019

Feb. 27, 2019

Dear SSR2 Review Team, Below is the draft agenda for the plenary call on Thursday 28 February at 15:00 UTC. 1. Welcome, roll call, SOI updates 2. ICANN SSR discussion - next steps towards ICANN64 * (ICANN SSR 7 topics document here<https://docs.google.com/document/d/1CzlnjElLnl-76dJ5a_Z257ZOFQCMHYL3Y44DpTl…>; Q&As from January LA Face-to-Face meeting here<https://docs.google.com/document/d/14eJwDGP-LvS9ltTmZoh1i19Fi0_pB2nJ4JYMsS7…>) 1. AOB 2. Confirm action items / decisions reached Best, Jennifer -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

2 1

Draft agenda: Kobe face-to-face meetings
by Jennifer Bryce Feb. 26, 2019

Feb. 26, 2019

Dear SSR2 Review Team members, Attached is a draft agenda for SSR2 Review Team face-to-face meetings at ICANN64. Note that the times for the agenda items are estimated and flexible. For quick reference, an abbreviated version is below. Also note that writing sessions for each of the workstreams will be scheduled throughout the week based on pop-up room availability. Dates and times for these sessions will be confirmed ahead of day 1 of the face-to-face meeting. Day 1: 8th March 2019 (09:00 - 17:00 local time) 1. Welcome, SOI updates, opening remarks 2. Finalize engagement session slides 3. ICANN SSR workstream - working session 4. DNS SSR workstream - working session 5. Day 1 debrief and A.O.B Day 2: 9th March 2019 (09:00 - 17:00 local time) 1. Welcome, SOI updates 2. Future Challenges workstream - working session 3. Planning for the week, including writing sessions and face-to-face meeting day 3 agenda 4. Day 2 debrief and A.O.B Day 3: 14th March 2019 (09:00 - 13:15 local time) 1. Welcome, SOI updates 2. Planning for report writing 3. Update work plan 4. Next steps 5. A.O.B and closing remarks Best, Jennifer -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

2 1

Future Challenges answers
by Jennifer Bryce Feb. 25, 2019

Feb. 25, 2019

Dear all, Below are some Future Challenges workstream answers. The complete list of questions and answers are here: https://docs.google.com/document/d/14eJwDGP-LvS9ltTmZoh1i19Fi0_pB2nJ4JYMsS7… Review Team volunteers: Laurin, Eric, Kerry-Ann Workstream: Future Challenges Topic: New uses for DNS (IoT, etc.) Q: Has ICANN identified any scenarios where the current DNS infrastructure would fail? A: DDoS attacks on all the root servers, or on all the servers for one or more TLDs, could cause some domains to be unreachable by some users, but the infrastructure itself would not be damaged, and reachability for domains in those zones would recover as the attacks abated. Q: Are there any groups, reports, or is there any work being done to track new uses of DNS? A: OCTO regularly discusses new uses of the DNS with the ICANN community at ICANN meetings. This is based on OCTO's following of new uses of the DNS in the IETF. This has happened many times. For example, at ICANN 60, we presented to the TEG and Board about using DOA in the DNS <https://icann60abudhabi2017.sched.com/event/CbHh/joint-meeting-icann-board-…> [icann60abudhabi2017.sched.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__icann60abudhabi2017.sc…>. We will present to the community at ICANN 64 about DNS-over-TLS and DNS-over-HTTP <https://64.schedule.icann.org/meetings/961998>. Outstanding questions on this topic: 0 Review Team volunteers: Eric, Norm, Laurin, Kerry-Ann, Noorul Workstream: Future Challenges Topic: Privacy protections (DNS over TLS / over HTTPS; Circular dependencies between WebPKI and DNSSEC; Impact on Proactive anti-abuse and investigations) Q: Does ICANN track these developments, what are the findings, and how do they feed into ICANN operations and policy? A: ICANN follows DoT and DoH. There are no particular findings about these new technologies. To date, nothing about DoT or DoH has needed to be fed into ICANN operations and policy. Outstanding questions on this topic: 1 Review Team volunteers: Eric, Russ, Ram, Laurin Workstream: Future Challenges Topic: New crypto systems in DNSSEC Q: What resources and processes are in place to track and make the Board aware and factor into strategic planning for this? A: OCTO regularly informs the Board Technical Committee and executive team about technical news that might affect Board decisions. OCTO informed the BTC and execs of NIST's report on the progress of the post-quantum cryptography work. https://www.nist.gov/publications/status-report-first-round-nist-post-quant… Q: What analyses or study/studies have been done? A: NIST is the primary creator of such reports and studies. As these reports are published, OCTO informs the Board Technical Committee and the executive team of the reports and gives brief background on them. Eg. https://csrc.nist.gov/publications/detail/nistir/8240/final Outstanding questions on this topic: 1 -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

2 1

DNS SSR answers FAO Laurin, Norm, Eric
by Jennifer Bryce Feb. 25, 2019

Feb. 25, 2019

Dear Laurin, Norm, and Eric, See below for answers to questions in the DNS SSR workstream. There are no remaining questions in this topic. The complete list of questions and answers can be viewed here: https://docs.google.com/document/d/14eJwDGP-LvS9ltTmZoh1i19Fi0_pB2nJ4JYMsS7…. Review Team volunteers: Laurin, Norm, Eric Workstream: DNS SSR Topic: Proactive anti-abuse by registrars and registries Q: Is ICANN providing avenues for coordination? Can you point to documentation? A: ICANN provides avenues for registry and registrar voluntary and proactive anti-abuse measures through its international meetings and outreach activities. ICANN’s Consumer Safeguards and Security, Stability and Resiliency teams conduct activities and outreach targeted at informing contracted parties about opportunities for proactive anti-abuse measures. ICANN also facilitated the community’s drafting of the advisory, New gTLD Registry Agreement Specification 11 3(b) at https://www.icann.org/resources/pages/advisory-registry-agreement-spec-11-3…. Q: Is there any (internal) reporting of preventative / proactive anti-abuse activities? Can you point the team to relevant resources? A: ICANN Contractual Compliance reporting is limited to its functions (see responses above for links to icann.org) (https://features.icann.org/compliance/dashboard/archives#definition) (https://features.icann.org/compliance/dashboard/report-list) (https://features.icann.org/compliance) (https://www.icann.org/resources/pages/compliance-2012-02-25-en) Blogs and reporting by the ICANN Consumer Safeguards and Security, Stability and Resiliency teams can be found on icann.org. -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

1 0

DNS SSR answers FAO Laurin, Norm, Denise, KC
by Jennifer Bryce Feb. 25, 2019

Feb. 25, 2019

Dear Laurin, Norm, Denise and KC, See below for answers to questions in the DNS SSR workstream. There are no remaining questions in this topic. The complete list of questions and answers can be viewed here: https://docs.google.com/document/d/14eJwDGP-LvS9ltTmZoh1i19Fi0_pB2nJ4JYMsS7…. Review Team volunteers: Laurin, Norm, Denise, KC Workstream: DNS SSR Topic: Leadership: Give ICANN compliance a “big stick” to lead abuse remediation initiatives and take action Q: Please provide a list of when ICANN used compliance procedures to address SSR issues in contracted parties? A: ICANN Contractual Compliance uses the ICANN Contractual Compliance Approach and Process to process third party complaints and conduct proactive monitoring and audits related to registrar and registry operator security, stability and resiliency issues, including those related to DNS abuse, WHOIS accuracy, WHOIS service and format issues, data escrow, other critical registry technical functions and reserved names and names collision occurrence management. Information and metrics regarding these activities can be found on the ICANN Contractual Compliance pages of icann.org. Q: What are the procedures around compliance enforcement, can you point us towards your procedures and approach? A: Information on the ICANN Contractual Compliance Approach and Process, including enforcement (or formal resolution) is at https://www.icann.org/resources/pages/approach-processes-2012-02-25-en. -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

1 0

ICANN SSR answers FAO Kerry-Ann, Denise
by Jennifer Bryce Feb. 25, 2019

Feb. 25, 2019

Dear Kerry-Ann and Denise, See below for answers to questions in the ICANN SSR workstream. The complete list of questions and answers can be viewed here: https://docs.google.com/document/d/14eJwDGP-LvS9ltTmZoh1i19Fi0_pB2nJ4JYMsS7…. Review Team volunteers: Kerry-Ann, Denise Workstream: ICANN SSR Topic: Perform an assessment how effectively ICANN has implemented its processes to ensure compliance regarding registrar agreements and the consensus policies. Q: As of Oct 2017, no action had been taken in relation to 32 RSPs which have reached emergency thresholds in 2017. Is this correct? Please provide updates on action taken (if any) in relation to RSPs that have reached emergency thresholds before and since October 2017. A: Registry operators are required to meet the obligations of the registry agreement (RA), including the five critical registry technical functions which are subject to emergency thresholds in Specification 10 of the RA (RDDS, DNS, DNSSEC, EPP and Data Escrow). ICANN Contractual Compliance enforces Specification 10 of the RA directly with the registry operators, as Registry Service Providers (RSPs) are not ICANN contracted parties and, therefore, out of ICANN’s contractual authority for enforcement of RA obligations. Registry operators are subject to Service Level Agreement monitoring and, for RDDS, DNS and DNSSEC failures, will receive automated compliance Escalated Notices when certain downtime thresholds are met, as well as compliance notices when data escrow failures occur. Upon resolution of the downtime, ICANN Contractual Compliance follows up with the registry operator for additional information and preventative actions. Registry operators often provide information from their RSPs in support of their responses. Failure to remediate noncompliance for these functions can result in a notice of breach being issued against the registry operator and transition of the top-level domain to an emergency back-end registry operator. Q: To what extent are there correlations between certain types of contracted party business models and certain types of abuse? Please provide details A: ICANN Contractual Compliance is not able to respond to this question as we do not have nor collect business model information. Q: Is there a plan to make the information from DAAR actionable by registries and registrars? Please provide details. A: As stated in the Frequently Asked Questions on DAAR at this link - https://www.icann.org/octo-ssr/daar-faqs - the data collected by this system could serve as a platform for studying daily or historical registration or abuse activities and for reporting activity and to assist the ICANN organization's Contractual Compliance department in obtaining additional information relating to Domain Name System (DNS) abuse for an accredited registrar or TLD registry operator. -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

1 0

ICANN SSR answers FAO Russ, Kerry-Ann
by Jennifer Bryce Feb. 25, 2019

Feb. 25, 2019

Dear Russ and Kerry-Ann, Please see below for answers to questions from the ICANN SSR workstream. The complete list of questions and answers can be viewed here: https://docs.google.com/document/d/14eJwDGP-LvS9ltTmZoh1i19Fi0_pB2nJ4JYMsS7…. Review Team volunteers: Russ, Kerry-Ann Workstream: ICANN SSR Topic: Perform an assessment of internal security, stability and resiliency of ICANN's operation processes and services. Subtopic: Compliance Q: Previous answer provided by ICANN org “Contractual Compliance has a standard Approach and Process (https://www.icann.org/resources/pages/approach-processes-2012-02-25-en) that applies across the registrar, registry and audit program. Contractual Compliance monitors complaints to identify patterns and systemic issues of noncompliance within and across the complaint types and the contracted parties. This effort is useful in identifying trends of issues and most importantly in identifying opportunities to conduct outreach or additional proactive monitoring. For example, based on trends identified by Contractual Compliance (including review of WHOIS inaccuracy complaints submitted by the public and generated as a result of the WHOIS ARS), Contractual Compliance launched a WHOIS Inquiry effort in 2016 that focused on registrars in China and Korea. These inquiries focused on issues with the 2013 RAA WHOIS Accuracy Specification Program (WAPS) requirements. These efforts continued for registrars in China, United States and other regions. Please refer to the annual update published at this link: https://www.icann.org/en/system/files/files/annual-2016-31jan17-en.pdf . Outreach efforts are ongoing; please refer to Outreach page (https://www.icann.org/resources/compliance-reporting-performance) for more information.” What are the other regions referred to in the answer? A: Please refer to the published compliance reports (https://www.icann.org/resources/pages/compliance-reports-2018) and the Outreach page (https://www.icann.org/resources/compliance/outreach) for a complete list of the different activities across different years. To list a few in 2018, compliance conducted outreach in APAC region (China, Korea), EMEA (Germany and Turkey), NA and Africa. Q: Can you report on your methodology for the ICANN Contractual Compliance Performance Reports? Is there documentation with version control, is there a permanent link? A: To learn more about the Contractual Compliance reports description and definition, please refer to this link https://features.icann.org/compliance/dashboard/archives#definition) Once the performance reports are published for a particular time period (i.e., monthly, quarterly or annually), they are not changed and have permanent links on the webpage at https://features.icann.org/compliance/dashboard/report-list. There are a limited number of reports that are published on a rolling basis and for which past data is removed from the website. These include the reports listed under the rolling 13-month header at https://features.icann.org/compliance. Q: How are indicators chosen, and how do you account for regional differences (e.g. number of registries in different regions)? Is there documentation with version control, is there a permanent link? A: Contractual Compliance reporting of metrics and participation in outreach activities with contracted parties are determined based on the community concerns, systemic issues and volume of complaints, and at times, based on contract and/or policy changes and implementations. The regional metrics generated by ICANN Contractual Compliance refers to the ICANN regions. See prior response regarding version control and links. Q: Is there a compliance function in GDD? A: No, there is no compliance function in ICANN’s Global Domains Division. Q: For example, is there contractual enforcement if access to data is denied? A: ICANN’s Global Domains Division, as well as other ICANN departments, may refer matters implicating contractual obligations to the ICANN Contractual Compliance team for review and follow up with the ICANN contracted parties, as needed. -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

1 0

Call summary: SSR2 21 Feb
by Jennifer Bryce Feb. 22, 2019

Feb. 22, 2019

Dear SSR2 RT members, Please find attached the plenary call report for SSR2 meeting #61, 21 February at 15:00 UTC. These high-level notes are designed to help SSR2 Review Team members navigate through the content of the call. They are not meant to be a substitute for the recording or transcript, which are posted on the wiki at: https://community.icann.org/x/JqAWBg. The transcript usually becomes available 5 - 7 business days after the meeting. Best, Jennifer -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

1 0