May 2019 - Ssr2-review - lists.icann.org

Re: [Ssr2-review] [Ext] Compliance call follow-up questions
by Jennifer Bryce May 30, 2019

May 30, 2019

Hi Denise, Thank you for sending the follow-up questions for compliance. We will begin working on these per our usual process and will keep the team apprised of progress. Best, Jennifer From: Denise Michel <denisemichel(a)fb.com> Date: Wednesday, May 29, 2019 at 8:23 PM To: Jennifer Bryce <jennifer.bryce(a)icann.org> Cc: Norm Ritchie <norm(a)webcatcher.ca>, "Weissinger, Laurin" <laurin.weissinger(a)yale.edu>, k claffy <kc(a)caida.org>, "Barrett, Kerry-Ann" <KABarrett(a)oas.org> Subject: [Ext] Compliance call follow-up questions Hi, Jennifer. Here are the questions from the Compliance Subgroup that should be expedited for answers. Please let the following members know when the answers will be provided, and please direct any follow-up questions to: Norm, Laurin, KC, Kerry-Ann, Denise Thanks for your help. Denise * For many years, Compliance has been stating that they don’t have the tools, authority, contract language that they need to effectively address contractual compliance-related issues impacting DNS abuse, especially systemic abuse. What stopped Compliance from doing a gap analysis and creating a list of improvements, and compiling a list of specific things they need in contracts, etc.? * It is common for regulatory/compliance entities worldwide to specify the tools, authority, etc. they need to improve impact, and compliance representatives are often directly involved in negotiating and effecting these changes. Jamie indicated that Compliance is not involved in discussions/negotiations to change the RAA & Registry agreements as it “wouldn’t be appropriate.” What does he base this statement on? What, specifically are the barriers (Bylaw language? Contract language?) that prevents Compliance from having a seat at the negotiating table to get what they need? * When will the Spec 11 Registry audit be done? Will it be publicly posted when done? * Is Compliance doing an audit of Registrars’ compliance with the requirement that they must investigate and respond to abuse? * Jamie said Compliance is using DAAR in the Registry audit. Are they using it in Registrar audits? If not, why not? * Jamie indicated that, in the future, DAAR will provide the public with aggregated abuse stats at the Registrar level, but staff responsible for DAAR stated in Kobe that this would not be done. Please provide clarification.

1 0

SSR2 agenda 30 May 2019
by Jennifer Bryce May 29, 2019

May 29, 2019

Dear SSR2 RT members, Below is the agenda for the next SSR2 plenary call, scheduled for Thursday 30 May at 14:00 UTC. 1. Welcome, roll call, SOI updates 2. Review each of the draft recommendations to determine consensus level (consolidated text Google doc here<https://docs.google.com/document/d/1giGuTH2_PDRkgdxXIgPP1YP3cb5mQ5FhTg7Hkc5…>) 3. Team approval of work plan updates (proposed updates shared via email) 4. AOB 5. Confirm action items, decisions reached Best, Jennifer -- Jennifer Bryce MSSI Associate Project Manager Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

1 0

SSR2 work plan for team review
by Jennifer Bryce May 29, 2019

May 29, 2019

Dear SSR2 Review Team members, Attached, please find the workplan with proposed updates post-Brussels meeting. The items that have been updated from the previous workplan are highlighted in yellow, with details of the update in the notes column. Please review the edits and share any comments or questions to this list ahead of the next plenary call, 30 May 2019 at 14:00 UTC. Once approved the workplan will be posted to the wiki here: https://community.icann.org/x/O7jRAw. Best, Jennifer -- Jennifer Bryce MSSI Associate Project Manager Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

1 0

Fwd: SSR2-RT Plenary Call | 30 May 2019 @ 14:00 UTC
by Norm Ritchie May 28, 2019

May 28, 2019

My apologies for the May 30th conference call. I will be unavailable that day. … Norm > Begin forwarded message: > > From: MSSI Secretariat <mssi-secretariat(a)icann.org> > Subject: SSR2-RT Plenary Call | 30 May 2019 @ 14:00 UTC > Date: May 13, 2019 at 2:02:53 PM EDT > To: "aalain(a)trstech.net" <aalain(a)trstech.net>, "krsic(a)denic.de" <krsic(a)denic.de>, "denisemichel(a)fb.com" <denisemichel(a)fb.com>, "lists(a)osterweil.net" <lists(a)osterweil.net>, "eric(a)osterweil.net" <eric(a)osterweil.net>, "jaberamatogoro(a)gmail.com" <jaberamatogoro(a)gmail.com>, "kaveh.ranjbar(a)board.icann.org" <kaveh.ranjbar(a)board.icann.org>, "kc(a)caida.org" <kc(a)caida.org>, "KABarrett(a)oas.org" <KABarrett(a)oas.org>, "kerryann.barrett(a)gmail.com" <kerryann.barrett(a)gmail.com>, "laurin.weissinger(a)yale.edu" <laurin.weissinger(a)yale.edu>, "norm(a)webcatcher.ca" <norm(a)webcatcher.ca>, "ameen(a)cert-in.org.in" <ameen(a)cert-in.org.in>, "noorul.ameen(a)meity.gov.in" <noorul.ameen(a)meity.gov.in>, "ramkrishna(a)isoc.org.np" <ramkrishna(a)isoc.org.np>, "naveedbinrais(a)gmail.com" <naveedbinrais(a)gmail.com>, "housley(a)vigilsec.com" <housley(a)vigilsec.com>, "smccormick(a)hackerone.com" <smccormick(a)hackerone.com>, "zarko.kecic(a)rnids.rs" <zarko.kecic(a)rnids.rs>, "danko.jevtovic(a)board.icann.org" <danko.jevtovic(a)board.icann.org>, Karen Mulberry <karen.mulberry(a)icann.org>, Charla Shambley <charla.shambley(a)icann.org>, Daniel Halloran <daniel.halloran(a)icann.org>, David Conrad <david.conrad(a)icann.org>, "Jennifer Bryce" <jennifer.bryce(a)icann.org>, "John L. Crain" <john.crain(a)icann.org>, Laena Rahim <laena.rahim(a)icann.org>, "Larisa B. Gurnick" <larisa.gurnick(a)icann.org>, Negar Farzinnia <negar.farzinnia(a)icann.org>, Steve Conte <steve.conte(a)icann.org>, Brenda Brewer <brenda.brewer(a)icann.org> > > Please join SSR2 Plenary Call #72 <https://community.icann.org/x/_4mGBg> on 30 May 2019 at 14:00 UTC -- additional time zone support here <https://www.timeanddate.com/worldclock/fixedtime.html?msg=SSR2+Plenary+Call…> > > Join Zoom Meeting: https://icann.zoom.us/j/493602415 <https://icann.zoom.us/j/493602415> > > Best audio option using Zoom – “Join with Computer Audio” (click the green bar in Zoom- see screenshot below) > > > > Or Join by Telephone only: > One tap mobile > +19294362866,,493602415# US (New York) > +16699006833,,493602415# US (San Jose) > > Dial by your location > +1 929 436 2866 US (New York) > +1 669 900 6833 US (San Jose) > 888 788 0099 US Toll-free > 877 853 5247 US Toll-free > +213 98 24 02 675 Algeria > +54 343 414 5986 Argentina > +54 341 512 2188 Argentina > 822 345 9889 Argentina Toll-free > +61 8 7150 1149 Australia > +61 2 8015 2088 Australia > 1800 893 423 Australia Toll-free > +43 72 011 5988 Austria > +43 670 309 0165 Austria > 800 802 588 Austria Toll-free > 1800 389 0808 Bahamas Toll-free > +973 1619 8488 Bahrain > +973 1619 7601 Bahrain > 800 198 33 Bahrain Toll-free > +32 3 808 0455 Belgium > +32 2 588 4188 Belgium > 800 267 88 Belgium Toll-free > 866 237 6875 Bermuda Toll-free > 800 100 560 Bolivia Toll-free > 0 800 828 50 Bosnia and Herzegovina Toll-free > +55 21 3958 7888 Brazil > +55 11 4680 6788 Brazil > 0 800 878 3108 Brazil Toll-free > +359 3 257 1633 Bulgaria > +359 2 492 5688 Bulgaria > 00 800 111 3251 Bulgaria Toll-free > 1800 201 503 Cambodia Toll-free > +1 647 558 0588 Canada > 855 703 8985 Canada Toll-free > +1 345 769 1930 Cayman Islands > +56 41 256 0288 Chile > +56 23 210 9066 Chile > 800 914 125 Chile Toll-free > +86 10 87833177 China > +86 10 53876330 China > 400 669 9381 China Toll-free > 400 616 8835 China Toll-free > +57 2 620 7388 Colombia > +57 1 508 7702 Colombia > 1 800 518 4301 Colombia Toll-free > +506 4000 3843 Costa Rica > +385 1777 6333 Croatia > +385 1300 0988 Croatia > 800 200 588 Croatia Toll-free > +357 2 505 4777 Cyprus > +357 2 200 0888 Cyprus > 800 773 38 Cyprus Toll-free > +420 5 3889 0161 Czech Republic > +420 2 2888 2388 Czech Republic > 828 848 888 Czech Republic Toll-free > +45 89 88 37 88 Denmark > 80 82 02 88 Denmark Toll-free > +1 829 956 2188 Dominican Republic > +1 829 947 9220 Dominican Republic > 1 800 751 9718 Dominican Republic Toll-free > 1800 000 785 Ecuador Toll-free > 0800 000 9608 Egypt Toll-free > +503 2136 6444 El Salvador > +503 2113 9088 El Salvador > +372 880 1188 Estonia > +372 660 1699 Estonia > 0080 02 592 Fiji Toll-free > +358 9 4245 1488 Finland > +358 3 4109 2129 Finland > 800 102 188 Finland Toll-free > +33 7 5678 4048 France > +33 1 8288 0188 France > 805 082 588 France Toll-free > +995 7067 77954 Georgia > +995 3224 73988 Georgia > +49 69 8088 3899 Germany > +49 30 3080 6188 Germany > +49 30 5679 5800 Germany > 800 724 3138 Germany Toll-free > 30 708 4676 Ghana Toll-free > +30 231 118 0599 Greece > +30 211 198 4488 Greece > 800 848 1188 Greece Toll-free > 1800 3000 161 Guatemala Toll-free > 800 2791 9494 Honduras Toll-free > +852 5808 6088 Hong Kong, China > 800 931 189 Hong Kong, China Toll-free > 800 906 780 Hong Kong, China Toll-free > +36 1 701 0488 Hungary > +36 1 408 8456 Hungary > 800 881 88 Hungary Toll-free > 0080 07 473 Iceland Toll-free > +91 22 62 192 563 India > +91 22 71 279 525 India > +91 80 71 279 440 India > +91 22 48 798 004 India > 1 800 267 2722 India Toll-free > 000 800 001 4002 India Toll-free > 1 800 102 9182 India Toll-free > +62 21 3972 2110 Indonesia > +62 21 3950 1721 Indonesia > +353 6 163 9031 Ireland > +353 1 513 3247 Ireland > +353 1 691 7488 Ireland > 1800 817 388 Ireland Toll-free > +972 55 330 1762 Israel > +972 3 978 6688 Israel > 1801 227 228 Israel Toll-free > +39 069 926 8001 Italy > +39 069 480 6488 Italy > 800 596 788 Italy Toll-free > +1 876 633 1687 Jamaica > 800 491 6523 Jamaica Toll-free > +81 524 564 439 Japan > +81 3 4578 1488 Japan > 0 800 100 5040 Japan Toll-free > 800 222 03 Jordan Toll-free > +7 727 312 2408 Kazakhstan > 800 733 310 Kenya Toll-free > +965 2206 9157 Kuwait > +371 6303 1888 Latvia > +371 6303 1808 Latvia > 8000 0281 Latvia Toll-free > +370 5214 1488 Lithuania > +370 3799 9260 Lithuania > 8 800 3 03 19 Lithuania Toll-free > +352 2786 4277 Luxembourg > +352 2786 1188 Luxembourg > 800 810 88 Luxembourg Toll-free > +853 6262 1604 Macau, China > 0 800 191 Macau, China Toll-free > 0 800 904 59 Macedonia [FYROM] Toll-free > +60 3 9212 1727 Malaysia > +60 3 3099 2229 Malaysia > 1 800 818 425 Malaysia Toll-free > +356 2778 1288 Malta > +356 2776 1777 Malta > 800 62714 Malta Toll-free > +52 554 161 4288 Mexico > +52 229 910 0061 Mexico > 1800 733 4118 Mexico Toll-free > +31 70 808 1008 Netherlands > +31 20 241 0288 Netherlands > 800 220 0040 Netherlands Toll-free > +64 9 801 1188 New Zealand > +64 4 831 8959 New Zealand > 800 002 260 New Zealand Toll-free > 1800 220 2436 Nicaragua Toll-free (Mobile) > 1800 220 2039 Nicaragua Toll-free (Landline) > +234 1227 8806 Nigeria > 708 060 1822 Nigeria Toll-free > +47 7349 4877 Norway > +47 2396 0588 Norway > 800 248 88 Norway Toll-free > 800 74201 Oman Toll-free > +92 21 3879 9843 Pakistan > +507 833 9588 Panama > 800 0558 Panama Toll-free > 0098 0011 0288 Paraguay Toll-free > +51 1 730 6777 Peru > +51 1 707 5788 Peru > 800 78743 Peru Toll-free > +63 92 3099 0478 Philippines > 1800 1110 2219 Philippines Toll-free > +48 22 398 7356 Poland > +48 22 307 3488 Poland > 00 800 321 1464 Poland Toll-free > +351 308 810 988 Portugal > +351 308 804 188 Portugal > 800 180 888 Portugal Toll-free > +1 787 966 7727 Puerto Rico > +1 787 945 1488 Puerto Rico > 800 239 1922 Puerto Rico Toll-free > 00 800 100363 Qatar Toll-free > +40 37 170 0418 Romania > +40 31 630 1088 Romania > 0 800 672 631 Romania Toll-free > +7 812 426 8988 Russia > +7 495 283 9788 Russia > 800 100 6938 Russia Toll-free > 800 850 0304 Saudi Arabia Toll-free > 800 811 0528 Saudi Arabia Toll-free > 0 800 500 702 Serbia Toll-free > +65 3165 1065 Singapore > +65 3158 7288 Singapore > 800 852 6054 Singapore Toll-free > +421 233 418 515 Slovakia > +421 233 056 888 Slovakia > 0 800 005 424 Slovakia Toll-free > +386 1888 8788 Slovenia > +386 1600 3102 Slovenia > 80 488 840 Slovenia Toll-free > +27 87 551 7702 South Africa > +27 87 550 7717 South Africa > 800 064 584 South Africa Toll-free > 800 008 728 South Africa Toll-free > +82 2 6105 4111 South Korea > +82 2 6022 2322 South Korea > 808 220 250 South Korea Toll-free > +34 91 198 0188 Spain > +34 84 368 5025 Spain > 900 839 088 Spain Toll-free > +94 7 2091 0374 Sri Lanka > +46 8 4468 6646 Sweden > +46 8 4468 2488 Sweden > 20 889 860 Sweden Toll-free > +41 31 528 09 88 Switzerland > +41 22 518 89 78 Switzerland > +41 22 518 90 06 Switzerland > 800 002 622 Switzerland Toll-free > +886 (2) 7741 7473 Taiwan > 08 0909 9864 Taiwan Toll-free > +66 60 003 5790 Thailand > +66 2018 2486 Thailand > 1 800 012 275 Thailand Toll-free > +1 868 224 5838 Trinidad and Tobago > +216 31 399 163 Tunisia > +90 216 900 2606 Turkey > +90 216 900 1866 Turkey > 811 213 0011 Turkey Toll-free > +256 206 300 097 Uganda > 0 800 501567 Ukraine Toll-free > 800 035 704 555 United Arab Emirates Toll-free > 800 035 704 239 United Arab Emirates Toll-free > +44 203 966 3809 United Kingdom > +44 203 695 0088 United Kingdom > 800 031 5717 United Kingdom Toll-free > 0004 054 189 Uruguay Toll-free > 800 120 1235 Uzbekistan Toll-free > 0 800 100 5564 Venezuela Toll-free > +84 28 4458 2373 Vietnam > +263 864 404 1086 Zimbabwe > > Meeting ID: 493 602 415 > Find your local number: https://zoom.us/u/adHVuVv1DT <https://zoom.us/u/adHVuVv1DT> > >

1 0

Rec 18 -> 4
by k claffy May 24, 2019

May 24, 2019

as mentioned on call, i proposed removing rec 18. people agreed. i crossed it out. i see a related (in terms of financial accountability) rec 4: Recommendation 4 (Budget Transparency) ICANN should fully implement the SSR1 Recommendation 20 in support of strategic objectives 1, 2, and 5, and strategic goal 2.1. ICANN should be fully transparent with the budget for parts of ICANN Org related to implementing the SSR Framework and performing SSR-related functions. At the moment, SSR-related activities appear in ICANNs annual budget, but only at a very high level. This SSR1 Recommendation 20 intends a greater degree of granularity for examination and public comment of SSR-related budget items, which is currently impossible. i haven't looked at the budget, but i think we need to be more precise about what granularity we mean wrt "fully transparent". can whoever wrote this expand on it? k

1 0

SSR2 agenda 23 May
by Jennifer Bryce May 23, 2019

May 23, 2019

Dear SSR2 RT members, Below is the agenda for the next SSR2 plenary call, scheduled for Thursday 23 May at 14:00 UTC. 1. Welcome, roll call, SOI updates 2. Brief recap of Brussels meeting 3. Team member questions or issues to flag for team discussion re: merging and editing recommendations exercise * Confirm next steps and timeline for consolidating text 4. AOB 5. Confirm action items, decisions reached Best, Jennifer -- Jennifer Bryce MSSI Associate Project Manager Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

3 2

Call summary: SSR2 23 May
by Jennifer Bryce May 23, 2019

May 23, 2019

Dear SSR2 RT members, Please find attached the plenary call report for SSR2 meeting #71, 23 May at 15:00 UTC. These high-level notes are designed to help SSR2 Review Team members navigate through the content of the call. They are not meant to be a substitute for the recording or transcript, which are posted on the wiki here: https://community.icann.org/x/_YmGBg. The transcript usually becomes available 5 - 7 business days after the meeting. Best, Jennifer -- Jennifer Bryce MSSI Associate Project Manager Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

1 0

Re: [Ssr2-review] [EXT] SSR2 agenda 23 May
by Barrett, Kerry-Ann May 23, 2019

May 23, 2019

Dear Team We are hosting our annual secretariat meeting today and tomorrow so I won’t be able to attend the call today. I reviewed the assignments for me and will work on them this weekend. Look forward to seeing the next steps. Have a great memorial weekend for us folks here and for everyone else have a good one :) Sincerely, Kerry-Ann Barrett Cybersecurity Policy Specialist Organization of American States On May 22, 2019, at 4:38 AM, Jennifer Bryce <jennifer.bryce(a)icann.org<mailto:jennifer.bryce@icann.org>> wrote: CAUTION: EXTERNAL SENDER Dear SSR2 RT members, Below is the agenda for the next SSR2 plenary call, scheduled for Thursday 23 May at 14:00 UTC. 1. Welcome, roll call, SOI updates 2. Brief recap of Brussels meeting 3. Team member questions or issues to flag for team discussion re: merging and editing recommendations exercise * Confirm next steps and timeline for consolidating text 4. AOB 5. Confirm action items, decisions reached Best, Jennifer -- Jennifer Bryce MSSI Associate Project Manager Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org<mailto:jennifer.bryce@icann.org> Skype: jennifer.bryce.icann www.icann.org<http://www.icann.org> _______________________________________________ Ssr2-review mailing list Ssr2-review(a)icann.org<mailto:Ssr2-review@icann.org> https://mm.icann.org/mailman/listinfo/ssr2-review

1 0

definition of abuse
by k claffy May 23, 2019

May 23, 2019

from ssac: SSAC hasn't tried to come up with a definition. But the GNSO did have a PDP working group for that.. Its final report is at: https://gnso.icann.org/sites/default/files/filefield_12530/rap-wg-final-rep… It says: "The RAPWG developed a consensus definition of abuse, which served as a basis to further explore the scope and definition of registration abuse. This definition reads: Abuse is an action that: a. Causes actual and substantial harm, or is a material predicate of such harm, and b. Is illegal or illegitimate, or is otherwise considered contrary to the intention and design of a stated legitimate purpose, if such purpose is disclosed." So that was an consensus-agreed, GNSO-baked definition, the result of a formal community effort. Chapter 6 is "Malicious Use of Domain Names" and is highly relevant. The issue of what's in-scope for ICANN policy-making -- and what Compliance can do because of what's in and not in the contracts -- is a related but separate issue. The report above explains those issues. Bad actors REGISTER domains in order to USE them maliciously. Sometimes when parties say there is "no agreed definition of abuse" they are talking about what specific kinds of problems should be put in the registry contract Spec 11 --which specifically mentions phishing, pharming, malware, botnets. (i found this comment useful) k

1 0

relevant docs from SSAC
by k claffy May 22, 2019

May 22, 2019

seems relevant: https://www.icann.org/en/system/files/files/ssac2019-02-03may19-en.pdf also, the link i mentioned during brussels meeting last week: https://www.icann.org/en/system/files/files/ssac-review-faiip-13may19-en.pdf i think someone (who is not on ssac) should read and consider ssac's position on these many issues outlined in this doc. k

1 0