March 2020 - Ssr2-review - lists.icann.org

FYI Domain Name Registration Data at the Crossroads.
by Denise Michel March 31, 2020

March 31, 2020

A report documenting compliance and technical failures involving WHOIS, registrars and ICANN was published today – see this CircleID<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.circleid.com_posts_…> and the Domain Name Registration Data at the Crossroads<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.interisle.net_domai…>. In addition to providing extensive details on the failures, it shows how these problems have real life implications for security, stability and trust on the internet, including for detecting and mitigating cybercrime related to the current pandemic. It's well-researched and relevant to several SSR2 recommendations. Best, Denise Denise Michel denisemichel(a)fb.com<mailto:denisemichel@fb.com>

1 0

Next root zone key signing ceremony
by Žarko Kecić March 31, 2020

March 31, 2020

Dear team, I think you will be interested in the information below, about the possible approach for conducting the next root zone key signing ceremony. Obviously there is a disaster recovery plan and procedure to perform these ceremonies even in situations such as the present, although likely none of us even thought that what was happening now is actually possible. Žarko Contingency plans for the next Root KSK Ceremony Colleagues, The IANA team, and the broader ICANN organization, have been giving significant thought to the Coronavirus pandemic and its impact on root zone KSK operations. Managing the KSK is centred on conducting "key signing ceremonies", where trusted community representatives (TCRs) attend from around the world to witness utilization of the root zone KSK private key. This approach seeks to engender trust in the broader community that the key has not been compromised, in addition to more typical controls such as third-party auditing. In light of world events we have developed contingency plans around how to hold key ceremonies in the short term. To that end, we identified a graduated set of options, in summary: 1. Hold the next ceremony as planned on April 23, with a quorum of participants globally. 2. Hold the next ceremony on a different date using only US-based TCRs. 3. Hold the next ceremony using our disaster recovery procedure, which provides for a staff-only ceremony (i.e. no TCRs would be physically present). In general, our goal has been to navigate from Option 1, and if that is not possible, Option 2, and so on. However, at this time, our focus is on developing a plan around Option 3. The ceremony is currently scheduled unusually early in the quarter (it is typically held in May), and needs to be held to generate signatures that will be needed in production for July. Our contingency plan is comprised of: * Holding the ceremony with a bare minimum of staff (approximately 6); * Using 3 TCRs' credentials, either by having their access key transferred to us in a secure manner in advance of the ceremony, or by drilling the safety deposit box that holds their secure elements. * Holding the ceremony under typical audit coverage, allowing for remote witnessing of events by all, plus providing additional opportunities for TCRs to stay involved in the process remotely. * Signing key materials to cover one or more subsequent quarters, to provide relief from the need to necessarily hold ceremonies later in 2020 if circumstances disallow it. (The additional signatures would be withheld securely until they are needed.) Our key management facilities were designed with the disaster recovery capability of performing staff-only ceremonies in mind, but this is a significant shift from normal operations and we want to promote broader community awareness of this work. Those directly involved in key ceremonies - the trusted community representatives, our vendors and auditors - have been consulted and are broadly supportive of this effort. Should there be any specific feedback you would like to share with our team, please let me know or respond to this thread. We will take it into consideration as we finalize our plans. Thank you for your support. Kim Davies VP, IANA Services, ICANN President, Public Technical Identifiers (PTI)

1 0

SSR2 agenda 1 April 2020
by Jennifer Bryce March 31, 2020

March 31, 2020

Dear SSR2 RT members, Below is the agenda for the next SSR2 plenary call, scheduled for Wednesday 1 April @ 14:00 - 15:00 UTC. 1. Welcome, roll call, SOI updates 2. Determine approach to review of public comments (see analysis spreadsheet<https://docs.google.com/spreadsheets/u/1/d/1DQpPA0aLDsW5IHLKgQqHtW-5860CKGC…>) 3. Determine approach to completion of review work (see sign-up sheet<https://docs.google.com/spreadsheets/u/1/d/1cOZ1lPXqHfuZNt68zvB5xRB63eBoL3g…> for subteams) 4. Review of outstanding team member comments in the markup document [docs.google.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__docs.google.com_docume…> 5. AOB 6. Confirm action items, decisions reached Best, Jennifer -- Jennifer Bryce MSSI Associate Project Manager Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

2 1

Re: [Ssr2-review] [EXT] SSR2 agenda 1 April 2020
by Barrett, Kerry-Ann March 30, 2020

March 30, 2020

Team Just heads up. The GAC is preparing comments for our draft report. From all indications so far it seems positive and very constructive. Sincerely, Kerry-Ann Barrett Cybersecurity Policy Specialist Organization of American States On Mar 30, 2020, at 5:44 PM, Jennifer Bryce <jennifer.bryce(a)icann.org> wrote: CAUTION: EXTERNAL SENDER Dear SSR2 RT members, Below is the agenda for the next SSR2 plenary call, scheduled for Wednesday 1 April @ 14:00 - 15:00 UTC. 1. Welcome, roll call, SOI updates 2. Determine approach to review of public comments (see analysis spreadsheet<https://docs.google.com/spreadsheets/u/1/d/1DQpPA0aLDsW5IHLKgQqHtW-5860CKGC…>) 3. Determine approach to completion of review work (see sign-up sheet<https://docs.google.com/spreadsheets/u/1/d/1cOZ1lPXqHfuZNt68zvB5xRB63eBoL3g…> for subteams) 4. Review of outstanding team member comments in the markup document [docs.google.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__docs.google.com_docume…> 5. AOB 6. Confirm action items, decisions reached Best, Jennifer -- Jennifer Bryce MSSI Associate Project Manager Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org _______________________________________________ Ssr2-review mailing list Ssr2-review(a)icann.org https://mm.icann.org/mailman/listinfo/ssr2-review _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos) You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.

1 0

Recommendation 8.3
by Russ Housley March 30, 2020

March 30, 2020

Alain: On the call today, there was a discussion of Recommendation 8.3. The question raised is: "Is there any evidence this has ever been a problem?" Can you point to one? Russ

2 3

Call summary: SSR2 25 March 2020
by Jennifer Bryce March 25, 2020

March 25, 2020

Dear SSR2 RT members, Please find attached the plenary call report for SSR2 meeting #105, 25 March 2020 at 14:00 UTC. These high-level notes are designed to help SSR2 Review Team members navigate through the content of the call. They are not meant to be a substitute for the recording or transcript, which are posted on the wiki here: https://community.icann.org/x/DR2JBw. The transcript usually becomes available 5 - 7 business days after the meeting. Best, Jennifer -- Jennifer Bryce MSSI Associate Project Manager Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

1 0

Re: [Ssr2-review] [EXT] Re: SSR2 agenda 25 March 2020
by Barrett, Kerry-Ann March 25, 2020

March 25, 2020

Hi Team My boss just asked for a team meeting to reorganize our workload. Apologies. On that call now Sincerely, Kerry-Ann Barrett Cybersecurity Policy Specialist Organization of American States On Mar 25, 2020, at 9:15 AM, Eric Osterweil <eric(a)osterweil.net> wrote: CAUTION: EXTERNAL SENDER Hi all, Please also note my apologies. An unanticipated faculty meeting has been called for our department. Eric From: Ssr2-review <ssr2-review-bounces(a)icann.org> on behalf of ALAIN AINA via Ssr2-review <ssr2-review(a)icann.org> Reply-To: ALAIN AINA <aalain(a)trstech.net> Date: Wednesday, March 25, 2020 at 8:21 AM To: Jennifer Bryce <jennifer.bryce(a)icann.org> Cc: "ssr2-review(a)icann.org" <ssr2-review(a)icann.org> Subject: Re: [Ssr2-review] SSR2 agenda 25 March 2020 Dear Jennifer, Please note my Apologies for this call. Thanks —Alain On 23 Mar 2020, at 17:25, Jennifer Bryce <jennifer.bryce(a)icann.org<mailto:jennifer.bryce@icann.org>> wrote: Dear SSR2 RT members, Below is the agenda for the next SSR2 plenary call, scheduled for Wednesday 25 March @ 14:00 - 15:00 UTC. 1. Welcome, roll call, SOI updates 2. Presentation and discussion of the revised report outline<https://docs.google.com/document/d/1FbdsGs0e0gTe7BVZK8_L1ZNOKJPgjIsCMWWpIiG…> proposal by Heather and Laurin 3. Review the public comments analysis spreadsheet<https://docs.google.com/spreadsheets/u/1/d/1DQpPA0aLDsW5IHLKgQqHtW-5860CKGC…> 4. Continue review of team member comments in the markup document<https://docs.google.com/document/d/1yb6RYublATbo_ae3G9BLUr3nziZFIIdVQQhETBE…> 5. AOB 6. Confirm action items, decisions reached Best, Jennifer -- Jennifer Bryce MSSI Associate Project Manager Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org<mailto:jennifer.bryce@icann.org> Skype: jennifer.bryce.icann www.icann.org<http://www.icann.org/> _______________________________________________ Ssr2-review mailing list Ssr2-review(a)icann.org<mailto:Ssr2-review@icann.org> https://mm.icann.org/mailman/listinfo/ssr2-review _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos) You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on. _______________________________________________ Ssr2-review mailing list Ssr2-review(a)icann.org https://mm.icann.org/mailman/listinfo/ssr2-review _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos) You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on. _______________________________________________ Ssr2-review mailing list Ssr2-review(a)icann.org https://mm.icann.org/mailman/listinfo/ssr2-review _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos) You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.

1 0

SSR2 agenda 25 March 2020
by Jennifer Bryce March 25, 2020

March 25, 2020

Dear SSR2 RT members, Below is the agenda for the next SSR2 plenary call, scheduled for Wednesday 25 March @ 14:00 - 15:00 UTC. 1. Welcome, roll call, SOI updates 2. Presentation and discussion of the revised report outline<https://docs.google.com/document/d/1FbdsGs0e0gTe7BVZK8_L1ZNOKJPgjIsCMWWpIiG…> proposal by Heather and Laurin 3. Review the public comments analysis spreadsheet<https://docs.google.com/spreadsheets/u/1/d/1DQpPA0aLDsW5IHLKgQqHtW-5860CKGC…> 4. Continue review of team member comments in the markup document<https://docs.google.com/document/d/1yb6RYublATbo_ae3G9BLUr3nziZFIIdVQQhETBE…> 5. AOB 6. Confirm action items, decisions reached Best, Jennifer -- Jennifer Bryce MSSI Associate Project Manager Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

3 2

The SSAC has published SAC109
by k claffy March 24, 2020

March 24, 2020

Can we remove Rec 31 now, or declare it implemented? The SSAC has published the following report. SAC109: The Implications of DNS over HTTPS and DNS over TLS <https://www.icann.org/en/system/files/files/sac-109-en.pdf> k

3 2

Registrar Guide to Abuse Reporting
by danko.jevtovic＠board.icann.org March 24, 2020

March 24, 2020

I believe this might be of interest to the team. Best, Danko Jevtović Subject: Registrar Guide to Abuse Reporting Hi All, I wanted to share with you a document published today by the Registrar Stakeholder Group. The goal of this document is to ensure that complaints of abuse submitted to Registrars contain all the information required to be actionable. As such, it provides the specific pieces of information required for each of the main categories of abuse typically submitted to a Registrar, as well as the general facts common to all abuse types. You can find the document attached, as well as hosted on our website here: https://rrsg.org/guide-to-registrar-abuse-reporting-practices/ [rrsg.org] <https://urldefense.proofpoint.com/v2/url?u=https-3A__rrsg.org_guide-2Dto-2D…> Lastly, a brief reminder of a similar document on the minimum information requirements for submitting a request for non-public Registrant information that can be found here: https://rrsg.org/minimum-required-information-for-whois-data-requests/ [rrsg.org] <https://urldefense.proofpoint.com/v2/url?u=https-3A__rrsg.org_minimum-2Dreq…> If you have questions, or suggestions for those documents, please feel free to contact me directly, or via secretariat(a)icannregistrars.org <mailto:secretariat@icannregistrars.org> Regards, Graeme Chair, Registrar Stakeholder Group -- ____________________________ Graeme Bunton Head of Policy Tucows Inc. PH: 416 535 0123 ext 1634

1 0