April 2020 - Ssr2-review - lists.icann.org

ICANN Organization Blog on DNS Abuse
by danko.jevtovic＠board.icann.org June 10, 2020

June 10, 2020

ICANN Organization Blog on DNS Abuse https://www.icann.org/news/blog/icann-org-s-multifaceted-response-to-dns-ab… Danko

4 7

For Zarko
by Russ Housley April 29, 2020

April 29, 2020

Zarko: I have been trying to reach you to start a discussion about Subteam 1. Are my messages going to your junk folder again? Russ

1 0

Call summary: SSR2 22 April 2020
by Jennifer Bryce April 22, 2020

April 22, 2020

Dear SSR2 RT members, Please find attached the plenary call report for SSR2 meeting #109, 22 April 2020 at 14:00 UTC. These high-level notes are designed to help SSR2 Review Team members navigate through the content of the call. They are not meant to be a substitute for the recording or transcript, which are posted on the wiki here: https://community.icann.org/x/GDGJBw. The transcript usually becomes available 5 - 7 business days after the meeting. Best, Jennifer -- Jennifer Bryce MSSI Associate Project Manager Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

1 0

Re: [Ssr2-review] [EXT] SSR2-RT Plenary Call | 22 April @ 14:00 UTC
by Eric Osterweil April 22, 2020

April 22, 2020

Hi Everyone, Same here, sorry. Eric > On Apr 22, 2020, at 1:19 AM, Boban Krsic <krsic(a)denic.de> wrote: > > Hi all, same here. I won’t be able to participate in today’s call. My apologies. > > Stay safe and best regards > > Boban > > >> On 22. Apr 2020, at 05:18, Barrett, Kerry-Ann <kabarrett(a)oas.org> wrote: >> >> >> >> Apologies, Won’t be able to join the call tomorrow due to a call conflict and time zone coordination issues. >> >> Haven’t started with my sub-teams email yet but will be sending it out this week. >> >> Stay safe everyone. >> >> >> [EXT] SSR2-RT Plenary Call | 22 April @ 14:00 UTC >> Scheduled: Wednesday, Apr 22, 2020 from 10:00 AM to 11:00 AM >> Location: https://icann.zoom.us/j/493602415 | +16699006833,,493602415# >> Invitees: kc(a)caida.org, naveedbinrais(a)gmail.com, Board Calendaring‌, eric(a)osterweil.net, ameen(a)cert-in.org.in, scott.mccormick(a)reciprocitylabs.com, Brenda Brewer‌, kaveh.ranjbar(a)board.icann.org, krsic(a)denic.de, danko.jevtovic(a)board.icann.org, lists(a)osterweil.net, Steve Conte‌, norm(a)webcatcher.ca, zarko.kecic(a)rnids.rs, Daniel Halloran‌, denisemichel(a)fb.com, noorul.ameen(a)meity.gov.in, housley(a)vigilsec.com, Jennifer Bryce‌, aalain(a)trstech.net, MSSI Secretariat‌, John L. Crain‌, laurin.weissinger(a)yale.edu, Larisa B. Gurnick‌, Laena Rahim‌, ramkrishna(a)isoc.org.np, hlf(a)sphericalcowconsulting.com, jaberamatogoro(a)gmail.com, Charla Shambley‌, kerryann.barrett(a)gmail.com >> >> >> Sincerely, >> Kerry-Ann Barrett >> Cybersecurity Policy Specialist >> Organization of American States

3 2

SSR2 agenda 22 April 2020
by Jennifer Bryce April 20, 2020

April 20, 2020

Dear SSR2 RT members, Below is the agenda for the next SSR2 plenary call, scheduled for Wednesday 22 April @ 14:00 - 15:00 UTC. 1. Welcome, roll call, SOI updates 2. Subteams to report out on progress (See list of subteams here [docs.google.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__docs.google.com_spread…> for reference) 3. Continue review of public comments assigned the ‘summary’ tag (see public comment feedback spreadsheet [docs.google.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__docs.google.com_spread…> column ‘B’) 4. AOB 5. Confirm action items, decisions reached Best, Jennifer -- Jennifer Bryce MSSI Associate Project Manager Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

1 0

Call summary: SSR2 15 April 2020
by Jennifer Bryce April 15, 2020

April 15, 2020

Dear SSR2 RT members, Please find attached the plenary call report for SSR2 meeting #108, 15 April 2020 at 14:00 UTC. These high-level notes are designed to help SSR2 Review Team members navigate through the content of the call. They are not meant to be a substitute for the recording or transcript, which are posted on the wiki here: https://community.icann.org/x/izCJBw. The transcript usually becomes available 5 - 7 business days after the meeting. Best, Jennifer -- Jennifer Bryce MSSI Associate Project Manager Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

1 0

Call summary: SSR2 8 April 2020
by Jennifer Bryce April 14, 2020

April 14, 2020

Dear SSR2 RT members, Please find attached the plenary call report for SSR2 meeting #107, 8 April 2020 at 14:00 UTC. These high-level notes are designed to help SSR2 Review Team members navigate through the content of the call. They are not meant to be a substitute for the recording or transcript, which are posted on the wiki here: https://community.icann.org/x/iDCJBw/. The transcript usually becomes available 5 - 7 business days after the meeting. Best, Jennifer -- Jennifer Bryce MSSI Associate Project Manager Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

1 0

SSR2 agenda 15 April 2020
by Jennifer Bryce April 14, 2020

April 14, 2020

Dear SSR2 RT members, Below is the agenda for the next SSR2 plenary call, scheduled for Wednesday 15 April @ 14:00 - 15:00 UTC. 1. Welcome, roll call, SOI updates 2. Subteams to report out on progress (as available. See list of subteams here<https://docs.google.com/spreadsheets/d/1cOZ1lPXqHfuZNt68zvB5xRB63eBoL3gonDb…> for reference) 3. Continue review of public comments assigned the ‘summary’ tag (see public comment feedback spreadsheet [docs.google.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__docs.google.com_spread…> column ‘B’) 4. AOB 5. Confirm action items, decisions reached Best, Jennifer -- Jennifer Bryce MSSI Associate Project Manager Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

1 0

FW: FYI - COVID-19, WHOIS, and the Pressing Need for Help With Domain Name System Abuse
by Denise Michel April 10, 2020

April 10, 2020

Re-sending. Seems to have been blocked… From: Denise Michel <denisemichel(a)fb.com> Date: Wednesday, April 8, 2020 at 8:38 AM To: SSR2 <ssr2-review(a)icann.org> Subject: FYI - COVID-19, WHOIS, and the Pressing Need for Help With Domain Name System Abuse This blog addresses domain name abuse, abuse of domains associated with the COVID-19 crisis, and how ICANN has failed to respond. http://www.circleid.com/posts/20200407-covid19-whois-and-pressing-need-for-…<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.circleid.com_posts_…> COVID-19, WHOIS, and the Pressing Need for Help With Domain Name System Abuse<http://www.circleid.com/posts/20200407-covid19-whois-and-pressing-need-for-…> By Mason Cole<http://www.circleid.com/members/552/> · Apr 07, 2020 2:27 PM PDT As widely reported, and not surprising, the internet is swimming in COVID-19 online scams<https://arstechnica.com/information-technology/2020/03/the-internet-is-drow…>. Criminals, accustomed to rapidly grabbing online territory during times of crisis and profiting from public fear, are working overtime in the face of the coronavirus. Unfortunately, ICANN's failure to enforce its minimal WHOIS and DNS abuse requirements has resulted in delayed mitigation efforts at a time when swift responses are needed to protect the public from COVID-19 scams. For years, ICANN Org has been challenged to proactively address DNS abuse — with calls to action intensifying over the course of the past two ICANN meetings. The problem, already acute, is now even more visible due to the pandemic and is exacerbating this tragic public health crisis. ICANN Org has the tools, via enforcement of its contracts with registrars and registries, to do something about this — but it's not. The COVID crisis calls for an immediate response from the ICANN Board to ensure that ICANN's contracts are enforced, timely WHOIS access is granted, and ICANN's operations actively support DNS abuse mitigation efforts, to the greatest extent possible. Here's the proof: In the domain name sector, over the course of the last several weeks, security researchers have documented a spike in the number of coronavirus-related domains<https://unit42.paloaltonetworks.com/covid19-cyber-threats/> — more than 100,000 registered in March alone — with attacks sourced from those registrations growing in conjunction with the disease's spread. An estimated half (and probably more by now) were identified as sources of malware or other harms<https://blog.checkpoint.com/2020/03/05/update-coronavirus-themed-domains-50…>. It's bad enough that even as her state is reeling from the medical crisis, New York's attorney general had to ask registrars what they're doing to protect the online public<https://ag.ny.gov/sites/default/files/3.19.20_letter_concerning_godaddy_and…> from cybercriminals. What started as a few registrations a day earlier this year are now thousands of new domains popping up daily, containing terms like coronavirus, COVID, pandemic, virus, or vaccine. Few, if any, of these registrations are for domain names meant to be authentic, authoritative sources of information about the ongoing public health crisis. Case in point: CoronaVirusApp[.]site is a documented ransomware site that distributes malware by holding targeted systems hostage. Registrants like these seek to capitalize on the public's fear to, at best, propagate misinformation or, at worst, spread their own versions of harm. Some are even claiming to provide vaccines against the virus<https://www.washingtonpost.com/national-security/coronavirus-vaccine-fraud-…>. Just as the world is facing a pandemic, so is the online world facing a spreading case of domain name system abuse. Unfortunately, if one wanted to stop the harm even after these types of domains go into use, no one can look up ownership and other relevant WHOIS data details for these parasitic names, thanks to ICANN's overly restrictive WHOIS policy, widespread non-compliance by registrars and registries<http://www.interisle.net/sub/DomainRegistrationData.pdf>, and ICANN's refusal to implement its own privacy/proxy policy. Compounding the problem is the fact that it's highly unlikely registrars bothered to validate the information provided by these registrants because ICANN has refused to require even the simplest steps to validate information at the point of registration. As a result, the WHOIS system — the number one instrument available to know who's behind a domain name and to track scammers (a legitimate and legal investigatory use of WHOIS to mitigate abuse, even under GDPR) — has been rendered useless. For several years, a majority of the stakeholder groups in ICANN (even many of the world's governments) have pleaded with ICANN's Board, staff, and community to do something about DNS abuse — at least, ramp up WHOIS compliance efforts. So far, however, the response has been underwhelming. While a recent voluntary effort by some registrars against COVID-related domains<https://rrsg.org/wp-content/uploads/2020/03/Registrar-approaches-to-the-COV…> is a positive step, it's clear that those still harboring the bad guys don't care about frameworks — and that this cohort of registrars won't ever take part in voluntary work to address DNS abuse. Still, while ICANN abrogates its responsibilities and tries to defend its limited and largely ineffectual actions, the problem continues to grow unabated and unchecked. When queried during ICANN67 about its anemic response to such a growing problem, ICANN executives could have said, "You're right, we're in a unique position to do more about this — not only can we, we're obligated to, so let's get to work together." Instead, we heard meandering replies, again pointing to community voluntary initiatives aimed at curtailing abuse. Voluntary statements targeting political hot-button abuses of domains with no accountability mechanisms is not a substitute for fixing WHOIS, ensuring compliance with ICANN's contracts, and improving DNS abuse mitigation. It's abundantly clear that it's time for ICANN to stop toying with the abuse concept and actually do something meaningful. The recently published findings of the security research-focused Interisle Consulting Group<http://www.interisle.net/sub/DomainRegistrationData.pdf> following its review of WHOIS practices among registrars highlights the severity of the problem. As documented in the report, Interisle found that registrars failed basic inquiries regarding WHOIS accessibility and compliance 40% of the time, and that there were notable usability issues in an additional 16% of cases. A significant percentage of registrars do not fully comply with ICANN's Temporary Specification that was adopted in 2018 to address GDPR concerns. This widespread non-compliance with ICANN's contractual policies involving both large and small registrars is alarming, and points to failures in ICANN's compliance procedures. This study illustrated clear "failures to provide the access, predictability, and reliability that ICANN exists to deliver, and that registrars are obligated to provide." In the face of these statistics, it's hard to argue otherwise. Worse yet, these failures created significant obstacles for those responding the COVID-19 scams. As noted by Interisle, "[t]he pandemic has led to an explosion of cybercrime, preying upon a population desperate for safety and reassurance, and that 'legal authorities are currently struggling with this wave of domain-based crime.'" There's a way out of this mess. ICANN Org can: * enforce its contracts and, where needed, strengthen the contracts it finds toothless — contracts that are currently under negotiation — in order to target industry players that don't participate in DNS abuse mitigation efforts; * issue advisories or guidance to contracted parties regarding options available for mitigation of DNS abuse; and * take action on overdue matters, such as the unanimously-supported privacy/proxy accreditation policy<https://www.icann.org/resources/pages/ppsai-2016-08-18-en>, approved years ago but never implemented, and the cross-field validation requirement set in 2013 but also never implemented. What ICANN cannot do is continue to stand idly by, opening and resolving a few single, low-level complaint tickets, while the real problem persists in greater and greater magnitude and is perpetrated by known bad actors. Nor can ICANN Org, including its Board, continue to point to voluntary industry best practice "frameworks" as a replacement for its own responsibilities and contracts with registrars, registries and privacy/proxy service providers. Patience is growing thin by those watching damage occur to the world's online identifier system in the midst of the COVID-19 crisis. This includes the registrars and registries who today expend great efforts and resources to combat abuse, only to be painted with broad brush alongside these bad actors. ICANN is overdue to respond in a meaningful and impactful way to the DNS abuse problem. Denise Michel denisemichel(a)fb.com<mailto:denisemichel@fb.com>

1 0

test
by Denise Michel April 10, 2020

April 10, 2020

1 0