July 2020 - Ssr2-review - lists.icann.org

Call summary: SSR2 Plenary - 29 July 2020
by MSSI Secretariat Aug. 24, 2020

Aug. 24, 2020

Dear SSR2 RT members, Please find attached the plenary call report for SSR2 meeting #119, 29 July 2020 at 14:00 UTC. These high-level notes are designed to help SSR2 Review Team members navigate through the content of the call. They are not meant to be a substitute for the recording or transcript, which are posted on the wiki here: https://community.icann.org/x/SIM4C. The transcript usually becomes available 5 - 7 business days after the meeting. With kind regards, Brenda --- Brenda Brewer, Projects & Operations Assistant Multistakeholder Strategy & Strategic Initiatives (MSSI) Internet Corporation for Assigned Names and Numbers (ICANN) Skype: brenda.brewer.icann

3 2

Fwd: Request to fill the form for the purpose of academic research.
by Kerry-Ann Barrett July 28, 2020

July 28, 2020

Are we able to verify if this is a phishing attacking using Rams email? Cheers Kerry-Ann Begin forwarded message: > From: Ram Krishna Pariyar <pariyar.ramkrishna(a)gmail.com> > Date: July 28, 2020 at 1:25:18 AM EDT > To: Champika <champika.wijayatunga(a)icann.org>, Kasun De Zoysa <kasun(a)ucsc.cmb.ac.lk>, Tashi Phuntsho <toebinoz(a)gmail.com>, adli(a)apnic.net, Suvash Khadka <specificideas(a)gmail.com>, Matogoro Jabera <jaberamatogoro(a)gmail.com>, kerryann.barrett(a)gmail.com, noorul.ameen(a)meity.gov.in, ameen(a)cert-in.org.in, scott.mccormick(a)reciprocitylabs.com, aalain(a)trstech.net, krsic(a)denic.de, Sahil Kath <ksahil(a)juniper.net>, kenneth.tux(a)gmail.com > Subject: Request to fill the form for the purpose of academic research. > > > Dear Sir / Madam > > Good Morning/ Afternoon / Evening > > I Have invited you to fill out a form. I Hope you will not disappoint me. > > --------------------------------------------------------- > This form is for the purpose of academic research. Would you please give some minutes of your valuable time to fill up this form. > The objective of this form is to collect data to prepare a Guidelines for Incident Response, Digital Forensics Investigation and Security Management for the country initiating cybersecurity practices > https://forms.office.com/Pages/ResponsePage.aspx?id=fP6q5RuXt0qwORQa02rOwHH… > > > Regards > Ram Krishna Pariyar >

1 0

SSR2 agenda 29 July 2020
by Jennifer Bryce July 28, 2020

July 28, 2020

Dear SSR2 RT members, Below is the agenda for the next SSR2 plenary call, scheduled for Wednesday 29 July @ 14:00 - 15:00 UTC. Please review the materials in advance of the call to allow for more discussion time during the meeting. 1. Welcome, roll call, SOI updates 2. Review the subteam status document<https://docs.google.com/spreadsheets/d/1cOZ1lPXqHfuZNt68zvB5xRB63eBoL3gonDb…> - determine areas where progress is slow and agree next steps 3. Ensure ICANN org responses to SSR2 questions (see emails to list) are being considered in subteam work 4. Review elements of ‘Risk’ text here<https://docs.google.com/document/d/1MJrPzXTngRCrdXLuiyPf7SeZsuPvwjjFGFoooQs…>: * Kerry-Ann’s text on the link between CISO and CDO (p30) * Recommendation 4 (p33) 1. Review available ‘Abuse’ subteam text 2. AOB 3. Confirm action items, decisions reached Additional reference documents: * Response to public comments spreadsheet here [docs.google.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__docs.google.com_spread…> Best, Jennifer -- Jennifer Bryce MSSI Associate Project Manager Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

1 0

Re: [Ssr2-review] [Ext] Re: ICANN Organization Blog on DNS Abuse
by Jennifer Bryce July 24, 2020

July 24, 2020

Dear SSR2 RT members, Please see below for ICANN org’s responses (in red) to the questions asked by SSR2 RT: It was announced earlier this year that Verisign will give ICANN $20 million over five years, beginning next year, “to support ICANN's initiatives to preserve and enhance the security, stability, and resiliency of the DNS.” Why (were there SSR vulnerabilities identified by Verisign and/or ICANN for which funding was needed)? No extraordinary SSR-related vulnerabilities were identified, rather Verisign and ICANN agreed that the security, stability and resiliency of the DNS must continue to be a critical focus for ICANN, Verisign and other Internet stakeholders. Would you please provide the SSR2 with details on what specific activities ICANN will be using these funds for, next year and in subsequent years, (beyond the general categories mentioned in Goran’s March 27 announcement). Specific activities have not, as yet, been identified. ICANN’s role in enhancing SSR has a broad range of applications and activities that these funds are available to address. ICANN org will be developing a framework to identify and select the activities that will be supported by these funds. What criteria and process is ICANN using to determine how to spend this SSR money? The criteria and process have not, as yet, been identified. Goran stated that he “recognizes the request for accountability and transparency regarding how the funds are used and is committed to full transparency to provide the ICANN community the appropriate level of detail when available”-- please provide SSR2 more details on this, including how the funds and expenditures will be reflected and tracked in ICANN’s annual budget and operating plan. These funds are included in the five-year operating plan and are part of the ICANN org’s operational funding. The activities and corresponding expenses pertaining to this funding will be tracked and documented specifically within the operating plan to ensure transparency on the use of these funds. Best, Jennifer From: Denise Michel <denisemichel(a)fb.com> Date: Monday, May 11, 2020 at 8:04 PM To: Jennifer Bryce <jennifer.bryce(a)icann.org>, "ssr2-review(a)icann.org" <ssr2-review(a)icann.org> Subject: [Ext] Re: [Ssr2-review] ICANN Organization Blog on DNS Abuse And please add another question: It was announced earlier this year that Verisign will give ICANN $20 million over five years, beginning next year, “to support ICANN's initiatives to preserve and enhance the security, stability, and resiliency of the DNS.” Why (were there SSR vulnerabilities identified by Verisign and/or ICANN for which funding was needed)? Would you please provide the SSR2 with details on what specific activities ICANN will be using these funds for, next year and in subsequent years, (beyond the general categories mentioned in Goran’s March 27 announcement). What criteria and process is ICANN using to determine how to spend this SSR money? Goran stated that he “recognizes the request for accountability and transparency regarding how the funds are used and is committed to full transparency to provide the ICANN community the appropriate level of detail when available”-- please provide SSR2 more details on this, including how the funds and expenditures will be reflected and tracked in ICANN’s annual budget and operating plan. Thanks Denise From: Denise Michel <denisemichel(a)fb.com> Date: Tuesday, May 5, 2020 at 3:43 PM To: Jennifer Bryce <jennifer.bryce(a)icann.org>, SSR2 <ssr2-review(a)icann.org> Subject: Re: [Ssr2-review] ICANN Organization Blog on DNS Abuse Hi, Jennifer. Please also include the following addition: ICANN reportedly will be adding supplemental questions and criteria on DNS abuse to the registrar accreditation application (sounds promising). Please provide SSR2 with information about this including: the final or draft supplemental text; how ICANN will assess the answers; whether and how the answers will factor into ICANN’s decision to approve or deny an application; how ICANN will track and hold an approved registrar accountable for the registrar’s statements in the application regarding how the applicant intends to address DNS abuse as a registrar; and whether ICANN has plans to add similar supplemental DNS abuse questions and criteria to registrar contract renewals (why, why not). Thanks, Denise From: Ssr2-review <ssr2-review-bounces(a)icann.org> on behalf of Jennifer Bryce <jennifer.bryce(a)icann.org> Date: Tuesday, May 5, 2020 at 2:41 PM To: SSR2 <ssr2-review(a)icann.org> Subject: Re: [Ssr2-review] ICANN Organization Blog on DNS Abuse Dear Russ, Thanks for your note. We’ll now share the questions with the relevant SMEs within the org and will provide the review team with an expected response delivery date as soon as we have this information. Per the standard process on requests for information, we’ll track the request/response as an action item on the wiki<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_x_…>. Best, Jennifer From: Ssr2-review <ssr2-review-bounces(a)icann.org> on behalf of Russ Housley <housley(a)vigilsec.com> Date: Tuesday, May 5, 2020 at 10:12 AM To: ICANN SSR2 <ssr2-review(a)icann.org> Subject: Re: [Ssr2-review] ICANN Organization Blog on DNS Abuse I would be interested in the answers to these questions. What is needed for staff to get the Q&A process started? Russ From: Ssr2-review <ssr2-review-bounces(a)icann.org<mailto:ssr2-review-bounces@icann.org>> on behalf of SSR2 <ssr2-review(a)icann.org<mailto:ssr2-review@icann.org>> Reply-To: Denise Michel <denisemichel(a)fb.com<mailto:denisemichel@fb.com>> Date: Wednesday, April 29, 2020 at 1:36 PM To: "danko.jevtovic(a)board.icann.org<mailto:danko.jevtovic@board.icann.org>" <danko.jevtovic(a)board.icann.org<mailto:danko.jevtovic@board.icann.org>>, SSR2 <ssr2-review(a)icann.org<mailto:ssr2-review@icann.org>> Subject: Re: [Ssr2-review] ICANN Organization Blog on DNS Abuse Thanks for sharing, the ICANN blog<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_news_blo…>, Danko. It’s highly relevant to SSR2 work, as well as to what several SSR2 members are doing in our day jobs to stop domain abuse. On the whole, the blog is an expression of intent to act. While welcomed, there are no specifics nor a time table for when the internal and community actions will occur. This raises several questions related to SSR2 work for ICANN Staff to answer (and a couple for the Board), which are listed below. Would SSR2 be able to get expedited answers to these? It would be useful for all concerned if we could factor this into our SSR2 work. Thanks Denise 1) The blog says: " the domain names and the data collected by the system will be shared with parties who are in a position to take action, such as registrars and registries, and in some cases with national and international law enforcement organizations." * What specific actions is ICANN expecting registries and registrars to take? * For example, is ICANN encouraging suspension of name resolution or of the registration, or the registrant account? * Will ICANN ask registrars and registries to report on the efficacy of these actions? If so, when and on what cadence? * ICANN should publicly report per registrar & registry action: * How many names has it identified as suspicious/malicious? * What’s the number of domain names that each registry/registrar has taken action against? And what action was taken? * When can we expect ICANN public reporting and on what cadence? 2) What distinguishes ICANN's participation in the face of the pandemic from how they've participated in the past? * The blog says: “ICANN Compliance uses data collected in audits (described in more detail below) to assess whether registries and registrars are adhering to their DNS security threat obligations.” * What will Compliance do that it has not done until now? * Is Compliance making audit data associated with US-based registrars available to States Attorney Generals and the US Attorney General? 3) The blog states (the obvious) that ICANN isn’t a regulator of Internet content, but it doesn’t address ICANN’s public interest remit. Multiple entities have asked ICANN to better govern the manner in which domain names are registered, and now especially, everyone is asking ICANN to hold contracted parties to greater accountability to prevent domains from being registered by malicious actors, especially for pandemic-related fraud and abuse. This requires greater scrutiny during the registration process. * What actions are ICANN taking that address this? * In addition to high volumes of fraudulent domain names containing pandemic-related strings with which criminals try to fool Internet users, random looking or otherwise auto-generated names that are easy to register in volume and are being used by the hundreds to perpetuate pandemic-related phishing attacks. What actions are ICANN taking that addresses this? * Recommended actions contained in SSR2’s draft report could help mitigate pandemic-related domain name abuse. Is the ICANN Board and staff reconsidering any of these actions? * Recommendations from others over the last few years also would help mitigate pandemic-related domain name abuse – especially the substantially increased phishing attacks that harm users. Is the ICANN Board and staff reconsidering any of these actions? Including: - will ICANN move to ensure domain name registrant data is validated? Or at least implement cross-field validation? - will ICANN put in place an Acceptable Use Policy that applies specifically to parties that register large numbers of domains, that requires registrants to apply for (and be validated for) bulk registration services? Further, will ICANN put in place an obligation to distinguish domain names registered by legal entities from those registered by natural persons, classify parties that use bulk registration services as legal entities, and require unredacted access to the registration data of legal entities? - will ICANN maintain and publish a current list of validated bulk registrants (who are from above defined as not natural persons)? - will ICANN disallow registration transactions that involve large numbers of random-looking algorithmic domain names? - will ICANN disallow, for a period of one year, the re-registration of any bulk-registered domain name that has been used in a criminal cyberattack? On Apr 21, 2020, at 11:44 AM, danko.jevtovic(a)board.icann.org<mailto:danko.jevtovic@board.icann.org> wrote: ICANN Organization Blog on DNS Abuse https://www.icann.org/news/blog/icann-org-s-multifaceted-response-to-dns-ab… [icann.org]<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_news_blo…> Danko

1 0

article on dns abuse
by k claffy July 23, 2020

July 23, 2020

http://www.circleid.com/posts/20200723-the-state-of-dns-abuse-moving-backwa…

1 0

Call summary: SSR2 Plenary - 22 July 2020
by MSSI Secretariat July 23, 2020

July 23, 2020

Dear SSR2 RT members, Please find attached the plenary call report for SSR2 meeting #118, 22 July 2020 at 14:00 UTC. These high-level notes are designed to help SSR2 Review Team members navigate through the content of the call. They are not meant to be a substitute for the recording or transcript, which are posted on the wiki here: https://community.icann.org/x/RYM4C. The transcript usually becomes available 5 - 7 business days after the meeting. With kind regards, Brenda --- Brenda Brewer, Projects & Operations Assistant Multistakeholder Strategy & Strategic Initiatives (MSSI) Internet Corporation for Assigned Names and Numbers (ICANN) Skype: brenda.brewer.icann

1 0

Re: [Ssr2-review] [EXT] Please raise any issues or concerns on the direction of Abuse Group of Subteams
by Barrett, Kerry-Ann July 22, 2020

July 22, 2020

Dear all Apologies for missing the call today, I was to send an email last night and forgot. Was my daughters 2nd birthday and got caught up with the celebrations. Will review notes and send any comments needed. Sincerely, Kerry-Ann Barrett Cybersecurity Policy Specialist Organization of American States > On Jul 22, 2020, at 10:35 AM, Russ Housley <housley(a)vigilsec.com> wrote: > > <HTML><div style='border:solid #9C6500 1.0pt;padding:2.0pt 2.0pt 2.0pt 2.0pt'><h1 style='line-height:12.0pt;background:#FFEB9C'><strong><span style='font-size:12.0pt;font-family:"Calibri",sans-serif;color:red'>CAUTION: EXTERNAL SENDER</span></strong><span style='font-size:12.0pt;color:black'><o:p></o:p></span></h1></div></HTML> > > SSR2 RT: > > The Abuse Group of Subteams provided a spreadsheet (attached again below). It was observed that some people that provided public comment do not agree with some abuse-related recommendations. In some cases, the draft report was not clear, and the Abuse Group of Subteams are proposing that the final report be more clear. In other cases, the commenter does not agree with the recommendation, and the the Abuse Group of Subteams are sticking to the previous SSR2 RT consensus around the recommendation. > > On the call today, there was agreement with the direction taken by the Abuse Group of Subteams. If you have any issues or concerns, please raise them on the mail list now. > > Russ > > > >> On Jul 17, 2020, at 3:00 PM, Russ Housley <housley(a)vigilsec.com> wrote: >> >> Please find the attachment for SSR2 RT review. It contains the Abuse Subgroup’s work on the public comments on Recs 10 – 19. >> >> Abuse Subgroup is still working on merging and updating those Recs; however, this will allows everyone to see the direction that be being taken. >> >> Russ >> > <Abuse Sub Team Proposed Responses - Comments.pdf> > _______________________________________________ > Ssr2-review mailing list > Ssr2-review(a)icann.org > https://mm.icann.org/mailman/listinfo/ssr2-review > > _______________________________________________ > By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos) You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.

1 0

Draft responses from Abuse Subgroup
by Russ Housley July 22, 2020

July 22, 2020

Please find the attachment for SSR2 RT review. It contains the Abuse Subgroup’s work on the public comments on Recs 10 – 19. Abuse Subgroup is still working on merging and updating those Recs; however, this will allows everyone to see the direction that be being taken. Russ

1 1

SSR2 agenda 22 July 2020
by Jennifer Bryce July 22, 2020

July 22, 2020

Dear SSR2 RT members, Below is the agenda for the next SSR2 plenary call, scheduled for Wednesday 22 July @ 14:00 - 15:00 UTC. Please review the materials in advance of the call to allow for more discussion time during the meeting. 1. Welcome, roll call, SOI updates 2. Abuse team public comment response document (attached) 3. Risk team (includes Kerry-Ann’s text on the link between CISO and CDO) * Text - see redline text pages 25 - 41 here: https://docs.google.com/document/d/1MJrPzXTngRCrdXLuiyPf7SeZsuPvwjjFGFoooQs… * Public comment responses here: https://docs.google.com/spreadsheets/d/1Oj3NB_lU2APbqLi53zIjNR9Cv2YuohrWzx-… 1. AOB 2. Confirm action items, decisions reached Additional reference documents: * List of subteams here [docs.google.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__docs.google.com_spread…> * Response to public comments spreadsheet here [docs.google.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__docs.google.com_spread…> Best, Jennifer -- Jennifer Bryce MSSI Associate Project Manager Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

3 2

Re: [Ssr2-review] ICANN Organization Blog on DNS Abuse
by Jennifer Bryce July 13, 2020

July 13, 2020

Dear SSR2 RT members, Please find below ICANN org’s response to the question asked by Denise in her email below. Question: ICANN reportedly will be adding supplemental questions and criteria on DNS abuse to the registrar accreditation application (sounds promising). Please provide SSR2 with information about this including: the final or draft supplemental text; how ICANN will assess the answers; whether and how the answers will factor into ICANN’s decision to approve or deny an application; how ICANN will track and hold an approved registrar accountable for the registrar’s statements in the application regarding how the applicant intends to address DNS abuse as a registrar; and whether ICANN has plans to add similar supplemental DNS abuse questions and criteria to registrar contract renewals (why, why not). ICANN org response: Given the increased focus by the ICANN Community on DNS abuse and identifying measures to mitigate it, ICANN is in the process of supplementing the Registrar Accreditation Agreement application and criteria with further detail around the mitigation of DNS abuse (Question 35). The expansion of this question aims to elicit the applicant’s understanding of the potential for DNS abuse in a registrar’s sponsored domain names, registrars’ abuse-related responsibilities, and how the applicant intends to address DNS abuse as a registrar. While this multi-part question is still being refined, the focus is more on the applicant’s understanding of its contractual obligations rather than specifics of how the applicant will meet the obligations. The published registrar accreditation application will be updated to when the question has been finalized. Answers to the DNS abuse question will be reviewed and the applicant approved only if ICANN feels they have demonstrated that they will meet their obligations. Approved applicants will be held to the same criteria detailed in the entire Registrar Accreditation Agreement. Best, Jennifer From: Denise Michel <denisemichel(a)fb.com> Date: Tuesday, May 5, 2020 at 11:43 PM To: Jennifer Bryce <jennifer.bryce(a)icann.org>, "ssr2-review(a)icann.org" <ssr2-review(a)icann.org> Subject: [Ext] Re: [Ssr2-review] ICANN Organization Blog on DNS Abuse Hi, Jennifer. Please also include the following addition: ICANN reportedly will be adding supplemental questions and criteria on DNS abuse to the registrar accreditation application (sounds promising). Please provide SSR2 with information about this including: the final or draft supplemental text; how ICANN will assess the answers; whether and how the answers will factor into ICANN’s decision to approve or deny an application; how ICANN will track and hold an approved registrar accountable for the registrar’s statements in the application regarding how the applicant intends to address DNS abuse as a registrar; and whether ICANN has plans to add similar supplemental DNS abuse questions and criteria to registrar contract renewals (why, why not). Thanks, Denise From: Ssr2-review <ssr2-review-bounces(a)icann.org> on behalf of Jennifer Bryce <jennifer.bryce(a)icann.org> Date: Tuesday, May 5, 2020 at 2:41 PM To: SSR2 <ssr2-review(a)icann.org> Subject: Re: [Ssr2-review] ICANN Organization Blog on DNS Abuse Dear Russ, Thanks for your note. We’ll now share the questions with the relevant SMEs within the org and will provide the review team with an expected response delivery date as soon as we have this information. Per the standard process on requests for information, we’ll track the request/response as an action item on the wiki<https://urldefense.proofpoint.com/v2/url?u=https-3A__community.icann.org_x_…>. Best, Jennifer From: Ssr2-review <ssr2-review-bounces(a)icann.org> on behalf of Russ Housley <housley(a)vigilsec.com> Date: Tuesday, May 5, 2020 at 10:12 AM To: ICANN SSR2 <ssr2-review(a)icann.org> Subject: Re: [Ssr2-review] ICANN Organization Blog on DNS Abuse I would be interested in the answers to these questions. What is needed for staff to get the Q&A process started? Russ From: Ssr2-review <ssr2-review-bounces(a)icann.org<mailto:ssr2-review-bounces@icann.org>> on behalf of SSR2 <ssr2-review(a)icann.org<mailto:ssr2-review@icann.org>> Reply-To: Denise Michel <denisemichel(a)fb.com<mailto:denisemichel@fb.com>> Date: Wednesday, April 29, 2020 at 1:36 PM To: "danko.jevtovic(a)board.icann.org<mailto:danko.jevtovic@board.icann.org>" <danko.jevtovic(a)board.icann.org<mailto:danko.jevtovic@board.icann.org>>, SSR2 <ssr2-review(a)icann.org<mailto:ssr2-review@icann.org>> Subject: Re: [Ssr2-review] ICANN Organization Blog on DNS Abuse Thanks for sharing, the ICANN blog<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_news_blo…>, Danko. It’s highly relevant to SSR2 work, as well as to what several SSR2 members are doing in our day jobs to stop domain abuse. On the whole, the blog is an expression of intent to act. While welcomed, there are no specifics nor a time table for when the internal and community actions will occur. This raises several questions related to SSR2 work for ICANN Staff to answer (and a couple for the Board), which are listed below. Would SSR2 be able to get expedited answers to these? It would be useful for all concerned if we could factor this into our SSR2 work. Thanks Denise 1) The blog says: " the domain names and the data collected by the system will be shared with parties who are in a position to take action, such as registrars and registries, and in some cases with national and international law enforcement organizations." * What specific actions is ICANN expecting registries and registrars to take? * For example, is ICANN encouraging suspension of name resolution or of the registration, or the registrant account? * Will ICANN ask registrars and registries to report on the efficacy of these actions? If so, when and on what cadence? * ICANN should publicly report per registrar & registry action: * How many names has it identified as suspicious/malicious? * What’s the number of domain names that each registry/registrar has taken action against? And what action was taken? * When can we expect ICANN public reporting and on what cadence? 2) What distinguishes ICANN's participation in the face of the pandemic from how they've participated in the past? * The blog says: “ICANN Compliance uses data collected in audits (described in more detail below) to assess whether registries and registrars are adhering to their DNS security threat obligations.” * What will Compliance do that it has not done until now? * Is Compliance making audit data associated with US-based registrars available to States Attorney Generals and the US Attorney General? 3) The blog states (the obvious) that ICANN isn’t a regulator of Internet content, but it doesn’t address ICANN’s public interest remit. Multiple entities have asked ICANN to better govern the manner in which domain names are registered, and now especially, everyone is asking ICANN to hold contracted parties to greater accountability to prevent domains from being registered by malicious actors, especially for pandemic-related fraud and abuse. This requires greater scrutiny during the registration process. * What actions are ICANN taking that address this? * In addition to high volumes of fraudulent domain names containing pandemic-related strings with which criminals try to fool Internet users, random looking or otherwise auto-generated names that are easy to register in volume and are being used by the hundreds to perpetuate pandemic-related phishing attacks. What actions are ICANN taking that addresses this? * Recommended actions contained in SSR2’s draft report could help mitigate pandemic-related domain name abuse. Is the ICANN Board and staff reconsidering any of these actions? * Recommendations from others over the last few years also would help mitigate pandemic-related domain name abuse – especially the substantially increased phishing attacks that harm users. Is the ICANN Board and staff reconsidering any of these actions? Including: - will ICANN move to ensure domain name registrant data is validated? Or at least implement cross-field validation? - will ICANN put in place an Acceptable Use Policy that applies specifically to parties that register large numbers of domains, that requires registrants to apply for (and be validated for) bulk registration services? Further, will ICANN put in place an obligation to distinguish domain names registered by legal entities from those registered by natural persons, classify parties that use bulk registration services as legal entities, and require unredacted access to the registration data of legal entities? - will ICANN maintain and publish a current list of validated bulk registrants (who are from above defined as not natural persons)? - will ICANN disallow registration transactions that involve large numbers of random-looking algorithmic domain names? - will ICANN disallow, for a period of one year, the re-registration of any bulk-registered domain name that has been used in a criminal cyberattack? On Apr 21, 2020, at 11:44 AM, danko.jevtovic(a)board.icann.org<mailto:danko.jevtovic@board.icann.org> wrote: ICANN Organization Blog on DNS Abuse https://www.icann.org/news/blog/icann-org-s-multifaceted-response-to-dns-ab… [icann.org]<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_news_blo…> Danko

1 0