- Ssr2-review - lists.icann.org

Re: [Ssr2-review] [EXT] Slides - SSR2 Update Webinar
by Barrett, Kerry-Ann Oct. 7, 2020

Oct. 7, 2020

Thanks Jen Sincerely, Kerry-Ann Barrett Cybersecurity Policy Specialist Organization of American States > On Oct 7, 2020, at 7:23 AM, Jennifer Bryce <jennifer.bryce(a)icann.org> wrote: > > CAUTION: EXTERNAL SENDER > > > Hi everyone, > > For your records, attached are the slides that will be used for the SSR2 update webinar today. These are posted to the ICANN69 schedule. No changes have been made to the slides since they were last circulated to the team for comment. > > Best, > Jennifer > > -- > Jennifer Bryce > Associate Project Manager, Review Support and Accountability > Internet Corporation for Assigned Names and Numbers (ICANN) > > Skype: jennifer.bryce.icann > Email: jennifer.bryce(a)icann.org > > _______________________________________________ > Ssr2-review mailing list > Ssr2-review(a)icann.org > https://mm.icann.org/mailman/listinfo/ssr2-review > > _______________________________________________ > By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos) You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.

1 0

Slides - SSR2 Update Webinar
by Jennifer Bryce Oct. 7, 2020

Oct. 7, 2020

Hi everyone, For your records, attached are the slides that will be used for the SSR2 update webinar today. These are posted to the ICANN69 schedule. No changes have been made to the slides since they were last circulated to the team for comment. Best, Jennifer -- Jennifer Bryce Associate Project Manager, Review Support and Accountability Internet Corporation for Assigned Names and Numbers (ICANN) Skype: jennifer.bryce.icann Email: jennifer.bryce(a)icann.org

1 0

URGENT UPDATE for SSR2 Webinar | 7 October at 15:00 UTC
by Brenda Brewer Oct. 6, 2020

Oct. 6, 2020

Hello SSR2 members and observers, Please view the updated calendar invite that will be send immediately after this email notice. Also, you may follow the directions listed below to receive the Zoom link for the SSR2 Webinar scheduled for Wednesday, 7 October @ 15:00 UTC. For security purposes, the zoom link can ONLY be accessed from the official ICANN69 schedule which you may access upon registering and signing up for webinar. Please register a minimum of 2 hours before the webinar, the sooner the better! You must register for ICANN69 in order to attend a session including the SSR2 Prep-Week Webinar. Register for ICANN69 here<https://events.icann.org/icann69-agm/registration>. You must sign-up for the SSR2 Prep-Week Webinar which is listed on the schedule, 7 October 2020 as Second Security, Stability and Resiliency Review (SSR2) Progress Update Please register a minimum of 2 hours before the webinar, the sooner the better! To attend this webinar, please register for ICANN69 here<https://events.icann.org/icann69-agm/registration>. Upon registration, you will receive two emails: 1. Registration confirmation 2. An email with login information for the schedule Once you log into the schedule, you will be able to sign up for the Prep Week webinars. Please note that participation links will be posted 24 hours prior to the session start times for security purposes. Times on the schedule are all in Central European Summer Time (CEST). Please reach out if you have questions. Thank you! Kind regards, Brenda

1 0

Re: [Ssr2-review] [EXT] Re: SSR2 action item: Review rec 29 markup
by Barrett, Kerry-Ann Oct. 5, 2020

Oct. 5, 2020

Thanks Danko. Will review and speak with the Abuse sub team. Sincerely Kerry-Ann Barrett Cybersecurity Program Officer Secretariat of the Inter-American Committee against Terrorism (CICTE) Secretariat for Multidimensional Security (SMS) Organization of American States 1889 F Street NW Washington D.C. 20006 (202) 370 4675 - (202) 458 3857 www.oas.org/cyber @KerryOAS| @OEA_Cyber Register to our distribution list here! -----Original Message----- From: Ssr2-review [mailto:ssr2-review-bounces@icann.org] On Behalf Of danko.jevtovic(a)board.icann.org Sent: Monday, October 5, 2020 2:30 AM To: 'ICANN SSR2' <ssr2-review(a)icann.org> Subject: [EXT] Re: [Ssr2-review] SSR2 action item: Review rec 29 markup <HTML><div style='border:solid #9C6500 1.0pt;padding:2.0pt 2.0pt 2.0pt 2.0pt'><h1 style='line-height:12.0pt;background:#FFEB9C'><strong><span style='font-size:12.0pt;font-family:"Calibri",sans-serif;color:red'>CAUTION: EXTERNAL SENDER</span></strong><span style='font-size:12.0pt;color:black'><o:p></o:p></span></h1></div></HTML> This letter from Goran might be of interest to the team, regarding the GDPR law obligations of the ICANN https://www.icann.org/en/system/files/correspondence/marby-to-viola-et-al-0… Published on the correspondence page: https://www.icann.org/resources/pages/correspondence Best, Danko Jevtović -----Original Message----- From: Ssr2-review <ssr2-review-bounces(a)icann.org> On Behalf Of k claffy Sent: Sunday, October 4, 2020 11:45 PM To: Kerry-Ann Barrett <kerryann.barrett(a)gmail.com> Cc: ICANN SSR2 <ssr2-review(a)icann.org> Subject: Re: [Ssr2-review] SSR2 action item: Review rec 29 markup Kerry-Ann, Thanks. The text you have below mostly makes sense, but the GAC missed my crucial point, while ICANN obliquely makes it in response. Those holding registration data are not qualified to "properly weigh the public interest" for access to private data. Nor is ICANN able to sufficiently represent the public interest in negotiations with them; the conflict of interest is overwhelming. So framing this recommendation around "ICANN should stay abreast of the laws around the world" makes no sense to me. I believe it is Europe (and any other government who wants mandatory access to this data under specific circumstances) who need their laws to catch up with reality on the ground. This is the primary lesson of the EPDP -- ICANN process will not thread this needle. I think the sentiments below belong in a section on access to registration data. As soon as someone lets me know where i can put text into that section, I'll work on it. It is not a good use of SSR2 time to continue this conversation until that section is done. k On Wed, Sep 30, 2020 at 11:04:28PM -0400, Kerry-Ann Barrett wrote: > Dear KC > Sorry for the late reply. > I wanted to have given the opportunity to the other team members to respond but also wanted to reiterate, that while I agreed the current text and placement of the text needed to be re-written and updated, the issue of privacy and security are still interlinked. The on-going discussion on the issue of WHOIS, GDPR and the Disclosure Procedure, does make this issue no longer a future security challenge as it was three years ago. > > In the recent minority statement issued on August 24, 2020 by GAC, they stated and referenced the importance of this issue to security and stability. > > The GAC acknowledges that under applicable data protection rules, including the GDPR, contracted Parties will likely remain responsible for the decision whether to disclose domain name registration data, and may face certain liability risks related to that decision. The GAC understands that contracted Parties have therefore sought to maintain control over the decision whether to disclose domain name registration data. The GAC notes, however, that those decentralized decisions whether to disclose data are largely exempt from challenge and enforcement action, notably via ICANN Compliance. 11 Registration data is important for the security and stability of the DNS and there is a real concern that contracted parties may inadvertently or purposely not properly weigh the public interest for the requestor to obtain such data. ICANN???s CEO recently conveyed this very concern to the European Data Protection Board, pointing out that ???[d]ue to a lack of legal certainty, registrars, as controllers, are likely to evaluate privacy and data protection in absolute terms, without considering other rights and legitimate interests, to avoid possible regulatory sanctions or a judgment against them.???12 Denials of legitimate requests for access to domain name registration data have real consequences. > > A review of some of these pages and other resources would allow the SSR2 team to at least ensure we express an appreciation of the issue and not have it removed from the report, but better placed and maybe stated more succinctly (https://whois.icann.org/en/using-whois; https://gac.icann.org/statement/public/gac-minority-statement-epdp-phase2-2…; https://gnso.icann.org/sites/default/files/file/field-file-attach/epdp-phas…) > > I would like to propose as we had agreed on the call that we could develop new text that would still capture the issues and the need for Compliance to have a stronger role in this process, which was the basis of this recommendation. > > The idea is not to make it a crime consideration but for security measures to be implemented for the security of data - of which data privacy is a subset. I won???t be able to join tomorrow because I was asked to deliver a course ( this is a one off situation) but available if there is consensus on the way fwd. Cheers Kerry-Ann > On Sep 29, 2020, at 12:56 AM, k claffy <kc(a)caida.org> wrote: > > ??? > Russ > > Yes, that's correct. > > We spent a lot of time talking about a lot of things > that don't need to be in a report 3 years later. > > What does SSR2 want ICANN to do beyond what's here? > https://www.icann.org/dataprotectionprivacy > I think ICANN is "keeping up with GDPR and similar laws", > in fact its CPs are arguably overcommitted to privacy > (or at least "not sharing data for free") at the expense of > security. So I don't think this advocacy is appropriate. > We know these laws are up for interpretation, and that "keeping > up w the laws" is not an SSR issue, it's how they are interpreted > and accommodated that have SSR implications. > > Moreover, why are we asking ICANN to keep with privacy laws > in an SSR review? Why not cybercrime laws? > Or breach notification laws? > > If it's because lack of access to RDAP data > is a security challenge, then we should advocate > finding a way to overcome that security challenge. > > k > > > On Mon, Sep 28, 2020 at 01:22:46PM -0400, Russ Housley wrote: > KC: > > You seem to be advocating deleting all of the text related to Rec. 29. Is that right? > > We spent a lot of time talking about ICANN org keeping up with GDPR and similar laws. Where do you think that belongs? > > Russ > > >> On Sep 23, 2020, at 10:32 AM, Jennifer Bryce <jennifer.bryce(a)icann.org> wrote: >> >> Dear SSR2 RT members, >> >> As discussed on the call today, please review the proposed markup of rec 29 (see page 59) here: https://docs.google.com/document/d/1WTnaEk2pW0V85FRXk1uUN4O-co7DcDIXb_9_-1M… <https://docs.google.com/document/d/1WTnaEk2pW0V85FRXk1uUN4O-co7DcDIXb_9_-1M…>. >> >> Please share any comments/feedback ahead of the meeting next week. >> >> Best, >> Jennifer >> >> -- >> Jennifer Bryce >> Associate Project Manager, Review Support and Accountability >> Internet Corporation for Assigned Names and Numbers (ICANN) >> >> Skype: jennifer.bryce.icann >> Email: jennifer.bryce(a)icann.org <mailto:jennifer.bryce@icann.org> >> >> _______________________________________________ >> Ssr2-review mailing list >> Ssr2-review(a)icann.org <mailto:Ssr2-review@icann.org> >> https://mm.icann.org/mailman/listinfo/ssr2-review <https://mm.icann.org/mailman/listinfo/ssr2-review> >> >> _______________________________________________ >> By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy <https://www.icann.org/privacy/policy>) and the website Terms of Service (https://www.icann.org/privacy/tos <https://www.icann.org/privacy/tos>). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on. > > _______________________________________________ > Ssr2-review mailing list > Ssr2-review(a)icann.org > https://mm.icann.org/mailman/listinfo/ssr2-review > > _______________________________________________ > By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos) You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on. _______________________________________________ Ssr2-review mailing list Ssr2-review(a)icann.org https://mm.icann.org/mailman/listinfo/ssr2-review _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos) You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.

1 0

Feedback on Recommendation 28
by Naveed Bin Rais Oct. 5, 2020

Oct. 5, 2020

Dear All, With reference to public comments on recommendation 28 of the draft report, I need the team's input to proceed further. There are many aspects of this recommendation that I am not familiar with. Attached you would find the public comments related to the recommendation and my responses to each of these comments. Please have a look at the attached file and my responses to see if that makes sense. Also, I need your advice related to Row Number 5, 8 and 9 of the attached file. Row 5 is a comment from RySG in which they are inquiring whether our recommendation is only related to TLD or it also applies to the second level. Row 8: Our recommendation seems to suggest that there should be an independent study related to name collision in addition to NCAP study and then both these studies should be vetted by third parties. This seems to be a two-step process. Is this what we meant by the recommendation? Row 9: I need your input about how we can make the reporting criteria (mechanism) SMART. Thanks. Cheers, Naveed -

3 5

Call summary: SSR2 Plenary - 1 October 2020
by Brenda Brewer Oct. 2, 2020

Oct. 2, 2020

Dear SSR2 RT members, Please find attached the plenary call report for SSR2 Plenary #123, 1 October 2020 at 14:00 UTC. These high-level notes are designed to help SSR2 Review Team members navigate through the content of the call. They are not meant to be a substitute for the recording or transcript, which are posted on the wiki here: https://community.icann.org/x/PQWbC. The transcript usually becomes available 5 - 7 business days after the meeting. With kind regards, Brenda --- Brenda Brewer Internet Corporation for Assigned Names and Numbers (ICANN) Skype: brenda.brewer.icann

1 0

SSR2 Action: Review webinar slides
by Jennifer Bryce Sept. 30, 2020

Sept. 30, 2020

Dear SSR2 RT, Please review the draft slides for the SSR2 progress update webinar at ICANN69 Prep Week (available in the team drive) https://drive.google.com/file/d/10C8e3KTjHQOB_nm5d3huMdqXr53IAgDy/view?usp=… Please share any comments on list, ahead of the 1 October plenary meeting. Best, Jennifer -- Jennifer Bryce Associate Project Manager, Review Support and Accountability Internet Corporation for Assigned Names and Numbers (ICANN) Skype: jennifer.bryce.icann Email: jennifer.bryce(a)icann.org

1 0

SSR2 plenary agenda | 1 October 2020 @ 14:00 UTC
by Jennifer Bryce Sept. 29, 2020

Sept. 29, 2020

Dear SSR2 RT members, Below is the agenda for the next SSR2 plenary call, scheduled for Thursday 1 October @ 14:00 - 15:00 UTC. Please remember the SSR2 plenary meetings will now take place every Thursday instead of Wednesday. 1. Welcome, roll call, SOI updates 2. Status update from subteams (see subteam status spreadsheet<https://docs.google.com/spreadsheets/d/1cOZ1lPXqHfuZNt68zvB5xRB63eBoL3gonDb…> here): * 23 * 25 (see document here<https://docs.google.com/spreadsheets/d/1cOZ1lPXqHfuZNt68zvB5xRB63eBoL3gonDb…>) * 26 * 29 (see document here<https://docs.google.com/document/d/1WTnaEk2pW0V85FRXk1uUN4O-co7DcDIXb_9_-1M…>) * 31 3. Abuse subteam status summary (recommendations 10 – 19) 4. AOB * ICANN69 prep week webinar (7 October @ 15:00 UTC) (see slides here<https://drive.google.com/file/d/10C8e3KTjHQOB_nm5d3huMdqXr53IAgDy/view?usp=…>) 5. Confirm action items, decisions reached Additional reference documents: * Response to public comments spreadsheet here [docs.google.com]<https://urldefense.com/v3/__https:/docs.google.com/spreadsheets/d/1DQpPA0aL…> * SSR2 final report draft here [docs.google.com]<https://urldefense.com/v3/__https:/docs.google.com/document/d/1myG9dtYYiL8l…> Please let Brenda know in advance whether any other documents need to be projected. Best, Jennifer -- Jennifer Bryce Associate Project Manager, Review Support and Accountability Internet Corporation for Assigned Names and Numbers (ICANN) Skype: jennifer.bryce.icann Email: jennifer.bryce(a)icann.org

1 0

Call summary: SSR2 Plenary - 23 September 2020
by Brenda Brewer Sept. 28, 2020

Sept. 28, 2020

Dear SSR2 RT members, Please find attached the plenary call report for SSR2 meeting #122, 23 September 2020 at 14:00 UTC. These high-level notes are designed to help SSR2 Review Team members navigate through the content of the call. They are not meant to be a substitute for the recording or transcript, which are posted on the wiki here: https://community.icann.org/x/OwWbC. The transcript usually becomes available 5 - 7 business days after the meeting. With kind regards, Brenda --- Brenda Brewer Internet Corporation for Assigned Names and Numbers (ICANN) Skype: brenda.brewer.icann

1 0

Recommendation 31
by Žarko Kecić Sept. 23, 2020

Sept. 23, 2020

Hello, The subteam tasked with reviewing the comments related to recommendation 31 agreed that the implementation of DoH could be an important security challenge. However, we believe that this is not within the remit of ICANN and we have agreed to drop this recommendation. We suggest that in the explanation of recommendation 29 we add a couple of sentences that state that there is the possibility of malicious implementation of DoH. Alain, Eric and me will prepare proposal for the next meeting. Zarko

3 2