- Ssr2-review - lists.icann.org

Privacy protections answer
by Jennifer Bryce March 21, 2019

March 21, 2019

Dear SSR2 Review Team members, Please see the below response from ICANN org to initial and follow-up questions from the SSR2 Review Team regarding GDPR. Review Team volunteers: Eric, Norm, Laurin, Kerry-Ann, Noorul Workstream: Future Challenges Topic: Privacy protections (DNS over TLS / over HTTPS; Circular dependencies between WebPKI and DNSSEC; Impact on Proactive anti-abuse and investigations) Response from ICANN org: ICANN’s achievement of recent GDPR-related milestones, including the (a) the Board’s approval of the Temporary Specification<https://www.icann.org/news/announcement-2018-05-17-en> for gTLD Registration Data (Temp Spec) and (b) the GNSO Council’s 4 March 2019 adoption<https://www.icann.org/news/announcement-2019-03-04-en> of the Final Recommendations of the Expedited Policy Development Process on the Temporary Specification for gTLD Registration Data (Final Recommendations), is the product of an unprecedented investment of ICANN org, Board, and community resources. Reaching these milestones was a notable accomplishment, but ICANN’s work related to GDPR is by no means complete. ICANN org provides this answer, which is focused on GDPR-related impacts on the availability of registration directory data, in response to the SSR2 Review Team’s initial and follow-up questions, as follows: * How will ICANN continue to follow up on the GDPR and related decisions? * What is ICANN’s response to GDPR in the spirit of ensuring facilitation of investigation and research? * How will the work of the e-PDP working group be synergised with the recommendation of the various working groups releasing recommendations that it would impact at the same time? * The German Appellate Court decision on ICANN Request to Preserve WHOIS Data is one of the cases in point. This case was highly publicized when the GDPR came into effect however, since then, how these decisions are catalogued and analyzed to inform policy is not clear. This is what we refer to as ‘related decisions’. ICANN’s GDPR Follow-Up The ICANN Board will continue to oversee ICANN org’s efforts related to GDPR, as we rapidly approach the 20 May 2019 expiration of the Temp Spec. ICANN org executives manage subject-matter experts from various departments who are supporting the community’s efforts, including through the anticipated implementation of the policy and contractual changes included in the EPDP Team’s Final Recommendations. ICANN org will continue to engage in a range of forums and with a range of stakeholders on GDPR-related issues that are relevant to ICANN's mission, including privacy and law enforcement. ICANN org will continue to engage with the European community (including the European Data Protection Board), data protection agencies, and other relevant stakeholders to gain a better understanding of the relevant aspects of GDPR related to the work of ICANN org and its contracts with registry operators and registrars. In terms of cataloguing relevant judicial developments, ICANN org tracks and posts GDPR-related judicial decisions in which ICANN is involved on this webpage<https://www.icann.org/resources/pages/data-protection-announcements-2017-12…>. This page is a resource for ICANN org and the broader community to inform all of our activities, including as a resource for policy development. ICANN org’s <https://www.icann.org/legislative-report-2019> Global Legislative and Regulatory Tracking report<https://www.icann.org/legislative-report-2019> is another source of information for the community on relevant developments in other jurisdictions, as we understand that the landscape outside of Europe is also undergoing change. ICANN org also recently released its draft<https://www.icann.org/en/system/files/files/proposed-org-engagement-govt-st…> charter<https://www.icann.org/en/system/files/files/proposed-org-engagement-govt-st…> for engagement on legislative and regulatory activity, describing the types of educational efforts that ICANN org will undertake (where appropriate) in order to allow lawmakers to understand the potential impacts on ICANN’s mission. Recommended New gTLD Registration Data Policy In working to address GDPR, ICANN org’s goal has been to preserve WHOIS to the greatest extent possible while also complying with applicable laws. ICANN’s mission and mandate, as stated in ICANN’s Bylaws, led to WHOIS obligations encapsulated in ICANN consensus policies and agreements that ICANN org has with registry operators and registrars. In the pre-Temp Spec environment, these policies and contractual obligations set the minimum requirements governing the collection, retention, escrow, transfer, and display of registration data, which included contact information of the registrant, administrative, and technical contacts as well as technical information associated with a domain name. The GDPR imposed new obligations that would have made it impossible, without a step such as adoption of the Temp Spec, for ICANN org, registry operators, and registrars to continue to comply with ICANN org agreements and the law. This would have resulted in the inability of ICANN org to enforce its contracts. This would also have resulted in each registry operator and registrar making its own determination regarding what gTLD registration data should be collected, transferred, and published, leading to a fragmentation of the globally distributed WHOIS system. Fragmentation of the WHOIS system would jeopardize the availability of registration data, which is essential to ensuring the security and stability of the Internet, including to mitigate attacks that threaten the stable and secure operation of the Internet. The consensus policy recommendations of the EPDP Team will, provided such recommendations are approved by the Board, become a new gTLD Registration Data Policy (Policy). This Policy will require registry operators and registrars to collect, retain, and publish a reduced amount of registrant data, compared to ICANN’s pre-GDPR requirements. This Policy will reduce the amount of registration data that contracted parties will be required to make available to third parties, including those involved in investigations and research. However, pending additional work by the EPDP Team on access to gTLD registration data in Phase 2, this Policy will require registry operators and registrars to publish, in a publicly accessible section of their websites, the mechanism and process for submitting requests for lawful disclosure of nonpublic registration data (See EPDP Team Recommendation 18<https://gnso.icann.org/sites/default/files/file/field-file-attach/epdp-gtld…>). The EPDP Team is expected to consider in Phase 2 whether a standardized model for lawful disclosure of non-public registration data should be adopted, and, if such a system is adopted, the specifics about who would have access to that system and what registration data would be made available (See EPDP Team Recommendation 3<https://gnso.icann.org/sites/default/files/file/field-file-attach/epdp-gtld…>). In this context, the EPDP Team will consider, among other issues, disclosure in the context of intellectual property infringement and DNS abuse cases. The EPDP Team recognized that ICANN has a responsibility to foster openness, interoperability, resilience, security, and/or stability of the DNS in accordance with its stated mission. The EPDP Team also recognized that ICANN may have a purpose to require actors in the ecosystem to respond to data disclosure requests that are related to the security, stability, and resilience of the system. The EPDP Team is expected to consider in Phase 2 whether additional purposes should be considered to facilitate ICANN org’s Office of the Chief Technology Officer to carry out its mission (See EPDP Team Recommendation 2<https://gnso.icann.org/sites/default/files/file/field-file-attach/epdp-gtld…>). From: ssr2-coordination <ssr2-coordination-bounces(a)icann.org> on behalf of "Barrett, Kerry-Ann" <kabarrett(a)oas.org> Date: Saturday, March 9, 2019 at 5:27 AM To: Russ Housley <housley(a)vigilsec.com> Cc: ssr2-coordination <ssr2-coordination(a)icann.org> Subject: Re: [Ssr2-coordination] [EXT] KERRY-ANN: Clarification request: Privacy protections question Hi Russ See clarification below. Please let me know if there has been progress on the ICANN GDPR track I’m unaware of but I just did a search before writing the response and couldn’t find anything publicly available . Sincerely, Kerry-Ann Barrett Cybersecurity Policy Specialist Organization of American States On Mar 8, 2019, at 11:48 PM, Russ Housley <housley(a)vigilsec.com<mailto:housley@vigilsec.com>> wrote: Kerry-Ann: Can you provide clarification? Russ From: Eric Osterweil <eric(a)osterweil.net<mailto:eric@osterweil.net>> Subject: Re: ERIC: Clarification request: Privacy protections question Date: March 8, 2019 at 11:14:13 PM EST To: Russ Housley <housley(a)vigilsec.com<mailto:housley@vigilsec.com>> Cc: ssr2-coordination <ssr2-coordination(a)icann.org<mailto:ssr2-coordination@icann.org>> I looked at this question and I think this is more in Kerry-Ann’s bailiwick than mine. Can we ask her to weigh in so that we don’t lose the goal of the question? Eric On Mar 8, 2019, at 11:46 AM, Russ Housley <housley(a)vigilsec.com<mailto:housley@vigilsec.com>> wrote: Eric: I think your paper is now behind you. No one else has spoken up, so will you please send a response to Jennifer. Russ On Feb 24, 2019, at 1:19 PM, Russ Housley <housley(a)vigilsec.com<mailto:housley@vigilsec.com>> wrote: Eric: Once your paper is behind you, if one of the others has not spoken up, please offer a clarification for the Review Team to consider. Russ On Feb 22, 2019, at 5:07 AM, Jennifer Bryce <jennifer.bryce(a)icann.org<mailto:jennifer.bryce@icann.org>> wrote: Dear SSR2 Review Team, Some clarification is sought on the below question. Would volunteers from the group asking the question please review the below request and provide further guidance? Review Team volunteers: Eric, Norm, Laurin, Kerry-Ann, Noorul Workstream: Future Challenges Topic: Privacy protections (DNS over TLS / over HTTPS; Circular dependencies between WebPKI and DNSSEC; Impact on Proactive anti-abuse and investigations) Q: How will ICANN continue to follow up on the GDPR and related decisions? Clarification requested from ICANN org: In providing our response: 1. Is there an expectation for us to look into each of the technical topics, i.e.: • DNS over TLS/over HTTPS; • Circular dependencies between WebPKI and DNNSEC; and • Impact on Proactive anti-abuse and investigations. NO, THIS WAS NOT THE INTENT OF THE QUESTION. WHILE SPECIFIC RECOMMENDATIONS RELATED TO GDPR AND DNS MAY BE MADE ONCE THE REVIEW IS COMPLETE. OR 1. Is the SSR2 RT looking for a more general, broad response i.e. what ICANN is doing re: GDPR; and how ICANN will continue to follow up/keep abreast on GDPR developments. YES, IN PART. But more specifically in an effort to avoid liability under the GDPR, registrars are refraining from publishing WHOIS information. Instead, under the temporary specification developed by ICANN, many are providing a randomized email address or web-based contact only, which can be used to contact the registrant anonymously. The temporary specification also requires each registrar to determine, on a case-by-case basis, whether the party requesting the personal information has a legitimate interest in the information and whether it outweighs the privacy interests of the registrant. This has hampered many law enforcement investigations and the work of researchers as well. Why is this relevant? The absence of a clear way forward hampers protections from an investigative and compliance perspective. Therefore the questions seeks to ask ‘ what is ICANNs response to GDPR in the spirit of ensuring facilitation of investigation and research?’/ ‘how will the work of the e-PDP working group synergised with the recommendation of the various working groups releasing recommendations that it would impact at the same time’ 2. What does GDPR and “related decisions” specifically mean in this context? THE German Appellate Court decision on ICANN Request to Preserve WHOISData is one of the case in point. This case was highly publicized when the GDPR came into effect however since then, how these decisions are catalogued and analyzed to inform policy is not clear. This is what we refer to as ‘related decisions’. Thank you, Jennifer -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org<mailto:jennifer.bryce@icann.org> Skype: jennifer.bryce.icann www.icann.org [icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.icann.org_&d=DwMF-g…> _______________________________________________ Ssr2-review mailing list Ssr2-review(a)icann.org<mailto:Ssr2-review@icann.org> https://mm.icann.org/mailman/listinfo/ssr2-review

1 0

Q&A doc clarification
by Jennifer Bryce March 21, 2019

March 21, 2019

Dear SSR2 Review Team members, As discussed in Kobe there was some confusion as to the location of Q&As. Please note that all of the questions that SSR2 has asked to ICANN org related to the ICANN SSR, DNS SSR and Future Challenges work streams are in the Google doc here: https://docs.google.com/document/d/14eJwDGP-LvS9ltTmZoh1i19Fi0_pB2nJ4JYMsS7…. For additional info only: * A few changes have been made since Kobe to this doc. 1 it has been renamed from ‘LA meeting questions and answers’ and 2. pre-pause ICANN SSR questions are now included, to make it a comprehensive list. * Note that answers are shared on-list via email when they are available, only to let those working on the topic know that the questions have been answered. They are also added to the Google doc above so you shouldn’t need to search emails. There are also some excel docs that contain the questions, similarly this is a tracking tool only, and you can use the Google doc as a single source. * All SSR1 related Q&As remain in the table here: https://docs.google.com/document/d/1qUxV4L-gS5xHmC4QQPGRk81MgQuhQvsbnEU7xxe… Please let us know if there are other ways of working that would be more helpful to your work, or if you are having difficulty locating any documents/information. Best, Jennifer -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

1 0

CCT Review, FYI
by Denise Michel March 14, 2019

March 14, 2019

________________________________ From: Denise Michel <denisemichel(a)fb.com> Sent: Thursday, March 14, 2019 4:33 PM To: Margie Milam; Frederick Felman; russp(a)seedip.com Subject: Fwd: My meeting with Cherine FYI ________________________________ From: Jonathan Zuck <jzuck(a)innovatorsnetwork.org> Sent: Thursday, March 14, 2019 12:16 PM To: Russ Housley; pkane(a)verisign.com; Denise Michel; susankpolicy(a)gmail.com; langdonorr(a)gmail.com; sdelbiancoATnetchoice.org Subject: Re: My meeting with Cherine Folks, I received the attached latter from Cherine and the board this morning and responded. Thankfully, the board has moved past the idea that the only mistake was one of miscommunication. In my discussions with the board, they recognized they have both a short and long term problem to manage the influx of recommendations. Accordingly, they intend to schedule a conference call (with all of us) in the very near term with the possibility of an in person meeting in May if one is deemed necessary. This will be followed up with community exercise to determine the best path forward into the future. Let’s consider if we would benefit from an organizing call prior to further interaction with the board. ‘Jonathan From: Russ Housley <housley(a)vigilsec.com> Date: Wednesday, March 13, 2019 at 11:21 AM To: Jonathan Zuck <JZuck(a)innovatorsnetwork.org>, Pat Kane <pkane(a)verisign.com>, Denise Michel <denisemichel(a)fb.com>, "susankpolicy(a)gmail.com" <susankpolicy(a)gmail.com>, "langdonorr(a)gmail.com" <langdonorr(a)gmail.com>, Steve DelBianco <sdelbianco(a)netchoice.org> Subject: Re: My meeting with Cherine Thanks for including me. I keep hearing that it was a communication failure. If that is the case, why is it so hard to get a corrected message? Also, look at the Bylaws that say what the Board is required to do with recommendations from "SPECIFIC REVIEWS": (C) Each final report of a review team shall be published for public comment in advance of the Board's consideration. Within six months of receipt of a final report, the Board shall consider such final report and the public comments on the final report, and determine whether to approve the recommendations in the final report. If the Board does not approve any or all of the recommendations, the written rationale supporting the Board's decision shall include an explanation for the decision on each recommendation that was not approved. The Board shall promptly direct implementation of the recommendations that were approved. The six month deadline seems to be the thing that drove the timing of the resolution. Since the Board did not "promptly direct implementation" of any of the recommendations, I can only interpret this resolution as non-approval for all of them. Russ On Mar 12, 2019, at 9:31 PM, Jonathan Zuck <JZuck(a)innovatorsnetwork.org<mailto:JZuck@innovatorsnetwork.org>> wrote: Adding Russ to our cabal Jonathan Zuck Executive Director Innovators Network Foundation Www.Innovatorsnetwork.org<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.innovatorsnetwork.o…> From: pkane(a)verisign.com<mailto:pkane@verisign.com> Sent: ‎Wednesday‎, ‎March‎ ‎13‎, ‎2019 ‎12‎:‎59‎ ‎AM To: Jonathan Zuck<mailto:JZuck@innovatorsnetwork.org>, Denise Michel<mailto:denisemichel@fb.com>, susankpolicy(a)gmail.com<mailto:susankpolicy@gmail.com>, langdonorr(a)gmail.com<mailto:langdonorr@gmail.com> Cc: Steve DelBianco<mailto:sdelbianco@netchoice.org> I spoke with Russ Housley briefly this afternoon and we are going to talk tomorrow (Wednesday) as he has a team of deflated reviewers and he does not know what to do next. We are going to try and learn from Monday’s interaction but it sounds as though there may be some benefit in catching up with you as well based upon your interaction with Cherine. I am concerned about the comment below about making funds available to staff for new gTLD work. If money is not available to work on CCTRT recommendations yet money is freed up for a WG that has yet to get to consensus on many items it appears that the money is being used to make more money for ICANN by taking applications for new gTLDs as soon as possible. Especially, given that every forum inKobe includes commentary about not having any money to do the work of the community. Pat Patrick Kane Senior Vice President Verisign Naming and Directory Services PKane(a)Verisign.com<mailto:PKane@Verisign.com> t: 703.948.3349 12061 Bluemont Way Reston, VA 20190 Verisign.com<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.verisigninc.com_&d=…> The Manifesto of Done – Laugh at perfection. It’s boring and keeps you from being done. Error! Filename not specified. From: Jonathan Zuck <JZuck(a)innovatorsnetwork.org<mailto:JZuck@innovatorsnetwork.org>> Sent: Tuesday, March 12, 2019 11:48 AM To: Denise Michel <denisemichel(a)fb.com<mailto:denisemichel@fb.com>>; Susan Kawaguchi <susankpolicy(a)gmail.com<mailto:susankpolicy@gmail.com>>; Kane, Pat <pkane(a)verisign.com<mailto:pkane@verisign.com>>; Cheryl Langdon-Orr <langdonorr(a)gmail.com<mailto:langdonorr@gmail.com>> Cc: Steve DelBianco <sdelbianco(a)netchoice.org<mailto:sdelbianco@netchoice.org>> Subject: [EXTERNAL] My meeting with Cherine I don’t know whom else to include on this email but I’ll start with you folks. This evening I spent an hour with Cherine discussing this debacle that has so taken the board by surprise. As you have no doubt realized from the board’s, now semi-annual, apology tour, they did not intend for the resolution to be interpreted the way it was. I was frank and suggested the resolution read like a late homework assignment given it’s generalized justifications, logic errors, misinterpretations all of which were separate from their atrocious communications strategy. He said he realized later that I had been trying to help them at the public forum and he hadn’t realized and had dug a deeper hole. As I pointed out a few illustrative examples of problems with their resolution, he conceded that most of the board had not read the recommendations but had instead relied on the board caucus committee that has been assigned to the project. They had assured the board that they knew just what to do by coming up with the 3 categories and he believed that eventually all of the recommendations would be accepted. He believed the board had committed to developing a data framework, even though that was not reflected in the resolution itself. It went on like that and the more we talked the more dismayed he became. He said there was an upcoming resolution to approve funds for ICANN staff to begin preparing for a new round and wondered if perhaps that might not go over well either. I suggested it might not because there was already a feeling of undo influence on the part of staff and that giving them a far less open ended set of directions could go a long way to mitigate the damage. But that’s all a separate but related issue. I mentioned the seemingly relentless momentum of the subsequent procedures WG and the boards apparent acquiescence. He said he didn’t think it was the board’s place to try and influence the PDP and I said that given the execution of the 2012 round, inserting some public interest requirements into the process was WELL within the board’s remit. Denise, I raised the issue of meeting sooner, perhaps by phone, given the fact there are several “in process” review teams that are currently wondering what they should be doing. He’s agreed to attempt something sooner, most likely at the board workshop in Istanbul in May. He asked, how many people would it be and I said it would likely be between 5 and 10 but that ideally it would be the leadership of any group with pending recommendations. He really believes that this was just a failure to communicate but I said that while that was true, it also signified a breakdown in process that raises alarm bells in the community. I suggested that cleaning up their communication was not going to be sufficient to resolve this issue satisfactorily amongst the currently chartered review teams who have been demotivated by the board’s luke warm reception of the CCT recommendations. I hope this is helpful and I’ll keep you informed about any further communications. Jonathan Jonathan Zuck | Executive Director | Innovators Network jzuck(a)innovatorsnetwork.org<mailto:jzuck@innovatorsnetwork.org> | O 202.420.7497 | S jvzuck | <image001.png>

1 0

No SSR2 Call Next Week
by Russ Housley March 14, 2019

March 14, 2019

Dear Review Team: After the session today, the leadership team had a short conversation, and we decided to cancel the call next Thursday, 21 March 2019. Please spend the time on your writing assignments or coordinating with others that are working on the same topics. Russ

1 0

Link to Board Caucus session now
by Jennifer Bryce March 14, 2019

March 14, 2019

Hi all, The Board Caucus and SSR2 meeting on now - the location is now Sapphire, if you want to join remotely: https://participate.icann.org/kix64-sapphire Best, Jennifer -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

7 8

Letter to the CCT Review Team
by Kaveh Ranjbar March 14, 2019

March 14, 2019

Dear SSR2 Team Members, In light of our informal session with the board yesterday and discussions around implementation of the CCT Review recommendations, you might find the letter sent today by our chairman of the board, Cherine Chalaby to the CCT-RT of interest. https://www.icann.org/en/system/files/correspondence/chalaby-to-zuck-14mar1… All the best, Kaveh. Sent from my iPhone

1 0

Reversing time
by Norm Ritchie March 14, 2019

March 14, 2019

Not SSR2 but very cool and interesting …. https://phys.org/news/2019-03-physicists-reverse-quantum.html

1 0

Canceled: Save the Date: SSR2 Face-to-Face Meeting
by Jennifer Bryce March 14, 2019

March 14, 2019

Dear all, Please save the date for a face-to-face meeting share any preferences with staff for countries in Europe that are easy for you to meet based on your visa requirements.

1 0

Save the Date: SSR2 Face-to-Face Meeting
by Jennifer Bryce March 14, 2019

March 14, 2019

Dear all, Please save the date for a face-to-face meeting share any preferences with staff for countries in Europe that are easy for you to meet based on your visa requirements.

1 0

Proposed strat. objectives
by Jennifer Bryce March 14, 2019

March 14, 2019

All, See slide 11 of the attached deck for the proposed new strategic objectives, as being discussed currently. Best, Jennifer -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

1 0