- Ssr2-review - lists.icann.org

Email replying to Board
by Denise Michel Oct. 10, 2017

Oct. 10, 2017

Dear Team Members: As discussed, the co-chairs are preparing a brief email reply to the Board’s latest correspondence regarding the ICANN SSR Subgroup fact-finding meeting in LA Oct 9-10. Because we are so short on time, we’ve outlined the points we’ll make and invite any Team members to provide any comments they may have by COB today (PT). After we send the email, we intend to follow-up with more discussion after the workshop and a more fulsome correspondence to the Board. * SSR mandate from ICANN’s bylaws to provide increased accountability and transparency of ICANN to its community for key aspects of ICANN’s work * SSR2’s terms of reference modelled on bylaws and adopted by majority consensus * Workplan and sub-group efforts flow from ToR * ICANN SSR subgroup’s fact-finding mission at ICANN addresses SSR2’s bylaw obligation. * Note Board concern about risks of exceeding SSR2 scope; Team discussed potential for over-reach while creating ToR, and reinforced Team’s commitment with text on gaining complete understanding of interconnected issues but then ensuring SSR2 recommendations are in-scope. * After subgroup’s Oct 9-10 fact-finding mission, Team will discuss results and next steps. * Look forward to discussing all this with the Board at ICANN 60 and getting more information on Board’s concerns Best, Denise & Eric Denise Michel Domain Name System Strategy & Management Facebook, Inc. denisemichel(a)fb.com<mailto:denisemichel@fb.com>

8 17

Action Required Today - SSR2 Plenary Call Thursday, 12 October - Doodle Poll
by Yvette Guigneaux Oct. 10, 2017

Oct. 10, 2017

Hi All - Good day. If you have not done so already, please participate in the doodle poll link below for availability for an SSR2 Plenary call - this Thursday, 12 October 2017 @ either 13:00 or 14:00 UTC. Doodle Link: http://doodle.com/poll/nkqvmpfy8pgs8utd | (Revised poll closing date): Today, Tuesday, 10 October @ 19:00 UTC. Thank you! Kind Regards, Yvette Guigneaux (MSSI) Multistakeholder Strategy & Strategic Initiatives Projects & Operations Assistant. ICANN - Internet Corporation for Assigned Names and Numbers Email: yvette.guigneaux(a)icann.org<mailto:yvette.guigneaux@icann.org> Cell: +1-310-460-8432 Skype: yvette.guigneaux.icann www.icann.org<http://www.icann.org/> [cid:image001.png@01D341A5.D0B0E6E0]

1 0

SSR1 Implementation Recs 21 - 28 Questions & Information Requests
by Denise Michel Oct. 9, 2017

Oct. 9, 2017

Dear Staff: Following-up on my 25 Aug. request for information on SSR1 Final Implementation Report, Recommendations 1- 20, I’ve reviewed information provided on implementation of SSR1 Recommendations 21 – 28 and have questions and a need for more information. I’ve listed them in the attached, grouped by recommendation. Again, this should provide a stronger foundation for the gap analysis. When you have a chance, please route this to appropriate staff, keep a list of SSR1-related requests on that Sub-group’s wiki page, and reference the requests in a nested table on the Team’s tracking list. Thanks for your help. Denise Denise Michel Domain Name System Strategy & Management Facebook, Inc. denisemichel(a)fb.com<mailto:denisemichel@fb.com>

1 0

For feedback: Future Challenges work items
by Jennifer Bryce Oct. 9, 2017

Oct. 9, 2017

Hi all, On behalf of the Future Challenges subgroup, attached is the subgroup’s list of work items. Also available in the Google doc<https://docs.google.com/document/d/1DWoT4VoMlT5Dvcy78EXI-O5tQFqa9CblwsDEV6g…>. As discussed on the 3 October 21:00 plenary call<https://community.icann.org/display/SSR/SSR2+Meeting+%2330+-++03+October+20…>, please review and share your feedback by 17:00 UTC on Monday 16 October. Best, Jennifer -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

1 0

Document requests for IANA subteam
by James Gannon Oct. 9, 2017

Oct. 9, 2017

Hi All, Just following up on the IANA sub team items, we would like to formalise the document requests from our Trello tasks here into a request for the following documentation, as identified in our meetings with PTI staff in Jo’burg: * Business continuity plan for PTI. * Plan for migration * What kind of failure rollover documentation do you have. Day-to-day. Failure rollover. * Processes and training. * A presentation on training and processes documents to a good level of detail. To replace seeing the docs themselves. * Documented evidence of business continuity test (if it exists) * A high-level walk through of RZMS, from perspective of cc and gTLDs (to clarify issues) * Field verification of RZMS – presentation on controls within the RZMS system * Documentation that identifies procedures for verifying authorized contact. * Presentation on relationship between PTI, ICANN and the root zone maintainer, post-transition (with roles and responsibilities, who works where, who have authority) -James

1 0

Reminder - Action Required Today - SSR2 Plenary Call Thursday, 12 October - Doodle Poll
by MSSI Secretariat Oct. 8, 2017

Oct. 8, 2017

Hi SSR2 - Good day. Friendly reminder to kindly fill out the doodle poll below with your availability for an SSR2 Plenary Call this week on Thursday, 12 October 2017 - thank you! Kind Regards, Yvette Guigneaux (MSSI) Multistakeholder Strategy & Strategic Initiatives Projects & Operations Assistant. ICANN - Internet Corporation for Assigned Names and Numbers Email: yvette.guigneaux(a)icann.org Cell: +1-310-460-8432 Skype: yvette.guigneaux.icann www.icann.org<http://www.icann.org/> [cid:image001.png@01D34028.325C5DE0] From: Yvette Guigneaux Sent: Thursday, October 05, 2017 3:17 PM To: 'SSR2' <SSR2-review(a)icann.org> Subject: Action Required Today - SSR2 Plenary Call Thursday, 12 October - Doodle Poll Hi All - Good day. Below is a doodle poll link for availability for an SSR2 Plenary call - Thursday, 12 October - as the usual Tuesday Plenary call was cancelled due to the ICANN SSR meeting in Los Angeles - please advise on your availability. Doodle Link: http://doodle.com/poll/nkqvmpfy8pgs8utd | Poll closes: Wednesday, 11 October @ 19:00 UTC. Kind Regards, Yvette Guigneaux (MSSI) Multistakeholder Strategy & Strategic Initiatives Projects & Operations Assistant. ICANN - Internet Corporation for Assigned Names and Numbers Email: yvette.guigneaux(a)icann.org<mailto:yvette.guigneaux@icann.org> Cell: +1-310-460-8432 Skype: yvette.guigneaux.icann www.icann.org<http://www.icann.org/> [cid:image001.png@01D34028.325C5DE0]

1 0

ICANN Board's Input and Comments to ICANN SSR Subteam Scope of Work for Second Security, Stability, and Resiliency Review Team (SSR2)
by Registrar Oct. 7, 2017

Oct. 7, 2017

Subject: ICANN Board's Input and Comments to ICANN SSR Subteam Scope of Work for Second Security, Stability, and Resiliency Review Team (SSR2) Date: 6 October 2017 From: Denise Michel and Eric Osterweil, Co-Chairs, SSR2 To: Steve Crocker, Chair, ICANN Board of Directors Cc: Cherine Chalaby, Vice Chair, ICANN Board of Directors Dear Steve, As Co-Chairs of the second Security, Stability and Resiliency Review Team (SSR2), we are responding to the Board’s letter of 3 October. Several of our members are currently or shortly to be in transit to Los Angeles for the scheduled fact-finding workshop with staff on October 9-10. Our response is therefore brief at this stage; we intend to follow this letter with more discussion after the workshop and additional correspondence. The SSR2 gains its mandate from ICANN’s new Bylaws<https://community.icann.org/display/SSR/Mandate>, adopted following the IANA transition. SSR2 is one of the required “community reviews” that are intended to provide increased accountability and transparency of ICANN to its community for key aspects of ICANN’s performance of its mission, through independent reviews performed by volunteers from across ICANN’s diverse community. The SSR2’s terms of reference<https://community.icann.org/display/SSR/Terms+of+Reference> (TOR), adopted on 4 May 2017, are closely modelled on the language of the ICANN Bylaws, which mandate community reviews, and follow the template provided by ICANN Staff and used by previous review teams. Those terms of reference were discussed by the entire Review Team and adopted by majority consensus, have been publicly available since 4 May 2017, and were communicated to the Board by email by the SSR2’s Co-Chairs on 11 May 2017. The Review Team’s work plan<https://community.icann.org/pages/viewpage.action?pageId=64075835&preview=/…> and timeline<https://docs.google.com/spreadsheets/d/1IUKMvoaomSqoY0quZBjdQ3cOK5Wsw2hDgBW…>, and sub-group activities<https://community.icann.org/display/SSR/Subgroups> flow from those terms of reference and also have been publicly discussed and available since their publication months ago. The Board will note the SSR2 sub-group’s fact-finding mission at ICANN headquarters in part addresses SSR2’s obligation under Bylaws 4.6(c)(i) and 4.6(c)(iii): 4.6(c)(i) “ICANN's execution of its commitment to enhance the operational stability, reliability, resiliency, security, and global interoperability of the systems and processes, both internal and external, that directly affect and/or are affected by the Internet's system of unique identifiers…,” and 4.6(c)(iii) “The SSR Review Team shall also assess the extent to which ICANN has successfully implemented its security efforts, the effectiveness of the security efforts to deal with actual and potential challenges and threats to the security and stability of the DNS, and the extent to which the security efforts are sufficiently robust to meet future challenges and threats to the security, stability and resiliency of the DNS, consistent with ICANN's Mission.” This fact-finding mission also will, in part, investigate the fulfilment of SSR1 recommendations<https://community.icann.org/display/SSR/SSR1+Review+Implementation+Home> 17, 25, 26, 27, and 28, as is our explicit mandate. Moreover, the Review Team’s interest in these matters also relates to the Security and Stability Advisory Committee’s (SSAC’s) documented recommendations, and the extent to which they have been adopted by ICANN, in SAC-074<https://www.icann.org/groups/ssac/documents> [en<https://www.icann.org/en/system/files/files/sac-074-en.pdf>]. While we note the Board’s anxiety about the risks of exceeding the SSR2’s scope, it’s important to note that the Review Team adopted the following directive as part of its ToR in May (emphasis add): The scope of the SSR2 as mandated by ICANN’s Bylaws are cast in broad terms. The SSR2 discussed the potential risk of over-reach at great length, and through majority consensus made the specific provision in its Terms of Reference as follows (emphasis added): In order to understand the security, stability, and resiliency importance of the ICANN identifier space (the elements that are within ICANN’s authoritative scope), the SSR2 Review Team will consider the issues in its entirety including inter-connected functions. The SSR2 Review Team may, therefore, review, discuss and seek advice from varying stakeholders in the community including those entities providing specific functions on behalf of ICANN to ensure that any recommendations provided takes into account the most complete reflection of the operational reality of ICANN. However, the SSR2 Review Team will then focus its recommendations on those efforts, issues, policies, systems, and identifiers that are clearly within ICANN’s scope and remit. We request more information on what seems to be the Board’s contention that responsibilities of the ICANN Organisation should be off-limits to community reviews, as that is not the understanding or position of a majority of the Review Team. We look forward to discussing this with the full Board at ICANN 60. Meanwhile, since there is such short time remaining before the LA meeting on 9 October, and considerable time and resources have been expended by both the volunteer team members and the ICANN organisation in its preparation, we will complete that fact-finding mission. We look forward to discussing these and related issues during the Review Team’s meeting with the Board at ICANN60 in Abu Dhabi.

2 1

Planned Workshop in LA
by Boban Krsic Oct. 6, 2017

Oct. 6, 2017

Dear Kaveh and ICANN Board, On behalf of the ICANN SSR subgroup of the SSR2 review team we acknowledge your communication of Wednesday 4th October referring to the concerns of the board about the scope of activities. We welcome a constructive dialogue with the board on these scope concerns, however given the time pressures that the subgroup is under to execute our work plan at the F2F workshop in Los Angeles we respectively submit that the most efficient manner for us to resolve these concerns would be with an extended dialogue with the Board or the board caucus group in Abu Dhabi. We intend to continue with our LA workshop as planned, as this is a critical information gathering exercise, we will then enter into a good faith dialogue to address the boards concerns both in Abu Dhabi or through any other alternative times that may be available. We hope to come to mutual understanding on the outputs and eventual recommendations that will be drafted as a result of this workshop. Regards, Boban Krsic on behalf of the ICANN SSR Subgroup.

4 4

Action Item 80b: Responses to questions
by Jennifer Bryce Oct. 6, 2017

Oct. 6, 2017

Dear all, Re: Tracker item 80b: “Provide responses to questions from SSR1 briefings (Ops + Finance)”. Please see below for responses to outstanding questions. Note we are still seeking clarification from the Review Team (requested via email<http://mm.icann.org/pipermail/ssr2-review/2017-August/000576.html>, 30 August) to question 2. The complete list of questions and answers, along with a link to the briefing materials, can be found here: https://docs.google.com/document/d/15g9bz4h57wC9LmNltKLarLRGhJdztnCBzDGtWmB… 1. To what extent do you work with the relevant standards bodies (UNICODE and the IETF) over the issues with the use of IDNs and longer label TLDs? Staff from the ICANN organization commonly participate in both IETF and UNICODE meetings. In the context of Universal Acceptance, as the community commonly refers to the issues described in this question, the ICANN Community created the Universal Acceptance Steering Group (UASG) which is supported by the ICANN organization. The UASG has its mission to raise awareness and facilitate resolution of Universal Acceptance issues. The ICANN organization is committed to support the efforts of the community through the UASG. 1. There are many challenges in IDN WHOIS lookups. How do we get an accurate IDN WHOIS database for the Incident Handling process? Question requires clarification from Review Team. 1. Can GDD comment on the failures of both SLAM and EBERO where they apply to RSP failure scenarios? Per the Base Registry Agreement<https://newgtlds.icann.org/sites/default/files/agreements/agreement-approve…>, the EBERO process is defined in the Registry Transition Processes<https://www.icann.org/resources/pages/transition-processes-2013-04-22-en>, one of the main objectives of the EBERO program is to minimize impact on registrants and gTLD users. As of 25 August 2017, we have seen 32 cases in which a service of a gTLD reached one of the emergency thresholds. Of those, 10 cases occurred pre-sunrise, 8 during sunrise, 5 before general availability, and 9 during general availability. The 32 cases involved a total of 211.7k active names at the second level at the time of the cases. The top-five cases in term of registrations that reached emergency thresholds had 211k active domains at the time of cases. Four of those cases happened in 2017. In all of the cases since 2015 the registry operators received compliance notices requiring an explanation of the issue, a root cause analysis and actions required to ensure the same issue would not be repeated. During the emergency, the ICANN organization was in contact with the affected registry/registry service provider to understand the problem at hand. The ICANN organization made a determination that it was going to be faster and had less impact on security and stability to let the current registry/registry service provider to fix the underlying issue than to execute the EBERO transition. Therefore, considering the impact to registrants and users, it was determined the best course of action to not execute an EBERO transition on those cases. 1. Implementation of EBERO testing took 3 years from implementation of the first new gTLD delegation. No security review of the EBEROs has ever taken place. What is the justification for that? The Base Registry Agreement does not specify a review for the EBERO program and it does not require periodic testing. However, since the launch of the new gTLDs and the EBERO program, the ICANN organization has worked with its three EBERO providers to ensure the program is ready to act, should the need arise. Specifically, the EBERO contract requires annual inspection of each of the EBERO providers. Additionally, the ICANN organization has worked with each of their EBERO providers to conduct a full EBERO exercise with a real TLD. These full EBERO exercises have taken advantage of gTLDs that have requested voluntary termination. The ICANN organization obtained consent from the registries to execute these exercises just before the TLD is removed from the root zone. These exercises involved executing the whole set of EBERO activities from the (simulated) failure of a TLD service, to full recovery of the TLD services in the EBERO, including the update of the root zone. Each of the exercises have been successful and provided validation of the readiness of the EBERO program. 1. Can Francisco brief us on both systems (EBERO and SLAM) from an SSR2 perspective (Rather than the SSR1 implementation perspective)? The ICANN organization will be happy to answer other questions you may have to enable the work of SSR2. -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

2 1

Updated: LA meeting agenda
by Jennifer Bryce Oct. 6, 2017

Oct. 6, 2017

Hi all, Please note minor updates to the ICANN SSR subgroup LA meeting agenda. The latest version is attached here. Best, Jennifer -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

1 0