March 2015 - Whois-iag-volunteers

Discussion paper for 1 April 2015 meeting
by Jamie Hedlund May 6, 2015

May 6, 2015

All, Attached please find a short paper for the upcoming call. It is intended to spur discussion on whether the trigger could be modified so long as adequate verification requirements were in place. The paper follows on from contributions to the discussions to date. This is the only proposed agenda item. Based on how the call goes, we can spend the last 10 minutes or so discussing next steps. If anyone would like to add anything to the agenda please let me know. Thanks. Best, Jamie Jamie Hedlund VP, Strategic Programs Global Domains Division ICANN +1.202.374.3969 (m) +1.202.570.7125 (d) jamie.hedlund(a)icann.org

9 24

Late arrival
by James Gannon March 31, 2015

March 31, 2015

Hi All, I am a late arrival to the group, just a quick introduction, I am a member of the NCSG here in ICANN, via the NCUC constituency. My day job is in Security and Privacy Management where I assist companies in their policy and program development work. As my 'night job' I perform a large amount of pro-bono work supporting charities, non-profits and at risk individuals in securing their online presences and working on the development of secure communications channels. I believe that a strongly policed WHOIS is a critical part of the internet ecosystem and that the work of this group will be key in defining the practical implementation of critical part of ICANN policy. Currently catching up on the previous discussions and will be on tomorrows call. Looking forward to working with you all, James Gannon Director Cyber Invasion Ltd Dun Laoghaire, County Dublin, Ireland Office: +353 (1)663-8787 Cell: +353 (86)175-3581 Email:james@cyberinvasion.net<mailto:james@cyberinvasion.net?subject=Via:%20Email%20Signature> GPG: https://keybase.io/jayg

2 2

Scheduling IAG-WHOIS Conflicts call, April 1st
by Maria Otanes March 30, 2015

March 30, 2015

Hello all, The next IAG-WHOIS Conflicts call will be held on Wednesday, April 1st. Please complete the Doodle Poll below with your preferred time by EOD Friday, March 20th. The available times are: 13:00 UTC 18:30 UTC 23:00 UTC http://doodle.com/asq6k7bw35x7q8mc Best, Ria

3 3

IAG-WHOIS Conflicts call
by Maria Otanes March 25, 2015

March 25, 2015

13:00-14:30 UTC http://www.timeanddate.com/worldclock/fixedtime.html?msg=IAG-WHOIS+Conflict… Agenda to follow. ---------------------------------------------------------- Link to Adobe Connect: https://icann.adobeconnect.com/iag-whois/ ***Upon logging into Adobe Connect, a pop up window will provide you the option to dial out to your phone. Enter your phone number, + country, phone number*** If you are unable to log into Adobe Connect and can only join via phone or Skype: [Select *6 to mute and unmute on the call] International Dial In Numbers: https://www.myrcplus.com/cnums.asp?bwebid=8369444&ppc=3515982074&num=1-719-… Participant Passcode: 351 598 2074

1 0

Re: [IAG-WHOIS conflicts] Agenda and Draft Redline and Notes
by Christopher Wilkinson March 15, 2015

March 15, 2015

Good evening: Thankyou, Stephanie, for these interesting observations, with which I largely concur. I am also not a lawyer, but as a long-standing participant in ICANN processes, may I observe that these matters have been under discussion for nigh on fifteen years. 1. There is no call for any further public consultation and delay. That has been done. All the relevant information is already available: either through past consultation and communication, or through a review of applicable laws. 2. The primary objective should be for ICANN to align its privacy policy on global best practice. That is not the case today. 3. Failing which, and meanwhile, ICANN should institute 'block-exemptions' to allow Registries and Registrars to automatically conform a priori - in their accreditation contracts - to the privacy laws of their jurisdiction. Obviously it is unnecessary and undesirable to attempt to customise case-by-case each accreditation agreement, whereas the generally applicable privacy laws are already known. The costs of such customisation to ICANN and to the Registries and Registrars concerned are unjustified. Best regards CW PS: I also regret missing the recent Whois-IAG conference calls. Currently, in addition to the usual domestic constraints, some of us are also subject to the rather demanding CWG conference calls schedules. On 15 Mar 2015, at 14:18, Seth M Reiss <seth.reiss(a)lex-ip.com> wrote: > I too missed the meeting, but I find Stephanie’s observations very compelling. > > Seth Reiss > > On Thursday, March 5, 2015 7:22 PM, Stephanie Perrin <stephanie.perrin(a)mail.utoronto.ca> wrote: > > > Once again, my apologies for missing the meeting. I have listened to the recording, and I can see I missed an interesting meeting. > I would like to offer my views on why the procedure and the remedies discussed are off the mark. I am not a lawyer, but I did spend ten years in the Canadian government working on the privacy standard which we attempted to take to ISO, and the law which passed parliament and is in force today (PIPEDA). During that period (the 1990s) I did considerable research on how to legislate privacy for the private sector, particularly in a federal jurisdiction, and had the opportunity to hold workshops with data protection authorities to discuss powers and what provisions work better than others, to consult with the European Commission, and converse with privacy scholars. It is this experience that I hope might make my remarks useful to the discussion. I also served two years as the Director of Policy and Research in our federal DPA's office, and spoke many years ago on WHOIS issues on behalf of the office at the Vancouver meeting. Still, remember that my remarks are those of a non-lawyer and therefore an amateur. > > 1. On the issue of whether a data protection authority is legitimate....that is an excellent question. Unfortunately for those wishing to harmonize, different jurisdictions may have authority...in the Canadian context, it is hard to predict whether or not a provincial data commissioner might think they have jurisdiction. Where there is none, the federal commissioner assuredly would. I have written a textbook on our law, but I would not be brave enough to offer a view on that, and I believe it is likely the matter would have to be settled in Court. With respect, I doubt you will get an authoritative answer from our GAC representative, so I don't think that is a fruitful avenue to explore as I am sure this will be true for many countries. I really don't think ICANN should put users in the postion of having to take matters to Court to prove a point, and I believe this is where that question would have to be resolved. > > 2. In some countries matters relating to the domain industry might be covered under other laws than data protection law, a point that was made yesterday. Many of those laws could not necessarily be interpreted reliably until they go to Court, so I believe you are in the same situation there. The fact is, ICANN matters with respect to privacy and constitutional rights (against search and seizure) have essentially not been litigated. Are you embarking on a policy route that will ensure the matters do get litigated? > > 3. On the issue of enforcement powers....if I understand the argument here, some parties believe that if a DPA simply writes a letter indicating that in their opinion the requirements imposed by ICANN violate the DP law, this is not sufficient unless the official writing the letter has the power to enforce that opinion. Unfortunately, not all data protection commissioners have binding powers. Many new laws are "light touch", where states have decided to see whether organizations will fall in line with the new laws in this relatively young area of law, before loading on criminal sanctions and powers to stop commercial activity. Some DPAs are more like Ombudsmen than judges. Some DPAs have the power to take a matter to the Court to request enforcement: this is the case in Canada with the national law. You are therefore pushing end users who are aggrieved to take registrars to Court. Volker Greimann made the point yesterday that if ICANN is going to put registrars in legal jeopardy in this way, they should cover the liability. In my view, he is missing a whole area of financial risk that goes far beyond the Court costs. IF end users crowd source class action or cases for higher courts to settle this matter and stop what they might regard (rightly or wrongly, it does not matter) as surveillance, it will certainly be the registrars who pay...not just in legal costs and potential damages, but in loss of customer trust and damage to their brands. If I were a registrar, I would find this totally and utterly unacceptable. > > 4. Just to be clear, on the matter of whether a letter from a DPA without enforcement powers is enough.....an end user/registrant who received such an opinion would be well armed to take a civil action against the registrar in question, at least in my jurisdiction. Tort law increasingly is being used in privacy invasion cases. This would probably be cheaper and easier than fighting it through the higher courts. Damages are often higher too. > > 5. I don't actually understand, given what I know about how data protection law works, how this procedure could have been accepted in the first place. I would suggest that before ICANN attempts to fix the procedure, they need to consult broadly with data protection authorities. The Article 29 group sent a letter giving an authoritative opinion for Europe. Many of the DPAs who form that group are legally constrained from offering such an opinion precisely because they have binding powers.....so you have put registrars in a catch-22. ICANN will not accept a letter from a group that is mandated by the Directive that sets the standard for data protection law in Europe, because they are not actually the body that enforces law, and demands instead that authorities who have enforcement powers send them a letter. DPAs with enforcement powers are likely to be constrained from offering an opinion, precisely because they have binding powers and the status of a judge. These are matters well understood in the data protection authority community, why don't you talk to them? A cynic might be forgiven for suspecting that this Catch 22 was engineered precisely to prevent registrars from abiding by data protection/constitutional requirements, precisely because those who are familiar with DP law easily can spot that Catch 22. I fear that the letter the registrars are going to get is a summons to Court...but as I said before, I am not a lawyer and I do not pretend to understand European law. > > I doubt that this is helpful, but I did want to get it on the record. IF you do ask for public comments on this procedure, you may get more informed opinion. iF you don't, please don't assume that the matter ends there. Privacy advocates do not have this matter on their radar at the moment, but post-Snowden irritation with business cooperating under the table with law enforcement is at a very high level. I would suggest that you do not want 500 comments from irate global experts; it may put registrars in more jeopardy. > > I will turn my attention now to providing comments on the draft text. Once again, my apologies for missing this important discussion. > Kind regards, > Stephanie Perrin > NCSG > On 2015-03-03 14:44, Maria Otanes wrote: > Hello all, > > Attached, please find the Agenda for tomorrow's call and Draft Redline and Notes based on the last meeting. > > I'm updating the calendar invite with the Adobe Connect link for the call, but you may also find the information at the bottom of this email. The call is scheduled for tomorrow, March 4th, at 13:00-14:30 UTC. > > If you have any questions, please let me know. > > Kind regards, > Ria > > Link to Adobe Connect: https://icann.adobeconnect.com/iag-whois/ > > ***Upon logging into Adobe Connect, a pop up window will provide you the option to dial out to your phone. Enter your phone number, + country, phone number*** > > If you are unable to log into Adobe Connect and can only join via phone or Skype: [Select *6 to mute and unmute on the call] > > International Dial In Numbers: https://www.myrcplus.com/cnums.asp?bwebid=8369444&ppc=3515982074&num=1-719-… > > Participant Passcode: 351 598 2074 > > US Mobile Phone Direct Link: tel://1-719-867-1571,*,,3515982074# > > > _______________________________________________ > Whois-iag-volunteers mailing list > Whois-iag-volunteers(a)icann.org > https://mm.icann.org/mailman/listinfo/whois-iag-volunteers > > > _______________________________________________ > Whois-iag-volunteers mailing list > Whois-iag-volunteers(a)icann.org > https://mm.icann.org/mailman/listinfo/whois-iag-volunteers > > > _______________________________________________ > Whois-iag-volunteers mailing list > Whois-iag-volunteers(a)icann.org > https://mm.icann.org/mailman/listinfo/whois-iag-volunteers

1 0

Agenda and Draft Redline and Notes
by Maria Otanes March 15, 2015

March 15, 2015

Hello all, Attached, please find the Agenda for tomorrow's call and Draft Redline and Notes based on the last meeting. I'm updating the calendar invite with the Adobe Connect link for the call, but you may also find the information at the bottom of this email. The call is scheduled for tomorrow, March 4th, at 13:00-14:30 UTC. If you have any questions, please let me know. Kind regards, Ria Link to Adobe Connect: https://icann.adobeconnect.com/iag-whois/ <https://icann.adobeconnect.com/iag-whois/> ***Upon logging into Adobe Connect, a pop up window will provide you the option to dial out to your phone. Enter your phone number, + country, phone number*** If you are unable to log into Adobe Connect and can only join via phone or Skype: [Select *6 to mute and unmute on the call] International Dial In Numbers: https://www.myrcplus.com/cnums.asp?bwebid=8369444&ppc=3515982074&num=1-719-8 67-1571 <https://www.myrcplus.com/cnums.asp?bwebid=8369444&ppc=3515982074&num=1-719- 867-1571> Participant Passcode: 351 598 2074 US Mobile Phone Direct Link: tel://1-719-867-1571,*,,3515982074#

4 3

IAG-WHOIS Conflicts call
by Maria Otanes March 5, 2015

March 5, 2015

Agenda 1. Review draft changes to Mission & Scope 2. Review output from last meeting 3. Discuss last question: How should public comment be incorporated into the Procedure? 4. AOB Link to Adobe Connect: https://icann.adobeconnect.com/iag-whois/ ***Upon logging into Adobe Connect, a pop up window will provide you the option to dial out to your phone. Enter your phone number, + country, phone number*** If you are unable to log into Adobe Connect and can only join via phone or Skype: [Select *6 to mute and unmute on the call] International Dial In Numbers: https://www.myrcplus.com/cnums.asp?bwebid=8369444&ppc=3515982074&num=1-719-… Participant Passcode: 351 598 2074

5 4