Page History

Brenda to share a Doodle poll with options for the webinar.

Heather to make the minor adjustments to the document discussed during the call.

Russ to send a note to the email list to advise team members who were not on the call of the changes discussed and agreed to by those in attendance. He will ask for those not on the call to raise any concerns that they have on list.

Staff to find out the process and timeline for next steps on the NCAP study, if ICANN org plans to publish a view on the report, and if so, when?

Eric to fill in the response column in the spreadsheet here for recommendation 21 where commenters support to say ‘noted’ or ‘thanks’.

Jennifer to recirculate to the SSR2 list the document containing the proposal for recommendation 29, with the instruction for team members to review and comment ahead of next week’s meeting.

SSR2 members to review and share any comments on the proposal for recommendation 29 in the document hereahead of next week’s meeting.

Alain to contact Zarko regarding how to move forward with recommendation 23.

Team members to review the Risk subteam text ahead of the 1 July meeting.

Laurin to review the recommendation 4 text in different documents and merge them ahead of next week’s meeting.

Q: It would be great if we could get updates on SSAC recommendations in SAC101v2, SAC097,  and the 4 suggestions in :

https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_en_system_files_files_ssac2019-2D02-2D03may19-2Den.pdf&d=DwICAg&c=FmY1u3PJp6wrcrwll3mSVzgfkbPSS6sJms7xcl4I5cM&r=VuRMFw6YascG5ysc1jEHBZgGTtD6QSLrFmqdvMx5FM8&m=BbASPz11QOHrRR5GgjJOp5C9L51Y_6k_tF1cLAskF2Y&s=FnnX_E-dhahAAb2ZkNVh9WqJvF14cFkJXQ2WR8XQXx4&e=

1. "ICANN Org issue guidance to all registry operators, clarifying expectations for reporting port 43 queries and RDAP queries. The guidance should make clear the purposes and goals of the data collection and the contractual obligations.
2. SSAC believes that a purpose of gathering the data is to document queries made by the users (consumers) of the registration data service. Registry  operators should exclude the queries they make to their own systems.
3. It is vital that ICANN collect valid, accurate data regarding RDAP queries. The WHOIS query data is unreliable, but the move to RDAP offers an opportunity to get things right.
4. ICANN Org's Global Domains Division and Compliance Department should examine the reporting of other metrics per the registry contracts. In  SAC097, the SSAC pointed out irregularities in the reporting of other registry metrics, such as web-based WHOIS queries. The current issue raises the question of whether metrics such as DNS queries are being reported accurately, if they too involve the reporting of self-queries, etc.

ICANN org to send an invite to the team for the DAAR call on 24 June.

3) The blog states (the obvious) that ICANN isn’t a regulator of Internet content, but it doesn’t address ICANN’s public interest remit. Multiple entities have asked ICANN to better govern the manner in which domain names are registered, and now especially, everyone is asking ICANN to hold contracted parties to greater accountability to prevent domains from being registered by malicious actors, especially for pandemic-related fraud and abuse. This requires greater scrutiny during the registration process.

> What actions are ICANN taking that address this?

> In addition to high volumes of fraudulent domain names containing pandemic-related strings with which criminals try to fool Internet users, random looking or otherwise auto-generated names that are easy to register in volume and are being used by the hundreds to perpetuate pandemic-related phishing attacks. What actions are ICANN taking that addresses this?

> Recommended actions contained in SSR2’s draft report could help mitigate pandemic-related domain name abuse. Is the ICANN Board and staff reconsidering any of these actions?

> Recommendations from others over the last few years also would help mitigate pandemic-related domain name abuse – especially the substantially increased phishing attacks that harm users. Is the ICANN Board and staff reconsidering any of these actions?

Including:

> - will ICANN move to ensure domain name registrant data is validated? Or at least implement cross-field validation?

> - will ICANN put in place an Acceptable Use Policy that applies specifically to parties that register large numbers of domains, that requires registrants to apply for (and be validated for) bulk registration services? Further, will ICANN put in place an obligation to distinguish domain names registered by legal entities from those registered by > natural persons, classify parties that use bulk registration services as legal entities, and require unredacted access to the registration data of legal entities?

> - will ICANN maintain and publish a current list of validated bulk registrants (who are from above defined as not natural persons)?

> - will ICANN disallow registration transactions that involve large numbers of random-looking algorithmic domain names? > - will ICANN disallow, for a period of one year, the re-registration of any bulk-registered domain name that has been used in a criminal cyberattack?

2) What distinguishes ICANN's participation in the face of the pandemic from how they've participated in the past?

> The blog says: “ICANN Compliance uses data collected in audits (described in more detail below) to assess whether registries and registrars are adhering to their DNS security threat obligations.”

> What will Compliance do that it has not done until now?

> Is Compliance making audit data associated with US-based registrars available to States Attorney Generals and the US Attorney General?

1) The blog says: " the domain names and the data collected by the system will be shared with parties
who are in a position to take action, such as registrars and registries, and in some cases with national and international law enforcement organizations."

> What specific actions is ICANN expecting registries and registrars to take? > For example, is ICANN encouraging suspension of name resolution or of the registration, or the registrant account?

> Will ICANN ask registrars and registries to report on the efficacy of these actions? If so, when and on what cadence?

> ICANN should publicly report per registrar & registry action: > How many names has it identified as suspicious/malicious?

> What’s the number of domain names that each registry/registrar has taken action against? And what action was taken? > When can we expect ICANN public reporting and on what cadence?

Staff to update the work plan based on the review team’s new completion date.

Kaveh and staff to confirm the latest available information is included in the Privacy text.

Heather and Kerry-Ann to work on cleaning up the ‘Privacy’ text.

Russ to ask team members with outstanding writing assignments to notify the list once the text is in the Google doc.

Staff to invite SMEs to the 8 January plenary call, as discussed with the review team.

Heather to note page numbers of the outstanding writing tasks in the Google doc (see second tab).

Russ to send a note to the list to seek volunteers for a review of the name collision findings, and the data access recommendation

Review team members to think about lessons learned that can be shared. Team will have a work topic on this area in the future.

Team members to complete writing assignments in the Google doc ahead of the call next week. Team members to input text are Denise, Kerry-Ann, Matogoro, Eric, Scott, and Laurin.

Denise to provide clarifying text in the Google doc to address Heather’s questions 1 and 8.

Team to share comments on the CCT implementation plan draft public comment from SSR2 Review Team by 8 October.

Staff to start the process of engaging a contractor for the Policy Researcher role.

Staff to work with Meetings Team to plan for this face-to-face meeting in DC.

Team members to share feedback on the compliance text discussed on the call. See the text in documents here and here.

Staff to ask ICANN IT to address the security issues with Zoom on Mac.

Kerry-Ann and Norm to add references to the strategic plan to their draft recommendations.

Russ will add the names of the penholders to each of the recommendations in the Google doc for ease of reference.

Denise to follow up with Eric and Laurin to confirm they have no updates to the work plan. Once confirmed, leadership team to advise staff to post the updated work plan to the wiki.

Jennifer to work with KC to recover recommendation ‘L’ text to the document.

Angie to follow up on email with people assigned to the recommendations that are not included in the v3 recommendations document here.

Jennifer to re-send the two Google document links to the team with a reminder of the work request.

KC will send a note to the team with a proposal for recommendation 18.

Review team plans to update the workplan document in Brussels.

Denise, Laurin, Zarko will look through the team’s SSR1 recommendations work for quality assurance and report back to team.

Team to collectively discuss how to address items that are blocked

Staff to follow up with SMEs on the outstanding answers to get these ahead of the Brussels meeting.

Review team members to work on topic item write-ups to be ready for the Brussels meeting.

All team members to keep working on their topic items.

Boban to send a follow-up question today for staff based on the written responses provided to previous questions.

Review team members to continue working on the items in the table, in time for Brussels.

Staff to draft a note for Russ to send out to community SO/ACs to ask for time on the agenda to present the recommendations in Marrakech.

Staff to contact Noorul to remind him he is the 'lead' on the future challenges item: Root server system protection: assess the threatscape of top threats (e.g. DDoS to the root system)

Staff to send a reminder to everyone to check volunteer document to see their involvement and be ready to provide an update on next week’s call.

ICANN org to find out re: ITHI - how is it different from ODI, where does it get its data (from internal collection or external data) and where is its data.  

ICANN org to ask ICANN Ops about ODI to determine current status and location of ODI related items

Staff to share contact information with each of the review team members individually. 

Lead RT members bolded in the doc here to reach out to other volunteers listed for the topic and drive the process for developing text.

KC to take the lead in research on any follow up from SSAC074, Denise offered to help.

KC, Denise, Laurin, Alain, Scott to have a discussion with the RSSAC and SSAC regarding recommendation 23 (team members to volunteer if they want to participate). KC will talk to RSSAC/ SSAC chairs to set this up

Denise to work with staff to set up a meeting with CCT RT members in Kobe, and any other groups/individuals the review team may wish to find time with in Kobe. 

Staff to send calendar invites for the writing time slots and room locations.

Staff to go through the volunteers document and list how many questions are outstanding for each of the topics.

Jennifer to finalize the slides. Content is finalized, formatting only required.

Team members to continue working on the text for ICANN SSR, Future Challenges and DNS SSR worksteams.

Volunteers to do own research on future challenges topics

Future Challenges topic: Coalescence of registrars/registry/backend operators for multiple TLDs - Norm to research

Kerry-Ann to work with staff to arrange a meeting with the workstream volunteers for future challenges.

Eric will put straw man text together for the DNS SSR items reviewed the call, and send to the volunteers for each item for input.

Staff to Identify a couple of hours on the 12^th and 13^th March in Kobe for the SSR2 Review Team to work on the report.

Cryptosystems topic moved to Future Challenges - ICANN org to update team documents accordingly.

Team members to share any preferences for countries in Europe that are easy to meet based on your visa requirements. 

Create a page that captures all Google documents that the team is working on to identify the most current versions.

SSR1 workstream: Laurin to fix intro to SSR1 section and recirculate to the list go through the SSR1 recommendations, circulate to team for final review.

Staff to share ICANN SSR and Future Challenges questions with SMEs and obtain answers, track status on the wiki.

Denise to send a proposed edit to the workplan to the list.

RT members to add questions to the DNS SSR workstream by EOD Tuesday 5 February

Leadership team to reach out to ICANN org management to let them know the importance of receiving answers to questions in a timely manner

Staff to circulate updated workplan to the list. Team to review ahead of the call on Thursday, where there will be a call for approval.

Staff to draft a blog post coming out of this meeting to highlight the teams progress, status of work, invitation to reach out via the mailing list if there is an interest to set up meetings consultation in Kobe.

ICANN SSR workstream & Future challenges workstream: Staff to pull out the list of questions from the ICANN SSR and Future Challenges workstream topic for team’s review on Thursday.

Send a save the date for 17^th, 18^th, 19^th May face-to-face meeting in Europe. Exact locations TBD.

Staff to circulate the table of volunteers for each workstream item, team members to add their names to topics they wish to work on.

Team to discuss a potential face-to face meeting in May 2019 during the January meeting in LA. Staff to give travel and meetings team the heads up.

Leadership team will go through the changes in the document after the deadline, ahead of the consensus call to be held in LA during face-to-face meeting.

Team members to use suggestion mode to make any final suggestions to the text in the Google document by Tuesday 22 January 23:59 UTC.

Eric will share DNS SSR topics to the list - for team member input

Add to leadership agenda for next week, Amin's resignation.

Team members to complete Doodle poll for a potential f2f meeting in May (poll to be circulated on list). 

Leadership will develop a draft agenda for the January f2f meeting. Team members to email suggestions to Russ ahead of Monday’s leadership call. 

Jennifer to circulate information to the list that is on the wiki and would be helpful fo the team.

Scott will input text for SSR1 recommendations 17 & 18 into the Google doc.

Kerry-Ann to input text to Google doc to explain that text for SSR1 recommendations 25 and 26 is contained within the text for recommendation 27.

Noorul to input text to the Google doc regarding overlap between recommendations 24 and 28, and that text for both recommendations is merged. 

Team members to input draft text into the SSR1 recommendations Google doc using the findings recorded by the review team. Russ to send a reminder. Penholders are indicated in the document.  

Team members to review the DNS SSR preamble text and share any additional comments in the document or on-list ahead of the 10 January plenary call. 

KC to reach out to Naveed regarding recommendation 23 draft text.

Staff to post updated work plan as circulated to the list and approved on the 20 December.

Penholders to draft text for team review for each SSR1 recommendation, using the Google doc here: https://docs.google.com/document/d/1WwzmsBDEtI0uvrxqSIs7zaBZRalZkC-TwO1VE_pN_7A/edit. Use the same structure as recommendation 4, which Laurin presented on the call. 

RT members who did research on the SSR1 Recommendations to start write up of findings. For recommendations that have more than one person researching it, they should collaborate on the write-up.

Team to review preamble documents (ICANN SSR, Future Challenges and DNS SSR when available) and add comments to the doc. Review of preambles will be added to the agenda of the next call (20 December)

Russ to send note to Eric to find out the estimated delivery date of the DNS SSR subgroup preamble text.

Staff to connect with meetings team to check on estimated date for notifications regarding LA meeting. 

Staff to create a new google doc with the approved SSR1 preamble and ensure all RT members have access to it, so the write-up of findings can start.

Leadership will post a draft of proposed outreach (blog) to the list for Review Team input.

Team to progress work on-list between now and Barcelona, with the aim of team members sharing initial strawman proposals on all SSR1 recommendations between now and Barcelona in Google doc.

Kaveh to clarify if there is any disagreement from the Board on the approach regarding sending Terms of Reference to the Board as an FYI only

Provide responses to questions on SSR1 briefing: Recommendations 11, 12.

11

Draft note and summary of SSR1 implementation for ICANN to send to SSR1 team members and invite them to share their assessment with the SSR2-RT.

Advise if the sub-team requires an NDA to access, and provide access to requested documents.

9 Oct 2017

Provide access to Business continuity plan for PTI.

• Plan for migration
• What kind of failure rollover documentation do you have. Day-to-day. Failure rollover.

9 Oct 2017

9 Oct 2017

9 Oct 2017

9 Oct 2017

9 Oct 2017

9 Oct 2017

• ICANN SSR team provided list of questions, shared with SME.
• EBERO operator responded with questions for the team. Shared on Trello. Response provided by team and shared with SME for progression.
• ICANN has sent a request to EBERO operators to gauge interest.

• Meeting request on hold.
• Proposed time slots sent to subteam via email.

• Action item cleared at re-start.
• Community webinars scheduled and information shared with the review team via email.
• Briefing confirmed for 25 June 2017. Postponed per Co-Chairs.

• Action item cleared at re-start
• Briefing scheduled for 3 November. Cancelled.
• Asked Co-Chairs via email to advise if meeting with members of the drafting team should be scheduled in Abu Dhabi.
• Briefing scheduled for 5 September 2017. Plenary meeting cancelled.
• Briefing confirmed for 25 July 2017. Postponed per Co-Chairs
• Briefing confirmed for 26 June 2017. Postponed per Co-Chairs.

11

Draft a Statement of Work for specialist technical writer: Co-Chairs to provide guidance on the scope of work and other requirements for the engagement of the technical writer.

Co-Chairs

• Action item cleared at restart
• ICANN Org provided outline of procurement process and input via email to support development of Statement of Work.

Review Team/Phil to add ‘consultant support’ as a discussion topic to the DC agenda. 

Phil to finalize summary slides of subgroup progress, and work with staff to suggest any edits/additions to the wiki that might help new members with summarizing work to date. 

Team to share any absences they expect to have during the f2f meeting via email with Phil as well as any additional feedback to the draft session plan that was circulated to the list. 

Staff to provide a brief email summary of the position arrived at by the review team regarding the NDA prior to the pause (include NDA as attachment to the email).

Staff to complete task of posting records of leadership meetings and emails to the wiki.

Team members to provide Phil with suggestions on how to recommence review work in preparation for the DC meeting

Phil to update meeting record of previous meeting, August 2, and re-circulate. 

Staff to share information about options to meet in Barcelona and circulate a Doodle poll.