Page History

Provide additional information about soliciting consultants with a budget under $50k (no RFP needed), and the difference between engaging a consultant and an “independent expert.”

Provide feedback to the IANA subgroup team on how quickly team can expect access to documents requested once NDAs are finalized and signed.

Break out IANA subteam document requests in order of priority to help expedite access to documents, once NDAs have been finalized and signed.

Determine appropriate person to ask for training documentation for processes and procedures for PTI staff.

• SME is on vacation until 11 September.

• SME is on vacation until 11 September.

• Edits provided on list. Further updates may be provided based on ICANN's response to action item 145.

11

14 May 2017

Updated Per meeting 24: James and Kerry-Ann will provide briefing to Review Team on Non-Disclosure Agreement (NDA) and associated documents, when available. 

Review non-disclosure form with ICANN Legal and report back to RT on any updates or edits to the circulated form.

James Gannon, Kerry-Ann Barrett

• Revised draft NDA and Confidential Disclosure Agreement circulated to review team via email.
• James provided update to team via email.
• Meeting to review revised documents scheduled with ICANN Legal Friday 18th August 2017.
• Discussion with ICANN Legal took place

• on 5 June 2017. Kerry-Ann and James to follow-up with redline edits to document.

Respond to ICANN Travel ASAP & make flight reservations to travel to Abu Dhabi for the face-to-face meeeting.

Report to Team on potential room availability at ICANN meeting for sub-group meetings during week.

Send calendar invites for Team meeting days in Abu Dhabi and additional invites as meetings are scheduled.

• Calendar invites for face-to-face confirmed meetings sent to team.

Try www.trello.com and give your feedback on email list. Co-Chairs will assume Team members are comfortable using this unless otherwise informed.

• Access granted and request sent via Trello for all team members to access the SSR2 Review Team boards.

Sub-team realignment: Reply on email list to Eric’s Aug 14 note about folding sub-group calls into Tuesday Team call to increase engagement and visibility

Finalize questions for ICANN subject-matter experts during potential ICANN SSR subgroup meeting in LA. Distribute to staff so they can identify appropriate resources.

Request ICANN Legal to be present at ICANN SSR face-to-face meeting, October 9-10 to rule on availability of documents.

• Intermediate email response sent to Review Team.

Circulate outline of detailed work items and proposed next steps after face-to-face meeting.

Žarko, Boban

Outline in writing a request to meet with ICANN staff responsible for Information Security Management, Auditing, Risk Management and Business Continuity Management. Request to include details of expected goals and outcomes of the meeting.

Team to provide feedback on the structure of the 9 work items, including identifying items which staff may be able to provide more information or help build out.

Provide responses to questions on SSR1 briefing: Recommendations 11, 12.

Recommendation 11:

1.     What was happening in the 5 years between when the recommendation was approved by the Board and when a draft consultant report was posted in April 2017?

2.    On the status and deliverables of Rec 11 it says that ICANN has implemented measures of success for the gTLDs, but we haven’t seen how you’ve implemented measures of success for new gTLDs and IDNs. That’s the first check mark, but what we’ve been provided with is a draft report of some ideas that you could do. How is that considered full implementation of this recommendation?

3.     Do you think it is ICANN staff’s responsibility to gather, analyze and publish this data or do you feel that it’s ICANN’s responsibility to facilitate others to do that?

4.     In a commercialized world of DNS service provision where data is considered to be a corporate asset, do you feel that either ICANN or the community at large have access to meaningful metrics? I cite the barriers that exist on information on root servers. Is this a barrier to the entire objective, that access to data appears to be challenging?

5.     The SSR1 review team called out a number of activities that were operational and within staff’s purview and contained in the SSR framework and called for implementation of measurements and metrics.  Was that work done and is it captured anywhere? To clarify, as part of the SSR1 report related to rec 11, the SSR1 review team noted ICANN administration of the new gTLD Program, IDN program, significant SSR related issues that are in the framework. They called for more specific goals, measurements and impact assessment. Was that work done and is it captured somewhere else?

6.     Is there more information on the steps that ICANN has taken in the past five years to facilitate data access and activities that involved other entities that had ownership or responsibilities on related activities?

7.     Broadly, in looking at the dashboard for rec 11 and all the checkmarks including operational items, it’s really unclear how staff defined and measured success related to SSR. It’s hard to see how the basic sprit of this recommendation was implementation, especially with an idea paper from a consultant. But in terms of the last 5 years and what staff did to implement, it’s unclear. Can you gather more information and provide more clarity and facts?

Recommendation 12:  

8.With regards to establishing best practices and integrating these into agreements to which ICANN enters: It’s linked to a paper that raises a whole host of issues and addresses proposed activities but it’s unclear how that then relates to integrating those into agreements into which ICANN has entered over the past 5 years. Can you provide more specific information on how best practices are reflected in agreements that ICANN has entered into?

9.  ‘Addressing SSR practices in MOUs’ links to a page that holds all of the MOUs. Can you provide some quantification of SSR-related practices in MOUs and more information on which ones contain SSR-related practices, which practices they contain, and how all that’s tracked or the implementation is assessed?

10.  Is there any quantification or more detailed information on what the working relationship with the APWG has yielded?

11. Which sections of the revised new gTLD registry agreement does OCTO staff feel advance SSR best practices and objectives?

12. What has changed after the implementation of Rec#12 as compared with the past?

1. In progress

2. In progress

3. Question answered during the call. See meeting record.

4. Geoff Huston (asker) clarified that he feels this is a question for the review team to answer, not ICANN Org.

5. Clarity requested via email. Awaiting input from Denise.

6. Clarity requested via email. Awaiting input from Denise.

7. In progress

8. In progress

9. Clarity requested via email. Awaiting input from Denise.

10. Question answered via email.

11. In progress

12. Question answered during the call. See meeting record.

• ICANN staff working to schedule webinars for the community.
• Briefing confirmed for 25 June 2017. Postponed per Co-Chairs.

• Briefing scheduled for 5 September 2017.
• Briefing confirmed for 25 July 2017. Postponed per Co-Chairs
• Briefing confirmed for 26 June 2017. Postponed per Co-Chairs.

13 June 2017

• 68. b. Follow-up via email: Please provide a written explanation as to how the original question was felt to be objectionable.
  
  
• 68. a. ICANN DNS Engineering team to reframe the following question and provide an answer (Q3 from SSR2 Plenary 14, 6 June GSE presentation) so as to better align with the RT mandate: Regarding L-root operations and hosting: What is the planning process vs. passive response? Is there a master plan for anyone who operates, in terms of Anycast? And how is that overall process implemented? (GH) 

• 68. a. Question reframe response circulated via email 11 July 2017.
• 68. a. ICANN DNS Engineering team provided proposed reframe of the question: "What measures are undertaken by ICANN for the anycast deployment for L-Root to ensure physical and network security and stability?"

68.a. 11 July 2017

11

14 May 2017

• 43. b. Follow-up via email: Could you please clarify when ITHI will start regularly publishing (or giving the public access to) data? It seems that the “schedule” below is about discussions rather than production, or am I misunderstanding?

• 43. a. Provide the SSR2 RT a timeline of the ITHI project, when they have clarity on next steps and schedules.

• 43. a. Email circulated to Review Team 26 June 2017.

43. a. 26 June 2017

The ICANN security team (now OCTO/SSR) developed a framework that provided a definition for "security".  The SSR2 team used that definition. The Board response to the Terms of Reference expressed that this definition is too broad for the Review Team’s use. Is Board asking staff to redefine definition of “security”?

Provide responses to questions from SSR1 briefings (Ops + Finance)

1. To what extent do you work with the relevant standards bodies (UNICODE and the IETF) over the issues with the use of IDNs and longer label TLDs?
2. There are many challenges in IDN WHOIS lookups.  How do we get an accurate IDN WHOIS database for the Incident Handling process?
   

3. How is the expansion of the name space with more gTLDs contributing to the security and stability of the Internet?

4. What metric is being used to ensure a "healthy" DNS marketplace?

5. How does ICANN proactively make sure to implement policy (eg. New gTLD Program expansion) in a secure and stable manner?

6. New gTLD contract has a lot on New gTLDs to make sure they are secure and stable. To clarify, the main means you see to do that in implementation is through contracts, vs.  that as an aspect? Is that the primary means for ICANN to push the SSR remit?

7. Can GDD comment on the failures of both SLAM and EBERO where they apply to RSP failure scenarios, also implementation of EBERO testing took 3 years from implementation of the first new gTLD delegation, no security review of the EBERO’s has ever taken place, what is the justification for that?

8. Can Francisco to brief us on both systems (EBERO and SLAM) from an SSR2 perspective (Rather than the SSR1 implementation perspective)?

9. I’m also looking for not how much departments are spending but how much their spending on EBERO.

10. Who will be the contracting entity for future SOC2/3 audits of PTI?
    

ICANN Org

1. In progress

2. In progress

3. In progress

8. In progress

4. Question answered during the meeting. See meeting record.

5. Question answered during the meeting. See meeting record.

6. Question answered during the meeting. See meeting record.

7. Question answered during the meeting. See meeting record.

9. Question answered via email.

10. Question answered via email

75, b. Provide responses to draft questions for ICANN Chief Innovation & Information Officer (CIO).

75. a. Prepare draft questions for ICANN Chief Innovation & Information Officer (CIO). Questions will be sent to the CIO in preparation for holding a briefing for the RT.

75.b. ICANN Org

75. a. SSR2-RT

75. b. 9 October 2017

75. a. 25 July 2017

• Staff from the ICANN CIO office will be available during the ICANN SSR subteam meeting 9-10 October to answer the questions.
• 75.a. Questions sent to ICANN CIO.

75. a. 25 July 2017

11

Draft note and summary of SSR1 implementation for ICANN to send to SSR1 team members and invite them to share their assessment with the SSR2-RT.

Send calendar invites for Team meeting days in Brussels, 22-24 January, and report to Team on how soon can ICANN travel can book arrangements.

Calendar invites distributed to team.

Welcome email/initial travel correspondence sent to review team from ICANN Travel.

1. Fix the broken links in the Final Implementation Report and ensure that relevant references have links (if it’s noted in the report as relevant to implementation, please make sure there’s a link to information about it).
2. Put all the documentation/information (links) for each Recommendation together in one place. Some are linked in the Final Implementation Report, some are listed under “Background Materials” in our wiki and others…. ?
3. In each Recommendation, provide completion dates for each listed “deliverable” that has a check-mark under “due date” instead of an actual date

See completed action item 104 for progress notes regarding related previous request.

Confirm approval of ICANN SSR subgroup potential face-to-face meeting in LA

• Cost estimate and staff availability circulated via email to Review Team.
• Doodle poll closed. Email circulated identifying 9-10 October as most popular dates.
• Staff requested via email additional information regarding meeting objectives/ desired outcomes.

Report on results of NDA meeting with ICANN Legal scheduled for 18 August.

Report to Co-chairs on outreach emails to ICANN groups regarding requested meetings in Abu Dhabi

Provide costing of ICANN SSR face-to-face meeting in LA, 9 and 10 October.

• Staff sought clarification via email as to the style as it differs from the template outline agreed on 25 July plenary.
• Work plan circulated via email by Co-Chairs.
  
  

11

14 May 2017

Research collaborative tools the RT may use that can be publicly archived.

Email request from James Gannon & PDF attachment

• ICANN IT researched requested tools and provided response to James Gannon and Co-Chairs.
• Face-to-face meeting with ICANN IT, MSSI support staff and James Gannon in Johannesburg, June 24.
• Tools demonstration scheduled for SSR2 plenary meeting 18, with ICANN and MSSI support staff.

Briefing provided during 15 August 2017 plenary meeting. Background information provided via email 14 August 2017.

Potential engagement of a third party to complete SSR1 implementation gap analysis: Draft a document to address statement of work, required skills and expertise, expected deliverables, timelines and work methods for co-chairs’ review and approval. 

Briefing with ICANN Procurement scheduled for 15 August 2017. Cancelled per co-chairs (staff/leadership call 11 August)

Draft RFP overview document shared with Co-Chairs via email 11 August 2017.

Draft work plan template shared with Co-Chairs via email 11 August 2017.

80. Provide follow-up questions from the 25 June SSR1 briefings so that ICANN Org can prepare responses.

ICANN Org

SSR2-RT

25 July 2017

25 July 2017

Interview complete and notes shared with subteam.

Share redline version of DNS SSR work topics draft to the subtopic email list.

Re-organized work items shared with plenary for input (see Item 90 on Tracking Tool). Replaced by actions S2.2

Provide completion dates for each recommendation (date it was designated as “complete”); if there was multiple activities or deliverables in a recommendation, include the dates those were completed too.

• Email provided additional clarity.
• Completion dates available in the SSR1 Implementation Final Report.
• Link added to SSR1 Subteam wiki page.

7 August 2017

26 July 2017

Review ICANN SSR re-organized work items (37 items in 8 groups) and send feedback to ICANNsecurity-SSR2-RT@icann.org. Please bear in mind the following questions:

• Is this a useful structure to use to organize this activity?
• What is missing from this list?
• Is there anything here that is perhaps out of scope?
• Is this an achievable agenda?

Confirm if staff responsible for the outstanding SSR1 Recommendations (11, 12) can attend the SSR2 plenary call to present the recommendation implementation.

• 76. e. Review Team members to share edits to availability with staff off-list. Co-Chairs to confirm meeting dates.
• 76. d. Co-Chairs to confirm location of face-to-face meeting.
• 76. c. Identify most cost-effective meeting location with Meetings team.
• 76. b. Co-Chairs to identify date for face-to-face meeting and share with Review Team.
• 76. a. Complete Doodle poll on January 2018 face-to-face meeting.

76. d. Co-Chairs

76. c. ICANN Org

76. b. Co-Chairs

76. a. SSR2-RT

• 76. e. James Gannon and Cathy Handley shared updates July 14. No additional follow-up received.
• 76. d. Email sent to Review Team confirming Brussels as the location.
• 76. c. Email sent to co-chairs identifying Brussels as the most cost-effective location.
• 76. b. 22-24 January identified by Co-Chairs per Doodle poll responses. Save-the-date invites distributed.

• 76. a. Doodle poll completed.

76.e. 27 July 2017

76. d. 25 July 2017

76. c 19 July 2017

76. b. 14 July 2017

76. a. 27 June 2017

Provide follow-up questions via email regarding the SSR1 implementation briefing by ICANN Compliance – recommendation 10.

SSR2-RT

Build out the SSR2 Review Team work plan to provide additional substance and practical steps to share with Co-Chairs for initial input.

https://www.icann.org/resources/pages/compliance-reports-2016

Respond to questions asked by the Review Team during the SSR1 implementation briefing by ICANN Compliance – recommendation 10.

ICANN Org

11

14 May 2017

Draft a Statement of Work for specialist technical writer.

James Gannon, Cathy Handley, Denise Michel

ICANN Org provided outline of procurement process and input via email to support development of Statement of Work.

• Follow-up question: Please clarify when.
• Provide SSR2-RT with information on if ICANN Org will accept Board proposal for a new, template “Terms of Reference in Operating Standards”? If so, when will it be issued?

• Response provided via email to Review Team. Terms of Reference template estimated to be completed 28 July 2017.
• Response provided via email to Review Team.

Identify Board members on “caucus” reviewing SSR2 work.

Doodle poll completed.

SSR2-RT members to volunteer for sub-topic rapporteur roles within each sub-team.

20 June 2017

SSR2-RT to share any objections on list to dropping the 0600 UTC call slot and address call schedule rotation in the Johannesburg meeting.

20 June 2017

Update the January 2018 face-to-face meeting Doodle poll with option for weekend meeting.

15 June 2017

Post attendance participation rates to wiki on a monthly basis.

13 June 2017

Staff to capture and share all discussions to-date around outreach.

Email request to adopt the title "Security Review" in public communications.

• Follow-up email sent from ICANN Comms.
• Follow-up meeting with Eric Osterweil, Denise Michel, Duncan Burns, Emily Pimentel, MSSI support staff - Johannesburg, 28 June
• Email response provided, 15 June

Send written responses to RT questions asked during the presentation on ICANN’s Global Stakeholder Engagement outreach efforts to SSR technical community.

1. We’re hearing that the GSE is supporting the work done by CTO. So, what do we mean by help support? And what is the relationship between this engagement and the IANA functions? (AA)
2. A lot of the presentation was about sending the message out. How does it work going the other way? You point to passive mechanisms but what about active measures? (GH)
3. Regarding L-root operations and hosting: What is the planning process vs. passive response? Is there a master plan for anyone who operates, in terms of Anycast? And how is that overall process implemented? (GH)
4. What efforts does ICANN take to inform the policy debate as it is taking place vs. after the fact? (GH)
5. How does GSE work specifically with the ccTLD community on SSR? (JM)
6. How is your work is coordinated and support the OCTO and SSR teams commitment to engage and seek input from the broader SSR community that’s not necessarily active in ICANN. Including their obligation to get input/interaction from them on SSR Framework and strategic priorities. How are you involved and how does the coordination occur? (DM)
7. When do you think in terms of GSE that the focus on explanation/teaching of what ICANN does will shift to more of an interaction/ substantive engagement? (GH)

• Answers to follow-up questions circulated to Review Team.

• ICANN DNS Engineering team asked RT to reframe the following question (Q3 from SSR2 Plenary 14, 6 June GSE presentation) so as to better align with the RT mandate: Regarding L-root operations and hosting: What is the planning process vs. passive response? Is there a master plan for anyone who operates, in terms of Anycast? And how is that overall process implemented? (GH) 

• RT asked ICANN DNS Engineering to reframe the question and provide an answer.

23 May 2017

Prepare a draft work plan proposal for SSR1 Review and ICANN Security topics.

23 May 2017

Add agenda item regarding how Observers can participate and contribute to sub topic work to plenary call #13. 

Publish blog on ICANN.org regarding SSR2 face-to-face meeting in Madrid.

11

Schedule remainder of briefings related to SSR1.

11

Staff to provide RT with explanation and background information from ICANN Global Stakeholder Engagement and Adiel Akplogan (ICANN VP Technical Engagement) regarding current outreach efforts to SSR technical community (responsibility, focus, accomplishments) for RT’s consideration.

Patrick Jones, Senior Director, GSE and Adiel Akplogan, Vice President, Technical Engagement joined SSR2 plenary 14.

11

Circulate list of potential scope topics and list of sub team volunteers.

Circulate link to ICANN technical portal

11

14 May 2017

Share links to relevant articles regarding threat mitigation and classification of threats.

Links circulated to Review Team:

Threat Mitigation

• http://www.g20portal.com/accelerating-cybercrime-response-and-mitigation/
• https://insights.sei.cmu.edu/sei_blog/2017/02/six-best-practices-for-securing-a-robust-domain-name-system-dns-infrastructure.html
• http://www.securityskeptic.com/2015/03/can-we-extend-trust-based-collaboration-beyond-handshakes-and-face-to-face.html

Classification of Threats 

• http://www.securityskeptic.com/2016/02/lending-clarity-to-security-risk-definitions-for-icann-community-and-beyond.html
• https://www.spamhaus.org/news/article/713/changes-in-spamhaus-dbl-dnsbl-return-codes
• http://www.surbl.org/lists (see multi.surbl.org section)

11

14 May 2017

Circulate Google doc for RT to input their SSR concerns. Inputs to form substance of scope discussion.

11

14 May 2017

Provide the SSR2 RT a timeline of the ITHI project, when they have clarity on next steps and schedules.

42

10

Post PTI briefing materials and relevant materials to the SSR2 wiki background materials page.

Circulate clean version of Terms of Reference to list for final 24-hour consideration.

2 May 2017

Send adopted Terms of Reference to ICANN Board, should no objections occur in the 24 hours from circulation.

2 May 2017

Prepare proposal for initial structuring of RT work for Madrid meeting.

2 May 2017

Provide a decision to the Review Team on whether a face-to-face meeting will take place in Johannesburg, and on what dates. 

Share link to Bylaws Article 18 and appropriate context.

18 April 2017

Provide v3 draft scope for Terms of Reference based on discussions and comments.

18 April 2017

Circulate Doodle poll to establish RT availability for F2F meeting in Johannesburg.

18 April 2017

Circulate updated open action items list to RT.

Non-Disclosure (NDA) and Conflicts Disclosure (CDA) documentation for RT.

• Documents circulated to Review Team via email.
• Posted to the SSR2 Legal Documentation wiki page.

Clean up draft Terms of Reference (accept points of agreement). Pull out points of disagreement for discussion on email list.

25

Propose timeline for finalizing scope.

• Replaced by action item #26.
• Thoughts shared via email.

3

Open SSR1 Rec 11 - Effectiveness of mechanisms to mitigate abuse. 

Implementation description: ICANN should finalize and implement measures of success for new gTLDs and IDN fast track that expressly relate to its SSR-related program objectives, including measurements for the effectiveness of mechanisms to mitigate domain name abuse.

3

The following three open SSR1 Recommendations are interrelated and are being implemented together:

Rec 20 - SSR budget

Implementation description: ICANN should increase the transparency of information about organization and budget related to implementing the SSR Framework and performing SSR-related functions. 

Rec 21 - SSR budget 

Implementation description: ICANN should establish a more structured internal process for showing how organization and budget decisions relate to the SSR Framework, including the underlying cost-benefit analysis.

Rec 22 - SSR resources for new gTLDs

Implementation description: ICANN should publish, monitor and update documentation on the organization and budget resources needed to manage SSR issues in conjunction with introduction of new gTLDs.  

Recommendation 20 implementation completed:

https://community.icann.org/display/SSR/Rec+%2320

Recommendation 21 implementation completed:

https://community.icann.org/display/SSR/Rec+%2321

Recommendation 22 implementation completed:

https://community.icann.org/display/SSR/Rec+%2322

• Strawman work plan shared with Review Team.
• Initial Terms of Reference document shared with Review Team.

• Email circulated to Review Team
• SSR2 Observers wiki page updated with link to requested information.

• Slide deck circulated and uploaded to SSR2 plenary 2 wiki page.
• Contact details provided via email.

15 March 2017

Request for the IS-SSR team to provide a summary of the types of requests for assistance that they receive from the community.

 1