PUBLICCOMMENTCLOSE
2018-04-18 00:00:00.0 UTC
STATEMENTNAME
<p><a href="https://www.icann.org/public-comments/ncap-project-plan-2018-03-02-en">Draft Project Plan for the Proposed Name Collision Analysis Project (NCAP)</a></p>
STATEMENTSTATUS
<p><ac:structured-macro ac:name="status" ac:schema-version="1" ac:macro-id="be0e80b8-bc1b-4e03-b6c5-07b2caee72f7"><ac:parameter ac:name="colour">Green</ac:parameter><ac:parameter ac:name="title">ADOPTED</ac:parameter></ac:structured-macro></p><p>12Y, 0N, 0A</p>
STATEMENTASSIGNEE
<p><ac:link><ri:user ri:userkey="8aa0802249f42f260149f4308adb0311" /></ac:link></p><p><ac:link><ri:user ri:userkey="8aa0802257ef2f160159203824ca002b" /></ac:link></p>
STAFFCONTACT
<p class="contact-name">Dennis Chang<br /><a href="mailto:dennis.chang@icann.org">dennis.chang@icann.org</a></p>
STATEMENTNUMBER
<p><strong>AL-ALAC-ST-0418-03-00-EN</strong></p>
PUBLICCOMMENTINFO
<h2>Brief Overview</h2><p><strong><em>Purpose:</em></strong> To seek community input in building a project plan for the Name Collision Analysis Project (NCAP).</p><p><strong><em>Current Status:</em></strong> In January 2018, the <abbr title="Security and Stability Advisory Committee">SSAC</abbr> Name Collision Analysis Project (NCAP) Work Party was formed and since then has been meeting weekly to discuss and prepare the project plan for submission to the Board.</p><p><strong><em>Next Steps:</em></strong> The NCAP Work Party plans to present the draft project plan at <abbr title="Internet Corporation for Assigned Names and Numbers">ICANN</abbr> 61 to facilitate community discussion and gather input. Upon completion of the public comment period, the NCAP Work Party will finalize the project plan and submit it to the full <abbr title="Security and Stability Advisory Committee">SSAC</abbr> to obtain consensus, and subsequently, submit a consensus plan to the <abbr title="Internet Corporation for Assigned Names and Numbers">ICANN</abbr> Board.</p><h2>Section I: Description and Explanation</h2><p>The proposed <a href="https://community.icann.org/display/NCAP/NCAP+Working+Documents?preview=/79437474/79438151/NCAP%20Proposal%20for%20Public%20Comment%2020180302.pdf">Name Collision Analysis Project (NCAP) project plan</a> [PDF, 241 KB] has been drafted by the <abbr title="Internet Corporation for Assigned Names and Numbers">ICANN</abbr> <abbr title="Security – Security, Stability and Resiliency (SSR)">Security</abbr> and <abbr title="Security, Stability and Resiliency">Stability</abbr> <abbr title="Advisory Committee">Advisory Committee</abbr> (<abbr title="Security and Stability Advisory Committee">SSAC</abbr>). It details their proposed approach for studying name collision in response to the <abbr title="Internet Corporation for Assigned Names and Numbers">ICANN</abbr> Board's request in resolutions 2017.11.02.29 - 2017.11.02.31. The proposed <abbr title="Security and Stability Advisory Committee">SSAC</abbr> study is intended to facilitate the development of policy on Collision Strings to mitigate potential harm to the stability and security of the <abbr title="Domain Name System">DNS</abbr> posed by delegation of such strings. The <abbr title="Security and Stability Advisory Committee">SSAC</abbr> seeks community input on the project plan before it is finalized and <abbr title="Security and Stability Advisory Committee">SSAC</abbr> consensus is reached for submission to the Board for approval and project kick-off.</p><p>In particular, feedback is invited on the following areas of the proposed project plan:</p><ol><li>The proposed approach for consultation and inclusion of views and considerations from beyond the NCAP Work Party.</li><li>The proposed approach for providing transparency on the progress of the work.</li><li>The proposed approach for managing Statements of Interest (<abbr title="Statement of Interest">SOI</abbr>) and any perceived Conflicts of Interest (COI).</li><li>Any additional risks that should be considered, along with any risk mitigation strategies.</li></ol><h2>Section II: Background</h2><p>On 2 November 2017, the <abbr title="Internet Corporation for Assigned Names and Numbers">ICANN</abbr> Board passed resolutions (2017.11.02.29 - 2017.11.02.31) requesting the <abbr title="Internet Corporation for Assigned Names and Numbers">ICANN</abbr> <abbr title="Security – Security, Stability and Resiliency (SSR)">Security</abbr> and <abbr title="Security, Stability and Resiliency">Stability</abbr> <abbr title="Advisory Committee">Advisory Committee</abbr> (<abbr title="Security and Stability Advisory Committee">SSAC</abbr>) to conduct studies to present data, analysis and points of view on .CORP, .HOME, and .MAIL (C/H/M) and other Collision Strings. In the resolution, the Board also requested the <abbr title="Security and Stability Advisory Committee">SSAC</abbr> to do the work in a timely and organized fashion, with adequate visibility on costs and schedule, which shall be subject to review and approval by the Board.</p><p>Following the Board resolution, the <abbr title="Security and Stability Advisory Committee">SSAC</abbr> initiated the project planning in December 2017. In January 2018, the <abbr title="Security and Stability Advisory Committee">SSAC</abbr> Name Collision Analysis Project (NCAP) Work Party was formed. It has been meeting weekly to discuss and prepare the project plan.</p><p>In resolutions (2017.11.02.29 - 2017.11.02.31) the Board requests the <abbr title="Security and Stability Advisory Committee">SSAC</abbr> to conduct studies to present data, analysis and points of view, and provide advice to the Board:</p><ol><li>Regarding the risks posed to users and end systems if .CORP, .HOME, .MAIL strings were to be delegated in the root, as well as possible courses of action that might mitigate the identified risks.</li><li>On a range of questions that include, but are not limited to, the following:<ol class="lower-alpha"><li>a proper definition for name collision and the underlying reasons why strings that manifest name collisions are so heavily used.</li><li>the role that negative answers currently returned from queries to the root for these strings play in the experience of the end user, including in the operation of existing end systems;</li><li>the harm to existing users that may occur if Collision Strings were to be delegated, including harm due to end systems no longer receiving a negative response and additional potential harm if the delegated registry accidentally or purposely exploited subsequent queries from these end systems, and any other types of harm;</li><li>possible courses of action that might mitigate harm;</li><li>factors that affect potential success of the courses of actions to mitigate harm;</li><li>potential residual risks of delegating Collision Strings even after taking actions to mitigate harm;</li><li>suggested criteria for determining whether an undelegated string should be considered a string that manifest name collisions, (i.e.) placed in the category of a Collision String;</li><li>suggested criteria for determining whether a Collision String should not be delegated, and suggested criteria for determining how remove an undelegated string from the list of Collision Strings; and</li><li>measures to protect against intentional or unintentional creation of situations, such as queries for undelegated strings, which might cause such strings to be placed in a Collision String category, and research into risk of possible negative effects, if any, of creation of such a collision string list.</li></ol></li></ol><h2>Section III: Relevant Resources</h2><p><br /></p><ul style="margin-left: 20px;"><li>Proposed NCAP plan: <a href="https://community.icann.org/display/NCAP/NCAP+Working+Documents?preview=/79437474/79438151/NCAP%20Proposal%20for%20Public%20Comment%2020180302.pdf">https://community.icann.org/display/NCAP/NCAP+Working+Documents?preview=/79437474/79438151/NCAP%20Proposal%20for%20Public%20Comment%2020180302.pdf</a></li><li>The Board Resolution <em><a href="https://www.icann.org/resources/board-material/resolutions-2018-02-04-en#2.c.rationale">2018.02.04.12</a></em> <strong><a href="https://www.icann.org/resources/board-material/resolutions-2018-02-04-en#2.c">Addressing the New <abbr title="generic Top Level Domain">gTLD</abbr> Program Applications for .CORP, .HOME, and .MAIL</a></strong><br /><a href="https://www.icann.org/resources/board-material/resolutions-2018-02-04-en#2.c">https://www.icann.org/resources/board-material/resolutions-2018-02-04-en#2.c</a></li><li>NCAP Community wiki: <a href="https://community.icann.org/display/NCAP">https://community.icann.org/display/NCAP</a></li></ul><p><br /></p><h2>Section IV: Additional Information</h2><p>Past Research and Studies on Name Collision</p><ol><li>SAC045: Invalid Top Level Domain Queries at the Root Level of the <abbr title="Domain Name">Domain Name</abbr> System (<a href="https://www.icann.org/en/committees/security/sac045.pdf">https://www.icann.org/en/committees/security/sac045.pdf</a> [PDF, 507 KB])</li><li>SAC057: <abbr title="Security and Stability Advisory Committee">SSAC</abbr> Advisory on Internal Name Certificates (<a href="https://www.icann.org/en/system/files/files/sac-057-en.pdf">https://www.icann.org/en/system/files/files/sac-057-en.pdf</a> [PDF, 1.14 MB])</li><li>Name Collision in the <abbr title="Domain Name System">DNS</abbr> (<a href="https://www.icann.org/en/system/files/files/name-collision-02aug13-en.pdf">https://www.icann.org/en/system/files/files/name-collision-02aug13-en.pdf</a> [PDF, 3.34 MB])</li><li>New <abbr title="generic Top Level Domain">gTLD</abbr> Collision Risk Mitigation (<a href="https://www.icann.org/en/system/files/files/new-gtld-collision-mitigation-05aug13-en.pdf">https://www.icann.org/en/system/files/files/new-gtld-collision-mitigation-05aug13-en.pdf</a> [PDF, 165 KB])</li><li>Name Collision Occurrence Management Framework (<a href="https://www.icann.org/en/system/files/files/name-collision-framework-30jul14-en.pdf">https://www.icann.org/en/system/files/files/name-collision-framework-30jul14-en.pdf</a> [PDF, 634 KB])</li><li>Mitigating the Risk of <abbr title="Domain Name System">DNS</abbr> Namespace Collisions (<a href="https://www.icann.org/en/system/files/files/name-collision-mitigation-final-28oct15-en.pdf">https://www.icann.org/en/system/files/files/name-collision-mitigation-final-28oct15-en.pdf</a> [PDF, 11 MB])</li></ol><h2>Section V: Reports</h2>
FINALVERSION
<p><ac:structured-macro ac:name="view-file" ac:schema-version="1" ac:macro-id="315a605c-1334-4e7f-9a35-bd28c6de594b"><ac:parameter ac:name="name"><ri:attachment ri:filename="AL-ALAC-ST-0418-03-00-EN.pdf" /></ac:parameter><ac:parameter ac:name="height">250</ac:parameter></ac:structured-macro></p>
FINALDRAFT
<p><em>As the principle voice of end users within the ICANN community, the At-large Advisory Committee (ALAC) supports the Security and Stability Advisory Committee (SSAC) in its efforts to address the issue of Name Collisions as it remains an area of some uncertainty. The ALAC urges the SSAC to proceed with the Name Collision Analysis Project (NCAP) Work Party's project plan and allocate enough time to do it right. We believe it is important to minimize the unintended consequences for end users. Name Collision occurs when a user, attempting to reach a private domain name, unintentionally reaches a public domain name and, as such, cut to the core of end user trust of the internet and could pose potential security issues.</em></p><p><em>The NCAP Work Party's project plan, as it currently stands, seems adequate without being excessive. We urge the SSAC to stay the course and not expedite the process for the benefit of any subsequent procedures. There is great anticipation, from parts of the community, for new applications but not only is a specific delay unlikely, given other factors, we believe it would be prudent for the SSAC to execute the project plan as submitted to provide the ICANN community with a holistic assessment of the risks.</em></p><p><em><em>Additionally, the ALAC seeks clarity on the SSAC's bidding process for work contemplated under this <em>Draft Project Plan,</em> as touched upon in sections 3.1 and 3.2. First, we appreciate the SSAC’s candour in disclosing that it will consider NCAP Work Party members’ bids (and that of their affiliates), but it remains unclear as to their overall status as compared to invited guests of the SSAC. Moreover, we see a potential issue with having only a select group of the SSAC community choosing with whom they will contract. The ALAC recommends that any decision with respect to contracting with either N<em>CAP Work Party members and their affiliates or</em> independent third-party contracting agents be taken by the whole SSAC (and excluding invited guests), and for SSAC to provide the ICANN community with adequate amount of notice with respect to any party with whom they wish to contract. </em></em></p><p><em><em>We believe that this recommendation will ameliorate concerns related to potential conflicts of interest that may arise.</em><br /></em></p>
FIRSTDRAFT
<p><em>As the principle voice of end users within the ICANN community, the At-large Advisory Committee (ALAC) supports the Security and Stability Advisory Committee (SSAC) in its efforts to address the issue of Name Collisions as it remains an area of some uncertainty. The ALAC urges the SSAC to proceed with the Name Collision Analysis Project (NCAP) Work Party's project plan and allocate enough time to do it right. We believe it is important to minimize the unintended consequences for end users. Name Collision occurs when a user, attempting to reach a private domain name, unintentionally reaches a public domain name and, as such, cut to the core of end user trust of the internet.<br /></em></p><p><em> The NCAP Work Party's project plan, as it currently stands, seems adequate without being excessive. We urge the SSAC to stay the course and not expedite the process for the benefit of any subsequent procedures. There is great anticipation, from parts of the community, for new applications but not only is a specific delay unlikely, given other factors, we believe it would be prudent for the SSAC to execute the project plan as submitted to provide the ICANN community with a holistic assessment of the risks.</em></p><p><em> We appreciate the opportunity to share our views on this matter. Thank you in advance for your time and consideration on this important issue. <br /> </em> <br /><br /></p>
CALLOPEN
2018-04-13 00:00:00.0 UTC
CALLCLOSE
2018-04-16 00:00:00.0 UTC
VOTEOPEN
2018-04-18 00:00:00.0 UTC
VOTECLOSE
2018-04-22 00:00:00.0 UTC
SUBMISSION
2018-04-18 00:00:00.0 UTC