FINAL VERSION TO BE SUBMITTED IF RATIFIED
The final version to be submitted, if the draft is ratified, will be placed here by upon completion of the vote.
FINAL DRAFT VERSION TO BE VOTED UPON BY THE ALAC
The ALAC welcomes the opportunity to comment on the Registration Data Access Protocol (RDAP) Operational Profile for gTLD Registries and Registrars.
While the new RDAP Operational Profile includes many new enhanced features from the previous Whois protocol, it does not include a list of mandatory features and provisions that will support an authentication and authorisation access control framework.
The SSAC in its 2011 report on Domain Name Whois Terminology and Structure (SAC 051) recommended the development of replacement protocol that would provide a uniform and standard framework for accessing Domain Name Registration Data (DNRD). That framework would ‘define and implement verification methods, credential services and access control capabilities’. The Board accepted SSAC recommendations and established the Expert Working Group on gTLD Directory Services (EWG) to begin implementation of the recommendations. In its Final Report, the EWG recommended a paradigm shift whereby gTLD registration data is collected, validated and disclosed for permissible purposes only, with some data elements being accessible only to authenticated requestors that are then held accountable for appropriate use.
Therefore, while existing ICANN policies do not now require differentiated access to DNRD, it is clear from Board decisions and EWG recommendations that future ICANN policies will likely have that requirement.
The Operational Profile of RDAP, therefore, should include an obligation on all gTLD registries and registrars that the basic functionality will support an authentication and authorisation framework.
Specifically, the features to allow differentiated access must be required now, as part of this protocol – even if at this stage all access seekers will be in one class - the public. In that way, when differentiated access requirements are imposed, protocol features will already be deployed to provide such access.
FIRST DRAFT SUBMITTED
Background:
ALAC has already sent a letter to the Board on this issue so the statement does not have to be lengthy. However, it would look very odd if we did not take the opportunity to formally express our concerns on the issue. The actual protocol is a very technical document, largely addressing the many issues highlighted by SAC051 - which is a good thing. Our concern, however, is that the additional features of the Protocol that would provide a framework for authentication and authorisation are not mandatory. The reason I have included mention of the SAC051 is that the Board endorsed all of its recommendations, including the need to support differentiated access. Therefore, it is clear that the policy direction is for differentiated access, and the Protocol should include mandatory requirements that will support differentiated access so that when the policies are changed, the technical features will be in place to support the policy change.
Proposed Statement:
The ALAC welcomes the opportunity to comment on the Registration Data Access Protocol (RDAP) Operational Profile for gTLD Registries and Registrars.
While the new RDAP Operational Profile includes many new enhanced features from the previous Whois protocol, it does not include in its list of mandatory features provisions that will support an authentication and authorisation access control framework.
The SSAC in its 2011 report on Whois Terminology and Structure (SAC 051) recommended the development of replacement protocol that would provide a uniform and standard framework for accessing Domain Name Registration Data (DNRD) that would ‘define and implement verification methods, credential services and access control capabilities’. The Board accepted SSAC recommendations and established the Expert Working Group to begin implementation of the recommendations. In its Final Report, the EWG recommended a paradigm shift whereby gTLD registration data is collected, validated and disclosed for permissible purposes only, with some data elements being accessible only to authenticated requestors that are then held accountable for appropriate use.
Therefore, while existing ICANN policies do not now require differentiated access to DNRD, it is clear from Board decisions and EWG recommendations, that future ICANN policies will.
The Operational Profile of RDAP, therefore, should include an obligation on all gTLD registries and registrars the basic functionality that will support an authentication and authorisation framework.
Specifically, the features required to allow differentiated access must be required now, as part of this Protocol – even if at this stage, all access seekers will be in one class – the public. In that way, when differentiated access requirements are imposed, Protocol features will already be deployed to provide such access.
