Showing posts with label DPA. Show all posts
Showing posts with label DPA. Show all posts

2019-04-21

News Review | ICANN EPDP Phase 2 Chair Janis Karklins

graphic "News Review" ©2016 DomainMondo.com
Domain Mondo's weekly internet domain news review (NR 2019-04-21) with analysis and opinion: Features •  1) ICANN EPDP Phase 2 Chair Janis Karklins,  2) EPDP Phase 2 Budget & EPDP notes, Domain Hijacking, 3) Other ICANN news: a. Domain Metrics, b. Name Collisions, c. DNS Hijacking, d. .AMAZON Update4) Names, Domains & Trademarks: Declining TLDs: .EU & New gTLDs, 5) ICYMI: Chinese-style Internet and more, 6) Most Read.

1) ICANN EPDP Phase 2 Chair Janis Karklins
Ambassador Janis Karklins, EPDP Phase 2 Chair (photo)
Ambassador Janis Karklins
"... the extended call for EOIs closed on Monday, 8 April. We received a total of two EOIs, one from Chris LaHatte, former ICANN Ombudsman, and another from Janis Karklins, former GAC Chair and current Latvian Ambassador to the United Nations in Geneva. The GNSO Council Leadership Team and the Standing Selection Committee (SSC) Leadership Team met on Tuesday after conducting individual scoring assessments for each candidate. After approximately one hour of discussion and deliberation, we agreed to unanimously recommend that the Council appoint Janis Karklins as EPDP Phase 2 Chair. We are confident in Janis' ability and commitment to perform the EPDP Phase 2 Chair duties in a neutral manner and consistent with the GNSO PDP Operating Procedures. We are also confident Janis will ensure the work is performed efficiently, effectively, and in a timely manner. Therefore, we will now update the 18 April 2019 GNSO Council agenda to reflect this recommendation and to add Janis Karklins' name to the Consent Agenda item on this topic. If anyone has questions, please raise them prior to the GNSO Council meeting. We thank both candidates for their willingness to serve."--Keith Drazek, GNSO Chair, Apr 10, 2019 (emphasis and link added). Editor's note: the appointment of Janis Karklins was unanimously approved by the GNSO Council on April 18, 2019, after discussion of possible conflict of interest (Karklins is past chair of the WIPO General Assembly) [see also CV].
2) EPDP Phase 2 Budget: 12 April 2019 Letter (pdf) from GNSO Chair Keith Drazek to ICANN Chairman Cherine Chalaby re:Resource Support for Expedited Policy Development Process (EPDP) Phase 2, excerpt:
"Pending the appointment of the Phase 2 Chair and the subsequent finalization of a detailed workplan with milestones, the EPDP Team has identified a preliminary list of the following four key resources needed to support the timely delivery of Phase 2 policy recommendations:
1. Continued availability of legal counsel, following the same process and approach in phase 1 (any questions are vetted through the legal committee);
2. Continued support for telecom services and transcriptions, but to reduce costs, transcriptions would have a 72-hour turnaround time (instead of 24-hour);
3. Mediation support for the EPDP Team meetings at ICANN65 in Marrakesh;
4. Travel support to be made available for ICANN65 for EPDP Team members who would otherwise not be able to attend and where no alternate is able to step in.
We look forward to receiving your feedback."
Additional EPDP related notes:

From the EPDP mail list:16 April 2019:"... Members from the CPH [Contracted Parties House, i.e., Registrars and Registry Operators] ... want to express our concern with discussing proposed working methods / prioritization without a Chair. We believe it is counterproductive to have these discussions without the new Chair in place, and that discussions and feedback should be placed on hold pending the new Chair. We are all anxious to get Phase 2 work underway, but trying to make decisions now increases the likelihood that we will need to revisit all decisions regarding work plans once the new Chair is in place. Accordingly, we respectfully request that all comprehensive discussions be paused until the new Chair is seated ..."--James Bladel (RrSG EPDP member) (emphasis added). April 16, 2019: "I support the CPH position"--Alan Greenberg (ALAC EPDP member).

EPDP Links: EPDP wiki & mail listPhase 1 Final Report (pdf), GNSO mail list & calendar. Link to legal questions and memos.

IRT Wiki: gTLD Registration Data Policy Implementation | Pre-IRT  ("IRT" Implementation Review Team)--"the pre-IRT is going to be a short-lived team to be replaced with the IRT, and all the members will be transitioned to the IRT ... we are putting this team together to get a fast start on the real IRT"--Dennis Chang, ICANN Org, 10 Apr 2019, transcript.). Pre-IRT mail list.

Public Comments closed April 17, 2019, on EPDP Phase 1 Final Report Policy Recommendations.
"... the European Commission considers that the purposes for processing WHOIS personal data by ICANN and/or the contracted parties should not include enabling access by third parties. This is also at the core of the concerns expressed for some time by the DPAs and the European Data Protection Board (EDPB), which have clarified that the purposes of ICANN and contracted parties must not be conflated with the interests of third parties in accessing registration data ..."--European Commission comment, infra.
All comments may be found here, including the comment (pdf) by DomainMondo's editor, embed below, and the comment (pdf) by the European Commission, embed further below:

European Commission comment:

See also:
  • Failure to Redact Personal WHOIS Data Led to Domain HijackingJury Convicts Social Media Entrepreneur in Plot to Hijack Internet Domain | justice.gov Friday, April 19, 2019--"... On June 21, 2017, Adams drove Hopkins to the domain owner’s house and provided Hopkins with a demand note, which contained instructions for transferring the domain [doitforstate.com] to Adams’ GoDaddy account ... Hopkins pulled out Adams’ demand note, which contained a series of directions on how to change an Internet domain name from the domain owner’s GoDaddy account to one of Adams’ GoDaddy accounts. Hopkins put the firearm against the victim’s head and ordered him to follow the directions on the demand note.  Hopkins then pistol whipped the victim several times in the head.  Fearing for his life, the victim quickly turned to move the gun away from his head.  The victim then managed to gain control of the gun, but during the struggle, he was shot in the leg.  The victim shot Hopkins multiple times in the chest.  He then contacted law enforcement ..."  
  • TorrentFreak.comCopyright holders and the US Government (NTIA) want ICANN to make domain WHOIS data more accessible again.
  • Facebook CEO Mark Zuckerberg under close scrutiny--FTC probe into Facebook's privacy practices is also looking at past statements by Zuckerberg and weighing whether to seek oversight of his leadership--washingtonpost.com.

3) Other ICANN News
graphic "ICANN | Internet Corporation for Assigned Names and Numbers"
a) ICANN Publishes Updated Domain Name Marketplace Indicators--ICANN.org see also Global Domains Division (GDD) Metrics. [Editor's note: these metrics or "indicators" are mostly worthless, but as often is the case with "ICANN metrics" it is a situation where instead of counting what is really important and relevant, someone has decided to make what they have selectively chosen to count, "important."]

b) Name Collisions Analysis Project (NCAP) Discussion Group--ICANN.org. [Editor's note: better late than never ICANN, after dumping 1200+ new gTLDs into the global DNS, knowing (since 2003) new gTLDs "fail to work as expected on the internet" and "break stuff."] See also the ICANN NCAP-Discuss mail list.

c) DNS Hijacking: a nation-state backed group of attackers identified as 'Sea Turtle' by Cisco Talos, have been actively exploiting domain name information, by going after domain registries for entire countries.
"The actors behind this campaign have focused on using DNS hijacking as a mechanism for achieving their ultimate objectives. DNS hijacking occurs when the actor can illicitly modify DNS name records to point users to actor-controlled servers. The Department of Homeland Security (DHS) issued an alert about this activity on Jan. 24 2019, warning that an attacker could redirect user traffic and obtain valid encryption certificates for an organization's domain names ... Talos was able to identify two distinct groups of victims. The first group, we identify as primary victims, includes national security organizations, ministries of foreign affairs, and prominent energy organizations. The threat actor targeted third-party entities that provide services to these primary entities to obtain access. Targets that fall into the secondary victim category include numerous DNS registrars, telecommunication companies, and internet service providers. One of the most notable aspects of this campaign was how they were able to perform DNS hijacking of their primary victims by first targeting these third-party entities ..."--talosintelligence.com.

d) 17 Apr 2019 Letter from Amazon VP Brian Huseman to ICANN Board Chair Chalaby (pdf)
Re: new gTLD applications for .AMAZON:
"... Unfortunately, despite best efforts, Amazon and the Amazon Cooperation Treaty Organization (“ACTO”) member states have not reached a mutually acceptable solution regarding Amazon’s applications, but we have listened intently and heard their concerns. Thus, in accordance with the Resolutions and in support of the multi-stakeholder model of internet governance, we submit the following modified proposal for how we will address the concerns of the ACTO member states regarding our applications .... our modified proposal consists of a Public Interest Commitment (“PIC”) and joint Steering Committee that reflects our commitment to operate the TLDs in a way that respects the culture and heritage of the people in the Amazonia region. We commit to: (1) not use as domain names in each .AMAZON TLD those terms that have a primary and well-recognized significance to the culture and heritage of the Amazonia region; (2) provide nine domain names in each .AMAZON TLD to be used for non-commercial purposes by ACTO and its member states to enhance the visibility of the region; and (3) block from all use up to 1500 domain names in each .AMAZON TLD that have a primary and well recognized significance to the culture and heritage of the Amazonia region ..."
Editor's note: I have little to add to what I already said last week (News Review 3)c. .AMAZON Redux), but see the New York Times:
Battle for .amazon Domain Pits Retailer Against South American Nations"Amazon is the world’s biggest online retailer. It is also the world’s largest rain forest. The question is who owns the name. This is the core of an epic battle between the tech behemoth Amazon.com and eight South American countries that contain parts of the rain forest. At stake is the [new gTLD] domain ... .amazon, and who should control it on the internet ..."
But ICANN neither listens nor learns, just continues its mindless and relentless Californication of the internet and global DNS:
“… we have learned that there is tremendous concern about the specifics of the [new gTLDs] program that may lead to a number of unintended and unforeseen consequences and could jeopardize its success …”--Larry Strickling, NTIA, Jan 3, 2012, letter to ICANN (pdf).

4) Names, Domains & Trademarks
graphic "Names, Domains & Trademarks" ©2017 DomainMondo.com
ccTLD .EU: EURid Annual Report (2018) (pdf): Compared to 2017, total net registrations decreased by 130,305 (from 3,815,055 to 3,684,750)--"The decline in the overall number of registrations can be attributed both to a reduction in the number of new registrations in the UK (mainly due to the UK’s withdrawal from the EU, which resulted in the UK falling from being the No. 4 market for .eu to No. 6 in one year), and to the increased efforts of EURid to build a trustworthy and secure .eu namespace which resulted in over 35 000 domain names being suspended in H2 2018."

Editor's note: .EU is not the only declining TLD, look at new gTLDs since the first of the year:

New gTLDs total net (adds minus drops) registrations decline Jan-Apr15, 2019: 
Source: ntldstats.com - new gTLDs total net registrations Jan-Apr15, 2019
Total net registrations in new gTLDs declined -669,064 from Jan 1 thru Apr 15, 2019. At that rate of loss in registrations, total net registrations in new gTLDs will decline in 2019 by over 2.3 million registrations. You won't hear ICANN or its Global Domains Division (GDD) talking about this (at least publicly), even though it is incontrovertible proof that ICANN's new gTLDs program was, and is, ill-conceived, and this has nothing to do with "lack of public awareness" of new gTLDs. Go to your registrar of choice, GoDaddy, Namecheap, Hover, et al, and look around, you can't avoid seeing all the crappy new gTLDs. Too bad ICANN didn't listen to the U.S. Department of Justice Antitrust Division (via NTIA) nor FTC, nor many others including Esther Dyson.

5) ICYMI Internet Domain News 
graphic "ICYMI Internet Domain News" ©2017 DomainMondo.com
Governments across Southeast Asia, including Vietnam and Thailand, are adopting Chinese-style internet and data controls, raising alarms in the U.S.--bloomberg.com.

Scribd taking down the Mueller Report is the future the EU has voted for--Scribd took down multiple copies of the Mueller Report, which is in the public domain, claiming that its algorithms identified it as a copyrighted work--qz.com.

Singapore's fake news bill poses 'risks to freedom of speech'--require social media sites to carry warnings on posts the government deems false and remove certain comments--aljazeera.com.  

Russia: Kremlin Moves Toward Control of Internet, Raising Censorship Fears--NYTimes.com.

German Data Privacy Commissioner Says Article 13 Inevitably Leads to Filters, Which Inevitably Lead to Internet "Oligopoly"--eff.org.

EU gives final approval to the new Copyright Directive, with its controversial Article 11 and 13 provisions, after 19 of the 28 member countries voted in favor --europa.eu.

Era of internet freedom is over.--spiked-online.com. 404 The Internet--forbes.com.

The prosecution of Julian Assange is about much more than attempting to hack a password--eff.org.

EFF’s Tweet About an Overzealous DMCA Takedown Is Now Subject to an Overzealous Takedown--eff.org.

Websites like Reddit and Telegram are being blocked in India by internet service providers.

Turkey: Turkish Economist Arrested After Insulting Erdogan On Twitter--zerohedge.com.

Will a Free Press Cheer on Government Censorship of the Internet? Will a thirst to punish Silicon Valley destroy our liberty?--reason.com.

How digital technology is destroying our freedom--“We’re being steamrolled by our devices” says Douglas Rushkoff--vox.com.

Notice: Vacancy of the European Data Protection Supervisor.

6) Most Read this past week on DomainMondo.com: 
graphic "Domain Mondo" ©2017 DomainMondo.com

-- John Poole, Editor  Domain Mondo 

feedback & comments via twitter @DomainMondo


DISCLAIMER

2019-02-03

News Review | ICANN EPDP Dysfunction & Burnout, Report Delayed

graphic "News Review" ©2016 DomainMondo.com
Domain Mondo's weekly internet domain news review (NR 2019-02-03 with analysis and opinion: Features •  1) ICANN EPDP Dysfunction & Burnout, Report Delayed, 2) EPDP Meetings, 3) ICANNBelgium's DPA, 4) ACTO, ICANN & .AMAZON, 5) Dot COM Dominates Aftermarket, 6) ICYMI: Internet Freedom, Data Protection, Internet Shutdowns, Google Public Policy Fellowships, 7) Most Read.

UPDATE FEB 5: EPDP Schedule changes a) Final Report 'drop dead date' now Feb 25 (revised timeline embed below). b) EPDP Plenary Meetings this week changed to Tuesday Feb 5, Wednesday Feb 6, Thursday Feb 7, starting at 14:00 UTC (9am EST). Observers: Adobe Connect. More info at 2) below.

4 Feb 2019 Letter (pdf) from ICANN CEO Goran Marby to GNSO Council Chair Keith Drazek:

UPDATES Feb 3-4, 2019: 
EPDP Consensus Call #1 email from EPDP Chair Kurt Pritz with attachment embed below:

EPDP Consensus Call #2 email from EPDP Chair Kurt Pritz with attachment embed below:  

Original Post:
1. EPDP Dysfunction & Burnout, Final Report (Phase I) Delayed:
[GNSO-EPDP-Team mail list] "Extreme workload warning!"
"While I understand that we have a deadline to meet, and we do not wish to push any more work than absolutely necessary to the next phase of our WHOIS policy development, I would like to push back on the amount of activity that we are now expected to join over the next couple of weeks in order to push the EPDP final report over the finish line. Many of us have busy lives beyond ICANN, and cannot drop everything to attend 4 three hour plenary meetings a week, let alone the other small team meetings (and respond to the list). Given that we have achieved really only a modest level of consensus on our policy recommendations to date, I would like to register a very strong warning that we will not accept changes to the text that have not been agreed in full committee with full attendance. This appears to be a golden opportunity for those who are being paid to work full time on lobbying for certain outcomes, to insert or reinsert their favorite language into the text. In the name of maintaining the integrity of the multi-stakeholder process, flawed as it undoubtedly is, let us resist this and accept the fact that we cannot fix in our last couple of weeks what we lingered over for months."--Stephanie Perrin, EPDP member and NCSG Chair, EPDP Mail List, Jan 28, 2019.
"I’d like to echo Stephanie’s concerns ... After two weeks of being AWOL (ePDP Toronto and GNSO Los Angeles), my employer is anxious for me to turn my attention to my real job.  I will not be joining the additional sessions next week, nor do I recall our discussing or agreeing to this ask."--James Bladel, EPDP member (GoDaddy, RrSG), EPDP Mail List, Jan 28, 2019.
Hi James and everyone: I got it. I am at NamesCon and spent the ride to the airport this morning on a EPDP staff call and have been holed up in my room typing up legal issues since I arrived. I haven’t sold (or bought) a domain name yet. The additional sessions are not a requirement; invitations were sent as placeholders as a heads up, but there is no confirmation yet on whether we go ahead with these or whether they are needed. Let’s discuss the go-forward plan on the call tomorrow - although we might not have a Plan B in place by then - we can at least generate a joint understanding of status and final objective. Thanks (Stephanie and James) for this interjection. Best regards, Kurt [Pritz, EPDP Chair (appointed by the GNSO Council)] EPDP Mail List Jan 28, 2019.
EPDP Timeline as of Jan 28, 2019 (pdf) now REVISED as of Feb 4, embed below:

Updated Editor's note: the EPDP's "drop dead date" is Feb 11 25, 2019, for submission of the final report to the GNSO Council.

2) ICANN EPDP Meetings for Week Ending Feb 9, and Weekly Recap
Updated: EPDP Plenary Meetings are now scheduled for Tuesday Feb 5, Wednesday Feb 6, Thursday Feb 7,  Friday Feb 8, at 14:00 UTC (9am EST) (schedule subject to change).

Notes and action items from the Thursday, Feb 7, 2019, EPDP meeting here.

Observers may use Adobe Connect, or audiocast via browser / app. Links: Draft Final Report info, EPDP Initial Report (pdf) and public comments to the Initial Report; PCRT Public Comment Review Tool; GNSO Council EPDP page and updates; links to EPDP meeting transcripts and recordings are on the GNSO calendar. Other EPDP links: wiki; mail list; action items; Temp Spec; EPDP Charter (pdf); Data Elements Workbooks (pdf), packet (pdf) small team agreements, ICANN's legal memo on Controllership (pdf), Bird & Bird legal memos are here.

EPDP recap for week ending Feb 2: Jan 29 EPDP meeting wiki page and Jan 31 EPDP meeting wiki page, notes and action items here; Legal committee Jan 30, and Data Elements group Jan 29 (5 EPDP team members + Pritz) and Jan 31 (4 EPDP team members + Pritz).

The Most Important EPDP development has been the legal advice provided by Ruth Boardman, Bird & Bird, to the select few members of the EPDP "legal committee" but finally made available to the full EPDP working group on Friday, Feb 1, 2019, here and here (note: more legal advice may be forthcoming). So far, the EPDP team has been advised:
  • relevant parties could be subject to liability if a registrant wrongly self-identifies as a legal person (and not a natural person) and the registrant's data is disclosed in reliance on this self-identification;
  • where the RNH [registrant] and the technical contact are not the same person, relying on the RNH to provide notice on the registrar's behalf will not meet GDPR's notice requirements if the RNH fails to provide the notice;
  • it is not clear if the contractual necessity condition [GDPR Article 6(1)(b)] can only apply where there is a contract between data controller and data subject;
  • "What is 'necessary' is interpreted strictly. We do not think that the EPDP could successfully argue that preventing DNS abuses is 'necessary' for the contract with the RNH" [registrant]. 

More info on Jan 29 and 31 EPDP meetings on last week's News Review, but the following from the Jan 29 transcript (pp. 54-57)  gives an indication of what's going on:
Milton Mueller: "As I said, I think we need to clarify with the legal counsel whether ICANN can, as controller, and ICANN needs to decide whether it’s a controller here of course, but assuming it is, then the fact that it doesn’t have the data doesn’t necessarily mean that it can request it if [it] is the controller, so we need legal advice on that and whether that’s actually – needs a distinctive purpose. But, you know, that’s not a third party access issue under any construction, that’s ICANN getting data about its own system and doing research on it, which we support but we don't want it in Purpose 2."
Kurt Pritz: Thanks, Milton. Alan, go ahead – Alan Greenberg. 
Alan Greenberg: "Yes, thank you. I misspoke before when I said it could go into Purpose 2; I’d forgotten that Purpose 2 is third parties right now so it cannot be Purpose 2. ICANN under no conditions is a third party. We can fix it, however, either by adding a new purpose or simply modifying Purpose 2 to say to third parties for legitimate lawful purposes, or to ICANN, and then add a processing activity for it. So we could make Purpose 2 apply to ICANN as well if people – if that’s offensive to people then it probably has to be a new purpose not because we need a purpose for ICANN doing the processing of the data but to ensure that it can be sent to ICANN. So it’s not the processing that’s the purpose, it’s the transmission to ICANN that we have to ensure is enshrined in some purpose. So we can fix 2 by adding ICANN as an Other recipient in addition to third parties. I can't see anywhere else it fits. I wouldn’t want to put it into 5 because 5 is very much a compliance one and this is not a compliance issue. Thank you."
Kurt Pritz: Thanks, Alan. ....
Farzaneh Badii: "Thank you, Kurt. Farzaneh speaking. So I think that we are really getting confused because we keep repeating and digging up issues that – and questions that we have responded to multiple times ..." [Editor's note: and so it goes.]
3) Status of ICANN’s exchanges with Belgium's Data Protection Authority (DPA)
Excerpt from 27 Jan 2019 Letter from ICANN GDD Cyrus Namazi (pdf)  
Video interview with Willem DebeuckelaerePresident of Belgium's DPA, at European Data Protection Days in Berlin in May 2018:

More info at: edpd-conference.com. Editor's note: ICANN has its sole EU office in Brussels, Belgium, and therefore Belgium's Data Protection Authority (DPA).is the "lead supervisory authority" over ICANN, stated Mr. Debeuckelaere in his letter, adding: 
"Finally, I wish to note that the GDPR places responsibility for compliance with the provisions of the GDPR upon the (joint) controller(s). It does not provide for a system of prior consultation, except in the case of article 36. It also does not foresee the possibility of prior approval, except in the cases mentioned by articles 40 (codes of conduct) and 47 (binding corporate rules)." 
See also:
"Use of WHOIS Data .... We also have some concerns about whether the practice of having the DAAR collection system query registration data is compliant with GDPR and other privacy regulations. Such queries would require a disclosure of personal data that has not previously been contemplated and could have significant repercussions for both registry operators and ICANN."--gTLD Registries Stakeholder Group (RySG) comments (link above) (emphasis added).

4) Other ICANN News: ACTO, ICANN & .AMAZON
graphic "ICANN | Internet Corporation for Assigned Names and Numbers"
28 January 2019 Letter (pdf) from Alexandra Moreira Lopez, Secretary General, Amazon Cooperation Treaty Organization (ACTO), to GAC Chair Manal Ismail re: New gTLD Applications for .AMAZON:

5) Names, Domains & Trademarks: Dot COM Dominates Aftermarket
graphic "Names, Domains & Trademarks" ©2017 DomainMondo.com
GoDaddy 2019 aftermarket domain trends and NamesCon keynote | slideshare.net excerpt:

6) ICYMI Internet Domain News: Internet Freedom, Data Protection, Internet Shutdowns and Google Public Policy Fellowships
graphic "ICYMI Internet Domain News" ©2017 DomainMondo.com
Has the internet afforded humans more freedom, or less?--Social-Media Outrage Is Collapsing Our Worlds--The internet once made it easier to slip from one domain to another. Is there a way to preserve that vital freedom?--theatlantic.com.

Google and IAB ad category lists show ‘massive leakage of highly intimate data,’ GDPR complaint claims--techcrunch.com.

Ireland questions Facebook’s plan to merge Messenger, Instagram, and WhatsApp--previous data-sharing proposals have ‘given rise to significant data protection concerns’--theverge.com.

Dr Paul Vixie, Farsight Security, on pushing back against cyber criminals--Tech Radio via Soundcloud.com.

African governments use internet shutdowns to silence opposition more and more--what can people do?--euronews.com. See also Zimbabwe President Mnangagwa Justifies Internet Shut Down, Although “He Deeply Believes In Freedom Of Speech And Expression”--techzim.co.zw.

Venezuela: The Committee to Protect Journalists have called on Venezuelan authorities to stop blocking news outlets and to ensure that access to the internet is available amid the country's political crisis and widespread protests--cpj.org.

Applications are open for the Google North America Public Policy Fellowship--all applications must be received by 12:00 p.m. EST, Friday, February, 15th. More information about Google Public Policy Fellowships, including in Latin America, Europe, Middle East, and Africahere.

7) Most Read this past week on DomainMondo.com: 
graphic "Domain Mondo" ©2017 DomainMondo.com



-- John Poole, Editor  Domain Mondo 

feedback & comments via twitter @DomainMondo


DISCLAIMER

Domain Mondo archive