Showing posts with label Safeguards. Show all posts
Showing posts with label Safeguards. Show all posts

2018-09-25

US Senate Hearing To Examine Safeguards for Consumer Data Privacy

What is the impact of digital privacy regulation on the tech industry?

TheAtlantic.com video above published Sep 14, 2018: Victoria Espinel, President, BSA | The Software Alliance, Michael Beckerman, CEO, The Internet Association and Dean Garfield, President and CEO, Internet Technology Industry Council. The panelists weigh in on adapting to regulation, the social impact of technology, and innovation.

Experts in digital privacy and protection weigh in on the current landscape

TheAtlantic.com video above published Sep 14, 2018: Harriet Pearson, Partner, Hogan Lovells, Bruce Schneier, Fellow, Berkman Klein Center for Internet and Society, Harvard University and Ari Waldman, Professor of Law and Director, Innovation Center for Law and Society, New York Law School share their thoughts on the importance of emphasizing innovation, risks of data collection and consumer rights. More info: protectingprivacy.theatlantic.com.

US Senate Commerce Committee Hearing: Examining Safeguards for Consumer Data Privacy: U.S. Sen. John Thune (R-S.D.), chairman of the Senate Committee on Commerce, Science, and Transportation, will convene a full committee hearing titled “Examining Safeguards for Consumer Data Privacy” at 10:00 a.m. EDT on Wednesday, Sep 26, 2018. LIVE video of the hearing will be available on commerce.senate.gov.

The hearing will examine privacy policies of top technology and communications firms, review the current state of consumer data privacy, and offer members the opportunity to discuss possible approaches to safeguarding privacy more effectively.
“Consumers deserve clear answers and standards on data privacy protection. This hearing will provide leading technology companies and internet service providers an opportunity to explain their approaches to privacy, how they plan to address new requirements from the European Union and California, and what Congress can do to promote clear privacy expectations without hurting innovation”--Senator Thune.
Witnesses:
  • Mr. Len Cali, Senior Vice President, Global Public Policy, AT&T Inc.
  • Mr. Andrew DeVore, Vice President and Associate General Counsel, Amazon.com, Inc.
  • Mr. Keith Enright, Chief Privacy Officer, Google LLC
  • Mr. Damian Kieran, Global Data Protection Officer and Associate Legal Director, Twitter, Inc.
  • Mr. Guy (Bud) Tribble, Vice President for Software Technology, Apple Inc.
  • Ms. Rachel Welch, Senior VP, Policy & External Affairs, Charter Communications, Inc.
*Witness list subject to change (source).
Twitter: @SenateCommerce

Background:
The European Union's sweeping privacy law known as the General Data Protection Regulation, or GDPR, became enforceable May 25, 2018, requiring websites to be more transparent about how they handle personal data and giving users more control over what companies can do with their information. A month later, California passed the United States' toughest data privacy law to date in an effort to head off an even stricter ballot initiative. The new California law does not go into effect until 2020, setting off a push in the tech industry for national privacy standards that would prevent (preempt) states from enforcing their own rules.
EFF.org: "The Senate Commerce Committee is getting ready to host a much-anticipated hearing on consumer privacy—and consumer privacy groups don’t get a seat at the table. Instead, the Committee is seeking only the testimony of big tech and Internet access corporations: Amazon, Apple, AT&T, Charter Communications, Google, and Twitter. Some of these companies have spent heavily to oppose consumer privacy legislation and have never supported consumer privacy laws. They know policymakers are considering new privacy protections, and are likely to view this hearing as a chance to encourage Congress to adopt the weakest privacy protections possible—and eviscerate stronger state protections at the same time. It is no coincidence that, in the past week, two leading industry groups (the Chamber of Commerceand the Internet Association) have called for federal preemption of state data privacy laws in exchange for weaker federal protections. For example, laws in California and Illinois require companies to have user consent to certain uses of their personal information (Nevada and Minnesota have these requirements for Internet access providers), while the industry proposals would only require transparency. That means that companies would be allowed to collect information without your permission as long as they tell you they’re doing it. The upcoming hearing at the Senate Commerce Committee may be the launch pad for this strategy of undoing stronger state laws ..."
See also:
  • Google releases framework to guide data privacy legislation--TheHill.com

feedback & comments via twitter @DomainMondo


DISCLAIMER

2016-02-04

ICANN, DNS Abuse, New gTLDs: Bad Policy, Horribly Implemented

DomainMondoShiningLight ©2013domainmondo.com All Rights Reserved
ICANN Questionnaire: Measuring DNS Abuse in New gTLDs:
[note: first 5 questions not included as they only asked for contact information of the person answering the questionnaire]

ICANN is seeking input on the effectiveness of nine safeguards put in place prior to the launch of the New gTLD Program that are intended to mitigate abusive, malicious and criminal behavior in the Domain Name System. In particular, ICANN is looking for ways to measure the effectiveness of these safeguards, which include:
  1. Vetting registry operators
  2. Requirement for DNSSEC deployment
  3. Requirement for Thick WHOIS records
  4. Prohibition of “wild carding”
  5. Removal of orphan glue records
  6. Centralization of Zone file access
  7. Abuse contact and documented anti-abuse policy requirements for registries and registrars
  8. Availability of expedited registry security request process
  9. High-security zone verification
Please answer the questions below to the best of your knowledge and from your own perspective.

6. Which activities do you consider to be DNS abuse?

Answer: Launching hundreds of unwanted, unneeded new gTLDs into the global DNS has to be DNS abuse problem #1 of which the known perpetrator is ICANN itself (along with a few hucksters hoping to make money by exploiting trademark owners and domain name registrants generally), while the victims are businesses, registrants, and the entire global internet community. What has been the effect of ICANN's new gTLDs? Financially failing gTLDs, predatory pricing, malware, rampant cybercrime and trademark infringement, "shady" new gTLDs that "fail to work as expected on the internet" (universal acceptance, collisions, etc.), resulting in reputable security firms advising their clients to block new gTLDs "wholesale" in order to protect the safety, stability, and security of their networks and users.

7. If you could put forth a globally accepted definition of DNS abuse, what would it be? This definition should be broad enough to cover various malicious uses of the DNS.

Answer: Misuse and abuse of the global domain name system (DNS) by ICANN, TLD registry operators, registrars, registrants, or others having access to the DNS.

8. In your opinion, what are the most effective methods to measure the prevalence of abusive activities in the DNS?

Answer: Measure which TLDs are being blocked "wholesale" by network administrators and others globally for reasons of safety and security. Also measure which registry operators, registrars and registrants are connected to domains identified as having abusive activities. Contact firms like IID and Blue Coat to help ICANN staff begin to "understand and comprehend" the magnitude of the problem ICANN has created with its new gTLDs program, and the damage being inflicted upon the DNS and global internet community. ICANN's new gTLDs program is an example of "bad policy, 'horribly implemented.'"

9. As part of the New gTLD Program, ICANN introduced safeguards to mitigate potential DNS abuse in new gTLDs (listed above). How would you propose we measure the effectiveness of these safeguards?

Answer: Since ICANN itself is a source of the problem--see answer to #6 above--accordingly, "ICANN safeguards" were insufficient and ineffective from the start. If ICANN never had a clue how to measure the effectiveness of its own safeguards, ICANN should have never introduced new gTLDs.

10. What has been your experience, personally or on behalf of an organization, with these safeguards? Please tell us:
A. Which were and/or were not effective? How so and why do you believe they were or were not effective?
B. Are there safeguards that should have been included but were not?

Answer to 10A&B: My experience has been as a user of the internet, domain name registrant, and website developer/publisher/editor. ICANN's "safeguards" were ineffective and insufficient--see answers to #6, #7, #8, #9 above. ICANN's new gTLDs program--bad policy, horribly implemented--is a complete indictment of ICANN and its own peculiar form of the "multistakeholder model" of internet governance.

Submitted to ICANN February 1, 2016

See also on Domain Mondo:



DISCLAIMER

2016-01-27

ICANN New gTLD Program Review: Domain Name System, DNS Abuse

Or which of ICANN's new gTLDs are the "shadiest" in the global DNS?


Above: ICANN 2015 Presentation on "DNS Abuse Handling"

From the ICANN Announcement--
ICANN is currently engaged in data collection on DNS (Domain Name System) abuse and mitigation efforts implemented as part of the New gTLD Program. Members of the community and general public are invited to join ICANN on 28 January 2016 in an open discussion on the topic. This work will help inform the efforts of the review team examining the effects of the Program on Competition, Consumer Choice, and Consumer Trust, which will assess the safeguards in the Program as part of its work.

Discussion Details & How to Attend--

ICANN will hold two discussions to enable participation in all regions:
Discussion 1Jan 28, 2016 at 02:00-03:30 UTC time converter (9-10:30pm EST Jan 27)
Discussion 2: Jan 28, 2016 at 16:00--17:30 UTC time converter (11am-12:30pm EST Jan 28)
Discussions will be conducted in English. Recordings will be posted at: https://newgtlds.icann.org/en/reviews/dns-abuse.

Register to attend the discussion and ICANN will send you an email with participation information OR unable to attend, but want to contribute? Give ICANN the OK to send you a questionnaire so you can tell ICANN about your experiences. Visit: http://survey.clicktools.com/app/survey/go.jsp?iv=25apb9wqx72s8

The goals of the discussion are to help formulate a definition of DNS abuse, brainstorm methods for measuring abuse, and gather qualitative, experiential input on whether safeguards to mitigate DNS abuse in new gTLDs have been effective. The discussion will be structured around 4 central topics, which participants are encouraged to consider prior to joining:

Topic 1: Which activities do you consider to be DNS abuse? If you could put forth a globally accepted definition of DNS abuse, what would it be? This definition should be broad enough to cover various malicious uses of the DNS.

Topic 2: What are the most effective methods to measure the prevalence of abusive activities in the DNS?

Topic 3: As part of the New gTLD Program, ICANN introduced safeguards [PDF, 128 KB] to mitigate potential DNS abuse in new gTLDs (listed below). How can we measure the effectiveness of these safeguards?
  • Vetting registry operators
  • Requirement for DNSSEC deployment
  • Requirement for Thick WHOIS records
  • Prohibition of "wild carding"
  • Removal of orphan glue records
  • Centralization of Zone file access
  • Abuse contact and documented anti-abuse policy requirements for registries and registrars
  • Availability of expedited registry security request process
  • High-security zone verification
Topic 4: What has been your experience, personally or on behalf of an organization, with these safeguards? Please tell us: Which were and/or were not effective? How so and why do you believe they were or were not effective? Are there safeguards that should have been included but were not? Any remaining time will be open for questions and related discussion.

Further Information: DNS Abuse Review | ICANN New gTLDs

ICANN's New gTLD Program has enabled hundreds of new top-level domains to enter into the Internet's root zone since the first delegation occurred in October 2013. Comprehensive reviews of the program have begun and will cover a variety of topics including competition, consumer trust and choice (CCT), security and stability, rights protection and other areas. Along with commissioning third-party analyses,ICANN is capturing stakeholder experiences regarding operation of the New gTLD Program and its effects on the domain name industry. Lessons learned as a result of these efforts will help shape future rounds of the program.

ICANN's Suggested Reading:
Source: ICANN Discussion: Reviewing New gTLD Program Safeguards Against DNS Abuse

See also on Domain Mondo:
See also:
DNS Abuse Handling (pdf)
Lost in .Space (Shady TLD Research, part 14) | Blue Coat
.ZIP URLs (or, Why You Should Block Domains on a TLD That Doesn't Have Any) | Blue Coat
Real World DNS Abuse: Finding Common Ground (Cisco)
"DNS Abuse" (Google SERP)
DNS is ubiquitous and it's easily abused to halt service or steal data | Network World
Finding and Fixing Open DNS Resolvers - Infoblox Experts Community
IID | IID Predicts Massive Botnet Takeover of IoT Devices by 2017 - Cybersecurity firm also anticipates a spate of domain failures, leading to demise of websites relying on them- IID




DISCLAIMER

2014-12-15

ALAC Call for Freeze on New gTLDs, Safeguards, Public Interest, All Disregarded by ICANN

More chaos, confusion and dysfunction at ICANN over new gTLDs (new generic top-level domains) and ICANN's disregard of the public interest and the public safety of the global internet community--

Letter dated December 9, 2014, from the ICANN Business Constituency to Fadi ChehadĂ©, CEO, ICANN, Dr. Stephen Crocker, Chair, ICANN Board of Directors (pdf):

"The Business Constituency (BC) supports the ALAC’s call for a freeze on contracting and
delegation of any new gTLD in highly-regulated sectors that have failed to implement GAC safeguards... The strings at issue here include:

Health and Fitness: .pharmacy .surgery .dentist .dds .hospital .medical .doctor
Financial: .bank .banque .creditunion .creditcard .insurance .ira .lifeinsurance .mutualfunds .mutuelle .vermogensberater .vesicherung .autoinsurance .carinsurance
Gambling: .bet .bingo .lotto .poker .spreadbetting .casino
Charity: .charity (and IDN Chinese equivalent)
Education: university 

....
In May-2014, the BC expressed concern that the safeguards adopted to date for strings associated with regulated industries and professions was falling short, and that such strings remain susceptible to fraud and abuse by potential registrants who wish enrich themselves at the expense of the general public. GAC and NTIA had raised concerns regarding NGPC’s proposed implementation of Category 1 safeguards. It was therefore unclear how PICs could provide effective safeguards, given a registry’s ability to amend or revoke its PICs [Public Interest Commitments] and the lengthy, expensive, and adversarial process required to enforce PICs by the limited class of parties able to bring enforcement actions.

Nevertheless, during 2014 ICANN has continued to sign registry contracts with applicants for 
Category 1 strings, without requiring safeguards in registry PICs. That led the ALAC to request a freeze at the ICANN51 Public Forum. The ALAC resolution calls for freezing the 28 highly-sensitive, regulated Category 1 strings until a joint ALAC-GAC working group can determine that appropriate safeguards are indeed in place to protect the public interest. In response, the ICANN Board New gTLD Program Committee (NGPC) voted on 7-Nov-2014 to disregard the ALAC Statement on Public Interest Commitments, including the ALAC request for a freeze....

The BC remains concerned that safeguards adopted for strings associated with regulated
industries and professions may fall short and that such strings remain susceptible to fraud and
abuse by potential registrants who wish enrich themselves at the expense of the general public.

Unless ICANN’s board and management respond appropriately, the continued delegation of new
gTLDs serving highly-regulated sectors will demonstrate ICANN’s lack of accountability to
consumers and to consumer protection authorities around the globe
. Lack of action by ICANN’s board on this matter will likely be cited as evidence to justify new independent review mechanisms to allow the Internet community to challenge decisions of ICANN board and management. The BC would be among those citing this case as justification for stronger accountability mechanisms for ICANN...." (emphasis added, read full letter at link above)


Also see: Letter dated December 9, 2014, from Governmental Advisory Committee (GAC) to Dr. Stephen Crocker, Chair, ICANN Board Of Directors (pdf)--excerpt:

".... We also remain concerned with the NGPC’s elimination of the requirement to consult with
relevant authorities (regulatory and quasi-regulatory bodies where applicable) in case of doubt
about the authenticity of credentials, and the requirement to conduct periodic post-registration
checks to ensure that Registrants’ continue to possess valid credentials and generally conduct
their activities in the interests of the consumers they serve. The GAC advised these procedures
to protect the public from falling prey to scammers and other criminals...." (emphasis added)

And the Obama Administration wants to surrender the US Department of Commerce (NTIA) contract and all oversight of ICANN--the scammers and other cybercriminals must be smiling! Of course when it comes to the new gTLDs program, ICANN was never interested in the public interest--it's all about the money--that's why we now have over 1000 new gTLDs being irresponsibly flooded into the domain name system (DNS).

see also: ICANN Seeking Panel Members for New gTLD Public Interest Commitment Dispute Resolution

UPDATE: Preliminary Report | Meeting of the New gTLD Program Committee 11 Dec 2014: "... After discussion, the sense of the Committee was that it was not supportive of halting the contracting and delegating process for the strings identified in the ALAC Statement, but the Committee decided to engage as soon as possible with the ALAC to better understand their concerns about the PICs, and to discuss a path forward. The Committee decided to prepare a response to the ALAC to provide the rationale for its decision, and to take steps to begin a dialogue with the ALAC. Also, the Committee agreed to take steps to initiate a dialogue with the GAC to discuss its concerns with the PICs...."

Domain Mondo archive