<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body dir="auto">
Rubens,
<div><br>
</div>
<div>
<p style="margin: 0px; font-stretch: normal; line-height: normal; font-family: ".SF UI Text"; color: rgb(69, 69, 69);">
</p>
<blockquote type="cite"><span style="font-family: ".SFUIText"; font-size: 14pt;">Those can be used to do some correlations, but other factors such as name servers, IP address and target URL (if hiding in a redirection chain) are useful as well.</span></blockquote>
<p></p>
<p style="margin: 0px; font-stretch: normal; line-height: normal; font-family: ".SF UI Text"; color: rgb(69, 69, 69); min-height: 16.7px;">
<span style="font-family: ".SFUIText"; font-size: 14pt;"></span><br>
</p>
<p style="margin: 0px; font-stretch: normal; line-height: normal; font-family: ".SF UI Text"; color: rgb(69, 69, 69); min-height: 16.7px;">
Name server and IP address are often not useful, especially with email based attacks, which is the majority of attacks now, because the bad guys use the registrar's nameservers and a third party mail server. In other words it doesn't tell us anything to see
that the domain has Microsoft or Google or major registrar MX records and IP addresses. Similarly, there is no target URL since the attack is not content based. </p>
<p style="margin: 0px; font-stretch: normal; line-height: normal; font-family: ".SF UI Text"; color: rgb(69, 69, 69); min-height: 16.7px;">
<br>
</p>
<p style="margin: 0px; font-stretch: normal; line-height: normal; font-family: ".SF UI Text"; color: rgb(69, 69, 69);">
</p>
<blockquote type="cite"><span style="font-family: ".SFUIText"; font-size: 14pt;">A registrar has access to registration data and can act based on that. So, if someone detects that example.example is a security threat, it can raise that issue with the registrar
and that registrar can correlate to other domains registered by the same wrong-doer. There is no secret sauce, and this happens in large amounts everyday.</span></blockquote>
<br>
<p></p>
<p style="margin: 0px; font-stretch: normal; line-height: normal; font-family: ".SF UI Text"; color: rgb(69, 69, 69);">
No offense to my registrar friends but they are generally not going to do this kind of investigation and definitely not en masse as would be required if there is no registrant name and email. Basically, you would be shifting the investigation burden to the
registrars. Why don't you ask them what they think of that idea and whether it is likely to happen. And that is just the major registrars - the smaller ones generally won't even investigate and say they have no duty to. </p>
<p style="margin: 0px; font-stretch: normal; line-height: normal; font-family: ".SF UI Text"; color: rgb(69, 69, 69); min-height: 16.7px;">
<span style="font-family: ".SFUIText"; font-size: 14pt;"></span><br>
</p>
<p style="margin: 0px; font-stretch: normal; line-height: normal; font-family: ".SF UI Text"; color: rgb(69, 69, 69);">
</p>
<blockquote type="cite"><span style="font-family: ".SFUIText"; font-size: 14pt;">Both investigating and enforcing can be done by registrars or thick registries (if they continue to exist after GDPR). Detecting can be done both by registrars and by 3rd parties,
and in my experience the best results come from all doing it: we run some pattern detection filters on the stream of new registrations and get threat feeds from the "usual suspects" (OpenPhish, PhishTank, ShadowServer etc.).</span></blockquote>
<br>
<p></p>
<p style="margin: 0px; font-stretch: normal; line-height: normal; font-family: ".SF UI Text"; color: rgb(69, 69, 69);">
See above- not going to happen. </p>
<p style="margin: 0px; font-stretch: normal; line-height: normal; font-family: ".SF UI Text"; color: rgb(69, 69, 69); min-height: 16.7px;">
<span style="font-family: ".SFUIText"; font-size: 14pt;"></span><br>
</p>
<p style="margin: 0px; font-stretch: normal; line-height: normal; font-family: ".SF UI Text"; color: rgb(69, 69, 69);">
</p>
<blockquote type="cite"><span style="font-family: ".SFUIText"; font-size: 14pt;">The interim time was between 27 April 2016, when GDPR passed, and 24 May 2018, the last day before its enforcement. Interim stops there, as some DPAs said:</span></blockquote>
<p></p>
<p style="margin: 0px; font-stretch: normal; line-height: normal; font-family: ".SF UI Text"; color: rgb(69, 69, 69);">
</p>
<blockquote type="cite"><span style="font-family: ".SFUIText"; font-size: 14pt;"><a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__iapp.org_news_a_dpas-2Dto-2Dpros-2Dtheres-2Dno-2Dgrace-2Dperiod-2Dfolks_&d=DwMGaQ&c=2s2mvbfY0UoSKkl6_Ol9wg&r=r5rx-kI5Cxza1vQgpUa9uXTHEPmarcD6Ch-F3m5O9fQ&m=82yN_ETS0oFDPpDfcXjf3emBmkHGWC21Fi6DYKxf71o&s=Pjz2yiMe86q8tuyEpOUG8fw3-ArScoJn6Ipqfph1nYg&e=">https://iapp.org/news/a/dpas-to-pros-theres-no-grace-period-folks/</a></span></blockquote>
<br>
<p></p>
<p style="margin: 0px; font-stretch: normal; line-height: normal; font-family: ".SF UI Text"; color: rgb(69, 69, 69);">
Funny but I'm talking about ICANN's interim solution before their final one. </p>
<p style="margin: 0px; font-stretch: normal; line-height: normal; font-family: ".SF UI Text"; color: rgb(69, 69, 69); min-height: 16.7px;">
<span style="font-family: ".SFUIText"; font-size: 14pt;"></span><br>
</p>
<p style="margin: 0px; font-stretch: normal; line-height: normal; font-family: ".SF UI Text"; color: rgb(69, 69, 69);">
</p>
<blockquote type="cite"><span style="font-family: ".SFUIText"; font-size: 14pt;">EDPB, known before May 25 as WP29. "The role of the EDPB will be to ensure the consistency of the application of the GDPR throughout the Union, through guidelines, opinions and
decisions."</span></blockquote>
<p></p>
<div><br>
</div>
Yes - But they won't give specific guidance before May 25. That much is clear. <br>
<div id="AppleMailSignature">
<div><br>
</div>
<div>Best Regards,</div>
<b>
<div><b><br>
</b></div>
Marc H.Trachtenberg</b>
<div>
<div>Shareholder</div>
<div>Greenberg Traurig, LLP</div>
<div>77 West Wacker Drive</div>
<div>Chicago, IL 60601</div>
<div>Office (312) 456-1020</div>
<div>Mobile (773) 677-3305</div>
</div>
</div>
<div><br>
On Apr 22, 2018, at 5:16 PM, Rubens Kuhl <<a href="mailto:rubensk@nic.br">rubensk@nic.br</a>> wrote:<br>
<br>
</div>
<blockquote type="cite">
<div>EDPB, known <span>before May 25</span> as WP29. "The role of the EDPB will be to ensure the consistency of the application of the GDPR throughout the Union, through guidelines, opinions and decisions."</div>
</blockquote>
</div>
<HR>If you are not an intended recipient of confidential and privileged information in this email, please delete it, notify us immediately at postmaster@gtlaw.com, and do not use or disseminate such information.<BR>
</body>
</html>