<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><meta http-equiv="Content-Type" content="text/html; charset=utf-8" class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""><div class=""><br class=""><blockquote type="cite" class=""><div class="">On 1 May 2018, at 11:20, Scott Austin <<a href="mailto:SAustin@vlplawgroup.com" class="">SAustin@vlplawgroup.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class="">
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252" class="">
<div class="" style="word-wrap:break-word; line-break:after-white-space">
<div class="">
<div class=""><font face="sans-serif" class="">Rubens:</font></div>
<div class=""><font face="sans-serif" class=""><br class="">
</font></div>
<div class=""><font face="sans-serif" class="">(My last email response to you was a bit unfinished as I was writing in an airport so I am resending with a completed final paragraph)</font></div>
<div class=""><font face="sans-serif" class=""><br class="">
</font></div>
<div class=""><font face="sans-serif" class="">First, you reference to an email from me using trademark registration as a basis for my proposal must be referring to someone else. I never mentioned trademark registrations as a model, only DMCA, which relates to copyright and
the US copyright office as providing a registry for designated agents for $6 so your cost multiples based on trademark registration are way off and should be based on that $6 figure I provided, if any, which is less than what I have paid for proxy service
as an addition to DN registration. In addition the designee need not be a lawyer and could be an existing proxy service as they have plenty of experience receiving and acting upon notice from rightsholders. If Google provides its service for free while others
charge perhaps they will be #1 very soon. I suggested the service might be provided without additional charge and here are at least two examples that prove it can.</font></div></div></div></div></blockquote><div class=""><br class=""></div>DMCA is very US-specific, but filing a copyright petition here costs 1.5 domain, so that could be an estimate. The point here is to make clear that one can't use US-market economics to say that something is economically viable everywhere. There is more to the world than the US and the EU. </div><div class=""><br class=""></div><div class=""><br class=""><blockquote type="cite" class=""><div class=""><div class="" style="word-wrap:break-word; line-break:after-white-space"><div class="">
<div class=""><font face="sans-serif" class=""><br class="">
</font></div>
<div class=""><font face="sans-serif" class="">You wrote: <</font>That contract network can't supersede any applicable laws. Contracts can go only up to what the law allows, and changing civil law requires lawmaker involvement, different from case law.></div>
<div class=""><br class="">
</div>
<div class="">Most contracts contain notice and choice of law provisions, which are well within the generally accepted principles of contract law, unless you know of a juridiction where parties cannot not consensually agree on what jurisdiction's law applies and how
they should be notified. Most contracts, including ICANN's, include such provisions, </div></div></div></div></blockquote><div class=""><br class=""></div>Not true regarding ICANN, and ICANN went to extremes in the CCWG-Accountability to position their contracts as jurisdiction neutral. ICANN registry contracts have no jurisdiction and geographic contract mention whatsoever, including no choice of law. Registrar contracts also have no choice of law, but curiously have a mention to "Los Angeles". That mention has been downplayed by ICANN to not specify any deterrence to California law. Some registries and registrars have been asking for clear choice of law since ever, and ICANN insists in not doing so. So that doesn't hold for ICANN contracts at this time. </div><div class=""><br class=""><blockquote type="cite" class=""><div class=""><div class="" style="word-wrap:break-word; line-break:after-white-space"><div class=""><div class="">so please clarify how providing a contact for notice to be forwarded to (without revealing the registrant's PII) which supports due process, would supersede or require change
to applicable law. No rights are being waived. Where is the logic in rendering a registrant unreachable if they have violated someone else's rights, privacy or otherwise. What am I missing? </div></div></div></div></blockquote><div class=""><br class=""></div>Because you are only looking at the notify process side. If that requirement could have been achieved without PII, it wouldn't be a legal problem. But for that to happen, the PII must be forwarded to the proxy provider, and when that becomes a requirement, it's no longer a freely-given consent. </div><div class=""><br class=""></div><div class=""><br class=""><blockquote type="cite" class=""><div class=""><div class="" style="word-wrap:break-word; line-break:after-white-space"><div class="">
<div class=""><br class="">
</div>
<div class="">You wrote: <We don't have to resort to multiple jurisdictions; I don't think Europol has a view much different from FBI, for instance, so they are as able to carry a message of steering the needle towards transparency instead of privacy to lawmakers.
But there is a global trend in society towards control of personal data that is overwhelming... so I wouldn't take such amendments for granted, even in less privacy-oriented jurisdictions. Specially after people realise that the sky hasn't fallen.></div>
<div class=""><font face="sans-serif" class=""><br class="">
</font></div>
<div class=""><font face="sans-serif" class="">The proposed amendment supports privacy in line with GDPR in the EU, a privacy oriented jurisdiction. LEAs (which would include FBI and Interpol) and cybersecurity companies have been some of the most vocal critics concerned with
timely access to protected Whois data after GDPR takes effect. I can't speak to the current views of the FBI and Interpol on GDPR, </font></div></div></div></div></blockquote><div class=""><br class=""></div>PSWG has been sharing their views, and that's why I mentioned Europol (not to be confused with Interpol), since it's the LEA that more closely covers the EU jurisdiction. It would be interesting to have an Europol position (not an EC3 position, like </div><div class=""><a href="https://www.icann.org/en/system/files/files/gdpr-statement-ec3-europol-icann-proposed-compliance-models-25jan18-en.pdf" class="">https://www.icann.org/en/system/files/files/gdpr-statement-ec3-europol-icann-proposed-compliance-models-25jan18-en.pdf</a> ) sent to Art 29 WP/EDPB. </div><div class=""><br class=""></div><div class=""><br class=""><blockquote type="cite" class=""><div class=""><div class="" style="word-wrap:break-word; line-break:after-white-space"><div class=""><div class=""><font face="sans-serif" class="">but given the extensive concerns raised by ICANN. stakeholders, and the press covering these issues, the sky is expected to grow
very dark, if not fall, for as much as 18 months. I am interested what evidence you have that it wont fall.</font></div></div></div></div></blockquote><div class=""><br class=""></div>The 2nd law of thermodynamics prevents anyone from having evidence about the future, but what I can say based on my InfoSec experience that goes back a few decades includes a few things:</div><div class="">- Passive DNS has been growing a lot in capability to detect threats. And for detecting the non-naive criminals that know not to share WHOIS details among domains, it's already the only tool out there. </div><div class="">- Registries and registrars that are security-conscious and have zero tolerance on abuse will still have data allowing correlation in their realm so they take-down a series of domains after someone hints them of one of the bad ones. </div><div class="">- Those that are not cooperative will not become more or less not cooperative; TLD or registrar-based rankings will still be possible since that information will still be published in WHOIS. </div><div class="">- Actually, because naive criminals won't see their data in WHOIS they might forget that registry and registrar still have that, so it may become easier for some contracted parties to identify them. </div><div class=""><br class=""></div><div class="">What is a gap, and I shared some thoughts with Jonathan from RiskIQ on that because I believe it could be a loss, is where all the conditions below apply:</div><div class="">1) Criminal is not a total newbie but also not experienced</div><div class="">2) Criminal used the same WHOIS data on different TLDs and/or registrars, possibly not trying to hide but by chance (price promotions, phishing keyword looks more closely to a TLD etc.)</div><div class="">3) Because it envolves different contracted parties, their abuse teams wouldn't be able to correlate with data held by other parties</div><div class=""><br class=""></div><div class="">But that gap has a possible solution not involving publishing PII, which is publishing an unique identifier. </div><div class=""><br class=""><blockquote type="cite" class=""><div class=""><div class="" style="word-wrap:break-word; line-break:after-white-space"><div class=""><div class=""><font face="sans-serif" class=""> Some registrar's WHOIS has already begun masking registrant email addresses which has been the primary means for global reach to registrants for notice,
including effective service of process for rights protection mechanisms like UDRP. </font></div></div></div></div></blockquote><div class=""><br class=""></div>Contracted parties have been many times on record to establish that UDRP and URS are unanimously considered by their legal teams as fitting GDPR nicely. They will not stop after GDPR modifications are enacted, although the procedures among dispute resolution providers and contracted parties might change a bit. </div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""><blockquote type="cite" class=""><div class=""><div class="" style="word-wrap:break-word; line-break:after-white-space"><div class=""><div class=""><font face="sans-serif" class="">My registrant agent propsal in no way exposes private data, and in fact protects it as the registrant can choose its designee to receive and foward notice. But it also avoids
a domain being used as a shroud to place the registrant beyond reach of notice, using privacy protection as subterfuge to avoid or cost prohibitively surcharge effective service via email.</font></div>
<div class=""><font face="sans-serif" class=""><br class=""></font></div></div></div></div></blockquote><div class=""><br class=""></div>But in all that attempt to provide a way to notice, it loses the correlation capabilities that are key to cybersecurity. So using cybersecurity as a reason for that doesn't hold; actually, people don't want to tip abusers that they are being tracked. </div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">Rubens</div><div class=""><br class=""><div class=""><br class=""></div><div class=""><br class=""></div><br class=""><blockquote type="cite" class=""><div class=""><div class="" style="word-wrap:break-word; line-break:after-white-space"><div class=""><div class=""><font face="sans-serif" class="">
</font></div>
<div class="">Best regards,</div>
<div class="">Scott</div>
<div class=""><font face="sans-serif" class=""><br class="">
</font></div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div id="composer_signature" class="">
<div dir="auto" style="font-size:85%; color:rgb(87,87,87)" class="">Sent from my T-Mobile 4G LTE Device</div>
</div>
<div class=""><br class="">
</div>
<div style="font-size:100%" class=""></div>
<div style="font-size:100%" class="">
<div class="">-------- Original message --------</div>
<div class="">From: Rubens Kuhl <<a href="mailto:rubensk@nic.br" class="">rubensk@nic.br</a>> </div>
<div class="">Date: 4/30/18 <a href="" class="">9:37 PM</a> (GMT-05:00) </div>
<div class="">To: Scott Austin <<a href="mailto:SAustin@vlplawgroup.com" class="">SAustin@vlplawgroup.com</a>>
</div>
<div class="">Cc: "BECKHAM, Brian" <<a href="mailto:brian.beckham@wipo.int" class="">brian.beckham@wipo.int</a>>, Cyntia King <<a href="mailto:cking@modernip.com" class="">cking@modernip.com</a>>,
<a href="mailto:accred-model@icann.org" class="">accred-model@icann.org</a> </div>
<div class="">Subject: Re: [Accred-Model] WP29 statement on WHOIS </div>
<div class=""><br class="">
</div>
</div>
<br class="">
<div class=""><br class="">
<blockquote type="cite" class="">
<div class="">On <a href="" class="">30 Apr 2018</a>, at <a href="" class="">21:59</a>, Scott Austin <<a href="mailto:SAustin@vlplawgroup.com" class="">SAustin@vlplawgroup.com</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div class="WordSection1" style="font-family:Helvetica; font-size:12px">
<div class="" style="margin:0in 0in 0.0001pt; font-size:11pt; font-family:Calibri,sans-serif">
Rubens:</div>
<div class="" style="margin:0in 0in 0.0001pt; font-size:11pt; font-family:Calibri,sans-serif">
You are correct, new law would have to be made – or existing law amended. But it is a given with the thousands of hours now spent by lawyers, ICANN, privacy officials and governing bodies analyzing GDPR that new law will be made in response to GDPR. My question
is whether those laws in response will be made through a patchwork of regulations or statutes in multiple jurisdictions taking effect at different times to protect their unsuspecting citizens from GDPR’sits penalties; or worse, a patchwork of judge-made interpretations
of GDPR’s application and scope in challenges of those penalties after they issue against citizens.
</div>
</div>
</div>
</blockquote>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
We don't have to resort to multiple jurisdictions; I don't think Europol has a view much different from FBI, for instance, so they are as able to carry a message of steering the needle towards transparency instead of privacy to lawmakers. </div>
<div class="">But there is a global trend in society towards control of personal data that is overwhelming... so I wouldn't take such amendments for granted, even in less privacy-oriented jurisdictions. Specially after people realise that the sky hasn't fallen after
May 25th. </div>
<div class=""><br class="">
</div>
<div class=""><br class="">
<blockquote type="cite" class="">
<div class="">
<div class="WordSection1" style="font-family:Helvetica; font-size:12px">
<div class="" style="margin:0in 0in 0.0001pt; font-size:11pt; font-family:Calibri,sans-serif">
And how will that cost compare with my suggestion of a modest amendment to an existing global contract network with existing registries,
</div>
</div>
</div>
</blockquote>
<div class=""><br class="">
</div>
That contract network can't supersede any applicable laws. Contracts can go only up to what the law allows, and changing civil law requires lawmaker involvement, different from case law. </div>
<div class=""><br class="">
</div>
<div class=""><br class="">
<blockquote type="cite" class="">
<div class="">
<div class="WordSection1" style="font-family:Helvetica; font-size:12px">
<div class="" style="margin:0in 0in 0.0001pt; font-size:11pt; font-family:Calibri,sans-serif">
which amendment proposes to keep data private but provide reasonable access for notice or service of process to a registrant through a qualified third party, registered designee, with the added benefit of taking effect globally and simultaneously. And given
that GDPR is essentially the enactment of government sanctioned proxy protection which may limit if not obviate the need for existing private proxy services, perhaps the privacy/proxy service providers would be willing to transfer their services to fulfill
the role of registrant’s agents or their back office. </div>
</div>
</div>
</blockquote>
<br class="">
</div>
<div class="">If that was true, privacy/proxy service would already be an included service in all major registrars. While it's included in Google Domains and Uniregistry, Google is #10 gTLD registrar at this time... so most registrants still to have to pay for a service
that is much more simpler than the one you suggest. A good number of those registrar-based proxy services simply turn off privacy in response to any kind of dispute or issue instead of relaying notices to registrants. What you have described is more like the
type of proxying provided by law offices, which comes with a price. </div>
<div class=""><br class="">
</div>
<div class="">BTW, since you mentioned trademark registrations in an earlier e-mail, I converted some local fees to local domain multiples so you can get a feeling of how that would impact pricing:</div>
<div class="">- Local PTO cost for requesting a trademark registration: 3.5 domains</div>
<div class="">- How much a lawyer bills for preparing that registration: 42.5 domains</div>
<div class="">- Local PTO cost for issuing a trademark: 7.5 domains</div>
<div class="">- Lawyer costs when the trademark is issued for monitoring and challenging future trademark applicants: 10 domains</div>
<div class=""><br class="">
</div>
<div class="">It's hard to fit any of those into a cost-neutral mechanism. </div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class="">Rubens</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class=""></div>
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div id="composer_signature" class="">
<div dir="auto" style="font-size:85%; color:#575757" class="">Sent from my T-Mobile 4G LTE Device</div>
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class="">-------- Original message --------</div>
<div class="">From: Rubens Kuhl <<a href="mailto:rubensk@nic.br" class="">rubensk@nic.br</a>> </div>
<div class="">Date: 4/30/18 9:37 PM (GMT-05:00) </div>
<div class="">To: Scott Austin <<a href="mailto:SAustin@vlplawgroup.com" class="">SAustin@vlplawgroup.com</a>> </div>
<div class="">Cc: "BECKHAM, Brian" <<a href="mailto:brian.beckham@wipo.int" class="">brian.beckham@wipo.int</a>>, Cyntia King <<a href="mailto:cking@modernip.com" class="">cking@modernip.com</a>>, <a href="mailto:accred-model@icann.org" class="">accred-model@icann.org</a>
</div>
<div class="">Subject: Re: [Accred-Model] WP29 statement on WHOIS </div>
<div class=""><br class="">
</div>
<div class=""><br class="">
<div class=""><br class="">
<blockquote type="cite" class="">
<div class="">On 30 Apr 2018, at 21:59, Scott Austin <<a href="mailto:SAustin@vlplawgroup.com" class="">SAustin@vlplawgroup.com</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div class="WordSection1" style="font-family:Helvetica; font-size:12px; font-style:normal; font-weight:normal; letter-spacing:normal; text-align:start; text-indent:0px; text-transform:none; white-space:normal; word-spacing:0px; text-decoration:none">
<div class="" style="margin:0in 0in 0.0001pt; font-size:11pt; font-family:Calibri,sans-serif">
Rubens:</div>
<div class="" style="margin:0in 0in 0.0001pt; font-size:11pt; font-family:Calibri,sans-serif">
You are correct, new law would have to be made – or existing law amended. But it is a given with the thousands of hours now spent by lawyers, ICANN, privacy officials and governing bodies analyzing GDPR that new law will be made in response to GDPR. My question
is whether those laws in response will be made through a patchwork of regulations or statutes in multiple jurisdictions taking effect at different times to protect their unsuspecting citizens from GDPR’sits penalties; or worse, a patchwork of judge-made interpretations
of GDPR’s application and scope in challenges of those penalties after they issue against citizens.
</div>
</div>
</div>
</blockquote>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
We don't have to resort to multiple jurisdictions; I don't think Europol has a view much different from FBI, for instance, so they are as able to carry a message of steering the needle towards transparency instead of privacy to lawmakers. </div>
<div class="">But there is a global trend in society towards control of personal data that is overwhelming... so I wouldn't take such amendments for granted, even in less privacy-oriented jurisdictions. Specially after people realise that the sky hasn't fallen after
May 25th. </div>
<div class=""><br class="">
</div>
<div class=""><br class="">
<blockquote type="cite" class="">
<div class="">
<div class="WordSection1" style="font-family:Helvetica; font-size:12px; font-style:normal; font-weight:normal; letter-spacing:normal; text-align:start; text-indent:0px; text-transform:none; white-space:normal; word-spacing:0px; text-decoration:none">
<div class="" style="margin:0in 0in 0.0001pt; font-size:11pt; font-family:Calibri,sans-serif">
And how will that cost compare with my suggestion of a modest amendment to an existing global contract network with existing registries,
</div>
</div>
</div>
</blockquote>
<div class=""><br class="">
</div>
That contract network can't supersede any applicable laws. Contracts can go only up to what the law allows, and changing civil law requires lawmaker involvement, different from case law. </div>
<div class=""><br class="">
</div>
<div class=""><br class="">
<blockquote type="cite" class="">
<div class="">
<div class="WordSection1" style="font-family:Helvetica; font-size:12px; font-style:normal; font-weight:normal; letter-spacing:normal; text-align:start; text-indent:0px; text-transform:none; white-space:normal; word-spacing:0px; text-decoration:none">
<div class="" style="margin:0in 0in 0.0001pt; font-size:11pt; font-family:Calibri,sans-serif">
which amendment proposes to keep data private but provide reasonable access for notice or service of process to a registrant through a qualified third party, registered designee, with the added benefit of taking effect globally and simultaneously. And given
that GDPR is essentially the enactment of government sanctioned proxy protection which may limit if not obviate the need for existing private proxy services, perhaps the privacy/proxy service providers would be willing to transfer their services to fulfill
the role of registrant’s agents or their back office. </div>
</div>
</div>
</blockquote>
<br class="">
</div>
<div class="">If that was true, privacy/proxy service would already be an included service in all major registrars. While it's included in Google Domains and Uniregistry, Google is #10 gTLD registrar at this time... so most registrants still to have to pay for a service
that is much more simpler than the one you suggest. A good number of those registrar-based proxy services simply turn off privacy in response to any kind of dispute or issue instead of relaying notices to registrants. What you have described is more like the
type of proxying provided by law offices, which comes with a price. </div>
<div class=""><br class="">
</div>
<div class="">BTW, since you mentioned trademark registrations in an earlier e-mail, I converted some local fees to local domain multiples so you can get a feeling of how that would impact pricing:</div>
<div class="">- Local PTO cost for requesting a trademark registration: 3.5 domains</div>
<div class="">- How much a lawyer bills for preparing that registration: 42.5 domains</div>
<div class="">- Local PTO cost for issuing a trademark: 7.5 domains</div>
<div class="">- Lawyer costs when the trademark is issued for monitoring and challenging future trademark applicants: 10 domains</div>
<div class=""><br class="">
</div>
<div class="">It's hard to fit any of those into a cost-neutral mechanism. </div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class="">Rubens</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
</div>
<br class="">
<font face="Arial" color="Gray" size="1" class=""><br class="">
This message contains information which may be confidential and legally privileged. Unless you are the addressee, you may not use, copy or disclose to anyone this message or any information contained in the message. If you have received this message in error,
please send me an email and delete this message. Any tax advice provided by VLP is for your use only and cannot be used to avoid tax penalties or for promotional or marketing purposes.<br class="">
</font>
</div>
</div></blockquote></div><br class=""></div></body></html>