<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML xmlns="http://www.w3.org/TR/REC-html40" xmlns:v =
"urn:schemas-microsoft-com:vml" xmlns:o =
"urn:schemas-microsoft-com:office:office" xmlns:w =
"urn:schemas-microsoft-com:office:word" xmlns:st1 =
"urn:schemas-microsoft-com:office:smarttags"><HEAD><TITLE>Fast Flux Report - questions</TITLE>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<META content="MSHTML 6.00.2900.3132" name=GENERATOR><!--[if !mso]>
<STYLE>v\:* {
BEHAVIOR: url(#default#VML)
}
o\:* {
BEHAVIOR: url(#default#VML)
}
w\:* {
BEHAVIOR: url(#default#VML)
}
.shape {
BEHAVIOR: url(#default#VML)
}
</STYLE>
<![endif]--><o:SmartTagType name="City"
namespaceuri="urn:schemas-microsoft-com:office:smarttags"></o:SmartTagType><o:SmartTagType
name="place"
namespaceuri="urn:schemas-microsoft-com:office:smarttags"></o:SmartTagType><!--[if !mso]>
<STYLE>st1\:* {
BEHAVIOR: url(#default#ieooui)
}
</STYLE>
<![endif]-->
<STYLE>@font-face {
font-family: Tahoma;
}
@page Section1 {size: 8.5in 11.0in; margin: 1.0in 1.25in 1.0in 1.25in; }
P.MsoNormal {
FONT-SIZE: 12pt; MARGIN: 0in 0in 0pt; FONT-FAMILY: "Times New Roman"
}
LI.MsoNormal {
FONT-SIZE: 12pt; MARGIN: 0in 0in 0pt; FONT-FAMILY: "Times New Roman"
}
DIV.MsoNormal {
FONT-SIZE: 12pt; MARGIN: 0in 0in 0pt; FONT-FAMILY: "Times New Roman"
}
A:link {
COLOR: blue; TEXT-DECORATION: underline
}
SPAN.MsoHyperlink {
COLOR: blue; TEXT-DECORATION: underline
}
A:visited {
COLOR: purple; TEXT-DECORATION: underline
}
SPAN.MsoHyperlinkFollowed {
COLOR: purple; TEXT-DECORATION: underline
}
P {
FONT-SIZE: 12pt; MARGIN-LEFT: 0in; MARGIN-RIGHT: 0in; FONT-FAMILY: "Times New Roman"; mso-margin-top-alt: auto; mso-margin-bottom-alt: auto
}
SPAN.EmailStyle18 {
COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal-reply
}
DIV.Section1 {
page: Section1
}
</STYLE>
</HEAD>
<BODY lang=EN-US vLink=purple link=blue>
<DIV dir=ltr align=left><SPAN class=085155715-21042008><FONT face=Arial
color=#0000ff size=2>Liz,</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=085155715-21042008><FONT face=Arial
color=#0000ff size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=085155715-21042008><FONT face=Arial
color=#0000ff size=2>Many thanks for the speedy response. I have
some additional follow up questions, which I've inserted in my original message
below.</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=085155715-21042008><FONT face=Arial
color=#0000ff size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=085155715-21042008><FONT face=Arial
color=#0000ff size=2>Kristina </FONT></SPAN></DIV><BR>
<BLOCKQUOTE dir=ltr style="MARGIN-RIGHT: 0px">
<DIV class=OutlookMessageHeader lang=en-us dir=ltr align=left>
<HR tabIndex=-1>
<FONT face=Tahoma size=2><B>From:</B> Liz Gasster
[mailto:liz.gasster@icann.org] <BR><B>Sent:</B> Friday, April 18, 2008 3:19
PM<BR><B>To:</B> Rosette, Kristina; council@gnso.icann.org<BR><B>Subject:</B>
RE: Fast Flux Report - questions<BR></FONT><BR></DIV>
<DIV></DIV>
<DIV class=Section1>
<P class=MsoNormal><FONT face=Arial color=navy size=2><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial">Kristina and
all,<o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial color=navy size=2><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial"><o:p> </o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial color=navy size=2><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial">Following are
responses below from staff where we can. I believe some of your
questions highlight the need for further study (possibly in more areas than
we’ve identified in the report, as some of your questions suggest).
<o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial color=navy size=2><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial"><o:p> </o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial color=navy size=2><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial">Happy to try to
answer further where we can, if you have more questions. I just want to
note again too that given the short time frame to prepare the report, the
breadth of sources we were able to draw upon were necessarily limited. I
really like your idea about noting sources and including a bibliography when
we prepare issues reports in the future, and I’m going to add this as a
suggestion in our GNSO improvements process so that we capture this idea to
consider in the development of a new policy development process.
<o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial color=navy size=2><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial"><o:p> </o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial color=navy size=2><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial">Liz<o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial color=navy size=2><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial"><o:p> </o:p></SPAN></FONT></P>
<DIV>
<DIV class=MsoNormal style="TEXT-ALIGN: center" align=center><FONT
face="Times New Roman" size=3><SPAN style="FONT-SIZE: 12pt">
<HR tabIndex=-1 align=center width="100%" SIZE=2>
</SPAN></FONT></DIV>
<P class=MsoNormal><B><FONT face=Tahoma size=2><SPAN
style="FONT-WEIGHT: bold; FONT-SIZE: 10pt; FONT-FAMILY: Tahoma">From:</SPAN></FONT></B><FONT
face=Tahoma size=2><SPAN style="FONT-SIZE: 10pt; FONT-FAMILY: Tahoma">
owner-council@gnso.icann.org [mailto:owner-council@gnso.icann.org] <B><SPAN
style="FONT-WEIGHT: bold">On Behalf Of </SPAN></B>Rosette,
Kristina<BR><B><SPAN style="FONT-WEIGHT: bold">Sent:</SPAN></B> Thursday,
April 17, 2008 7:00 AM<BR><B><SPAN style="FONT-WEIGHT: bold">To:</SPAN></B>
council@gnso.icann.org<BR><B><SPAN
style="FONT-WEIGHT: bold">Subject:</SPAN></B> [council] Fast Flux Report -
questions </SPAN></FONT><o:p></o:p></P></DIV>
<P class=MsoNormal><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt"><o:p> </o:p></SPAN></FONT></P>
<P><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">All,</SPAN></FONT> <o:p></o:p></P>
<P><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">Here are some initial
questions/requests about the report. I will forward additional questions
soon.</SPAN></FONT> <o:p></o:p></P>
<P><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">Page 1: The report states
that staff "consulted other appropriate and relevant sources of
information". In the interest of transparency, I would appreciate having
those sources be identified. As a general note, it may be helpful
to all readers of the report if the issues reports included a bibliography or
sources consulted section.<o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial color=navy size=2><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial">LG -- staff
considered the SAC Advisory (SAC 025) and I also consulted extensively with
Lyman Chapin. We referred to the email exchanges on the SSAC list during
the period of time in which the SSAC folks were discussing fast flux and
preparing SAC 025, the presentations and transcripts from the SSAC workshops
in <st1:City w:st="on"><st1:place w:st="on">Los Angeles</st1:place></st1:City>
(<U><A href="http://losangeles2007.icann.org/node/78"><FONT color=navy><SPAN
style="COLOR: navy">http://losangeles2007.icann.org/node/78</SPAN></FONT></A></U>)<o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial color=navy size=2><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial">and <st1:City
w:st="on"><st1:place w:st="on">Delhi</st1:place></st1:City> (<A
href="http://delhi.icann.org/node/97"><FONT color=navy><SPAN
style="COLOR: navy">http://delhi.icann.org/node/97</SPAN></FONT></A>), and
informally with a few other sources.</SPAN></FONT><FONT face=Arial color=navy
size=2><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial"><o:p></o:p></SPAN></FONT></P>
<P><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">Pages 6, 14: One
interpretation of the reference to "domains in ccTLDs are targeted as well" is
that there is no "lasting value" to developing gTLD policy regarding any issue
that occurs in both gTLDs and ccTLDs. Is this interpretation
intended?<o:p></o:p></SPAN></FONT></P>
<P><FONT color=navy><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial">LG -- Chuck’s
comment was right. There could be a benefit to coordinating with the
ccNSO. Not making a judgment on “no lasting value”.<FONT
color=#0000ff><SPAN
class=085155715-21042008> </SPAN></FONT></SPAN></FONT></P>
<P><FONT color=navy><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial"><FONT
color=#0000ff><SPAN class=085155715-21042008>KR - The referenced statement
appears in a paragraph that begins with reference to the General
Counsel's opinion<FONT color=#000000>. I will direct my question to that
office. </FONT></SPAN></FONT></SPAN></FONT></P>
<P><FONT color=navy><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial"><FONT
color=#0000ff><SPAN class=085155715-21042008></SPAN></FONT></SPAN></FONT><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial"><SPAN
class=085155715-21042008> </SPAN>Pages 6, 14: Similarly, one
interpretation of the reference to "static rules through a policy development
process might be quickly undermined by intrepid cybercriminals" is that there
can be "no lasting value" to developing gTLD policy regarding any issue that
results from or is associated with cybercriminals because they move more
quickly than the PDP and, as interpreted by one IPC member, "are smarter than
we are". Is this interpretation intended?<o:p></o:p></SPAN></P>
<P><FONT color=navy><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial">LG – That is why we
mention the importance of developing best practices, which then can be
enhanced and upgraded over time to keep up better with new techniques
developed to undermine existing deterrent techniques. Perhaps a policy
outcome might point to the need to adopt rigorous best practices and refresh
on an ongoing basis. But my understanding on fast flux is that these
best practices do not necessarily exist today, so the question might be how to
encourage their development in a structured and focused way, as a necessary
precursor to deciding how to encourage or require their widespread
adoption. Might the GNSO Council take on a convening role here? Or
encourage or direct in some other way? In this context, the inference of
concern about “lasting value” of imposing a specific practice is
intended. <FONT color=#0000ff><SPAN
class=085155715-21042008> </SPAN></FONT></SPAN></FONT></P>
<P><FONT color=navy><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial"><FONT
color=#0000ff><SPAN class=085155715-21042008>KR - same comment as above.
</SPAN><o:p></o:p></FONT></SPAN></FONT></P>
<P><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">Page 8: For how long and on
what scale has proxy redirection been used to maintain high availability and
spread the network load?<o:p></o:p></SPAN></FONT></P>
<P><FONT color=navy><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial">LG – We need to study
this more. The key question I was raising is, “are there valid uses that
need to be considered, that could be undermined if certain deterrent steps
were imposed?” It is not clear from our cursory view how broadly this is
used – seems also unlikely that there would be need for such constant and
frequent fluxing in this context, but we couldn’t determine for sure either
way. <FONT color=#0000ff><SPAN
class=085155715-21042008> </SPAN></FONT></SPAN></FONT></P>
<P><FONT color=navy><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial"><FONT
color=#0000ff><SPAN class=085155715-21042008>KR - I am confused. Are you
saying that it couldn't be determined for sure (a) how widely proxy
redirection has been used in this way; and (b) whether there is a need for
fast flux in the context of proxy
redirection? </SPAN></FONT></SPAN></FONT><FONT color=navy><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial"><FONT
color=#0000ff><SPAN
class=085155715-21042008> </SPAN><o:p></o:p></FONT></SPAN></FONT></P>
<P><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">Page 9: Did more than one
person describe evasion of "black holing" "anecdotally as a possible
'legitimate use'" of fast flux? Any evidence or research to suggest that
it actually happens? <o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT color=navy size=3><SPAN
style="FONT-SIZE: 12pt; COLOR: navy; FONT-FAMILY: Arial">LG
</SPAN></FONT><FONT color=navy><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial">-- This is anecdotal
and may only be one entity, another potential subject of further study.<SPAN
class=085155715-21042008><FONT
color=#0000ff> </FONT></SPAN></SPAN></FONT></P>
<P class=MsoNormal><FONT color=navy><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial"><SPAN
class=085155715-21042008></SPAN></SPAN></FONT> </P>
<P class=MsoNormal><FONT color=navy><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial"><SPAN
class=085155715-21042008><FONT color=#0000ff>KR - I understand your
answers to be "No, only one person described evasion of black
holing anecdotally as a possible legitimate use of fast flux. No,
there is no evidence or research to suggest that it actually happens."
Is my understanding incorrect?</FONT></SPAN></SPAN></FONT></P>
<P><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">Page 10: How likely is that
fast flux hosting "could be significantly curtailed by changes in the way in
which DNS registries and registrars currently
operate"?<o:p></o:p></SPAN></FONT></P>
<P><FONT face=Arial color=navy size=2><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial">LG – Would need to
study further.<o:p></o:p></SPAN></FONT></P>
<P><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">Page 11: Is it technically
possible now for registries and registrars to act in two ways set forth in
report? Practically possible? If so, do they? If not, have
reasons for not doing so been provided and, if so, what are
they?<o:p></o:p></SPAN></FONT></P>
<P><FONT color=navy><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial">LG – Would need to
study further.<FONT color=#0000ff><SPAN
class=085155715-21042008> </SPAN></FONT></SPAN></FONT></P>
<P><FONT color=navy><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial"><FONT
color=#0000ff><SPAN class=085155715-21042008>KR - I am confused. If the
answers to these questions require further study, what is the factual basis
for the statement in the report that " Registries and registrars can curb the
practice in two ways . . .. "?<BR></SPAN></FONT></SPAN></FONT></P>
<P><FONT color=navy><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial"><FONT
color=#0000ff><SPAN
class=085155715-21042008> </SPAN><o:p></o:p></FONT></SPAN></FONT></P>
<P><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">(I have not included a scope
clarification question because I understand that it has already bee
posed.)</SPAN></FONT> <o:p></o:p></P>
<P><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">Many thanks.</SPAN></FONT>
<o:p></o:p></P>
<P><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">Kristina
</SPAN></FONT><o:p></o:p></P>
<P class=MsoNormal><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt"><o:p> </o:p></SPAN></FONT></P></DIV></BLOCKQUOTE></BODY></HTML>