<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:dt="uuid:C2F41010-65B3-11d1-A29F-00AA00C14882" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:2049256089;
mso-list-type:hybrid;
mso-list-template-ids:558375962 67698703 67698713 67698715 67698703 67698713 67698715 67698703 67698713 67698715;}
@list l0:level1
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level2
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level3
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level4
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level5
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level6
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level7
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level8
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level9
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">Hi Caitlin, <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thoughtful suggestions, as promised: <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Preliminary Recommendation #1. Accreditation<o:p></o:p></p>
<p class="MsoNormal"><i>Not as a standalone section, since this appears to be primarily technical/operational as opposed to legal. This may be helpful background for Bird & Bird in reviewing Recommendation #16.</i><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Preliminary Recommendation #3. Criteria and Content of Requests<o:p></o:p></p>
<p class="MsoNormal"><i>Not as a primary focus, but would not oppose this being a bottom-tier question if we have funding.
</i><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Preliminary Recommendation #6. Contracted Party Authorization<o:p></o:p></p>
<p class="MsoNormal"><i>Yes, propose to ask Bird & Bird to confirm whether a Contracted Party likely carries more liability in this scenario vs. in Recommendation #7.</i><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Preliminary Recommendation #7. Authorization for automated disclosure requests<o:p></o:p></p>
<p class="MsoNormal"><i>Yes, propose to ask Bird & Bird to confirm whether a Contracted Party likely carries more liability in this scenario vs. in Recommendation #6, and also whether a Contracted Party carries more liability if it has outsourced its decision
making to the Central Gateway vs. voluntarily taken on decision making itself. Bird & Bird should explore whether its previous controllership and liability guidance is changed in a scenario where the Contracted Party has no visibility into who the requestor
is or why the data is being requested, and is merely required to provide the data upon instruction by ICANN as controller.
</i><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Preliminary Recommendation #10. Acceptable Use Policy<o:p></o:p></p>
<p class="MsoNormal"><i>Not as a standalone section. This may be helpful background for Bird & Bird in reviewing Recommendation #16.</i><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Preliminary Recommendation #11. Disclosure Requirement<o:p></o:p></p>
<p class="MsoNormal"><i>Not as a primary focus, but would not oppose this being a third-tier priority question if we have funding.
</i><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Preliminary Recommendation #14. Retention and Destruction of Data<o:p></o:p></p>
<p class="MsoNormal"><i>Not as a standalone section. This may be helpful background for Bird & Bird in reviewing Recommendation #16.</i><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Preliminary Recommendation #16. Automation<o:p></o:p></p>
<p class="MsoNormal"><i>Yes, propose to ask Bird & Bird to help us list the types of requests for which disclosure can be automated. We should also ask for a list of additional types of requests that can be automated if we add or improve safeguards and limitations,
and/or if we enable and require the requestor to make an affirmation or allegation. Bird & Bird should be specific and constructive.
</i><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Preliminary Recommendation #17. Logging<o:p></o:p></p>
<p class="MsoNormal"><i>Only consider this section if analyzing logging is helpful to their analysis on automation.
<o:p></o:p></i></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Preliminary Recommendation #18. Audits<o:p></o:p></p>
<p class="MsoNormal"><i>Only consider this section if analyzing audits is helpful to their analysis on automation.
<o:p></o:p></i></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Preliminary Recommendation #19. Mechanism for the evolution of SSAD<o:p></o:p></p>
<p class="MsoNormal"><i>Yes, propose to ask Bird & Bird to confirm whether a Contracted Party likely carries more liability in this scenario if ICANN as controller may unilaterally evolve the SSAD to automate and take on decision making for different request
types. Do Contracted Parties remain controllers in this scenario? How does their liability change (if at all)?
</i><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><b><span lang="EN-GB" style="font-size:10.0pt;color:black">Brian J. King
</span></b><span lang="EN-GB" style="font-size:10.0pt;color:black"> <br>
Director of Internet Policy and Industry Affairs<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-size:10.0pt;color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-size:10.0pt;color:black">T +1 443 761 3726</span><u><span style="font-size:10.0pt;color:#0563C1"><a href="http://www.markmonitor.com"><span lang="EN-GB" style="color:#0563C1"><br>
</span><span style="color:#0563C1">markmonitor.com</span></a></span></u><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><b><span lang="EN-GB" style="font-size:10.0pt;color:black">MarkMonitor<br>
</span></b><span lang="EN-GB" style="font-size:10.0pt;color:black">Protecting companies and consumers in a digital world<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>