<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;}
p.p1, li.p1, div.p1
{mso-style-name:p1;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.s1
{mso-style-name:s1;}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
span.s2
{mso-style-name:s2;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt">Dear All,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">As per the action items, please find attached the proposed Purpose O - R</span><span style="font-size:11.0pt;color:black">esearch<b>
</b>and publish</span><span style="font-size:11.0pt;color:black"> reports on threats to the operational stability, reliability, security, global interoperability, resilience, and openness of the DNS, as circulated to the mailing list by Benedict on 15 November
(see <a href="https://mm.icann.org/pipermail/gnso-epdp-team/2018-November/000897.html">
https://mm.icann.org/pipermail/gnso-epdp-team/2018-November/000897.html</a>). <o:p>
</o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Note that in relation to registration data used by ICANN departments, ICANN Org also responded to a number of questions from the EPDP Team (see below).
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">In order to facilitate Thursday’s discussion on this topic, please share any clarifying questions and/or comments you may have in advance of the meeting.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Best regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Caitlin, Berry and Marika<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Responses from ICANN Org to EPDP Team Question re. use of registration data by other ICANN Departments (see
<a href="https://community.icann.org/x/ahppBQ">https://community.icann.org/x/ahppBQ</a>):
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="p1" style="mso-margin-top-alt:7.5pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;margin-bottom:.0001pt">
<span class="s1"><span style="color:black">2.</span></span><span class="apple-converted-space"><span style="color:black"> </span></span><em><span style="font-family:"Calibri",sans-serif;color:black">Apart from ICANN Org Compliance, do any other ICANN departments
require access to registration data and, as such, might require a specific purpose? If so, please describe in detail sufficient to provide a legal basis for such data processing.</span></em><span style="color:black"><o:p></o:p></span></p>
<p class="p1" style="mso-margin-top-alt:7.5pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;margin-bottom:.0001pt;caret-color: rgb(23, 43, 77);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="color:black">This question seems to be asking about any use by ICANN Org of registration data that is now masked pursuant to the Temporary Specification. One example of an ICANN Org activity that previously used WHOIS data elements that may now
be redacted pursuant to the Temporary Specification is the WHOIS Accuracy Reporting System, which is currently under review as discussed with the EPDP Team on 26 September 2018. If additional information is needed it would be helpful if the EPDP Team could
please clarify if the question is for information related to such past uses of now-masked registration data, or to any current ICANN Org (apart from Contractual Compliance) uses of non-public data, or to any future uses of non-public registration data that
may be needed in order to implement GNSO-recommended policies.<o:p></o:p></span></p>
<p class="p1" style="mso-margin-top-alt:7.5pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;margin-bottom:.0001pt;caret-color: rgb(23, 43, 77);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="color:black">Also, in discussions that the EPDP Team has had regarding purposes, ICANN Office of the CTO (OCTO) has been mentioned. To inform the EPDP Team’s continued discussion on this topic, ICANN Org would like to clarify that ICANN OCTO does
not require personal data in domain name registration data for its work. For example, OCTO’s Domain Abuse Activity Reporting (DAAR) project <<a href="https://www.icann.org/octo-ssr/daar"><span class="s2"><span style="color:black;text-decoration:none">https://www.icann.org/octo-ssr/daar</span></span></a>>
uses only the registrar and nameserver information.<o:p></o:p></span></p>
<p style="mso-margin-top-alt:7.5pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;margin-bottom:.0001pt;caret-color: rgb(23, 43, 77);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<em><span style="font-family:"Calibri",sans-serif;color:black">3. Further input is requested to explore how WHOIS was used before the Temp Spec was adopted, in OCTO's activities. The original Org response does not address that issue. For example, did OCTO
use WHOIS in its law enforcement training and outreach activities, or engagement with the cybersecurity community, or to facilitate or respond to large scale botnet attacks, such as Conficker or Avalanche? Individual members may follow up with the CTO for
follow up questions, if available at ICANN63.</span></em><span style="color:black"><o:p></o:p></span></p>
<p style="mso-margin-top-alt:7.5pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;margin-bottom:.0001pt;caret-color: rgb(23, 43, 77);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="color:black">Regarding the EPDP Team’s follow-up question on how OCTO used WHOIS data for training and outreach activities, prior to the effective date of the Temporary Specification, use of WhOIS data to identify the registrant and the technical
data related to a domain name was part of the training materials. The training showed how one could use WHOIS data to attempt to contact a registrant or the hosting provider in cases of compromised machines, etc. Since the Temporary Specification became effective,
the training no longer shows one how to use public WHOIS data to contact a registrant, instead as part of the training, a brief overview of where the policy discussions are and how people can get involved in the discussion is provided.<o:p></o:p></span></p>
<p style="mso-margin-top-alt:7.5pt;margin-right:0in;margin-bottom:0in;margin-left:.5in;margin-bottom:.0001pt;caret-color: rgb(23, 43, 77);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="color:black">The EPDP Team’s follow-up question also asks how OCTO used WHOIS data for engagement with cybersecurity community, or to facilitate or respond to large scale botnet attacks, such as Conficker or Avalanche. Conficker, Andromeda and
other large-scale actions are typically managed by the Law Enforcement agencies, not OCTO. OCTO’s role in those activities does not involve the use of personal data in WHOIS. Those Law Enforcement agencies would be better placed to discuss their operational
procedures and the effect of the Temporary Specification on their operations.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><i><span style="font-size:10.0pt;color:black">Marika Konings</span></i></b><span style="font-size:10.0pt;color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><i><span style="font-size:10.0pt;color:black">Vice President, Policy Development Support – GNSO, Internet Corporation for Assigned Names and Numbers (ICANN) </span></i><span style="font-size:10.0pt;color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><i><span style="font-size:10.0pt;color:black">Email: <a href="mailto:marika.konings@icann.org"><span style="color:#0563C1">marika.konings@icann.org</span></a> </span></i><span style="font-size:10.0pt;color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><i><span style="font-size:10.0pt;color:black"> </span></i><span style="font-size:10.0pt;color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><i><span style="font-size:10.0pt;color:black">Follow the GNSO via Twitter @ICANN_GNSO</span></i><span style="font-size:10.0pt;color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><i><span style="font-size:10.0pt;color:black">Find out more about the GNSO by taking our <a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__learn.icann.org_courses_gnso&d=DwMGaQ&c=FmY1u3PJp6wrcrwll3mSVzgfkbPSS6sJms7xcl4I5cM&r=7_PQAir-9nJQ2uB2cWiTDDDo5Hfy5HL9rSTe65iXLVM&m=5DXgId95wrCsHi--pxTiJD7bMB9r-T5ytCn7od3CF2Q&s=Cg5uQf0yAfw-qlFZ0WNBfsLmmtBNUiH0SuI6Vg-gXBQ&e="><span style="color:#0563C1">interactive
courses</span></a> and visiting the <a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__gnso.icann.org_sites_gnso.icann.org_files_gnso_presentations_policy-2Defforts.htm-23newcomers&d=DwMGaQ&c=FmY1u3PJp6wrcrwll3mSVzgfkbPSS6sJms7xcl4I5cM&r=7_PQAir-9nJQ2uB2cWiTDDDo5Hfy5HL9rSTe65iXLVM&m=5DXgId95wrCsHi--pxTiJD7bMB9r-T5ytCn7od3CF2Q&s=tT-E2RoAucUb3pfL9zmlbRdq1sytaEf765KOEkBVCjk&e="><span style="color:#0563C1">GNSO
Newcomer pages</span></a>. </span></i><span style="font-size:10.0pt;color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>