<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hi all. Thanks for this and a quick question on the questions. Does ICANN *have to* establish a replica database in this scenario? Can't the information just more or less pass through ICANN? That would mean less data being transferred and could also presumably
less data stored/retained. Right? Just thinking out loud in an effort to identify other options so we don't unintentionally box ourselves in. </div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thanks!</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Ashley (GAC)</div>
<div>
<div id="appendonsend"></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> Gnso-epdp-team <gnso-epdp-team-bounces@icann.org> on behalf of James M. Bladel <jbladel@godaddy.com><br>
<b>Sent:</b> Friday, September 20, 2019 11:35 AM<br>
<b>To:</b> Greg Aaron <greg@illumintel.com>; 'Sarah Wyld' <swyld@tucows.com>; gnso-epdp-team@icann.org <gnso-epdp-team@icann.org><br>
<b>Subject:</b> Re: [Gnso-epdp-team] Questions regarding disclosure risks</font>
<div> </div>
</div>
<div style="">
<div style="direction:ltr">
<div>
<div></div>
</div>
<div>Greg et al -</div>
<div><br>
</div>
<div style="direction:ltr">Sarahs’ Alt super powers expired at midnight yesterday and her laptop has now turned back in to a pumpkin. So I’ll respond to Greg and pose a few questions to ICANN Staff.</div>
<div><br>
</div>
<div style="direction:ltr">Greg - In this case, Yes. “Addressed” = making the disclosure decision, and (if affirmative) providing the Requestor with the requested non-public data. For clarity, “provided” can mean that ICANN sends the data directly to the Requestor,
or somehow <b>causes</b> another (contracted) party to transmit the data to the Requestor.</div>
<div><br>
</div>
<div style="direction:ltr">Many EPDP members have expressed a desire to work with ICANN directly, rather than route requests to individual Contracted Parties. They would also prefer to have ICANN make the disclosure determination, as opposed to leaving this
to the affected Contracted Party (please jump in if I’m misunderstanding/mischaracterizing this point).</div>
<div><br>
</div>
<div style="direction:ltr">Therefore, the questions we (me, Sarah, Registrars, ePDP) would like to refer to our Staff Liaisons are:</div>
<div><br>
</div>
<div style="direction:ltr">Does ICANN have a clear preference on whether or not it will:</div>
<div style="direction:ltr">1. Field these requests for non-public data</div>
<div style="direction:ltr">2. Maintain its own RDS replica database</div>
<div style="direction:ltr">3. Make a/the determination of the validity of the request</div>
<div style="direction:ltr">4. Assume responsibility for this decision, in any scenario where ICANN doesn’t hold the data directly and must require a Contracted Party to respond to the Requestor (even if the Contracted Party disputes ICANN’s determination).</div>
<div><br>
</div>
<div style="direction:ltr">We have been dancing around these questions for a quite a while, and I now believe the answers stand between us and progress on our work. Either ICANN agrees to assume some/all of the role of decision-maker (and accept responsibility
for making this decision), or we abandon the “centralized” version of SSAD and instead focus our efforts on developing a distributed model (which is expressly opposed by some “requestor” stakeholders). </div>
<div><br>
</div>
<div style="direction:ltr">Either way, the is the fork in the road, and we need a clear path forward. If there are no further questions or objections, I recommend that Marika/Staff refer this to our liaisons. </div>
<div><br>
</div>
<div style="direction:ltr">Thanks—</div>
<div><br>
</div>
<div style="direction:ltr">J.</div>
<div style="direction:ltr">_______________</div>
<div class="x_ms-outlook-ios-signature">
<div style="direction:ltr">James Bladel</div>
<div style="direction:ltr">GoDaddy</div>
</div>
</div>
<div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_divRplyFwdMsg" dir="dir="ltr""><font face="Calibri, sans-serif" style="font-size:11pt"><b>From:</b> Gnso-epdp-team <gnso-epdp-team-bounces@icann.org> on behalf of Greg Aaron <greg@illumintel.com><br>
<b>Sent:</b> Thursday, September 19, 2019 14:25<br>
<b>To:</b> 'Sarah Wyld'; gnso-epdp-team@icann.org<br>
<b>Subject:</b> Re: [Gnso-epdp-team] Questions regarding disclosure risks
<div> </div>
</font></div>
<meta content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<div style="background-color:#ebebeb; padding-left:.5cm; border-left-width:5px; border-left-style:solid; border-left-color:#A6A6A6">
<span style="font-size:9pt; line-height:22pt; font-family:Tahoma,Verdana,Segoe,sans-serif; color:grey">Notice:</span><span style="font-size:9pt; line-height:22pt; font-family:Tahoma,Verdana,Segoe,sans-serif; color:grey">This email is from an external sender.
</span></div>
<p> </p>
<div>
<div class="x_WordSection1">
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 102);">
<span style="color:windowtext">When you say “addressed” what do you mean -- that ICANN decides whether the data should be disclosed in response to a query?</span></p>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 102);">
<span style="color:windowtext"> </span></p>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 102);">
<span style="color:windowtext"> </span></p>
<div>
<div style="border:none; border-top:solid #E1E1E1 1.0pt; padding:3.0pt 0in 0in 0in">
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 102);">
<b><span style="color:windowtext">From:</span></b><span style="color:windowtext"> Sarah Wyld <swyld@tucows.com><br>
<b>Sent:</b> Thursday, September 19, 2019 11:16 AM<br>
<b>To:</b> Greg Aaron <greg@illumintel.com>; gnso-epdp-team@icann.org<br>
<b>Subject:</b> Re: [Gnso-epdp-team] Questions regarding disclosure risks</span></p>
</div>
</div>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 102);">
</p>
<p><span style="font-size:10.0pt; font-family:"Verdana",sans-serif">Hi Greg,<br>
<br>
"Responding party" here would mean that requests are received and addressed by ICANN Org. This email focused specifically on questions raised by ICANN Org working in this capacity, I'm interested to see what other scenarios you could expect to occur here.</span></p>
<p><span style="font-size:10.0pt; font-family:"Verdana",sans-serif">Thanks.</span></p>
<pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: "Courier New"; color: rgb(0, 0, 102);">-- </pre>
<pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: "Courier New"; color: rgb(0, 0, 102);">Sarah Wyld</pre>
<pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: "Courier New"; color: rgb(0, 0, 102);">Domains Product Team</pre>
<pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: "Courier New"; color: rgb(0, 0, 102);">Tucows</pre>
<pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: "Courier New"; color: rgb(0, 0, 102);">+1.416 535 0123 Ext. 1392</pre>
<pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: "Courier New"; color: rgb(0, 0, 102);"> </pre>
<pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: "Courier New"; color: rgb(0, 0, 102);"> </pre>
<div>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 102);">
On 9/19/2019 10:12 AM, Greg Aaron wrote:</p>
</div>
<blockquote style="margin-top:5.0pt; margin-bottom:5.0pt">
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 102);">
<span style="color:windowtext">Sarah, what do you mean by “responding party”? For example so your scenarios assume that ICANN is acting in a specific legal capacity?</span></p>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 102);">
<span style="color:windowtext"> </span></p>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 102);">
<span style="color:windowtext">I ask because depending on what you mean, there may be other scenarios.</span></p>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 102);">
<span style="color:windowtext"> </span></p>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 102);">
<span style="color:windowtext">All best,</span></p>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 102);">
<span style="color:windowtext">--Greg</span></p>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 102);">
<span style="color:windowtext"> </span></p>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 102);">
<span style="color:windowtext"> </span></p>
<div>
<div style="border:none; border-top:solid #E1E1E1 1.0pt; padding:3.0pt 0in 0in 0in">
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 102);">
<b><span style="color:windowtext">From:</span></b><span style="color:windowtext"> Gnso-epdp-team</span><a href="mailto:gnso-epdp-team-bounces@icann.org"><gnso-epdp-team-bounces@icann.org></a><span style="color:windowtext"><b>On Behalf Of
</b>Sarah Wyld<br>
<b>Sent:</b> Wednesday, September 18, 2019 3:18 PM<br>
<b>To:</b> </span><a href="mailto:gnso-epdp-team@icann.org">gnso-epdp-team@icann.org</a><span style="color:windowtext"><br>
<b>Subject:</b> [Gnso-epdp-team] Questions regarding disclosure risks</span></p>
</div>
</div>
<p class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 102);">
</p>
<p>Hello all,</p>
<p>During the recent EPDP face-to-face meetings in Los Angeles, several members of the working group expressed a desire to position ICANN as the responding party to requests for disclosure of non-public registration data.<br>
<br>
In order to fulfill this request, one of two things must be true. Either:</p>
<ol start="1" type="1" style="margin-bottom: 0in;">
<li class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 102);">
ICANN Org maintains a current (<24 hours) copy of the entire RDS database; or</li><li class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 102);">
ICANN has some mechanism (contract clause) to compel the Contracted Party to disclose the data to ICANN or the requestor</li></ol>
<p>These potential scenarios raise the following questions:</p>
<ol start="1" type="1" style="margin-bottom: 0in;">
<li class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 102);">
In the first scenario, does ICANN accept the legal risks and operational costs of maintaining its own replica of all RDS data for gTLDs? If not, how would those risks and costs be addressed?</li><li class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 102);">
In the second scenario, will ICANN “relay” disclosed data between the requestor and the Registry/Registrar?</li><li class="x_MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 102);">
What should be done in situations where ICANN instructs the Registry/Registrar to disclose data (either to ICANN or the requestor), but the contracted party has determined that the request is not legitimate and refuses? Is this matter referred to ICANN compliance?
</li></ol>
<p style="margin-bottom:12.0pt"><br>
Thank you, <br>
<br>
</p>
<pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: "Courier New"; color: rgb(0, 0, 102);">-- </pre>
<pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: "Courier New"; color: rgb(0, 0, 102);">Sarah Wyld</pre>
<pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: "Courier New"; color: rgb(0, 0, 102);">Domains Product Team</pre>
<pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: "Courier New"; color: rgb(0, 0, 102);">Tucows</pre>
<pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: "Courier New"; color: rgb(0, 0, 102);">+1.416 535 0123 Ext. 1392</pre>
<pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: "Courier New"; color: rgb(0, 0, 102);"> </pre>
<pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: "Courier New"; color: rgb(0, 0, 102);"> </pre>
</blockquote>
</div>
</div>
</div>
</div>
</div>
</body>
</html>