<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:"Segoe UI Light";
panose-1:2 11 5 2 4 2 4 2 2 3;}
@font-face
{font-family:"Segoe UI";
panose-1:2 11 5 2 4 2 4 2 2 3;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";
color:black;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";
color:black;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";
color:black;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:"Consolas","serif";
color:black;}
span.EmailStyle21
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.25in 1.0in 1.25in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body bgcolor="white" lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Those exposed 1.2 billion people are the Internet end users whom the ALAC is trying to protect. Who is accountable for this exposure, who is responsible for
the server which is causing the damage?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext"> Gnso-epdp-team [mailto:gnso-epdp-team-bounces@icann.org]
<b>On Behalf Of </b>Volker Greimann<br>
<b>Sent:</b> Tuesday, December 10, 2019 8:00 PM<br>
<b>To:</b> gnso-epdp-team@icann.org<br>
<b>Subject:</b> Re: [Gnso-epdp-team] Data enrichment companies<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p>Still waiting for Facebook to publish a verified whois of their account holders ;-)<o:p></o:p></p>
<p>Best,<o:p></o:p></p>
<p>Volker<o:p></o:p></p>
<div>
<p class="MsoNormal">Am 09.12.2019 um 09:46 schrieb Ayden Férdeline:<o:p></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal">I don't want to disagree with someone from my own stakeholder group, but I don't understand how this is a "quick solution to the SSAD problem"? These services contain names, emails, and LinkedIn URLs - I don't see how these are substitutes
for the data elements in Whois. And how are you even meant to know who to search for in one of these third-party services, absent the name of a registrant? These third-party services that pull in random data sets should be reigned in, not what we recommend
others turn to locate/trace a registrant.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<div>
<div>
<p class="MsoNormal">Ayden Férdeline <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Cambria Math","serif"">‐‐‐‐‐‐‐</span> Original Message
<span style="font-family:"Cambria Math","serif"">‐‐‐‐‐‐‐</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">On Monday, December 9, 2019 3:44 AM, Mueller, Milton L <a href="mailto:milton@gatech.edu">
<milton@gatech.edu></a> wrote:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif"">I am wondering how many of the people involved in EPDP are familiar with data enrichment companies such as People Data Labs.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif"">If you're not you may be amazed at how vast is the number of people encompassed in their records, and how many data points are aggregated in them. As we battle mightily over how much disclosure
of measly Whois records we will allow and under what circumstances, it might be useful to take a look at this article, <a href="https://www.dataviper.io/blog/2019/pdl-data-exposure-billion-people/">https://www.dataviper.io/blog/2019/pdl-data-exposure-billion-people/</a> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif""><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif"">There you will see a storehouse of names, email addresses, phone numbers, social media profile information and physical addresses for 1.2 billion people, all available for subscribers to
this service and - in this bizarre case - all of it exposed to anyone with the right IP address due to a configuration error of an Elasticsearch server. <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif""><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif""> Based on my exposure to these data enrichment services, I think we may have found a quick solution to the SSAD problem. One could conclude that we don't need one at all, because any serious
requestor can get a ton of data about virtually anyone on the internet - automatically, instantly - by using one of these services. <o:p></o:p></span></p>
</div>
<div style="margin-top:12.0pt;margin-bottom:12.0pt;max-width: 800px;min-width: 424px">
<table class="MsoNormalTable" border="1" cellpadding="0" width="100%" style="width:100.0%;border:solid #C8C8C8 1.0pt">
<tbody>
<tr>
<td valign="top" style="border:none;padding:9.0pt 27.0pt 9.0pt 9.0pt">
<div style="margin-right:9.0pt;overflow:hidden">
<p class="MsoNormal"><a href="https://www.dataviper.io/blog/2019/pdl-data-exposure-billion-people/" target="_blank"><span style="text-decoration:none"><img border="0" width="240" height="88" id="_x0000_i1025" src="https://www.dataviper.io/wp-content/uploads/2019/11/data_viper_blog_v3.jpg"></span></a><o:p></o:p></p>
</div>
</td>
<td width="100%" valign="top" style="width:100.0%;border:none;padding:9.0pt 27.0pt 9.0pt 9.0pt">
<div style="margin-right:6.0pt">
<p class="MsoNormal"><span style="font-size:16.0pt;font-family:"Segoe UI Light","sans-serif""><a href="https://www.dataviper.io/blog/2019/pdl-data-exposure-billion-people/" target="_blank"><span style="text-decoration:none">1.2 billion people exposed in data
leak includes personal info, LinkedIN, Facebook</span></a><o:p></o:p></span></p>
</div>
<div style="margin-right:6.0pt;margin-bottom:9.0pt;max-height: 100px;overflow:hidden">
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Segoe UI","sans-serif";color:#666666">On October 16, 2019 Bob Diachenko and Vinny Troia discovered a wide-open Elasticsearch server containing an unprecedented 4 billion user accounts spanning
more than 4 terabytes of data.. A total count of unique people across all data sets reached more than 1.2 billion people, making this one of the largest data leaks from a single source organization in history.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Segoe UI","sans-serif";color:#A6A6A6"><a href="http://www.dataviper.io">www.dataviper.io</a><o:p></o:p></span></p>
</div>
</td>
</tr>
</tbody>
</table>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif"">I'll leave you all with that thought. See you Tuesday.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif""><o:p> </o:p></span></p>
</div>
<div>
<div>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-family:"Calibri","sans-serif"">Dr Milton L Mueller, Professor<o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-family:"Calibri","sans-serif"">School of Public Policy<o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-family:"Calibri","sans-serif"">Georgia Institute of Technology<o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-family:"Calibri","sans-serif""><a href="https://internetgovernance.org">Internet Governance Project</a> <o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-family:"Calibri","sans-serif""><o:p> </o:p></span></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal"><br>
<br>
<o:p></o:p></p>
<pre>_______________________________________________<o:p></o:p></pre>
<pre>Gnso-epdp-team mailing list<o:p></o:p></pre>
<pre><a href="mailto:Gnso-epdp-team@icann.org">Gnso-epdp-team@icann.org</a><o:p></o:p></pre>
<pre><a href="https://mm.icann.org/mailman/listinfo/gnso-epdp-team">https://mm.icann.org/mailman/listinfo/gnso-epdp-team</a><o:p></o:p></pre>
<pre>_______________________________________________<o:p></o:p></pre>
<pre>By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (<a href="https://www.icann.org/privacy/policy">https://www.icann.org/privacy/policy</a>) and the website Terms of Service (<a href="https://www.icann.org/privacy/tos">https://www.icann.org/privacy/tos</a>). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.<o:p></o:p></pre>
</blockquote>
<div>
<p class="MsoNormal">-- <br>
Volker A. Greimann<br>
General Counsel and Policy Manager<br>
<strong>KEY-SYSTEMS GMBH</strong><br>
<br>
T: +49 6894 9396901<br>
M: +49 6894 9396851<br>
F: +49 6894 9396851<br>
W: <a href="http://www.key-systems.net">www.key-systems.net</a><br>
<br>
Key-Systems GmbH is a company registered at the local court of Saarbruecken, Germany with the registration no. HR B 18835<br>
CEO: Alexander Siffrin<br>
<br>
Part of the CentralNic Group PLC (LON: CNIC) a company registered in England and Wales with company number 8576358.<o:p></o:p></p>
</div>
</div>
</body>
</html>