<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Helvetica;
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Thanks for the quick response Neil.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Chuck<o:p></o:p></span></p>
<p class="MsoNormal"><a name="_MailEndCompose"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></a></p>
<span style="mso-bookmark:_MailEndCompose"></span>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Neil Schwartzman [mailto:neil@cauce.org]
<br>
<b>Sent:</b> Thursday, June 08, 2017 11:45 AM<br>
<b>To:</b> Gomes, Chuck <cgomes@verisign.com><br>
<b>Cc:</b> ICANN RDS <gnso-rds-pdp-wg@icann.org><br>
<b>Subject:</b> [EXTERNAL] Re: [gnso-rds-pdp-wg] Who is in charge? (was Re: Why the thin data is necessary)]<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Helvetica",sans-serif">On Jun 8, 2017, at 4:52 PM, Gomes, Chuck <<a href="mailto:cgomes@verisign.com">cgomes@verisign.com</a>> wrote:<br>
<br>
Neil,<br>
<br>
Have you read the Expert Working Group (EWG) Report? If not, it is prerequisite reading for this WG because the ICANN Board tasked us as a WG with using it as a starting point for our work. It can be found here: <a href="https://www.icann.org/en/system/files/files/final-report-06jun14-en.pdf">https://www.icann.org/en/system/files/files/final-report-06jun14-en.pdf</a> .<br>
<br>
I encourage you to note the composition of the EWG that is described starting on page 164. In my opinion the group consisted of some extremely qualified people with lots of different areas of expertise. That said, you may still think they were naïve in recommending
a gated access solution, but you should at least be aware that they put an incredible amount of time and effort into their work and their final report provides essential information for our WG to consider.<br>
<br>
Our WG does not have to accept the EWG recommendations but we certainly need to seriously evaluate them and have sound reasons for rejecting them.<br>
<o:p></o:p></span></p>
</blockquote>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Hi Chuck,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal">I had indeed, both in the draft and published form, years ago. I disagreed then, I disagree now. I voiced my disagreement individually to a EWG member, and helped draft community input and response that stated those disagreements.<br>
<br>
ironically … (from pp 166):<br>
<br>
For more information and the biographies of EWG members, please see this announcement.<br>
<a href="https://www.icann.org/news/announcement-2013-02-14-enhttps:/www.icann.org/news/announcement-2013-02-14-en">https://www.icann.org/news/announcement-2013-02-14-enhttps:/www.icann.org/news/announcement-2013-02-14-en</a><br>
<br>
<img border="0" width="978" height="538" style="width:10.1916in;height:5.6083in" id="FE483E94-C1C1-4EDA-A47D-116D7D4EF0B3" src="cid:image001.png@01D2E04C.C5F093A0"><br>
<br>
<br>
<o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal"><br>
Chuck<br>
<br>
From: <a href="mailto:gnso-rds-pdp-wg-bounces@icann.org">gnso-rds-pdp-wg-bounces@icann.org</a> [<a href="mailto:gnso-rds-pdp-wg-bounces@icann.org">mailto:gnso-rds-pdp-wg-bounces@icann.org</a>] On Behalf Of Neil Schwartzman<br>
Sent: Thursday, June 08, 2017 8:18 AM<br>
To: ICANN RDS <<a href="mailto:gnso-rds-pdp-wg@icann.org">gnso-rds-pdp-wg@icann.org</a>><br>
Subject: [EXTERNAL] Re: [gnso-rds-pdp-wg] Who is in charge? (was Re: Why the thin data is necessary)]<br>
<br>
<br>
On Jun 8, 2017, at 11:38 AM, jonathan matkowsky <<a href="mailto:jonathan.matkowsky@riskiq.net">jonathan.matkowsky@riskiq.net</a>> wrote:<br>
<br>
<br>
On a side note, a threat researcher or analyst is not the equivalent of an investigator. So focusing on certifying investigators is irrelevant to any issue within the working group. <br>
<br>
You are correct Jonathan, if you mean ‘law enforcement investigators’. In some companies, the term is used synonymously with threat researcher. In that context, "certifying investigators, researchers and analysts is irrelevant to any issue within the working
group.” would be more apropos.<br>
<br>
That said gated access needs some sort of parsing model. which is why I object to it in any form.<br>
<br>
On Jun 8, 2017, at 10:55 AM, Stephanie Perrin <<a href="mailto:stephanie.perrin@mail.utoronto.ca">stephanie.perrin@mail.utoronto.ca</a>> wrote:<br>
<br>
What criteria does an organization like APWG apply, when it admits members and shares data with them? <br>
<br>
<a href="http://apwg.org/membership/membership/">http://apwg.org/membership/membership/</a><br>
<br>
Example of some, but far from all, security initiatives include APWG.org, M3AAWG and FIRST.org (this latter with very stringent criteria, they do onsite visits of CERTs and SIRTs, etcetera). Membership is subject to proprietary internal regulation specific
to these organizations, and may be determined by a vote by existing members, ongoing reviews, etcetera.<br>
<br>
The type of data exchanged in almost all cases is deeper on the order of a magnitude than WHOIS data in terms of sensitivity, it may involve materials, discussions of techniques, that would provide benefit to the adversary were they know (or known that we know),
or disrupt legal initiatives being prepared, or even live law enforcement cases.<br>
<br>
What happens when trust is breached? The member in question is removed.<br>
<br>
Simply because someone passes accreditation doesn’t make them impervious to engaging in future abuse; the most recent case being an analyst with the NSA who leaked top secret documents to the press. I know someone who is currently in the process of being accredited
for such a job, it is at minimum an 18-month process. Perhaps more. I’ve not spoken to her in a while. Furthermore, Mr. Snowden, I believe, did not have such accreditation, as an outside contractor. So there’s that, too.<br>
<br>
N.B.: not all researchers, investigators, and analysts are members of companies or organizations that maintain membership to these groups. Many are professionals without credentials. Many companies are not members. Their abuse ops teams operate without credentials.
They access WHOIS constantly to protect their networks, and those of others, for example, feeding the anti-spam mechanisms protecting u of T’s mail systems.<br>
<br>
<br>
When I have questions like this, I often check with experts before I ask. They don't call me naive, they answer my questions<br>
<br>
The phrase "I believe the notion of certifying private cybercrime investigators to be painfully naive” said nothing about you personally; I spoke to the concept, nothing more. you can choose to take personal umbrage but it was not meant in that manner.<br>
<br>
<br>
we need a system that is slightly more organized and less open to anti-competitive behaviour than the club-of-folks-who-know-each-other under which we are operating now.<br>
<br>
I agree when you said "Folks, can we please try to be polite to one another on this list? “, after all, calling the security research industry anti-competitive isn’t impolite. [for non-english speakers, the use of the word “impolite" was intended to be ironic].<br>
<br>
I do not believe we need anything more than what we have now. WHOIS access is working extremely well.<br>
<br>
<br>
Neil Schwartzman<br>
Executive Director<br>
Coalition Against Unsolicited Commercial Email<br>
<a href="http://cauce.org">http://cauce.org</a><br>
Tel : (303) 800-6345<br>
Twitter : @cauce<o:p></o:p></p>
</blockquote>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>