<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div class=""><br class=""></div>Chris,<div class=""><br class=""></div><div class="">When I found two vulnerabilities at the website in question, <a href="https://compliance.icann.org" class="">https://compliance.icann.org</a>, ICANN informed that KPMG was in charge of that server. This was corroborated by OU field in the certificate indicating KPMG. Since then, <a href="http://compliance.icann.org" class="">compliance.icann.org</a> now redirects to <a href="https://mft.us.kpmg.com/" class="">https://mft.us.kpmg.com/</a> , making clearer that the data is being sent to KPMG. </div><div class=""><br class=""></div><div class="">From an ICANN message of the time (February 2016):</div><div class=""><span style="font-family: Calibri, sans-serif; font-size: 14px;" class="">"(name) is on top of this and working with IT and KPMG to address it."</span></div><div class=""><font face="Calibri, sans-serif" class=""><span style="font-size: 14px;" class=""><br class=""></span></font></div><div class=""><font face="Calibri, sans-serif" class=""><span style="font-size: 14px;" class=""><br class=""></span></font></div><div class=""><font face="Calibri, sans-serif" class=""><span style="font-size: 14px;" class=""><br class=""></span></font></div><div class=""><font face="Calibri, sans-serif" class=""><span style="font-size: 14px;" class="">Rubens</span></font></div><div class=""><font face="Calibri, sans-serif" class=""><span style="font-size: 14px;" class=""><br class=""></span></font></div><div class=""><font face="Calibri, sans-serif" class=""><span style="font-size: 14px;" class=""><br class=""></span></font></div><div class=""><font face="Calibri, sans-serif" class=""><span style="font-size: 14px;" class=""><br class=""></span></font><div><br class=""><blockquote type="cite" class=""><div class="">On 13 Feb 2018, at 17:11, Chris Pelling <<a href="mailto:chris@netearth.net" class="">chris@netearth.net</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class=""><div style="font-family: Arial; font-size: 12pt;" class=""><div class="">Hi Rubens,</div><div class=""><br data-mce-bogus="1" class=""></div><div class="">My understanding from doing these audit twice is that hte data is sent to an ICANN managed and controlled system, this is then sent onto the auditor KPMG in these cases. That or KPMG has access to the data on the ICANN system.</div><div class=""><br class=""></div><div data-marker="__SIG_PRE__" class="">Kind regards,<br class=""><br class="">Chris</div><br class=""><hr id="zwchr" data-marker="__DIVIDER__" class=""><div data-marker="__HEADERS__" class=""><b class="">From: </b>"Rubens Kuhl" <<a href="mailto:rubensk@nic.br" class="">rubensk@nic.br</a>><br class=""><b class="">To: </b>"Chris Pelling" <<a href="mailto:chris@netearth.net" class="">chris@netearth.net</a>><br class=""><b class="">Cc: </b>"John Bambenek" <<a href="mailto:jcb@bambenekconsulting.com" class="">jcb@bambenekconsulting.com</a>>, "gnso-rds-pdp-wg" <<a href="mailto:gnso-rds-pdp-wg@icann.org" class="">gnso-rds-pdp-wg@icann.org</a>>, "Greg Aaron" <<a href="mailto:gca@icginc.com" class="">gca@icginc.com</a>><br class=""><b class="">Sent: </b>Tuesday, 13 February, 2018 17:40:25<br class=""><b class="">Subject: </b>Re: [gnso-rds-pdp-wg] Equifax hack worse than previously thought: Biz kissed goodbye to card expiry dates, tax IDs etc<br class=""></div><br class=""><div data-marker="__QUOTED_TEXT__" class=""><br class=""><div class=""><br class=""><blockquote class=""><div class="">On 13 Feb 2018, at 15:29, Chris Pelling <<a href="mailto:chris@netearth.net" class="" target="_blank">chris@netearth.net</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);" class=""><div dir="auto" style="direction: ltr; margin: 0px; padding: 0px; font-family: sans-serif; font-size: 11pt;" class="">Sorry Greg,<br class=""><br class=""></div><div dir="auto" style="direction: ltr; margin: 0px; padding: 0px; font-family: sans-serif; font-size: 11pt;" class="">Totally disagree based on the requirements of the RAA and data retention requirements. Sending data to Icann for audits etc, to iron mountain for data escrow.<br class=""><br class=""></div><div dir="auto" style="direction: ltr; margin: 0px; padding: 0px; font-family: sans-serif; font-size: 11pt;" class="">Way too much data in my opinion<span class="Apple-converted-space"> </span><br class=""></div></div></div></blockquote></div><br class=""><div class=""><br class=""></div><div class="">During audits data is sent to auditors, not to ICANN. I wouldn't trust ICANN InfoSec with such data and I think most contracted parties wouldn't either. </div><div class=""><br class=""></div><div class="">As for data escrow, it only contains registration data; while some information there is sensitive (like physical address), registrants would rather keep their domains in case of a registrar or registry collapse. Different from WHOIS publication, when the possible legitimate uses under discussions are of 3rd parties, escrow is a legitimate interest of the registrant. While I would like to see DPAs signing on that thinking to be sure we are on the safe side, it's not a balance, it is in place towards registrant benefit. The only grey area here is "right to be forgotten" after a domain is deleted or transferred; will a registrant be able to ask for such data removal, or is a domain registry like a land registry where the ownership history belongs to society not to individual owners of that piece of land ? </div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">Rubens</div><div class=""><br class=""></div><div class=""><br class=""></div><br class=""></div></div></div></div></blockquote></div><br class=""></div></body></html>