<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Title" content="">
<meta name="Keywords" content="">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:HelveticaNeue;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.msoIns
{mso-style-type:export-only;
mso-style-name:"";
text-decoration:underline;
color:teal;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body bgcolor="white" lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">Thanks, Amin. Noted.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">Denise Michel<o:p></o:p></p>
<p class="MsoNormal">Domain Name System Strategy & Management<o:p></o:p></p>
<p class="MsoNormal">Facebook, Inc.<o:p></o:p></p>
<p class="MsoNormal"><u><a href="mailto:denisemichel@fb.com"><span style="color:#0563C1">denisemichel@fb.com</span></a></u> <o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black"><ssr2-review-bounces@icann.org> on behalf of Mohamad Amin hasbini <ma@mahasbini.org><br>
<b>Date: </b>Thursday, October 5, 2017 at 3:46 PM<br>
<b>To: </b>SSR2 <ssr2-review@icann.org><br>
<b>Subject: </b>[Ssr2-review] Recent SSR2 status<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"HelveticaNeue",sans-serif;color:black">Hi all,</span>
<o:p></o:p></p>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"HelveticaNeue",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"HelveticaNeue",sans-serif;color:black">I’ve been monitoring and mostly silent, nevertheless I feel i should share few thought about recent occurrences.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"HelveticaNeue",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"HelveticaNeue",sans-serif;color:black">While people dived into the deep processes of ICANN and the dozens of ICANN documents, history, trying to define a feasible scope, I do not think this should
be the SSR2 main role.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"HelveticaNeue",sans-serif;color:black">We are experts in the infosec field, that is why we were selected. We should help ICANN do the SSR evaluation in the best possible manner.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"HelveticaNeue",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"HelveticaNeue",sans-serif;color:black">Observations:<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"HelveticaNeue",sans-serif;color:black">1- We do not have full visibility on what is happening at ICANN and partner organizations (we do not work inside, we do not live inside, at least myself)<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"HelveticaNeue",sans-serif;color:black">2- We will not be able to fully grasp what is happening at ICANN and partner organizations, this is not a small organizations being examined.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"HelveticaNeue",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"HelveticaNeue",sans-serif;color:black">What I think we should do as SSR2:<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"HelveticaNeue",sans-serif;color:black">1- We are not supposed to get hold of all that happens at ICANN. Not even ICANN staff are able to do that and they frequently referred us to different people/employees
when we had different questions<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"HelveticaNeue",sans-serif;color:black">2- We should establish a solid evaluation process where we as SSR2 members are not essential. Our main role is to offer our expertise and develop an evaluation
process which guarantees integrity and transparency for the community we represent. The process should be repeatable and self-sustainable, our follow-up meetings should be to assure the process is being executed and followed accurately, keeping the ICANN board
in full visibility, until ending results are achieved.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"HelveticaNeue",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"HelveticaNeue",sans-serif;color:black">How should the SSR2 do the above mentioned:<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"HelveticaNeue",sans-serif;color:black">One of the main things we need to initiate asap is supporting ICANN to contract an IT/IS risk specialized firm to handle the field work phase, part of the
SSR2 roadmap.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"HelveticaNeue",sans-serif;color:black">Why do that?<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"HelveticaNeue",sans-serif;color:black">Such an organization will:<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"HelveticaNeue",sans-serif;color:black">1- will be onsite(s) at ICANN, with solid previous experience from hundreds of large clients, structured dedicated staff and a large toolset<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"HelveticaNeue",sans-serif;color:black">2- will be able to consolidate and sharpen the scope of the SSR2 evaluation (including this phase budget)<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"HelveticaNeue",sans-serif;color:black">3- will be able to execute the negotiated scope while reporting to the SSR2 and answering its experts questions and concerns<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"HelveticaNeue",sans-serif;color:black">4- will be accountable to deadlines and integrity issues<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"HelveticaNeue",sans-serif;color:black">5- NDA issues solved? If we’re not doing the field work (we can’t anyway afaik), we have no need to sign any NDAs, the engaged firm would need to do so and
that would be absolute standard behavior.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"HelveticaNeue",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"HelveticaNeue",sans-serif;color:black">What would the SSR2 role be here?<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"HelveticaNeue",sans-serif;color:black">As SSR2 members and experts in the field:<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"HelveticaNeue",sans-serif;color:black">1- we would help ICANN negotiate the most efficient and authentic offering<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"HelveticaNeue",sans-serif;color:black">2- we shall be directing the engaged firm into what we think should be prioritized (agreed as a concern with the ICANN board part of the scope)<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"HelveticaNeue",sans-serif;color:black">3- we shall do our best to guarantee the objectivity and integrity of the field work, while continuously reporting results to the ICANN board<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"HelveticaNeue",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"HelveticaNeue",sans-serif;color:black">Final thoughts:<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"HelveticaNeue",sans-serif;color:black">The need for SSR2 to hire and monitor for the ICANN SSR evaluation is something i personally mentioned times before, though it did not get much attention,
i do not believe the SSR2 members are able to deliver quality Security Stability and Reliability evaluation by themselves for ICANN, not with any of our conditions anyway(different locations, timezones, all have job/family priorities…). Nevertheless i believe
the SSR2 group of experts (or what is left of it) will have a much better chance to efficient success, overseeing/guiding the SSR evaluation field execution. Also please do not misunderstand me, SSR2 people are doing very hard work already.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"HelveticaNeue",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"HelveticaNeue",sans-serif;color:black">While my comments are mainly targeting the SSR2 team, I also hope they are relayed to the board, i represent myself and could be mistaken, apologies for the
long message.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"HelveticaNeue",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"HelveticaNeue",sans-serif;color:black">Regards,<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"HelveticaNeue",sans-serif;color:black">Amin<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"HelveticaNeue",sans-serif;color:black">KL<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"HelveticaNeue",sans-serif;color:black">SSC<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"HelveticaNeue",sans-serif;color:black">Brunel<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"HelveticaNeue",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
</div>
</div>
</body>
</html>