<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div class="">I would be interested in the answers to these questions. What is needed for staff to get the Q&A process started?</div><div class=""><br class=""></div><div class="">Russ</div><div class=""><br class=""></div><div class=""><br class=""></div><br class=""><blockquote type="cite" class=""><div style="border-style: solid none none; border-top-width: 1pt; border-top-color: rgb(181, 196, 223); padding: 3pt 0in 0in;" class=""><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><b class=""><span style="font-size: 12pt;" class="">From: </span></b><span style="font-size: 12pt;" class="">Ssr2-review <<a href="mailto:ssr2-review-bounces@icann.org" style="color: blue;" class="">ssr2-review-bounces@icann.org</a>> on behalf of SSR2 <<a href="mailto:ssr2-review@icann.org" style="color: blue;" class="">ssr2-review@icann.org</a>><br class=""><b class="">Reply-To: </b>Denise Michel <<a href="mailto:denisemichel@fb.com" style="color: blue;" class="">denisemichel@fb.com</a>><br class=""><b class="">Date: </b>Wednesday, April 29, 2020 at 1:36 PM<br class=""><b class="">To: </b>"<a href="mailto:danko.jevtovic@board.icann.org" style="color: blue;" class="">danko.jevtovic@board.icann.org</a>" <<a href="mailto:danko.jevtovic@board.icann.org" style="color: blue;" class="">danko.jevtovic@board.icann.org</a>>, SSR2 <<a href="mailto:ssr2-review@icann.org" style="color: blue;" class="">ssr2-review@icann.org</a>><br class=""><b class="">Subject: </b>Re: [Ssr2-review] ICANN Organization Blog on DNS Abuse</span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""> <o:p class=""></o:p></div></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 12pt;" class="">Thanks for sharing, the I<a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_news_blog_icann-2Dorg-2Ds-2Dmultifaceted-2Dresponse-2Dto-2Ddns-2Dabuse&d=DwMGaQ&c=5VD0RTtNlTh3ycd41b3MUw&r=MWVuq3jZIw5gwhGdDf-HWNL4CEWIsdUnt9gOgplCArM&m=ggx5SwI6SuR-4JaAOkNZQ8wkI7nupJpHZmX2EQHiZII&s=3wrosB7KZbFTR-2MbCLB6RlzwAyJ4tLkJlghqOa56Pk&e=" style="color: blue;" class="">CANN blog</a>, Danko. It’s highly relevant to SSR2 work, as well as to what several SSR2 members are doing in our day jobs to stop domain abuse.</span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 12pt;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 12pt;" class="">On the whole, the blog is an expression of intent to act. While welcomed, there are no specifics nor a time table for when the internal and community actions will occur. This raises several questions related to SSR2 work for ICANN Staff to answer (and a couple for the Board), which are listed below.</span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 12pt;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 12pt;" class="">Would SSR2 be able to get expedited answers to these? It would be useful for all concerned if we could factor this into our SSR2 work.</span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 12pt;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 12pt;" class="">Thanks</span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 12pt;" class="">Denise</span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 12pt;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 12pt;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 12pt;" class="">1) The blog says: " the domain names and the data collected by the system will be shared with parties who are in a position to take action, such as registrars and registries, and in some cases with national and international law enforcement organizations."</span><o:p class=""></o:p></div><ul type="disc" style="margin-bottom: 0in; margin-top: 0in;" class=""><li class="MsoListParagraph" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">What specific actions is ICANN expecting registries and registrars to take? <o:p class=""></o:p></li><li class="MsoListParagraph" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">For example, is ICANN encouraging suspension of name resolution or of the registration, or the registrant account?<o:p class=""></o:p></li><li class="MsoListParagraph" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">Will ICANN ask registrars and registries to report on the efficacy of these actions? If so, when and on what cadence?<o:p class=""></o:p></li><li class="MsoListParagraph" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">ICANN should publicly report per registrar & registry action: <o:p class=""></o:p></li><ul type="circle" style="margin-bottom: 0in; margin-top: 0in;" class=""><li class="MsoListParagraph" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;"> How many names has it identified as suspicious/malicious?<o:p class=""></o:p></li><li class="MsoListParagraph" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;"> What’s the number of domain names that each registry/registrar has taken action against? And what action was taken?<o:p class=""></o:p></li></ul><li class="MsoListParagraph" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">When can we expect ICANN public reporting and on what cadence? <o:p class=""></o:p></li></ul><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 12pt;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 12pt;" class="">2) What distinguishes ICANN's participation in the face of the pandemic from how they've participated in the past? </span><o:p class=""></o:p></div><ul type="disc" style="margin-bottom: 0in; margin-top: 0in;" class=""><li class="MsoListParagraph" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">The blog says: “ICANN Compliance uses data collected in audits (described in more detail below) to assess whether registries and registrars are adhering to their DNS security threat obligations.” <o:p class=""></o:p></li><li class="MsoListParagraph" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">What will Compliance do that it has not done until now?<o:p class=""></o:p></li><li class="MsoListParagraph" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">Is Compliance making audit data associated with US-based registrars available to States Attorney Generals and the US Attorney General?<o:p class=""></o:p></li></ul><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 12pt;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 12pt;" class="">3) The blog states (the obvious) that ICANN isn’t a regulator of Internet content, but it doesn’t address ICANN’s public interest remit. Multiple entities have asked ICANN to better govern the manner in which domain names are registered, and now especially, everyone is asking ICANN to hold contracted parties to greater accountability to prevent domains from being registered by malicious actors, especially for pandemic-related fraud and abuse. This requires greater scrutiny during the registration process. </span><o:p class=""></o:p></div><ul type="disc" style="margin-bottom: 0in; margin-top: 0in;" class=""><li class="MsoListParagraph" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">What actions are ICANN taking that address this?<o:p class=""></o:p></li><li class="MsoListParagraph" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">In addition to high volumes of fraudulent domain names containing pandemic-related strings with which criminals try to fool Internet users, random looking or otherwise auto-generated names that are easy to register in volume and are being used by the hundreds to perpetuate pandemic-related phishing attacks. What actions are ICANN taking that addresses this?<o:p class=""></o:p></li><li class="MsoListParagraph" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">Recommended actions contained in SSR2’s draft report could help mitigate pandemic-related domain name abuse. Is the ICANN Board and staff reconsidering any of these actions?<o:p class=""></o:p></li><li class="MsoListParagraph" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">Recommendations from others over the last few years also would help mitigate pandemic-related domain name abuse – especially the substantially increased phishing attacks that harm users. Is the ICANN Board and staff reconsidering any of these actions? Including:<o:p class=""></o:p></li></ul><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 12pt;" class="">- will ICANN move to ensure domain name registrant data is validated? Or at least implement cross-field validation?</span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 12pt;" class="">- will ICANN put in place an Acceptable Use Policy that applies specifically to parties that register large numbers of domains, that requires registrants to apply for (and be validated for) bulk registration services? Further, will ICANN put in place an obligation to distinguish domain names registered by legal entities from those registered by</span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 12pt;" class="">natural persons, classify parties that use bulk registration services as legal entities, and require unredacted access to the registration data of legal entities?</span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 12pt;" class="">- will ICANN maintain and publish a current list of validated bulk registrants (who are from above defined as not natural persons)?</span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 12pt;" class="">- will ICANN disallow registration transactions that involve large numbers of random-looking algorithmic domain names? </span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 12pt;" class="">- will ICANN disallow, for a period of one year, the re-registration of any bulk-registered domain name that has been used in a criminal cyberattack?</span><o:p class=""></o:p></div><div class=""><span style="font-size: 12pt;" class=""><br class=""></span></div><div><br class=""><blockquote type="cite" class=""><div class="">On Apr 21, 2020, at 11:44 AM, <a href="mailto:danko.jevtovic@board.icann.org" class="">danko.jevtovic@board.icann.org</a> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="WordSection1" style="page: WordSection1; caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-family: "Roboto Light";" class="">ICANN Organization Blog on DNS Abuse<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-family: "Roboto Light";" class=""><o:p class=""> </o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-family: "Roboto Light";" class=""><a href="https://www.icann.org/news/blog/icann-org-s-multifaceted-response-to-dns-abuse" style="color: blue; text-decoration: underline;" class="">https://www.icann.org/news/blog/icann-org-s-multifaceted-response-to-dns-abuse</a><o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-family: "Roboto Light";" class=""><o:p class=""> </o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-family: "Roboto Light";" class="">Danko<o:p class=""></o:p></span></div></div></div></blockquote></div><br class=""></blockquote></body></html>