[GNSO-Accuracy-ST] Identity Proofing Clarity - Follow Up Homework

[Steve Crocker]

Others on this list more familiar than I am with the fine grain details of
both the contracts and the operational aspects of the registration process
may be able to comment on my perspective of the registration process.

Registration is initiated by the account holder.  The account holder is
also sometimes referred to as the customer.   This is the person who has an
account with the registrar and thus has the capability of initiating a
registration process.

During the registration process the account holder provides the name and
other contact details of the registrant.  At that point, the registrant
acquires the rights and responsibilities associated with the registration,
although the account holder continues to be the person who has operational
control of the registration.

This distinction becomes important when there is a dispute about control of
the registration.  The account holder has the capability of making changes
within a few seconds.  If the registrant does not have electronic access to
the account, they can appeal to the registrar.  This process will generally
take some number of days, but, I am told, the registrant will generally
prevail.  I would imagine that during such a dispute process, the
registrant may have to provide evidence they are, in fact, the registrant.

Returning to the registration process, what procedures are in place to
inform the registrant they are in charge of and responsible for the
registration, and what response, if any, is required from the registrant?
If an affirmative response is required, I would say the level of validation
is more than merely operational.  That said, I would also agree this level
of validation is somewhat less than full identity validation.

By "merely operational" I mean that email or phone numbers are checked to
see if mail is delivered or the phone is answered.  Similarly, a street
address is "merely operational" if it's an actual street address and
presumably capable of receiving snail mail.  The inclusion of affirmative
feedback significantly changes the situation, in my view.

Moving to a slightly different but closely related aspect of the
registration process, the roles of Admin contact, Tech contact and perhaps
other roles deserve a brief mention.  I know our general direction is
toward deprecating or eliminating these roles.  That's fine with me, but I
am under the impression some registrars continue to assign specific
responsibility and authority to these roles.  For example, I believe some
registrars give Admin contact the authority to approve transfer of the
registration.

In my view, whenever a person is assigned a role that includes any degree
of responsibility or authority, it's essential the person knows and has
agreed.  To be fully clear, by "responsibility" I mean an obligation to
respond or act in certain circumstances, and by "authority" I mean the
authorization to take certain actions.

Going a step further, it's not only essential for a person assigned to a
role to know their responsibility and authority, it's also essential for
anyone who contacts that person to know what that person is obligated and
capable to do.

Thanks,

Steve
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://mm.icann.org/pipermail/gnso-accuracy-st/attachments/20211022/d188ab2b/attachment.html>