<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:"Courier New";}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style></head><body lang=EN-CA link=blue vlink="#954F72" style='word-wrap:break-word'><div class=WordSection1><p class=MsoNormal>HI Steve,</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Steve said:<span style='font-size:12.0pt;font-family:"Arial",sans-serif;color:black'> Returning to the registration process, what procedures are in place to inform the registrant they are in charge of and responsible for the registration, and what response, if any, is required from the registrant? If an affirmative response is required, I would say the level of validation is more than merely operational. That said, I would also agree this level of validation is somewhat less than full identity validation.<o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Sarah says: Yes–the process that you are asking about, something to inform the registrant that their data is used on the domain and require an affirmative response, is the Whois verification process described in the Whois Accuracy Program Specification 1 (f) (i) or (ii). This is what we are referring to as operational validation, and the contractual obligation is to ensure either the email or phone number are operational.</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I think we should leave out any consideration of Admin contact, as that is definitely being deprecated by the EPDP Phase 1 work currently in IRT, and although I may agree regarding the obligation of a person with responsibility, I don’t think that’s relevant to this accuracy scoping work.</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Thanks,</p><pre><o:p> </o:p></pre><pre><o:p> </o:p></pre><pre><span style='font-family:"Verdana",sans-serif'>-- <o:p></o:p></span></pre><pre><b><span style='font-family:"Verdana",sans-serif'>Sarah Wyld</span></b><span style='font-family:"Verdana",sans-serif'>, CIPP/E<o:p></o:p></span></pre><pre><span style='font-family:"Verdana",sans-serif'><o:p> </o:p></span></pre><pre><span style='font-family:"Verdana",sans-serif'>Policy & Privacy Manager<o:p></o:p></span></pre><pre><span style='font-family:"Verdana",sans-serif'>Pronouns: she/they<o:p></o:p></span></pre><pre><span style='font-family:"Verdana",sans-serif'><o:p> </o:p></span></pre><pre><a href="mailto:swyld@tucows.com"><span style='font-family:"Verdana",sans-serif'>swyld@tucows.com</span></a><span style='font-family:"Verdana",sans-serif'> <o:p></o:p></span></pre><pre><span style='font-family:"Verdana",sans-serif'>+1.416 535 0123 Ext. 1392<o:p></o:p></span></pre><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'><o:p> </o:p></span></p><p class=MsoNormal><img border=0 width=100 height=24 style='width:1.0416in;height:.2447in' id="Picture_x0020_3" src="cid:image003.png@01D7C725.87E1F990"><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><div style='mso-element:para-border-div;border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal style='border:none;padding:0cm'><b>From: </b><a href="mailto:steve@shinkuro.com">Steve Crocker</a><br><b>Sent: </b>October 22, 2021 8:38 AM<br><b>To: </b><a href="mailto:gnso-accuracy-st@icann.org">gnso-accuracy-st@icann.org</a><br><b>Subject: </b>Re: [GNSO-Accuracy-ST] Identity Proofing Clarity - Follow UpHomework</p></div><p class=MsoNormal><o:p> </o:p></p><div><div><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Arial",sans-serif;color:black'>Others on this list more familiar than I am with the fine grain details of both the contracts and the operational aspects of the registration process may be able to comment on my perspective of the registration process.<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Arial",sans-serif;color:black'><o:p> </o:p></span></p></div><div><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Arial",sans-serif;color:black'>Registration is initiated by the account holder. The account holder is also sometimes referred to as the customer. This is the person who has an account with the registrar and thus has the capability of initiating a registration process.<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Arial",sans-serif;color:black'><o:p> </o:p></span></p></div><div><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Arial",sans-serif;color:black'>During the registration process the account holder provides the name and other contact details of the registrant. At that point, the registrant acquires the rights and responsibilities associated with the registration, although the account holder continues to be the person who has operational control of the registration.<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Arial",sans-serif;color:black'><o:p> </o:p></span></p></div><div><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Arial",sans-serif;color:black'>This distinction becomes important when there is a dispute about control of the registration. The account holder has the capability of making changes within a few seconds. If the registrant does not have electronic access to the account, they can appeal to the registrar. This process will generally take some number of days, but, I am told, the registrant will generally prevail. I would imagine that during such a dispute process, the registrant may have to provide evidence they are, in fact, the registrant.<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Arial",sans-serif;color:black'><o:p> </o:p></span></p></div><div><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Arial",sans-serif;color:black'>Returning to the registration process, what procedures are in place to inform the registrant they are in charge of and responsible for the registration, and what response, if any, is required from the registrant? If an affirmative response is required, I would say the level of validation is more than merely operational. That said, I would also agree this level of validation is somewhat less than full identity validation.<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Arial",sans-serif;color:black'><o:p> </o:p></span></p></div><div><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Arial",sans-serif;color:black'>By "merely operational" I mean that email or phone numbers are checked to see if mail is delivered or the phone is answered. Similarly, a street address is "merely operational" if it's an actual street address and presumably capable of receiving snail mail. The inclusion of affirmative feedback significantly changes the situation, in my view.<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Arial",sans-serif;color:black'><o:p> </o:p></span></p></div><div><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Arial",sans-serif;color:black'>Moving to a slightly different but closely related aspect of the registration process, the roles of Admin contact, Tech contact and perhaps other roles deserve a brief mention. I know our general direction is toward deprecating or eliminating these roles. That's fine with me, but I am under the impression some registrars continue to assign specific responsibility and authority to these roles. For example, I believe some registrars give Admin contact the authority to approve transfer of the registration.<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Arial",sans-serif;color:black'><o:p> </o:p></span></p></div><div><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Arial",sans-serif;color:black'>In my view, whenever a person is assigned a role that includes any degree of responsibility or authority, it's essential the person knows and has agreed. To be fully clear, by "responsibility" I mean an obligation to respond or act in certain circumstances, and by "authority" I mean the authorization to take certain actions.<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Arial",sans-serif;color:black'><o:p> </o:p></span></p></div><div><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Arial",sans-serif;color:black'>Going a step further, it's not only essential for a person assigned to a role to know their responsibility and authority, it's also essential for anyone who contacts that person to know what that person is obligated and capable to do.<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Arial",sans-serif;color:black'><o:p> </o:p></span></p></div><div><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Arial",sans-serif;color:black'>Thanks,<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Arial",sans-serif;color:black'><o:p> </o:p></span></p></div><div><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Arial",sans-serif;color:black'>Steve<o:p></o:p></span></p></div></div><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Arial",sans-serif;color:black'><o:p> </o:p></span></p><p class=MsoNormal><o:p> </o:p></p></div></body></html>