[gnso-rds-pdp-wg] Notes and action items from Next-Generation RDS PDP WG Meeting - deep concerns

Wed Mar 2 17:16:14 UTC 2016

Dear All,

Sorry for not being able to attend the call, but I am continuously in
meetings.However I just wanted to support the idea of talking first on the
purpose of the WHOIS. I share the views stating that it's hard to speak
about any data, set of data without setting the purpose of the whole data
processing (ie. WHOIS here). Even if we started with defining the data
requested we will surely bump into the question: For what purpose?

Best regards,

Peter

From: gnso-rds-pdp-wg-bounces at icann.org
[mailto:gnso-rds-pdp-wg-bounces at icann.org] On Behalf Of Stephanie Perrin
Sent: Friday, February 26, 2016 6:55 AM
To: gnso-rds-pdp-wg at icann.org
Subject: Re: [gnso-rds-pdp-wg] Notes and action items from Next-Generation
RDS PDP WG Meeting - deep concerns

As I said somewhat facetiously during the chat, you should have seen the
dissents I refrained from emitting....the EWG did not start from a de novo
position.  Given the repeated failure to even define the purpose of WHOIS
(see the SAC Blind men and the elephant report) we do need to take a de novo
approach.  The EWG report provided good analysis on some issues, and some
new approaches.  It certainly did not solve all the problems or deal with
all the issues.  Brace yourself for me repeatedly pointing these lacunae
out, as I know a lot more about all the issues than I did when I started
with the EWG....
Stephanie Perrin

On 2016-02-25 20:27, Gomes, Chuck wrote:

Please see my responses below Kathy.

Chuck

From: Kathy Kleiman [mailto:kathy at kathykleiman.com] 
Sent: Thursday, February 25, 2016 5:18 PM
To: Gomes, Chuck; gnso-rds-pdp-wg at icann.org
<mailto:gnso-rds-pdp-wg at icann.org> 
Subject: Re: [gnso-rds-pdp-wg] Notes and action items from Next-Generation
RDS PDP WG Meeting - deep concerns

Hi Chuck, 
I'm sorry, but I don't understand the starting point of the draft work plan.
It says that the "Bulk of Work in phase 1 relates to recommending
requirements for Registration Directory Services." After review of the EWG,
it states that we will "Develop a comprehensive list of possible requirement
[sic] (without a debate) as a first step." 

[Chuck Gomes] That statement is an assumption based on the WG charter.  Do
you not think that the WG's main task, which will consume most of our time,
will involve most of our time?  If not, please show me what I am missing in
the charter.

It seems to me that the first step should be evaluating the data collected
by the registrars for registration purposes. The next step should be
evaluating the purposes for which that data is collected. The third step
should be seeking out additionally purposes for which folks not registrars
would like to use the data. The fourth step should be to determine whether
the information could legally be made available for those additional
purposes, and whether those additional purposes are even desirable or useful
(or are there dangers and concerns?)

[Chuck Gomes] The EWG already spent countless hours evaluating the data
collected and had multiple opportunities for public comment on their work.
Are you suggesting that we should repeat that work?  The first of the eleven
questions deals with users and purposes so your suggested first two steps
seem to be covered by the WG deliberations on the first charter question.
In other words, it seems to me that the proposed approach covers your first
two steps at the beginning like you are suggesting.  The only difference is
that the approach suggests identifying possible requirements first.

Jumping straight into "Develop a comprehensive list of possible requirements
(without debate)" skips the whole analysis (above) that I understand is
necessary under EU nations' laws (and the many other countries with data
protection laws) and jumps straight into -- "who wants this data?! Get your
data here!"

[Chuck Gomes] The analysis will not be skipped.  It will happen when we do
our deliberation.

For the draft work plan, section 3 below ("Review and discuss draft work
plan"), I would start with these opening bullet points:
- what domain name registration data is collected and for what purpose?
[Chuck Gomes]  First area of deliberation.
- what specific laws and restrictions limit the re-use or secondary use of
this domain name registration data?  (data gathering, legal analysis
section)[Chuck Gomes]  This will happen in our deliberation on each possible
requirement.
- what additional uses would people like to use the domain name registration
data and why?[Chuck Gomes]  First area of deliberation.
- Outreach to the Supporting Organizations, Advisory Committees and outreach
to the greater Internet Community[Chuck Gomes]  We will do this multiple
times during our work.
- Deliberations as to whether these additional uses are legal, possible,
optional -- and what the costs and benefits are of providing this data for
the secondary purposes that people are seeking it. 

On a related note, I used to program large-scale databases on Wall Street
and respectfully submit that the term "requirements" in the first 3 bullet
points of section 3 is being used incorrectly (or confusingly) as a
technical matter. Until we do the detailed analysis of the key issues of
what data collected, its primary purpose, sought secondary use,
proportionality, etc, we can't possibly know or lay out the "requirements"
we are seeking for the new Registration Directory Services.  "Requirements"
is best used as the term for the features we intend to build into our new
RDS system. We are nowhere near the "requirements" stage yet -- we are at
the preliminary data gathering, use and user analysis, legal review, and
other preliminaries. Shaping, scoping, defining and describing the
"requirements" of the new system will come later.  What other term can we
use? 

[Chuck Gomes] We are using the term from the charter.  I agree that it may
fit better in some cases than others but I suggest we don't get too hung up
on terminology.  If we can improve it, fine, but let's not spend too much
time debating terminology until it becomes critical, i.e., when we actually
get into our deliberation.

To the other question of the WG, what "rough categories of expertise" are
needed:
I would add groups that specialize in free speech, freedom of expression,
human rights, domestic violence, international journalist organizations, and
groups that specialize in political oppression. It is these groups that know
intimately who is being harassed, stalked and even killed based on Whois
data -- and many of them participated in the last public comment held by the
Proxy/Privacy Accreditation Working Group. They are definitely reachable and
in tune with our issues. 

[Chuck Gomes] We are way past the 24-hour deadline on this.  If the
membership review team has not finalized the categories yet, they of course
can take your input into consideration but it is possible they have already
completed the list.  

I deeply apologize for missing the meeting this week. We had a death of a
family friend and given daytime commitments, I could not participate in the
late-night call.

[Chuck Gomes] Please accept my condolences.

Tx for your review. 
Best,
Kathy (Kleiman)

On 2/25/2016 9:57 AM, Gomes, Chuck wrote:

Thanks for the feedback Kathy.  I will let those who were on the EWG respond
to what happened after London but I did insert some personal responses
below.

Chuck

From: gnso-rds-pdp-wg-bounces at icann.org
<mailto:gnso-rds-pdp-wg-bounces at icann.org>
[mailto:gnso-rds-pdp-wg-bounces at icann.org] On Behalf Of Kathy Kleiman
Sent: Thursday, February 25, 2016 9:04 AM
To: gnso-rds-pdp-wg at icann.org <mailto:gnso-rds-pdp-wg at icann.org> 
Subject: Re: [gnso-rds-pdp-wg] Notes and action items from Next-Generation
RDS PDP WG Meeting - deep concerns

Hi Chuck,
Tx you for the reminder for the last call of comments. I would like to raise
concerns about some of the items in the work plan. My objections have to do
with the focus of the "Outline of Approach for Phase 1" extensively on input
from the EWG Final Report. The work plan, as circulated (particularly under
its "Assumptions") implies an understanding and acceptance of the EWG Final
Report that never existed. Let me explain (and invite my EWG friends and all
present at that time) to supplement this record:

[Chuck Gomes] Please tell me why you think there is an acceptance of the EWG
Final Report?  No such assumption was made by the Leadership Team.  As you
share below, the intent is for it to be a starting point.

Background:  the EWG Final Report was greatly changed from the interim to
the final draft. Not a little bit, but significantly, substantively, clearly
changed. Dozens of new pages were added; entirely new analysis and
recommendations. The final Report was difficult, even impossible, to
understand. Long public sessions were held at the ICANN meeting in London
where speaker after speaker raised issues, concerns and questions,
questions, questions. There were so much ambiguity in the text, so many
sections that were unclear, so many cross-references that were not complete
that even those of us who have been in this field for many years found it
impossible to understand specifically what was being recommended and why.
Further, there were major questions raised about the large amount of data
being collected and retained, indications of nearly unlimited access for
certain types of users, and many more concerns.  There were so many
questions that commenters at the microphone agreed we/they could not even
start a full and substantive critique of the Final Report because it is
unclear even what was being recommended on certain key and substantive
points. The essence of drafting rules and technical policy is, of course,
clarity and we agreed in these public session in London that it was lacking
in this Final Report.** Answers were promised; answers never came. The EWG
Final Report remains an ambiguous, unclear document. 

No Final Public Comment: Unfortunately, despite major and extensive changes
between the interim and final drafts, and ICANN precedent itself, the EWG
Final Report never went to public written comment. (In all my time in ICANN,
which is a lot, I have never seen a final report which did not go to public
comment - particularly a final report as complex, difficult, convoluted and
significantly-changed as this one.) There was no final comment period for
this report -- just a promise that no group would ever accept the Final
Report as an absolute starting point; and that all future groups working
with the EWG Final Report would know that it never received a final review,
never received consensus, and was never even understood by those critiquing
it in the public sessions. 

Dissent: Further, the EWG Final Report received a strong dissent from the
only member of the EWG with a data protection background - the person who
was a key drafter of the Canadian Data Protection Report. Her 

issues and concerns have, of course, never been addressed because the EWG
Final Report never went out for that final round of public comment and final
round of revisions. 

[Chuck Gomes] I fully expect and encourage the dissenter (Stephanie) to add
possible requirements that address her concerns.

Accordingly: calls for acceptance and reliance on the EWG Final Report
should be much more carefully worded and limited in the Work Plan than they
are now. I know the Board wants us to refer it as a reference point and
touch point, but not the only or exclusive starting point.  The work plan
has references to other sources other than the EWG Final Report, but what
are they, where are they and who will find and summarize them?  Given the
speed we want to work, it is incumbent on the WG, at this early point in
development, in this Work Plan, to determine what these other sources might
be and how we can access them quickly, efficiently and effectively. I would
like to request that the Work Plan include provisions for subteams to form
and Staff to help find, use and summarize these other sources so that they
will be available as quickly as the EWG Report (and noting that it may be
difficult for members of the community to drop other work and write short
White Papers.) But it is clear that we need to fairly and fully pull in the
widest range of information and input at this critical point of Phase 1 --
the RDS Working Group richly deserves it! 

[Chuck Gomes] If you think the wording asks for acceptance and reliance on
the EWG Final Report, please suggest alternative wording.  Regarding other
sources, many of them are identified in the EWG Report, in the Issues Report
and I encourage WG members to identify other sources.  Stephanie's minority
statement is one source already mentioned, although I consider it part of
the EWG Report.

In my view, I see no need for writing white papers.  What we will need
though in the early parts of our work is for everyone to identify possible
requirements so that we create as comprehensive a list as possible.  That
list will then be deliberated on by the WG to determine which ones we agree
should be recommended.

Best, 
Kathy (Kleiman)
p.s. In summary, I would like to ask Assumptions be modified to reflect the
huge questions and concerns raised about the EWG Final Report in London, and
the complete lack of any final comment period on a hugely and
substantively-changed final report.  I would also like to request that
Outline of Approach to Phase 1 be modified to reflect a concerted effort of
the WG, Leadership Team subteam(s) and Staff to identify, define and
summarize the "sources other than the EWG Final Report" that will be used
and what resources will be devoted by Staff to collecting and summarizing
them for ease of use by the WG. 

Best regards,
Kathy

On 2/24/2016 1:34 AM, Marika Konings wrote: 

Dear All,

Please find below the notes and action items of today's meeting. I would
like to draw special attention to the following action items and deadlines
associated with these:

*	Action item #1: All to review categories identified by small team
and provide feedback within 24 hours (see attached)
*	Action item #4: All to review work plan approach as has been
circulated with the agenda and provide any comments / questions on the
mailing list within 48 hours. (see attached)

Please share any input or questions you may have with the mailing list.

Best regards,

Marika

Notes/Action items 24 February 2016 - Next-Generation RDS PDP WG Meeting

1. Roll call/ SOI

*	Note, observers have read-only access to the mailing list and do not
receive the call details. If you want to change your status, you can inform
the GNSO Secretariat accordingly.
*	Members are required to provide a Statement of Interest in order to
participate in the Working Group.
*	Updates to SOIs are requested at the start of every meeting.

Action item #1: Please complete / update your Statement of Interest if you
have not done so yet. 

2. Review of WG membership & expertise update

*	Small team has been discussing how to identify current level of
expertise
*	Identified a number of rough categories of expertise that is
expected to be needed for this effort: Legal (IP, criminal, civil),
Technical (Protocol development, Security, Audit), Data Protection,
Operational (Registrar, Registries), Commercial/e-business, Non
commercial/not for profit, government advisory, law enforcement (police,
investigators, courts), individual internet user.
*	Proposal to put these categories into a zoomerang poll to allow for
WG members to self-identify their expertise
*	Small team would like to receive input on the categories identified
and possible sub-categories
*	Consider removing investigators as it can be considered part of
'police'. There are also other agencies that are involved in investigations,
maybe that is why it has been identified as a separate category. Should
investigators (non-government) be a separate category? This would include
organisations like consumer organisations.
*	Security may not only be technical expertise, there may also be
non-technical aspects to it. Consider having a security category that is not
under the technical heading.
*	DNS technical specialists should also be considered as a category
*	Categories are intended to get a general sense of expertise
available
*	Consider updating law enforcement to public safety to capture a
broader category of investigators?
*	Should public defenders be added to the legal category? Might
already be covered by legal/criminal?
*	Consider a category for cybersecurity. 
*	Experts can be invited to just join when a particular topic is
discussed - not only looking at filling gaps in membership, but also
identify specific support that may be needed in an expert capacity. 
*	Consider adding a category for WHOIS software / service developer

Action item #1: All to review categories identified and provide feedback
within 24 hours

Action item #2: staff to develop survey on the basis of the categories
identified and request WG members to participate

Action item #3: small team to review feedback received to the survey and
identify whether additional outreach is needed based on the survey results. 

3. Review and discuss draft work plan approach

*	Bulk of work in phase 1 relates to recommending requirements for
Registration Directory Services
*	Use EWG Final Report as starting point, as instructed by the ICANN
Board. Substantial public input was provided and incorporated by this
effort. Not restricted to the EWG Final Report, but an important starting
point. 
*	Develop a comprehensive list of possible requirement (without a
debate) as a first step. Deliberations on each possible requirement will be
the next step after developing this comprehensive list, including reaching
consensus on whether requirements should be included or not.
*	Outreach to SO/ACs is expected during various stages of the PDP,
periodically as needed. This outreach may take various forms, formal,
informal. There is a requirement for formal input at the early phase of the
process. 
*	Interdependency of all eleven questions in the charter will main
that the WG may need to go back and forth between questions. 
*	First five questions are critical as they are essential to
responding to the foundational question of whether a new RDS is needed. 
*	No comment period held on the Final EWG Report. EWG Report expected
to be starting point - not stopping there, just a first list of possible
requirements that the WG is expected to add to.
*	Should purpose be defined before discussion uses? Purposes and uses
are part of the charter which are expected to result in possible
requirements (see question 1).
*	Leadership team has started developing a first list of possible
requirements - draft as a starting point for the full WG to review and add
to. SO/AC/SG/Cs can also be asked to add to the list of possible
requirements. Objective to have comprehensive list of requirements. 
*	Once this comprehensive list is 'complete' (WG is of the view that
all possible requirements have been added), systematic review of the
requirements by the WG. 
*	Deliberation of some requirements could be deferred to later phases,
if deemed appropriate. 
*	Following this work, the WG is expected to deliberate on
foundational question: is a new RDS needed or can the existing WHOIS system
be modified to satisfy the recommended requirements for questions 1-5.
Answer to this question will determine subsequent steps. 
*	Who will come up with costing based on the requirements identified?
Is it possible to estimate costs until you get to phase 2 and 3? Might be
possible to get a high level idea in phase 1, but you cannot do it thorougly
until you get to phase 2 when the policies are identified. Phase 1 could
identify what costs need to be measured while phase 2 may ballpark those.
Cost impact expected across the whole eco-system. Impact assessment will be
important question.
*	Outreach to SO/ACs may involve those groups to consult with their
respective constituencies that may take more than 35 days. Smaller requests
more frequently may facilitate feedback. All should be communicating
regularly with their respective groups - bring feedback to the WG on an
ongoing basis. If any request for input would be associated with a minimum
35 day timeline it would have a significant impact on the overall timeline.
*	Leadership team will work on the detail of the work plan based on
the approach outlined and comments received.
*	Those on the call were supportive of the approach outlined. Provide
opportunity for those not on the call to provide feedback on the approach. 
*	Leadership team would like to be able to send out a first cut of a
work plan by the end of this week so it can be further discussed and
reviewed during next week's meeting.

Action item #4: All to review work plan approach as has been circulated with
the agenda and provide any comments / questions on the mailing list within
48 hours. 

Action item #5: Leadership team to send out first draft of work plan by the
end of this week.

4. Discuss proposed outreach to SO/AC/SG/Cs to solicit early input

*	Required to formally request input at early stage, minimum of 35
days response time. Considering asking for general input.
*	Request formal input shortly after ICANN meeting in Marrakech. 

Action item #6: Leadership team to develop draft outreach message for WG
review.

5. ICANN meeting in Marrakech F2F meeting

*	See http://doodle.com/poll/7f9h9spwwmys26c5. To date 46 expected to
participate in person, 20 are planning to participate remotely and 5 are not
able to attend.
*	See https://meetings.icann.org/en/marrakech55/schedule/wed-rds for
further details.

6. Confirm next steps and next meeting

*	Next meeting will be scheduled for Tuesday 1 March at 16.00 UTC 
*	Chuck will not be available for the next meeting - Susan Kawaguchi
has volunteered to chair the meeting on 1 March.

_______________________________________________
gnso-rds-pdp-wg mailing list
gnso-rds-pdp-wg at icann.org <mailto:gnso-rds-pdp-wg at icann.org> 
https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg

_______________________________________________
gnso-rds-pdp-wg mailing list
gnso-rds-pdp-wg at icann.org <mailto:gnso-rds-pdp-wg at icann.org> 
https://mm.icann.org/mailman/listinfo/gnso-rds-pdp-wg

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mm.icann.org/pipermail/gnso-rds-pdp-wg/attachments/20160302/c4d09ccd/attachment.html>