<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Helvetica;
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle22
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:288359879;
mso-list-template-ids:-2120980256;}
@list l0:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level2
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:1.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:1.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level5
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level8
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l1
{mso-list-id:502624390;
mso-list-template-ids:586731908;}
@list l1:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l1:level2
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:1.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l1:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:1.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l1:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l1:level5
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l1:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l1:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l1:level8
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l1:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l2
{mso-list-id:925652690;
mso-list-template-ids:431265392;}
@list l2:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l2:level2
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:1.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l2:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:1.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l2:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l2:level5
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l2:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l2:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l2:level8
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l2:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l3
{mso-list-id:1630476018;
mso-list-template-ids:-409537450;}
@list l3:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l3:level2
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:1.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l3:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:1.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l3:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l3:level5
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l3:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l3:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l3:level8
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l3:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l4
{mso-list-id:1758869346;
mso-list-type:hybrid;
mso-list-template-ids:1012182376 -557447276 67698691 67698693 67698689 67698691 67698693 67698689 67698691 67698693;}
@list l4:level1
{mso-level-start-at:2;
mso-level-number-format:bullet;
mso-level-text:-;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Calibri",sans-serif;
mso-fareast-font-family:Calibri;}
@list l4:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l4:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
@list l4:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l4:level5
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l4:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
@list l4:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l4:level8
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l4:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1027" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">All,<o:p></o:p></p>
<p class="MsoNormal">I was able to get some additional background relating to the 60 day lock after creation of a domain name. From Verisign’s perspective, this is definitely legacy as a form of this restriction has been in our RA and enforced by the registry
since 1999. It is my understanding, from a conversation with someone who pre-dates me here at Verisign, that this was originally created as a registrar protection to prevent new registrants from hopping around to avoid payment (at least one of the considerations).
Below is from <a href="https://www.icann.org/en/registry-agreements/com/com-registry-agreement-appendix-7-1-12-2012-en">
Appendix 7, Section 3.1.1 of the publicly available .COM RA</a>. I believe that other legacy TLDs may have similar language. Hope this helps.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><i>Transfer (other than ICANN-approved bulk transfer).</i> Transfers under Part A of the ICANN Policy on Transfer of Registrations between Registrars
<b>may not occur during the <i>Add Grace Period</i> or at any other time within the first 60 days after the initial registration</b>. Enforcement is the responsibility of the Registrar sponsoring the domain name registration and is enforced by the SRS.
<o:p></o:p></p>
<div>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="380" style="width:285.0pt">
<tbody>
<tr style="height:1.35pt">
<td colspan="2" style="padding:0in 0in 0in 0in;height:1.35pt">
<p class="MsoNormal" style="margin-bottom:10.0pt;mso-line-height-alt:1.35pt"><span style="font-size:12.0pt;color:#1F497D"> </span><img border="0" width="370" height="2" style="width:3.8541in;height:.0208in" id="Picture_x0020_1" src="cid:image004.jpg@01D7C663.4A07DC10"><span style="font-size:12.0pt;color:#1F497D"><o:p></o:p></span></p>
</td>
</tr>
<tr style="height:86.25pt">
<td style="padding:11.25pt 0in 15.0pt 0in;height:86.25pt">
<p class="MsoNormal" style="line-height:10.5pt"><b><span style="font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#006AAA">Barbara Knight, CCEP, CCME</span></b><span style="font-size:12.0pt;color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:10.5pt"><span style="font-size:9.5pt;font-family:"Helvetica",sans-serif;color:#6B6D71">Sr. Director - Registry Compliance</span><span style="font-size:12.0pt;color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:10.5pt"><span style="font-size:9.5pt;font-family:"Helvetica",sans-serif"><a href="mailto:bknight@Verisign.com"><span style="color:blue">bknight@Verisign.com</span></a><span style="color:#6B6D71"><br>
<br>
t: 703-948-3343</span></span><span style="font-size:12.0pt;color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:10.0pt;line-height:10.5pt"><span style="font-size:9.5pt;font-family:"Helvetica",sans-serif;color:#6B6D71">12061 Bluemont Way, Reston, VA 20190
<br>
<br>
</span><a href="http://www.verisigninc.com/"><span style="font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#006AAA">Verisign.com</span></a><span style="font-size:9.5pt;font-family:"Helvetica",sans-serif;color:#6B6D71">
</span><span style="font-size:12.0pt;color:#1F497D"><o:p></o:p></span></p>
</td>
<td valign="top" style="padding:11.25pt 0in 0in 0in;height:86.25pt">
<p class="MsoNormal" style="margin-bottom:10.0pt;line-height:115%"><!--[if gte vml 1]><v:shapetype id="_x0000_t75" coordsize="21600,21600" o:spt="75" o:preferrelative="t" path="m@4@5l@4@11@9@11@9@5xe" filled="f" stroked="f">
<v:stroke joinstyle="miter" />
<v:formulas>
<v:f eqn="if lineDrawn pixelLineWidth 0" />
<v:f eqn="sum @0 1 0" />
<v:f eqn="sum 0 0 @1" />
<v:f eqn="prod @2 1 2" />
<v:f eqn="prod @3 21600 pixelWidth" />
<v:f eqn="prod @3 21600 pixelHeight" />
<v:f eqn="sum @0 0 1" />
<v:f eqn="prod @6 1 2" />
<v:f eqn="prod @7 21600 pixelWidth" />
<v:f eqn="sum @8 21600 0" />
<v:f eqn="prod @7 21600 pixelHeight" />
<v:f eqn="sum @10 21600 0" />
</v:formulas>
<v:path o:extrusionok="f" gradientshapeok="t" o:connecttype="rect" />
<o:lock v:ext="edit" aspectratio="t" />
</v:shapetype><v:shape id="Picture_x0020_2" o:spid="_x0000_s1026" type="#_x0000_t75" alt="Description: Description: Description: Description: Verisign™" style='position:absolute;margin-left:3.55pt;margin-top:0;width:54.75pt;height:48pt;z-index:251659264;visibility:visible;mso-wrap-style:square;mso-width-percent:0;mso-height-percent:0;mso-wrap-distance-left:0;mso-wrap-distance-top:0;mso-wrap-distance-right:0;mso-wrap-distance-bottom:0;mso-position-horizontal:right;mso-position-horizontal-relative:text;mso-position-vertical:absolute;mso-position-vertical-relative:line;mso-width-percent:0;mso-height-percent:0;mso-width-relative:page;mso-height-relative:page' o:allowoverlap="f">
<v:imagedata src="cid:image003.png@01D7C663.49E5D520" o:title=" Verisign™" />
<w:wrap type="square" anchory="line"/>
</v:shape><![endif]--><![if !vml]><img width="73" height="64" style="width:.7604in;height:.6666in" src="cid:image003.png@01D7C663.49E5D520" align="right" alt="Description: Description: Description: Description: Verisign™" v:shapes="Picture_x0020_2"><![endif]><span style="font-size:14.0pt;line-height:115%;font-family:"Times New Roman",serif;color:#1F497D"><o:p></o:p></span></p>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> GNSO-TPR <gnso-tpr-bounces@icann.org> <b>On Behalf Of
</b>Julie Hedlund<br>
<b>Sent:</b> Tuesday, October 19, 2021 2:01 PM<br>
<b>To:</b> gnso-tpr@icann.org<br>
<b>Subject:</b> [EXTERNAL] [GNSO-TPR] Notes and action items - TPR WG Meeting #22 - 19 Oct 2021<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<table class="MsoNormalTable" border="0" cellpadding="0" width="1185" style="width:888.75pt;background:#F5ECCE">
<tbody>
<tr>
<td width="1175" style="width:881.25pt;padding:.75pt .75pt .75pt .75pt">
<p><strong><span style="font-family:"Calibri",sans-serif;color:#993300">Caution:</span></strong><span style="color:#993300"> </span><span style="color:black">This email originated from outside the organization. Do not click links or open attachments unless
you recognize the sender and know the content is safe. </span><o:p></o:p></p>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal"><span style="color:black">Dear TPR WG Members,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:black">Please find below the notes and action items from today’s call.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:black">The next TPR WG meeting will be Tuesday,
</span>26<span style="color:black"> October at 1</span>7<span style="color:black">:</span>3<span style="color:black">0 UTC.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"><br>
Best regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:black">Emily, Julie, Berry, and Caitlin </span><o:p></o:p></p>
<p class="MsoNormal"><b><u><span style="color:black"><o:p><span style="text-decoration:none"> </span></o:p></span></u></b></p>
<p class="MsoNormal"><b><u><span style="color:black">Action Items<o:p></o:p></span></u></b></p>
<p class="MsoNormal"><b><u><span style="color:black"><o:p><span style="text-decoration:none"> </span></o:p></span></u></b></p>
<p class="MsoNormal">1. <b>WG members to review the attached revised slides for the ICANN72 session, in particular the updated the definition on slide 8 based on the discussion on the mailing list, as well as slide 12 with the potential recommendations.<o:p></o:p></b></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><b><span style="color:black">Transfer Policy Review Phase 1 - Meeting #2</span>2</b><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:6.0pt;line-height:18.0pt"><b><span style="color:black">Tuesday </span>19
<span style="color:black">October 2021 at 16:00 UTC<o:p></o:p></span></b></p>
<p class="MsoNormal">1. Roll Call & SOI Updates (5 minutes): No updates provided.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">2. Welcome & Chair updates (5 minutes)<o:p></o:p></p>
<ul type="disc">
<li class="MsoListParagraph" style="mso-list:l4 level1 lfo3"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">ICANN72 meeting next week on Tuesday, 26 October at 17:30.</span><span style="font-size:11.0pt"><o:p></o:p></span></li><li class="MsoListParagraph" style="mso-list:l4 level1 lfo3"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Will send around revised slides.</span><span style="font-size:11.0pt"><o:p></o:p></span></li><li class="MsoListParagraph" style="mso-list:l4 level1 lfo3"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">WG member updates: No updates provided.</span><span style="font-size:11.0pt"><o:p></o:p></span></li></ul>
<p class="MsoNormal">3. Deliberations on Additional Security Measures (60 minutes) – See:
<a href="https://secure-web.cisco.com/17FsmhI1n1Aydix8dhFAKY-VZelgnx-EQ2itP8WiEybnLPtId43jVry0Yax8zs9vjLfxK3d3rphpopuMIJr9qDMp6XtgxFjA4hL760ad6BmE6RvtTbnyO0kI7i5aNY9yQq4pwkWrF3IgoKsEwms0pPFXLKHJkhFRC7tzdGM6AAz7SImAtEp-0cK5qinRBKTau5k_micGR8ION_r6O3CUFAsP1wPm-hmcYfiSdc737nsgRa3vjwUH_FoktrOR-2ZEr/https%3A%2F%2Fdocs.google.com%2Fdocument%2Fd%2F1q7xaJuxi50Q6TDD26H92P6wOfZ8luap1wdWOtIgkv7o%2Fedit%3Fusp%3Dsharing">
Additional Security Measures Working Document</a><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Overview:<o:p></o:p></p>
<ul type="disc">
<li class="MsoListParagraph" style="mso-list:l4 level1 lfo3"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Kind of a broad topic, with a focus on locking.</span><o:p></o:p></li><li class="MsoListParagraph" style="mso-list:l4 level1 lfo3"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">How to make the TAC a more consistent standard.</span><o:p></o:p></li><li class="MsoListParagraph" style="mso-list:l4 level1 lfo3"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Locking – mandatory or suggested; if allowed what and how.</span><o:p></o:p></li><li class="MsoListParagraph" style="mso-list:l4 level1 lfo3"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Some registrars impose a 60-day lock and some don’t, and some do something in between.</span><o:p></o:p></li><li class="MsoListParagraph" style="mso-list:l4 level1 lfo3"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Trying to get something that is consistent.</span><o:p></o:p></li></ul>
<p class="MsoNormal"><b>Charter Question: a6) Survey respondents noted that mandatory domain name locking is an additional security enhancement to prevent domain name hijacking and improper domain name transfers. The Transfer Policy does not currently require
mandatory domain name locking; it allows a registrar to NACK an inter-registrar transfer if the inter-registrar transfer was requested within 60 days of the domain name’s creation date as shown in the registry RDDS record for the domain name or if the domain
name is within 60 days after being transferred. Is mandatory domain name locking an additional requirement the Working Group believes should be added to the Transfer Policy?
<o:p></o:p></b></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Discussion:<o:p></o:p></p>
<ul type="disc">
<li class="MsoListParagraph" style="mso-list:l4 level1 lfo3"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Question: Are we dealing with locking in Phase 1 or Phase 2? Answer: We may bring some Phase 2 items into Phase 1. If we get into
a certain level of detail we may hold off. Let’s open up the discussion and see where it goes.</span><o:p></o:p></li><li class="MsoListParagraph" style="mso-list:l4 level1 lfo3"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Context behind the question about what is in Phase 1 and Phase 2: The Additional Security Measures document is asking if domain name
locking should be mandatory. In Phase 2 we also consider reasons for NACKing. The Phase 1 question is a result of survey input.</span><o:p></o:p></li><li class="MsoListParagraph" style="mso-list:l4 level1 lfo3"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">These things are linked, so it’s difficult to see how we can discuss this in a limited context. Do want to make sure that this issue
receives its due addition.</span><o:p></o:p></li><li class="MsoListParagraph" style="mso-list:l4 level1 lfo3"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">It is open for discussion here and if people think we are getting to detailed we can pull back.</span><o:p></o:p></li><li class="MsoListParagraph" style="mso-list:l4 level1 lfo3"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">We need to look at all of the different reasons for domains to be locked; we might want to keep some and take others away.</span><o:p></o:p></li><li class="MsoListParagraph" style="mso-list:l4 level1 lfo3"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Question: What would be the purpose of a mandatory lock? Is it to prevent that a domain name is transferred multiple times – against
an attack? Answer: That is one reason to have the lock, as the charter question notes “to prevent domain name hijacking and improper domain name transfers.”</span><o:p></o:p></li><li class="MsoListParagraph" style="mso-list:l4 level1 lfo3"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Suggest that the first order of business is to look at what the current policy says. It currently isn’t mandatory. Then we should
consider whether they should be mandatory and have some consistency.</span><o:p></o:p></li><li class="MsoListParagraph" style="mso-list:l4 level1 lfo3"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Also consider other questions, such as whether or not there is anything else that needs to happen, who has control, what is the timing?</span><o:p></o:p></li><li class="MsoListParagraph" style="mso-list:l4 level1 lfo3"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Question: Do we have the numbers for domain names that were hacked and were pushed from registrars to others? Answer: Don’t think we
have that specific data, but ICANN Compliance can check.</span><o:p></o:p></li><li class="MsoListParagraph" style="mso-list:l4 level1 lfo3"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Looking back in time, this lock for 60-days was part of IRTP Part B or C. It would mitigate the hops to multiple registrars. The intent
of the lock for 60 days was somewhat watered down or lessened. You had the ability to opt out of the lock, which causes confusion in the marketplace.
</span><o:p></o:p></li><li class="MsoListParagraph" style="mso-list:l4 level1 lfo3"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Maybe we should start with whether post-creation registration locks should be mandatory. Have heard from registrars that this lock is
at the behest of registries, but not sure that is the case. Would like to know more about the policy rationale for this particular kind of lock.<o:p></o:p></span></li><li class="MsoListParagraph" style="mso-list:l4 level1 lfo3"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">We should think about recommendations for how we can obtain the data to help inform a review of the policy, since we don’t have this
level of specific data now.<o:p></o:p></span></li><li class="MsoListParagraph" style="mso-list:l4 level1 lfo3"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">RegistryLock is a service that has to be approved by ICANN as a RSEP (still so if I call correct). Locks set by the registrar must be
changed by the sponsoring registrar. registry lock is very difficult to remove, requires passphrases etc, it's separate from the "Client Transfer Prohibited" EPP status which is applied to domains.<o:p></o:p></span></li><li class="MsoListParagraph" style="mso-list:l4 level1 lfo3"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">We should explicitly link the post-transfer-lock to the Dispute-Policy and make it mandatory for exactly this purpose. Giving a rationale
does increase the acceptance.<o:p></o:p></span></li><li class="MsoListParagraph" style="mso-list:l4 level1 lfo3"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">We can look at the discussions around the last IRTP around the 60-day lock.<o:p></o:p></span></li><li class="MsoListParagraph" style="mso-list:l4 level1 lfo3"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Another reason for low numbers of complaints – not all registrants know about ICANN or how to complain. So some unauthorized transfers
are not being reported.<o:p></o:p></span></li><li class="MsoListParagraph" style="mso-list:l4 level1 lfo3"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">These unauthorized transfers do happen, although there aren’t many of them. Still, the impact is large. We should look at the impact.<o:p></o:p></span></li><li class="MsoListParagraph" style="mso-list:l4 level1 lfo3"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">The big concern is when it gets to 5 different registrars in 5 different countries, so the claw-back process is complicated.<o:p></o:p></span></li><li class="MsoListParagraph" style="mso-list:l4 level1 lfo3"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Some of the pressure on registrars in clawing back these domain names could be ameliorated – if the actual registrant could invoke.
We could consider who should be initiating the different processes.<o:p></o:p></span></li><li class="MsoListParagraph" style="mso-list:l4 level1 lfo3"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">When we are talking about the claw-back, what are we talking about? It could be getting certain assurances from the registrant – perhaps
creating a type of form for registrants, whether mandatory or not. To put the registrar at ease to make this move faster and improve the coordination between registrars.<o:p></o:p></span></li><li class="MsoListParagraph" style="mso-list:l4 level1 lfo3"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">The main point of this charter question is whether there should be a required lock on a transfer. Specifically, “Is mandatory domain
name locking [on a create or transfer] an additional requirement the Working Group believes should be added to the Transfer Policy?” We aren’t talking about a Registry Lock, but a client lock by registrars.<o:p></o:p></span></li><li class="MsoListParagraph" style="mso-list:l4 level1 lfo3"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">The lock after registration and after transfer are two different things and should be treated differently. Identifying what those differences
are is important.<o:p></o:p></span></li><li class="MsoListParagraph" style="mso-list:l4 level1 lfo3"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">The issue for many registrants is not whether locks should be mandatory or not, it is the inconsistent application. It should be consistent
or the registrar’s policy should be transfer.<o:p></o:p></span></li><li class="MsoListParagraph" style="mso-list:l4 level1 lfo3"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Understanding of the current policy is that registrars MAY deny a transfer if a domain name has been transferred in 60 days. Registrars
have the discretion – and the charter question is asking if this lock instead should be mandatory. There are certain instances where the registrar MUST NACK the transfer, such as in UDRP cases.<o:p></o:p></span></li><li class="MsoListParagraph" style="mso-list:l4 level1 lfo3"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Verisign prevents domain names from being transferred for 60 days after being created as part of our system. We don’t get complaints
from registrars during this locking period. Can’t speak for other registries.<o:p></o:p></span></li><li class="MsoListParagraph" style="mso-list:l4 level1 lfo3"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Good to know where the 60-day creation lock came from.<o:p></o:p></span></li><li class="MsoListParagraph" style="mso-list:l4 level1 lfo3"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">How do we standardize on the various options with that discretion?<o:p></o:p></span></li><li class="MsoListParagraph" style="mso-list:l4 level1 lfo3"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">If there is text somewhere else that prevents a transfer we should look into it. Not that we would change that if it’s not policy.<o:p></o:p></span></li><li class="MsoListParagraph" style="mso-list:l4 level1 lfo3"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">It seems it was a legacy – there being systematic enforcement of restricting transfers for 60 days post creation.<o:p></o:p></span></li><li class="MsoListParagraph" style="mso-list:l4 level1 lfo3"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Seems that some WG members agree that the lock should not be mandatory, but discretionary.<o:p></o:p></span></li></ul>
<p class="MsoNormal">Questions from the <i>Transfer Policy Status Report Survey:</i><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><i>Q7) What methods do you use to mitigate domain name hijacking outside of the IRTP framework?</i><o:p></o:p></p>
<ul type="disc">
<li class="MsoListParagraph" style="mso-list:l4 level1 lfo3"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">We’ve kind of talked around this. Maybe a registrar has a reason to lock this.</span><span style="font-family:"Calibri",sans-serif"><o:p></o:p></span></li><li class="MsoListParagraph" style="mso-list:l4 level1 lfo3"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Are there a finite number of scenarios?</span><span style="font-family:"Calibri",sans-serif"><o:p></o:p></span></li><li class="MsoListParagraph" style="mso-list:l4 level1 lfo3"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">If you want to have good security you have to make sure everything is locked at the account level – start with the basics (the account)
and that is something only the registrar can do.</span><span style="font-family:"Calibri",sans-serif"><o:p></o:p></span></li><li class="MsoListParagraph" style="mso-list:l4 level1 lfo3"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">One of our outcomes is not only determining whether or not a lock should be mandatory or optional, but also to make sure we are using
the proper or precise term. </span><span style="font-family:"Calibri",sans-serif"><o:p></o:p></span></li><li class="MsoListParagraph" style="mso-list:l4 level1 lfo3"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Homework: Start to review the different EPP status codes and when we are talking about a lock – what part of the EPP status codes are
being used. Are there opportunities to make it more precise?</span><span style="font-family:"Calibri",sans-serif"><o:p></o:p></span></li><li class="MsoListParagraph" style="mso-list:l4 level1 lfo3"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Can’t always see if there is a lock.</span><span style="font-family:"Calibri",sans-serif"><o:p></o:p></span></li></ul>
<p class="MsoNormal"><i>Q13) Do you lock domains by default upon registration of a name?<o:p></o:p></i></p>
<p class="MsoNormal"><i>Q21) What do you think the ideal transfer process should look like from a policy and a technical perspective?<o:p></o:p></i></p>
<p class="MsoNormal"><i><o:p> </o:p></i></p>
<p class="MsoNormal">– Seems that we’ve covered these questions.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">4. Review: Summary of “Potential Recommendations Under Consideration” to be presented to the community during ICANN72 session (15 minutes) -- See attached revised slides.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><b>ACTION ITEM: WG members to review the attached revised slides for the ICANN72 session, in particular the updated the definition on slide 8 based on the discussion on the mailing list, as well as slide 12 with the potential recommendations.<o:p></o:p></b></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">5. AOB (5 minutes): ICANN72 session: Tuesday, 26 October 2021 at 17:30 UTC<o:p></o:p></p>
</div>
</body>
</html>