[IRT.RegDataPolicy] Homework Item #149 - Section 11.6

[Roger D Carney]

Good Afternoon,

I thought it was probably easier to consume this information in an email versus trying to shoehorn it into comments on the OneDoc.

After spending some more time reviewing Recommendation 18 (and resulting OneDoc section 11), I think I have been able to extract some useful bits of information that may help resolve any misunderstandings of the requirements from this recommendation. This is a bit lengthy, so you may want to grab a favorite drink and some snacks before you start reading:).

I believe that the IRT generally agrees (please correct me if this is not the case) that sections 11.1-11.4, 11.7 and 11.8 make sense and seem to implement the relevant pieces of Recommendation 18 appropriately (though it does appear that there are some new changes occurring/occurred today, that will need to be reviewed). The concern and focus of discussions have been on sections 11.5 and 11.6.

With that in mind. Paragraph 5 of Recommendation 18 makes the distinction between acknowledgement and response: "The EPDP Team recommends that criteria for a Reasonable Request for Lawful Disclosure and the requirements for acknowledging receipt of a request and response to such request will be defined as part of the implementation of these policy recommendations but will include at a minimum:"

The "timeline section" of Recommendation 18 also makes this distinction between acknowledgement and response. Bullet 1 discusses specifically acknowledging of requests:
"Response time for acknowledging receipt of a Reasonable Request for Lawful Disclosure. Without undue delay, but not more than two (2) business days from receipt, unless shown circumstances does not make this possible."
Bullets two (response data) and three (logging) are not about timing but bullets four and five are and they specifically address the "response" to the request. Bullet four is about the response requirements for requests in general:
"Response time for a response to the requestor will occur without undue delay, but within maximum of 30 days unless there are exceptional circumstances. Such circumstances may include the overall number of requests received. The contracted parties will report the number of requests received to ICANN on a regular basis so that the reasonableness can be assessed.";
and bullet five is about response requirements for urgent requests:
"A separate timeline of [less than X business days] will considered for the response to ‘Urgent’ Reasonable Disclosure Requests, those Requests for which evidence is supplied to show an immediate need for disclosure [time frame to be finalized and criteria set for Urgent requests during implementation].".

It appears the One Doc section 11.5 (general requests) does a pretty good job of separating these two concepts and addressing bullets one and four:
"Registrars and Registry Operators MUST acknowledge receipt of a Reasonable Request for Lawful Disclosure within 2 business days but no more than 3 calendar days from receipt, and MUST respond without undue delay, but within thirty (30) calendar days from receipt absent exceptional circumstances."
Three notes on these One Doc wording: 1) 3 calendar days is not part of the recommendation and I do not support the addition as it changes the requirements from the recommendation; 2) the One Doc wording does not contain the "unless shown circumstances does not make this possible." wording from the recommendation but does state "absent exceptional circumstances", not sure why the change; 3) Recommendation 18 states 30 days not 30 calendar days.

But the One Doc section 11.6 (urgent requests) does not correctly separate the two concepts (acknowledge and response), nor does it accurately portray the wording in the recommendation. Section 11.6 actually conflates these two concepts (acknowledge and response) and in doing so no longer states the requirements correctly (creates new policy):
"For an Urgent Reasonable Request for Lawful Disclosure which meets the format required by the Registrar or Registry Operator, Registrars and Registry Operators MUST acknowledge and respond without undue delay, but within 24 hours from receipt.  If responding to an Urgent Reasonable Request for Lawful Disclosure is complex, or a large number of requests are received by a Registrar or a Registry Operator within a 24 hour period, Registrars or Registry Operators MAY extend the time for response up to an additional two (2) calendar days from the date of receipt of the Urgent Reasonable Request for Lawful Disclosure, provided Registrars or Registry Operators provide notice to the requestor within the initial 24 hour period and explain the need for an extension of time."

I don't know if it makes more sense to have two sections, one for acknowledgment and one for response (with two sub points: general and urgent) or if it is better like it is in the One Doc, one for general and one for urgent just repeating the acknowledgement wording. Here are a couple proposals; the first, similar to what the One Doc has now:

  *   Registrars and Registry Operators MUST acknowledge receipt of a Reasonable Request for Lawful Disclosure within two (2) business days from receipt, and MUST respond without undue delay, but within thirty (30) calendar days from receipt absent exceptional circumstances.
  *   For an Urgent Reasonable Request, those Requests for which evidence is supplied to show an immediate need, for Lawful Disclosure, Registrars and Registry Operators MUST acknowledge receipt of a Reasonable Request for Lawful Disclosure within two (2) business days from receipt, and MUST respond without undue delay, but within one (1) business day from receipt absent exceptional circumstances.  If responding to an Urgent Reasonable Request for Lawful Disclosure is complex, or a large number of requests are received by a Registrar or a Registry Operator within a 24 hour period, Registrars or Registry Operators MAY extend the time for response up to an additional two (2) business days from the date of receipt of the Urgent Reasonable Request for Lawful Disclosure, provided Registrars or Registry Operators provide notice to the requestor within the initial 24 hour period and explain the need for an extension of time.

As a second option, I think it may be easier/clearer to read/understand like this (which aligns much closer to Recommendation 18 wording):

  *   Registrars and Registry Operators MUST acknowledge receipt of a Reasonable Request for Lawful Disclosure within two (2) business days from receipt.
  *   Registrars and Registry Operators MUST respond to a Reasonable Request for Lawful Disclosure:
     *   For an Urgent Request, those Requests for which evidence is supplied to show an immediate need: without undue delay, but within one (1) business day from receipt absent exceptional circumstances. If responding to an Urgent Reasonable Request for Lawful Disclosure is complex, or a large number of requests are received by a Registrar or a Registry Operator within a 24 hour period, Registrars or Registry Operators MAY extend the time for response up to an additional two (2) business days from the date of receipt of the Urgent Reasonable Request for Lawful Disclosure, provided Registrars or Registry Operators provide notice to the requestor within the initial 24 hour period and explain the need for an extension of time.
     *   For all other requests: without undue delay, but within thirty (30) days from receipt absent exceptional circumstances.

I hope after reading this novel that I have been able to clarify what the requirements are from Recommendation 18.


Thanks
Roger

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mm.icann.org/pipermail/irt.regdatapolicy/attachments/20210420/479b20d6/attachment-0001.html>