<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:x="urn:schemas-microsoft-com:office:excel" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Segoe UI";
panose-1:2 11 5 2 4 2 4 2 2 3;}
@font-face
{font-family:Georgia;
panose-1:2 4 5 2 5 4 5 2 3 3;}
@font-face
{font-family:Montserrat;
panose-1:0 0 5 0 0 0 0 0 0 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I’m glad this is (again) coming up as it is a very important and subtle point.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Please see our (the JAS) report, page 22, section 3.1.6 entitled “Alternatives to Controlled Interruption”, specifically 3.1.8 “Honeypot Approaches” which includes what is being referred to here as “Enhanced Controlled Interruption”:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><a href="https://www.icann.org/en/system/files/files/name-collision-mitigation-final-28oct15-en.pdf">name-collision-mitigation-final-28oct15-en.pdf (icann.org)</a><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I would encourage everyone to (re-) read this section of the report (pp. 22-27) as it contains a thoughtful discussion of these issues, and little has changed in the ensuing 7 years. I will reproduce one relevant bullet:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><i>There are collision scenarios where returning an Internet IP address will cause
<o:p></o:p></i></p>
<p class="MsoNormal"><i>traffic to be sent over the Internet that was never previously sent. Ever
<o:p></o:p></i></p>
<p class="MsoNormal"><i>conscious of “cure being worse than the disease” concerns, we certainly do not
<o:p></o:p></i></p>
<p class="MsoNormal"><i>want to open these hosts to new risks while we try to help them.
<o:p></o:p></i></p>
<p class="MsoNormal"><i>[. . . ]<o:p></o:p></i></p>
<p class="MsoNormal"><i>Controlled interruption should not decrease the security posture of a
<o:p></o:p></i></p>
<p class="MsoNormal"><i>system, even temporarily. Or, as Verisign cleverly said in their public comment,
<o:p></o:p></i></p>
<p class="MsoNormal"><i>we don’t want to risk turning “Controlled Interruption” into “Controlled
<o:p></o:p></i></p>
<p class="MsoNormal"><i>Exfiltration!”<o:p></o:p></i></p>
<p class="MsoNormal"><i><o:p> </o:p></i></p>
<p class="MsoNormal">Verisign noted similar concerns circa 2015 (including their comments to the JAS report) regarding the exfiltration of data that any honeypotting (aka “enhanced controlled interruption”) would cause.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">We also discussed several new liabilities that are created by honeypots – including causing information that would not have otherwise been transmitted over the Internet to be so transmitted (“but for the honeypot”), and the liabilities
operators of the honeypot would face by creating lists of vulnerable hosts, capturing unknown and potentially sensitive data, etc. “Causing” honeypots may also subject others to various liabilities.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">As we said in 2015, and I believe is still the case now: <i>
“</i><i>. . . JAS believes the risk of operating such a honeypot does not justify the value and recommends against such an implementation.”</i><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Said more bluntly, honeypots are one of those things that sound good in theory but become difficult in practice.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Jeff<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">NCAP-Discuss <ncap-discuss-bounces@icann.org> on behalf of Justine Chew <justine.chew.icann@gmail.com><br>
<b>Date: </b>Friday, February 11, 2022 at 10:41 PM<br>
<b>To: </b>Heather Flanagan <hlf@sphericalcowconsulting.com><br>
<b>Cc: </b>"ncap-discuss@icann.org" <ncap-discuss@icann.org><br>
<b>Subject: </b>Re: [NCAP-Discuss] ICANN’s thoughts on controlled interruption<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" align="left" width="100%" style="width:100.0%;cellpadding:0;cellspacing:0;display:table;border-collapse:seperate;float:none">
<tbody>
<tr>
<td style="background:#A6A6A6;padding:5.25pt 1.5pt 5.25pt 1.5pt;valign:middle"></td>
<td width="100%" style="width:100.0%;background:#EAEAEA;padding:5.25pt 3.75pt 5.25pt 11.25pt">
<div>
<p class="MsoNormal" style="mso-element:frame;mso-element-frame-hspace:2.25pt;mso-element-wrap:around;mso-element-anchor-vertical:paragraph;mso-element-anchor-horizontal:column;mso-height-rule:exactly">
<span style="font-size:9.0pt;font-family:"Segoe UI",sans-serif;color:#212121">You don't often get email from justine.chew.icann@gmail.com.
<a href="http://aka.ms/LearnAboutSenderIdentification">Learn why this is important</a><o:p></o:p></span></p>
</div>
</td>
<td width="75" style="width:56.25pt;background:#EAEAEA;padding:5.25pt 3.75pt 5.25pt 3.75pt;align:left">
</td>
</tr>
</tbody>
</table>
<div>
<div>
<p class="MsoNormal">Hi Heather,<br>
<br>
Thanks for this. <br>
<br>
I'd like to ask please, in your review of reports, advisories etc relevant to Controlled Interruptions and Enhanced Controlled Interruptions, did you come across any explanations (preferably not exclusively in technical language) of the privacy and legal risks
associated with the honeypot approach? Might this have been highlighted in SAC 062 (although I didn't quite spot any in a quick scan of this), or perhaps in SAC 066 and/or the JAS report? <br clear="all">
<o:p></o:p></p>
<div>
<div>
<div>
<p class="MsoNormal"><br>
<span style="color:black">Thanks in advance for the assist,<br>
</span><br>
<span style="color:black">Justine</span><o:p></o:p></p>
</div>
</div>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Fri, 11 Feb 2022 at 05:52, Heather Flanagan <<a href="mailto:hlf@sphericalcowconsulting.com" target="_blank">hlf@sphericalcowconsulting.com</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div name="messageBodySection">
<div>
<p class="MsoNormal"><span style="font-family:Montserrat">In the chat of yesterday’s call, Ruben wanted to know why ICANN had decided against Enhanced Controlled Interruption in the past. The information I was thinking of is in their Name Collision Framework
from July 2014:</span><br>
<br>
<span style="font-family:Montserrat">"</span><span style="font-size:12.5pt;font-family:"Georgia",serif">ICANN is interested in maintaining the reliability, security and stability of the DNS and the Internet. </span><span style="font-size:12.5pt"><br>
</span><span style="font-size:12.5pt;font-family:"Georgia",serif">As such, ICANN is interested in providing a good notification measure for those parties that may be </span><span style="font-size:12.5pt"><br>
</span><span style="font-size:12.5pt;font-family:"Georgia",serif">leaking queries intended for private namespaces to the public DNS. However, ICANN is also aware of </span><span style="font-size:12.5pt"><br>
</span><span style="font-size:12.5pt;font-family:"Georgia",serif">the privacy and legal risks associated with the honeypot approach described in SAC 062 and 066 and </span><span style="font-size:12.5pt"><br>
</span><span style="font-size:12.5pt;font-family:"Georgia",serif">the JAS report. ICANN has decided on balancing the good notification features offered by using the </span><span style="font-size:12.5pt"><br>
</span><span style="font-size:12.5pt;font-family:"Georgia",serif">loopback address option with its superior privacy protection vs. the use of a honeypot. "</span><span style="font-size:12.5pt"><br>
<br>
</span><a href="https://www.icann.org/en/system/files/files/name-collision-framework-30jul14-en.pdf" target="_blank"><span style="font-family:Montserrat">https://www.icann.org/en/system/files/files/name-collision-framework-30jul14-en.pdf</span></a><br>
<br>
<br>
<span style="font-family:Montserrat">I think the text will need to be clear in our recommendations why the discussion group thinks this decision by ICANN must be revisted by the Board.</span><o:p></o:p></p>
</div>
</div>
<div name="messageSignatureSection">
<p class="MsoNormal"><o:p> </o:p></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" style="border-collapse:collapse;border-radius:0px">
<tbody>
<tr>
<td style="padding:.75pt .75pt .75pt .75pt">
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="100%" style="width:100.0%">
<tbody>
<tr>
<td valign="top" style="padding:0in 10.5pt 7.5pt 0in">
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="66" style="width:49.5pt">
<tbody>
<tr>
<td style="padding:0in 0in 0in 0in">
<p class="MsoNormal"><span style="border:solid windowtext 1.0pt;padding:0in"><img border="0" width="66" height="60" style="width:.6875in;height:.625in" id="_x0000_i1029" src="cid:~WRD0004.jpg" alt="Image removed by sender."></span><o:p></o:p></p>
</td>
</tr>
</tbody>
</table>
</td>
<td width="100%" valign="top" style="width:100.0%;padding:0in 0in 7.5pt 0in">
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="100%" style="width:100.0%">
<tbody>
<tr>
<td style="padding:0in 0in 0in 0in">
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="100%" style="width:100.0%">
<tbody>
<tr>
<td width="100%" style="width:100.0%;padding:0in 0in 0in 0in">
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="100%" style="width:100.0%">
<tbody>
<tr>
<td style="padding:0in 0in 0in 0in">
<p style="margin:0in;line-height:12.6pt"><b><span style="font-size:10.5pt;font-family:"Arial",sans-serif;color:#45668E">Heather Flanagan</span></b><br>
<span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#444444">Spherical Cow Consulting</span><o:p></o:p></p>
</td>
</tr>
</tbody>
</table>
</td>
<td valign="bottom" style="padding:0in 0in .75pt 37.5pt">
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" align="right" width="100%" style="width:100.0%;float:right">
<tbody>
<tr>
<td style="padding:0in 0in 0in 0in">
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0">
<tbody>
<tr>
<td style="padding:0in 4.5pt 0in 0in">
<p class="MsoNormal" align="center" style="text-align:center"><a href="http://linkedin.com/in/hlflanagan/" target="_blank"><span style="color:windowtext;text-decoration:none"><span style="font-size:8.5pt;color:#444444;border:solid windowtext 1.0pt;padding:0in"><img border="0" width="24" height="24" style="width:.25in;height:.25in" id="_x0000_i1028" src="cid:~WRD0004.jpg" alt="Image removed by sender."></span></span></a><o:p></o:p></p>
</td>
<td style="padding:0in 4.5pt 0in 0in">
<p class="MsoNormal" align="center" style="text-align:center"><a href="http://twitter.com/sphcow" target="_blank"><span style="color:windowtext;text-decoration:none"><span style="font-size:8.5pt;color:#444444;border:solid windowtext 1.0pt;padding:0in"><img border="0" width="24" height="24" style="width:.25in;height:.25in" id="_x0000_i1027" src="cid:~WRD0004.jpg" alt="Image removed by sender."></span></span></a><o:p></o:p></p>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
<tr>
<td colspan="2" style="padding:0in 0in 0in 0in">
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="100%" style="width:100.0%">
<tbody>
<tr style="height:9.75pt">
<td style="padding:0in 0in 0in 0in;height:9.75pt">
<p class="MsoNormal" style="line-height:0%"><span style="font-size:1.0pt"> <o:p></o:p></span></p>
</td>
</tr>
<tr style="height:.75pt">
<td style="border:none;border-top:solid #BDBDBD 1.0pt;padding:0in 0in 0in 0in;height:.75pt">
<p class="MsoNormal" style="line-height:0%"><span style="font-size:1.0pt"> <o:p></o:p></span></p>
</td>
</tr>
<tr style="height:10.5pt">
<td style="padding:0in 0in 0in 0in;height:10.5pt">
<p class="MsoNormal" style="line-height:0%"><span style="font-size:1.0pt"> <o:p></o:p></span></p>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
<tr>
<td style="padding:0in 0in 0in 0in">
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0">
<tbody>
<tr>
<td style="padding:0in 0in 0in 0in">
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0">
<tbody>
<tr>
<td style="padding:0in 0in 4.5pt 0in">
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0">
<tbody>
<tr>
<td style="padding:0in 0in 0in 0in">
<p class="MsoNormal" style="line-height:10.5pt"><b><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#45668E;border:solid windowtext 1.0pt;padding:0in"><img border="0" width="32" height="32" style="width:.3333in;height:.3333in" id="_x0000_i1026" src="cid:~WRD0004.jpg" alt="Image removed by sender."></span></b><b><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#45668E"><o:p></o:p></span></b></p>
</td>
<td width="5" style="width:3.75pt;padding:0in 0in 0in 0in">
<p class="MsoNormal" style="line-height:0%"><span style="font-size:1.0pt;font-family:"Arial",sans-serif"> <o:p></o:p></span></p>
</td>
<td style="padding:0in 0in 0in 0in">
<p class="MsoNormal" style="line-height:10.5pt"><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#212121">Translator of Geek to Human</span><span style="font-size:9.0pt;font-family:"Arial",sans-serif"><o:p></o:p></span></p>
</td>
</tr>
</tbody>
</table>
</td>
<td style="padding:0in 0in 4.5pt 0in">
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0">
<tbody>
<tr>
<td style="padding:0in 4.5pt 0in 4.5pt"></td>
<td style="padding:0in 0in 0in 0in">
<p class="MsoNormal" style="line-height:10.5pt"><b><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#45668E;border:solid windowtext 1.0pt;padding:0in"><img border="0" width="32" height="32" style="width:.3333in;height:.3333in" id="_x0000_i1025" src="cid:~WRD0004.jpg" alt="Image removed by sender."></span></b><b><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#45668E"><o:p></o:p></span></b></p>
</td>
<td width="5" style="width:3.75pt;padding:0in 0in 0in 0in">
<p class="MsoNormal" style="line-height:0%"><span style="font-size:1.0pt;font-family:"Arial",sans-serif"> <o:p></o:p></span></p>
</td>
<td style="padding:0in 0in 0in 0in">
<p class="MsoNormal" style="line-height:10.5pt"><span style="font-size:9.0pt;font-family:"Arial",sans-serif"><a href="mailto:hlf@sphericalcowconsulting.com" target="_blank"><span style="color:#212121;text-decoration:none">hlf@sphericalcowconsulting.com</span></a><o:p></o:p></span></p>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</td>
<td style="padding:0in 0in 0in 0in"></td>
</tr>
<tr>
<td colspan="2" style="padding:0in 0in 0in 0in">
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="100%" style="width:100.0%">
<tbody>
<tr style="height:6.0pt">
<td style="padding:0in 0in 0in 0in;height:6.0pt">
<p class="MsoNormal"><span style="font-size:1.0pt"> <o:p></o:p></span></p>
</td>
</tr>
<tr style="height:.75pt">
<td style="border:none;border-top:solid #BDBDBD 1.0pt;padding:0in 0in 0in 0in;height:.75pt">
<p class="MsoNormal" style="line-height:0%"><span style="font-size:1.0pt"> <o:p></o:p></span></p>
</td>
</tr>
<tr style="height:6.0pt">
<td style="padding:0in 0in 0in 0in;height:6.0pt">
<p class="MsoNormal"><span style="font-size:1.0pt"> <o:p></o:p></span></p>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal"><span style="display:none"><o:p> </o:p></span></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0">
<tbody>
<tr>
<td style="padding:0in 0in 0in 0in"></td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal"><span style="display:none"><o:p> </o:p></span></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" style="opacity:0">
<tbody>
<tr style="height:.75pt">
<td width="1" style="width:.75pt;padding:0in 0in 0in 0in;height:.75pt">
<p class="MsoNormal"><span style="font-size:1.0pt"><o:p></o:p></span></p>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<p class="MsoNormal"><span style="color:black">_______________________________________________</span><br>
NCAP-Discuss mailing list<br>
<a href="mailto:NCAP-Discuss@icann.org" target="_blank">NCAP-Discuss@icann.org</a><br>
<a href="https://mm.icann.org/mailman/listinfo/ncap-discuss" target="_blank">https://mm.icann.org/mailman/listinfo/ncap-discuss</a><br>
<br>
_______________________________________________<br>
By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (<a href="https://www.icann.org/privacy/policy" target="_blank">https://www.icann.org/privacy/policy</a>)
and the website Terms of Service (<a href="https://www.icann.org/privacy/tos" target="_blank">https://www.icann.org/privacy/tos</a>). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style
delivery or disabling delivery altogether (e.g., for a vacation), and so on.<o:p></o:p></p>
</blockquote>
</div>
</div>
</div>
</body>
</html>