<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On 22 Feb 2022, at 16:46, James Galvin <<a href="mailto:galvin@elistx.com" class="">galvin@elistx.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class="">
<meta http-equiv="Content-Type" content="text/xhtml; charset=utf-8" class="">
<div class=""><div style="font-family: sans-serif;" class=""><div class="plaintext" style="white-space: normal;"><p dir="auto" class="">Excellent questions, Jeff. Speaking personally, I think your questions fit in that space between purely technical and purely legal. policy, and business.</p><p dir="auto" class="">I would say we are obligated to inform the Board with our best advice on how to interpret the data showing the existence of name collisions and then how to review mitigation and remediation plans. So we have to say something about your questions, beyond just listing them.</p><p dir="auto" class="">I don’t think we’re going to be able to propose a solution that is 100% predictable though. I’d be delighted to be educated differently.</p><p dir="auto" class="">Other folks should certainly offer their own ideas for how to answer your questions. Here are some ideas from me for folks to consider.</p><p dir="auto" class="">1. ECI is conducted, data is collected (details still to be defined), and data is made available to Applicant and Technical Review Team.</p><div class=""><br class=""></div></div></div></div></div></blockquote><br class=""></div><div><br class=""></div>I would to like to pick this part to highlight the issues with controlled exfiltration (aka ECI) and its relation to GNSO Policy. <div class="">On one hand, if the data is made available to the more parties, the privacy concerns skyrocket. Not only the data is transmitted over the Internet, but it also goes to 3 parties (honeypot operator, applicant, technical review team). </div><div class="">On the other hand, if the data is only available to the review team, one piece of the GNSO policy is not satisfied, that the data is available (even with customary research restrictions and non-disclosures). </div><div class=""><br class=""></div><div class="">So, which way it goes ? No good answers, exactly because the current report is "all-in" in the controlled exfiltration idea, instead of at least suggesting a different path as alternative. </div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">Rubens</div><div class=""><br class=""></div></body></html>