[registrars] FW: Information regarding Data Escrow

[Tim Cole]

Forwarded Response from Kurt Pritz:

Ricardo,

Thank you for your message.  Some other registrars raised this same sort of
general concern when ICANN initially discussed potential candidates, some of
whom are registrars. Most of these general concerns were alleviated when
Iron Mountain emerged as the potential provider. The reasons why the
concerns of other registrars were alleviated are described below. 

Please understand that Iron Mountain completed this questionnaire and we
undertook this registrar feedback process precisely to identify and mitigate
potential risks Iron Mountain could pose due to possible conflicts of
interest.  (It is also worth noting that the conflicts questionnaire was
drafted through a collaborative process involving multiple registrars.)

As background, ICANN solicited proposals to operate the Registrar Data
Escrow (RDE) service through a competitive Request for Proposals (RFP) and
selected a provider based on all criteria, not just one factor, such as
technical competence, reputation, accreditation status, and price.  In
reviewing all proposals received, Iron Mountain presented the most
comprehensive solution, and will provide the most secure and competent RDE
service to registrars.  

Bear in mind that the RDE service will not be simple by any measure. For
example, ICANN's RDE provider will be required to store up to 25 terabytes
per year, dedicate substantial bandwidth to receiving data, coordinate the
on-boarding efforts of roughly 900 registrars in under six months, and
provide detailed reporting to ICANN for compliance testing.  We learned
through our RFP process that this is not a service that most existing data
storage providers can provide, particularly with the robust level of support
that will be required.  ICANN's first priority is that the RDE
program/service be accomplished securely and competently.  This means,
locating the best-qualified service provider.  While we obviously would not
select an otherwise qualified provider whom we felt could not be trusted due
to conflicts or other risks, we are assured that the processes described and
proposed measures to be taken by Iron Mountain adequately address many of
the risks posed by their selection.  Through negotiation of a contract, Iron
Mountain will make the necessary warranties to ensure registrar data is not
misused.

The possibility that ICANN could retain an accredited registrar to provide
RDE services was raised, generally, at the ICANN meeting in San Juan.
Interestingly, in surveying several registrars about Iron Mountain
specifically, most, if not all, indicated Iron Mountain would be an
acceptable RDE provider, despite its operation of domain name-related
businesses.  In fact, more than one of the registrars surveyed indicated
that they are already Iron Mountain data-storage customers.

In talking to registrars, one of the key distinctions made between Iron
Mountain and other, more traditionally retail-facing registrars is that Iron
Mountain's primary business is "trust."  Iron Mountain has, for over fifty
years, provided secure document (and later data) storage and escrow services
to thousands of people, businesses, and government customers.  Like the
registrars we spoke to, we do not believe Iron Mountain would sacrifice its
reputation and primary line of business in order to gain a competitive
advantage in the domain name marketplace.  

This is obviously a very critical moment for ICANN and the greater internet
community.  We have now the opportunity to operationalize the RDE service
and put into place this secondary layer of security for registrants and all
users of the DNS.  While we appreciate that not every registrar may find
ICANN's selection of an RDE provider to be optimal, our goal is to choose
the provider that will most effectively and securely carry out our mission
to protect registrants and other stakeholders through the RDE program.  

While I hope that you find that this information relieves your concerns,
your registrar has the right to opt-out by selecting a different,
third-party escrow agent no matter who is ultimately selected as the ICANN
provider. Thanks in advance for reading and considering this information.
Please feel free to write me directly with additional questions you might
have.  Please also be assured that your opinion will be carefully considered
in the decision-making process.

Thanks again for your feedback.

Best,

Kurt Pritz

ICANN
4676 Admiralty Way, #330
Marina del Rey. CA  90292


-----Original Message-----
From: owner-registrars at gnso.icann.org
[mailto:owner-registrars at gnso.icann.org] On Behalf Of ricardo at nomer.com.br
Sent: Thursday, August 09, 2007 8:33 AM
To: Registrars Constituency; Nevett, Jonathon
Cc: Tim Cole
Subject: RE: [registrars] FW: Information regarding Data Escrow
Importance: High

Dear Fellows:

After read the atached letter for me its clear that there is a HUGE conflict
of interest. An ICANN accredited Registrar to escrow other Registrars ? No,
sorry. Even with a very specific confidentiality contract and policy... we
might opt for a diff provider...

Could you redirect this email to Mike cc Kurt?

Are the other proposals so weak ???

Best Regards,

Ricardo Vaz Monteiro
Nomer.com