[gnso-dow123] Revised WHOIS Task Force draft minutes 14 August 2006
[To: gnso-dow123[at]gnso.icann.org] Dear Task Force Members, Please find the revised draft minutes of the call on August 14, 2006 indicating that the GNSO Policy officer was on vacation and excused from the call and (Note: The relevant task force input was provided by staff, during the subsequent task force call on 28 August, 2006.) Please let me know what changes you would like made. Thank you very much. Kind regards, Glen ............................................................................ WHOIS Task Force 14 August - Minutes ATTENDEES: GNSO Constituency representatives: Jordyn Buchanan - Chair gTLD Registries constituency - David Maher gTLD Registries constituency - Simon Sheard Registrars constituency - Tom Keller Internet Service and Connectivity Providers constituency - Greg Ruth Internet Service and Connectivity Providers constituency - Maggie Mansourkia Intellectual Property Interests Constituency - Ute Decker (in place of Steve Metalitz) Intellectual Property Interests Constituency - Niklas Lagergren Commercial and Business Users constituency - Marilyn Cade Commercial and Business Users Constituency - David Fares Nominating Committee appointee - Avri Doria Liaisons At-Large Advisory Committee (ALAC) liaisons - Wendy Seltzer - excused GAC Liaison - Suzanne Sene - absent ICANN Staff: Olof Nordling - Manager, Policy Development Coordination Maria Farrell - GNSO Policy Officer - apologies (on vacation) GNSO Secretariat - Glen de Saint Géry Absent: gTLD Registries constituency - Ken Stubbs - excused Internet Service and Connectivity Providers constituency - Tony Harris - excused Commercial and Business Users Constituency - Sarah Deutsch Intellectual Property Interests Constituency - Steve Metalitz -excused Registrars constituency - Ross Rader - excused Registrars constituency - Paul Stahura Registrars constituency - Tim Ruiz (alternate) Non Commercial Users Constituency - Frannie Wellings Non Commercial Users Constituency - Kathy Kleiman Non Commercial Users Constituency - Milton Mueller MP3 Recording Agenda: 1. Review Jordyn Buchanan's summary of consequences and concerns related to removing data elements from WHOIS 2. Next steps: forward suggestions to remedy concerns. 3 Current timeline and what is needed to complete the Preliminary Task Force Report in October. 4. How do we notify people of the changes to Whois, including the definition of various roles? 5. Is expert advice needed to complete the task force work. (Note: The relevant task force input was provided by staff, during the subsequent task force call on 28 August, 2006.) Marilyn Cade suggested reviewing the Task Force terms of reference and examining whether concluding the OPOC proposal concluded the terms of reference. In addition Marilyn noted that outreach was needed to the other Supporting Organisations and Advisory Committees. 1. Review Jordyn Buchanan's summary of consequences and concerns related to removing data elements from WHOIS **** Removing Registrant Mailing Address 1) This makes it difficult to determine jurisdiction. As a result, may not know which laws apply or where to file a complaint. Governmental agencies may not know which domains they have jurisdiction over. [It was noted during the call that registrants agreed to be sued in the location of the registrant and that the OPOC might work to pass on these types of notices.] 2) Some types of problems are best resolved by getting in touch with the registrant. Removing the mailing address may impede a communications channel that often allows for expeditious resolution of a problem related to a domain name (e.g. legal problems). 3) Removing the address prevents abuses of the WHOIS server that may put the registrant in physical danger or result in chilling effects on speech. Also prevents fraudulent notices sent to registrants regarding renewal of their domain name. *** Replacing admin and technical contact with operational point of contact 1) The admin contact in some cases is a person who can directly resolve certain types of issues (e.g. trademark or copyright issues). Removing these [On the call, some participants noted that they thought the OPOC was simply a streamlined admin contact and could address these same issues] 2) There may be some delay introduced by not having direct contact with the contacts. 3) Some businesses need to list more than one type of contact because different groups deal with different types of problems. [Solution: Ross proposed, and amended the proposal, to require registrars to accept at least two OPOC's if the registrant wanted to provide them (the registrant must always list one OPOC)] 99) [Also, Marilyn noted that we need to discuss how to communicate these changes/responsibilities to registrants. Not a direct concern to this change, but a more general issue.] *** Removing contact data from registry output 1) This data may now server as a backup when registrars do not provide it. (Study cited indicating there was no data for 3% of WHOIS lookups) [Note: most domains are in com/net, so this backup wouldn't work] [TF will request that staff provide a list of registrars and their authoritative WHOIS servers as well as a summary of how many WDRP complaints are related to registrars not providing any WHOIS data in response to a query.] 2) Registrars have some concerns about the facilitation of transfers until EPP auth codes are implemented by all registries.
Jordyn Buchanan reminded the group that the aim in discussing the OPOC proposal was is to improve it by addressing concerns. Ute Decker commented that there should be a name to identify the person and removing the details of the registrant could cause a problem, for example to determine whether or not he had a trade mark licence. In addition there could be a delay introduced by not having direct contact and what would happen if the OPOC did not respond. Marilyn Cade commented on the OPOC's job function responsibilities and whether timely passing on of notices was part of the OPOC responsibility. Failure to respond could be failure of the OPOC to pass on the notice rather than registrant failure to respond. The question was raised as to where the OPOC appointment would be filed. If the OPOC was intended to improve accuracy, then what would be the consequences of giving false and misleading information There was discussion about how the existing proxy registration services would be dealt with under the OPOC, would they continue to exist, or would they be supplanted by the OPOC. 3 Current timeline and what is needed to complete the Preliminary Task Force Report in October. The Preliminary Report should cover: - the remaining terms of reference, - topics discussed in the OPOC proposal, - a summary of the work, - policy recommendations, - any input from experts - document additional outreach undertaken. Constituency statements should be solicited and limited to the OPOC proposal. It was noted that the GNSO review acknowledged that the Policy Development Process (PDP) was not perfect and that a task force would often expand or adapt the PDP , but this should be documented and the GNSO Council should be apprised of these modifications. Jordyn Buchanan referred to the remaining terms of reference,2,3,4. (2) Define the purpose of the Registered Name Holder, technical, and administrative contacts, in the context of the purpose of WHOIS, and the purpose for which the data was collected. Use the relevant definitions from Exhibit C of the Transfers Task force report as a starting point (from http://www.icann.org/gnso/transfers-tf/report-exhc-12feb03.htm): (3) Determine what data collected should be available for public access in the context of the purpose of WHOIS. Determine how to access data that is not available for public access. The current elements that must be displayed by a registrar are: - The name of the Registered Name; - The names of the primary nameserver and secondary nameserver(s) for the Registered Name - The identity of Registrar (which may be provided through Registrar's website); - The original creation date of the registration; - The expiration date of the registration; - The name and postal address of the Registered Name Holder; - The name, postal address, e-mail address, voice telephone number, and (where available) fax number of the technical contact for the Registered Name; and - The name, postal address, e-mail address, voice telephone number, and (where available) fax number of the administrative contact for the Registered Name. (4) Determine how to improve the process for notifying a registrar of inaccurate WHOIS data, and the process for investigating and correcting inaccurate data. Currently a registrar "shall, upon notification by any person of an inaccuracy in the contact information associated with a Registered Name sponsored by Registrar, take reasonable steps to investigate that claimed inaccuracy. In the event Registrar learns on inaccurate contact information associated with a Registered Name it sponsors, it shall take reasonable steps to correct that inaccuracy." Jordyn noted that the 'Registered name holder ' needed additional language,while the technical and admin contacts fell under the OPOC proposal. TOR 4 is addressed in the second last section of the opoc proposal. http://forum.icann.org/lists/gnso-dow123/msg01057.html 'Correcting Inaccurate WHOIS Data; In addition to preserving the existing requirement for Accredited Registrars to promptly update registration records when a Registered Name Holder provides them with updated information, Registrars must also positively respond to notices of alleged inaccuracies in a timely manner. Specifically, when a Registrar receives notice of an alleged inaccuracy in the WHOIS record for a particular domain name; the Registrar must notify the Operational Point of Contact or the Registered Name Holder in a timely manner. The oPOC or the Registered Name Holder must correct the alleged inaccuracy or defend the accuracy of the data, also in a timely manner. If the oPOC or the Registered Name Holder does not update the contact record with corrected information within this time period, the Registrar must either place the domain name on “hold” or revoke the registration. Before accepting the new information, the Registrar must verify that the oPOC or the Registered Name Holder is contactable using the new email address provided. If the basis for the original complaint of inaccurate data included data elements other than the e-mail address, the Registrar must take reasonable steps to validate corrections to these other data elements before accepting them. A standardized mechanism should be used to convey notices of alleged inaccuracy from the internet community and distribute them to the relevant registrar. The view of the author of the OPOC proposal, data that is not available for public access could be obtained though a legal procedure. This was flagged as an area for discussion. 5. Is expert advice needed to complete the task force work? Jordyn Buchanan referred to Bruce Tonkin's email about a possible expert, Mr Stephen Lau, Chairman of EDS Hong Kong and also a Director of Honk Kong Internet Registration Corporation Limited (.hk), who offered his services to assist the WHOIS task force. "Stephen K.M. Lau, Chairman of EDS Hong Kong, was the first Privacy Commissioner for Personal Data for Hong Kong (1996-2001) with responsibility to promote and enforce compliance with The Personal Data (Privacy) Ordinance, which was enacted to provide adequate protection for the use of an individual's personal data in both the public and private sectors." Consultation with experts should follow a determined process and the task force should establish the purpose of the consultation as well as come to an agreement on how to identify experts. There should be the opportunity to hear from proposed experts throughout the work of the task force. Further outreach should include informed input in areas where it is needed, from independent sources, but the selection of experts should wait for a process to be in place. There was general agreement that there were no identified areas where expert advice was needed. However, it was felt that additional data gathering was necessary, as indicated in the GNSO Council resolution 20060720-03 1) The ICANN staff will review a representative sample of registrar agreements with Registered Name Holders, taking into account the issues of geographical diversity and rule of law variances, to identify some of the purposes for which registrars collect Personal Data in the course of registering a domain name for their customers. (2) The ICANN staff will review a representative sample of cctld registry or cctld registrar agreements with registrants, taking into account the issues of geographical diversity and rule of law variances, to identify some of the purposes for which these organisations collect Personal Data from registrants. There was general agreement that outreach was a high priority but that independents experts were not required. Additional outreach proposals consisted of: - consultation with the ccTLD managers - enquire on the progress for the discussion between the GAC, the GNSO Council and the WHOIS task force on the principles of WHOIS - probability of a GAC /Council working session in Sao Paulo built around the council resolution - intercessional calls with the GAC and the GNSO Council consulting on the OPOC proposal were proposed for October. - conference calls to collect input and public comments. - invite Steve Crocker, Security and Stability Advisory Committee (SSAC) and the Regional Internet Registries RIRs Timelines: September 2006 outreach calls with SSAC and RIRs October 2006 outreach call with GAC Proposed areas for discussion on next call and on the mailing list: 1. How to notify people of changes 2. Intersection of the proxy registrations to the OPOC proposals 3. How to access data that is no longer available as a result of the changes 4. Proposals relating to improvement of the OPOC 5. Review staff feed back on whether or not the registry services are used as a backup to registrars on WHOIS contact data. Next Calls: Monday, SEPTEMBER 18, 2006 Address concerns of the OPOC proposal Monday SEPTEMBER 25, 2006 Discuss Preliminary report Jordyn Buchanan proposed closing the call and thanked everyone for their participation. Next Task Force Call: August 28, 2006 at 7:30 LA, 10:30 EST, 14:00 UTC, 16:30 CET. see: http://gnso.icann.org/calendar/#augWHOIS Task Force 14 August - Minutes ATTENDEES: GNSO Constituency representatives: Jordyn Buchanan - Chair gTLD Registries constituency - David Maher gTLD Registries constituency - Simon Sheard Registrars constituency - Tom Keller Internet Service and Connectivity Providers constituency - Greg Ruth Internet Service and Connectivity Providers constituency - Maggie Mansourkia Intellectual Property Interests Constituency - Ute Decker (in place of Steve Metalitz) Intellectual Property Interests Constituency - Niklas Lagergren Commercial and Business Users constituency - Marilyn Cade Commercial and Business Users Constituency - David Fares Nominating Committee appointee - Avri Doria Liaisons At-Large Advisory Committee (ALAC) liaisons - Wendy Seltzer - excused GAC Liaison - Suzanne Sene - absent ICANN Staff: Olof Nordling - Manager, Policy Development Coordination Maria Farrell - GNSO Policy Officer - apologies (on vacation) GNSO Secretariat - Glen de Saint Géry Absent: gTLD Registries constituency - Ken Stubbs - excused Internet Service and Connectivity Providers constituency - Tony Harris - excused Commercial and Business Users Constituency - Sarah Deutsch Intellectual Property Interests Constituency - Steve Metalitz -excused Registrars constituency - Ross Rader - excused Registrars constituency - Paul Stahura Registrars constituency - Tim Ruiz (alternate) Non Commercial Users Constituency - Frannie Wellings Non Commercial Users Constituency - Kathy Kleiman Non Commercial Users Constituency - Milton Mueller MP3 Recording Agenda: 1. Review Jordyn Buchanan's summary of consequences and concerns related to removing data elements from WHOIS 2. Next steps: forward suggestions to remedy concerns. 3 Current timeline and what is needed to complete the Preliminary Task Force Report in October. 4. How do we notify people of the changes to Whois, including the definition of various roles? 5. Is expert advice needed to complete the task force work. (Note: The relevant task force input was provided by staff, during the subsequent task force call on 28 August, 2006.) Marilyn Cade suggested reviewing the Task Force terms of reference and examining whether concluding the OPOC proposal concluded the terms of reference. In addition Marilyn noted that outreach was needed to the other Supporting Organisations and Advisory Committees. 1. Review Jordyn Buchanan's summary of consequences and concerns related to removing data elements from WHOIS **** Removing Registrant Mailing Address 1) This makes it difficult to determine jurisdiction. As a result, may not know which laws apply or where to file a complaint. Governmental agencies may not know which domains they have jurisdiction over. [It was noted during the call that registrants agreed to be sued in the location of the registrant and that the OPOC might work to pass on these types of notices.] 2) Some types of problems are best resolved by getting in touch with the registrant. Removing the mailing address may impede a communications channel that often allows for expeditious resolution of a problem related to a domain name (e.g. legal problems). 3) Removing the address prevents abuses of the WHOIS server that may put the registrant in physical danger or result in chilling effects on speech. Also prevents fraudulent notices sent to registrants regarding renewal of their domain name. *** Replacing admin and technical contact with operational point of contact 1) The admin contact in some cases is a person who can directly resolve certain types of issues (e.g. trademark or copyright issues). Removing these [On the call, some participants noted that they thought the OPOC was simply a streamlined admin contact and could address these same issues] 2) There may be some delay introduced by not having direct contact with the contacts. 3) Some businesses need to list more than one type of contact because different groups deal with different types of problems. [Solution: Ross proposed, and amended the proposal, to require registrars to accept at least two OPOC's if the registrant wanted to provide them (the registrant must always list one OPOC)] 99) [Also, Marilyn noted that we need to discuss how to communicate these changes/responsibilities to registrants. Not a direct concern to this change, but a more general issue.] *** Removing contact data from registry output 1) This data may now server as a backup when registrars do not provide it. (Study cited indicating there was no data for 3% of WHOIS lookups) [Note: most domains are in com/net, so this backup wouldn't work] [TF will request that staff provide a list of registrars and their authoritative WHOIS servers as well as a summary of how many WDRP complaints are related to registrars not providing any WHOIS data in response to a query.] 2) Registrars have some concerns about the facilitation of transfers until EPP auth codes are implemented by all registries.
Jordyn Buchanan reminded the group that the aim in discussing the OPOC proposal was is to improve it by addressing concerns. Ute Decker commented that there should be a name to identify the person and removing the details of the registrant could cause a problem, for example to determine whether or not he had a trade mark licence. In addition there could be a delay introduced by not having direct contact and what would happen if the OPOC did not respond. Marilyn Cade commented on the OPOC's job function responsibilities and whether timely passing on of notices was part of the OPOC responsibility. Failure to respond could be failure of the OPOC to pass on the notice rather than registrant failure to respond. The question was raised as to where the OPOC appointment would be filed. If the OPOC was intended to improve accuracy, then what would be the consequences of giving false and misleading information There was discussion about how the existing proxy registration services would be dealt with under the OPOC, would they continue to exist, or would they be supplanted by the OPOC. 3 Current timeline and what is needed to complete the Preliminary Task Force Report in October. The Preliminary Report should cover: - the remaining terms of reference, - topics discussed in the OPOC proposal, - a summary of the work, - policy recommendations, - any input from experts - document additional outreach undertaken. Constituency statements should be solicited and limited to the OPOC proposal. It was noted that the GNSO review acknowledged that the Policy Development Process (PDP) was not perfect and that a task force would often expand or adapt the PDP , but this should be documented and the GNSO Council should be apprised of these modifications. Jordyn Buchanan referred to the remaining terms of reference,2,3,4. (2) Define the purpose of the Registered Name Holder, technical, and administrative contacts, in the context of the purpose of WHOIS, and the purpose for which the data was collected. Use the relevant definitions from Exhibit C of the Transfers Task force report as a starting point (from http://www.icann.org/gnso/transfers-tf/report-exhc-12feb03.htm): (3) Determine what data collected should be available for public access in the context of the purpose of WHOIS. Determine how to access data that is not available for public access. The current elements that must be displayed by a registrar are: - The name of the Registered Name; - The names of the primary nameserver and secondary nameserver(s) for the Registered Name - The identity of Registrar (which may be provided through Registrar's website); - The original creation date of the registration; - The expiration date of the registration; - The name and postal address of the Registered Name Holder; - The name, postal address, e-mail address, voice telephone number, and (where available) fax number of the technical contact for the Registered Name; and - The name, postal address, e-mail address, voice telephone number, and (where available) fax number of the administrative contact for the Registered Name. (4) Determine how to improve the process for notifying a registrar of inaccurate WHOIS data, and the process for investigating and correcting inaccurate data. Currently a registrar "shall, upon notification by any person of an inaccuracy in the contact information associated with a Registered Name sponsored by Registrar, take reasonable steps to investigate that claimed inaccuracy. In the event Registrar learns on inaccurate contact information associated with a Registered Name it sponsors, it shall take reasonable steps to correct that inaccuracy." Jordyn noted that the 'Registered name holder ' needed additional language,while the technical and admin contacts fell under the OPOC proposal. TOR 4 is addressed in the second last section of the opoc proposal. http://forum.icann.org/lists/gnso-dow123/msg01057.html 'Correcting Inaccurate WHOIS Data; In addition to preserving the existing requirement for Accredited Registrars to promptly update registration records when a Registered Name Holder provides them with updated information, Registrars must also positively respond to notices of alleged inaccuracies in a timely manner. Specifically, when a Registrar receives notice of an alleged inaccuracy in the WHOIS record for a particular domain name; the Registrar must notify the Operational Point of Contact or the Registered Name Holder in a timely manner. The oPOC or the Registered Name Holder must correct the alleged inaccuracy or defend the accuracy of the data, also in a timely manner. If the oPOC or the Registered Name Holder does not update the contact record with corrected information within this time period, the Registrar must either place the domain name on “hold” or revoke the registration. Before accepting the new information, the Registrar must verify that the oPOC or the Registered Name Holder is contactable using the new email address provided. If the basis for the original complaint of inaccurate data included data elements other than the e-mail address, the Registrar must take reasonable steps to validate corrections to these other data elements before accepting them. A standardized mechanism should be used to convey notices of alleged inaccuracy from the internet community and distribute them to the relevant registrar. The view of the author of the OPOC proposal, data that is not available for public access could be obtained though a legal procedure. This was flagged as an area for discussion. 5. Is expert advice needed to complete the task force work? Jordyn Buchanan referred to Bruce Tonkin's email about a possible expert, Mr Stephen Lau, Chairman of EDS Hong Kong and also a Director of Honk Kong Internet Registration Corporation Limited (.hk), who offered his services to assist the WHOIS task force. "Stephen K.M. Lau, Chairman of EDS Hong Kong, was the first Privacy Commissioner for Personal Data for Hong Kong (1996-2001) with responsibility to promote and enforce compliance with The Personal Data (Privacy) Ordinance, which was enacted to provide adequate protection for the use of an individual's personal data in both the public and private sectors." Consultation with experts should follow a determined process and the task force should establish the purpose of the consultation as well as come to an agreement on how to identify experts. There should be the opportunity to hear from proposed experts throughout the work of the task force. Further outreach should include informed input in areas where it is needed, from independent sources, but the selection of experts should wait for a process to be in place. There was general agreement that there were no identified areas where expert advice was needed. However, it was felt that additional data gathering was necessary, as indicated in the GNSO Council resolution 20060720-03 1) The ICANN staff will review a representative sample of registrar agreements with Registered Name Holders, taking into account the issues of geographical diversity and rule of law variances, to identify some of the purposes for which registrars collect Personal Data in the course of registering a domain name for their customers. (2) The ICANN staff will review a representative sample of cctld registry or cctld registrar agreements with registrants, taking into account the issues of geographical diversity and rule of law variances, to identify some of the purposes for which these organisations collect Personal Data from registrants. There was general agreement that outreach was a high priority but that independents experts were not required. Additional outreach proposals consisted of: - consultation with the ccTLD managers - enquire on the progress for the discussion between the GAC, the GNSO Council and the WHOIS task force on the principles of WHOIS - probability of a GAC /Council working session in Sao Paulo built around the council resolution - intercessional calls with the GAC and the GNSO Council consulting on the OPOC proposal were proposed for October. - conference calls to collect input and public comments. - invite Steve Crocker, Security and Stability Advisory Committee (SSAC) and the Regional Internet Registries RIRs Timelines: September 2006 outreach calls with SSAC and RIRs October 2006 outreach call with GAC Proposed areas for discussion on next call and on the mailing list: 1. How to notify people of changes 2. Intersection of the proxy registrations to the OPOC proposals 3. How to access data that is no longer available as a result of the changes 4. Proposals relating to improvement of the OPOC 5. Review staff feed back on whether or not the registry services are used as a backup to registrars on WHOIS contact data. Next Calls: Monday, SEPTEMBER 18, 2006 Address concerns of the OPOC proposal Monday SEPTEMBER 25, 2006 Discuss Preliminary report Jordyn Buchanan proposed closing the call and thanked everyone for their participation. Next Task Force Call: August 28, 2006 at 7:30 LA, 10:30 EST, 14:00 UTC, 16:30 CET. see: http://gnso.icann.org/calendar/#aug -- Glen de Saint Géry GNSO Secretariat - ICANN gnso.secretariat[at]gnso.icann.org http://gnso.icann.org |