Tracking Tool

Brenda to share a Doodle poll with options for the webinar.

Heather to make the minor adjustments to the document discussed during the call.

Russ to send a note to the email list to advise team members who were not on the call of the changes discussed and agreed to by those in attendance. He will ask for those not on the call to raise any concerns that they have on list.

Staff to find out the process and timeline for next steps on the NCAP study, if ICANN org plans to publish a view on the report, and if so, when?

Eric to fill in the response column in the spreadsheet here for recommendation 21 where commenters support to say ‘noted’ or ‘thanks’.

Jennifer to recirculate to the SSR2 list the document containing the proposal for recommendation 29, with the instruction for team members to review and comment ahead of next week’s meeting.

SSR2 members to review and share any comments on the proposal for recommendation 29 in the document here ahead of next week’s meeting.

Alain to contact Zarko regarding how to move forward with recommendation 23.

Team members to review the Risk subteam text ahead of the 1 July meeting.

Laurin to review the recommendation 4 text in different documents and merge them ahead of next week’s meeting.

Q: It would be great if we could get updates on SSAC recommendations in SAC101v2, SAC097,  and the 4 suggestions in :

https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_en_system_files_files_ssac2019-2D02-2D03may19-2Den.pdf&d=DwICAg&c=FmY1u3PJp6wrcrwll3mSVzgfkbPSS6sJms7xcl4I5cM&r=VuRMFw6YascG5ysc1jEHBZgGTtD6QSLrFmqdvMx5FM8&m=BbASPz11QOHrRR5GgjJOp5C9L51Y_6k_tF1cLAskF2Y&s=FnnX_E-dhahAAb2ZkNVh9WqJvF14cFkJXQ2WR8XQXx4&e=

1. "ICANN Org issue guidance to all registry operators, clarifying expectations for reporting port 43 queries and RDAP queries. The guidance should make clear the purposes and goals of the data collection and the contractual obligations.
2. SSAC believes that a purpose of gathering the data is to document queries made by the users (consumers) of the registration data service. Registry  operators should exclude the queries they make to their own systems.
3. It is vital that ICANN collect valid, accurate data regarding RDAP queries. The WHOIS query data is unreliable, but the move to RDAP offers an opportunity to get things right.
4. ICANN Org's Global Domains Division and Compliance Department should examine the reporting of other metrics per the registry contracts. In  SAC097, the SSAC pointed out irregularities in the reporting of other registry metrics, such as web-based WHOIS queries. The current issue raises the question of whether metrics such as DNS queries are being reported accurately, if they too involve the reporting of self-queries, etc.

ICANN org to send an invite to the team for the DAAR call on 24 June.

3) The blog states (the obvious) that ICANN isn’t a regulator of Internet content, but it doesn’t address ICANN’s public interest remit. Multiple entities have asked ICANN to better govern the manner in which domain names are registered, and now especially, everyone is asking ICANN to hold contracted parties to greater accountability to prevent domains from being registered by malicious actors, especially for pandemic-related fraud and abuse. This requires greater scrutiny during the registration process.

> What actions are ICANN taking that address this?

> In addition to high volumes of fraudulent domain names containing pandemic-related strings with which criminals try to fool Internet users, random looking or otherwise auto-generated names that are easy to register in volume and are being used by the hundreds to perpetuate pandemic-related phishing attacks. What actions are ICANN taking that addresses this?

> Recommended actions contained in SSR2’s draft report could help mitigate pandemic-related domain name abuse. Is the ICANN Board and staff reconsidering any of these actions?

> Recommendations from others over the last few years also would help mitigate pandemic-related domain name abuse – especially the substantially increased phishing attacks that harm users. Is the ICANN Board and staff reconsidering any of these actions?

Including:

> - will ICANN move to ensure domain name registrant data is validated? Or at least implement cross-field validation?

> - will ICANN put in place an Acceptable Use Policy that applies specifically to parties that register large numbers of domains, that requires registrants to apply for (and be validated for) bulk registration services? Further, will ICANN put in place an obligation to distinguish domain names registered by legal entities from those registered by > natural persons, classify parties that use bulk registration services as legal entities, and require unredacted access to the registration data of legal entities?

> - will ICANN maintain and publish a current list of validated bulk registrants (who are from above defined as not natural persons)?

> - will ICANN disallow registration transactions that involve large numbers of random-looking algorithmic domain names? > - will ICANN disallow, for a period of one year, the re-registration of any bulk-registered domain name that has been used in a criminal cyberattack?

2) What distinguishes ICANN's participation in the face of the pandemic from how they've participated in the past?

> The blog says: “ICANN Compliance uses data collected in audits (described in more detail below) to assess whether registries and registrars are adhering to their DNS security threat obligations.”

> What will Compliance do that it has not done until now?

> Is Compliance making audit data associated with US-based registrars available to States Attorney Generals and the US Attorney General?

1) The blog says: " the domain names and the data collected by the system will be shared with parties
who are in a position to take action, such as registrars and registries, and in some cases with national and international law enforcement organizations."

> What specific actions is ICANN expecting registries and registrars to take? > For example, is ICANN encouraging suspension of name resolution or of the registration, or the registrant account?

> Will ICANN ask registrars and registries to report on the efficacy of these actions? If so, when and on what cadence?

> ICANN should publicly report per registrar & registry action: > How many names has it identified as suspicious/malicious?

> What’s the number of domain names that each registry/registrar has taken action against? And what action was taken? > When can we expect ICANN public reporting and on what cadence?

Staff to update the work plan based on the review team’s new completion date.

Kaveh and staff to confirm the latest available information is included in the Privacy text.

Heather and Kerry-Ann to work on cleaning up the ‘Privacy’ text.

Russ to ask team members with outstanding writing assignments to notify the list once the text is in the Google doc.

Staff to invite SMEs to the 8 January plenary call, as discussed with the review team.

Heather to note page numbers of the outstanding writing tasks in the Google doc (see second tab).

Russ to send a note to the list to seek volunteers for a review of the name collision findings, and the data access recommendation

Review team members to think about lessons learned that can be shared. Team will have a work topic on this area in the future.

Team members to complete writing assignments in the Google doc ahead of the call next week. Team members to input text are Denise, Kerry-Ann, Matogoro, Eric, Scott, and Laurin.

Denise to provide clarifying text in the Google doc to address Heather’s questions 1 and 8.

Team to share comments on the CCT implementation plan draft public comment from SSR2 Review Team by 8 October.

Staff to start the process of engaging a contractor for the Policy Researcher role.

Staff to work with Meetings Team to plan for this face-to-face meeting in DC.

Team members to share feedback on the compliance text discussed on the call. See the text in documents here and here.

Staff to ask ICANN IT to address the security issues with Zoom on Mac.

Kerry-Ann and Norm to add references to the strategic plan to their draft recommendations.

Russ will add the names of the penholders to each of the recommendations in the Google doc for ease of reference.

Denise to follow up with Eric and Laurin to confirm they have no updates to the work plan. Once confirmed, leadership team to advise staff to post the updated work plan to the wiki.

Jennifer to work with KC to recover recommendation ‘L’ text to the document.

Angie to follow up on email with people assigned to the recommendations that are not included in the v3 recommendations document here.

Jennifer to re-send the two Google document links to the team with a reminder of the work request.

KC will send a note to the team with a proposal for recommendation 18.

Review team plans to update the workplan document in Brussels.

Denise, Laurin, Zarko will look through the team’s SSR1 recommendations work for quality assurance and report back to team.

Team to collectively discuss how to address items that are blocked

Staff to follow up with SMEs on the outstanding answers to get these ahead of the Brussels meeting.

Review team members to work on topic item write-ups to be ready for the Brussels meeting.

All team members to keep working on their topic items.

Boban to send a follow-up question today for staff based on the written responses provided to previous questions.

Review team members to continue working on the items in the table, in time for Brussels.

Staff to draft a note for Russ to send out to community SO/ACs to ask for time on the agenda to present the recommendations in Marrakech.

Staff to contact Noorul to remind him he is the 'lead' on the future challenges item: Root server system protection: assess the threatscape of top threats (e.g. DDoS to the root system)

Staff to send a reminder to everyone to check volunteer document to see their involvement and be ready to provide an update on next week’s call.

ICANN org to find out re: ITHI - how is it different from ODI, where does it get its data (from internal collection or external data) and where is its data.  

ICANN org to ask ICANN Ops about ODI to determine current status and location of ODI related items

Staff to share contact information with each of the review team members individually. 

Lead RT members bolded in the doc here to reach out to other volunteers listed for the topic and drive the process for developing text.

KC to take the lead in research on any follow up from SSAC074, Denise offered to help.

KC, Denise, Laurin, Alain, Scott to have a discussion with the RSSAC and SSAC regarding recommendation 23 (team members to volunteer if they want to participate). KC will talk to RSSAC/ SSAC chairs to set this up

Denise to work with staff to set up a meeting with CCT RT members in Kobe, and any other groups/individuals the review team may wish to find time with in Kobe. 

Staff to send calendar invites for the writing time slots and room locations.

Staff to go through the volunteers document and list how many questions are outstanding for each of the topics.

Jennifer to finalize the slides. Content is finalized, formatting only required.

Team members to continue working on the text for ICANN SSR, Future Challenges and DNS SSR worksteams.

Volunteers to do own research on future challenges topics

Future Challenges topic: Coalescence of registrars/registry/backend operators for multiple TLDs - Norm to research

Kerry-Ann to work with staff to arrange a meeting with the workstream volunteers for future challenges.

Eric will put straw man text together for the DNS SSR items reviewed the call, and send to the volunteers for each item for input.

Staff to Identify a couple of hours on the 12^th and 13^th March in Kobe for the SSR2 Review Team to work on the report.

Cryptosystems topic moved to Future Challenges - ICANN org to update team documents accordingly.

Team members to share any preferences for countries in Europe that are easy to meet based on your visa requirements. 

Create a page that captures all Google documents that the team is working on to identify the most current versions.

SSR1 workstream: Laurin to fix intro to SSR1 section and recirculate to the list go through the SSR1 recommendations, circulate to team for final review.

Staff to share ICANN SSR and Future Challenges questions with SMEs and obtain answers, track status on the wiki.

Denise to send a proposed edit to the workplan to the list.

RT members to add questions to the DNS SSR workstream by EOD Tuesday 5 February

Leadership team to reach out to ICANN org management to let them know the importance of receiving answers to questions in a timely manner

Staff to circulate updated workplan to the list. Team to review ahead of the call on Thursday, where there will be a call for approval.

Staff to draft a blog post coming out of this meeting to highlight the teams progress, status of work, invitation to reach out via the mailing list if there is an interest to set up meetings consultation in Kobe.

ICANN SSR workstream & Future challenges workstream: Staff to pull out the list of questions from the ICANN SSR and Future Challenges workstream topic for team’s review on Thursday.

Send a save the date for 17^th, 18^th, 19^th May face-to-face meeting in Europe. Exact locations TBD.

Staff to circulate the table of volunteers for each workstream item, team members to add their names to topics they wish to work on.

Team to discuss a potential face-to face meeting in May 2019 during the January meeting in LA. Staff to give travel and meetings team the heads up.

Leadership team will go through the changes in the document after the deadline, ahead of the consensus call to be held in LA during face-to-face meeting.

Team members to use suggestion mode to make any final suggestions to the text in the Google document by Tuesday 22 January 23:59 UTC.

Eric will share DNS SSR topics to the list - for team member input

Add to leadership agenda for next week, Amin's resignation.

Team members to complete Doodle poll for a potential f2f meeting in May (poll to be circulated on list). 

Leadership will develop a draft agenda for the January f2f meeting. Team members to email suggestions to Russ ahead of Monday’s leadership call. 

Jennifer to circulate information to the list that is on the wiki and would be helpful fo the team.

Scott will input text for SSR1 recommendations 17 & 18 into the Google doc.

Kerry-Ann to input text to Google doc to explain that text for SSR1 recommendations 25 and 26 is contained within the text for recommendation 27.

Noorul to input text to the Google doc regarding overlap between recommendations 24 and 28, and that text for both recommendations is merged. 

Team members to input draft text into the SSR1 recommendations Google doc using the findings recorded by the review team. Russ to send a reminder. Penholders are indicated in the document.  

Team members to review the DNS SSR preamble text and share any additional comments in the document or on-list ahead of the 10 January plenary call. 

KC to reach out to Naveed regarding recommendation 23 draft text.

Staff to post updated work plan as circulated to the list and approved on the 20 December.

Penholders to draft text for team review for each SSR1 recommendation, using the Google doc here: https://docs.google.com/document/d/1WwzmsBDEtI0uvrxqSIs7zaBZRalZkC-TwO1VE_pN_7A/edit. Use the same structure as recommendation 4, which Laurin presented on the call. 

RT members who did research on the SSR1 Recommendations to start write up of findings. For recommendations that have more than one person researching it, they should collaborate on the write-up.

Team to review preamble documents (ICANN SSR, Future Challenges and DNS SSR when available) and add comments to the doc. Review of preambles will be added to the agenda of the next call (20 December)

Russ to send note to Eric to find out the estimated delivery date of the DNS SSR subgroup preamble text.

Staff to connect with meetings team to check on estimated date for notifications regarding LA meeting. 

Staff to create a new google doc with the approved SSR1 preamble and ensure all RT members have access to it, so the write-up of findings can start.

Leadership will post a draft of proposed outreach (blog) to the list for Review Team input.

Team to progress work on-list between now and Barcelona, with the aim of team members sharing initial strawman proposals on all SSR1 recommendations between now and Barcelona in Google doc.

Kaveh to clarify if there is any disagreement from the Board on the approach regarding sending Terms of Reference to the Board as an FYI only

Provide responses to questions on SSR1 briefing: Recommendations 11, 12.

11

Draft note and summary of SSR1 implementation for ICANN to send to SSR1 team members and invite them to share their assessment with the SSR2-RT.

Advise if the sub-team requires an NDA to access, and provide access to requested documents.

9 Oct 2017

Provide access to Business continuity plan for PTI.

• Plan for migration
• What kind of failure rollover documentation do you have. Day-to-day. Failure rollover.

9 Oct 2017

9 Oct 2017

9 Oct 2017

9 Oct 2017

9 Oct 2017

9 Oct 2017

• ICANN SSR team provided list of questions, shared with SME.
• EBERO operator responded with questions for the team. Shared on Trello. Response provided by team and shared with SME for progression.
• ICANN has sent a request to EBERO operators to gauge interest.

• Meeting request on hold.
• Proposed time slots sent to subteam via email.

• Action item cleared at re-start.
• Community webinars scheduled and information shared with the review team via email.
• Briefing confirmed for 25 June 2017. Postponed per Co-Chairs.

• Action item cleared at re-start
• Briefing scheduled for 3 November. Cancelled.
• Asked Co-Chairs via email to advise if meeting with members of the drafting team should be scheduled in Abu Dhabi.
• Briefing scheduled for 5 September 2017. Plenary meeting cancelled.
• Briefing confirmed for 25 July 2017. Postponed per Co-Chairs
• Briefing confirmed for 26 June 2017. Postponed per Co-Chairs.

11

Draft a Statement of Work for specialist technical writer: Co-Chairs to provide guidance on the scope of work and other requirements for the engagement of the technical writer.

Co-Chairs

• Action item cleared at restart
• ICANN Org provided outline of procurement process and input via email to support development of Statement of Work.

Review Team/Phil to add ‘consultant support’ as a discussion topic to the DC agenda. 

Phil to finalize summary slides of subgroup progress, and work with staff to suggest any edits/additions to the wiki that might help new members with summarizing work to date. 

Team to share any absences they expect to have during the f2f meeting via email with Phil as well as any additional feedback to the draft session plan that was circulated to the list. 

Staff to provide a brief email summary of the position arrived at by the review team regarding the NDA prior to the pause (include NDA as attachment to the email).

Staff to complete task of posting records of leadership meetings and emails to the wiki.

Team members to provide Phil with suggestions on how to recommence review work in preparation for the DC meeting

Phil to update meeting record of previous meeting, August 2, and re-circulate. 

Staff to share information about options to meet in Barcelona and circulate a Doodle poll.

Include budget discussion in the DC meeting objectives

Phil to circulate a draft session plan for the DC meeting prior to the next review team meeting.

Phil to circulate a request for volunteers to produce a narrative of methodology used to determine scope of work, division of work/subgroups (incl. progress)

ICANN org to pull together a SSR1 implementation package (briefing materials, SSR1 implementation related questions) for posting on the ICANN wiki

ICANN org to find out what the current FY budget is 

Phil to summarize and share stock-take on the status of the review team’s work.

ICANN org to provide an overview of restrictions associated scheduling during ICANN meetings

Phil to provide a summary of deliverables established in contract

ICANN org to provide Phil with information on meeting room layout/size etc.

ICANN org to send meeting minutes to Phil for edits

ICANN org to submit a request for a two-day face-to-face meeting prior to ICANN63 

Review team members who require a letter of invitation for visa procedures are asked to send a request to ssr2-staff@icann.org by 23:59 UTC on Friday 6 July.

Staff to circulate Doodle poll to the team re: team’s next conference call meeting. Suggested date for meeting, week of July 3rd.

Phil to work with co-chairs to prepare agenda/materials ahead of the next meeting for RT members to respond to.

Eric and Denise to draft a digest of reading materials ahead of the face-to-face meeting and share with the RT for feedback.

Report to Team on potential room availability at ICANN meeting for sub-group meetings during week.

Subteam rapporteurs to prepare a short status update for the presentations to the SO/AC groups in Abu Dhabi

Send calendar invites for Team meeting days in Abu Dhabi and additional invites as meetings are scheduled.

Calendar invites for confrmed meetings, including outreach sessions, sent to team.

ICANN org to arrange meeting with Board Caucus group in Abu Dhabi.

Provide responses to questions from SSR1 briefings (Ops + Finance).

ICANN Org

• Clarification requested from Review Team for question 2.

Answers provided in Google document and circulated to Review Team.

75, b. Provide responses to draft questions for ICANN Chief Innovation & Information Officer (CIO).

75. a. Prepare draft questions for ICANN Chief Innovation & Information Officer (CIO). Questions will be sent to the CIO in preparation for holding a briefing for the RT.

75.b. ICANN Org

75. a. SSR2-RT

• Draft audit plan document reviewed with SMEs and ICANN SSR subgroup during face-to-face meeting in Los Angeles.
• 75.a. Questions sent to ICANN CIO.

Review Team members to review the Non-Disclosure Agreement and Confidential Disclosure Framework documents and raise any questions on the list.

Try www.trello.com and give your feedback on email list. Co-Chairs will assume Team members are comfortable using this unless otherwise informed.

Access granted and request sent via Trello for all team members to access the SSR2 Review Team boards. See action item 166 for workaround for team members unable to access Trello.

Respond to ICANN Travel ASAP & make flight reservations to travel to Abu Dhabi for the face-to-face meeeting.

Break out IANA subteam document requests in order of priority to help expedite access to documents, once NDAs have been finalized and signed.

Team members to indicate which work item topics they wish to volunteer for. Boban to mirror in Trello.

Staff to explore options for team members who are unable to access Google docs/Trello

Staff to circulate send a final version of Future Challenges topics list to plenary email list for approval by the plenary – allow 7 days for Review Team approval on list.

Provide feedback to the IANA subgroup team on how quickly team can expect access to documents requested once NDAs are finalized and signed.

SSR2 to share thoughts on ICANN SSR scope related discussion on email list

ICANN Org to share ICANN SSR subgroup audit plan and the document ‘SSR2_sub_topic_ICANN.SSR’ on email list. 

ICANN Org to circulate update to list of staff members attending LA subgroup meeting.

Review Team members to share expected outcomes of outreach meetings in Abu Dhabi to the list to ensure team is in alignment. 

Add “ICANN SSR sub-team scope discussion” as item #1 to 26 September plenary agenda

ICANN Org to circulate a Doodle poll and schedule a conference call next week to prepare for LA

ICANN Org to publish agenda and participants of the ICANN SSR subgroup meeting in LA by Monday 25 September, 23:59 UTC to the subgroup wiki and email list.

Question for ICANN: Regarding the SSR implications of the .avianca tld https://www.icann.org/uploads/compliance_notice/attachment/957/serad-to-reyes-19sep17.pdf[icann.org] situation, i.e when and where do the decisions on enforcement of non compliance get evaluated for SSR impact (in this case where a gTLD is AWOL but for months no actual action is taken).

Gap analysis RFP published to ICANN.org.

Review Team agreed to proceed with release of gap analysis specifications document on 26 September plenary call.

• 'Clean' RFP document and revised procurement process overview circulated to Co-Chairs 9/14. Co-Chairs to approve document for ICANN Procurement final review.
• Edits provided on list. Further updates may be provided based on ICANN's response to action item 145.

Determine appropriate person to ask for training documentation for processes and procedures for PTI staff.

Provide additional information about soliciting consultants with a budget under $50k (no RFP needed), and the difference between engaging a consultant and an “independent expert.”

Team to provide feedback on the structure of the 9 work items, including identifying items which staff may be able to provide more information or help build out.

11

Updated Per meeting 24: James and Kerry-Ann will provide briefing to Review Team on Non-Disclosure Agreement (NDA) and associated documents, when available. 

Review non-disclosure form with ICANN Legal and report back to RT on any updates or edits to the circulated form.

James Gannon, Kerry-Ann Barrett

• Revised draft NDA and Confidential Disclosure Agreement circulated to review team via email.
• James provided update to team via email.
• Meeting to review revised documents scheduled with ICANN Legal Friday 18th August 2017.
• Discussion with ICANN Legal took place on 5 June 2017. Kerry-Ann and James to follow-up with redline edits to document.

Documents circulated to the list (29 August) and overview provided by Kerry-Ann on plenary meeting 27 (12 September).

• 43. b. Follow-up via email: Could you please clarify when ITHI will start regularly publishing (or giving the public access to) data? It seems that the “schedule” below is about discussions rather than production, or am I misunderstanding?

• 43. a. Provide the SSR2 RT a timeline of the ITHI project, when they have clarity on next steps and schedules.

ICANN Org

• 43. a. Email circulated to Review Team 26 June 2017.

The ICANN security team (now OCTO/SSR) developed a framework that provided a definition for "security".  The SSR2 team used that definition. The Board response to the Terms of Reference expressed that this definition is too broad for the Review Team’s use. Is Board asking staff to redefine definition of “security”?

• ICANN staff working to schedule webinars for the community.
• Briefing confirmed for 25 June 2017. Postponed per Co-Chairs.

Community webinars scheduled and information shared with the review team via email.

Request ICANN Legal to be present at ICANN SSR face-to-face meeting, October 9-10 to rule on availability of documents.

• Process for sharing confidential documents is in development. Team updated via email.

Update sent to the review team via email. Replaced by action item 144.

Send calendar invites for Team meeting days in Brussels, 22-24 January, and report to Team on how soon can ICANN travel can book arrangements.

Calendar invites distributed to team.

Welcome email/initial travel correspondence sent to review team from ICANN Travel.

1. Fix the broken links in the Final Implementation Report and ensure that relevant references have links (if it’s noted in the report as relevant to implementation, please make sure there’s a link to information about it).
2. Put all the documentation/information (links) for each Recommendation together in one place. Some are linked in the Final Implementation Report, some are listed under “Background Materials” in our wiki and others…. ?
3. In each Recommendation, provide completion dates for each listed “deliverable” that has a check-mark under “due date” instead of an actual date

See completed action item 104 for progress notes regarding related previous request.

Outline in writing a request to meet with ICANN staff responsible for Information Security Management, Auditing, Risk Management and Business Continuity Management. Request to include details of expected goals and outcomes of the meeting.

Sub-team realignment: Reply on email list to Eric’s Aug 14 note about folding sub-group calls into Tuesday Team call to increase engagement and visibility

Circulate outline of detailed work items and proposed next steps after face-to-face meeting.

Žarko, Boban

Finalize questions for ICANN subject-matter experts during potential ICANN SSR subgroup meeting in LA. Distribute to staff so they can identify appropriate resources.

Confirm approval of ICANN SSR subgroup potential face-to-face meeting in LA

• Cost estimate and staff availability circulated via email to Review Team.
• Doodle poll closed. Email circulated identifying 9-10 October as most popular dates.
• Staff requested via email additional information regarding meeting objectives/ desired outcomes.

Report on results of NDA meeting with ICANN Legal scheduled for 18 August.

Report to Co-chairs on outreach emails to ICANN groups regarding requested meetings in Abu Dhabi

Provide costing of ICANN SSR face-to-face meeting in LA, 9 and 10 October.