<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"
"http://www.w3.org/TR/REC-html40/loose.dtd">
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
<title></title>
</head>
<body style="font-family:Arial;font-size:14px">
<p>Milton,<br>
You quoted the first sentence and the last sentence of my email; let’s read the middle now. You gave us options and we chose one. You can’t take that back now.<br>
<br>
Further, our position is not alone or an outlier. We chose Option 1 in a discussion in this stakeholder group – on this list – with clear agreement that it is virtually impossible for our community to differentiate legal/natural persons. That’s been our NCSG position for years (and became the GNSO position on the Proxy/Privacy Accreditation Working Group)!<br>
<br>
What you have shown – through hard and diligent effort – is that it is virtually impossible to phrase questions to Registrants at the time of registration on legal/natural persons in a fair, clear, legally-valid and informative way. You tried hard; others did too. But it didn’t work; it’s likely impossible to do because the law is complicated. <strong>That’s why we chose<br>
Option 1. Not just me, but virtually everyone who responded on this issue in the last week.</strong><br>
<br>
Manju references a document of the registrars we have not seen. (I note we only saw the Registrars statement of last Thurs before I circulated it.) It is likely a “best practices” document and one that we can certainly work with registrars to help make clearer and better. But that’s not EPDP Policy and does not sound like anything she, you nor the EPDP have been working on. <strong>Again, the Registrars position is Option 1 per their statement last Thursday.</strong><br>
<br>
You said in your first email response to me: <em>“Personally, I would have no problem falling in line with your position.” </em> Good, please do. Because now the division in the NCSG is being caused by you. You asked for a decision and we provided one.<br>
<br>
Best, Kathy<br>
-----------------<br>
Milton,<br>
In the legal world, you are not allowed to do what you just did. When you give a client options for how to proceed, they have to be valid ones, and then you have to follow what the client says. It’s called client-centered lawyering, and it’s the law.<br>
<br>
You have given us options and we chose not to differentiate legal and natural persons. Different people from different perspectives in NCSG, including EU citizens, lawyers, drafters of data protection laws, former NCSG leaders and folks teaching data protection and privacy shared why it is diifficult for our NCSG members, at this time, to differentiate legal and natural persons. To do so, exposes our members to unique dangers (and those who force them to do face unique liability). For our members’ privacy is protected by a range of privacy, freedom of expression and free association laws, conventions and treaties. We ask you to go back to the EPDP as part of our team and deliver our result – Option 1.<br>
<br>
Yesterday, Brian King (IPC/BC) told the EPDP that your view was our (NCSG) view. We would ask you to clarify that it is not.<br>
<br>
I know you would like to overrule our view because of your predictions about what the EC will do, and what the Board will do. But that’s your reaing of the crystal ball - and my reading shows the opposite result. If we, NCSG, take a clear and principled line for Option 1, and support it, as the recent NCSG discussions have clearly done, then we send a clear, strong and principled message to the Board, the EC and others.<br>
<br>
Our Option 1 view is not an outlier – the Registrar Stakeholder Group presented the same view. The Registries likely support them as the Contracted Parties tend to stick together. With our NCSG Support for Option 1, More than Half the GNSO Will Support Not Differentiating Between Legal and Natural Persons. When you and our EPDP team share why and our unique and long history on this very matter, including in Proxy/Privacy work, the Board, GAC, IPC/BC and others will know that this is a longstanding, historic and grounded view – and one just reconfirmed by members from across the NCSG.<br>
<br>
You gave us an option, we took it. We ask you and our EPDP Team to hold the line - and go with Option 1.<br>
<br>
Best, Kathy<br>
p.s. As Stephanie says, “The moment you drag anything into policy, it will become mandatory.”<br>
<br>
Quoting "Mueller, Milton L" <<a href="mailto:milton@gatech.edu">milton@gatech.edu</a>>:<br>
<br>
> Kathy,<br>
><br>
>> You have given us options and we chose not to differentiate legal<br>
>> and natural persons.<br>
><br>
> Sorry if you misinterpreted this. As I explained, no differentiation<br>
> is _not_ an option anymore.<br>
><br>
> The actual choice is, Do contracted parties get to decide entirely on<br>
> their own whether and how to differentiate? Or do we offer them<br>
> guidance?<br>
><br>
>> . As Stephanie says, “The moment you drag anything into policy, it<br>
>> will become mandatory.”<br>
><br>
> Nope. The EPDP will develop guidance. After it does so, there will be<br>
> a vote on whether it should be mandatory or not. We, the CPs, and<br>
> ISPs will vote against that, the other crew will vote for it. There<br>
> will not be consensus, ergo it will not be mandatory. There is no way<br>
> guidance that has been explicitly deemed not mandatory can suddenly<br>
> become mandatory without a new PDP.<br>
><br>
> Technically, it is possible for NCSG to suddenly turn against<br>
> offering any guidance, but I don’t think there is NCSG support for<br>
> that. Both Manju and I have opposed it. Anyone else on the EPDP care<br>
> to speak up?<br>
><br>
> --------------------------------------------------------------------<br>
><br>
> Quoting "Mueller, Milton L" <<a href="mailto:milton@gatech.edu">milton@gatech.edu</a><mailto:<a href="mailto:milton@gatech.edu>>:">milton@gatech.edu>>:</a><br>
><br>
>> Kathy, Stephanie, and NCSG members:<br>
>><br>
>> Personally, I would have no problem falling in line with your<br>
>> position. But there are two fatal flaws that you need to address.<br>
>> First, you are describing only what _we_ want and not thinking at all<br>
>> about how you get consensus. Second, your description of what we want<br>
>> does NOT correspond to what will actually happen if we “hold the<br>
>> line.” As much as I would like to promote harmony and unity among<br>
>> NCSG EPDP representatives, I don’t think you have thought things<br>
>> through.<br>
>><br>
>> I know perfectly well that we don’t want any differentiation and that<br>
>> the registrars don’t either. What you are overlooking is that the<br>
>> other half of the EPDP does want it, and the board will see the EPDP<br>
>> as deadlocked. So Option 1 will make you feel very self-righteous in<br>
>> the short term, but what happens next? You are, as I will show,<br>
>> leading us down a blind alley.<br>
>><br>
>> I can think of 3 scenarios we can discuss as a basis for action.<br>
>><br>
>> Scenario 1.<br>
>> We “hold the line,” and we revert to Phase 1 recommendations<br>
>> unchanged. There is _no guidance_. The other half of the EPDP just<br>
>> gives up and accepts it. This result is not bad, I admit, if that<br>
>> last bit happens.<br>
>> But what are the Phase 1 recommendations? You have misrepresented the<br>
>> “status quo” as not differentiating legal and natural. WRONG. What<br>
>> will happen under this option is that any registrar or registry can<br>
>> choose to differentiate in any way they like. And there will be no<br>
>> guidance that you can appeal to if they do it wrong. You say you<br>
>> don’t want registrars asking users whether they are legal or natural.<br>
>> Well, sorry, that can happen under your Option 1. A deadlock on EPDP<br>
>> means that differentiation is neither prohibited or required, it is<br>
>> up to the contracted parties. Many registrars won’t do it, but some<br>
>> will. Registries could do it, too. This is the “let the market<br>
>> decide” option. Stephanie has become a libertarian, I guess.<br>
>><br>
>> Scenario 2<br>
>> Scenario 1 assumes the other side accepts defeat. But what if we<br>
>> “hold the line,” and the other half of the EPDP doesn’t accept it?<br>
>> The European Commission, the US justice department, the GAC, SSAC,<br>
>> and of course the IPC/BC and ALAC join a strong chorus telling the<br>
>> board “something must be done.” The Board is influenced, and refuses<br>
>> to accept the recommendation, as it has done with the SSAD (which the<br>
>> same group of stakeholders opposed). We have seen the Board cave to<br>
>> GAC and governmental demands again and again, the latest example<br>
>> being “curative rights” for IGO acronyms, which the GNSO never<br>
>> approved. Worse, the EC may modify its NIS2 legislation to require<br>
>> ICANN to differentiate. The US congress could intervene. The issue<br>
>> festers for another three – five years. Several powerful players<br>
>> start attacking the multistakeholder process. Maybe ICANN corrupts<br>
>> its process once again.<br>
>><br>
>> Scenario 3<br>
>> Scenario 3 is that we don’t require differentiation of legal persons,<br>
>> but we develop consensus guidance on how contracted parties should do<br>
>> it if they choose to do it. This is the most likely scenario, and<br>
>> it’s one that your position paper completely ignores. If you do want<br>
>> guidance, the approach to guidance that I have suggested is best,<br>
>> because it is a very lightweight process of self-identification by<br>
>> registrants. By offering some differentiation it may defuse the<br>
>> opposition of the other stakeholders. On the other hand Stephanie’s<br>
>> complicated, expensive and power-surrendering approach is not the<br>
>> kind of guidance we want.<br>
>><br>
>> By now it should be clear to anyone who’s read this far that Scenario<br>
>> 1 is not as wonderful as you say and may not be possible. The EPDP is<br>
>> already deeply invested in developing guidance about how registrars<br>
>> should and should not differentiate. We have been working on it for<br>
>> weeks. Unless something changes radically in the next week, we will<br>
>> actually produce some guidance about differentiation. So, I suggest<br>
>> that we confine our debate to Scenario 2: the developing of<br>
>> nonbinding guidance. I suggest again that allowing registrants to<br>
>> choose to identify their registration as one of a legal person, with<br>
>> their data published or automatically available via SSAD, creates a<br>
>> path to consensus and to resolving the issue, whereas your preferred<br>
>> path does not.<br>
>><br>
>> To conclude, I call your attention to a pathology that is paralyzing<br>
>> nearly all of ICANN’s working groups. Defining your position and<br>
>> “holding the line” is a strategy that all the SGs and ACs seem to<br>
>> adopt now. It turns all these deliberations into a bunch of people<br>
>> re-stating their position again and again for 3-4 years,<br>
>> re-litigating issues endlessly, avoiding any serious middle ground.<br>
>> No thought is given to finding a solution that achieves a critical<br>
>> mass of consensus.<br>
>><br>
>> Anyone who wants to be a serious participant in developing the NCSG’s<br>
>> position in EPDP has to answer a very basic question:<br>
>><br>
>> How does this end?<br>
>> What is your scenario for achieving the level of agreement needed to<br>
>> pass a policy?<br>
>><br>
>> Looking forward to your response.<br>
>><br>
>> Dr. Milton L Mueller<br>
>> Georgia Institute of Technology<br>
>> School of Public Policy<br>
>> Internet Governance Project<<a href="https://internetgovernance.org/" target="_blank">https://internetgovernance.org/</a>><br>
>><br>
>><br>
>><br>
>> From: NCSG-Discuss<br>
>> <<a href="mailto:NCSG-DISCUSS@LISTSERV.SYR.EDU">NCSG-DISCUSS@LISTSERV.SYR.EDU</a><mailto:<a href="mailto:NCSG-DISCUSS@LISTSERV.SYR.EDU>>">NCSG-DISCUSS@LISTSERV.SYR.EDU>></a> On<br>
>> Behalf Of<br>
>> <a href="mailto:kathy@DNRC.TECH">kathy@DNRC.TECH</a><mailto:<a href="mailto:kathy@DNRC.TECH>">kathy@DNRC.TECH></a><br>
>> Sent: Tuesday, May 4, 2021 5:35 PM<br>
>> To: <a href="mailto:NCSG-DISCUSS@LISTSERV.SYR.EDU">NCSG-DISCUSS@LISTSERV.SYR.EDU</a><mailto:<a href="mailto:NCSG-DISCUSS@LISTSERV.SYR.EDU>">NCSG-DISCUSS@LISTSERV.SYR.EDU></a><br>
>> Subject: Option 1<br>
>><br>
>><br>
>> Tx to Milton, Stephanie, Manju, Tapani, Farzi, Mark Leiser, Kim von<br>
>> Arx and everyone else who commented on our dicussion of options for<br>
>> the EPDP.<br>
>><br>
>> As it's time to wrap up this issue so our EPDP members can present<br>
>> our view to the EPDP Group, I co-wrote the email Stephanie posted<br>
>> earlier today (attached below too). Best regards, Kathy<br>
>> ------------------------------------------------------------------------<br>
>><br>
>> Fellow NCSG members,<br>
>><br>
>>> We would like to work together to share our rationale for Option 1 –<br>
>><br>
>> maintaining the status quo and not asking further follow-up<br>
>> questions, mandatory or otherwise, about legal and natural persons.<br>
>> While the EPDP phase 2a discussions have been an educational and<br>
>> interesting exercise, we are not under any obligation to change the<br>
>> existing policy, or further complicate it.<br>
>><br>
>> As we have all discussed, legal/natural person questions are very<br>
>> complicated for many of our members who are often noncommercial and<br>
>> non-profit organizations whose structure and ways of obtaining domain<br>
>> names do not resemble those of the large corporations other<br>
>> stakeholder groups represent. Our members may have many layers of<br>
>> privacy protection in less-well-known sections of the GDPR, other<br>
>> local law, Constitutions and international conventions.<br>
>><br>
>> We learned that recent studies show that 50% of gTLD domain name<br>
>> registrations are for natural persons – and at least 25% more have<br>
>> overlapping entity and personal data (e.g., the organization name has<br>
>> personal data in it and is thus protected as personal data).<br>
>><br>
>> Stephanie and Kathy shared their concerns for legal/natural person<br>
>> questions during our long work on the Proxy and Privacy<br>
>> Accreditation Working Group. We worked closely with the Registrars<br>
>> Stakeholder Group to protect registrant privacy – including Battered<br>
>> Women’s Shelters, family planning clinics, and girls educational<br>
>> institutions – all of which may be legal entities, but have<br>
>> protectable data due to obvious danger from disclosure in certain<br>
>> countries.<br>
>><br>
>> In light of the complicated world around us, we support Option 1- the<br>
>> Status Quo. We ask the NCSG to adopt this as our stance. Based on<br>
>> the existing policy which makes differentiation of legal/natural<br>
>> persons optional for each registrar, we believe we already have the<br>
>><br>
>> - best way to fight DNS Abuse,<br>
>><br>
>> - best way to protect individuals and noncommercial<br>
>> organizations, and<br>
>><br>
>> - best way to follow GDPR and other applicable human rights<br>
>> and free speech laws<br>
>><br>
>> Therefore, we recommend NCSG “hold the line” and stick with Option 1.<br>
>><br>
>> As the Registrars wrote in their EPDP Statement on Thursday April 29:<br>
>> We have heard plenty of vocal support in this group to<br>
>> [differentiate between legal and natural persons in a mandatory<br>
>> fashion], but to date the RrSG have not heard any compelling reason<br>
>> to create policy that makes this dramatic shift to the domain<br>
>> registration landscape.<br>
>><br>
>> We agree. Nothing will stop other stakeholder groups from demanding<br>
>> further disclosure of data, and lobbying other parties including<br>
>> governments. What we can do in ICANN is come up with the best<br>
>> solution for us at this time.<br>
>><br>
>> Many thanks to the members of our NCSG EPDP Team for your hard work.<br>
>> This has been a long road. With new studies, new information and<br>
>> legal opinions, we think we have a clear and strategic path forward.<br>
>> We believe our position to be closely aligned with that of the<br>
>> Registrar Stakeholder Group, which they articulated on April 29 (see<br>
>> below).<br>
>><br>
>> Best, Kathy Kleiman and Stephanie Perrin<br>
>><br>
>> ---------------------------------------------------------<br>
>> The Registrar Stakeholder Group issued their position statement on<br>
>> Thursday (4/29):<br>
>><br>
>> The members of the RrSG EPDP team have participated in this process<br>
>> in good faith since day one and will continue to do so; however, we<br>
>> need to be crystal clear that members of our Stakeholder Group, whom<br>
>> we are here to represent, have voiced and recently reconfirmed their<br>
>> strong opposition to any policy coming out of this group that makes<br>
>> differentiation between natural and legal persons for domain<br>
>> registrations mandatory.<br>
>><br>
>> We have heard plenty of vocal support in this group to do just that,<br>
>> but to date the RrSG have not heard any compelling reason to create<br>
>> policy that makes this dramatic shift to the domain registration<br>
>> landscape. The Contracted Party can make the most accurate assessment<br>
>> of their own legal, technical, and commercial risks and obligations,<br>
>> and is the only party that can determine what level of risk they<br>
>> should assume. The scope of this EPDP Phase 2a is to consider if<br>
>> changes are required for the relevant Recommendation; it has become<br>
>> clear through this process that no such changes are required<br>
>><br>
>> To the extent this group can focus its energies on guidance to<br>
>> contracted parties which choose on their own to make this<br>
>> differentiation, we continue to believe that is a worthwhile<br>
>> exercise. We believe that guidance materials including educational<br>
>> information provided by ICANN in multiple languages would help<br>
>> contracted parties educate registrants and this would be a valuable<br>
>> effort.<br>
>><br>
>> That said, based on analysis done by our stakeholder group's members,<br>
>> we reject the notion that the majority of registered domain names are<br>
>> registered to legal entities. We further remind this team that we<br>
>> have not yet seen evidence that increased publication of registration<br>
>> data will address any of the problems which have been mentioned so<br>
>> far in this phase, and that the registration data is reliably and<br>
>> promptly available to those who do have a legitimate reason to access<br>
>> it.<br>
>><br>
>> Finally we note that this statement represents the official position<br>
>> of the Registrar Stakeholder group, and statements from members of<br>
>> other groups participating in the EPDP do not represent our group’s<br>
>> position.<br>
>><br>
>> (Source: Transcript of EPDP-Phase 2A Team Call, 29 April 2021,<br>
>> Statement of Volker Greimann on behalf of the Registrars Stakeholder<br>
>> Group read into the record)<br>
<br></p>
</body>
</html>