<div dir="ltr"><div class="gmail_extra">Hi all,</div><div class="gmail_extra"><br></div><div class="gmail_extra">as the deadline already passed with no objection made on the list, I submitted the attached comment.</div><div class="gmail_extra">Thanks.</div><div class="gmail_extra"><br></div><div class="gmail_extra">Best,</div><div class="gmail_extra"><br></div><div class="gmail_extra">Rafik<br>
<br><div class="gmail_quote">2017-08-09 11:50 GMT+09:00 Rafik Dammak <span dir="ltr"><<a href="mailto:rafik.dammak@gmail.com" target="_blank">rafik.dammak@gmail.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div class="gmail_extra">hi Tatiana,</div><div class="gmail_extra"><br></div><div class="gmail_extra">thanks, I removed those 2 statements and we have this version now <a href="https://docs.google.com/document/d/1TfgHuMqzD660_CHLQMXMW4phnBtLSP94j6X5riY2Ko4/edit" target="_blank">https://docs.google.com/<wbr>document/d/1TfgHuMqzD660_<wbr>CHLQMXMW4phnBtLSP94j6X5riY2Ko4<wbr>/edit</a> . with those changes, I can understand that you are supporting the comment. looking to hear from other PC members.</div><div class="gmail_extra">if I don't hear any objection by Wednesday 9th August 11:59am UTC, I can interpret that the comment is endorsed by NCSG Policy committee.</div><div class="gmail_extra"><br></div><div class="gmail_extra">Best,</div><div class="gmail_extra"><br></div><div class="gmail_extra">Rafik<div><div class="h5"><br>
<br><div class="gmail_quote">2017-08-08 17:40 GMT+09:00 Dr. Tatiana Tropina <span dir="ltr"><<a href="mailto:t.tropina@mpicc.de" target="_blank">t.tropina@mpicc.de</a>></span>:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div bgcolor="#FFFFFF">
<p>Hi Rafik,</p>
<p>As I said - I do not quite get what the first statement means in
terms of issues raised so I can't come up with any suggestion. I
wish I could. As this statement doesn't really contribute to
anything and doesn't raise any issue (although it's supposed to as
it is placed in the "issue" section) I suggest we just remove it
for the sake of clarity. Unless the drafters are ready to clarify
or rephrase. But I don't think removal will change anything in the
document except making it clearer. <br>
</p>
<p>I am totally supporting your suggestion for removal of anotehr
statement - let's not send the mix messages especially with vague
wording proposals.</p>
<p>Thanks! <br>
</p>
<p>Tanya <br>
</p><div><div class="m_-5101307762047424355gmail-h5">
<br>
<div class="m_-5101307762047424355gmail-m_-1724544983087285085moz-cite-prefix">On 08/08/17 08:08, Rafik Dammak wrote:<br>
</div>
<blockquote type="cite">
<div dir="ltr">
<div class="gmail_extra">Hi Tatiana,</div>
<div class="gmail_extra"><br>
</div>
<div class="gmail_extra">Thanks for the comments,</div>
<div class="gmail_extra">while we are late by our deadline to
submit a comment, I think we can solve the concerns.</div>
<div class="gmail_extra">1/ do you have a proposal of rephrasing
for the first statement?</div>
<div class="gmail_extra">2/ I understand your concerns and
indeed doesn't seem aligned with our previous stances
regarding domain suspension. probably we can remove that.<br>
<br>
really looking forward to solving this within the next
24hours.</div>
<div class="gmail_extra"><br>
</div>
<div class="gmail_extra">Best,</div>
<div class="gmail_extra"><br>
</div>
<div class="gmail_extra">Rafik<br>
<div class="gmail_quote">2017-08-05 6:56 GMT+09:00 Dr. Tatiana
Tropina <span dir="ltr"><<a href="mailto:t.tropina@mpicc.de" target="_blank">t.tropina@mpicc.de</a>></span>:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div bgcolor="#FFFFFF">
<p>Hi all,</p>
<p>I have a couple of comments:</p>
<p>1) I have hard time making sense of the first point:</p>
<p><font size="-2">"1. Registry Response, Responsible
Parties<br>
<br>
“ROs are not necessarily the best parties to
address certain security threats. The identification
of the parties considered as being most relevant and
appropriate in resolving the security threat is
critical to the prompt resolution of the matter.”<br>
<br>
More specifically, responsibility of identifying
security threats connected to New gTLDs and
resolving them when possible rests with ROs."</font></p>
<p>As this point is a part of the comment that refers to
the "issue" I wonder what is this - a statement? What
kind of issue is identified here? Are we recommending
anything? If not and if this is just an introduction,
may be it's better to rephrase? May be it's just too
late here but I struggling with what this "issue"
implies. <br>
</p>
<p>2) I wonder if this one is really in line with NSCG
values such as due process: <br>
</p>
<p><font size="-2">2. We ask you to consider including
the following GAC recommendation in Registry
Response:<br>
<br>
“If Registry operator identifies risk of harm,
Registry operator will notify the relevant registrar
and , if the registrar does not take immediate
action, suspend the domain name until the matter is
resolved.” </font><br>
</p>
<p>The framework already lists the actions that Registry
can take even in the case if "a negative or
non-existent response from the Registrar", which
"should not<br>
preclude the Registry from taking action". I do not
like the notion of "immediate action" as it sound to
vague to me and I believe that there are enough
actions listed to address the issue under the
framework rather than suspension of domain name -
again, "till the matter is resolved" looks too vague.
I don't think it's acceptable when it comes to such a
matter as a suspension of domain name. I know enough
cases of mistakes when due to abuse claims customers
went dark, etc. I suggest we rather be careful here.
But if everyone is comfortable with this suggestion,
I'll surrender. <br>
</p>
<p>Warm regards,</p>
<p>Tanya <br>
</p>
<div>
<div class="m_-5101307762047424355gmail-m_-1724544983087285085m_4966123089002198678h5">
<p><br>
</p>
<br>
<div class="m_-5101307762047424355gmail-m_-1724544983087285085m_4966123089002198678m_-326150836554865276moz-cite-prefix">On
04/08/17 09:39, Rafik Dammak wrote:<br>
</div>
<blockquote type="cite">
<div dir="ltr">
<div class="gmail_extra">Dear PC members,</div>
<div class="gmail_extra"><br>
</div>
<div class="gmail_extra">any comment on the
draft? we got an extension till 6th August, we
should review quickly and make a decision.</div>
<div class="gmail_extra"><br>
</div>
<div class="gmail_extra">Best,</div>
<div class="gmail_extra"><br>
</div>
<div class="gmail_extra">Rafik</div>
<div class="gmail_extra"><br>
</div>
<div class="gmail_extra">
<div class="gmail_quote">2017-07-31 19:33
GMT+09:00 Rafik Dammak <span dir="ltr"><<a href="mailto:rafik.dammak@gmail.com" target="_blank">rafik.dammak@gmail.com</a>></span>:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div dir="auto">
<div>Hi Ayden,
<div dir="auto"><br>
</div>
<div dir="auto">Yes it is for PC
review. We worked on it the last
days with Juan, Dina and Niels.
James cannot response since is off
for the coming days. I was going to
send email to related ICANN staff to
inform that we will make a late
submission, hopefully by end of this
week.</div>
<div dir="auto"><br>
</div>
<div dir="auto">Best,</div>
<div dir="auto"><br>
</div>
<div dir="auto">Rafik </div>
<br>
<div class="gmail_extra"><br>
<div class="gmail_quote">
<div>
<div class="m_-5101307762047424355gmail-m_-1724544983087285085m_4966123089002198678m_-326150836554865276h5">On
Jul 31, 2017 7:18 PM, "Ayden
Férdeline" <<a href="mailto:icann@ferdeline.com" target="_blank">icann@ferdeline.com</a>>
wrote:<br type="attribution">
</div>
</div>
<blockquote class="m_-5101307762047424355gmail-m_-1724544983087285085m_4966123089002198678m_-326150836554865276m_7229474843329171798quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div>
<div class="m_-5101307762047424355gmail-m_-1724544983087285085m_4966123089002198678m_-326150836554865276h5">
<div>I believe the PC is
being asked to review this
comment which has been
drafted by Dina and Juan.
The submission deadline
for comments on this issue
is today, but I suspect we
will not be able to meet
that, so let's try for
this Friday? I think we
need to bring in a topic
expert, James Gannon
(cc'd), to get his opinion
on this comment, too --
because I am happy to
raise my hand and say I do
not know anything about
this topic. <br>
</div>
<div><br>
</div>
<div class="m_-5101307762047424355gmail-m_-1724544983087285085m_4966123089002198678m_-326150836554865276m_7229474843329171798m_6307797313055180449protonmail_signature_block">
<div class="m_-5101307762047424355gmail-m_-1724544983087285085m_4966123089002198678m_-326150836554865276m_7229474843329171798m_6307797313055180449protonmail_signature_block-user">
<div>Best, Ayden <br>
</div>
</div>
<div class="m_-5101307762047424355gmail-m_-1724544983087285085m_4966123089002198678m_-326150836554865276m_7229474843329171798m_6307797313055180449protonmail_signature_block-protonm_7229474843329171798m_6307797313055180449protonmail_signature_block-empty"><br>
</div>
</div>
<div class="m_-5101307762047424355gmail-m_-1724544983087285085m_4966123089002198678m_-326150836554865276m_7229474843329171798elided-text">
<div><br>
</div>
<blockquote type="cite" class="m_-5101307762047424355gmail-m_-1724544983087285085m_4966123089002198678m_-326150836554865276m_7229474843329171798m_6307797313055180449protonmail_quote">
<div>-------- Original
Message --------<br>
</div>
<div>Subject:
[NCUC-DISCUSS]
Suggested Comment:
Draft Framework for
Registry Operators to
Respond to Security
Threats<br>
</div>
<div>Local Time: July
30, 2017 11:24 PM<br>
</div>
<div>UTC Time: July 30,
2017 10:24 PM<br>
</div>
<div>From: <a href="mailto:thomascovenant@thomascovenant.org" target="_blank">thomascovenant@thomascovenant.<wbr>org</a><br>
</div>
<div>To: NCUC-discuss
<<a href="mailto:ncuc-discuss@lists.ncuc.org" target="_blank">ncuc-discuss@lists.ncuc.org</a>><br>
</div>
<div><br>
</div>
<div>Hello,<br>
</div>
<div><br>
</div>
<div>the comment
proposal is
underneath, what are
your thoughts?<br>
</div>
<div><br>
</div>
<div><a href="https://docs.google.com/document/d/1TfgHuMqzD660_CHLQMXMW4phnBtLSP94j6X5riY2Ko4/edit" target="_blank">https://docs.google.com/docume<wbr>nt/d/1TfgHuMqzD660_CHLQMXMW4ph<wbr>nBtLSP94j6X5riY2Ko4/edit</a><br>
</div>
<div><br>
</div>
<div>Note from Security
Framework Drafting
Team wiki workspace:<br>
</div>
<div><br>
</div>
<div>- Is Public Comment
required for the draft
Framework?<br>
</div>
<div>- This is not a
policy implementation
nor a contractual
requirements document;
therefore, a public
comment proceeding
would not be required.
However, SFDT has
decided to conduct a
public comment for
broader community
feedback prior to
finalization of the
Framework.<br>
</div>
<div><br>
</div>
<div>Main points:<br>
</div>
<div><br>
</div>
<div>- Framework should
be expanded<br>
</div>
<div>- Several minor
details are to be
clarified,
restructuring proposal<br>
</div>
<div>- as a small step
in response to
proposed detailed
report examination, I
suggest we include a
recommendation on
Responsible Threat
Disclosure.<br>
</div>
<div><br>
</div>
<div>Finally, I quote
Point 3 from the
Comment:<br>
</div>
<div><br>
</div>
<div>"Since the
following examination
of threat report is
identified in the
Framework, we strongly
suggest including a
recommendation on
Responsible Threat
Disclosure to be
included in the
document:<br>
</div>
<div><br>
</div>
<div>"Each RO should
scrutinize, question
or otherwise inquire
about the legitimacy
of the origin<br>
</div>
<div>of a request, in
accordance with their
own internal policies
and processes."<br>
</div>
<div><br>
</div>
<div>We have seen a
broad variation in
handling security
threat reports,
varying from
constructive actions
addressing the issues
to punishment of the
reporting party.
Benefits of
responsible threat
submission are
obvious.<br>
</div>
<div><br>
</div>
<div>In this context, it
is important to
underline benefits and
importance of
responsible threat
disclosure. We request
recommendation to
extend goodwill and
not cause harm to the
reporting party
whenever possible:<br>
</div>
<div><br>
</div>
<div>When applicable, RO
should provide:<br>
</div>
<div><br>
</div>
<div>- an easy way to
report security
threats and violation<br>
</div>
<div>- encrypted ways of
communication<br>
</div>
<div>- option of
anonymous submission"<br>
</div>
<div><br>
</div>
<div>Other:<br>
</div>
<div><br>
</div>
<div>- This is my first
comment drafted with
input from Juan Manuel
Rojas (thank you for
commenting). Access to
shared document and
request for review was
given to those who
expressed interest in
working on it. All
input from the list is
very welcome. Please
let me know what needs
to be corrected and I
will promptly do it.<br>
</div>
<div>- Comment is a bit
late, I will request
an extra week to
discuss the proposal
with my humble
excuses.<br>
</div>
<div><br>
</div>
<div>BR,<br>
</div>
<div>Dina Solveig
Jalkanen<br>
</div>
<div>-- <br>
</div>
<div>* * *<br>
</div>
<div>Friendly geek in
Amsterdam, FSFE Fellow<br>
</div>
<div><a href="https://wiki.techinc.nl/index.php/User:Thomascovenant" target="_blank">https://wiki.techinc.nl/index.<wbr>php/User:Thomascovenant</a><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div>______________________________<wbr>_________________<br>
</div>
<div>Ncuc-discuss
mailing list<br>
</div>
<div><a href="mailto:Ncuc-discuss@lists.ncuc.org" target="_blank">Ncuc-discuss@lists.ncuc.org</a><br>
</div>
<div><a href="http://lists.ncuc.org/cgi-bin/mailman/listinfo/ncuc-discuss" target="_blank">http://lists.ncuc.org/cgi-bin/<wbr>mailman/listinfo/ncuc-discuss</a><br>
</div>
</blockquote>
<div><br>
</div>
</div>
<br>
</div>
</div>
______________________________<wbr>_________________<br>
NCSG-PC mailing list<br>
<a href="mailto:NCSG-PC@lists.ncsg.is" target="_blank">NCSG-PC@lists.ncsg.is</a><br>
<a href="https://lists.ncsg.is/mailman/listinfo/ncsg-pc" rel="noreferrer" target="_blank">https://lists.ncsg.is/mailman/<wbr>listinfo/ncsg-pc</a><br>
<br>
</blockquote>
</div>
<br>
</div>
</div>
</div>
</blockquote>
</div>
<br>
</div>
</div>
<br>
<fieldset class="m_-5101307762047424355gmail-m_-1724544983087285085m_4966123089002198678m_-326150836554865276mimeAttachmentHeader"></fieldset>
<br>
<pre>______________________________<wbr>_________________
NCSG-PC mailing list
<a class="m_-5101307762047424355gmail-m_-1724544983087285085m_4966123089002198678m_-326150836554865276moz-txt-link-abbreviated" href="mailto:NCSG-PC@lists.ncsg.is" target="_blank">NCSG-PC@lists.ncsg.is</a>
<a class="m_-5101307762047424355gmail-m_-1724544983087285085m_4966123089002198678m_-326150836554865276moz-txt-link-freetext" href="https://lists.ncsg.is/mailman/listinfo/ncsg-pc" target="_blank">https://lists.ncsg.is/mailman/<wbr>listinfo/ncsg-pc</a>
</pre>
</blockquote>
</div></div></div>
______________________________<wbr>_________________
NCSG-PC mailing list
<a href="mailto:NCSG-PC@lists.ncsg.is" target="_blank">NCSG-PC@lists.ncsg.is</a>
<a href="https://lists.ncsg.is/mailman/listinfo/ncsg-pc" rel="noreferrer" target="_blank">https://lists.ncsg.is/mailman/<wbr>listinfo/ncsg-pc</a>
</blockquote></div>
</div></div>
</blockquote>
</div></div></div></blockquote></div><br></div></div></div></div>
</blockquote></div><br></div></div>