Whois/privacy and the SSAD

[farzaneh badii]

Hi Milton,

I looked at the cost report of this and they really don't have enough
information and data to actually estimate the cost. Obviously the
Intellectual property crowd claims they submit "many" requests but others
say otherwise.  I am more inclined to see if they can pilot an
implementation and see what sort of problems they face (as laid out in the
note you sent). Opening another EPDP or getting back to council and EPDP is
going to risk re-litigating issues for sure. If we have to take one of
those paths, I go with number 1 (reluctantly, because I don't know how the
Board is going to articulate the reasons)

Isn't this system just a "triage" of request and an accreditation model?
That the final decision is by the registries and registrars? I hear a lot
of people thinking this is "disclosure" mechanism, which adds to the
complexity.

There are many unknown issues about the implementation of SSAD. Even the
governments don't want to accredit their own law enforcement themselves (as
mentioned in a letter from the GAC chair, they just want to verify
identity).
https://gnso.icann.org/sites/default/files/file/field-file-attach/ismail-to-fouquart-15dec21-en.pdf

And anyhow that recommendation that governments each get to accredit their
own law enforcement is unfortunately a terrible idea. And what will happen
to sanctioned countries that are usually authoritarian and have law
enforcement to suppress opposition? will they get access to personal
information of people while people suffer from sanctions? Or perhaps the
contracted parties deny them access. (I raised the issue at an NCSG meeting
last year,implicitly, but I guess the ship has sailed)


Best regards,


Farzaneh


On Tue, Jan 4, 2022 at 3:04 PM Mueller, Milton L <milton at gatech.edu> wrote:

> Greetings all and happy new year.
> As one of your representatives on the EPDP dealing with Whois and privacy,
> I want to inform you of the latest development.
>
> You will remember that a lot of sensitive domain name registration data is
> now redacted (hidden), because ICANN had to come into compliance with GDPR.
> The SSAD (Standardized System of Access and Disclosure) was an elaborate
> mechanism developed by the EPDP to allow people who want to see the hidden
> data to request its disclosure. The proposed SSAD had an elaborate
> mechanism for accrediting users of the system, including a process for each
> national government to accredit its own law enforcement and government
> agencies.
>
> ICANN Org has done a study of the costs of the proposed SSAD and estimates
> that it will be very expensive and will take a long time to implement. The
> ICANN board has indicated that it may not approve the SSAD recommendation
> because of these problems.
>
> So now we are faced with a question about what to do next.
>
> There are basically two options being presented to us:
>
>    1. Let the ICANN Board formally refuse to adopt the recommendation,
>    tell us what's wrong with it, and then let the Council and the EPDP adopt a
>    supplemental recommendation that fixes the problems
>    2. Re-convene the EPDP and work out its own modification of the
>    recommendation.
>
> I've attached a more detailed analysis of the options that the ICANN staff
> circulated today. I have my own opinion about this - I think the SSAD does
> need to be simplified and agree with the staff's concerns about its
> complexity and cost. But I am not sure what is the best way procedurally to
> fix this problem. Hope we can discuss this as a SG and reach a unified
> position.
>
> Cheers,
>
> Dr Milton L Mueller, Professor
>
> School of Public Policy
>
> Georgia Institute of Technology
>
> Internet Governance Project <https://internetgovernance.org>
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.ncsg.is/pipermail/ncsg-discuss/attachments/20220104/6c3b5e8d/attachment.htm>