FW: Draft Comments - FW: Transfer Policy Review Preliminary Report - NCSG Public Comment Discussion

Fri Sep 27 11:09:01 EEST 2024

Hi Ken,

Tx for all your work on this issue.  Years of work and effort!

I share Adebunmi's concerns below.  How can we can request more than one 
notification -- at all major points along the way?  One notice can go 
into a spam folder, as you mention below, or be lost completely when the 
power goes down (as in so many areas of US right now - since a large 
hurricane hit overnight).  It seems a fair and reasonable principle that 
never should a notice on something important involving our domain names 
be an isolated one.

Precedent: In the Uniform Dispute Resolution Policy (UDRP) rules, we 
worked very hard for an "actual notice" standard - making sure that the 
Domain Name Registrant actually knows that the UDRP proceeding is taking 
place -- by requiring the complaint to be distributed via:

- Email to all the listed contacts (registrant, admin, tech), and

- "Written Notice to all postal-mail and facsimile addresses for the 
domain-name holder, administrative and technical contact (as applicable) 
shown in the domain name's Registration Data in Registrar's Registration 
Data Directory Service... [and] supplied by Registrar to the Provider 
for the registration's billing contact." (UDRP Rules)

****

Can we quickly expand our comments to ensure wide and fair  notice - and 
certainly no single point of failure in the notice system?

Best and tx,
Kathy

On 2024-09-27 06:41, Ken Herman wrote:
> Hello Adebunmi.
> 
> Thanks for your question. The proposed recommendations include many
> areas where notifications of registration changes are sent to
> registered name holders throughout the process. One key notification
> can be found in recommendation 11, “Notification of TAC issuance”
> which states:
> 
> “The working group recommends that the Registrar of Record MUST send
> a “Notification of TAC
> 
> Issuance” to the RNH without undue delay but no later than 10
> minutes after the Registrar of
> 
> Record issues the TAC. For the purposes of sending the notification,
> the Registrar of Record
> 
> MUST use contact information as it was in the registration data at the
> time of the TAC request.”
> 
> Also, Recommendation #19: Notification of Transfer Completion contains
> a requirement to notify when the transfer has been completed.
> 
> There are other places where notifications to registered name holders
> have been added to the policy.
> 
> When it comes to quantity of notices, it is only going to be one per
> instance. And, as far as whether or not a message goes to a RNH’s
> spam folder, well, that isn’t under the control of the sender, in
> this case the registrar involved.
> 
> As the non-commercial community, we may want to do more outreach to
> constituents to ensure the adoption of good practices, like taking
> advantage of multi-factor authentication when it is available and
> whitelisting messages from important senders, like the registrars we
> use. Also, as a constituency, we can advocate for registrars who have
> not already done so to put in place security measures such as MFA.
> 
> I am sorry to hear of your bad experience with a notification, and
> keep in mind that the policy mandates a 30-day transfer restriction
> after a transfer, so if a domain is taken maliciously, there is time
> to address the problem.
> 
> I hope this helps and once again, thank you for the question.
> 
> Ken
> 
> From: Adebunmi Akinbo <adebunmi.akinbo at gmail.com>
> Sent: Wednesday, September 25, 2024 7:51 PM
> To: Ken Herman <ken at kherman.com>
> Cc: NCSG-DISCUSS at listserv.syr.edu
> Subject: Re: FW: Draft Comments - FW: Transfer Policy Review
> Preliminary Report - NCSG Public Comment Discussion
> 
> Apologies for missing the meeting.
> 
> I will do my best to read the reworked comments, but I want to respond
> briefly to your comment on the 30 days.
> 
> We should factor out the following questions and processes:
> 
> Question: What is the communication strategy to ensure the
> non-commercial registered name user respond to any supposed malicious
> transfer? Would it be once? When does it start counting? How sure are
> we that such mails do not go to junk or spam mail?
> 
> From experience, I failed to respond to an ownership and my domain
> name was restricted from use. My website stopped loading and my mails
> failed. Apparently, the initial mail sent went to junk.
> 
> If the policy reflects a mandatory communication strategy, it may help
> the seemingly non-commercial registered name holder an opportunity to
> respond on time to a malicious domain name transfer.
> 
> My 2kobo!
> 
> On Thu, Sep 26, 2024, 12:31 AM Ken Herman <ken at kherman.com> wrote:
> 
>> Dear NCSG Members
>> 
>> I would like to thank everyone who attended today’s session on the
>> Transfer Policy Review. I hope you all found the presentation useful
>> and for those unable to make it, Andrea has circulated a link to the
>> recording.
>> 
>> As a result of this review, and after examining the process for
>> submitting comments, I have reworked and edited the responses, and
>> you can find it at this link:
>> 
>> 
> https://docs.google.com/document/d/1uM38-A98TYK-bED30l4Ue1cFJdNuHaZl/edit?usp=sharing&ouid=105988793481216121706&rtpof=true&sd=true
>> 
>> As you will see, we won’t be uploading this document per se, but
>> the comments remain basically the same.
>> 
>> Please have a look and provide any comments in the document or to me
>> by 23:00 UTC on Sunday, September 29, 2024. This will give me time
>> to incorporate into the responses prior to the submission deadline
>> on Monday, September 30.
>> 
>> Thanks again and I look forward to any input you may have.
>> 
>> Best regards
>> 
>> Ken
>> 
>> From: NCSG-Discuss <NCSG-DISCUSS at LISTSERV.SYR.EDU> On Behalf Of Ken
>> Herman
>> Sent: Monday, September 23, 2024 7:44 PM
>> To: NCSG-DISCUSS at LISTSERV.SYR.EDU
>> Subject: Draft Comments - FW: Transfer Policy Review Preliminary
>> Report - NCSG Public Comment Discussion
>> 
>> Hello again fellow NCSG members
>> 
>> In preparation for our discussion on Wednesday, or as a way for
>> members unable to attend to contribute, you can find in the link
>> below some suggested text for our public comment.
>> 
>> ·Link Removed
>> 
>> The public comment is due next Monday, September 30, 2024, so I
>> welcome any additional points that you feel are important to raise
>> for this policy.
>> 
>> One aspect of the policy that I have been wondering about is the
>> transfer restrictions imposed after registration or a transfer. The
>> recommendation regarding this aspect of the policy imposes a 30-day
>> restriction (with some exceptions, which you can see I addressed in
>> the draft comments). I have no issue with the restriction itself,
>> but my question is whether or not 30-days (720 hours) is enough
>> time. Keeping in mind that the transfer restrictions are in place
>> for security reasons, my experience is that the average
>> non-commercial registered name holder does not have substantial
>> knowledge of domain name management activities and may take some
>> time to understand what might be happening in the case of a
>> malicious transfer. Therefore, would 30 days be enough time to
>> understand the issues and respond? If not, what timeframe would be
>> better and why? Or, is my assumption incorrect and 30 days is
>> generally sufficient.
>> 
>> Your thoughts on this, or any of the other policy recommendations,
>> are most welcome and I look forward to our discussion on Wednesday.
>> 
>> Best regards.
>> 
>> Ken
>> 
>> From: NCSG-Discuss <NCSG-DISCUSS at LISTSERV.SYR.EDU> On Behalf Of Ken
>> Herman
>> Sent: Thursday, September 19, 2024 11:47 PM
>> To: NCSG-DISCUSS at LISTSERV.SYR.EDU
>> Subject: Transfer Policy Review Preliminary Report - NCSG Public
>> Comment Discussion
>> 
>> Dear fellow NCSG members:
>> 
>> As I reported previously, the Transfer Policy review Working Group
>> (TPR WG) has completed its consideration of the issues outlined in
>> its charter and have produced its preliminary report. We are now in
>> the public comment period for this report, which closes at the end
>> of September. Recently, the TPR WG support team have run two
>> webinars describing the recommendations, along with an opportunity
>> to ask questions. The links to the recordings of these webinars are
>> below.
>> 
>> As the deadline for comments approaches, your TPR WG NCSG
>> representatives (Juan and I) welcome all NCSG members to a working
>> session to consider any issues we may wish to include in our public
>> comment contribution.
>> 
>> We have arranged the call for Wednesday, September 25, 2024 @ 13:30
>> UTC with the connection details below. I have also requested Andrea
>> to send these details as calendar invitations.
>> 
>> For your reference I have placed below links to the relevant
>> materials, including the NCSG public comment to the interim report
>> published in 2022.
>> 
>> I look forward to your participation in this discussion, but if you
>> cannot attend we welcome any written comments anyone may have.
>> 
>> As always, please feel free to contact me if you have any questions.
>> 
>> Best regards
>> 
>> Ken
>> 
>> Join Zoom Meeting:
>> 
> https://icann.zoom.us/j/98878189584?pwd=ZVpkSVVuaXVqeGRMelNEWW1LMkxQUT09
>> 
>> Meeting ID: 988 7818 9584
>> 
>> Passcode: i!y7.qx+11
>> 
>> One tap mobile
>> 
>> +16699006833,,98878189584#,,,,,,0#,,7740925615# US (San Jose)
>> 
>> +12532158782,,98878189584#,,,,,,0#,,7740925615# US (Tacoma)
>> 
>> PHONE ONLY DETAILS:
>> 
>> Find your local number: https://icann.zoom.us/u/ayKmeftWg
>> 
>> Meeting ID: 988 7818 9584
>> 
>> Phone only Passcode: 7740925615
>> 
>> Transfer Policy Review PDP Page:
>> 
> https://community.icann.org/display/TPRPDP/Transfer+Policy+Review+PDP
>> 
>> TPR Public Comment page:
>> 
>> 
> https://www.icann.org/en/public-comment/proceeding/initial-report-on-the-transfer-policy-review-01-08-2024
>> 
>> Transfer Policy Review Webinar 1:
>> https://community.icann.org/x/OgKkFQ
>> 
>> Transfer Policy Review Webinar 2:
>> https://community.icann.org/x/PAKkFQ
>> 
>> NCSG Response to preliminary report in 2022:
>> 
> https://itp.cdn.icann.org/public-comment/proceeding/Initial%20Report%20on%20the%20Transfer%20Policy%20Review%20-%20Phase%201(a)-21-06-2022/submissions/NCSG/NCSG%20Response%20-%20Transfer%20Policy%20Review-15-08-2022.pdf