[Ncsg-discuss] [Ext] [ICANN87] Board's questions to NCSG

[Shiva Upadhyay]

Dear Rafik, Farzaneh and colleagues ,

Thank you both for considering my proposed questions. Farzaneh, I appreciate your concerns about registrants’ rights and welcome your suggested framing on transparency reporting. I would like to clarify the concern behind my first question.

Contactability is indeed essential. Registrars need reliable contact details to send renewal reminders, communicate about services and account security, and reach registrants when their websites or domains are compromised. The practical question is whether those details remain usable when an urgent situation arises.

Some domain registrations are deliberately used to harm others through phishing, impersonation, financial fraud, malware distribution and credential theft. Domain names can also facilitate wider harms such as publishing personal information without consent, extortion, targeted harassment and the dissemination of non-consensual morphed images. Victims’ privacy, dignity and safety deserve consideration alongside the rights of legitimate registrants. Addressing these harms may require cooperation with hosting providers, platforms and competent authorities, within each actor’s responsibilities.

Where an abuser supplies fabricated details or abandons disposable email addresses and telephone numbers, reaching the customer and pursuing an investigation becomes difficult. Access to non-public registration data and the reliability of the data obtained are separate questions: lawful access is of limited assistance if the information provides no usable investigative lead. Such weaknesses can be exploited repeatedly, undermining confidence in the domain name ecosystem. 

Accuracy alone will not prevent DNS abuse, but reliable registration data can support prevention, notification and accountability. Whether the approach involves stronger contact verification, proportionate KYC measures where justified, or other mechanisms, we should assess its effectiveness, necessity, privacy implications and impact on access. SSAC’s work provides a useful basis: SAC058 distinguishes syntactic, operational and identity validation, while its later work highlights the security and operational consequences of inaccurate data. These approaches warrant careful examination, with safeguards and accessible alternatives for legitimate users.

I had also hoped PDP1 would provide stronger coordination against abusive campaigns moving across TLDs and registrars. To be precise, its current proposal requires checks within a registrar’s own portfolio, which can include multiple TLDs, but does not require cross-registrar checks or coordination. That leaves a broader coordination concern worth discussing, even while supporting the progress made through PDP1.

Compromised domains also deserve focused attention because their legitimate registrants are themselves victims. We should examine whether registration records held by registrars should include a verified emergency or alternative contact, protected against unnecessary public disclosure and preferably independent of the affected domain. Clear, risk-sensitive timeframes for investigating suspected compromise, notifying the legitimate holder and coordinating remediation could help protect users while avoiding unnecessary disruption to legitimate websites and email services.

On transparency reporting, I support your broader formulation and would welcome coverage of existing obligations as well as future PDPs. Meaningful reporting could help us assess both the effectiveness of mitigation and its unintended effects on registrants. I also agree that Board-community sessions would benefit from clearer follow-up, including identifying the responsible committee or team and providing an expected response date.

Finally, I believe we should give the concerns raised by other Supporting Organizations and Advisory Committees, including the GAC, fair consideration. Their perspectives may differ, but the problems they identify can be genuine. We can examine those concerns critically and constructively while remaining firm on human rights. Our shared objective should be an environment in which all parts of the community can work together towards a safer, more secure and trustworthy Internet.

Best regards,
Shiva Upadhyay


    On Saturday, 10 October 2026 at 03:37:02 am IST, farzaneh badii <00001deb507b73c5-dmarc-request at listserv.syr.edu> wrote:  
 
 Thanks Rafik.
as to Shiva's first question on accuracy, we believe accuracy is very important for the registrant to avoid losing access to their domain name. However, accuracy is about contactibility. But some stakeholders and advisories come up with ideas such as KYC or other human rights violating measures that could impact the domain name registrant access because they didn't update their information or didn't show their ID. We don't want to give the Board the impression that we are going with the rest of "accuracy" cheering crowd, especially GAC, that believes accuracy of WHOIS data is the key to mitigating DNS abuse. 
As to the second question, I think it's great. Lets ask it in this general way: How can we integrate transparency reporting into each PDP to align with transparency standards in tech? 
You can also start the session with criticizing the format they have these sessions. What is the point of having these sessions when there are no follow ups, when the board doesn't even discuss our concerns in their respective committees? how can we make these sessions more useful? maybe they say they discuss our concerns!
Farzaneh 

On Fri, Oct 9, 2026 at 10:00 AM Rafik Dammak <rafik.dammak at gmail.com> wrote:


Thanks Farzaneh for the framing. I will also add your question, trying to phrase it "NCSG would like to request a conversation regarding remedy for domain name registrant in the context of DNS abuse". putting this as a placeholder.
Rafik



Le ven. 9 oct. 2026 à 22:05, farzaneh badii <farzaneh.badii at gmail.com> a écrit :

Hi Rafik
I would frame the sanctions related q like this: The issue of sanctions has been hampering people’s access to domain names around the world for many years. ICANN workstream on accountability advised ICANN to take some measures. That was 8 years ago. That study result which doesn’t look like it has been published appears in the operational tracking and seems like it mentions that because of legal impossibility of obtaining a general license, ICANN won’t pursue it. Could you please tell us about this study, when it’s going to be published and what the next steps are for ICANN to undertake its role indiscriminately as a global coordinator of DNS? We expected the study to start in consultation with the community. 



And can we tell the board we want to have a convo about remedy for domain name registrant? I don’t know why they keep wanting us to question them lets have a convo!!! 

Farzaneh 
On Fri, Oct 9, 2026 at 7:03 AM Rafik Dammak <00001e06d4af460b-dmarc-request at listserv.syr.edu> wrote:


hi all,
trying to summarize quickly the proposals we have till now, editing is welcome:- Pedro and Kathy shared suggestions to respond to board question to NCSG: sustainability of NCSG fellowship or similar initiative and requesting independent data and research studies, we can develop more as we will answer them during the meeting.- for questions  we are proposing (with some editing for concision)
* Regarding sanctions:ICANN’s Work Stream 2 addressed OFAC sanctions primarily in relation to the impact of sanctions on ICANN’s own ability to enter into and support transactions involving registries, registrars and other Internet resources. Recommendation 4.1.4 specifically called on ICANN to study and pursue OFAC general licenses to reduce such friction. It did not, however, specifically address situations in which sanctions compliance by a Registry Operator or Registry Service Provider results in the suspension of DNS resolution for an existing registrant and potentially affects third-party users.

What role does the ICANN Board believe ICANN should have when a Registry Operator or its Registry Service Provider applies national sanctions or similar legal requirements in a way that results in a registry-level suspension of DNS resolution?
Should ICANN consider whether the existing framework provides sufficient transparency regarding the legal basis, decision-making authority, notice, review and redress mechanisms associated with such actions, while recognizing that contracted parties must comply with applicable law and that ICANN’s Human Rights Core Value operates within the limits of ICANN’s Mission?what is the current status of Work Stream 2 Recommendation 4.1.4 on OFAC general licenses, which ICANN’s implementation page still lists as “In progress” with a targeted completion date of Q2 2026, and does the Board believe that the existing WS2 framework remains adequate for situations of this kind?
* Regarding DNS abuse
While PDP1 on Associated Domain Checks and PDP2 on safeguards for access to high-volume registration tools have been prioritised, other important gaps identified in the Final Issue Report could face delays due to resource constraints. 
What mechanisms, other than a full-fledged PDP, could be used to address the contact-verification gaps identified in the Final Issue Report, particularly reducing the 15-day window and ensuring validation and verification before domain activation? 

How could the reporting and transparency gaps identified in the Final Issue Report be addressed through mechanisms other than a full-fledged PDP, including establishing mandatory, standardized aggregate reporting to ICANN Contractual Compliance? Such reporting could cover statistics such as complaints received, domains involved, including compromised domains, actions taken, confirmed false positives, complaints closed for insufficient evidence and demonstrably fabricated complaints, without personal data or domain-level identifiers.
regarding the last questions/topics, I would like those in the working group to chime in and share their thoughts
Best,
Rafik
Le ven. 9 oct. 2026 à 17:16, Shiva Upadhyay <shiva.upadhyay at yahoo.com> a écrit :

 
Dear Rafik and colleagues,

Ahead of today’s deadline, please consider the following two proposed questions for the NCSG-Board meeting at ICANN87, with brief rationales.

While PDP1 on Associated Domain Checks and PDP2 on safeguards for access to high-volume registration tools have been prioritised, other important gaps identified in the Final Issue Report could face delays due to resource constraints. These questions seek the Board’s views on how alternative mechanisms could advance work on those gaps without requiring a full-fledged PDP.

1. Timely verification of registration data and protection of victims

Question: What mechanisms, other than a full-fledged PDP, could be used to address the contact-verification gaps identified in the Final Issue Report, particularly reducing the 15-day window and ensuring validation and verification before domain activation? 

Rationale: The report identifies proactive and timely contact-verification gaps under Preventative Measures-P2 and P3 and also one one of the recommendation of Accuracy scoping team. Accurate, up-to-date contact details can help registrars promptly reach legitimate holders of compromised domains, support targeted remediation and facilitate lawful action against deliberate abusers. This can protect victims’ privacy, dignity and safety, including where phishing or malware enables image-based abuse involving non-consensual morphed images or extortion. It can also help avoid unnecessary suspension of legitimate websites and email services.

Given the potential delays in further policy work, it would be useful to identify which alternative mechanisms could deliver earlier improvements. Any approach should minimise data collection, provide accessible verification, correction and review mechanisms, and support ongoing accuracy maintenance within ICANN’s remit.

2. Mandatory aggregate reporting of abuse complaints and outcomes

Question: How could the reporting and transparency gaps identified in the Final Issue Report be addressed through mechanisms other than a full-fledged PDP, including establishing mandatory, standardized aggregate reporting to ICANN Contractual Compliance? Such reporting could cover statistics such as complaints received, domains involved, including compromised domains, actions taken, confirmed false positives, complaints closed for insufficient evidence and demonstrably fabricated complaints, without personal data or domain-level identifiers.

Rationale: This proposal principally addresses Contractual Obligations-C1: limited transparency in mitigation actions, while supporting compliance oversight and the report’s Data and Transparency objectives. Exploring alternative mechanisms could help advance this work alongside the two prioritised PDPs.

Consistent reporting would help ICANN Compliance identify patterns warranting examination and prioritise audits or outreach. It would help registrars and registries improve complaint handling, and enable community stakeholders to assess effectiveness and prioritise further action. For example, high numbers of complaints closed for insufficient evidence could indicate a need for clearer reporting guidance; false positives could indicate weaknesses in review safeguards; and compromised-domain figures could inform better notification and remediation arrangements.

Public aggregate summaries would also provide NCSG and the wider community with a shared evidence base, reducing the burden of independently gathering data. Reporting should use common definitions, distinguish complaints from unique domains and protect against identification through small statistical groups. Insufficient evidence should not automatically be classified as a fabricated complaint, nor should complaint volume alone establish non-compliance.

I would welcome colleagues’ views and any refinements needed for consolidation.


Thanks & Regards,Shiva Upadhyay



    On Friday, 9 October 2026 at 05:33:27 am IST, Rafik Dammak <00001e06d4af460b-dmarc-request at listserv.syr.edu> wrote:  
 
 Hi all,
reminder that today is the deadline to send the questions to board. It would be helpful to share what to agree with or not as we need to consolidate them in a clear set of questions/topics.
Best,
Rafik

Le mer. 7 oct. 2026 à 13:13, Rafik Dammak <rafik.dammak at gmail.com> a écrit :

hi all,
a reminder that we should submit the questions by 9th October. Please share your input.
Best,
Rafik

Le ven. 2 oct. 2026 à 23:50, Rafik Dammak <rafik.dammak at gmail.com> a écrit :

Thanks all for the comments and suggestions. We have one week to finalize our questions and submit them.
Best,
Rafik

On Thu, Oct 1, 2026, 06:27 Andrea Glandon <andrea.glandon at icann.org> wrote:

Hello all, 
A small update was sent for the question from the Board.
The NCSG has cited challenges with capacity for supporting policy development in addition to the other community work such as reviews and has expressed concerns about the amount of concurrent work. What are the NCSG’s most significant challenges in monitoring and deciding which work to prioritize and focus resources? How can the Board assist the NCSG to plan and position itself better to ensure it is actively engaged on its priority policy topics for the future? 
Thanks!Andrea GlandonPolicy Operations SpecialistInternet Corporation for Assigned Names and Numbers (ICANN)
From: NCSG-Discuss <NCSG-DISCUSS at LISTSERV.SYR.EDU> on behalf of Rafik Dammak <00001e06d4af460b-dmarc-request at LISTSERV.SYR.EDU>
Date: Wednesday, September 30, 2026 at 03:42
To: NCSG-DISCUSS at LISTSERV.SYR.EDU <NCSG-DISCUSS at LISTSERV.SYR.EDU>
Subject: [Ext] [ICANN87] Board's questions to NCSG


Hi everyone,
As usual during the ICANN meeting,  we will have interaction with the ICANN board during a joint meeting in ICANN87. The board sent us this question below:
The NCSG has cited challenges with capacity for supporting policy development and has expressed concerns about the amount of concurrent work. What are the NCSG’s most significant challenges in monitoring and deciding how to support  policy development work? How can the Board assist the NCSG to plan and position itself better to ensure it is actively engaged on its priority policy topics for the future? 
The board is also asking us if we have any questions for them to be addressed during the meeting and we should submit by 9th October.

Please share your ideas and comments, and we will summarize/consolidate them.

Best regards,

Rafik



  



  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.ncsg.is/pipermail/ncsg-discuss/attachments/20261010/ea8a0073/attachment-0001.htm>