ICANN 72

Dates:	Prep Week: October 12-14, 2021 AGM: October 25-28, 2021
Location:	Seattle, WA
Venue:	Virtual
Website:	ICANN 72 (registration required)

ICANN 72 was the annual general meeting for 2021, held in October. The meeting was fully virtual in response to the COVID-19 pandemic. The meeting schedule was based on the time zone of the intended host city, Seattle. Note that users must be logged in to their ICANN account in order to view information about meeting sessions, transcripts, and archived video and audio.

Board Composition & Leadership

As with every annual general meeting, a number of board members ended their terms of service: Ron da Silva (ASO), Lito Ibarra (NomCom), Merike Käo (SSAC Liaison), and Nigel Roberts (ccNSO) concluded their terms on the board. Alan Barrett (ASO), Edmon Chung (NomCom), James Galvin (SSAC Liaison), and Katrina Sataki (ccNSO) were elected to the board during the organizational meeting.

Themes

Interacting with Governments

• ICANN Executive Team Response (Mandy Carver): ICANN's Government Engagement is growing to meet the need to learn about and give input on DNS-related legislation around the world; this is not the purview of the GAC.
• In the joint ICANN Board-GAC session, the GAC recommended that the board engage in less formal and more substantive interactions with the GAC to get more done toward working with governments on geopolitical Internet issues.

DNS Abuse

• Trusted Notifier Framework
• Interisle gave a presentation to the BC on its Phishing Landscape 2021.
• Goran Marby pointed to DNS Security Facilitation - Technical Study Group recommendations as an indication of the 12 steps ICANN could take in response to Cybersecurity if not directly DNS Abuse

SubPro

• ODP

In the GAC Discussions on Subsequent Procedures, Karen Lentz explained that a version of the ODP generally happens anyway following the ICANN Board's reviewing of a Consensus Policy; now it has just been formalized. Likewise, the funding is not outside of what is already happening; rather, it reflects processes that are or would happen as ICANN Organization determined next steps toward implementation (or not).

• DNS Abuse Mitigation Rider

There were several discussions around incorporating responses to DNS Abuse into the Contractual Compliance obligations of the next round.

• In the ICANN Board and SSAC Joint Meeting, Maarten Botterman asked Geoff Huston whether there would be a way to know if the DNS can survive future rounds of additional TLDs and second-level strings. His response:
  • Sac117 (see also octo-15). Root zone can’t grow infinitely. Is there a way to see whether there will be imminent demise of the dns? We can collect and analyze data about the DNS's behavior/nature but it’s not possible to have an early warning system or no when it will collapse
  • flattening the DNS solves some technical issues but creates problems around resolving queries for which the hierarchical architecture is better suited; if different labels lead to different behaviors, then we will be in unchartered territory; we've seen a little a bit of this with IDNs. It will be unpredictable for the entire system
  • support for RSAC002, 047 (measuring the DNS)

Universal Acceptance

• IDNs,
  • ccNSO updated the GNSO on ccPDP4 on validation and delegation of ccTLD IDN variants and what triggers IDN ccTLD retirements
  • GNSO held a session on the EPDP on Internationalized Domain Names
    • Key topics:
      • IDN tables, confusing similarity, and IDN implementation Guidelines - will they now apply to both ccTLDs and gTLDs?
      • will the tables be publicized for second-level strings too?
      • ICANN Board is asking GNSO to expedite the Guidelines item for security reasons
      • interaction with SUBPRO, especially for challenges over validation because not supported by RZ-LGR
      • can we assume that label requirements will be built into the algorithmic check in the next round of applications' submission system?

SSAD

On 17 May 2018, the ICANN Board approved the Temporary Specification for gTLD Registration Data to allow contracted parties to comply with ICANN contractual requirements while also complying with the European Union's General Data Protection Regulation, triggering a GNSO Council initiation of a PDP on 19 July 2018. Phase 1 was to confirm the Temporary Specification by 25 May 2019. Phase 2 was chartered to discuss a standardized access model to nonpublic registration data, aka SSAD.

• ALAC expressed unhappiness to the ICANN Board over SSAD ODP, EPDP phase 2 recommendations, emphasizing SSAD would probably not be worth the cost and would run into trouble with NIS2 when passed.
• The BC was presented with a model and demo capable of supporting both sides of the SSAD challenge. It provides the verifiable claims to support the evaluation of requests from requesters and allows the logic engine to evaluate the lawfulness of the request, even if the backend remains manual on the registrar side.
• In the SSAC Public Meeting, Steve Crocker presented a summary of SAC118's three recommendations.

1. The GNSO and ICANN Organization should focus on building and operating a timely, reliable, effective, and efficient differentiated access system for competing interests.
2. to address issues around legal/natural personal registration data:
   1. There should be a data element to denote the legal status of the registrant, which can be displayed as publicly available data;
   2. at the time of new domain registration, registrars should be required to classify all registrants as natural or legal persons;
   3. Registrants should continue to have the option of making their contact data publicly available; and
   4. Legal person registrants should be able to protect their data via privacy and proxy services.
3. On Pseudonymizing Email Contacts:
   1. separate the ability to quickly, effectively contact registrants without disclosing personal data from helping investigators correlate registrations with contact information;
   2. registrars should support registrant-based email contact and develop safeguard requirements for them;
   3. EPDP Phase 2A should not specify a method for correlating registrations with contact information

• In the ICANN Board-SSAC Joint Meeting, Becky Burr clarified that the SSAD will deliver one thing alone: a single, unified intake system. It will not be predictable and uniform in terms of out products, because it will continue to be up to registrars what the GDPR means to them.
  • Steve Crocker responded, "SSAD should be stopped cold now. It is not fit for purpose...Back up and start over."
  • Rod Rasmussen (SSAC Chair) responded, 1) SSAD's problems are going to lead to a lack of adoption. 2) ICANN is spending too much time focusing on fixing problems and not enough time on what we want to accomplish, which could be a way forward on unification.

Prioritization

• ICANN's Office of Planning and Finance presented its plans for developing a Prioritization Framework

Data Accuracy

• The GNSO Council created a Registration Data Accuracy Scoping Team to consider current enforcement and reporting; measurement of accuracy, and effectiveness; this meeting spent a significant amount of time discussing the definition of accuracy and spent a little bit of time on determining how much time each step will take to answer whether changes should be recommended to improve accuracy levels; how and by whom they would be developed; and whether existing contractual requirements may necessitate a PDP or contractual negotiations.
• In the GAC session called 'GAC Discussion: WHOIS and Data Protection,' Laureen Kapin led a discussion on the need for validated "operational" accuracy, as opposed to merely syntactical accuracy, in terms of registrants' contact information, as GAC members often represent law enforcement and regulatory bodies.

Transfer Policy

• The GNSO Transfer Policy Review PDP Working Group focused on enhancing security without limiting options for verification
• In the SSAC Public Meeting, Steve Crocker presented SAC119, which concerns two security risks:

1. A domain name can experience a discontinuity of DNS resolution and DNSSEC validation if the transfer of DNS Services is not considered during the process.
2. A domain name is more at risk of being hijacked if the authInfo code is not managed based on best practice security principles.