Tag: ePDP

ICANN73 or the difficult equation of preserving a weakened global model

ICANN73 or the difficult equation of preserving a weakened global model

In recent years, ICANN, the regulator of a “universal resolution” of the Internet for all Internet users, has been confronted with new difficulties that are weakening the body and its model. Its mode of operation has had to be adapted to an unprecedented global pandemic and its model of a global Internet is now being questioned by the growing desire of states to emancipate themselves from it, with the tragic conflict in Ukraine pushing the Urals a little further away from the Rockies. But the difficulties also come from its immediate environment with the rise of alternate roots. It is in this context and following a previous edition marked by tensions around the subjects that make up its topicality and which are struggling to move forward, that the 73rd summit opened with great expectations.

For once, the 73rd ICANN meeting did not kick off on a Monday, the day scheduled for the first working sessions. On Sunday 6 March, ICANN published a communiqué stating that its Board of Directors had decided to allocate an initial sum of US$1 million in financial assistance to support access to the Internet infrastructure in emergency situations in Ukraine. This was a way to launch an edition where the conflict in Ukraine was bound to be on everyone’s mind and in many debates.

The conflict in Ukraine in the background

Indeed, on Monday afternoon the very first plenary session of the summit, that of the GAC, the body representing governments, began with a condemnation of Russia’s actions in Ukraine. Several members of the GAC, including France, took the floor.

Two weeks earlier, Ukraine was hit by the first Russian strikes. Ukraine, through Mykhailo Fedorov, Deputy Prime Minister and Minister of Digital Transformation, asked ICANN to target Russia’s access to the Internet by revoking specific country code top-level domains operated from Russia, revoking SSL certificates associated with the domain names and shutting down a subset of root servers located in Russia. ICANN responded negatively to this request in a letter from Goran Marby, ICANN’s CEO, to the Minister, reminding that ICANN’s mission is to take steps to ensure that the Internet operates in a global and non-politicised manner. ICANN is a neutral body, Goran Marby repeated at the Public Forum that closed the summit.

Prospects for ongoing policy development processes

During the previous ICANN summit, tensions were palpable in certain bodies, especially the one representing the registries, due to policy development processes that have become longer with additional stages such as the ODP (Operational Design Phase) that now intervene between the return of final recommendations and the Board’s vote on them.

The first subject to be affected by the ODP stage is the Standardised System for Access to domain name Data. This system, known as SSAD, has been under discussion for more than three years as part of a policy development process known as ePDP, of which SSAD is part of phase 2. It is intended to return to a more uniform model of access to domain name registration data for legitimate requests. However, the ODP, which has just been finalised six months later than the initial estimated timetable, has highlighted the difficulty of framing this project. The number of users is in fact estimated at between 25,000 and 3 million to address 100,000 to 12 million requests, values that lead to a particularly wide range of implementation and maintenance costs (from 34 to 134 million US dollars) and consequently to access costs for the future system that are very difficult to evaluate, the idea being to finance the system exclusively with access costs. At ICANN73 , a way out was suggested: Create a pilot project to limit the risks, in other words, envisage a small-scale SSAD before considering the next steps.

It has been noted that regarding phase 1 of the aforementioned ePDP there is now a finish line. It is estimated to be completed by the end of 2022. This phase aims to create a perennial policy to replace a Temporary Specification that addressed the GDPR in the domain name eco-system in 2018.

The other major topic is that of a next series of new generic extensions. Let’s remember that the previous series will celebrate its ten years in 2022. Since then, it has been a policy development process (PDP) that stretched from December 2015 to February 2021 when the body representing generic policies, the GNSO, adopted the final recommendations report. Last September the ICANN Board decided to initiate an ODP process that could last until early next year. This topic has been the subject of much criticism as the finish line seems to be getting further and further away, even though it has been ten years since the last round. Nevertheless, one option was discussed at ICANN73, that of starting the implementation work without delay, a proposal that, while it rather displeased the ICANN CEO, was rather positively received by the ICANN Board, which should however only vote on the recommendations of the final report of the PDP process after the end of the ODP.

Geopolitical, legislative and regulatory aspects – a new feature

Among the novelties of this summit was a plenary session devoted to geopolitical, legislative and regulatory aspects. This session provided an overview of the many initiatives coming from institutions such as the United Nations, the International Telecoms Union, the Council of Europe and the OECD, as well as from States such as Russia with its digital sovereignty law and China with its law on cybersecurity and data security. This session also allowed to clarify perceptions such as ICANN’s position on the European NIS2 directive. Goran Marby indicated that ICANN does not have an official position on this issue.

The return of the GDD/GDS summit?

Until 2019, ICANN proposed a more operational summit called GDD Summit in addition to the three policy summits. This was abandoned in the context of the global pandemic and has not been mentioned since. The possibility of relaunching this mechanism was put on the table at ICANN73. There could therefore be a fourth annual ICANN meeting as early as the end of this year, with November being mentioned as a possible date. However, between now and then, there will be ICANN74 in June and ICANN75 in September, two events where the hybrid mode, face-to-face and remote, should be in place.

Nameshield Comments

ICANN 73 was undeniably marked by the conflict in Ukraine. A conflict that paradoxically allowed to find a semblance of unity with the outline of solutions as the fact of allowing the Ukrainian registrars to derogate from the ICANN policies through a device called “extraordinary circumstances” and to recall the ICANN to its fundamentals, an apolitical body working for a global Internet. By mapping out the geopolitical, legislative and regulatory contexts, the body also seems to have realised that the world ahead may make it even more difficult to preserve its model of a globalised internet. The feeling after this summit is that more concrete proposals and perspectives have been given on some of the subjects discussed.

For the next round, it is the threat of alternative roots to the DNS that could give an unexpected boost to the current process. These roots that tend to develop could cause collisions between requests if one day identical TLDs cohabit in two environments, a risk that is all the more increased if ICANN marks the step on a future round. Another risk is to be challenged for the allocation of regulatory TLDs when an identical TLD would exist on an alternate root.

Image source: ICANN’s website

ICANN72, between prioritisation needs and fragmentation risks

ICANN72, between prioritisation needs and fragmentation risks

At the end of October, the 72nd ICANN summit was held, devoted to the development of policies that impact the domain name system (DNS) and the global Internet community. As already announced during the past summer, this latest annual meeting was to be held by videoconference in the time zone of Seattle in the United States. “Sleepless” were therefore not in Seattle but rather in Europe.

ICANN72, between prioritisation needs and fragmentation risks

The thorn in the side of the next round of new generic extensions

A month before this summit, ICANN announced the schedule for the Operational Design Phase (ODP) for one of the most anticipated topics by the contracting parties: the organisation of a future round of applications for new generic extensions. The ODP is a new mechanism now linked to the policy development process (PDP). It is similar to a project scoping exercise as it aims to identify the steps, risks, costs and resources to be allocated to implement a project, in this case a new round of generic extensions. The PDP was conducted between 2015 and 2020, with the submission of a final recommendations report to the ICANN Board in March of this year. However, it is not until February 2023, almost two years later, that the Board should consider these recommendations, the time to let the ODP conduct. Indeed, ICANN confirmed before the opening of ICANN72 that this scoping phase should last sixteen months in its entirety, including ten months for the conduct of the ODP, three months upstream to initiate the latter and in particular to constitute the teams that will conduct it and three months downstream to conclude the work. This timetable surprised many of the contracting parties and gave rise to much discontent. These discontents were particularly expressed through the Brand Registry Group that represents and promotes the interests of its members, dotBrand owners. For most members, things are not moving fast enough and the ODP would even be partly useless since some aspects overlap with the work already conducted during the previous PDP. Another aspect pointed out was the cost of the ODP estimated to $9 million, which is not a small amount.

The clouds are gathering as are the processes underway

As the other sessions scheduled during the week-long summit progressed, it was clear that the clouds continued to gather in the weather of ICANN’s policies. For example, the announcement of the launch of an expedited policy development process (ePDP) to review the Uniform Domain-Name Dispute Resolution Policy (UDRP), which allows for the recovery of disputed domain names, caused a great deal of misunderstanding, given that a review of all rights protection mechanisms (RPMs) has already been conducted between 2016 and 2020 and its final recommendations have not yet been examined by the ICANN Board. Now this review to validate the recommendations is scheduled to take place at best in the summer of 2022, by which time the aforementioned ePDP should be finalised. This example illustrated the gap that is being created between the community’s expectations for decisions and ICANN’s decision-making bodies, which seem to be overwhelmed by the policy negotiation processes that are piling up and stretching out over time, risking rendering decisions obsolete if they are made too late. According to some participants, this even affects ICANN’s ability to continue to carry out its mission as set out in its founding documents: To preserve and enhance the operational stability, reliability, security and global interoperability of the Internet.

“Prioritisation”, the word is out

On the first day of the sessions, ICANN CEO Goran Marby defended himself against the idea that the Board was slow to make decisions. He pointed out that the Board had recently examined 228 recommendations from the Competion Consumer Choice & Consumer Trust (CCT), which had just conducted a review to assess the extent to which the expansion of generic TLDs, gTLDs, had promoted competition, consumer confidence and consumer choice. 166 have been approved to date, 44 placed on hold and 18 rejected. Many of these measures are correlated with research and data collection to better understand market trends for new gTLDs.

Goran Marby also justified the delays in decision-making by the large number of ongoing and overlapping issues and by the fact that ICANN sometimes needs additional expertise to make decisions. In response to the criticisms, he also indicated that ICANN is now working on some form of prioritisation, a wish expressed by NAMESHIELD that seems to have been heard. However, Marteen Botterman of the Board nuanced this by specifying that prioritisation is not the Board’s responsibility, as it must ensure that the multi-stakeholder model is respected and must therefore maintain a certain neutrality on the subjects submitted to it.

A risk of fragmentation

From an organisation that has difficulty in making decisions, to its questioning, there is only one step. From the first day of the sessions, Goran Marby, who was particularly involved in the exchanges, spoke of “threats to ICANN”. ICANN is working on a risk management framework for the organisation. He also spoke of the need to talk more closely with governments as the current governance model is being challenged. Indeed, one only has to look at Russia to see that in November 2019, the Russian government introduced new regulations that create a legal framework for centralised state management of the internet within Russia’s borders. Russia has also proposed to hand over the management of the root servers to BRICS (Brazil, Russia, India, China and South Africa) member states. Proof that the States are going on the offensive in terms of their legislation, recent European directives also have an impact on the governance model, such as the General Data Protection Regulation (GDPR) and the forthcoming NIS2 (Network and Information Systems) directive, subjects which were also recalled at the summit. In China, for example, a law strengthening controls on digital services operated in China has just been adopted.

The failure of the ICANN governance model, if confirmed, could lead to a fragmentation of the DNS as we know it today, a fragmentation which takes shape as ICANN becomes bogged down in sterile debates. This summit has highlighted that the community and ICANN leadership have identified this major risk. The challenge for the future is to address it. We will watch the next ICANN summit scheduled in March 2022.

The observation that DNS regulation policies are bogged down, particularly at ICANN72, was widely shared by NAMESHIELD well before this summit. In particular, NAMESHIELD had expressed the need to prioritise topics in agreement with the community during the ICANN72 preparatory sessions. NAMESHIELD, which participates in working groups working on recommendations in the context of the periodic reviews conducted by ICANN, also advocated for re-enchanting voluntary work and helping diversify representatives in these working groups, in particular from small structures. Indeed many volunteers are now overwhelmed by the increasing volume of topics to be considered as the processes accumulate and decisions do not follow. New participants are discouraged from taking an interest in these topics by lengthy and cumbersome processes.

Image source : David Mark via Pixabay

ICANN71: GAC in the spotlight

ICANN71: GAC in the spotlight
Image source : icann.org website

Some 56 sessions were scheduled as part of the 71st ICANN Summit in The Hague. Held once again exclusively by video conference due to the global health situation, no less than a quarter of these sessions were organised by the GAC, the governmental advisory committee that advises ICANN on public policy issues related to ICANN’s responsibilities in the domain name system. The GAC has been very active on all current ICANN policy issues and has clearly made its mark.

The GAC currently has 179 members, representing a majority of the world’s countries. This gives it a good representation on a global scale to speak to a global governance body. The GAC is highly organised and precedes ICANN meetings with preparatory meetings that enable it to gather opinions at local level and then relay them to the governance body. Once again, this summit highlighted the fact that there are really a lot of policy issues going on at ICANN level.

The fight against DNS abuse

The topic of abuse has almost become a chestnut at ICANN summits, as it has been at the center of concerns for almost two years. While registries and registrars are already subject to a battery of obligations on this topic, many stakeholders consider these to be insufficient to really address the issue. The year 2020 has indeed seen an explosion in cybersecurity breaches, particularly as a result of the global pandemic, which has seen even more consumption via the web, particularly due to confinements, and where working methods have had to be reinvented in favour of the remote. It is clear that little has been achieved to date on that issue.

A thorough initiative rich in proposals was formulated by the SSAC (Security and Stability Advisory Committee) which, in its 24 recommendations transmitted to the ICANN Board, put forward the idea of initiating an expedited Policy Development Process (ePDP) with a view to developing an anti-abuse policy. Their report to the Board three months ago has not been acted upon to date. The second and more recent initiative comes from the Registry Stakeholder Group (RySG). It has finalised, with input from the GAC, a framework aimed specifically at botnets, attacks that use forms of Trojan horses to take control of computers to form networks of computers to carry out further attacks. Its principle is to allow voluntary registries to join a scheme that requires them to preemptively block bulk names generated via DGAs (Domain Generation Algorithms), algorithms used to periodically generate large numbers of domain names that can be used as rendezvous points with their command and control servers. The large number of potential rendezvous points makes it difficult for law enforcement to effectively counter botnets, as infected computers will attempt to contact some of these domain names every day to receive updates or commands. The principle here is therefore preventive. In return, the registries would benefit from incentives and would not have to pay the tax collected by ICANN when a domain is created. This initiative is to be welcomed, but it is carried out more directly by the RySG and is therefore not consensual, hence its voluntary nature and therefore its very limited impact.

The reason the DNS abuse issue is so stalled is that it is confronted with other ongoing and upcoming policy development processes and competing interests between bodies, the Intellectual Property Constituency (IPC) for example being very concerned about access to contact data in domain name directories, the RySG about the launch of the next round of new gTLDs that they want to see move forward.

The impact of the General Data Protection Regulation (GDPR) on domain name registration data

Recall that to replace the Temporary Specification, which was put in place on 17th of May 2018 just a few days before the GDPR came into effect, an ePDP process was initiated. This process, described as expeditious, seemed to be far from being finalised at this new ICANN summit, even though three years have passed.

Segmented into three phases, phase 1 aims to provide a perennial policy that should frame the management of personal data of domain names to replace the temporary Specification that notably redacted personal data from domain name directories (via the Whois and RDAP protocols). Its drafting is progressing but no date is known for its finalisation and therefore possible implementation. The delay is partly due to the difficulty of transcribing certain recommendations, one of which was in conflict with an existing policy, the Thick Whois Transition Policy, which provides for the systematic transfer of detailed contact data from registrars to registries. Another pitfall is that the policy overlaps with other existing policies, which therefore also require ongoing adaptation.

Phase 2 concerns the establishment of a harmonised system of access to redacted name directory data for “legitimate” interests. This system is now known as the Standardised Data Access System (SDAS). The first hurdle was that the Generic Names Supporting Organization (GNSO), the policy-making body for generic names, had surprisingly approved all of the recommendations in the Final Report, even those that did not achieve consensus. The recommendations to create this system were therefore all transmitted to the ICANN Board, which rather than pronounce and vote on their application decided to first initiate an Operational Design Phase (ODP). Initiated at the end of March by the Board, it should last six months and aims to identify the stages, risks, costs and resources to be allocated, with a consultation of the community once a milestone has been reached. It is therefore a form of project scoping. The publication of a Request for Information is planned for June for a first consultation of the community.

A Phase 2a additional layer of the PDP aims to assess the possibility of unbundling the contact data of publishable legal entities from non-publishable natural persons. Initiated in December 2020, it resulted in five recommendations in an initial report open for comment until 19th of July 2021. The first recommendation, which was much commented on at ICANN71 , finally recommends that nothing should be changed by allowing players who so wish to make this differentiation. This process will continue with a final report of recommendations expected in the second half of the year.

The GAC considers that improvements are needed in both of the above-mentioned topics. In particular, it considers that the system does not go far enough to protect consumers and increase their confidence. It also regrets that the evolution of the system over time has not been framed and fears that the cost, since access is subject to an accreditation system, could be a deterrent, particularly for those involved in the fight against security breaches who need access to registration data. On DNS abuse, the GAC reiterates the need to address this issue. It has already made several proposals at previous summits.

What about the next round?

The next round is still undecided. We just learned that the ICANN Board, which has just received the last inputs on the recommendations for the next round of new gTLDs, has confirmed that it will start an Operational Design Phase (ODP) to estimate the steps, risks and resources necessary to implement these recommendations. Not yet planned, the Board said it had asked ICANN org to prepare a document to frame the ODP in order to draft the resolution that will formalise it. This resolution will set a deadline for completion of the ODP, possibly six months as with the SSAD. 

The GAC, for its part, recalled the issues of specific concern to its members. These include: predictability, voluntary and mandatory registry commitments including how to address DNS abuse, its desire to see support for new applicants better adapted, particularly for less favoured areas, its opposition to closed generic TLDs, the consolidation of its ability to evaluate all applications in order to issue advices and warnings, and its opposition to private auctions to decide between applicants for the same gTLD. It also wishes to support non-profit community applications.

Other issues carried by the GAC are very committed

Other policy development processes are underway, such as the one on Governmental and Non-Governmental Organisation Identifiers (IGOs, INGOs), a process on the rights protection mechanisms, or in the initial phase a PDP on domain transfers and on the launch pad a PDP on IDNs. The GAC did not fail to recall the central issue of accuracy of registration data which is considered insufficiently addressed by the current obligations espacially due to the impact of GDPR. This topic will indeed be central in the perspective of the future NIS2 directives and the Digital Services Act currently being drafted at the European level. The GNSO was challenged by the GAC on the examination of this topic, which has not really started, and apologized for having too many topics in progress. Tensions that the GNSO has sought to alleviate by spending time reviewing its liaison with the GAC to improve it, a decidedly offensive and active GAC.

What About Future Summits?

ICANN summits usually end with a public forum where the public can directly question the Board. As a sign of a (temporary?) improvement of the health state on the covid, the traditional forum was dedicated to the future ICANN summits to know if they should be held in person. From this session it emerged that the answer is not obvious. At issue were the different levels of vaccination and access to vaccines in different countries, the currently restricted conditions of entry to the USA, ICANN72 being held in Seattle and the evolution of the pandemic which remains uncertain. This forum provided an opportunity to comment on a recent survey conducted by ICANN which showed that the majority of those interested in ICANN events considered that face-to-face meetings should be reactivated (54%). At the end of this session, ICANN committed to arbitrate during July. The format of ICANN72 could be hybrid, with limited on-site representation and the continuation of the remote format.

A notable feature of this summit was the large number of ongoing issues and the impression that things are moving forward with difficulty. This has resulted in notable tensions between bodies and discontent expressed, for example, by the group of representatives of geographical extensions, the geoTLDs. If for some, the return to face-to-face meetings seems to be the solution to improve things, through our presence in certain bodies and our participation in working groups, we think that it is rather a problem of visibility due to too many subjects being launched in parallel, some of which overlap with a clear lack of prioritisation. The ODP, the new tool which aims to frame the implementation of a harmonised system of access to registration data and which is now being applied in the next round, may go some way to improving these perceptions. Another aspect to be considered is the diverging interests between bodies. Here, facilitated exchanges can perhaps improve things.

ICANN66 at Montreal – A contrasting summit

During the first half of November, the 66th ICANN Summit was held in Montreal, Canada. This third and final annual summit devoted to policies applicable to Internet naming was eagerly awaited as the topics under discussion are numerous. At its closing, however, it left many participants a little bit disappointed.

A preview of the topics and postures during the weekend before the official launch of the Summit

The weekend before the official opening of the Summit is usually an opportunity to get an overview of the topics and postures involved. Not surprisingly, the expedited Policy Development Process (ePDP) which aims to develop a consensus rule to specify future conditions of access to personal data that are no longer published in the WHOIS, the domain name search directory, due to GDPR, is one of the major topics.

Among other related topics, the replacement of the same WHOIS by the RDAP (Registration Data Access Protocol) probably next year for generic domain names. This replacement is not insignificant when we know that WHOIS has been in use for nearly 35 years.

The body representing governments, the GAC, has weighed up the issue of domain name abuse, which has taken off considerably on the new generic extensions launched in 2012. When we know the rise of Internet practices aimed at weighing on elections in certain countries and the economic impact of computer attacks and hacking, we understand that this subject is being pushed by the GAC. While one of ICANN’s topics is to clarify in their texts the notion of malicious uses, this term refers to domains registered for phishing, malware, botnets and spam, the other part concerns the means to stem them. The existence of abusive domains indeed threatens the DNS infrastructure, impacts consumer safety and threatens the critical assets of public and commercial entities. Finally, and not surprisingly, the subject of a future round of new generic extensions has also been on many lips.

ICANN66 at Montreal - A contrasting summit
Cherine Chalaby at the ICANN Summit held in Montreal

“The best ICANN summit”, really?

During the traditional opening ceremony, which brings together all the guests for one hour (2500 according to Goran Marby, ICANN CEO) in a huge room to listen to various speakers, including Martin Aubé of the Quebec Government’s Ministry of Economy and Innovation, Cherine Chalaby, one of the ICANN Board members whose term ends at the end of the year, told his audience that ICANN66 would be the “Best ICANN summit”. It must be said, however, that at the end of the week of debates and meetings, which followed one another at a sustained pace, while the subjects under discussion are really numerous, the feeling regarding this assertion was more than mixed for many participants.

First, the expeditious process for access to WHOIS non-public data is progressing with a framework constrained by ICANN and the Personal Data Protection Authorities. The outcome of this process is envisaged between April and June 2020 and it is currently a centralized model where ICANN would allow the future lifting of anonymity of data that are now masked due to GDPR which holds the line.

Then the subject that was probably most often mentioned during this new summit week concerned abuses with domain names. For ICANN, the subject is central because it is directly correlated to its totem: the stability of the Internet for which they are the responsible. Since February 2019, ICANN has been publishing some metrics on malicious practices identified through DAAR, their Domain Abuse Activity Reporting.

Their latest report presented in Montreal shows that 364 extensions (mainly new generic extensions from the 2012 round) revealed at least one threat posed by one of the domain names activated on these extensions. More worryingly, new generic extensions would still account for nearly 40% of malicious uses, compared to 60% for historical generic extensions. This figure should be highlighted with the volume of these two categories of extensions. Indeed, out of just over 200 million generic names, new generic domains represent only 15% of the total number of registered names. ICANN therefore wants this subject to be taken up by the entire community present in Montreal.

Proposals were made by the various bodies present, some of which went so far as to request a policy development process (PDP). This last proposal, if it were to obtain ICANN’s approval, would have the unfortunate consequence of postponing the hypothetical schedule for a next round of new extensions, a subject that interested many of the guests present in Montreal. Indeed, for ICANN, the problem of the concentration of malicious practices in the new generic extensions must be solved before any future round, so that the PDP still in progress on the review of the last round of 2012 has gone almost unnoticed.  

If the rules are slow to evolve on malicious uses, your Nameshield consultant can already provide you with adapted solutions to your needs on this key matter.

Status of ongoing projects after ICANN64

A month ago, ICANN held its first annual meeting with the Internet community in Kobe, Japan. At this summit, ICANN presented the major projects of the year and those of the coming years. Let’s look back at the main topics.

The implicitely constraint of the GDPR

While in May 2018, Europe adopted ambitious legislation to protect users’ personal data, ICANN imposed a regulatory framework on domain name players to bring the industry into line with the constraints of the GDPR.

In the absence of consensus, this framework was imposed when the GDPR came into force on May 25, 2018. It contains non-consensual provisions such as no longer publishing in the registry’s registration directory service, which currently operates via the Whois protocol, data that can be assimilated to personal data for contacts associated with domain names: registrant contacts, administrative contacts, technical contacts. Exit therefore the names, first names, postal addresses, telephone numbers and anonymization of email addresses or hidding via a contact form.

However, as provided for in the Bylaws, the rules governing the role and operation of ICANN, non-consensual rules may not be imposed beyond one year. ICANN therefore had the May 2019 deadline in mind throughout the Kobe meeting.

To build on this, last year ICANN initiated an expedited policy development process (ePDP) whose delicate mission was to develop consensus rules to replace the temporary provisions currently in place.

Shortly before ICANN64, this working group, in which Nameshield participates, submitted its proposals to the GNSO, the ICANN body that manages policy development for generic domain names. This report, which is currently open for comments, is expected to result in a final framework that will be submitted to the ICANN Board in early May for voting and promulgation.

The proposals outline a target date for implementation by 29 February 2020. ICANN has therefore focused its efforts on managing the transition period between May 2019 and this still distant deadline of February 2020. The prevailing approach is rather pragmatic as it consists in keeping the provisions currently in place such as the masking of personal data in the Whois until all the new provisions can be implemented by actors such as registrars and registries by the above-mentioned deadline.

Access to hidden data subject to tensions

Launched in 2012 during the last round of openings of new domain name extensions but quickly relegated to the boxes, the RDAP (Registration Data Access Protocol), an alternative to the aging Whois protocol, has resurfaced with the GDPR because of its modularity, which allows, unlike Whois, to filter access to certain data according to the user’s profile.

ICANN confirmed in Kobe that this protocol will be widely deployed by this summer. First, this protocol will coexist alongside the Whois protocol. Registrars will therefore provide access to domain name data through both protocols.

The stakeholders present at ICANN64 also learnt about the project submitted by a technical study group mandated by ICANN on the operational way envisaged through the RDAP protocol for access to hidden domain name data. It has been the subject of tensions because it is not the result of a consensual process and ICANN suggested it could play a central role in collecting all requests to validate their authorization, with authentication of requests being carried out upstream by agents accredited by data protection authorities. This topic is also part of the new mission of the Policy Development Working Group (ePDP) in the coming months. Things can therefore evolve on this subject in the future.

Status of ongoing projects after ICANN64
Goran Marby, ICANN CEO, speaking on the proposed functioning of access to hidden data for domain names through the future RDAP

A multi-year strategic plan

At ICANN64, ICANN also presented progress on the implementation of a strategic operating plan for the organization for the period 2021-2025.

The adoption of a five-year plan is new for this organization, which has always operated on an annual basis. This plan must determine the priorities for the coming years, which is also a novelty in a context where multiple projects have always been carried out simultaneously without any real prioritization.

We already know that DNS security is one of the major issues of the coming period. Among the priorities identified are the reinforced fight against malware and the increased security of the DNS, in particular through a faster deployment of DNSSEC.

For the next round of new domain names extensions openings also mentioned, ICANN has also indicated that it will take into account the lessons learned from the previous round. Among them, new extensions are ten times more targeted than historical generic extensions (like .COM,.NET,.ORG,.BIZ,.INFO) by malicious practices such as typosquatting and dotsquatting on which phishing and pharming practices proliferate.

Feel free to contact your Nameshield consultant, who is very knowledgeable on all these subjects.