Subject: [weirds] Requirement Suggestions from ICANN-45

From: "Hollenbeck, Scott" <[email-masked]>
Date: Thu, 18 Oct 2012 14:22:26 +0000

Mentioned by Steve Metalitz (a member of the Intellectual Property Constituency) at the mic during yesterday's WHOIS update:

1. Add support for WhoWas [1] services.

2. Add info to responses to indicate when data elements have been validated by a registry.

Murray (in the role of WG chair panelist) made the point that our goal is to allow for protocol extensions to provide services like these. #2 implies that there's a requirement for registry operators to implement a data validation process, and as far as I know that doesn't currently exist.

Scott

[1] https://www.arin.net/resources/whowas/index.html

---

From: Ernie Dainow <[email-masked]>
Date: Fri, 19 Oct 2012 12:13:16 -0400

Seems to me that there are emerging requirements for both of these, in 
the Registrar Accreditation Agreement (RAA) 
http://www.icann.org/en/news/announcements/announcement-5-24sep12-en.htm

These are important requirements. Protocol design should really include 
these now, not as future extensions.

The following is extracted from 
https://community.icann.org/display/RAA/Negotiations+Between+ICANN+and+Registrars+to+Amend+the+Registrar+Accreditation+Agreement

Verification
It is our current understanding that law enforcement representatives are 
willing to accept post-resolution verification of registrant Whois data, 
with a requirement to suspend the registration if verification is not 
successful within a specified time period. However, law enforcement 
recommends that if registrant Whois data is verified after the domain 
name resolves (as opposed to before), two points of data (a phone number 
and an email address) should be verified.

Data Retention
Law enforcement representatives appear to be willing to accept a 
dual-tiered retention schedule, requiring some elements such as 
transaction data to be retained for a minimum of six months (not six 
months after the expiration of the domain name), while other kinds of 
data would be kept for two years past the life of the registration.

-Ernie

On 10/18/2012 10:22 AM, Hollenbeck, Scott wrote:
> _______________________________________________
> weirds mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/weirds

---

From: SM <[email-masked]>
Date: Fri, 19 Oct 2012 09:34:29 -0700

Hi Ernie,
At 09:13 19-10-2012, Ernie Dainow wrote:
>These are important requirements. Protocol design should really 
>include these now, not as future extensions.

[snip]

>months after the expiration of the domain name), while other kinds 
>of data would be kept for two years past the life of the registration.

There isn't any mention of data retention in the charter.  It seems 
to me that the WG will end up trying to solve "the Whois problem" if 
it tackles all the requirements being thrown in its path.

Regards,
-sm

---

From: "\"Michele Neylon :: Blacknight\"" <[email-masked]>
Date: Fri, 19 Oct 2012 16:54:15 +0000

The RAA is still being negotiated so the actual requirements for registrars have not been finalised

Regards

Michele

Mr. Michele Neylon
Blacknight
http://Blacknight.tel

Via iPhone so excuse typos and brevity

On 19 Oct 2012, at 12:13, "Ernie Dainow" <[email-masked]<mailto:[email-masked]>> wrote:

Seems to me that there are emerging requirements for both of these, in the Registrar Accreditation Agreement (RAA) http://www.icann.org/en/news/announcements/announcement-5-24sep12-en.htm

These are important requirements. Protocol design should really include these now, not as future extensions.

The following is extracted from https://community.icann.org/display/RAA/Negotiations+Between+ICANN+and+Registrars+to+Amend+the+Registrar+Accreditation+Agreement

Verification
It is our current understanding that law enforcement representatives are willing to accept post-resolution verification of registrant Whois data, with a requirement to suspend the registration if verification is not successful within a specified time period.  However, law enforcement recommends that if registrant Whois data is verified after the domain name resolves (as opposed to before), two points of data (a phone number and an email address) should be verified.

Data Retention
Law enforcement representatives appear to be willing to accept a dual-tiered retention schedule, requiring some elements such as transaction data to be retained for a minimum of six months (not six months after the expiration of the domain name), while other kinds of data would be kept for two years past the life of the registration.

-Ernie

Scott

[1] https://www.arin.net/resources/whowas/index.html
_______________________________________________
weirds mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/weirds

_______________________________________________
weirds mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/weirds

---

From: Peter Koch <[email-masked]>
Date: Mon, 22 Oct 2012 15:38:39 +0200

> it tackles all the requirements being thrown in its path.

+1;

while this oe "whowas" might be small extensions to the protocol,
(probably only a date added to the query for "whowas"), they are
different services.  Since we have to expect the WEIRDS spec
be misused as service description, i'd suggest the group stick to
its charter.

-Peter

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Sun, 28 Oct 2012 02:13:34 -0700

> be misused as service description, i'd suggest the group stick to

I don't believe we're chartered to do a WHOWAS service, just to be
clear.  It's not part of the existing basic WHOIS service that we're
trying to replace.

In terms of the second requirement (data validation), it's hard to say
whether or not that's in charter without a definition of what it is.
If it's simply "the registrar has done its due diligence trying to
confirm the data's validity" as a flag or date stamp in the reply,
then I suspect it's simply part of the data model, and thus in-scope.
If however there's an expectation that we will define what
"validation" means and also find a way to do it, then I would say
we're not going to tackle that one with this charter.

-MSK, co-chairin'