<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><div>Begin forwarded message:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><font face="Helvetica" size="3" color="#000000" style="font: 12.0px Helvetica; color: #000000"><b>From: </b></font><font face="Helvetica" size="3" style="font: 12.0px Helvetica">Liz Gasster <<a href="mailto:liz.gasster@icann.org">liz.gasster@icann.org</a>></font></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><font face="Helvetica" size="3" color="#000000" style="font: 12.0px Helvetica; color: #000000"><b>Date: </b></font><font face="Helvetica" size="3" style="font: 12.0px Helvetica">February 25, 2008 5:26:55 PM PST</font></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><font face="Helvetica" size="3" color="#000000" style="font: 12.0px Helvetica; color: #000000"><b>To: </b></font><font face="Helvetica" size="3" style="font: 12.0px Helvetica">Council GNSO <<a href="mailto:council@gnso.icann.org">council@gnso.icann.org</a>></font></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><font face="Helvetica" size="3" color="#000000" style="font: 12.0px Helvetica; color: #000000"><b>Subject: </b></font><font face="Helvetica" size="3" style="font: 12.0px Helvetica"><b>[council] Report on public suggestions of further studies of WHOIS</b></font></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; min-height: 14px; "><br></div> <div class="Section1"><p class="MsoNormal"><font size="2" face="Arial"><span style="font-size:10.0pt; font-family:Arial">All,<o:p></o:p></span></font></p><p><font size="2" face="Arial"><span lang="FR" style="font-size:10.0pt;font-family: Arial">You may recall that when the GNSO Council decided last October in LA to terminate the pending PDP on WHOIS, you also decided to solicit public opinions about the types of future studies that might be conducted on WHOIS, to inform future policy development. You may also recall that the 31 October resolution asks staff to prepare a summary of the submissions received (amended to request by February 25), and the Council would then </span></font><font size="2" face="Arial"><span lang="EN-GB" style="font-size:10.0pt;font-family:Arial">provide additional definition regarding potential data gathering and study requirements. Staff would then provide the Council with rough cost estimates for various components of data gathering and studies as requested by the Council. Based on those cost estimates, the Council will decide what data gathering and studies would be pursued; and 4) staff will perform the resulting data gathering and studies and report the results back to the Council.<o:p></o:p></span></font></p><p class="MsoNormal"><font size="2" face="Arial"><span style="font-size:10.0pt; font-family:Arial">The public comment period closed on 15 February, and attached is a summary and analysis of the public comments we received (25 total) that I’ve compiled with the considerable help of an expert consultant, Lorrie Faith Cranor. Dr. Cranor is a professor of computer science at Carnegie Mellon U. and an expert researcher on Internet privacy, security and related issues, and we are fortunate to have her expertise to review and collate study suggestions.<o:p></o:p></span></font></p><p class="MsoNormal"><font size="2" face="Arial"><span style="font-size:10.0pt; font-family:Arial"><o:p> </o:p></span></font></p><p class="MsoNormal" style="text-autospace:none"><font size="2" face="Arial"><span style="font-size:10.0pt;font-family:Arial">As you consider next steps, I do want to point out that in the attached summary, we have grouped proposed studies according to the following topic areas: <o:p></o:p></span></font></p><p class="MsoNormal" style="text-autospace:none"><font size="2" face="Arial"><span style="font-size:10.0pt;font-family:Arial"><o:p> </o:p></span></font></p><p class="MsoListBullet"><font size="2" face="Arial"><span style="font-size:10.0pt;font-family:Arial"><span style="mso-list:Ignore">1.<font size="1" face="Times New Roman"><span style="font:7.0pt "Times New Roman""> </span></font></span></span></font><font size="2" face="Arial"><span style="font-size:10.0pt;font-family:Arial">WHOIS misuse <o:p></o:p></span></font></p><p class="MsoListBullet"><font size="2" face="Arial"><span style="font-size:10.0pt;font-family:Arial"><span style="mso-list:Ignore">2.<font size="1" face="Times New Roman"><span style="font:7.0pt "Times New Roman""> </span></font></span></span></font><font size="2" face="Arial"><span style="font-size:10.0pt;font-family:Arial">Compliance with data protection laws and registrar accreditation agreements<o:p></o:p></span></font></p><p class="MsoListBullet"><font size="2" face="Arial"><span style="font-size:10.0pt;font-family:Arial"><span style="mso-list:Ignore">3.<font size="1" face="Times New Roman"><span style="font:7.0pt "Times New Roman""> </span></font></span></span></font><font size="2" face="Arial"><span style="font-size:10.0pt;font-family:Arial">Availability of privacy services<o:p></o:p></span></font></p><p class="MsoListBullet"><font size="2" face="Arial"><span style="font-size:10.0pt;font-family:Arial"><span style="mso-list:Ignore">4.<font size="1" face="Times New Roman"><span style="font:7.0pt "Times New Roman""> </span></font></span></span></font><font size="2" face="Arial"><span style="font-size:10.0pt;font-family:Arial">Demand and motivation for use of privacy services <o:p></o:p></span></font></p><p class="MsoListBullet"><font size="2" face="Arial"><span style="font-size:10.0pt;font-family:Arial"><span style="mso-list:Ignore">5.<font size="1" face="Times New Roman"><span style="font:7.0pt "Times New Roman""> </span></font></span></span></font><font size="2" face="Arial"><span style="font-size:10.0pt;font-family:Arial">Impact of WHOIS data protection on crime and abuse<o:p></o:p></span></font></p><p class="MsoListBullet"><font size="2" face="Arial"><span style="font-size:10.0pt;font-family:Arial"><span style="mso-list:Ignore">6.<font size="1" face="Times New Roman"><span style="font:7.0pt "Times New Roman""> </span></font></span></span></font><font size="2" face="Arial"><span style="font-size:10.0pt;font-family:Arial">Proxy registrar compliance with law enforcement and dispute resolution requests <o:p></o:p></span></font></p><p class="MsoListBullet"><font size="2" face="Arial"><span style="font-size:10.0pt;font-family:Arial"><span style="mso-list:Ignore">7.<font size="1" face="Times New Roman"><span style="font:7.0pt "Times New Roman""> </span></font></span></span></font><font size="2" face="Arial"><span style="font-size:10.0pt;font-family:Arial">WHOIS data accuracy<o:p></o:p></span></font></p><p class="MsoNormal" style="text-autospace:none"><font size="2" face="Arial"><span style="font-size:10.0pt;font-family:Arial"><o:p> </o:p></span></font></p><p class="MsoNormal" style="text-autospace:none"><font size="2" face="Arial"><span style="font-size:10.0pt;font-family:Arial">You may find it useful to first consider which of the groupings address questions you think that having data about would inform the debate. Once you have identified which questions you want to answer, then you could focus on only those particular groupings and consider which study approach (or combination of approaches) will best answer your questions. In some cases Lorrie has indicated that the different studies answer slightly different questions. In some cases she indicates that some of the approaches are likely to give better data, or that some of the approaches are likely to be less expensive. When you think about the fundamental questions asked by each grouping, you may find it more useful to consider the questions asked by each grouping as follows:<o:p></o:p></span></font></p><p class="MsoNormal" style="text-autospace:none"><font size="2" face="Courier New"><span style="font-size:10.0pt;font-family:"Courier New""><o:p> </o:p></span></font></p><p class="MsoNormal" style="margin-left:.25in;text-indent:-.25in;mso-list:l1 level1 lfo3; text-autospace:none"><font size="2" face="Arial"><span style="font-size:10.0pt;font-family:Arial"><span style="mso-list:Ignore">1.<font size="1" face="Times New Roman"><span style="font:7.0pt "Times New Roman""> </span></font></span></span></font><font size="2" face="Arial"><span style="font-size:10.0pt;font-family:Arial">How big is the WHOIS misuse problem that may need to be solved?<o:p></o:p></span></font></p><p class="MsoNormal" style="margin-left:.25in;text-indent:-.25in;mso-list:l1 level1 lfo3; text-autospace:none"><font size="2" face="Arial"><span style="font-size:10.0pt;font-family:Arial"><span style="mso-list:Ignore">2.<font size="1" face="Times New Roman"><span style="font:7.0pt "Times New Roman""> </span></font></span></span></font><font size="2" face="Arial"><span style="font-size:10.0pt;font-family:Arial">Is there a non-compliance with data protection laws problem that needs to be solved?<o:p></o:p></span></font></p><p class="MsoNormal" style="margin-left:.25in;text-indent:-.25in;mso-list:l1 level1 lfo3; text-autospace:none"><font size="2" face="Arial"><span style="font-size:10.0pt;font-family:Arial"><span style="mso-list:Ignore">3.<font size="1" face="Times New Roman"><span style="font:7.0pt "Times New Roman""> </span></font></span></span></font><font size="2" face="Arial"><span style="font-size:10.0pt;font-family:Arial">Are there already market-driven solutions available?<o:p></o:p></span></font></p><p class="MsoNormal" style="margin-left:.25in;text-indent:-.25in;mso-list:l1 level1 lfo3; text-autospace:none"><font size="2" face="Arial"><span style="font-size:10.0pt;font-family:Arial"><span style="mso-list:Ignore">4.<font size="1" face="Times New Roman"><span style="font:7.0pt "Times New Roman""> </span></font></span></span></font><font size="2" face="Arial"><span style="font-size:10.0pt;font-family:Arial">Is there demand for market-driven solutions, and are they being used for legitimate or illegitimate purposes?<o:p></o:p></span></font></p><p class="MsoNormal" style="margin-left:.25in;text-indent:-.25in;mso-list:l1 level1 lfo3; text-autospace:none"><font size="2" face="Arial"><span style="font-size:10.0pt;font-family:Arial"><span style="mso-list:Ignore">5.<font size="1" face="Times New Roman"><span style="font:7.0pt "Times New Roman""> </span></font></span></span></font><font size="2" face="Arial"><span style="font-size:10.0pt;font-family:Arial">Do WHOIS data protections lead to abuse and misuse?<o:p></o:p></span></font></p><p class="MsoNormal" style="margin-left:.25in;text-indent:-.25in;mso-list:l1 level1 lfo3; text-autospace:none"><font size="2" face="Arial"><span style="font-size:10.0pt;font-family:Arial"><span style="mso-list:Ignore">6.<font size="1" face="Times New Roman"><span style="font:7.0pt "Times New Roman""> </span></font></span></span></font><font size="2" face="Arial"><span style="font-size:10.0pt;font-family:Arial">Are provisions for providing protected WHOIS data to law enforcement for investigation of crime and abuse effective?<o:p></o:p></span></font></p><p class="MsoNormal" style="margin-left:.25in;text-indent:-.25in;mso-list:l1 level1 lfo3; text-autospace:none"><font size="2" face="Arial"><span style="font-size:10.0pt;font-family:Arial"><span style="mso-list:Ignore">7.<font size="1" face="Times New Roman"><span style="font:7.0pt "Times New Roman""> </span></font></span></span></font><font size="2" face="Arial"><span style="font-size:10.0pt;font-family:Arial">Is WHOIS data accurate?<o:p></o:p></span></font></p><p class="MsoNormal" style="text-autospace:none"><font size="2" face="Arial"><span style="font-size:10.0pt;font-family:Arial"><o:p> </o:p></span></font></p><p class="MsoNormal"><font size="2" face="Arial"><span style="font-size:10.0pt; font-family:Arial">I note also</span></font><font size="2" face="Arial"><span style="font-size:10.0pt;font-family:Arial"> that several of the proposed studies are being recommended to address questions of WHOIS accuracy and compliance and I have also shared this summary with ICANN’s compliance director and deputy general counsel. They may have further views that we will share as appropriate. Lastly, if you would find it useful, Dr. Cranor can be available to participate in an upcoming call to discuss the report and answer questions. <o:p></o:p></span></font></p><p class="MsoNormal"><font size="2" face="Arial"><span style="font-size:10.0pt; font-family:Arial"><o:p> </o:p></span></font></p><p class="MsoNormal"><font size="2" face="Arial"><span style="font-size:10.0pt; font-family:Arial">Thanks, Liz</span></font><font size="2" face="Arial"><span style="font-size:10.0pt;font-family:Arial"><o:p></o:p></span></font></p><p class="MsoNormal"><font size="2" face="Arial"><span style="font-size:10.0pt; font-family:Arial"><o:p> </o:p></span></font></p> </div> </blockquote></div></body></html>