Whois policy group closes down in face of GDPR

An ICANN working group devoted to crafting Whois policy has closed down “until further notice” in light of the EU General Data Protection Regulation.
The Registration Data Service Policy Development Process Working Group will have no more meetings until it receives “guidance from the [ICANN] Board regarding how this WG will be affected by the GDPR compliance efforts”.
That’s according to WG co-chair Chuck Gomes, in an email to the group this morning. The mailing list will remain active to keep members informed of progress, he said.
The group has been tasked with developing “comprehensive Whois reform”.
It’s been working for over two years to attempt to find consensus on changes such as tiered access and data privacy, the latest iteration of fruitless, fractious Whois policy discussions dating back a couple of decades, and had made very little progress.
Recently, it’s also been hit by infighting and, in my opinion, a sense of helplessness in the face of GDPR, the EU privacy law that will take precedence over any policy ICANN comes up with.
Last month, prominent Non-Commercial Stakeholder Group member Stephanie Perrin publicly resigned from the WG, saying it was “fundamentally flawed” and complaining the process was an “antique” that wasn’t sufficiently taking GDPR into account.
As DI has been reporting for the last several months, there’s very little clarity right now about how GDPR will effect ICANN’s Whois policy.
ICANN CEO Goran Marby told us yesterday that he’s “cautiously optimistic” that EU data protection authorities will soon provide some firm guidance on what it means to be GDPR-compliant.
It appears that the RDS group’s fate may also lie in the hands of the DPAs, for now.

Marby ponders emergency powers to avoid fragmented Whois

ICANN could invoke emergency powers in its contracts to prevent Whois becoming “fragmented” after EU privacy laws kick in next month.
That’s a possibility that emerged during a DI interview with ICANN CEO Goran Marby yesterday.
Marby told us that he’s “cautiously optimistic” that European data protection authorities will soon provide clear guidance that will help the domain industry become compliant with the General Data Protection Regulation, which becomes fully effective May 25.
But he said that a lack of such guidance will lead to a situation where different companies provide different levels of public Whois.
“It’s a a high probability that Whois goes fragmented or that Whois will be in a sort of ‘thin’ model in which very little information is collected and very little information is displayed,” he said. “That’s a sort of worst-case scenario.”
I should note that the interview was conducted yesterday before news broke that Afilias has become the first major gTLD registry to announce its Whois output will be essentially thin — eschewing all registrant contact data — from May 25.
Marby has asked European DPAs for two things.
First, guidance on whether its “Cookbook” proposal for a dramatically scaled-back, GDPR-compliant Whois is in fact GDPR-compliant.
Second, an enforcement moratorium while registries and registrars actually go about implementing the Cookbook.
“If we don’t get guidance that’s clear enough, we will see a fragmented Whois. If we get guidance that is clear enough we can work it out,” Marby said.
A moratorium could enable Whois to carry on in its current state, or something close to it, while ICANN goes about creating a new policy that fits with the DPA’s guidance.
If the DPAs refuse a moratorium, we’re looking at a black hole of indeterminate duration during which nobody — not even law enforcement or self-appointed trademark cops — can easily access full Whois records.
“It’s not something I can do anything about, it’s really in the hands of the DPAs,” Marby said. “Remember that it’s the law.”
While ICANN has expended most of its effort to date on creating a model for the public Whois, there’s a parallel effort to create an accreditation program that would enable organizations with “legitimate purposes” to access full, or at least more complete, Whois records.
It’s the IP lawyers that are driving this effort, primarily, terrified that their ability to hunt down cybersquatters and bootleggers will be diminished come May 25.
ICANN has so far resisted calls to endorse the so-called “Cannoli” draft accreditation model, with Marby publicly saying that it needs cross-community support.
But the organization has committed staff support resources to discussion of Cannoli. There’s a new mailing list and there will be a community conference call this coming Friday at 1400 UTC.
Marby said that he shares the worries of the IP community, adding: “If we get the proper guidance from the DPAs, we will know how to sort out the accreditation model.”
He met with the Article 29 Working Party, comprised of DPAs, last week; the group agreed to put Whois on its agenda for its meeting next week, April 10-11.
The fact that it’s up for discussion is what gives Marby his cautious optimism that he will get the guidance he needs.
Assuming the DPAs deliver, ICANN is then in the predicament of having to figure out a way to enforce, via its contracts, a Whois system that is compliant with the DPAs’ interpretation of GDPR.
Usually, this would require a GNSO Policy Development Process leading to a binding Consensus Policy.
But Marby said ICANN’s board of directors has other options, such as what he called an “emergency policy”.
This is a reference, I believe, to the “Temporary Policies” clauses, which can be found in the Registrar Accreditation Agreement and Registry Agreement.
Such policies can be mandated by a super-majority vote of the board, would have to be narrowly tailored to solve the specific problem at hand, and could be in effect no longer than one year.
A temporary policy could be replaced by a compatible, community-created Consensus Policy.
It’s possible that a temporary policy could, for example, force Afilias and others to reverse their plans to switch to thin Whois.
But that’s perhaps getting ahead of ourselves.
Fact is, the advice the DPAs provide following their Article 29 meeting next week is what’s going to define Whois for the foreseeable future.
If the guidance is clear, the ICANN organization and community will have their direction of travel mapped out for them.
If it’s vague, wishy-washy, and non-committal, then it’s likely that only the European Court of Justice will be able to provide clarity. And that would take many years.
And whatever the DPAs say, Marby says it is “highly improbable” that Whois will continue to exist in its current form.
“The GDPR will have an effect on the Whois system. Not everybody will get access to the Whois system. Not everybody will have as easy access as before,” he said.
“That’s not a bug, that’s a feature of the legislation,” he said. “That’s not ICANN’s fault, it’s what the legislator thought when it made this legislation. It is the legislators’ intention to make sure people’s data is handled in a different way going forward, so it will have an effect.”
The community awaits the DPAs’ guidance with baited breath.

ICANN chief begs privacy watchdogs for Whois advice

ICANN CEO Goran Marby has written to the data protection authorities of all 28 European Union states, along with the European Data Protection Supervisor, to ask for guidance on how to implement new privacy laws.
Marby also asked the DPAs about the possibility of an enforcement moratorium, to give the domain industry and ICANN more time to formulate their collective response to the General Data Protection Regulation.
GDPR, which aims to give EU citizens more control over their personal data, comes into full effect May 25. Companies that break the rules face fines that could amount to millions of euros.
But ICANN does not yet have a firm plan for bringing the distributed Whois system into compliance with GDPR, and has repeatedly indicated that it needs guidance from European DPAs.
“ICANN and more than a thousand of the domain names registries and registrars are at a critical juncture,” Marby wrote (pdf).
“We need specific guidance from European data protection authorities in order to meet the needs of the global internet stakeholder community, including governments, privacy authorities, law enforcement agencies, intellectual property holders, cybersecurity experts, domain name registries, registrars, registrants and ordinary internet users,” he wrote.
ICANN has already written a proposal — known as the “Cookbook” and sent to DPAs three weeks ago — for how gTLD registrars and registries could comply with GDPR by removing most fields from public Whois records.
But Marby’s letter points out that many ICANN community members think the Cookbook either goes too far or not far enough.
As we reported a week ago, the Governmental Advisory Committee and Intellectual Property Constituency are not convinced ICANN needs to chop quite as much info from the public Whois as it’s currently planning.
But on the flipside, there are privacy advocates who think far less data should be collected on registrants and fundamentally question ICANN’s power to mandate public Whois access in its registry and registrar contracts.
Both sides of the debate are referenced in the letter.
“Guidance from DPAs on ICANN’s plan of action as presented in the Cookbook, and in particular, the areas where there are competing views, is critical as soon as possible, but particularly during the next few weeks,” Marby wrote.
Whether ICANN will get the answers it needs on the timetable it needs them is open to debate.
Many community members expressed skepticism about whether the DPAs’ commitment to the urgency of the issue matches ICANN’s own, during ICANN 61 earlier this month.
There seemed to be little confidence that the DPAs’ responses, should ICANN receive any, will provide the clarity the industry needs.
It may also be bad timing given the unrelated Cambridge Analytica/Facebook scandal, which appears to be consuming the attention of some European DPAs.

Stéphane Van Gelder dies after motorcycle accident

I’m very sad to report that domain name industry veteran and ICANN community leader Stéphane Van Gelder has died. He was 51.
Friends tell me he died today of injuries sustained in a vehicle crash in Switzerland near the Italian border.
According to a local report, he and his wife were hit by a car March 23, while stopped on their motorcycles at a traffic light.
His wife, Julie, was also injured but survived.
Stéphane was a long-time member of the industry, in 1999 co-founding the French registrar Indom, which he sold to Group NBT in 2010.
After Indom, he became an independent consultant, first under the brand Stéphane Van Gelder Consulting, later as Milathan.
He joined new gTLD registry StartingDot in 2014 and saw the company through to its acquisition by Afilias in 2016.
He told us at the time of his rebranding that the name “Milathan” was a “derivative of words in Hindi that mean ‘union’ or ‘meeting’ in the sense of bringing people together”.
It was perhaps an appropriate name, given Stéphane’s record of successful senior leadership positions in the ICANN volunteer community.
Notably, he chaired the GNSO Council for two years from 2010, and was chair of the Nominating Committee from 2015.
His most recent social media posts show that he was on a motorcycle tour of Italy with his wife before his accident near Lake Como.
Stéphane and I were not close, but in our interactions I always found him knowledgeable, witty, and charming. A thoroughly nice guy.
He was also one of the very few people in the industry I’ve trusted enough to write guest posts for DI over the years. Here he is fighting the GNSO’s corner in 2012.
Stéphane is survived by his wife and, friends tell me, two children. They have our condolences, and we wish his wife a speedy recovery.
He will be missed.

Some men at ICANN meetings really are assholes

Several men have been accused of sexual harassment at ICANN meetings.
A group of women have written to ICANN with five stories of how they were groped, intimidated, objectified or otherwise harassed in violation of not only common decency but also ICANN’s year-old anti-harassment policy.
They’ve not named the alleged harassers, but hinted that they may do so in future.
If we assume the stories are all the unembellished truth — and we kinda have to nowadays — then the behavior described is unambiguously out of order.
Fortunately, none of the allegations rise to the level of the obviously seriously criminal. In these cases we appear to be talking more Hoffman than Weinstein.
But we’re not talking about bizarro Cheesesandwichgate-level interactions either. The stories allege groping, simulated sexual activity, and physical restraint, among other things.
In one allegation, a woman claims a drunk man touched her rear during a social interaction.
In another, a man is alleged to have attempted to let himself into a woman’s hotel room, prompting her to block the door from the inside with a chair, after his earlier advances were rebuffed.
Another woman claims a man she had never met chose, as his opening conversational gambit, to compliment her appearance and inquire after her marital status — during a daytime coffee break for crying out loud — and then grabbed her waist and wrists to prevent her from leaving.
“If you want to start a conversation, ask what I do, what do I work with and why am I here,” the woman is quoted as saying. “Do not acknowledge physical attributes and reduce me to this.”
“If you want to talk to women in a professional setting, do not tighten her wrists, do not grab her waist. Do not ask whether she is married or not,” she said. “Regardless, you should respect her integrity, not her marital status.”
Another man is accused of simulating a sex position with a woman during a cocktail event.
A fifth is accused of “body-blocking” a woman as she attempted to leave a room.
The letter states:

These actions which are definitely categorized as harassment and even assault, would not only affect the woman who went through the incident but it would also lead to several probable repercussions such as (1) Her withdrawal from the community and physical presence. We all know how important being present in meetings is on different levels of engagement in and outside meetings (2) When no solid response from the community is done towards the harasser, there can definitely be an increase in aggressive characters of harassers as there would be no accountability to stop them (3) With the increase in harassment there surely will be a decrease in the representation of young women’s voices in any proceeding which defies the core concept of diversity.

The letter (pdf) is unsigned, and ICANN broke with its usual practice of listing the sender on the correspondence page of its web site.
The letter also does not name any of the accused men, but it and a related comment from a group of women at the public forum at ICANN 61 last week, said the women “refrain from using names for now, in order to keep the focus on the topic and not the person”.
It’s been DI practice to not name either party concerned in such allegations, even when we know who they are.
While the anti-harassment policy exists to deal precisely with the kinds of behaviors outlined in the letter, we reported in November that the ICANN Ombudsman had received no complaints whatsoever invoking the policy, even after the post-Weinstein sea change in workplace sexual politics.
But the letter-writers say this is because the current Ombudsman, Herb Weye, is a man, and women are sometimes reluctant to report such incidents to a man. The letter states:

There should be a woman ombudsperson for harassment reporting. It has been proven by several studies that given the sensitivity of the issue, harassment reports are more prone to be tackled and come forth with, when the ombudsperson is (a) a woman (b) an expert in gender-related issues and mitigating harassment risks

They’re also not confident that the policy, which has yet to be tested, will cause more good than harm.
They also want all ICANN meeting delegates to read the harassment policy as a condition for attendance, and for signage at the meetings to warn against inappropriate behavior.
In response to the public forum comments, ICANN vice-chair Chris Disspain promised that the board will respond to the women’s letter, adding that the Ombudsman is taking a look at how the harassment policy has been implemented.
“It’s very important that ICANN is a safe place for everyone,” chair Cherine Chalaby told the women. “The more we raise awareness, the more it is safe.”
The message to certain blokes at ICANN meetings seems pretty clear: stop being assholes.
Like most places of work, the ICANN community is resplendent with examples of people forming lasting romantic relationships — or even just getting laid — but none of them began with a man grabbing a woman’s backside without her consent.

Is ICANN over-reacting to Whois privacy law?

Is ICANN pushing the domain industry to over-comply with the European Union’s incoming General Data Protection Regulation privacy law?
Governments and plenty of intellectual property and business lobbyists think so.
After days of criticism from unhappy IP lawyers, ICANN’s public meeting in Puerto Rico last week was capped with a withering critique of the organization’s proposed plan for the industry to become GDPR compliant as pertains Whois.
The Governmental Advisory Committee, in unusually granular terms, picked apart the plan in its usual formal, end-of-meeting advice bomb, which focused on making sure law enforcement and IP owners continue to get unfettered Whois access after GDPR kicks in in May.
Key among the GAC’s recommendations (pdf) is that the post-GDPR public Whois system should continue to publish the email address of each domain registrant.
Under ICANN’s plan — now known as the “Cookbook” — that field would be obscured and replaced with a contact form or anonymized email address.
The GAC advised ICANN to “reconsider the proposal to hide the registrant email address as this may not be proportionate in view of the significant negative impact on law enforcement, cybersecurity and rights protection;”.
But its rationale for the advice is a little wacky, suggesting that email addresses under some unspecified circumstances may not contain “personal data”:

publication of the registrant’s email address should be considered in light of the important role of this data element in the pursuit of a number of legitimate purposes and the possibility for registrants to provide an email address that does not contain personal data.

That’s kinda like saying your mailing address and phone number aren’t personal data, in my view. Makes no sense.
The GAC advice will have won the committee friends in the Intellectual Property Constituency and Business Constituency, which throughout ICANN 61 had been pressuring ICANN to check whether removing email addresses from public Whois was strictly necessary.
ICANN is currently acting as a non-exclusive middleman between community members and the 20-odd Data Protection Authorities — which will be largely responsible for enforcing GDPR — in the EU.
It’s running compliance proposals it compiles from community input past the DPAs in the hope of a firm nod, or just some crumbs of guidance.
But the BC and IPC have been critical that ICANN is only submitting a single, rather Draconian proposal — one which would eschew email addresses from the public Whois — to the DPAs.
In a March 13 session, BC member Steve DelBianco pressed ICANN CEO Goran Marby and other executives and directors repeatedly on this point.
“If they [the DPAs] respond ‘Yes, that’s sufficient,’ we won’t know whether it was necessary,” DelBianco said, worried that the Cookbook guts Whois more than is required.
ICANN general counsel John Jeffrey conceded that the Cookbook given to the DPAs only contains one proposal, but said that it also outlines the “competing views” in the ICANN community on publishing email addresses and asks for guidance.
But email addresses are not the only beef the GAC/IPC/BC have with the ICANN proposal.
On Thursday, the GAC also advised that legal entities that are not “natural persons” should continue to have their full information published in the public Whois, on the grounds that GDPR only applies to people, not organizations.
That’s contrary to ICANN’s proposal, which for pragmatic reasons makes no distinction between people and companies.
There’s also the question of whether the new regime of Whois privacy should apply to all registrants, or just those based in the European Economic Area.
ICANN plans to give contracted parties the option to make it apply in blanket fashion worldwide, but some say that’s overkill.
Downtime for Whois?
While there’s bickering about which fields should be made private under the new regime, there doesn’t seem to be any serious resistance to the notion that, after May, Whois will become a two-tier system with a severely depleted public service and a firewalled, full-fat version for law enforcement and whichever other “legitimate users” can get their feet in the door.
The problem here is that while ICANN envisions an accreditation program for these legitimate users — think trademark lawyers, security researchers, etc — it has made little progress towards actually creating one.
In other words, Whois could go dark for everyone just two months from now, at least until the accreditation program is put in place.
The GAC doesn’t like that prospect.
It said in its advice that ICANN should: “Ensure continued access to the WHOIS, including non-public data, for users with a legitimate purpose, until the time when the interim WHOIS model is fully operational, on a mandatory basis for all contracted parties”.
But ICANN executives said in a session on Thursday that the org plans to ask the DPAs for a deferral of enforcement of GDPR over Whois until the domain industry has had time to come into compliance while continuing to grant access to full Whois to police and special interests.
December appears to be the favored date for this proposed implementation deadline, but ICANN is looking for feedback on its timetable by this coming Friday, March 23.
But the IPC/BC faction are not stting on their hands.
Halfway through ICANN 61 they expressed support for a draft accreditation model penned by consultant Fred Felman, formerly of brand protection registrar MarkMonitor.
The model, nicknamed “Cannoli” (pdf) for some reason, unsurprisingly would give full Whois access to anyone with enough money to afford a trademark registration, and those acting on behalf of trademark owners.
Eligible accreditees would also include security researchers and internet safety organizations with the appropriate credentials.
Once approved, accredited Whois users would have unlimited access to Whois records for defined purposes such as trademark enforcement or domain transfers. All of their queries would be logged and randomly audited, and they could lose accreditation if found to be acting outside of their legitimate purpose.
But Cannoli felt some resistance from ICANN brass, some of whom pointed out that it had been drafted by just one part of the community
“If the community — the whole community — comes up with an accreditation model we would be proud to put that before the DPAs,” Marby said during Thursday’s public forum in Puerto Rico.
It’s a somewhat ironic position, given that ICANN was just a few weeks ago prepared to hand over responsibility for creating the first stage of the accreditation program — covering law enforcement — wholesale to the GAC.
The GAC’s response to that request?
It’s not interested. Its ICANN 61 communique said the GAC “does not envision an operational role in designing and implementing the proposed accreditation programs”.

A lazy blogger’s wish-list for ICANN remote participation

Remote participation at ICANN meetings is pretty damn good, but I’m an ungrateful asshole and I want more.
I’ve had a personal wish-list of remote participation features during and immediately after every ICANN meeting for a few years now, but when ICANN turned off Adobe Connect for the back half of ICANN 61 last week I was inspired to put pen to paper and rant about it in public.
Make no mistake, these are minor quibbles and no diss to the thoroughly lovely people on the ICANN meetings team.
In a community where are great many people are tasked with herding cats, the meetings guys are the only ones who have to physically herd the cats into their windowless pens through the sheer power of their organizational skills.
Not to mention they have to ensure all the cats are fed, watered, caffeinated, inebriated, and have trays of gravel into which to do their dirty business.
(Sorry, that metaphor got away from me a little there.)
My point is, the fact that anyone ever gets anything done at an ICANN meeting is due in no small part to the folk who actually organize the events, including the remote participation.
With all those disclaimers in mind, here are a few things I would like to see in future.
Archive the scribe feeds
The ICANN scribe feed, provided for as long as I can remember by Brewer & Darrenougue and StreamText is excellent.
It provides a live, scrolling, text transcription, in English, of whatever is being said in a session. It’s not 100% accurate all of the time, but it’s damn close.
Over the years, the scribes seem to have gained an ear for the regular speakers. It’s increasingly rare to see “[SAYING NAME]” in a feed, and we don’t often see pleas from the scribes for speakers to slow down any more.
This allows Anglo monoglot basement-dwellers such as myself to identify who’s talking and get a rough idea what they’re saying, even when they are Catalan registry operators speak quickly in heavily accented, non-native English.
The problem with the feed is that they disappear immediately after each session ends, usually at lunch time and again at the end of the day. Remote participants then have to wait anywhere from a day to several days for the full, edited transcript to be published.
I think the resource cost of immediately publishing the full, warts-and-all scribe transcript would be negligible.
Even if StreamText doesn’t offer it as an automated feature, copy-pasting a session transcript from a browser window into a PDF and banging it on the ICANN web site shouldn’t take more than a few minutes. I know; for several meetings I did it myself on selected sessions as a public service.
Bring back the MP3s
Not too long ago, the audio-only streams were recorded into MP3 files and dumped on the meeting web site in short order, often the same day.
Now, instead, we get M3U files, which are basically just links to streams. And the streams are extremely temperamental, regularly skipping around, restarting or simply stopping for no readily apparent reason.
Today, attempting to re-listen to the M3U of last Thursday’s Public Forum, I had to restart the stream and go hunting for the position I’d been kicked out maybe a dozen times. It was very irritating.
MP3s have the added advantage that they can be listened to offline, allowing you to catch up on sessions you missed while, for example, loitering at an airport with crappy wifi.
I want the MP3s back, dammit!
Consider YouTube maybe?
Recent meetings have seen the introduction of Livestream.com as an alternative to Adobe Connect for viewing live video.
I assume ICANN is paying for this service, probably five figures per year, but I have no idea what benefit (if any) the service offers over YouTube live streaming.
It doesn’t even always work. Try getting Thursday’s Public Forum recording to play. I couldn’t.
Is there any particular reason YouTube is not a viable option? As far as I know it’s free and reliable. YouTubers with far greater audiences than ICANN seem to get away with using it on a daily basis.
It could even be monetized, turning an expense into a small source of additional revenue.
Bring back meaningful filenames
ICANN is pretty good about publishing transcripts, presentations and other documentation as PDFs on the pages for each session. But for some reason in Puerto Rico it started naming the files with apparently meaningless numerical strings.
In all the meetings I can recall before ICANN 61, a downloadable transcript might be named something like “transcript-public-forum-10mar16-en.pdf”. Now, you’ll get something like “1521076292.pdf” instead, which is a step backwards.
Sure, I could manually rename the file to something meaningful myself, but that would take me at least 30 seconds — 30 seconds I could better use listening to Marilyn Cade introduce herself, Goran Marby apologize for something, or literally anyone else in the community complain that nobody listens to them any more.
Keep the redundancy!
Finally, as ICANN discovered this week, redundancy is essential to maintaining uninterrupted remote participation.
Even with Adobe Connect offline across the board for half of the week, it was still possible for those of us in the cheap seats to see video, hear audio, read the scribes, and submit questions and comments.
It wasn’t perfect, but it did the job well enough (previous complaints notwithstanding).
Even when Adobe is turned on, the alternative methods of listening in are extremely useful for overcoming its occasional limitations.
Often, AC rooms are barely audible. This problem occurs on an almost daily basis during ICANN. It affects some rooms but not others and I’ve yet to spot a predictable pattern.
But when you can’t hear what’s going on in AC, it’s always possible to mute the room and launch the always-audible live M3U stream separately.
Similarly, on the rare occasions the audio or video is down, the scribes can often allow us to follow the gist of the discussion while the nerds work on a fix.
In short, redundancy is good.
UPDATE (MARCH 21): Josh Baulch from the ICANN meetings team has left a comment addressing some of these points. It turns out MP3s are actually available elsewhere on the ICANN web site and Livestream costs ICANN far, far less than I had estimated based on Livestream’s published price list.

Data leak security glitch screws up ICANN 61 for thousands

A security vulnerability forced ICANN to take down its Adobe Connect conferencing service halfway through its ICANN 61 meeting in Puerto Rico.
The “potentially serious security issue” could “could possibly lead to the disclosure of the information shared in an ICANN Adobe Connect room”, ICANN said in a pair of statements.
Taking down the service for the remainder of the meeting, which ends today, meant that potentially thousands of remote participants were left to cobble together a less streamlined replacement experience from a combination of live streams, transcription and email.
At the last ICANN meeting, over 4,000 unique participants logged into Adobe Connect. With only 1,900 or so people on-site, we’re probably looking at over 2,000 remote participants relying on AC to take part.
At this point, it’s not clear whether ICANN has discovered a previously undisclosed vulnerability in the Adobe service, or whether it simply buggered up its implementation with sloppy configuration settings.
It’s also not clear whether the glitch has been actively exploited to expose private data, though ICANN said it was first reported by a member of the Security and Stability Advisory Committee.
ICANN said in the second of two statements issued yesterday:

The issue is one that could possibly lead to the disclosure of the information shared in an ICANN Adobe Connect room. We are still investigating the root cause of the issue. We have formulated different scenarios based on authentication, encryption, and software versions, which we are testing in a controlled fashion in attempt to replicate and understand the root cause of the issue.
We are working directly with Adobe and with our cloud service provider to learn more.

Adobe Connect is a web conferencing tool that, at least when ICANN uses it for public meetings, combines live video and transcription, PowerPoint presentation sharing, and public and private chat rooms.
I also understand that there’s also a whiteboarding feature that allows participants to collaboratively work on documents in closed sessions.
Given that everything shared in the public sessions (outside of the private chat function) is by definition public, it might be reasonable to assume that ICANN’s primary concern here is how the software is used in closed sessions.
I hear ICANN uses Adobe Connect internally among its own staff and board, where one might imagine private data is sometimes shared. Other relatively secretive groups, such as the Governmental Advisory Committee and Nominating Committee, are also believed to sometimes use it behind closed doors.
While Adobe is infamous for producing buggy, insecure software, and ICANN uses a version of it hosted by a third-party cloud services provider, that doesn’t necessarily mean this wasn’t another ICANN screw-up.
In a similar incident uncovered in 2015, it was discovered that new gTLD applicants could read attachments on the confidential portions of their competitors’ applications, after ICANN accidentally had a single privacy configuration toggle set to “On” instead of “Off” in the hosted Salesforce.com software it was using to manage the program.
Ashwin Rangan, ICANN’s CIO and the guy also tasked with investigating the Salesforce issue, has now started a probe into the Adobe issue.

Next new gTLD round unlikely before 2022

ICANN is unlikely to accept any more new gTLD applications until a full decade has passed since the last round was open.
That’s the conclusion of some ICANN community members working on rules for the next round.
Speaking at ICANN 61 in Puerto Rico this weekend, Jeff Neuman, co-chair of the New gTLD Subsequent Procedures Working group, presented a “best case” timetable for the next round.
The timetable would see the next new gTLD application window opening in the first quarter of 2021, nine years after the 2012 round.
But Neuman acknowledged that the timeline would require all parts of the ICANN community — working groups, GNSO Council, board of directors, staff — to work at their most efficient.
With that in mind, 2021 seems optimistic.
“Even if we hit the 2021 date, that’s still a decade after the launch of the last round, which is crazy,” Neuman said.

The timetable assumes the GNSO wraps up its policy development a year from now, with the ICANN board approving the policy mid-2019.
It then gives the ICANN staff about six months to publish an updated Applicant Guidebook, and assumes whatever is produced is approved within about six months, after the first pass of public comments.
It’s worth noting that the 2012 round’s AGB hit its first draft in 2008 and went through half a dozen revisions over three years before it was finalized, though one imagines there would be less wheel-reinventing required next time around.
After the board gives the AGB the final nod, the timeline assumes ICANN staff about six months to “operationalize” the program.
But one unidentified ICANN staffer, who said she was “the person that will be ultimately responsible for the implementation” of whatever the GNSO comes up with, said during this weekend’s session that she doubted this was realistic.
She said ICANN the organization would need “at least 12 months” between the ICANN board approving the AGB and the application window opening. That would push the window to late 2021.
The Subsequent Procedures policy work is of course not the only gating factor to the next round.
There’s also a potential bottleneck in work being carried out to review rights protection mechanisms, where fears of filibustering have emerged in an already fractious working group.
All things considered, I wouldn’t place any bets on an application window opening as early as 2021.

ICANNWiki fans protest funding cut

ICANN should continue to fund the independent ICANNWiki project, according to high-profile industry supporters.
As I first reported back in December, ICANN plans to stop giving a $100,000 annual grant to ICANNWiki, a repository of about 6,000 community-sourced articles on the people and organizations involved in the ICANN community.
While ICANNWiki does not merit an explicit mention in ICANN’s latest proposed budget, both organizations have confirmed to DI that the funding is for the chop, as ICANN attempts to rein in spending in the face of depressed revenue.
About a quarter of the 41 comments filed on the budget express support for the wiki.
Consultant Kurt Pritz, a 10-year veteran of ICANN and one of the key architects of its new gTLD program, wrote that the wiki “has been an essential part of the ICANN culture for many years… often saving ICANN meetings from terminal ennui.”
Roland LaPlante, chief marketing officer of Afilias (one of about 15 sponsors listed on ICANNWiki’s front page), wrote:

The complete withdrawal of funding from ICANN so abruptly not only threatens the viability of the project, but rather disrespectfully junks the valuable time and resources that the community has invested over the years. Ultimately the loss of ICANNWiki would be a loss to our overall sense of community.
ICANN should continue to support ICANNWiki at a reasonable level in the next fiscal year. At a minimum, please consider giving the team time to find other sources of funding.

Sandeep Ramchandani, CEO of Radix, concurred, writing:

ICANNNWiki benefits the entire ICANN community. Cutting the funding entirely would effectively halt its operations and be a disservice to the community it serves. It is in ICANN and the community’s best interest to continue funding it in an amount that works for ICANN long-term, and provide ICANNWiki sufficient time to develop a more sustainable business plan.

Simon Cousins, CEO of Chinese market localization specialist Allegravita, said:

Before ICANNWiki, there was precious little information on industry fundamentals in China, and since Allegravita has supported the pro-bono translation of ICANNWiki content into Chinese, the vital platform that is ICANNWiki has been acknowledged hundreds of times.
We do not support the immediate and full withdrawal of funding for ICANNWiki. We guardedly support incremental, annual decreases to give ICANNWiki the time necessary to generate new sponsorship income to cover their costs.

Pablo Rodriguez of .pr ccTLD operator PRTLD, host of ICANN 61 and an ICANNWiki sponsor, wrote:

We believe that they should not be cut out from the ICANN’s Budget, instead, they should be supported and embraced to continue their engaging approach and work with ICANN’s Community and as well newcomers, veterans, special programming for beginners and others in order to deliver what is ICANN and what does the organization do and so forth.

Several other commentators on ICANN’s budget asked ICANN to maintain the funding and I was unable to find any comments supporting its withdrawal.
It’s worth noting that ICANN’s $100,000 is not ICANNWiki’s only financial support. It says it receives an additional $61,000 a year from corporate sponsorship, and as a wiki much of its output is produced by volunteers.
It has been in existence for a decade, but ICANN has only been giving it money for three years.
The costs associated with running it appear to be mostly centered not on maintaining the web site but on its outreach and promotional activities, such as attending meetings and the popular caricatures and card decks it distributes.
It could be argued that ICANNWiki is pretty good value for money when compared to cost of a dedicated outreach professional (the average cost of an ICANN staffer has been estimated at $175,000+ in the latest budget).
ICANNWiki will host an “Edit-A-Thon” during the current ICANN 61 public meeting in San Juan, Puerto Rico on Tuesday at 0900 local time.