On 25 January 2021, the Second Security, Stability, and Resiliency (SSR2) Review Team delivered its Final Report to the ICANN Board. This achievement represents more than four years of research, evaluation, and consideration. On behalf of the ICANN Board, I thank the SSR2 Review Team for its dedication and extensive work in preparing the recommendations.
The SSR Review is one of four Specific Reviews anchored in the ICANN Bylaws and relates to key elements of the ICANN's Strategic Plan. The Bylaws require the Board to take action on the SSR2 Review Team Final Report within six months of receipt, by 25 July 2021. On 22 July 2021, the Board took action on all recommendations included in the report.
The SSR2 Review Team, which began its work in 2017, delivered a Final Report that contains 63 recommendations in the following areas:
- The extent to which prior SSR Review recommendations have been implemented and whether implementation has resulted in the intended effect.
- SSR within ICANN.
- Contracts, compliance, and transparency around Domain Name System (DNS) abuse.
- Additional SSR-related concerns regarding the global DNS.
Many of the recommendations are complex and touch on other significant areas of work underway. It is important to follow up on any clarification needed, and to align SSR2 recommendations to complement existing community advice, other community recommendations, and public input. This clarification and alignment will ensure that the SSR2 recommendations are in alignment with ICANN's Strategic Plan prior to implementation.
Since receiving the SSR2 Final Report, a great deal of work has been underway to review materials, including public comments and briefings from ICANN organization (ICANN org), to better understand the complexities of the SSR2 recommendations and their potential impacts. The Board also engaged with the community and listened carefully to related discussions during ICANN70 and ICANN71. The Board Caucus Group on SSR2 (SSR2 Caucus) was established to facilitate the interactions between the Board and the SSR2 Review Team. The SSR2 Caucus includes the Board-appointed members of the SSR2 Review Team. The SSR2 Caucus led the Board's efforts in the substantive analysis of the recommendations and ICANN org's assessments in preparation for Board action. The SSR2 Caucus will continue its involvement in the ongoing work on SSR2 recommendations.
Noting that the recommendations encompass broad areas and themes, many of which also are emphasized in public comments, the Board developed six categories of action to move some recommendations to final action now, while allowing sufficient additional time for fulsome analysis and consideration of the relevant significant factors impacting the feasibility of implementing other recommendations. The categories are noted here, with the number of recommendations placed in each category:
- Recommendations the Board approves, subject to prioritization, risk assessment and mitigation, costing, and implementation considerations; and recommendations that the Board approves, with the understanding that they are already fully implemented (13 recommendations, of which two recommendations are fully implemented). Approved recommendations are consistent with ICANN's mission, serve the public interest, and fall within the Board's remit. Further, approved recommendations are clear, do not have dependencies (including any requiring mitigation of other work), and have community support and a clear path to implementation.
- Recommendations the Board rejects because the recommendation cannot be approved in full (6 recommendations). While portions of these recommendations could be feasible, and in some cases, work is already underway to deal with the underlying issues on portions of these recommendations, limitations imposed by other portions of the same recommendation could impact feasibility in light of the Bylaws and Board/ICANN org remit. The Board does not have the option to selectively approve or reject parts of a single, indivisible community recommendation; they must act on a recommendation as written and not as interpreted by ICANN org or the Board. The Board notes that part of the community intent in incorporating Specific Reviews into the ICANN Bylaws in 2016 was to require the Board to act on recommendations as written, not as interpreted by ICANN org or Board.
- Recommendations the Board rejects (10 recommendations). The detailed rationale for each recommendation sets out the specific reasons for the Board's decision.
- Recommendations the Board determines to be pending, likely to be approved once further information is gathered to enable approval (4 recommendations). The Board expects specific actions to take place in order to take further Board decision on these recommendations.
- Recommendations that the Board determines to be pending, holding to seek clarity or further information (24 recommendations). The Board is unable to signal at this time whether it is likely to accept or reject these recommendations pending additional information.
- Recommendations the Board determines to be pending, likely to be rejected unless additional information shows implementation is feasible (6 recommendations). The Board expects specific actions to take place in order to take further Board decision on these recommendations. Based on the information available to date, the Board anticipates that each of these recommendations will be rejected.
The detailed rationale for each recommendation sets out the specific reasons for the Board's decision for each category.
The Board has committed to take further action on the recommendations placed into the pending categories subsequent to the completion of the steps identified in the scorecard. The Board has also asked ICANN org to provide the information requested in the scorecard within six months and advise if additional time is needed to support the Board reaching decisions on the pending recommendations.
Although the Board is not able to selectively approve portions of recommendations and must reject some recommendations in their entirety, the Board still recognizes that it is important to acknowledge where work and further efforts could be achieved. While the Board might direct ICANN org to take some action on rejected recommendations, those actions will not be tracked as part of the implementation of approved SSR2 recommendations. However, it is important to note that ICANN org regularly reports on general security, stability, and resiliency-related activities through ICANN annual reports as well as strategic and operating plans. The Board is supportive of further reporting for greater transparency and understanding.
Additionally, the Board acknowledges process restrictions that require the Board to "reject because the recommendation cannot be approved in full," even though the Board agrees in principle with the intent of the recommendation. The Board encourages ICANN org to work with the community on ways to address these process restrictions. This could include socializing the existing process restrictions and the associated gaps via a thought paper. Addressing possible existing process restrictions should proceed in collaboration with the ICANN community within the context of broader work to improve future outcomes from ICANN's review program.
Proper analysis and engagement with the community will pave the way for implementation that is consistent with intent of the recommendations and in line with ICANN's mission. As part of our continued analysis and assessment of the pending recommendations, the Board and ICANN org will engage with the SSR2 Implementation Shepherds to better understand the SSR2 Review Team's intent and the desired outcome of the recommendation in cases where this is not clear. The Board thanks the Implementation Shepherds for their ongoing dedication to this important review. The Board will also take into account the differing opinions registered through Public Comment suggesting that more community engagement and discussion may be required to consider how to best address overarching issues in a balanced way.
The Board looks forward to the positive contributions the approved recommendations will make to the security, stability, and resiliency of the Internet's system of unique identifiers that ICANN coordinates, as well as to the continuous improvement of ICANN as a whole. We will provide periodic updates as the Board progresses through the pending recommendations.