Purpose: This public comment forum is intended to gather community feedback on the proposed Framework for the Registry Operator to Respond to Security Threats that has been a collaborative effort of the members of the Security Framework Drafting Team (SFDT) on behalf of the Registries Stakeholder Group (RySG), Public Safety Working Group (PSWG), Registrar Stakeholder Group (RrSG) and ICANN organization.
Current Status: The SFDT, consisting of representatives from registries, registrars, and the GAC PSWG, has collaborated with ICANN organization over the past two years to produce this draft document (“Framework”). The draft document has been reviewed by the RySG, RrSG, PSWG of the Governmental Advisory Committee (GAC), and those organizations did not object to or express concern with the draft.
Next Steps: ICANN organization will prepare a public comment summary report at the conclusion of the comment period. SFDT will consider in-scope comments and after finalizing the Framework document, it will be publicly posted on the ICANN website for the benefit of the community.
Section I: Description and Explanation
The objective of the Framework is to deliver on the New gTLD Program Committee of the ICANN Board’s (NGPC) commitment to the GAC regarding ICANN soliciting community participation to develop a framework for how a Registry Operator (RO) may respond to identified security threats. This framework is a voluntary and non-binding document designed to articulate guidance as to the ways ROs may respond to identified security threats.
The Framework sets out some of the security issues law enforcement face and outlines the most common options available to ROs to address identified security threats. It is designed to assist both law enforcement and ROs in understanding the issues and limitations faced and to provide resources and alternatives for resolving identified security threats.
This Framework does not address situations where an RO does not have discretion to respond (such as subject to a Court Order from a court of competent jurisdiction over the RO) or situations where the RO’s policies would prohibit it from taking any particular action. The Framework (and the practices contained therein) does not reflect any consensus policy affecting ROs.
Section II: Background
While developing the terms of the Registry Agreements in the New gTLD Program, the NGPC resolved to include the so called “security checks” into Specification 11 section 3b (see the New gTLD Registry Agreement). While doing so, the NGPC recognized that these terms were general guidelines which omitted specific details because there are multiple ways for ROs to respond to identified security risks. In order to allow for careful and fulsome consideration of these implementation details, the NGPC Proposal for Implementation of GAC Safeguards Applicable to All New gTLDs called for ICANN to solicit community participation to develop a framework for “Registry Operators to respond to identified security risks that pose an actual risk of harm (…)”.
After conducting a preliminary consultation with a group of ROs and GAC representatives, ICANN formed a Framework Drafting Team composed of volunteers from affected parties to draft a Framework for Registry Operators to Respond to Security Threats. ROs, registrars, and GAC representatives (including from the Public Safety Working Group) participated in the drafting effort.
Section III: Relevant Resources
- The Framework Draft: https://community.icann.org/download/attachments/54693403/Security%20Framework%20draft%20v8.pdf?version=1&modificationDate=1496856148416&api=v2
- Security Framework Drafting Team wiki workspace: https://community.icann.org/display/S1SF/Security+Framework+Home
- NGPC Direction to ICANN Org: https://www.icann.org/resources/board-material/resolutions-new-gtld-2013-06-25-en#2.b
- GAC Advice: https://www.icann.org/en/system/files/correspondence/gac-to-board-18apr13-en.pdf