Subject: [Ietf-not43] Comments on CRISP Requirements draft-06 and CRIS P Internet Resour ce Number Requirements draft-00

From: rlehning at smimetlaw.com (Ryan Lehning)
Date: Wed Nov 12 08:35:53 2003

Rick,

Thanks for the prompt response.  It strikes me that your comments are
equally relevant to the Data Omission Protocol Requirement (3.2.8.1).  That
requirement doesn't specify what the authorization rules might be or what
the privacy constraints are, those would be filled for particular
applications based on policy choices.  The same goes for the proposed
accuracy/verification amendment. the rules are policy, but the protocol has
to be able to support whatever policy is chosen.

There could be lots of different typologies of verification.  One could be
whether data was verified individually through contact with a registrant, or
automatically.  Again, the specific, implemented, typology could be left up
to the registries themselves, but the protocol must accomodate some typology
of methods.

Doesn't the SECSAC Whois recommendation call for exactly this sort of data
element?

	"Whois data must contain a 'Last Verified Date' that reflects the
last point in time at 
	which the information was known to contain valid data.  It must also
contain a reference to 
	the data verification process."
http://www.icann.org/committees/security/sac003.htm

Thanks again for your helpful comments,

Ryan

---

From: wessorh at ar.com (Rick Wesson)
Date: Wed Nov 12 09:22:32 2003

Mr. Legal Professional:

no matter what the SECSAC said,  your proposal does not fit with the 
functional framework of the CRISP work. You can't say "well this works in the 
US because we have verifiable zip codes" and ignore the 200+ countries that 
your proposal does not work in.

I continue to believe that a 'Last Verified Date' would be valuable to the 
community. Furthermore, I don't believe you have justified any of your 
proposal, or provided the requested examples from my last note, indicating 
that we may now safely ignore your proposal.

-rick

---

From: vb at bertola.eu.org (Vittorio Bertola)
Date: Wed Nov 12 10:10:33 2003

Ryan Lehning ha scritto:
> equally relevant to the Data Omission Protocol Requirement (3.2.8.1).

Sorry - don't want to flood you with comments - but which of his 
comments, and how?

I disagree with your statement. That paragraph does not define any 
country-dependant mechanism, does not refer to undefined concepts such 
as "accuracy", nor it requires the creation of a new set of reference 
values.

Furthermore, that paragraph deals with the situation where the protocol 
is not able to return the values it is built to return, because of 
policy constraints; the protocol needs to be able to cope with this 
situation, or, simply, it won't work. But that paragraph does not 
require the protocol to start supporting new data elements or extend it 
over its original purpose.

As for ICANN's SECSAC recommendation, as you possibly know, ICANN has 
just started a policy making process to deal with that and other 
recommendations, and to verify the consensus on whether Whois contact 
data elements should be changed and how. So before talking about extra 
items to be communicated by the protocol, I think it would be wiser to 
wait for that process to finish. It will not take long.

Then (replying to your other message):

> Finally, your solution, "if you need to know more, you might simply obtain
> the registrant and registrar contacts and then ask them directly," will not
> work if the data is phony.  

Do you mean that registries return fake *registrar* information?

Thanks,
-- 
.oOo.oOo.oOo.oOo vb.
Vittorio Bertola - vb [a] bertola.eu.org
http://bertola.eu.org/    <-- Vecchio sito, nuovo toblog!