Hi Niels,
Il 23/01/2019 13:55, Niels ten Oever ha scritto:
On 1/23/19 1:37 PM, Hollenbeck, Scott wrote:
-----Original Message-----
From: regext <regext-boun...@ietf.org> On Behalf Of Antoin Verschuren
Sent: Friday, January 18, 2019 11:04 AM
To: Registration Protocols Extensions <regext@ietf.org>
Subject: [EXTERNAL] [regext] Call for adoption:
draft-loffredo-regext-rdap-
reverse-search
Hi all,
As discussed on the mailinglist, we have selected 5 documents that
people
most want to be added to our milestone list.
To be able to to that the documents should first be adopted as working
group documents.
This is a formal adoption request for
draft-loffredo-regext-rdap-reverse-
search
The draft is available here:
https://datatracker.ietf.org/doc/draft-loffredo-regext-rdap-reverse-search/
Please review this draft to see if you think it is suitable for
adoption by
REGEXT, and comment to the list, clearly stating your view.
Please also indicate if you are willing to contribute text, review, be a
document shepherd, etc.
I support adoption and am willing to review the document and
contribute text.
Scott
I strongly object to the adoption of this document as it currently stands.
In this draft, there are no privacy considerations, and the report
that is being cited to legitimize this approach has not been adopted
by ICANN the organization or the community and was very controversial
at the time of publication. The report is being miscited as being
produced by ICANN itself, which was not the case.
If you are referring to the document
https://www.icann.org/en/system/files/files/final-report-06jun14-en.pdf,
it sounds to me a bit weird that ICANN community has nothing in common
with it:
- it is published on ICANN web site
- it has been written by the members of an ICANN WG
In addition, the requirement of a controlled reverse search capability
by ICANN community is also reported in Specification 4 of last "Registry
Agreement" version
(https://newgtlds.icann.org/sites/default/files/agreements/agreement-approved-31jul17-en.pdf).
Finally, Francisco Arias from ICANN exposed the same requirement in his
presentation about "RDAP searchability" at IETF 102.
I think It is not meaningless to say there is some interest about a
reverse search capability in RDSs and such interest is shared by all TLDs.
There is also no limitation or specific use defined, which makes this
protocol in direct violation of with the GDPR.
I strongly disagree with you about that point.
As I wrote to you by email last November 6th, there are at least three
GDPR "lawful bases" legitimating the availability of such capability to
RDAP authenticated users.
For the sake of clarity, I report an extract of that mail here in the
following:
"First of all, I want to point out that I think to an RDAP service as a
service providing different capabilities and contents according to
different user profiles.
Such a policy should be applied to any capability but even more to the
reverse search.
That being said, let us talk in terms of GDPR lawful bases which an RDAP
provider could rely on in order to provide a user with a reverse search.
Any authenticated user, in the exercise of an official authority or
performing a specific task in the public interest that is set out in
law, would be allowed to submit a reverse search because the RDAP
provider could rely on the "Public Task" basis.
A registrar (obviously authenticated) would be allowed to submit a
reverse search ONLY on his own contacts/domains because the RDAP
provider could rely on the "Contract" basis.
The "Legitimate Interest" basis would be used to legitimate the
provisioning of the reverse search capability to a registry internal
user (obviously autheticated).
I'm sure that in the three scenarios above (the first three occurred to
me at this late hour), the reverse search would be allowed because they
correspond to out-of-band operations which are usually authorized and
executed by the registries under specific lawful bases."
The mail included another possible scenario in theory where reverse
search might be allowed also to unauthenticated users.
In that case, the "Consent" basis could be used to allow reverse
searches taking into account only those entities which have previously
given the consent for publishing their personal data on the RDS (Whois
in the past, RDAP in the future).
If we agree that reverse search is compliant to GDPR under both specific
conditions and premissible purposes, we don't need to specify that any
use of reverse search capability against GDPR principles MUST be avoided
because any RDAP provider allowing such a capability illegally will be
held responsible in law.
To furtherly demonstrate that the authors are not thinking to an
uncontrolled capability (as it is clearly stated in the "Security
Considerations" section), reverse search on .it RDAP public test server
is available only to authenticated users even if the server is currently
a mere proof of concepts and is based on faked data.
Obviously, I'm willing to work on the draft to avoid any possible
misunderstanding.
Regards,
Mario
This needs serious rework before we can adopt this as WG document imho.
Best,
Niels
_______________________________________________
regext mailing list
regext@ietf.org
https://www.ietf.org/mailman/listinfo/regext
--
Dr. Mario Loffredo
Servizi Internet e Sviluppo Tecnologico
CNR - Istituto di Informatica e Telematica
via G. Moruzzi 1, I-56124 PISA, Italy
E-Mail: mario.loffr...@iit.cnr.it
Phone: +39.0503153497
Web: http://www.iit.cnr.it/mario.loffredo
_______________________________________________
regext mailing list
regext@ietf.org
https://www.ietf.org/mailman/listinfo/regext
