WEBVTT 1 00:01:43.790 --> 00:01:52.749 MTS - Video: the CCNO desk, and what are our objectives, and what do we, what are we trying to achieve here? 2 00:01:52.930 --> 00:02:04.139 MTS - Video: We've also got for you today some highlights from the 2026 survey of CCTLDs, and Alejandra and myself will take you through those. 3 00:02:04.530 --> 00:02:12.250 MTS - Video: We'll have a bit of a discussion on the emerging themes from the survey, and 4 00:02:12.550 --> 00:02:23.029 MTS - Video: hopefully get some insights and information around what we might want to identify for future ICANN sessions to, talk about. 5 00:02:24.390 --> 00:02:31.049 MTS - Video: Also want to invite you to join the December webinar, which we will insert 6 00:02:31.160 --> 00:02:37.740 MTS - Video: The second in there shortly, and more details will 7 00:02:37.950 --> 00:02:42.729 MTS - Video: be circulated. It currently says the 3rd of December, but it's actually, the 2nd. 8 00:02:44.470 --> 00:02:57.390 MTS - Video: Thank you also to the working group and to the subcommittee for all the work on developing the questions for the survey, and for reviewing the questions and providing feedback. 9 00:02:59.840 --> 00:03:01.720 MTS - Video: So, next slide. 10 00:03:02.630 --> 00:03:05.920 MTS - Video: a little bit about the CCNSO desk. 11 00:03:09.630 --> 00:03:10.690 MTS - Video: Thank you. 12 00:03:11.810 --> 00:03:23.940 MTS - Video: So DASC's activities primarily include sharing information via dedicated sessions within and outside the ICANN public meetings. 13 00:03:24.500 --> 00:03:32.000 MTS - Video: We provide resources for CCTLDs to access on DNS abuse. 14 00:03:32.300 --> 00:03:37.649 MTS - Video: What sorts of metrics are used to measure abuse? 15 00:03:37.860 --> 00:03:47.900 MTS - Video: And support CCTLD managers in disrupting DNS abuse or abuse, whatever that means for your CCTLD. 16 00:03:48.420 --> 00:03:51.950 MTS - Video: We currently have 24 working group members. 17 00:03:52.410 --> 00:03:58.170 MTS - Video: And… Participation is voluntary, and importantly. 18 00:03:58.410 --> 00:04:08.160 MTS - Video: DASC does not develop policies or rules. Each CCTLD will develop their own. 19 00:04:09.870 --> 00:04:17.219 MTS - Video: In accordance with, their cultural and geographic locations, and what's important to them. 20 00:04:18.380 --> 00:04:20.299 MTS - Video: Next slide, please. 21 00:04:28.310 --> 00:04:31.730 MTS - Video: So a little bit about the 2026 survey. 22 00:04:34.710 --> 00:04:38.579 MTS - Video: We've refined the questions from 2024. 23 00:04:38.720 --> 00:04:43.129 MTS - Video: Reduced them in number from 43 to 32. 24 00:04:43.740 --> 00:04:56.079 MTS - Video: provided a bit of clarity and filled some gaps based on feedback that we'd had previously. This is the third survey overall. The one prior to 24 was 2022. 25 00:04:56.810 --> 00:05:04.970 MTS - Video: Some of the new topics that we've included in the 26 one is around associated domain checks. 26 00:05:05.110 --> 00:05:07.500 MTS - Video: Domain generation algorithms. 27 00:05:08.070 --> 00:05:17.920 MTS - Video: Those two topics are also currently being explored by the GNSO policy development and going through a policy development process. 28 00:05:20.290 --> 00:05:32.310 MTS - Video: A little bit more deeper dive into registrar requirements, and some more granular information around registrant verification practices that CCTs under… CCTLDs undertake. 29 00:05:33.420 --> 00:05:34.880 MTS - Video: Next slide, please. 30 00:05:39.860 --> 00:05:41.630 MTS - Video: So a little bit. 31 00:05:53.510 --> 00:05:54.640 MTS - Video: Catch up there. 32 00:05:54.900 --> 00:06:02.200 MTS - Video: So all CCTLDs were invited to respond to the survey, and we have anonymised the results. 33 00:06:03.290 --> 00:06:09.500 MTS - Video: There's a link at the bottom there to the actual questions that were circulated and responded to. 34 00:06:09.890 --> 00:06:16.699 MTS - Video: We had 45 responses that represented 65 CCTLDs. 35 00:06:18.940 --> 00:06:20.740 MTS - Video: Next slide, please. 36 00:06:25.070 --> 00:06:39.149 MTS - Video: Just a little bit about what the survey seeks to understand. We've looked at the types of abuse that CCTLDs encounter, which is at times broader than the ICANN-defined DNS abuse. 37 00:06:39.280 --> 00:06:45.559 MTS - Video: the levels of abuse identified and what actions are being taken. 38 00:06:46.040 --> 00:06:49.290 MTS - Video: Some of the detection and mitigation tools. 39 00:06:49.520 --> 00:06:55.179 MTS - Video: verification requirements and what challenges Ccs are facing. 40 00:06:56.000 --> 00:07:01.760 MTS - Video: And in respect of the CCTLD landscape, there's currently 309. 41 00:07:02.060 --> 00:07:11.440 MTS - Video: With 65 being included in the survey, that's about 21% of CCs represented through this 26 survey. 42 00:07:14.310 --> 00:07:15.849 MTS - Video: Next slide, please. 43 00:07:17.590 --> 00:07:27.120 MTS - Video: Just a bit of context here, from CCs compared to GTLDs, they currently have just about 40% of the global market. 44 00:07:27.470 --> 00:07:36.460 MTS - Video: and 5 of the largest Tlds are, in fact, the CCTLDs, the ones shown there in red or orange. 45 00:07:42.080 --> 00:07:43.470 MTS - Video: Next slide, please. 46 00:07:48.120 --> 00:07:58.999 MTS - Video: So CCTs, LDs are uniquely distinct in their purpose, their governance, their registration rules, their policies, and tied to specific 47 00:07:59.200 --> 00:08:04.210 MTS - Video: country or territories across 5 geographic regions. 48 00:08:05.110 --> 00:08:10.089 MTS - Video: Local governance models dictate what a registry defines as abuse. 49 00:08:14.560 --> 00:08:16.119 MTS - Video: Thank you. Next slide. 50 00:08:21.140 --> 00:08:25.360 MTS - Video: Generally, CCs have typically lower levels of abuse. 51 00:08:25.500 --> 00:08:35.160 MTS - Video: observed compared to GTLDs. We don't really know why, but some of the indicators might be stricter eligibility. 52 00:08:35.260 --> 00:08:43.239 MTS - Video: requirements in some jurisdictions, and many have more rigorous data accuracy practices. 53 00:08:49.230 --> 00:08:57.990 MTS - Video: NetBeacon provides some regular reporting around comparisons between GTLDs and CCTLDs. 54 00:08:58.370 --> 00:08:59.870 MTS - Video: and 55 00:09:00.620 --> 00:09:06.090 MTS - Video: Happy to hear from anyone who might be here from NetBEACON if they wanted to talk to that at all. 56 00:09:08.230 --> 00:09:09.890 MTS - Video: Do we have anyone here? 57 00:09:12.990 --> 00:09:13.970 MTS - Video: David. 58 00:09:16.040 --> 00:09:35.130 MTS - Video: Thank you, Barbara. My name is David McCauley from VeriSign. I am definitely not part of NetBeacon. However, I joined the survey team, not at the beginning, but partway through, and one of the things I've done recently is touch base with NetBeacon with respect to these kinds of statements we have, and 59 00:09:35.310 --> 00:09:52.659 MTS - Video: Graham Button kindly responded, and there's plenty of data. I have some data I can share if anybody would like to see what I've been looking at. I don't have it to present right now. I'd be happy to share that, through email afterwards. Just get in touch with me, David McCauley, I'm at VeriSign. 60 00:09:52.660 --> 00:09:57.340 MTS - Video: But roughly, looking at the 10 largest 61 00:09:57.750 --> 00:10:09.630 MTS - Video: gTLDs versus the 10 largest ccTLDs, it was an order of magnitude of maybe one-fifth of the level of malicious… maliciously registered domains on the CC side. 62 00:10:09.630 --> 00:10:21.649 MTS - Video: And so, anyway, they have plenty of data. NetBeacon, as many of you know, does this, does a very good job of this, and so, I'm happy to share what I have and can get people in touch with Graham and Rowena. 63 00:10:21.660 --> 00:10:23.860 MTS - Video: As they would wish. Thanks. 64 00:10:29.490 --> 00:10:30.720 MTS - Video: Thanks, David. 65 00:10:32.770 --> 00:10:40.700 MTS - Video: Okay, well, any further comments or questions in respect of the context around CCs at all? 66 00:10:40.890 --> 00:10:42.330 MTS - Video: and abuse. 67 00:10:42.480 --> 00:10:43.690 MTS - Video: But nothing. 68 00:10:50.860 --> 00:10:58.270 MTS - Video: Okay, well, we'll… Now get into the survey results. And 69 00:10:58.770 --> 00:11:03.189 MTS - Video: I want to thank Alejandra for a terrific job she's done. 70 00:11:03.580 --> 00:11:14.989 MTS - Video: assessing all of the responses, and she will help me now with some of the presentation on some of the findings. So I hand over to you, Alejandra. Thank you very much. 71 00:11:16.140 --> 00:11:23.280 MTS - Video: Thank you, Barbara. This is Alejandra speaking. If we can go to the next slide. 72 00:11:23.420 --> 00:11:31.580 MTS - Video: As as and and the next one. Thank you. As we saw in the previous 73 00:11:31.830 --> 00:11:45.229 MTS - Video: slide, we, we want to understand, how DNS abuse, it's handled, in the ccTLD world, and 74 00:11:45.390 --> 00:12:01.899 MTS - Video: the more data, the more research we do, the better understanding we will have on this. And here we can see the first highlight of the surveys, and it's a comparison of the, percentage of. 75 00:12:01.990 --> 00:12:10.009 MTS - Video: CCTLDs from a region, in the 3 years that the survey has been. 76 00:12:10.010 --> 00:12:28.899 MTS - Video: circulated. So this time we had fewer responses than in previous years. We do understand that sometimes the survey can seem either too long or not everyone has all the information all at once. 77 00:12:28.900 --> 00:12:44.120 MTS - Video: But we would like to improve this in the sense of, as Barbara mentioned, the survey was reduced and maybe if some didn't know, we are trying to improve that. 78 00:12:44.230 --> 00:13:02.889 MTS - Video: I would like to encourage people to always participate in the survey, because it gives us a better understanding. We like to know that the CCTLD world has less abuse than the GTLD world. 79 00:13:02.890 --> 00:13:06.390 MTS - Video: But we would like to have data to show for it. 80 00:13:06.510 --> 00:13:17.869 MTS - Video: So here, the this, the the what we can see here is that it's similar. 81 00:13:18.240 --> 00:13:26.620 MTS - Video: distribution of the regions and, from the respondents. So. 82 00:13:27.390 --> 00:13:33.520 MTS - Video: It's good participation, and we appreciate it, but we would like more. If we can go to the next slide, please. 83 00:13:37.200 --> 00:13:53.400 MTS - Video: So there was a question on that asked to the to the Cctlds for them to let us know the levels of abuse that they know, or that they 84 00:13:53.480 --> 00:14:05.470 MTS - Video: well, self-report on on on this question. So what we can see here is that 85 00:14:05.630 --> 00:14:24.480 MTS - Video: we have, improved awareness, on, through time. Like, when we started in 2022, there were more not-sure responses than now, so that's a plus. And we can also see that there's. 86 00:14:24.530 --> 00:14:26.839 MTS - Video: As, 87 00:14:28.580 --> 00:14:41.089 MTS - Video: We are preserving, let's say, a majority of the respondents reporting on abuse below 0.1%. 88 00:14:41.210 --> 00:14:46.880 MTS - Video: So it's 89 00:14:47.400 --> 00:14:55.969 MTS - Video: It's great to see these numbers, and it's very few who have more than 0.2%, which is already low. 90 00:14:56.120 --> 00:14:59.080 MTS - Video: So Yeah. 91 00:15:00.430 --> 00:15:07.259 MTS - Video: I don't know if anyone has any questions regarding this particular highlight. Yes, Jajit. 92 00:15:07.440 --> 00:15:22.179 MTS - Video: Quick observations is one is that when we look at the responses, it's largely from EU from the previous slide. So I'll be curious to know what is the response in terms of abuse levels by region. That's one. 93 00:15:22.380 --> 00:15:33.850 MTS - Video: And second is that what is the seriousness of the abuse? So it may be 0.1 or 0.01%, but it may be extremely severe. So if we can possibly capture that in future. 94 00:15:34.600 --> 00:15:56.420 MTS - Video: We have some information around this. These are just the first highlights of the data analysis. There will be a webinar where we will get more in-depth with the responses that we got, so thank you for that. We will make sure to include that when we present them. 95 00:15:56.630 --> 00:15:57.420 MTS - Video: Thank you. 96 00:15:58.950 --> 00:16:01.479 MTS - Video: If we can go to the next one. 97 00:16:07.720 --> 00:16:15.270 MTS - Video: Okay. So here, there is. 98 00:16:15.660 --> 00:16:30.200 MTS - Video: I call this the meat buster table, because there's a sense that having low prices is related to having 99 00:16:30.210 --> 00:16:42.390 MTS - Video: abuse. But here we can see that there's a range of of of different pricing of the domain names, and 100 00:16:42.490 --> 00:17:01.139 MTS - Video: most of the respondents are still in the lower ends of abuse. So there's no link between pricing and the level of abuse from the data that we 101 00:17:01.430 --> 00:17:04.109 MTS - Video: We gathered here. 102 00:17:04.470 --> 00:17:11.750 MTS - Video: And we would like to know what it's actually what. 103 00:17:11.890 --> 00:17:28.750 MTS - Video: helps TLDs have less abuse, but at least this one that it's related to pricing and that's something that people intuitively think that that's the relation here we can see that it's it's not linked. 104 00:17:29.860 --> 00:17:30.760 MTS - Video: Oh. 105 00:17:31.270 --> 00:17:51.090 MTS - Video: So, Jayajit, for the record, just hazarding a guess is that, for the higher price levels, they're able to push in more traffic, so they will use that. So they'll use the cheapest level, which allows maximum amount of traffic to go through. So they won't use $99 plus, because that's a waste of money. 106 00:17:51.090 --> 00:17:58.500 MTS - Video: They'll not use 5 USD because that doesn't allow too much traffic to be pumped in. So the sweet spot is the area that you had marked out. 107 00:18:01.900 --> 00:18:02.670 MTS - Video: Well. 108 00:18:03.460 --> 00:18:07.289 MTS - Video: I don't know if we have the data for that. But please, Bruce. 109 00:18:08.780 --> 00:18:27.269 MTS - Video: Yeah, one comment I would make is, I think when people are filling in this survey, we're basically referring to our, I was going to say rack rate, but, you know, like the normal price that the registry offers, but I think a lot of TLDs do promotional pricing for different events, so it probably doesn't capture it. 110 00:18:27.350 --> 00:18:34.519 MTS - Video: And so, when people say that there's a link between pricing and abuse, I suspect some of it's to do with promotional programs. 111 00:18:34.670 --> 00:18:38.389 MTS - Video: Where, you know, in some cases, people say that names are free. 112 00:18:38.530 --> 00:18:53.530 MTS - Video: And then what they're trying to do is they want to get revenue from the renewals. So I think that's one thing that we probably haven't captured is the impact of promotions on abuse as opposed to the steady state when the pricing is set like this. 113 00:18:54.990 --> 00:19:05.630 MTS - Video: Yes, there were some observations in this field that they did say that since when they need to answer this question, they need to choose 114 00:19:05.630 --> 00:19:29.949 MTS - Video: one of the ranges, and some do handle different ranges. There were some observations said that, okay, we tried to place our response the best way we could on the range of prices that we have, but still, even if they do have these promotions, or even they do have the premium domain names that they… like, you can go either way, right? 115 00:19:30.030 --> 00:19:35.960 MTS - Video: They're not taken into consideration, here. But still. 116 00:19:36.170 --> 00:19:52.559 MTS - Video: knowing that the respondents still chose one of these ranges, the levels of abuse are still low. So even if they do have the promotions, we don't have a link as in 117 00:19:52.720 --> 00:20:00.309 MTS - Video: Cheap makes abuse easier or the other way around. Thank you. Christian. 118 00:20:00.950 --> 00:20:06.690 MTS - Video: Thank you. I think it really differs on what kind of abuse you're seeing. 119 00:20:06.690 --> 00:20:22.969 MTS - Video: Because for some types of abuse, the price really has a link. Like we had extreme campaigns in 2017, and we saw much higher levels of abuse and more ADR cases and so on. And we don't have that kind of promotions anymore. 120 00:20:22.970 --> 00:20:28.899 MTS - Video: But if you look at the abuse now, like, if you want to target a Swedish consumer. 121 00:20:28.900 --> 00:20:32.299 MTS - Video: Then you want to get an SE domain to target those. 122 00:20:32.300 --> 00:20:55.399 MTS - Video: So then it doesn't really matter that our TLD is around, like, $20 or something, because if you want to target these people, you get what's most credible, and in Sweden, that would be a SE domain. So there, the pricing doesn't matter. But if you just want to target whoever and get a lot of, like, old domains and so on, the pricing is very important in that sense, because. 123 00:20:55.400 --> 00:20:58.789 MTS - Video: If you only pay $0.01, then you can buy many domains. 124 00:21:05.320 --> 00:21:08.800 MTS - Video: Alright, just checking if there are no more ads. 125 00:21:09.540 --> 00:21:12.769 MTS - Video: Yeah. Well, we have one in the back. 126 00:21:17.150 --> 00:21:18.040 MTS - Video: I, 127 00:21:24.710 --> 00:21:33.550 MTS - Video: Hello, Alban Kwan from Trusted Notify. Now, just a quick question. I know some CCTLD consider local defined 128 00:21:33.620 --> 00:21:45.369 MTS - Video: abuse as the abuse type as well. Is this statistic only related to DNS abuse specifically, or is it more like an open-ended abuse? 129 00:21:45.600 --> 00:21:47.310 MTS - Video: Definition. 130 00:21:48.120 --> 00:21:52.460 MTS - Video: Well, it's on Dns abuse in particular. 131 00:21:55.010 --> 00:21:59.179 MTS - Video: So we've That, I think we can… oh, yes, Yuka? 132 00:22:00.060 --> 00:22:19.050 MTS - Video: Thanks, Alekana. So, the CCNSO DNS Abuse Standing Committee has decided that it has a very broad perspective on what relates to… related to DNS abuse, so it's not strictly limited to the ICANN definition of DNS abuse, it's broader, and 133 00:22:19.050 --> 00:22:31.529 MTS - Video: The committee has decided that the perspective is beneficial to explore. And because CCTLDs are not linked to the ICANN consensus policies. 134 00:22:31.530 --> 00:22:39.789 MTS - Video: There is a benefit in having a broader perspective and an open view of everything abuse related in the market. Thank you. 135 00:22:42.630 --> 00:22:43.739 MTS - Video: Thank you. Okay. 136 00:22:46.090 --> 00:22:49.070 MTS - Video: All right, maybe we can go to the next one. 137 00:22:58.180 --> 00:22:59.760 MTS - Video: Thank you. So here. 138 00:22:59.860 --> 00:23:16.289 MTS - Video: Another highlight, from the survey, it's related to the hot topic of AI, and, here it's, very interesting to see that, from last 139 00:23:16.290 --> 00:23:20.040 MTS - Video: Survey to the current one, there's an increase. 140 00:23:20.040 --> 00:23:32.919 MTS - Video: use and awareness of AI. Before, people were less likely to be using it and more likely not to use it. 141 00:23:33.070 --> 00:23:46.559 MTS - Video: But right now there's more respondents willing to use it less not to use it, but more planning to. So this is something to 142 00:23:47.570 --> 00:24:01.320 MTS - Video: well to to take into consideration the Cctlds are willing to innovate and to get updated with technology and to 143 00:24:01.630 --> 00:24:13.589 MTS - Video: well, use it to combat DNS abuse. In the past, the DASC had a panel at Tech Day. 144 00:24:13.590 --> 00:24:22.969 MTS - Video: where this was one of the topics, the use of AI in DNS abuse prevention and detection. 145 00:24:23.020 --> 00:24:28.079 MTS - Video: So what we see here reflects that. 146 00:24:29.230 --> 00:24:33.909 MTS - Video: Does anyone have Any comment or question on this one? 147 00:24:36.350 --> 00:24:49.040 MTS - Video: Yeah, it looks a little dangerous, because we should be using AI to protect ourselves. I mean, even two days back, I was in a meeting with our military, and we are 148 00:24:49.040 --> 00:25:00.009 MTS - Video: using AI quite significantly to stop Dns abuse. So I think it'd be important that we started adopting it in the civilian side also. 149 00:25:00.180 --> 00:25:09.280 MTS - Video: So the fact that AI is not being, there's no increase in use of AI between 2024 and 2026. No, I did it incorrectly, sorry. 150 00:25:09.490 --> 00:25:17.220 MTS - Video: Sorry I read it incorrectly. I'll take back the statement. Yes, yes, it actually increased. So okay, no problem. 151 00:25:17.370 --> 00:25:18.290 MTS - Video: A. 152 00:25:19.350 --> 00:25:22.139 MTS - Video: Okay, so let's move on to the next slide. 153 00:25:24.870 --> 00:25:29.400 MTS - Video: And here I hand it over back to Barbara. Thank you. 154 00:25:30.090 --> 00:25:34.750 MTS - Video: Just on the comment that you made, Chegg. 155 00:25:36.670 --> 00:25:43.139 MTS - Video: Yeah, Jake, Jake, did you have any examples of how you're using it that you wanted to share at all? 156 00:25:43.570 --> 00:25:50.490 MTS - Video: It was from the military, so I'll, I'll not be able to share, but, everyone is struggling. 157 00:25:50.740 --> 00:25:53.909 MTS - Video: Right, so the intent is there, but 158 00:25:53.950 --> 00:26:12.380 MTS - Video: The tools used are different. Also, the point is that there is no difference between civilian and military, because if the critical infrastructure gets impacted, then the military gets degraded. So the struggle is to make sure that there is an extension from the military to the civilian. 159 00:26:12.700 --> 00:26:24.789 MTS - Video: And that's quite challenging. Also, it's not just about .in, which is the CCTLD for India, but it's about a whole host of other things. So .in is part of the larger puzzle. 160 00:26:26.340 --> 00:26:37.659 MTS - Video: Thank you. This slide here is taken from the free text comments that people made in respect of how they're using AI. 161 00:26:37.660 --> 00:26:46.389 MTS - Video: And what types of tools that they are using. So, we've just summarized some of the in-house. 162 00:26:46.810 --> 00:26:56.999 MTS - Video: ways that CCs are using it is to, or planning to use it, is around flagging suspicious registrations. 163 00:26:57.710 --> 00:27:05.660 MTS - Video: developing tools to monitor new domains and web pages, how it's being used to identify potential abuse. 164 00:27:05.800 --> 00:27:09.300 MTS - Video: They some some have developed their own AI system. 165 00:27:09.640 --> 00:27:14.640 MTS - Video: To identify suspicious registrations, and… 166 00:27:14.680 --> 00:27:29.660 MTS - Video: Machine learning is also being used to detect domain name patterns and false addresses. In some cases they have automation set up, but in a lot of cases there is some manual as well. 167 00:27:29.820 --> 00:27:37.170 MTS - Video: And on the right-hand side is a list of the different tools that are being used, and explored. 168 00:27:38.110 --> 00:27:48.860 MTS - Video: Did anyone have any comments or want to share any of their own activities in respect to the use of AI and machine learning? 169 00:27:51.010 --> 00:27:52.620 MTS - Video: Or any challenges? 170 00:28:05.060 --> 00:28:07.790 MTS - Video: and I certainly oh, Bruce. 171 00:28:08.660 --> 00:28:13.489 MTS - Video: Yeah, I guess when… I suppose the challenge with a lot of these tools is they do. 172 00:28:13.960 --> 00:28:20.470 MTS - Video: identify a lot of, let's call it, suspicious domains, and so the question is, you know, how do you resource investigating it? 173 00:28:20.760 --> 00:28:25.180 MTS - Video: Or do you let the AI tool. 174 00:28:25.400 --> 00:28:31.369 MTS - Video: you know, start contacting customers and things. I think most of us are uncomfortable with that step. 175 00:28:31.730 --> 00:28:35.499 MTS - Video: But it's interesting, is where do you draw the line between 176 00:28:35.650 --> 00:28:37.630 MTS - Video: Where do you add the human into the loop? 177 00:28:37.770 --> 00:28:38.610 MTS - Video: I'm 178 00:28:38.810 --> 00:28:55.830 MTS - Video: And I think that's probably going to be the biggest challenge with AI. Because the tools have got the capability to go all the way through, identify something suspicious. Talk to somebody, suspend a domain name, do all those things. But I think most of us probably want to have a fair degree of human intervention at this stage. 179 00:28:58.380 --> 00:29:16.010 MTS - Video: Yeah, that's a good point. I know for our CCTLD, we're using it to get a sample to do registration, validation and verification, because you can't check… we can't check everything, so at least, it's sort of selecting the most 180 00:29:16.470 --> 00:29:20.890 MTS - Video: Dodgy looking ones that you might want to process, 181 00:29:21.120 --> 00:29:31.650 MTS - Video: And often we've found that it's quite accurate and a lot don't validate and verify, so the human in the loop in our case is at the point of 182 00:29:32.070 --> 00:29:36.420 MTS - Video: The action that's taken to suspend or 183 00:29:37.300 --> 00:29:44.060 MTS - Video: In our case, anyway. Would you go as far as letting the AI do the suspension? No, not at this point, I don't think. 184 00:29:44.740 --> 00:29:54.970 MTS - Video: Sorry, Bruce's question was, would we go as far as letting AI do the suspension? And at this point we wouldn't. Alejandra, did you have any comments? 185 00:29:55.030 --> 00:29:57.750 MTS - Video: Oh, and just to to add 186 00:29:57.750 --> 00:30:17.770 MTS - Video: To that particular point is that most of the free text submissions hinted that there was always a human involved, which is, I think, a good approach in the sense of 187 00:30:17.840 --> 00:30:37.030 MTS - Video: verify, even if it seems to be very accurate every single time. There were also comments saying that they had false positives as well, so… and some of the tools, needed more refinement, but just to… to… 188 00:30:37.210 --> 00:30:51.399 MTS - Video: to add to what was mentioned. Thank you. If I may add, it's a good question, because the system is getting overwhelmed as we speak, obviously, and therefore, what they're looking at is human-in-the-loop post-facto, which is 189 00:30:51.400 --> 00:31:06.990 MTS - Video: after they have blocked it, and then looking whether the blocking was justified or not, because in real time, in many cases, the human in the loop is given 4 minutes to look at it, which is not really human in the loop, it's somebody not applying their mind. So it's a challenging situation. 190 00:31:10.730 --> 00:31:13.740 MTS - Video: Any other comments or questions? 191 00:31:17.480 --> 00:31:20.520 MTS - Video: Okay, next slide. I think we're going. 192 00:31:22.520 --> 00:31:24.139 MTS - Video: Back to you, Alejandra. 193 00:31:25.710 --> 00:31:29.170 MTS - Video: Thank you, Barbara. This is Alejandra, and 194 00:31:30.020 --> 00:31:40.630 MTS - Video: Since, the CCNSO is, currently participating in the, Janice Oak. 195 00:31:40.850 --> 00:31:58.050 MTS - Video: PDP on mitigation of DNS abuse. This is one of the topics that they were discussing, and of course, we wanted to check with the CCTLDs if they were doing any associated domain checks, and this means that if they find 196 00:31:58.050 --> 00:32:14.300 MTS - Video: that a domain name has issues if they look to all the other domain names that might be associated with this one, if they also have issues. So, what we get from this. 197 00:32:15.550 --> 00:32:25.029 MTS - Video: question is that Some do check either regularly or occasionally. 198 00:32:25.280 --> 00:32:37.720 MTS - Video: And, others do require the registrars to do so, and, less than half, none of the above. So, it's split here, like some… 199 00:32:37.870 --> 00:32:47.670 MTS - Video: do, some don't. And one of the responses was if anyone would provide a reverse who is to third parties to 200 00:32:48.060 --> 00:32:55.210 MTS - Video: to conduct such a check, and nobody selected this particular option. 201 00:32:55.330 --> 00:32:57.080 MTS - Video: So 202 00:32:57.520 --> 00:33:05.349 MTS - Video: It's it's an interesting thing to to know. I don't know if anyone has any comments on this one. 203 00:33:06.670 --> 00:33:08.460 MTS - Video: Please, Kristen. 204 00:33:09.050 --> 00:33:23.179 MTS - Video: It's Christian from .se. I just wanted to say that we're in the process to offer Rivera Squiz publicly, and plan to launch it in December. And I know that Norway is also, but I don't know if they responded, but… 205 00:33:24.570 --> 00:33:35.619 MTS - Video: I would guess that, well, we… I cannot tell you who did it, who didn't respond, because we do keep the responses anonymized. 206 00:33:35.620 --> 00:33:46.009 MTS - Video: But in any case, if they did or didn't, maybe they would be thinking of right now if they're doing it now, since it didn't have the possibility in the future. 207 00:33:46.050 --> 00:33:49.280 MTS - Video: So, that's, something. 208 00:33:50.070 --> 00:33:51.590 MTS - Video: Anyone else? 209 00:33:52.640 --> 00:33:53.990 MTS - Video: just checking. 210 00:33:54.440 --> 00:33:56.850 MTS - Video: Oh, you? Yes. 211 00:33:58.430 --> 00:34:09.139 MTS - Video: taking over the microphone. Hi, I'm Martin Simon, SRDN. We plan to introduce a reverse WIS for. 212 00:34:09.360 --> 00:34:17.800 MTS - Video: for authorities next year so that they can do some lookups, but only for them. So it's limited. 213 00:34:20.670 --> 00:34:28.540 MTS - Video: Thank you. So looking forward when we do our next survey. But now those responses coming and Bryce. 214 00:34:28.810 --> 00:34:42.299 MTS - Video: And Bruce? Just… just gonna say, yeah, we… we sort of… there's another variation of that. Yeah, we… we have a reverse who is, but it's only available, actually, to the, actual owner of the domain name, because what we see sometimes is people 215 00:34:42.300 --> 00:34:50.149 MTS - Video: will misuse a particular registrant's credentials to register other names and they can contact us and we can give them 216 00:34:50.150 --> 00:34:53.339 MTS - Video: A list of all the names that are on on the register for them. 217 00:34:53.489 --> 00:34:57.699 MTS - Video: So we… we've yet to make it available much beyond that. 218 00:35:02.270 --> 00:35:05.569 MTS - Video: Thank you. Yes, please. 219 00:35:07.040 --> 00:35:11.869 MTS - Video: Thank you. This is Yuri Takamatsu from Dot Jp. For the record, and 220 00:35:12.050 --> 00:35:14.609 MTS - Video: My question is a little bit different. 221 00:35:15.320 --> 00:35:22.510 MTS - Video: Regarding this question, would you provide how many respondents? 222 00:35:23.470 --> 00:35:25.069 MTS - Video: Each question had. 223 00:35:25.270 --> 00:35:43.879 MTS - Video: I mean, is it possible to disclose that information as a survey result? I was just wondering, this looks like there's only percentage at the left side, so it looks like 46 are the basic number of the total, so I was literally thinking about, is it right or not? 224 00:35:44.790 --> 00:36:02.420 MTS - Video: Well, we already mentioned at the beginning how many people did respond, and this is the percentage of that number. So, usually, the task, it's the first time I'm participating in the analysis of the data, but as I know. 225 00:36:02.420 --> 00:36:06.019 MTS - Video: The task usually presents them in percentages. 226 00:36:06.020 --> 00:36:10.309 MTS - Video: Because it's the percentage of the people who responded this time. 227 00:36:10.370 --> 00:36:17.689 MTS - Video: But I defer to Secretary and the chair to tell me otherwise. 228 00:36:18.270 --> 00:36:31.160 MTS - Video: Thanks, Alejandra. So the practice of the desk has been since the very beginning to share the results in an anonymized manner. That also means not giving concrete numbers of who responded to which option. 229 00:36:31.160 --> 00:36:43.670 MTS - Video: to ensure additional anonymity and, yeah, to have a sort of a picture, a range of the direction of travel, of how the landscape looks like. And, the. 230 00:36:43.670 --> 00:36:45.059 MTS - Video: This, 231 00:36:45.060 --> 00:36:51.730 MTS - Video: Yeah, is in line with how DASC presented survey results in the past. Hope that answers your question. 232 00:36:51.810 --> 00:36:52.760 MTS - Video: Thank you. 233 00:36:54.390 --> 00:36:55.200 MTS - Video: Okay. 234 00:36:56.070 --> 00:36:59.559 MTS - Video: So let's go to the next one, please. 235 00:37:03.440 --> 00:37:09.700 MTS - Video: Okay, so, this is, something that 236 00:37:10.190 --> 00:37:28.889 MTS - Video: It's very interesting to see, regarding data verification, who does it, and when in the process it's done, and how, also. So you can see that in blue, we will see manually by the CCTLD. 237 00:37:29.290 --> 00:37:32.889 MTS - Video: In red, it's automated by the CCTLD. 238 00:37:33.170 --> 00:37:42.249 MTS - Video: In yellow, it's not performed by the CCTLD, and in green, its registrars are required to verify. So… 239 00:37:42.440 --> 00:37:58.479 MTS - Video: With that, we see that data verification happens prior to registration and post-registration. Upon renewal, it's mostly required on the registrar side. 240 00:37:58.540 --> 00:38:07.760 MTS - Video: And the screening of suspicious registration is heavily done manually by CCTLDs, according to the respondents. 241 00:38:07.950 --> 00:38:20.350 MTS - Video: There's some automation and some requirement for the registrars, but this is, how we see the data verification being 242 00:38:20.520 --> 00:38:23.440 MTS - Video: Done in different stages. 243 00:38:23.810 --> 00:38:28.229 MTS - Video: Any comments or questions on this one. 244 00:38:33.410 --> 00:38:34.340 MTS - Video: Peter. 245 00:38:36.870 --> 00:38:46.820 MTS - Video: Good morning, everyone. My name is Peter Varosta from Center. Just so that I correctly interpret this, This slide. 246 00:38:47.880 --> 00:38:53.560 MTS - Video: So if I add prior to registration and post registration, currently. 247 00:38:55.390 --> 00:39:02.990 MTS - Video: 70 to 75% of CCTLDs verify all registrations manually. 248 00:39:06.860 --> 00:39:10.140 MTS - Video: That sounds… Very high. 249 00:39:14.610 --> 00:39:20.300 MTS - Video: No. Well… 250 00:39:23.550 --> 00:39:33.820 MTS - Video: Right now, I'm blanking on whether the respondents could select more than one response, and I believe they did, but Jordan can help me here. 251 00:39:34.150 --> 00:39:45.010 MTS - Video: Oh, no, I mean, I can't. It's just that because the purple bar is up to 60%, the purple bars add up to more than 100, so you must have been able to choose multiple options, yeah. 252 00:39:46.870 --> 00:39:48.200 MTS - Video: Well, here… 253 00:39:48.820 --> 00:39:58.309 MTS - Video: We are not, we're just seeing the responses as they are, and not how many did… like, is it the same 254 00:39:58.960 --> 00:40:05.210 MTS - Video: person who selected the prior registration, the one that selected post-registration. 255 00:40:05.490 --> 00:40:21.210 MTS - Video: No, we're just telling how many people selected that response, so I wouldn't add them up to say, this is what's happening, because we don't know if it was the same person. Maybe some that do automated 256 00:40:21.260 --> 00:40:25.739 MTS - Video: Prior to registration, then they do manually post-registration, you know? 257 00:40:25.900 --> 00:40:27.910 MTS - Video: That's what I mean. 258 00:40:29.560 --> 00:40:42.900 MTS - Video: So, thanks, but… I mean, to me, that still doesn't clarify. Even if you would say we forget about the prior to registrations, that 40% of CCTLDs manually checks every registration 259 00:40:43.310 --> 00:40:48.909 MTS - Video: Post, yes, every registration post-registration. Even that seems very high. 260 00:40:50.480 --> 00:41:00.540 MTS - Video: Well, some do. Maybe it's about interpretation, or maybe the question reveals that it's only some registrations that are manually checked. 261 00:41:02.460 --> 00:41:16.479 MTS - Video: Well, I would, I have some hands up, but, we will I will need to check the observations. But yes, a lot of CCTLDs do manual checking. So I'm. 262 00:41:16.600 --> 00:41:19.000 MTS - Video: Chris, Christian first, and then Bruce. 263 00:41:19.800 --> 00:41:36.880 MTS - Video: It's Christian from DataC. I just wanted to give an example. So we have, I guess, up to, like, a thousand registrations per day, and we do have one employee sitting every day and scrolling through the registrations to see if they catch something that looks suspicious, but that's after registration. 264 00:41:36.880 --> 00:41:44.279 MTS - Video: So we use about 1 to 2 hours per day on this. And we do find a lot of interesting data that we want to look more into. 265 00:41:44.320 --> 00:41:54.720 MTS - Video: So yeah, we do manual checks. We also do a lot of automation check, and we do require registrars to verify before registration, which is of. 266 00:41:55.200 --> 00:41:57.579 MTS - Video: Different quality, depending on the registrar. 267 00:42:00.230 --> 00:42:06.369 MTS - Video: Bruce? Yeah, I was just… I can't just, offer a little bit more of a mathematical interpretation, but. 268 00:42:06.680 --> 00:42:15.140 MTS - Video: I think I'll recognise that some of the CCs are quite small, and so it's quite feasible for a person to literally look at the registrations as they're coming through. 269 00:42:15.190 --> 00:42:39.710 MTS - Video: And then even for a larger registry, you know, we probably get a couple of thousand registrations a day. I think, as Kristian said, you can still actually scan that visually, just the list, and look at stuff that looks a bit odd, and then delve into it in more detail. So you're not looking at the detail of 2,000 records, you're scanning it, and you go, oh, this record's got the word bank in it, maybe I'll have a look at it in more detail. 270 00:42:39.940 --> 00:42:48.399 MTS - Video: So I don't think you should interpret that post-registration, meaning you check every registration. It just means that someone is having a look at the registrations as a whole. 271 00:42:50.610 --> 00:42:51.520 MTS - Video: Correct. 272 00:42:53.450 --> 00:42:55.260 MTS - Video: You okay? 273 00:42:56.890 --> 00:42:58.230 MTS - Video: Oh, Kristian. 274 00:42:58.570 --> 00:43:00.219 MTS - Video: Then you're good. 275 00:43:04.100 --> 00:43:05.520 MTS - Video: Okay, thank you. 276 00:43:05.790 --> 00:43:06.940 MTS - Video: So… 277 00:43:07.160 --> 00:43:22.729 MTS - Video: Just to let you know that this question refers to question number 23 from the survey, and it was indeed a matrix question. So, respondents were able to select several options in one row. So it was about, when do people. 278 00:43:23.370 --> 00:43:30.219 MTS - Video: Do verifications and how do they happen? Like, for instance, prior to registration, is it manual, automated? 279 00:43:30.370 --> 00:43:36.730 MTS - Video: either not performed by the CCTLD or registrars are required, and all of those boxes could be selected. 280 00:43:36.930 --> 00:43:37.810 MTS - Video: Thank you. 281 00:43:40.170 --> 00:43:42.340 MTS - Video: Thank you. I see Jaichi. 282 00:43:42.760 --> 00:44:02.400 MTS - Video: Yeah, Jayajit, for the record, I was hoping somebody else will ask the question, but it's bothering me. The purple and the red and the yellow, at the first read together should add up to 100%, and I'm not able to do that visually. Maybe I'm interpreting it incorrectly again. But, between manually check. 283 00:44:02.540 --> 00:44:06.520 MTS - Video: Automatically checked and not checked, that should be 100%. 284 00:44:06.900 --> 00:44:24.209 MTS - Video: No, because since, as Jokic just explained, people could select different options, right? So what we are showing here is from each option, how… from the respondents, how many selected each, but it's not… 285 00:44:24.230 --> 00:44:31.350 MTS - Video: You cannot sum them all up to get to 100. It's from those. How… From… 286 00:44:31.450 --> 00:44:34.000 MTS - Video: What's the percentage per per option? 287 00:44:36.080 --> 00:44:41.559 MTS - Video: I mean, same, because either they will say that they did not do the check. 288 00:44:41.680 --> 00:44:49.760 MTS - Video: Right? So even if they take everything, if there is a possibility of taking everything, and if they take that they did it automatically, then they won't take the manual one. 289 00:44:49.940 --> 00:45:06.359 MTS - Video: Right? From the face value of what it looks like. So either they have performed the check or not performed the check. If they haven't, if they perform the check, then it'll be either manually or automatic. There is no third option. So, I think a bit of an interpretation will help, on this. 290 00:45:07.450 --> 00:45:11.259 MTS - Video: Okay, but we can… well, we are not showing that 291 00:45:11.410 --> 00:45:19.150 MTS - Video: The correlation between all the responses, like, if a person selected 3 options. 292 00:45:20.010 --> 00:45:33.369 MTS - Video: or that they select one option. It's just the response, like, which option was selected. But I see that it is confusing. We will review it for the webinar. Okay. 293 00:45:34.590 --> 00:45:48.379 MTS - Video: Yes, Chris? Just a quick follow-up. Like, in our system, we have an automatic system that checks first, and then the manual I talked about before, then we check manually everything the automatic system didn't catch. 294 00:45:48.380 --> 00:45:55.599 MTS - Video: So in that sense, no, I was not the one filling out the form, but I'm guessing my colleague crossed both manual and automatic. 295 00:45:55.910 --> 00:46:01.240 MTS - Video: That makes sense, and it should be more than 100%. It's less than 100. 296 00:46:01.590 --> 00:46:02.469 MTS - Video: Thank you. 297 00:46:09.590 --> 00:46:11.630 MTS - Video: We will revise Jochen. 298 00:46:15.600 --> 00:46:20.679 MTS - Video: I have to admit that I raised my hand and then forgot what I wanted to say. But 299 00:46:20.730 --> 00:46:32.199 MTS - Video: Yeah, maybe important to stress that this is self-reporting. It's not exact science, what you see here. We try to provide a picture of the landscape. 300 00:46:32.200 --> 00:46:44.740 MTS - Video: Informing discussions around ccTLDs and DNS abuse mitigation, and hoping to find emerging trends that might be relevant for ccTLDs to explore further. 301 00:46:44.800 --> 00:46:49.810 MTS - Video: But, the, display of how the… 302 00:46:49.840 --> 00:47:05.290 MTS - Video: question was asked, and how… something to be refined, perhaps. It could be displayed either by the time of when the type of verification happens, but we could also display it the other way around, like. 303 00:47:05.290 --> 00:47:11.370 MTS - Video: Focusing on the methodology, if it's automatic or manual, and… 304 00:47:11.460 --> 00:47:17.879 MTS - Video: Yeah, as said by Kristian before, you could choose all of the options or none. 305 00:47:18.430 --> 00:47:20.620 MTS - Video: Any combination. Thank you. 306 00:47:25.380 --> 00:47:28.740 MTS - Video: Okay, I don't see any more hands up. 307 00:47:29.020 --> 00:47:31.540 MTS - Video: Let's go to the next one, please. 308 00:47:38.880 --> 00:47:43.569 MTS - Video: and I get back to Barb. Thank you. 309 00:47:44.270 --> 00:47:59.960 MTS - Video: we did use AI to put the free text challenges responses from CCs into some themes for you. I know there's a lot of words on that slide, but 310 00:48:00.570 --> 00:48:05.130 MTS - Video: I guess there's a couple of key themes that are coming through. 311 00:48:05.370 --> 00:48:15.260 MTS - Video: around what are the challenges for CCs in… identifying and mitigating DNS abuse. 312 00:48:15.730 --> 00:48:19.980 MTS - Video: detection, investigation, and verification. 313 00:48:21.700 --> 00:48:30.419 MTS - Video: Everything from being able to identify the quality of the registration data. 314 00:48:31.630 --> 00:48:37.299 MTS - Video: Uncertainty around associated domain checks, whether they should do that or not. 315 00:48:39.140 --> 00:48:48.430 MTS - Video: the ongoing issue of registrant identity fraud. So even if you might have a local presence requirement. 316 00:48:48.920 --> 00:48:51.980 MTS - Video: Bad actors. 317 00:48:52.110 --> 00:49:02.470 MTS - Video: For want of a better word, using Other business identification from the local registration, 318 00:49:02.800 --> 00:49:06.649 MTS - Video: as well, so that can be difficult to detect at times. 319 00:49:09.970 --> 00:49:12.890 MTS - Video: Resources, technology and automation. 320 00:49:13.110 --> 00:49:18.579 MTS - Video: There's… For some CCs, there's limited access to threat. 321 00:49:18.720 --> 00:49:25.010 MTS - Video: intelligence. Some of that's down to the cost of vendor products. 322 00:49:25.330 --> 00:49:30.899 MTS - Video: Some of it's limited technical and human resources. 323 00:49:31.060 --> 00:49:32.650 MTS - Video: in the registry. 324 00:49:37.100 --> 00:49:40.230 MTS - Video: And a lot of manual. 325 00:49:40.560 --> 00:49:48.100 MTS - Video: Processes still in place, so… A bit of a call for more automation to help with that. 326 00:49:48.630 --> 00:49:51.920 MTS - Video: stakeholder cooperation and coordination. 327 00:49:53.970 --> 00:49:57.400 MTS - Video: need for more proactive action. 328 00:49:57.770 --> 00:50:01.760 MTS - Video: Lack of common understanding of DNS abuse. 329 00:50:01.910 --> 00:50:03.000 MTS - Video: I think… 330 00:50:03.380 --> 00:50:13.979 MTS - Video: For our forum, we don't want to put an exact definition on DNS abuse. It's whatever that is for you in your CC. 331 00:50:14.140 --> 00:50:23.140 MTS - Video: So, these other jurisdictional and authority dependencies as well. 332 00:50:24.020 --> 00:50:27.819 MTS - Video: Policy, legal and regulatory frameworks. 333 00:50:28.700 --> 00:50:32.990 MTS - Video: around potential regulatory and legal constraints. 334 00:50:34.230 --> 00:50:39.540 MTS - Video: Lack of clear contact content related guidelines. 335 00:50:39.990 --> 00:50:44.820 MTS - Video: Need for formal DNS abuse policies and response frameworks. 336 00:50:45.190 --> 00:50:49.939 MTS - Video: And… Proportionality and mitigation actions. 337 00:50:51.110 --> 00:51:06.479 MTS - Video: The other theme was reporting and data quality. As mentioned earlier, some CCs are using threat intelligence and getting a lot of false positives and low-quality abuse reports. 338 00:51:06.800 --> 00:51:14.149 MTS - Video: But on the flip side, some of them are using it quite successfully, so it's different for different CCs. 339 00:51:14.610 --> 00:51:20.499 MTS - Video: One of the common themes was poor quality or incomplete registration data. 340 00:51:20.890 --> 00:51:24.289 MTS - Video: from registrars and their customers. 341 00:51:25.240 --> 00:51:29.299 MTS - Video: Proactive mitigation and registration controls. 342 00:51:30.930 --> 00:51:33.609 MTS - Video: A real call out for more automation. 343 00:51:33.960 --> 00:51:37.369 MTS - Video: Cost and access to threat intelligence. 344 00:51:38.290 --> 00:51:46.209 MTS - Video: I just, in respect of access to threat intelligence, I just wanted to flag for some CCs who might be interested. 345 00:51:46.400 --> 00:51:50.660 MTS - Video: pir and the Internet Watch Foundation. 346 00:51:50.780 --> 00:52:03.319 MTS - Video: are providing support for anyone who wants to access CSAM, child sexual abuse material flagging. 347 00:52:03.340 --> 00:52:14.949 MTS - Video: So if that's something that you're interested in exploring, you could reach out to .pir or the Internet Watch Foundation, who can tell you more about that. 348 00:52:15.120 --> 00:52:17.849 MTS - Video: I don't know if we have anyone from PIR? 349 00:52:18.520 --> 00:52:24.810 MTS - Video: here in the session, but if you are, I'm welcome to speak to that. 350 00:52:27.710 --> 00:52:32.109 MTS - Video: doesn't look like it. But yes, if you want more information, please reach out. 351 00:52:33.170 --> 00:52:35.330 MTS - Video: David? 352 00:52:36.670 --> 00:52:43.499 MTS - Video: Thanks, Barbara. David McCauley speaking again. I know, or I believe, that the folks from PIR are planning to attend our Wednesday… 353 00:52:44.070 --> 00:52:47.559 MTS - Video: Excuse me, our session on Wednesday for that very purpose, too. 354 00:52:47.690 --> 00:52:51.530 MTS - Video: sort of spread the word about availability of IWF. Thanks. 355 00:52:52.000 --> 00:52:53.480 MTS - Video: Perfect. Thank you. 356 00:52:55.430 --> 00:53:06.399 MTS - Video: And then I guess the evolving nature of DNS abuse. It's, always evolving with AI creating it more quickly. 357 00:53:06.530 --> 00:53:21.130 MTS - Video: It's hard to keep on top of it and keep disrupting it. Need for continuous adaptation and mitigation. So, don't know if anyone wanted to speak about their experience, or any tips and tricks? 358 00:53:21.440 --> 00:53:28.840 MTS - Video: or any ways that you might be implementing more automation that others might find interesting. 359 00:53:29.720 --> 00:53:31.509 MTS - Video: Happy to open the floor up. 360 00:53:36.210 --> 00:53:37.800 MTS - Video: or anyone online. 361 00:53:51.470 --> 00:53:58.040 MTS - Video: I know centers recently published some interesting documents around 362 00:53:58.560 --> 00:54:11.049 MTS - Video: innovation from a number of different CCs in the EU around threat intelligence tools that I think some are even open source, if anyone wanted to talk to any of those at all. 363 00:54:19.050 --> 00:54:24.849 MTS - Video: If not, is there anything else that people might be finding challenging? 364 00:54:25.380 --> 00:54:30.249 MTS - Video: In your space that… You'd like to have a discussion about? 365 00:54:31.030 --> 00:54:31.870 MTS - Video: Yes. 366 00:54:33.380 --> 00:54:52.519 MTS - Video: This is Fatma from Turkey. Okay, that's the big difference between GTLDs and CCTLDs is about governance model, and we also have, trying to solve this problem in the stakeholder cooperation part. 367 00:54:52.690 --> 00:55:11.540 MTS - Video: And the PDP is trying to solve this between registrar and registrants with the help of RRI. But we have a lot of stakeholders in CCTLDs like cybersecurity units and other important units. 368 00:55:11.930 --> 00:55:24.230 MTS - Video: And because of that, I think we have to talk about more. Maybe it can be also a topic for the next meeting. 369 00:55:24.230 --> 00:55:32.299 MTS - Video: And the role of the stakeholders to solve abuse issue, to mitigate abuse issue. 370 00:55:32.300 --> 00:55:46.960 MTS - Video: And, who can be responsible for detection and verification and solving problem, from these stakeholders, cybersecurity units, registry or registrar. 371 00:55:46.960 --> 00:55:53.099 MTS - Video: I think this could be an interesting topic for the next ICANN ATA meeting. 372 00:55:55.880 --> 00:56:00.829 MTS - Video: Thank you, Fatima, for that suggestion. That's really helpful. Any Bruce. 373 00:56:01.880 --> 00:56:12.730 MTS - Video: Just a broad comment, I think, in terms of the environment that we're all operating in, but what we're seeing in Australia is much more of a… 374 00:56:12.750 --> 00:56:22.979 MTS - Video: Sentiment from consumers that tech industry, and we're just obviously one tiny part of it, but the tech industry should be doing more to stop scams. 375 00:56:22.980 --> 00:56:38.160 MTS - Video: And the problem is that a lot of scams involve a lot of providers. So typically they involve the banking system, they involve SMS messages on phones, they involve domain registrations, and often. 376 00:56:38.250 --> 00:56:53.010 MTS - Video: regulators, and in Australia we have a regulator for everything, they'll often, struggle to find who in this tech environment, should they talk to to stop a particular problem, and often the only one they can find is us. 377 00:56:53.230 --> 00:57:08.549 MTS - Video: And so we're… what we're finding is that we're trying to push back out and sort of say, well, we… we are responsible for the registration itself, and I often use the analogy of number plates. You know, we… we can actually tell you who's the number plate. 378 00:57:08.610 --> 00:57:24.219 MTS - Video: On a car, and we can tell you who owns that number plate, but we've really got nothing to do with what's going on in the car, how many passengers they've got, what goods they're carrying, et cetera, et cetera. And it's more likely that the car rental company or whatever's got more information. 379 00:57:24.340 --> 00:57:34.869 MTS - Video: So it's actually trying to map out that ecosystem for enforcement bodies and actually help people find the right person or entity to direct their complaint to. 380 00:57:39.900 --> 00:57:41.130 MTS - Video: Thanks, Bruce. 381 00:57:42.470 --> 00:57:44.890 MTS - Video: Do we have any… Oh. 382 00:57:45.020 --> 00:57:45.920 MTS - Video: Georgia. 383 00:57:46.810 --> 00:58:05.299 MTS - Video: I'll just add to what was just mentioned, is that there is also a bit of a challenge in terms of where is the regulatory power being derived to even block traffic going through. So it's, in a way, it's a legality issue. And if I can paraphrase what was just said, there is… 384 00:58:05.640 --> 00:58:24.620 MTS - Video: no power but responsibility, because you can't stop, let's say, banking traffic from going through. But the responsibility keeps falling on the transport layer, which includes the registrar. So that's a bit of a challenge. 385 00:58:26.980 --> 00:58:28.100 MTS - Video: Thank you. 386 00:58:28.350 --> 00:58:33.169 MTS - Video: Do we have anyone online who Has any questions or comments? 387 00:58:39.640 --> 00:58:40.690 MTS - Video: Okay. 388 00:58:43.050 --> 00:58:47.459 MTS - Video: Well, this is just the summary of the highlights. We. 389 00:58:48.010 --> 00:58:55.679 MTS - Video: There will be a fuller session on the 2nd of December by way of a webinar with more information. 390 00:58:55.850 --> 00:58:57.620 MTS - Video: From the survey questions. 391 00:58:58.000 --> 00:59:01.170 MTS - Video: This is just a selection. 392 00:59:01.750 --> 00:59:05.110 MTS - Video: Are we ready for the mentimeter? Oh. 393 00:59:05.310 --> 00:59:13.470 MTS - Video: Just before we do that, this is, just an overview of the previous topics and things that the 394 00:59:13.630 --> 00:59:23.929 MTS - Video: DASC have covered off at previous ICANN public meetings. So we've talked about abuse mitigation tools and measurements. 395 00:59:24.130 --> 00:59:36.659 MTS - Video: data accuracy and validation. A bit about what Bruce was just talking about, online scams, financial crime, and in particular, what some of the 396 00:59:36.860 --> 00:59:44.010 MTS - Video: country regulatory frameworks are around that anti anti-scam alliances, etc. 397 00:59:44.180 --> 00:59:45.939 MTS - Video: And there was… 398 00:59:46.150 --> 00:59:55.840 MTS - Video: a joint session with the Tech Day on AI tools and abuse mitigation, and more recently with the… it's the registry stakeholder group. 399 00:59:58.950 --> 01:00:05.819 MTS - Video: I can't remember what was the topic. Yoke, do you remember what the topic was at the registry one? 400 01:00:07.090 --> 01:00:16.059 MTS - Video: Apologies, Barbara, I was distracted. Repeat the question. I think it was the Pdps for the ICANN 85 and 86. I think. 401 01:00:16.060 --> 01:00:29.189 MTS - Video: Yeah, so CCNSO regularly has joint meetings with the Registrar Stakeholder Group, also with the Registry Stakeholder Group, and DNS abuse mitigation has always been one of the topics of common interest between 402 01:00:29.190 --> 01:00:46.430 MTS - Video: the GNSO registry stakeholder group and the CCNSO. So the PDP was definitely one of the topics, but not only. Also, regular desk activities and trends in the ccTLD landscape. Thank you. 403 01:00:47.030 --> 01:00:48.160 MTS - Video: Thank you. 404 01:00:49.280 --> 01:00:57.169 MTS - Video: So that's just a little bit of what's been covered off through by the working group more recently. And 405 01:00:58.680 --> 01:01:02.150 MTS - Video: If we could go to the next slide, please. 406 01:01:02.980 --> 01:01:12.749 MTS - Video: Just some of the emerging themes coming through is around abuse remaining lower for CCTLDs. 407 01:01:12.860 --> 01:01:25.359 MTS - Video: Potentially not all of them, but for a large number. And some of the challenges around manual processes, false positives, registrant identity fraud, poor quality data. 408 01:01:25.520 --> 01:01:36.339 MTS - Video: Limited resources… And the need for more proactive mitigation and automation. So thinking about those challenges. 409 01:01:36.980 --> 01:01:41.820 MTS - Video: I think we've got some poll… Some Mentimeter polls now. 410 01:01:42.500 --> 01:01:47.439 MTS - Video: With some questions to get your guidance around. 411 01:01:48.190 --> 01:01:52.610 MTS - Video: What sort of topics would you like to have covered off? 412 01:01:52.770 --> 01:01:57.300 MTS - Video: Or explored more, at the next ICANN meeting. 413 01:02:06.150 --> 01:02:09.859 MTS - Video: So will we have 3 questions come up for people there? 414 01:02:28.410 --> 01:02:29.400 MTS - Video: And. 415 01:02:31.490 --> 01:02:40.979 MTS - Video: So, if you can scan the QR code so you can participate in the survey. If not, you can go to menti.com on your laptop and just enter the code. 416 01:02:48.070 --> 01:02:49.000 MTS - Video: Yeah. 417 01:02:51.590 --> 01:03:02.799 MTS - Video: So we really like to know what would help CCTLDs move from being reactive to more proactive with DNS abuse mitigation. 418 01:03:08.320 --> 01:03:12.300 MTS - Video: and you should be able to just put through some free text comments here. 419 01:03:35.520 --> 01:03:39.910 MTS - Video: It's got coming up AI AI analysis, regulatory powers. 420 01:03:41.040 --> 01:03:43.819 MTS - Video: Setting up mechanisms to track abuse. 421 01:03:44.580 --> 01:03:47.920 MTS - Video: Tools deployed to mitigate DNS abuse. 422 01:03:48.040 --> 01:03:49.939 MTS - Video: AI tools again… 423 01:03:54.560 --> 01:04:02.089 MTS - Video: A CERT kind of framework at CCTLD level to share DNS abuse information on a real-time basis. 424 01:04:02.590 --> 01:04:04.590 MTS - Video: Registrar support. 425 01:04:06.220 --> 01:04:09.070 MTS - Video: Self-assessment and evaluation. 426 01:04:09.550 --> 01:04:12.559 MTS - Video: Sharing data about identified abuse. 427 01:04:14.960 --> 01:04:19.150 MTS - Video: Recognised digital identity verifications. 428 01:04:36.240 --> 01:04:39.940 MTS - Video: Maybe 30 more seconds, if there's anything else. 429 01:04:42.500 --> 01:04:45.149 MTS - Video: More work to be done with registrars. 430 01:04:49.910 --> 01:04:59.829 MTS - Video: Processes should be automated, integration of AI, continuous monitoring of use… use using AI. 431 01:05:01.310 --> 01:05:04.420 MTS - Video: Local certs coming up again. 432 01:05:05.040 --> 01:05:08.949 MTS - Video: should integrate DNS abuse in their priorities? 433 01:05:14.530 --> 01:05:20.300 MTS - Video: Sharing data about registrars or resellers who attract shady customers. 434 01:05:21.760 --> 01:05:24.200 MTS - Video: Still a lot of manual processes. 435 01:05:24.970 --> 01:05:33.959 MTS - Video: Strong identity verification, having a clear and legitimate basis for taking action, such as domestic legislation. 436 01:05:34.670 --> 01:05:40.200 MTS - Video: Hey, these are really good, ideas. Thank you very much. 437 01:05:43.390 --> 01:05:50.400 MTS - Video: Thanks, Barb, if I may. Perhaps somebody would like to speak to the answer options that they added into mentimeter. 438 01:05:51.960 --> 01:05:55.600 MTS - Video: Anybody that would like to take the floor regarding the suggestions. 439 01:06:01.780 --> 01:06:02.860 MTS - Video: Peter? 440 01:06:04.840 --> 01:06:09.819 MTS - Video: Thank you, Alejandra Peter from center. Yes, I was one of the 441 01:06:10.380 --> 01:06:17.950 MTS - Video: the few people, or the many people, I think that the added, sharing data in different… 442 01:06:18.190 --> 01:06:33.769 MTS - Video: I mean, I think the CERT umbrella suggestion is a really good one. And then make sure that that data exchange is used and explored. And there's plenty of new tools available these days to do that. 443 01:06:34.670 --> 01:06:39.860 MTS - Video: So I think that definitely is a very good option to make some progress there. Thanks. 444 01:06:42.100 --> 01:06:49.729 MTS - Video: Thank you for that. Have you got any experience engaging with your certs or around how to do that? 445 01:06:53.170 --> 01:07:18.119 MTS - Video: One of the key obstacles, unsurprisingly, in Europe has been the personal data that's involved in those exchanges. I know some registries have now finished a cooperation agreement that will allow them to exchange that data where the respective roles of data controllers are identified. And hopefully we'll be using that framework in a larger context. 446 01:07:18.120 --> 01:07:20.539 MTS - Video: Once that is established, then… 447 01:07:20.570 --> 01:07:28.879 MTS - Video: I think they are even getting confirmation from a data protection authority of one of the involved members that they're fine in sharing the data. 448 01:07:29.860 --> 01:07:42.040 MTS - Video: Especially since half of the data or more is probably fake data anyway. And it's in a public interest that is to combat DNS abuse or cybercrime in a larger context. 449 01:07:43.080 --> 01:07:43.930 MTS - Video: Thank you. 450 01:07:44.110 --> 01:07:45.639 MTS - Video: Thanks for sharing that. 451 01:07:46.360 --> 01:08:04.729 MTS - Video: Is there anyone else? So, I'll give the background as to why I put the CERT framework is for two primary reasons. One is, that the pathway for the escalation is through the national CERT, and that is a slow pathway. 452 01:08:04.840 --> 01:08:11.900 MTS - Video: Second is many of the abuses are transnational in nature, and therefore the… 453 01:08:11.920 --> 01:08:30.610 MTS - Video: the regulatory framework applicable is outside the jurisdiction of the local entity. And therefore, if we can have a layer before it reaches the national cert, a layer of the registrars sharing information at a very quick pace. 454 01:08:30.779 --> 01:08:51.040 MTS - Video: Third also is that there is poisoning of AI happening because of the fact that it's being caught much later. So the data that's being fed into the AI itself gets poisoned. And therefore, that will be a problem that will show up, I think, in a few quarters from now. And hence, a rapid response is needed at this level. 455 01:08:57.189 --> 01:09:01.939 MTS - Video: Thanks for that. Could you explain what you mean by the AI is being poisoned? 456 01:09:02.310 --> 01:09:15.989 MTS - Video: So the AI is being driven by the train data. The data itself that is being picked up is getting poisoned, and therefore, it's a long gestation attack that's happening, and that's the problem. 457 01:09:21.550 --> 01:09:24.939 MTS - Video: Anyone else wanting to speak to their suggestions? 458 01:09:27.920 --> 01:09:29.759 MTS - Video: Make sure there's no one online. 459 01:09:31.170 --> 01:09:35.070 MTS - Video: Okay, shall we move to the second Mentimeter question? 460 01:09:40.510 --> 01:09:46.369 MTS - Video: What would you like to learn from other CCs about tackling DNS abuse? 461 01:09:52.149 --> 01:09:56.019 MTS - Video: Give you a couple of minutes to send through your thoughts. 462 01:10:43.780 --> 01:10:52.009 MTS - Video: I think that's a really good question. How do CC's get their registrars involved? Does anyone have any experience with that? Just while we're 463 01:10:56.210 --> 01:10:58.160 MTS - Video: waiting for some more responses. 464 01:11:14.850 --> 01:11:19.669 MTS - Video: So some of the others we've got coming through collaborating in tools and data. 465 01:11:21.420 --> 01:11:28.839 MTS - Video: Simply their how-to, policies, techniques, how to tackle massive amounts of AI abuse reports. 466 01:11:30.960 --> 01:11:37.780 MTS - Video: What data can a CC share with each other that complies with privacy constraints? 467 01:11:38.410 --> 01:11:43.690 MTS - Video: abuse methods or techniques used to attack their registrars. 468 01:11:47.360 --> 01:11:49.010 MTS - Video: What's working? 469 01:11:50.000 --> 01:11:53.500 MTS - Video: What enablers or levers make it work? 470 01:11:56.580 --> 01:12:00.040 MTS - Video: how to work with certs again from other countries. 471 01:12:01.500 --> 01:12:04.239 MTS - Video: How to better deal with cross-border abuse. 472 01:12:06.860 --> 01:12:12.060 MTS - Video: specific ways. Other Ccs use AI for Dns abuse mitigation. 473 01:12:19.930 --> 01:12:20.950 MTS - Video: Mmm. 474 01:12:23.370 --> 01:12:28.600 MTS - Video: Good examples of collaboration between CCs and local regulatory authorities. 475 01:12:33.730 --> 01:12:37.200 MTS - Video: Maybe about… Few more seconds. 476 01:12:38.970 --> 01:12:42.119 MTS - Video: Is anyone wanting to speak to any of those suggestions? 477 01:13:07.370 --> 01:13:09.400 MTS - Video: How they handle false positives. 478 01:13:13.210 --> 01:13:16.639 MTS - Video: Okay, there's some really great suggestions here, thanks very much. 479 01:13:21.910 --> 01:13:25.499 MTS - Video: I think we're seeing quite a theme there around the cert. 480 01:13:26.180 --> 01:13:33.529 MTS - Video: Engagement and collaboration and… Also with registrars. 481 01:13:34.520 --> 01:13:38.409 MTS - Video: and AI and automation. 482 01:13:45.220 --> 01:13:46.740 MTS - Video: Anything from you, Bruce? 483 01:13:49.500 --> 01:13:51.209 MTS - Video: No, I have no problems. 484 01:13:58.620 --> 01:14:03.470 MTS - Video: Let me turn that on first. Should we go to the final question we have? 485 01:14:04.260 --> 01:14:13.869 MTS - Video: Based on what we learned from the 2026 survey, what is one issue you would like DASC to unpack at ICANN 88? 486 01:14:14.610 --> 01:14:15.970 MTS - Video: In March. 487 01:14:18.570 --> 01:14:20.150 MTS - Video: If it had to be one. 488 01:14:21.190 --> 01:14:22.780 MTS - Video: What would it be? 489 01:14:22.890 --> 01:14:24.449 MTS - Video: This is the vote. 490 01:15:56.060 --> 01:15:58.669 MTS - Video: Okay, we've got coming through, 491 01:15:59.540 --> 01:16:03.279 MTS - Video: a lot around use of AI and abuse detection. 492 01:16:05.380 --> 01:16:09.400 MTS - Video: automation and human in the loop. I think I saw there. 493 01:16:11.490 --> 01:16:17.600 MTS - Video: There's a bit coming through a few on associated domain checks. How to use information to do that. 494 01:16:18.770 --> 01:16:24.120 MTS - Video: Yeah, that was one of my comments. One thing that jumped out to me on that slide. 495 01:16:25.300 --> 01:16:42.869 MTS - Video: was, I guess, was a relative lower portion of ccTLDs doing associated domain name checks than I expected, and maybe that's, again, a bit of a mix of size of GTLD, of ccTLD, but certainly there's a policy development process requiring 496 01:16:42.870 --> 01:16:47.969 MTS - Video: GTLD registries and registrars to do associate domain checks. 497 01:16:49.310 --> 01:17:08.759 MTS - Video: What's probably missing is sort of the how, I guess, and that's probably where we can share that information. I think it's a relatively no-brainer that you should look to see if you've found abuse. Is there any other types of abuse? But what are the typical things we look for? Are we looking for Registrations that have got the same. 498 01:17:09.280 --> 01:17:18.099 MTS - Video: DNS name server, or are we looking for registrations that have got the same email address as the contact? You know, what are the things that we use as triggers? 499 01:17:21.750 --> 01:17:22.930 MTS - Video: Thanks, Bruce. 500 01:17:23.940 --> 01:17:27.800 MTS - Video: Is there anything else that anyone wants to? Yeah, Alejandra. 501 01:17:28.580 --> 01:17:33.440 MTS - Video: Just a quick observation from the 1st 502 01:17:33.510 --> 01:17:50.220 MTS - Video: inputs. There were a few on how to balance manual or automated procedures. I think that's a great thing to understand on how CCTLDs do that. 503 01:17:50.500 --> 01:17:51.600 MTS - Video: No. 504 01:17:52.150 --> 01:18:11.449 MTS - Video: just thinking from all perspectives, right? As in, from maybe smaller CCTLDs who have few registrations to large CCTLDs who have lots of registrations. Still, they do share some manuals, some, automated, and 505 01:18:11.470 --> 01:18:16.900 MTS - Video: I see a benefit on learning on those, and how to improve. 506 01:18:20.560 --> 01:18:22.190 MTS - Video: Yeah, thank you for that. 507 01:18:22.350 --> 01:18:32.740 MTS - Video: I think. Christian gave a good example of how he uses, how they do both. So that's really interesting. Thanks. Is there? 508 01:18:33.170 --> 01:18:39.150 MTS - Video: Before we wrap up, is there any further comments or questions from anyone around any of the topics? 509 01:18:44.230 --> 01:18:45.210 MTS - Video: David. 510 01:18:46.730 --> 01:18:57.480 MTS - Video: Thanks, Margaret. David McCauley speaking again. So, I'd just like to mention something that's going to be coming in the new year, and I mentioned before that I work at Verisign. I participate here in CCNSO. 511 01:18:57.670 --> 01:19:13.780 MTS - Video: But I also participate in the GNSO, in the Registry Stakeholder Group, and they're doing the P… I mean, the GNSO is doing the PDPs, they're doing discrete, you know, quickly achievable PDPs, one after the other. And one of the things they're going to be looking at in the coming year 512 01:19:14.010 --> 01:19:23.629 MTS - Video: Is the other side of DNS abuse, that is, are there recourse mechanisms available to registrants who have had a name inappropriately blocked or suspended? 513 01:19:23.750 --> 01:19:42.519 MTS - Video: And so, I just wanted to plant the seed that that work is being considered now. There's going to be an exploratory meeting at this ICANN87 about it. And so, there would be an interest in hearing about that, or hearing people's experiences if they do such… if they have such mechanisms in place, such processes. 514 01:19:42.520 --> 01:19:57.589 MTS - Video: So it's just playing the seed to, you know, to be aware in the coming year, there may be requests to hear of experience and what might work, etc. And that also illustrates a point. We've worked more and more with the registry stakeholder group, DNS Abuse Working Group. 515 01:19:57.590 --> 01:20:05.750 MTS - Video: that I also participate on, and that's a good… that's a good thing, because we're all registries, we all face this issue, and it's nice to share information. 516 01:20:05.860 --> 01:20:10.979 MTS - Video: And I think we've done that well, and we're continuing to, so thank you very much. 517 01:20:11.850 --> 01:20:12.510 MTS - Video: Okay. 518 01:20:13.180 --> 01:20:31.049 MTS - Video: Thanks, David, and I just see there's another one up there, registrant validation manual versus automated, and it seems to me there are a reasonably high number of CCs who also have their registrars required to validate and verify 519 01:20:31.090 --> 01:20:48.229 MTS - Video: customer information, so maybe there's an opportunity to learn from them how they do that as well, not just in the CCs, but how the registrars are actually doing that, and if there's any tips for CCs around that that they could implement. 520 01:20:48.630 --> 01:20:50.069 MTS - Video: If they wanted to. 521 01:20:52.930 --> 01:20:54.310 MTS - Video: Alright, I think… 522 01:20:55.480 --> 01:21:09.280 MTS - Video: We've come to the end now, so the working group will have another meeting and then chat about which topics we want to progress for the next ICANN. 523 01:21:14.090 --> 01:21:19.390 MTS - Video: Thank you very much for your participation and for the ideas and thoughts around that. 524 01:21:20.080 --> 01:21:32.840 MTS - Video: Just a plug, we will have a webinar on the 2nd of December, if you want to scan that code there, and we'll provide more information on the survey results. 525 01:21:34.020 --> 01:21:36.249 MTS - Video: If you want to come along to that. 526 01:21:39.300 --> 01:21:41.800 MTS - Video: I think that's it, is it? Okay. 527 01:21:42.140 --> 01:21:54.430 MTS - Video: Just to let you know that the slides used during today's session, together with the Mentimeter results, will be posted on the ICANN public schedule, so you can see the… you can review them there. Thank you. 528 01:21:55.560 --> 01:21:59.240 MTS - Video: Thanks. Anything else before we close up, then. 529 01:22:00.290 --> 01:22:06.159 MTS - Video: Yes, David, you okay? Have a question. Does the chat transcript gets posted on the schedule? 530 01:22:07.080 --> 01:22:07.900 MTS - Video: Okay. 531 01:22:08.420 --> 01:22:10.439 MTS - Video: Okay, just curious. Thank you. 532 01:22:13.070 --> 01:22:19.159 MTS - Video: Okay, if there's nothing else, thank you very much, and enjoy the rest of the conference.