Minutes of the Meeting of the CIRA Board of Directors held via teleconference on May 9, 2008 at 8:30 a.m. Ottawa time
Directors attending: Paul Andersen, Richard Anderson, Annette Cyr, John Demco (ex-officio and Secretary), Heather Dryden (ex-officio), Robert Ford, Christopher Goodfellow, Byron Holland (ex-officio), Ron Kawchuk, Lynne Mackan-Roy (Vice-Chair), Ross Rader, Bill Reid, Debi Rosati (Chair), Jeff Rybak, Rick Sutcliffe
Guests: Albert Chang (CIRA), Michael Stewart (CIRA), Len St-Aubin (Industry Canada)
Recording Secretary: Lynn Gravel (CIRA)
1. WHOIS Status and Issue Update
D. Rosati thanked the Board of Directors for their time and discussion regarding this matter since the last meeting and anticipated that a decision would be made at the conclusion of the meeting. D. Rosati introduced Len St-Aubin, Director General, Telecommunications Policy at Industry Canada. L. St-Aubin was asked to join the call to articulate Industry Canada’s position on the WHOIS Policy.
Industry Canada highlighted the importance of taking into account CIRA’s established policy and process when implementing the WHOIS policy. Given the various interests of stakeholders with regard to WHOIS implementation, and the fact that CIRA operates a public resource, CIRA needs to be attentive to a wider range of interests and impacts than a private company needs to be.
The Department further recognised the challenge now facing CIRA as it works to execute the policy in a practical or workable manner. CIRA needs a defensible rationale for implementation measures to be taken, as well as a strategy for notifying the public and the various stakeholder groups involved or affected by the implementation of the WHOIS policy. Industry Canada explained that from the Department’s point of view, such care and consideration is necessary in order to preserve the credibility of the organisation.
Industry Canada strongly urged CIRA to focus simultaneously on the various legitimate uses of the WHOIS, to contend with issues such as, trademark infringement, situations where an individual’s personal name has been used to misrepresent, child exploitation, attacks on the network, and national security (narrowly defined) when considering what circumstances could necessitate provision of the non-published WHOIS name and address of an individual to a third party, without presentation of a court order. Industry Canada also emphasised that the concerns of law enforcement should not be considered secondary to the legitimate interests of other stakeholders.
Industry Canada conveyed that a principled approach based on privacy can be maintained and that, from this perspective, section 6(b) of CIRA’s Privacy Policy could be used to draft an executable process for those situations warranting provision of non-published WHOIS name and address of an individual to a third party, without a court order.
Industry Canada indicated that it remains ready to work with and assist CIRA and the Board in the successful implementation of CIRA’s WHOIS policy.
R. Anderson joined the meeting.
L. St-Aubin withdrew from the meeting.
As a preliminary matter, D. Rosati reminded the Board of Directors of the Directors’ Code of Conduct, specifically, their fiduciary duty to maintain confidentiality as well as to disclose Conflicts of Interest. It appears that there had been some discussions outside the Board and there were concerns that a Board member may have discussed the WHOIS Policy outside the Board. At the request of D. Rosati, M. Stewart summarized the Policy as a general reminder, and referred the Board of Directors to Section 3: Conflict of Interest and Section 4: Confidentiality. An objection was raised to this interpretation of the Policy on the basis that it was important that Board members be allowed to consult with outside people regarding decisions of the Board. M. Stewart articulated that he was simply reading the Policy as is, with no interpretation, and other Board members commented that a Board member should not be discussing Board matters with outsiders without the express consent of the Board. R. Ford asked that any director who may have spoken to or discussed WHOIS policy outside the Board to indicate so, and no such discussions were indicated. D. Rosati asked that each Director declare any conflicts, and no conflicts of interest were declared.
D. Rosati put a suggestion of how to move the meeting forward. Since L. St-Aubin presented Industry Canada’s view, B. Holland would then provide a discussion of the four possible scenarios identified by Staff. A motion would then be put forward for a vote.
A request was made that Directors have an opportunity to present submissions after the vote explaining why they voted the way they did.
B. Holland presented the following four implementation scenarios to the Board of Directors:
1) Implement WHOIS with specified process for Section 6(b)
Under this scenario, CIRA would implement WHOIS on June 10, 2008 with a stringent process outside of Court Orders to allow those with a legitimate reason access to certain Registrant information. This would be limited to (1) law enforcement in the areas of child exploitation, national security, and attacks on the network, (2) intellectual property rights (e.g. trademarks), and (3) personal claims (e.g. identity theft). Parties would be required to show that they had a legitimate reason for the Registrant information, backed by supporting documentation. Non-Law Enforcement parties would also be required to first use the Interested Party Contact Procedure. B. Holland also indicated that there would be a guaranteed consultation process within the first 12 months of the WHOIS launch.
2) Implement WHOIS but with an immediate consultation
Under this scenario, Staff would implement WHOIS and would only disclose Registrant information pursuant to a Court Order. There would be an immediate consultation process throughout the summer on the issue of disclosure, with the Board making a decision around Labour Day. It was noted that Staff would require specific direction from the Board regarding critical requests for Registrant information which could arise before the Board made its decision.
3) Stop implementation of WHOIS, with consultation
Under this scenario, Staff would stop the implementation of WHOIS, and would initiate public consultations. B. Holland noted that this would allow Staff to look at the issues with the benefit of the years of history. However, this scenario would also have certain negative consequences, such as Individual Registrants would be delayed in obtaining privacy protection.
4) Implement WHOIS with no changes or consultations
Under this scenario, Staff would implement WHOIS as is with no changes or consultations. Registrant information would only be disclosed pursuant to a Court Order.
Staff’s recommendation was to proceed with the first scenario. Staff strongly believed that this first option struck the most reasonable balance between the various affected stakeholders and as a result presented the smallest legal and operational risk. B. Holland noted that this scenario was consistent with the principles articulated in Michael Binder’s letter to CIRA of September 15, 2006 in which he recognized “the importance of considering the issues raised by stakeholders about trademark infringement and spamming” and that “it will be important as the new policy is implemented to strike a balance, to the extent possible, between the governing principle of privacy protection and facilitating access, as permitted by the new policy”.
According to Staff, Scenarios two and three offered other avenues for implementation that incurred respectively higher risk and liability profiles, operational overhead, and costs. Staff was of the view that Scenario four presented a significant and unacceptable level of risk to the organization and felt that it was not in the best interests of CIRA or its stakeholders, and strongly recommended that this approach not be considered.
A Board member presented a possible fifth scenario, which would involve the deletion of Section 6(b) of CIRA’s Privacy Policy. However, Staff responded that this appeared to be the same as Scenario 4. If CIRA determined that it would only disclose Registrant information pursuant to a Court Order, this would be inconsistent with Section 6(b) of the Privacy Policy and would require its deletion.
Staff put forward a resolution to the Board of Directors:
Be it resolved that the Board of Directors agrees with staff’s recommendation that they proceed to implement a process, pursuant to Section 6(b) of CIRA’s Privacy Policy, whereby certain personal information of Individual Registrants will be disclosed by CIRA under certain circumstances, as follows:
Such circumstances are: Intellectual Property claims (e.g. trademark, copyright), personal claims (e.g. identity theft) and law enforcement matters (i.e. child exploitation, national security (narrowly defined) and attacks on the Internet). Staff will determine the best means, process and documentation to implement such process and circumstances, as well as the necessary communications strategy;
Staff will announce and implement this process by June 10, 2008 (the date the new WHOIS policy is being implemented);
CIRA will hold a public consultation regarding this disclosure process within 12 months of its implementation; and
Staff will update the Board on the implementation of this disclosure process, at the Board of Directors’ meeting on June 3, 2008.
(Moved: L. Mackan-Roy, seconded: A. Cyr, in favour: A. Cyr, R. Ford, C. Goodfellow, R. Kawchuk, L. Mackan-Roy, B. Reid, D. Rosati, R. Sutcliffe; opposed: P. Andersen, R. Anderson, R. Rader and J. Rybak, motion carried).
It was directed that Staff produce an implementation package and communications strategy at the June 3, 2008 meeting.
Directors were advised that they would be given the opportunity to put forward their comments on why they voted the way they had if they wished to do so.
2. Adjournment
There being no further business, on motion by A. Cyr and seconded by R. Sutcliffe, the meeting was adjourned at 9:45 a.m.
