Approved Resolutions | Special Meeting of the ICANN Board | 11 December 2024

Rationale for Resolution 2024.12.11.01

Why is the Board addressing the issue?

The Security, Stability, and Resiliency (SSR) Review is one of the four Specific Reviews anchored in Article 4, Section 4.6 of the ICANN Bylaws. Specific Reviews are conducted by community-led review teams, which assess ICANN's performance in fulfilling its commitments. Reviews contribute to ensuring that ICANN serves the public interest, are critical to maintaining an effective multistakeholder model, and help ICANN achieve its mission, as detailed in Article 1 of the Bylaws.

The SSR2 Review is the second iteration of the SSR Review and is focused on the assessment of ICANN's execution of its commitment to enhance the operational stability, reliability, resiliency, security, and global interoperability of the systems and processes that are affected by the Internet's system of unique identifiers that ICANN coordinates.

What is the proposal being considered?

This proposed action is in furtherance of resolution 2021.07.21.13 to respectively place 34 SSR2 recommendations in "pending" status. The SSR2 Recommendation 17.1 was placed in a pending status, noting dependencies on the SSAC's Name Collision Analysis Project (NCAP).

SSR2 Recommendation 17.1 entails four key components: 1) creating a framework that describes the nature and frequency of name collisions and resulting concerns; 2) including metrics and mechanisms that may be used to measure the extent to which controlled interruption is successful in identifying and eliminating name collisions in such framework; 3) having a mechanism to enable protected disclosure of name collision instances; and 4) ensuring that the framework allows the handling of sensitive data and security threats.

The Name Collision Analysis Project Study 1 Final Report, published on 19 June 2020, documented prior work on name collisions and assessed name collision datasets. The Name Collision Analysis Project Study 2 Final Report, completed on 5 April 2024, proposes a Name Collision Risk Assessment Framework, which holistically measures the nature and frequency of name collisions, as well as mitigating the name collisions. The NCAP Study 2 report also examines historical data and trends, identifies common scenarios where collisions occur, and explores potential risks. In May 2024, the SSAC released SAC 124 through which it advised the Board to approve and implement the recommendations in the Name Collision Analysis Project (NCAP) Study 2 Final Report.

Beyond the NCAP study 2 report, the Board notes that the Root Cause Analysis - New gTLD Collisions report, dated January 2023, also enumerated and described causes for name collisions. The Root Cause Analysis also studied the effectiveness of controlled interruption as a mechanism to mitigate name collision.

The Board wishes to highlight the name collision related amendments to the Base Registry Agreement that are being considered by the Subsequent Procedures Implementation Review Team (IRT) assisting ICANN org in the implementation of the policy recommendations in the Final Report in the new gTLD Subsequent Procedures Policy Development Process.

The Board also recognizes ICANN's centralized reporting mechanism, that allows users to report instances of name collision, allowing ICANN to handle reported issues.

The Board concurs with the ICANN assessment that taken together, the Name Collision reporting page, the requirements in the Registry Agreement for Registry Operators, and the implementation of the Name Collision Risk Assessment Framework provide sufficient identification and mitigation of name collisions during the introduction of additional new gTLDs.

Which stakeholders or others were consulted?

The SSR2 Final Report was published for public comment and the Board received feedback as part of that process.

What significant materials did the Board review?

The Board considered various significant materials and documents. In addition to the ICANN org assessment, the Board consulted the following:

• SSR2 Review Team Final Report (25 January 2021)
• Staff Report of Public Comment Proceeding on SSR2 Review Team Final Report (10 May 2021)
• Root Cause Analysis - New gTLD Collisions (18 January 2023)
• Name Collision Analysis Project Study 1 Final Report (19 June 2020)
• Name Collision Occurrence Management Framework (30 July 2014)
• Name Collision Analysis Project Study 2 Final Report (05 April 2024)
• SSAC Advice on Name Collision Analysis (SAC 124) (01 May 2024)

Are there positive or negative community impacts?

Taking action on the SSR2 pending recommendation contributes to concluding the work to address the outcome of the SSR2 Specific Review, and enhances ICANN's accountability. With action on this remaining SSR2 pending recommendation, the status of pending Specific Reviews recommendations will be fully cleared.

Are there fiscal impacts or ramifications on ICANN (strategic plan, operating plan, budget); the community; and/or the public?

No direct fiscal impact. This Board resolution is in line with the 7 September 2024 action on the Name Collisions: SAC124 Advice and NCAP Discussion Group Recommendations.

Are there any security, stability or resiliency issues relating to the DNS?

This Board resolution is in line with the 7 September 2024 action on the Name Collisions: SAC124 Advice and NCAP Discussion Group Recommendations. It "constitutes a formal process for managing the security, stability and resilience risks associated with name collisions occurring as a result of the establishment of new generic top-level domains"².

Is this decision in the public interest and within ICANN's mission?

This action is in the public interest as it is a fulfillment of ICANN Bylaws, as articulated in Article 4, Section 4.6. It is also within ICANN's mission and mandate. ICANN reviews are an important and essential part of how ICANN upholds its commitments.

Is this either a defined policy process within ICANN's Supporting Organizations or ICANN's Organizational Administrative Function decision requiring public comment or not requiring public comment?

None required.