- Session Title:                       Who is Collected, Disclosed and Protected: CERTs Viewpoint

- Date:                                        14 November 2018           

- Time:                                       11:30 - 12:30

- Session Organizer:           Pablo Hinojosa

- Chair/Moderators:             Madeline Carr, Duncan Hollis

- Rapporteur/Notetaker:  Madeline Carr

- List of Speakers and their institutional affiliations:  

(in order of participation)

• Duncan Hollis, Professor of Law, Temple University School of Law
• Dr. Madeline Carr, Associate Professor of International Relations and Cyber Security, University College London
• Pablo Hinojosa, Strategic Engagement Director, APNIC
• Paul Wilson, APNIC
• Cristine Hoepers, CERT Brazil
• Becky Burr, ICANN
• Grégory Mounier, Europol
• Jac Sm Kee, APC Women
• Farzaneh Badii, Georgia Institute of Technology

- Key Issues raised (1 sentence per issue):                 

• As in the past two IGF sessions, this roundtable is an effort to improve dialogue between the policy, technical and internet governance communities.
• We always choose one specific issue around which we can gather and exchange views in an effort to better understand diverse perspectives on a contentious topic.
• This session touched on the difficulties of implementing the GDPR in the context of the WhoIs databases, however, the main focus was on issues around accountability online.
• The implementation of the GDPR has raised questions about the use of, access to and distribution of the WhoIs databases.
• While these questions are still to be resolved, the CERTs that rely on this information are very concerned that any steps that interrupt their easy access to critical information will hamper their ability to carry out security practices and respond to incidents.
• Although law enforcement can still access WhoIs databases, the process is now slower and more cumbersome than it was previously and this has negative implications for investigations.
• WhoIs databases can contain personally identifiable information which, under the GDPR, can only be shared under prescribed conditions such as ‘legitimate use’ or with the consent of the data subject.
• There remain very real concerns in the community about the possible infringement of human rights and the right to privacy that arise through access to personally identifiable information (PII) contained in the WhoIs databases.
• The WhoIs database is not a single, unitary database. Rather, there are many different databases that contain different information and serve different purposes.
• Some WhoIs databases contain more PII than others.
• These databases or registries operate independently.
• For CERTs, it is critical to be able to quickly identify the owner / administrator of a network that may have been affected by a security incident.
• Free access to the WhoIs databases is a key tool in the toolbox of the CERTs.
• Not being able to access the WhoIs databases that they rely upon will mean that they struggle to identify those at risk and notify them in a timely manner.
• This access is not only important for large, national CERTs but is also important for small and large organisations that need to quickly find peers in other networks to exchange information and collaboratively problem solve security incidents.
• From the perspective of the European CCTLD landscape, there has been little change in terms of data collection for the WhoIs databases post GDPR.
• For law enforcement, although criminals tend not to use their real names to register, the information in the WhoIs databases remains a key element of investigations.
• The implementation of GDPR has impacted law enforcement investigations negatively due to the added time it takes to access the data they need.
• There was a point made that CERTs do qualify as ‘legitimate interest’ under the GDPR and therefore, should still be entitled to access the WhoIs databases.
• CERTs are clearly identifiable within their community and recognise their accountability in terms of protecting sensitive data.
• While the WhoIs databases are a necessary source of information for CERTs and law enforcement, they are also open to abuse by perpetrators of gender based violence who use them to find personal details of their victims.
• The CERT representative pointed out that she really needs access to IP addresses and admin details, rather than domain names.
• It was acknowledged that further clarity about exactly what information is needed, by whom, would help this discussion move forward.
• It was suggested that it is now necessary to devise a system of due process that can operate globally, including clear checks and balances to define who are the actors, who are their interest and what information they should have access to including clear safeguards against abuse.
• The issue of a valid email address as a point of contact in case there are trademark infringements was raised as important for the intellectual property constituencies.

- If there were presentations during the session, please provide a 1-paragraph summary for each presentation:                 

n/a

- Please describe the Discussions that took place during the workshop session (3 paragraphs):    

• The exact nature of the information that CERTs require access to was discussed in some detail. As were the challenges that law enforcement face in their investigations due to time constraints now imposed by GDPR compliance.This discussion was useful in terms of developing a better understanding amongst participants of which personally identifiable information is or is not at risk through CERTs access to WhoIs databases.
• There was also an important discussion about the ways in which WhoIs database information can and is used by perpetrators of gender based violence, to suppress political free speech and also as harvested information that is then on-sold without permission of the data subjects.
• It was clear from the discussion that relevant stakeholders had not had the opportunity for clear discussion and understanding of these competing perspectives in adequate detail. By the end of the session, there was a general sense in the room that a more fine grained conversation was essential and that, having done so, there were certainly pathways for forward momentum on this issue and a resolution that brought all parties together in an acceptable framework.

- Please describe any Participant suggestions regarding the way forward/ potential next steps /key takeaways (3 paragraphs):   

• CERTs need to provide more clarity about exactly what information they need and under what circumstances. They also should take a role in outlining which entities qualify for that access, given the tightly controlled parameters of their community which has a high degree of accountability.
• The administrators of WhoIs databases need to have a clear understanding of the range of ways in which the information they collect and control can be abused by those who can access it. They should work with law enforcement, CERTs and those who work in human rights protection to develop adequate safeguards that allow CERTs to continue their work without undermining human rights.
• Further discussions of this type would be useful to tease out these future collaborative working practices and avoid the road blocks that have characterised past engagements.

Gender Reporting

- Estimate the overall number of the participants present at the session:

Around 70 pax.

- Estimate the overall number of women present at the session:

35 pax.

- To what extent did the session discuss gender equality and/or women’s empowerment?

n/a

- If the session addressed issues related to gender equality and/or women’s empowerment, please provide a brief summary of the discussion:

• The list of speakers was big and quite diverse in terms of gender, stakeholder group and geographic representation.