1. Text Competition, Consumer Choice and Trust Metrics IAG-CCT Call 18 April 2014 I. Possible overlapping metrics II. Metrics for discussion

2. Text Possible overlapping metrics 2.3: Biennial surveys of perceived consumer choice in DNS, relative to experience before the gTLD expansion. 2.13: Biennial survey of perceived consumer choice relative to experiences before the gTLD expansion. Survey should assess public awareness of new gTLDs. Survey should also measure costs of defensive or duplicate registrations. Survey should assess motivations, intent, and satisfaction with new gTLDs. Both are related to end-user surveys and will require multiple questions to get to a metric measuring users’ understanding of TLD eligibility restrictions and perceived consumer choice. o Suggestion: Combine with other metrics related to end-user survey for a single report measuring broad end user understanding and use of the DNS.

3. Text Possible overlapping metrics 2.9: Relative share of new gTLD registrations already having the same domain in legacy TLDs prior to expansion. 2.10: Automated analysis or online survey to determine the number of “duplicate” registrations in new gTLDs. Same metric but with different methodologies. Given that we can likely find reliable data in an automated and reliable way (measuring exact matches in second-level domains across gTLDs), the survey questions may only provide a glimpse into registrants’ attitudes toward duplicate registrations.

4. Text Possible overlapping metrics 9.1: Are end-user software applications capable of implementing all of the new gTLDs; Can browsers and DNS clients in end-user systems resolve all new gTLDs 9.2: Which browsers or other end-user applications require plugins or user-installed enhancements in order to use new gTLDs Both are derived from the same questions regarding the accessibility of all new gTLDs to end users. 9.2 drills further into 9.1 as whether applications and software are incapable of resolving new gTLDs unless users install necessary fixes.

5. Text 1.14: Quantity and Relative Incidence of Domain Takedowns. This metric relies on voluntary self-reporting (either by RRs or governments/LEA), which may be difficult to gather. Also raises question of why those domains are being taken down and whether raw numbers provide context for trends in either direction.

6. Text 1.18: Quantity and relative incidence of detected botnets and malware distributed using new gTLDs. Potential sources: Spamhaus: DROP lists botnets and malware ShadowServer: Tracks botnets and malware and has historic data Malware Domain List: Historic data to 2009 APWG: May collect some of this data May be sensitivities surrounding definitions of botnets and malware and metrics used to measure their relative incidence. Would require securing outside expertise to conduct detailed analysis.

7. Text 1.19: Quantity and relative incidence of sites found to be dealing in or distributing identities and account information used in identity fraud. Research has found that stolen identities are not distributed via sites but rather underground chat rooms or other networks. May be able to measure instance of sites collecting identities, but this might mirror the information in metrics 1.16-1.18 (on phishing, malware and botnets.)

8. Text 5.2-5.4: Growth in use of hosted pages (i.e. Facebook)/QR codes/URL shortening services Data sources: Comscore has some U.S./Europe-centric data on mobile phone usage (QR codes) More representative global data available for desktop computer users on hosted pages and URL shorteners Costs vary but can do snapshot reports or provide access to subscription service Other market research firms for comparison: Nielsen Online, Alexa Data is available, but further consideration needed about contextualization and use of data.

9. Text 5.6: Growth of Software Defined Networking (SDN) as alternative to the DNS Unclear how SDN is an alternative to DNS Is this related to the use of apps/QR codes/URL shorteners, which are covered under 5.2-5.4?

10. Text 6.1: Number of consumer complaints to government agencies related to confusing or misleading domain names What is meant by “confusing or misleading” domain names? Difficult to obtain measurable and statistically valid data. Econsumer.gov (an initiative of the International Consumer Protection and Enforcement Network) tracks complaints from its 29 member countries

11. Text 6.2: Number of complaints to police agencies alleging fraud or misrepresentation based on – or traced to – domain names Some data available, but it may not be a very complete global picture nor enough to determine a statistically valid answer. o Disparate reports from various national law enforcement agencies, consumer reporting groups, and corporate risk analysis firms. o Law enforcement can’t easily or accurately classify a domain as being an intentional or consequential instrument of a crime.

12. Text 6.3: Number of fraud investigations where WHOIS information positively assisted investigation and identification of offending parties Feedback indicated that LEA would be unwilling to share this type of information for fear of exposing investigation techniques.

13. Text 8.2: How many registries are subject to Compliance activity based on reported breaches of RAA? Is this meant to track miscategorized complaints about RAA breaches, but which then are correctly treated as Ry compliance issues? Compliance does not initiate enforcement activity on a registry based on a complaint about a registrar.

14. Text Data security breach reports collected per 2013 RAA 3.20 Registry agreement 2.18: ICANN may receive complaints on insufficient protection of personal data Is the metric meant to measure ICANN compliance’s response to potential violations of applicable national laws? Applicable national laws Further define “applicable national law” to determine LEA input, i.e. tax laws, identity theft, pornography, etc. WIPO indexes a subset of cases that reference national laws – but ultimately these cases are tracked as UDRP decisions in other metrics 1.13: Quantity of Compliance Concerns regarding Applicable National Laws, including reported data security breaches.