<html><body><span style="font-family:Verdana; color:#000; font-size:12pt;"><div><i><span style="">"I don't disagree that there are legitimate situations where LIR contract</span><br style=""><span style="">termination could be justified, but non-compliance with a relatively</span><br style=""><span style="">minor bureaucratic tickbox operation is not one of them."</span></i><br style=""></div><div><br></div><div>Providing an operational abuse email inbox, to deal with a complaint about a host that is on a fibre optic connection and participating in a 500 GBPS botnet DDoS attack IS NOT A MINOR BUREAUCRATIC TICKBOX OPERATION.</div><div><br></div><div>It's people like this, that just don't get it & why not only should the resource be de-registered, but a fee should apply every time RIPE is required to investigate a non-responsive abuse mailbox or any other non-compliance with RIPE policy.</div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div>
<blockquote id="replyBlockquote" webmail="1" style="border-left: 2px solid blue; margin-left: 8px; padding-left: 8px; font-size:10pt; color:black; font-family:verdana;">
<div id="wmQuoteWrapper">
-------- Original Message --------<br>
Subject: Re: [anti-abuse-wg] [policy-announce] 2017-02 Review Phase<br>
(Regular abuse-c Validation)<br>
From: Nick Hilliard <<a href="mailto:nick@foobar.org">nick@foobar.org</a>><br>
Date: Thu, January 25, 2018 1:40 am<br>
To: Brian Nisbet <<a href="mailto:brian.nisbet@heanet.ie">brian.nisbet@heanet.ie</a>><br>
Cc: Gert Doering <<a href="mailto:gert@space.net">gert@space.net</a>>, <a href="mailto:anti-abuse-wg@ripe.net">anti-abuse-wg@ripe.net</a><br>
<br>
Brian Nisbet wrote:<br>
> No, it isn't. It's a statement that the process has many steps and that<br>
> the NCC both say they do and clearly do whatever they can to not reach<br>
> the termination point of the process. I'm not saying it could never<br>
> happen, I'm saying that it if happens it's may have been started by<br>
> 2017-02 but the deregistration would happen because over ~9 months the<br>
> NCC would be unable to in contact with the LIR in any way.<br>
<br>
Couple of things here.<br>
<br>
Firstly, you're not denying that an extreme policy compliance<br>
enforcement mechanism exists.<br>
<br>
Having a policy which allows a LIR contract to be terminated is extreme,<br>
de-facto. It is extreme because the consequences of address resource<br>
withdrawal would be terminal for many address holders.<br>
<br>
I don't disagree that there are legitimate situations where LIR contract<br>
termination could be justified, but non-compliance with a relatively<br>
minor bureaucratic tickbox operation is not one of them.<br>
<br>
Presenting an argument about operational procedures and saying that this<br>
hasn't been deployed in the past is a different issue.<br>
<br>
It's akin to describing the colour of a pair of gloves and showing how<br>
soft and how nice and even how comfortable they are, while pretending<br>
that just because the gloves are so nice, that there isn't an iron fist<br>
underneath.<br>
<br>
Make no mistake, there here is an iron fist being inserted into the<br>
policy here and the policy proposal document is - unusually for a policy<br>
proposal - explicitly stating in the interpretation notes that this can,<br>
and will be used if compliance is not achieved.<br>
<br>
Again, I have no problem with a policy of LIR termination in situations<br>
where that is justified. This is not one of those situations.<br>
<br>
Secondly, there is no RIPE Community policy that I'm aware of which<br>
mandates LIR termination for anything, and certainly not for minor<br>
issues like this.<br>
<br>
It needs to be pointed out that the RIPE NCC board has recently, and<br>
without notification to either the membership or the RIPE Community,<br>
substantially changed the terms of the "RIPE NCC Audit Activity"<br>
document which is a RIPE NCC operational policy, not a RIPE Community<br>
policy. The old policy stated that the escalation path was "further<br>
measures may be necessary", without stating what those further measures<br>
were. Notably, termination of the rights of resource holders was not<br>
included. The new policy, dating from Jan 10th states that LIR<br>
termination is now a formal and documented RIPE NCC policy. This<br>
represents a substantial change in itself.<br>
<br>
Confusingly, the "RIPE NCC Audit Activity" document is linked from<br>
several RIPE Community policies without restriction, which means that we<br>
now appear to be in the awkward situation where the RIPE NCC is<br>
*arguably* making changes to RIPE Community policy (without reference or<br>
even notification to the community) because existing references in RIPE<br>
Community policy documents referred to RIPE-423 and previous versions<br>
rather than RIPE-694. This is troubling in its own right.<br>
<br>
What's inside the scope of AAWG is that apparently RIPE-694 now exists<br>
and if a policy is passed which acknowledges this document content<br>
change, then that RIPE Community policy - unlike all other previous RIPE<br>
Community policies which acknowledged RIPE-423 - will give explicit RIPE<br>
community mandate to termination of resource holder rights under the<br>
terms of 694.<br>
<br>
This marks a dramatic and substantial change in RIPE Community policy<br>
because for the first time, the community would be explicitly giving a<br>
mandate to the RIPE NCC to use RIPE-694 rather than RIPE-423.<br>
<br>
With due respect to your analysis, this is a far larger issue than ought<br>
to be dealt with in AAWG. If there is serious intent to continue with<br>
any proposal which involves extinguishment of resource holder rights,<br>
that discussion needs to be brought up into the context of the larger<br>
RIPE Community and the RIPE NCC membership rather than just this working<br>
group.<br>
<br>
Nick<br>
<br>
</div>
</blockquote></span></body></html>