<div><div><div><div dir="auto">Hi Kurtis,</div><div><br><div class="gmail_quote"></div></div></div></div></div><div><div><div><div dir="ltr" class="gmail_attr">On Wed, Sep 22, 2021 at 01:48 Kurtis Lindqvist <<a href="mailto:kurtis@linx.net" target="_blank">kurtis@linx.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;padding-left:1ex;border-left-color:rgb(204,204,204)" dir="auto"><br>
<br>
Hi Elvis!<br>
<br>
> On 21 Sep 2021, at 00:55, Elvis Daniel Velea <<a href="mailto:elvis@v4escrow.net" target="_blank">elvis@v4escrow.net</a>> wrote:<br>
> <br>
> What I meant to say was that all members should understand that what they hold in their accounts are numbers that have a high value and therefore they should do everything they can to secure their accounts because there are fraudsters out there trying to hack into their accounts to steal their prized assets.</blockquote></div></div></div><div><div><div><div dir="auto">[…]</div></div></div></div><div><div><div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;padding-left:1ex;border-left-color:rgb(204,204,204)" dir="auto"><br>
> How can someone be sure that an ink signature is not fake always amazes me, there are highly skilled individuals that authenticate autographs that have done this for a life and can still make mistakes.. Why has the NCC gone this route with 30+ people, none with the right skills or training to do this?</blockquote></div></div></div><div><div><div><div dir="auto">[…]</div></div></div></div><div><div><div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;padding-left:1ex;border-left-color:rgb(204,204,204)" dir="auto"><br>
> The owners of the LIR accounts should be responsible for their own passwords/authentication methods and who they give access to the resources to. They should also be responsible for the documentation provided by their company to the RIPE NCC and acknowledge that the NCC may refer cases to LEAs/justice when they have reasons to believe this information/documentation is fake.<br>
<br>
<br>
You are making the assumption that there are no undisputed resources at the moment, that there is a clear ownership for every single resource, that “password hacking” is the only way to claim or steal resources etc. Neither of these are true.</blockquote><div dir="auto"><br></div></div></div></div><div><div><div><div dir="auto">No, I am not making this assumption. What I am saying is that the NCC is basing the security of those resources and the ‘holdership’ of a resource based on the SSO owner and the documents they receive from him/her. They evaluate these documents by comparing them visually, but they don’t really have any real training in identifying a fake signature, they can suspect it, maybe.</div><div dir="auto">The NCC RS dept. has never had people specialized in identifying fake documentation. It is very hard to identify abuse or faked documentation considering the large service region it covers. Deregistering resources or refusing services based on suspicion is just an invitation to the NCC being sued and losing more time in a court than evaluating requests.</div><div dir="auto">All the NCC is basing its decisions on is that by catching the bad guys those will not have the knowledge or willingness to take it to court.</div><div dir="auto">That is why it is very important that the NCC focuses it’s effort in ensuring the members have secure access to the LIR Portal and the tools available.</div></div><div><div dir="auto"><br></div><div dir="auto">Ever wondered why we have only heard of a handful of deregistrations in almost 30 years? </div><div dir="auto">Why the NCC has rarely gone (or been taken) to court? It’s because it is not their job to prove fraud and even when they do, the NCC should first report it to LEAs and let them investigate.</div></div></div></div><div><div><div dir="auto"><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;padding-left:1ex;border-left-color:rgb(204,204,204)" dir="auto"><br>
There are plenty of disputed resources, many other ways to steal or claim resources. Disputes will arise as a result of company mergers, splits or defaults.</blockquote><div dir="auto"><br></div></div></div><div><div><div><div dir="auto">Again, everything is reduced to an SSO holder which the NCC talks to. All other cases need to resolve by mediation or court decisions. I believe that because as IP Broker I’ve had customers with all kind of weird mergers or splits and have seen how complicated some of these are. In the end, what’s registered is hard to be changed or deregistered even with enough proof in hand.</div><div dir="auto"><br></div><div dir="auto">And when it comes to legacy blocks, the NCC rarely does anything, especially when the original resource holder does not know of the hijack or does not even exist any longer so they can’t report it. I know that for a fact as I’ve previously reported at least one hijack of a large block and they have not been able to investigate or revert any changes made by what I believed to be hijackers.</div></div></div></div><div><div><div><div dir="auto"><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;padding-left:1ex;border-left-color:rgb(204,204,204)" dir="auto"><br>
<br>
Miscreants can claim ROAs for resources with loose controls or ownership structures. As a community we should all want the NCC to ensure we are protected from this as these all put us at risk.</blockquote><div dir="auto"><br></div></div></div></div><div><div><div><div dir="auto">Only if they have access to the SSO which in turn has access to the LIR Portal account. I doubt the NCC have the training to really provide this ‘protection’. Some cases may be blatantly fraudulent (like when the NCC received a copy of an ID foe John Doe with Cher’s picture on) but even then, deregistering a resource should be done very carefully.</div></div></div></div><div><div><div><div dir="auto"><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;padding-left:1ex;border-left-color:rgb(204,204,204)" dir="auto"><br>
<br>
You seem to focus on the easy of the transfer market only but the that is not the NCCs goal, far from it. NCC has other, and in my view much more important objectives they need to fulfil to protect us all. To do this they need to uphold processes that might impact the speed of the transfer market, but I personally think that is a price worth paying for a robust system and community trust. That said, the checks should be streamlined and effective, but not compromise the integrity of the data.</blockquote><div dir="auto"><br></div></div></div></div><div><div><div><div dir="auto">I am not talking only about transfers here. ALL tickets are delayed, even those where people just want to open an LIR. You see that I’m an IPv4 Broker an guess that’s my only concern. That’s not correct and you are wrong here to make that assumption.</div><div dir="auto">The Registration Services department is failing to reply within the agreed SLA and some tickets take months to resolve (see Felipe’s presentation showing that there are over 100-150 tickets opened monthly that take more than 8 weeks or/and 10 replies to be resolved, at least 1/3rd of these are improvable so something is wrong with some of the processes or communication, see slide 7 *)</div><div dir="auto"><br></div><div dir="auto">Since the Customer Services Department has been merged with the Registration Services Department, it is now one big department, the only department communicating with the members. </div><div dir="auto">RS is the link between the NCC and the membership, they have a clear SLA which they fail to respect almost daily, for years now.. that is my concern. It’s even worse that in early August we received a message saying ‘we’ll do even worse before we improve’.</div><div dir="auto"><br></div><div dir="auto">I am not asking for any compromise or anything that would compromise the accuracy of the registry. </div><div dir="auto">I am asking for a review of the processes and of the reason the delay in processing request is getting worse because, it is my opinion, the RS management has recently made some poor decisions in creating/modifying processes for sanctions checks and anti-fraud checks that delay almost all the tickets processed by that department and miss the SLA daily.</div><div dir="auto"><br></div><div dir="auto">I have also been asking for a clear picture of the number of days the SLA has been violated, the NCC is still refusing to provide that number.</div><div dir="auto"><br></div><div dir="auto">* <a href="https://ripe82.ripe.net/archives/video/584/" target="_blank">https://ripe82.ripe.net/archives/video/584/</a></div><div dir="auto"><br></div><div dir="auto"><div class="quoted-text" style="font-size:1rem;word-spacing:1px;border-color:rgb(117,117,117);color:rgb(117,117,117)" dir="auto">-- <br>Kind regards,<br>Elvis Daniel Velea<br>Chief Executive Officer<br>V4Escrow LLC<br></div><a href="http://www.v4escrow.com/" rel="noreferrer" target="_blank" style="font-size:1rem;word-spacing:1px;border-color:rgb(66,133,244)">www.v4escrow.com</a><br style="color:rgb(212,212,213);font-family:-apple-system,HelveticaNeue;word-spacing:1px"><a href="mailto:elvis@v4escrow.net" target="_blank" style="font-size:1rem;word-spacing:1px;border-color:rgb(66,133,244)">elvis@v4escrow.net</a><br style="color:rgb(212,212,213);font-family:-apple-system,HelveticaNeue;word-spacing:1px"><span style="word-spacing:1px;border-color:rgb(49,49,49);color:rgb(49,49,49)">+1-702-970-0921</span><br></div><div dir="auto"><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;padding-left:1ex;border-left-color:rgb(204,204,204)" dir="auto"><br>
<br>
- kurtis -<br>
</blockquote>
</div>
</div>
</div>-- <br><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature">This message was sent from a mobile device. Some typos may be possible. </div>