[rpd] Discussion about e-voting

Thu May 15 21:04:20 UTC 2014

Hi All,

Let me start this email by saying I do not know the details of this case,
nor do I know the individuals involved.

That being said, this exchange of emails has raised some very interesting
questions that I feel AfriNIC needs to answer.  Let it be stated very
clearly that I am not taking any sides here but the situation referred to
in the previous emails does have impact on the entire African community,
since there seems to be a large amount of space that has walked off the
continent.  So, here goes with the questions.

1.) I have been repeatedly informed that large allocations are checked and
signed off by the board, based on what is said here, is AfriNIC admitting
that the board failed in the checks which they have very plainly stated
are done on large allocations

2.) Raised from an earlier point about AfriNIC requesting ID documents for
certificates in order to electronically vote.  Considering that (as stated
in previous emails), AfriNIC does not require such documentation for any
other transactions, and considering that AfriNIC has not given the
community ANY information about the data storage and security, and in
addition the fact that the certificates are issued to individuals, and the
ID documents are issued to AfriNIC by individuals with absolutely no
confidentiality agreements or NDA¹s in place (effectively meaning that
should the documents get leaked, there is absolutely no recourse against
AfriNIC), this situation raises some VERY serious concerns.

Irrespective of the facts or the rights and wrongs of this case, what
AfriNIC is effectively saying here is, we had an individual that broke the
rules, bypassed our checks and balances, hoodwinked the board that had to
sign off the allocation and effectively committed a criminal offence.  In
the same breath, they are saying, give us documents which we will not
state how we are storing, how we are going to use, and with no guarantees
of confidentiality.  On a continent with such rife identity fraud and
identity theftŠ let me be bluntŠ this REALLY scares me!

3.) Considering that AfriNIC has in documented cases requested access to
members equipment, and such requests have come from members of the IP
evaluation team, and such access has in certain cases been granted (in one
case I know of by someone who was not really authorised to grant such
access), can AfriNIC comment on how many members have granted them access
to their equipment, and what did AfriNIC do to safe guard any data pulled
from that equipment.

Irrespective of all the facts of the case at hand, right now, I can only
say that the situation raises very serious questions about the checks and
balances in place and the security mechanisms in place, and I really feel
that the membership base should be demanding some very concrete answers
and reassurances.

Thanks

Andrew

On 5/15/14, 6:36 PM, "Adiel Akplogan" <adiel at afrinic.net> wrote:

>Hello Kofi,
>
>Now, as I was expecting your engagement with this list to evolve into
>this very specific case that you have also alluded to on other lists
>before, I think the community deserve some further explanation of who you
>are and what all this is about. This specific case is also connected to a
>complain that has been field for investigation with local and
>international law enforcement for possible link to criminal activities.
>That is on the way and there are many details that we can not reveal here
>but in which you have been identified by the police as one suspect.
>
>On May 15, 2014, at 17:25 PM, Kofi ansa akufo <kofi.ansa at gmail.com> wrote:
>
>> Yes there are many specific cases I need the community to take a close
>>look. Unfortunately as a former resource evaluation manager I am bound
>>by NDA by AFRINIC.
>>
>> I site one specific case which applicant has brought to my attention
>>which I need the community's support.
>>
>> Scenario: A prospective member applies to be a resourced member of
>>AFRINIC. His application gets approved after COMPLYING with policy.
>>AFRINIC billing department issues two invoices namely i.) Initial Setup
>>Fees $4000 and ii.) Annual Membership Fees $12,800 as well as
>>Registration Service Agreement (RSA). There are NO payment deadlines on
>>both invoices neither does any staff member of AFRINIC communicate such
>>to applicant.
>
>You forgot to mention that it was YOU Kofi, as then staff of AFRINIC and
>IP Analyst who has evaluated this very specific application, and this, in
>an expedite way during the last days of your notice period. We later
>understood that you had a clear conflict of interest in this application
>as it doesn¹t take long after you left the organisation that you start
>inquiring about the case and not long after be appointed by this same
>applicant as their consultant to represent them for the application. What
>do you think about that?
>
>We have carefully reviewed this specific case internally and noticed how
>that conflict of interest has played in the way you even handled the
>evaluation.
>
>> Nevertheless the applicant proceeds to sign the RSA which outlines a
>>contractual agreement between AFRINIC and the applicant. Applicant
>>further proceeds to make payment of initial setup fees of $4000 and
>>request for annual membership fees to be paid in parts due to recent
>>Forex transfer restrictions in country of operation. AFRINIC denies the
>>request for payment in parts although they allow that in certain cases
>>as stated on their website.
>
>As ex-IP analyst at AFRINIC you should better know the internal policy
>use to approve split membership fees payment (when it accepted and when
>it is not). Seems like your 12 months working at AFRINIC has not given
>you enough knowledge of our internal process as you seems to be claiming
>and selling it to all your new "customer(s)".
>
>> The applicant request an invoice update due to elapsed time (2 months)
>>and AFRINIC never responds to the request.
>>
>> AFRINIC staff respond to member on the 89th day of a so called "90
>>days" period in which application needs to be finalized. This 90 days is
>>not published anywhere in policy, website or communicated to applicant
>>during the application process.   Nevertheless again the applicant
>>responds that they are awaiting invoice update before payment.
>>
>> AFRINIC staff finally respond that the application has expired contrary
>>to what is defined in the executed RSA and further tell applicant the
>>initial setup fees of $4000 paid is non-refundable and that applicant
>>needs to put in a new application.
>
>Well we have thoroughly reviewed the whole process of this specific
>application and a communication will reach the applicant soon (as you are
>their appointed consultant you should see a copy).
>
>> These are some of the kinds of frustration applicants face with certain
>>staff members who refuse to stick to policies as well as contractual
>>agreements.
>
>You are completely misrepresenting the case and of course some members
>will be frustrated if instead of being honest and straight, they try to
>play the system and find themselves cornered by the Hostmaster team. And
>you as Ex-IP analyst trying to collude with such people who are trying to
>abuse the system is even worse and I think the community should be aware
>of such behaviour. This unfortunately explain why the team has became
>more and more demanding for each application. This unfortunately impact
>genuine applicants. But with people like you and alike around we will
>have no choice.
>
>> All that is needed in such a situation for AFRINIC team is to reissue
>>an updated invoice and enquire if the has been any changes in the
>>applicants IP resources requirement. If there has been any changes
>>request applicant to update IP address plan but NOT to tell the
>>applicant to resubmit a whole new application again when applicant was
>>not notified of any deadlines during application.
>
>Too much confusion from your side about the process. Proof that you have
>not even learn anything while working here beside trying to understand
>how to play the system from inside.
>
>> So is this specific case justified for fellow community members to
>>rally behind and knock on the doors of the CEO and AFRINIC to ask why
>>the consequence of inefficiency on the part of certain staff and
>>procedures in AFRINIC should be borne by a member :)
>
>That is a distraction tactic, diverting the attention of the community
>elsewhere so you and you allies get away with your maneuver? AFRINIC is
>an organisation that is based on honesty and you can not full a whole
>community.
>
>- a.
>
>> On May 15, 2014 2:49 PM, "Seun Ojedeji" <seun.ojedeji at gmail.com> wrote:
>> Hello Kofi,
>>
>> Let me say a few personal words below
>>
>> On Thu, May 15, 2014 at 6:54 AM, Kofi ansa akufo <kofi.ansa at gmail.com>
>>wrote:
>> <snip>
>> I draw typical examples below;
>>
>> 1. The core activity of AFRINIC is managing internet resources for the
>>Region. What is seen now is more or less a passive approach to
>>evaluation of prospective members for resources. AFRINIC staff makes it
>>difficult to get resources
>>
>> Hmm...maybe we should say the community makes it difficult, considering
>>that staff will only follow community developed policy to allocate
>>resources. Nevertheless i am not even sure that difficult is the right
>>word to use here. Perhaps if you have specific concerns of scenarios
>>where you meet all the requirement and it still seem difficult to get
>>the resource, then you could share with the community and we can go
>>banging on the doors of staff with placard ;-)
>> YET when resources are granted there is little or no follow up
>>processes to check if it is even being used in the region. A quick check
>>in the whois database of AFRINIC indicates a /13 IPv4 that was issued
>>last year which is not even used in the region. Lost of job creation
>>opportunity on the continent.
>>
>> +1 with this, and i so much agree with you that there needs to be a
>>better way to retain major part of our IP within our region, not just
>>retaining but also seeing it used and empowering people in this
>>continent; Our resources needs to drive our continent development. We
>>all should to remember that AFRINIC among all the RIRs has the least
>>number of IANA assigned /8 V4.
>>
>> The fact that we have the least of IANA allocated /8 among all the RIR
>>has also recently placed us on top of all other RIRs as the region with
>>most available v4 addresses. However we are at this present status-quo
>>not because we don't have the population to consume the resource but
>>because either the population is not enabled to consume it OR does not
>>want to. The latter is the immediate reason; if most mobile networks go
>>native public v4 you can bet that IP addresses we have left will be
>>exhausted. I will liken this situation with our mineral resources;
>>Africa is blessed with mineral resources, however most of the resources
>>are shipped out of the continent with its refined produce imported back
>>into the continent. Something similar is already happening in the IP
>>space in that the resources are shipped abroad and we get connected to
>>our IP (outside the continent) at our own expense.
>>
>> Okay enough of trying to describe the situation we currently are. The
>>most important question is what is the way forward.
>>
>> The way forward is for the community to look at the existing policies
>>used by AFRINIC to issue resource with the aim of "tightening possible
>>loose ends" towards ensuring that the IP resource benefits the region.
>>There are areas of concern that were presented by staff during afrinic
>>18[1], i think that could be a good starting point. While there is
>>another f2f around the corner, i encourage everyone to take up this
>>challenge by looking at our existing policy and proposing an update or
>>even an entirely new proposal. Some of this can be discussed at the
>>upcoming f2f meeting
>> Solution: the very IP resources we seek to manage is evolving in a
>>technology which is dissolving geographic barriers. AFRINIC should then
>>be seen as a key partner for our region to ensure that infrastructures
>>are established in our region to create jobs through standard policies
>>which will continuously monitor the activities and link or tie
>>prospective investors to the region rather than turn them off or
>>frustrate them and later grant them huge chunks of resources to be used
>>outside the region.
>>
>> While one can definitely not determine/restrict how a member should use
>>his/her IP resource, one could set certain requirements before granting
>>the resource and those could be related to infrastructure presence,
>>organisation activity history in Africa et all. All these can be
>>reflected in a policy, i again call on the community to stand up to this
>>challenge. The CEO has also recently indicated this concern in his
>>statement [2] and calls for urgent attention of the community for v4 and
>>v6 deployment in Africa.
>> 2. AFRINIC currently adopts "see the trees from the forest" approach
>>with respect to training programs (e.g. IPv6 training). There are
>>currently more than three active Research and  Education Networks (REN),
>>Association of African Universities (AAU) as well as African Network
>>Operators Group (AfNOG) - specialized groups. What I see as a better and
>>far reaching impact is to collaborate with these groups to tailor
>>curriculum and draw standards. Follow up with program monitoring and
>>audits. I believe this should NOT be a long term goal. IPv6 awareness
>>and adoption will have being considerable high.
>>
>> 3. Again the RIR should be seen playing a regulatory role. Recent years
>>has seen considerable internet exchange spring up each with their own
>>operating guidelines for membership and peering. What AFRINIC should be
>>doing is to collaborate with key stakeholders (governments, submarine
>>cable providers, service providers through AfNOG) to draft various
>>standards and architectutes to be adhered to. (for example encourage
>>distributed / or linked national and regional exchanges.
>>
>> I think there are efforts in the areas mentioned above, nevertheless i
>>agree that more efforts needs to be put in place. However there is a
>>saying that; "you can only take a horse to the river, you can't force it
>>to drink water". There are quite many service provider that are aware of
>>the need to go v6 and that also know the disadvantage of NATing (to be
>>an incentive to deploy native v4 as much as possible) however they ain't
>>doing that because they havn't see the demand. So for me i think we will
>>experience a boost if we improve support of Africa content
>>development/initiatives that are IP demanding (internet of things) which
>>will change the demand of end users.
>>
>> <snip>
>> One will argue how does this approach impact AFRINIC members directly
>>and increase meeting turnout and subsequent voting participation?
>>
>> It can either impact it positively or negatively depending on the rules
>>and guideline we have provided. Afrinic will be 10 but its still
>>relatively young and we need to start setting policies that will make it
>>sustainable and more community driven.
>> Thanks
>>
>> Kind regards
>>
>> 1.
>>http://meeting.afrinic.net/afrinic-18/sites/default/files/Madhvipolicy-im
>>plementation-report.pdf
>> 2.
>>http://www.afrinic.net/en/library/news/1101-arin-nears-ipv4-depletion-afr
>>inic-reaffirms-the-need-for-urgent-ipv6-deployment
>> Kofi
>>
>> On May 15, 2014 6:05 AM, "Adiel Akplogan" <adiel at afrinic.net> wrote:
>>
>> On May 15, 2014, at 24:26 AM, Kofi ansa akufo <kofi.ansa at gmail.com>
>>wrote:
>>
>> > Hello Adiel and All
>> >
>> > Interesting discussion.
>> >
>> > Forgive me to play the devils advocate for a while - few questions
>>below regarding the immediate past election for board members.
>> >
>> > 1. What was the total votes casts?
>> >
>> > 2. How many votes were cast as proxy votes?
>>
>> See my previous mail for the above.
>>
>> > 3. How many individuals voted more than once due to being associated
>>to more than one member?
>>
>> 8 out of 45. Knowing that all board members (registered members) that
>>are also valid contact of resource members get 2 votes.
>>
>> > 4. What was the total active members as at the time of opening voting?
>>
>> About 750 members. This data can be dynamically checked at:
>>http://www.afrinic.net/en/about-us/our-members
>>
>> > 5. How many votes were cast through ballot paper at the election?
>>
>> 45.
>>
>> > 6. Do we have a minimum number of votes casted (%) relative to the
>>number of active members to determine dismissal or approval of the
>>election?
>>
>> That is not set anywhere. but for the past year we have been dealing
>>with around 10% ratio. Which as I mentioned in my previous mail is
>>relatively the same thing for all RIRs. So even though we are aiming at
>>better, we are not an exception (with the ressou=rces we have).
>>
>> - a.
>>
>>
>>
>>
>> --
>> ------------------------------------------------------------------------
>> Seun Ojedeji,
>> Federal University Oye-Ekiti
>> web:      http://www.fuoye.edu.ng
>> Mobile: +2348035233535
>> alt email: seun.ojedeji at fuoye.edu.ng
>>
>> The key to understanding is humility - my view !
>>
>

DISCLAIMER:  This email contains proprietary information some or all of which may be legally privileged. It is for the intended recipient only. If an addressing or transmission error has misdirected this email, please notify the author by replying to this email. If you are not the intended recipient, you must not use, disclose, copy, print, or rely on this email.  We cannot accept liability for any statements made which are clearly the sender's own and not expressly made on behalf of this company or one of its agents.