[rpd] RPD : Prolicy proposal "Internet Number Resources review by AFRINIC" informations update

[Arnaud AMELINA]

Owen,

The "This policy is not needed", "but if you want it, address A,B,C " game
continues. See inline

Le dim. 7 avr. 2019 à 17:53, Owen DeLong <owen at delong.com> a écrit :

> This change is trivial and does not address the vast majority of issues
> raised with the previous version of the proposal.
>

This new change addresses a new issue raised and agreed during the last
meeting. Not all objections raised are adopted and lead to change to
proposals.


> I hereby request that if the authors will not allow this proposal to
> expire as it should, that they at least provide a substantive update which
> addresses the majority of the issues raised to date:
>

You seem to be expecting the expiration of the proposal and did not speak
up when authors asked several times for comments and suggestions after
Hammamet.
So, why waste valuable time in responding to the points below?  People
change their mind. You opposed after you supported. You may change again.
Here you go.


> + Potential for abuse of the complaint process as a DOS attack on large
> organizations
>

This was discussed intensively and remains at the stage of  potentiality
not proven.


> + The proposal is unnecessary as the useful portions are already
> enshrined in existing policy
> and the RSA.
>

Hummmm ! Can you please point to these documents and sections ?


> + Please also address the grammatical errors (e.g. “within the four
> weeks.”)
>

Oh for sure...  Will be fixed. Thanks for pointing this out.


> + The term “annual meaningful report” is not defined. Specifically, what
> constitutes “meaningful” in this context
> and, absent a clear definition, how is this decided by whom?
>

This is left to staff to decide.  This point was also discussed intensively
and have evolved from the  original proposal to the current text:

--- initial text---
3.6 Compliance Report
AFRINIC shall publish an annual report describing the members which have
been reviewed and their level of compliance.

--- 1st amendment---
13.6 Compliance Report

AFRINIC shall publish an annual report describing review activities, in
accordance with Mauritius Data Protection Act and NDA with members.

---Current text---
13.6 Compliance Report
AFRINIC shall publish an annual meaningful report describing review
activities, in accordance with all applicable laws and regulations.
----

As you can see the consensus was to allow Staff to publish a comprehensive
report which obey the laws and regulations.

+ There is no provision for satisfactory outcome without a complete review
> by AfriNIC staff, even if it is
> obvious that there is no need for further action. This is unnecessarily
> costly to both AfriNIC and the
> organization being reviewed.
>

The proposal does not tell Staff how and when to complete a review, as by
default staff know what to do to conduct reviews.

+ As written, in the reported case, AfriNIC staff cannot reject a review
> where the evidence supported
> does not justify one. They can insist upon a sworn submission of the
> complaint and evidence, but,
> the policy does not give the discretion to reject or ignore a specious
> sworn complaint. This is a
> clear path to abuse.
>

Not true.

The current text was also a consensus of the WG discussion. Lawyers advised
that the word 'Warrant' be used to guarantee that staff has full right to
not trigger a review if the evidences do not justify one. See text below
----
B) There has been a community complaint made against them that warrants
investigation. Complaints shall be backed by evidence and AFRINIC staff
shall evaluate the facts as appropriate to conduct the review. However this
review is not applicable to a member  with the same resources portfolio on
which a full review has been completed in the preceding 24 months.
AFRINIC staff may, at its sole discretion, after having assessed the nature
of the evidence found in the community complaint, require that such
evidence be (i) submitted in the form of a sworn affidavit or (ii) declared
to be true before a Commissioner of Oath.
------


> + The numbering of the paragraphs outside of the actual policy being
> coincident with the numbering
> of the paragraphs in the proposal should be eliminated. It should be clear
> and unambiguous which
> text is intended to be applied to the policy manual and which is metadata
> for the proposal.
>

Some disorganisation occurred during the migration to the CPM's format. It
will updated. Expect a new version of the proposal.

+ The mechanism of priority in 13.2 and, indeed, the meaning of “priority
> is given” is undefined.
>

Hmmmmm.  Do we really need to define " priority is given" ? Let's review
the text again.
----
13.2 The reviews cover all allocated/Assigned resources, but priority goes
to IPv4 and ASN mappable to two-octet ASN.
-----


> + 13.3.1 does not define the intended fraction of members to be reviewed
> in any given time period.
> Is AfriNIC expected to conduct 5 random reviews per year, or 500?
>

This is left to staff to decide in the limit of  available resources (human
and financial) as discussed and agreed.

+ The 24 month exemption in section 13.3.3 ignores the fact that “full
> review completed” is vague and
> opens multiple channels of abuse…
> - What constitutes a full vs. partial review?
> - In the case where AfriNIC has satisfied itself after reviewing 80% or
> even 90% of an organizations
> resources and AfriNIC terminates the review process, does that constitute
> completion of a full
> review, or, is such an organization subject to being put through the full
> process all over again
> within 24 months?
> - Can additional complaints filed during a review trigger additional
> reviews contemporaneously?
>
>
> As one can see from the text below, the base idea is that an INR cannot be
subject to review more than once in 24 months. Member's resources portfolio
changes over time.
----
B) There has been a community complaint made against them that warrants
investigation. Complaints shall be backed by evidence and AFRINIC staff
shall evaluate the facts as appropriate to conduct the review. However this
review is not applicable to a member  with the same resources portfolio on
which a full review has been completed in the preceding 24 months.
------

Most, if not all of these problems have been reported previously. It’s
> likely there are other problems remaining as well,
> but the above is based on a fresh review of the text below.
>

> I renew my call for the authors to recognize that this proposal at best
> causes more problems than it solves and lacks community consensus or any
> likelihood of achieving community consensus.
>
> At a minimum, I ask that the authors either withdraw the proposal or
> provide a substantial update which addresses each and every concern stated
> above.
>
> Owen
>
> On behalf of authors

Arnaud

>
> On Apr 6, 2019, at 8:12 AM, Arnaud AMELINA <amelnaud at gmail.com> wrote:
>
> Hi Ernest and Co-chairs,
>
> Please find below an update of our Policy proposal "Internet Number
> Resources Review by AFRINIC", for future discussions on the list.
>
> Regards
>
> -------------------------------------------------------------------------------
> Begin
> ---------------------------------------------------------------------------------
>
>     Name : Internet Number Resources Review by AFRINIC (Draft 7)
>     Ref. Name: AFPUB-2016-GEN-001-DRAFT07
>     Status: Under Discussion
>     Date: 6 April 2019
>
> Authors:
>         (a) Amelina A. A. Arnaud | <arnaud.amelina at togorer.tg> |
> AUF/TogoRER
>         (b) Jean-Baptiste Millogo |<jean.millogo at orange.com>| Orange
> Burkina
>         (c) Marcus ADOMEY  <madomey at ug.edu.gh>  | University of Ghana
>
> 13.0 Summary of the Problem Being Addressed by this Policy Proposal
>
> As Internet Number resources are finite, their allocation is based on the
> operational needs of end-users and Internet Services Providers, while
> avoiding stockpiling in accordance with RFC7020, IPv4 Allocation Policy CPM
> 5.5, IPv6 Allocation and assignment policy CPM 6.5 and Policy for
> Autonomous System Numbers (ASN) Management in the AFRINIC region CPM
> 7.0.Section 4 of the Registration Service Agreement (RSA) provides the
> framework for investigations of the usage of allocated Internet Number
> resources, defines members’ obligation to cooperate and the measures to be
> taken by AFRINIC in case of failure to comply. The lack of such
> investigation or regular control can lead to inefficient usage of the
> Internet Number resources, to stockpiling and other type of abuses.
>
> 13.0.1 Summary of How this Proposal Addresses the Problem
>
> In order to ensure efficient and appropriate use of resources, AFRINIC
> shall conduct regular reviews of resource utilization held by its members.
> This would allow recovery of any type of resource, where usage is not in
> compliance with the RSA. Those resources can be reallocated for better
> usage.
>
> 13.0.2 Proposal
>
> The policy proposal will modify the CPM as follows:
>
> Insert a section 13 to the CPM as follows:
>
> 13.0 Internet Number Resources Review
>
> Regular reviews of resource utilization are conducted by AFRINIC to ensure
> efficient and appropriate usage of resources. This allows for recovery of
> any type of resource where usage is not in compliance with the RSA; to
> allow such resources to be reallocated for better usage.
>
> 13.1 The reviews shall be based on compliance with the terms outlined in
> the RSA and Allocation/Assignment Policies.
>
> 13.2 The reviews cover all allocated/Assigned resources, but priority goes
> to IPv4 and ASN mappable to two-octet ASN.
>
> 13.3 Classes of review: Members to be reviewed shall be selected according
> to the following classes:
>
> 13.3.1 Random
>
> The member is chosen by AFRINIC at random between the membership.
>
>
> 13.3.2 Selected
>
>  Member is selected because of an internal report or due to a lack of
> contact between the AFRINIC and the member.
>
> 13.3.3 Reported: Here, members are reviewed either because:
>
> A) They have requested the review themselves or
>
> B) There has been a community complaint made against them that warrants
> investigation. Complaints shall be backed by evidence and AFRINIC staff
> shall evaluate the facts as appropriate to conduct the review. However this
> review is not applicable to a member  with the same resources portfolio on
> which a full review has been completed in the preceding 24 months.
>
>  AFRINIC staff may, at its sole discretion, after having assessed the
> nature of the evidence found in the community complaint, require that such
> evidence be (i) submitted in the form of a sworn affidavit or (ii) declared
> to be true before a Commissioner of Oath.
>
> 13.4 In case of non-compliance and if evidence has been established in
> accordance with:
>
> •    Breach of AFRINIC policies
> •    Breach of the provisions of the registration service agreement or
> other legal agreements between the organization holding the resource and
> AFRINIC.
>
> AFRNIC shall initiate the resource recovery process.
>
> A) AFRINIC shall attempt to contact the organization and correct any
> discrepancy towards the RSA. Except in cases of fraudulent resource
> acquisition or  unlawful usage and abuse, the organization shall be given a
> minimum of six months to effect the return of the resources.
>
> If the organization is cooperative and working in good faith to
> substantially restore compliance or has a valid need for additional time to
> renumber out of the affected blocks, AFRINIC shall negotiate a longer term.
>
> The acceptance level of compliance and duration of the longer term are at
> AFRINIC staff discretion.
>
> B) If the situation cannot be rectified and the member did not transfer
> the ressources to meet other AFRINIC-approved needs as per adopted policies
>
>  AFRINIC shall publish the resources to be recovered for a period of three
> (3) months; during which the organization may at any time, seek compliance
> or transfer the ressources to other members
>
>  After this period, the resource shall be recovered and therefore the
> records of the previous holder of the recovered resource shall be updated
> in AFRINIC’s databases.
>
> C)  Any Internet Number Resources recovered under this policy may be
> assigned/allocated under existing Allocation and Assignment Policies.
>
> 13.5 Appeal procedure
>
> Reviewed members who are not satisfied have the right to appeal against
> the result within the four weeks. Appeals shall follow an arbitration
> process as provided for in the
> Code de Procedure Civile (Code of Civil Procedure) of the Republic of
> Mauritius. AFRINIC may, on request from an aggrieved party, suggest a pool
> of arbitrators who shall be knowledgeable volunteers from the community.
>
> 13.6 Compliance Report
>
> AFRINIC shall publish an annual meaningful report describing review
> activities, in accordance with all applicable laws and regulations.
>
> 13.7 Acknowledgements
>
> The authors thank Ms Wafa Dahmani Zaafouri (become Afrinic GC Chair), Mr
> Serge ILUNGA (become Afrinic Board member)  and Mr Alain P. Aina for their
> contributions  in the development of this Policy proposal.
>
> The authors also thank the community for the discussions and contributions.
>
> 4.0 Revision History
>
> 18 May 2016
>   Version 1.0
> - First Draft AFPUB-2016-GEN-001-DRAFT01
> - Posted on RPD list
>
> 05 Aug 2016
>   Version 2.0
> - Second Draft AFPUB-2016-GEN-001-DRAFT02
> - Change on the policy’s name
> - Addition of the Acknowledgement section
> - Rephrasing of section 3.3.3
>
> 18 Nov 2016
> Version 3.0
> - Third Draft AFPUB-2016-GEN-001-DRAFT03
> - Update of section 3.3.3 from discussions on mailing list
> - Update of section 3.7 (Acknowledgements) to thank the community for
> discussions and contributions
>
> 11 Apr 2017
> Version 4.0
> - Fourth Draft AFPUB-2016-GEN-001-DRAFT04
> - Update and Rephrasing of section 3.4
> - Update and Rephrasing of section 3.5
> - Update and Rephrasing of section 3.6
>
> 21 Oct. 2107
> Version 5.0
> - Fifth Draft AFPUB-2016-GEN-001-DRAFT05
> - Adding the paragraphe C to 13.3.3. according to the legal counsel
> proposition
> - Rephrasing the paragraphe 13.5 to comply with staff and legal assessment
> - Rephrasing the paragraphe 13.6 to comply with staff assessment and avoid
> any ambiguity
> - Changing the co-authors list
> - Updating the Acknowledgement session
> - Amending 13.4 (B) to  reflect the Transfer policies
>
> 06 Apr. 2018
> Version 6.0
> - Sixth Draft AFPUB-2016-GEN-001-DRAFT06
> - Removing categorization between membership in random class section 13.3.1
>
> 06 Apr. 2019
> Version 07
> - Seventh Draft AFPUB-2016-GEN-001-DRAFT07
> - Modifying section 13.4 Paragraph A) to clarify the resources recovery
> process: set conditions  under which a member could be given longer term
> to effect the return of the resources.
>
> -------------------------------------------------------------------------------
> End
> ---------------------------------------------------------------------------------
>
> AAAA./
>
> Le mar. 3 avr. 2018 à 07:51, Ernest Byaruhanga <ernest at afrinic.net> a
> écrit :
>
>> Hi Arnaud,
>>
>> On 31 Mar 2018, at 18:41, Arnaud AMELINA <amelnaud at gmail.com> wrote:
>>
>> Dear PDWG,
>> As you can see through the Lagos PPM minutes [1],  all  pending legal
>> concerns  have been addressed. Last suggestion  received abiut removing
>> categories in section 13.3.1( make the random selection applies to all
>> members)  was  accepted by working group and  will reflect  in the next
>> version  to come.
>>
>> While awaiting the new version, please send any new comments, suggestions
>> you may have on the proposal [2]
>>
>> [1]
>> https://afrinic.net/fr/library/policies/archive/ppm-minutes/2261-afrinic-27-pdwg-meeting-minutes
>> [2]
>> https://afrinic.net/fr/community/policy-development/policy-proposals/2231-internet-number-resources-review-by-afrinic
>>
>>
>> Please send the new version well ahead of the recommended CPM 3.4.2
>> deadline to allow reasonable time for staff's assessment of the updated
>> proposal.
>>
>> Regards,
>> Ernest.
>>
> _______________________________________________
> RPD mailing list
> RPD at afrinic.net
> https://lists.afrinic.net/mailman/listinfo/rpd
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.afrinic.net/pipermail/rpd/attachments/20190428/37b300e1/attachment-0001.html>