[rpd] Policy Development Process and Elections

[Ronald F. Guilmette]

In message <AF256225-1FBC-4494-9523-92DD1D757749 at consulintel.es>, 
JORDI PALET MARTINEZ <jordi.palet at consulintel.es> wrote:


>Hi Ronald,

>

>While I fully agree that it is suspicious and it doesn't look good if you want your inputs to the PDP to be seriously considered, to not have a corporate account and your real name, or introduce yourself, etc., nothing in the PDP of any RIR prevent from participate.


I have no problem with people participating.  I had gathered however that
there was an issue currently being discussed with respect to -voting-.


>It is even much more suspicious in this list, when we have already previous cases of people impersonating others ... that definitively set a very bad background, unfortunately, and even worse than that, the board decided not to make a legal claim so google is forced to identify the real persona behind that email so we could take, for example, a decision to suspend the real person posting rights or whatever.


I was not aware of this.  Anyway, I can only say that I support the board
in this instance.  Legal actions can be quite costly, and I do believe
there are other and much more worthy things that the money could be spent
on.

More to the point however... and I hope that someone will correct me if
I have misunderstood... it seems that the real issue is "sock puppets"
infiltrating the mailing lists AND then asking to vote, or being allowed
to vote. 

This problem, which appears to be a real one, needs to be solved in some
comprehensive and long lasting way that does not require the initiation,
by AFRINIC, of a huge plethora of legal actions.

It is my firm believe that there are numerous different technical strategies
that could be called upon for effectively combatting this sort of thing,
ranging from the gentle to the draconian, and I would be happy to discuss
the available options to the extent that people on this list sincerely
care about this "sock puppet" issue.  It is certainly the case that AFRINIC
is by no means alone in being faced with this unique but widespread problem
of the online world, and many other companies and organizations have found
inventive and effective ways to thwart the sock puppets, and these existing
technical stratgies stand as working examples and real-world lessons,
showing us what can be done if there is a sincere desire to address the
problem.


>By the way, I don't have resources in any RIR, so from your perspective I will not be allowed to participate?


I am also in your exact same situation!

Of course my feeling is that you and I should be able to "participate".

When it comes to -voting- however, I am of two minds on this question.

On the one hand, I like to think that both you and I are capable of making
positive contributions, both to mailing list discussions and also to the
outcome of various votes.  On the other hand however, I, at least, am not
a "member" per se, of AFRINIC.  I pay no dues or fees to the orgainzation,
and thus, arguably, I have no real stake in the outcome of deliberations.
I do not have, as we say here, "skin in the game".

That having been said, I certainly DO NOT believe that it is even necessary
to make -any- choice that deviates from current practice when it comes to
the question of allowing voting by non-members.  This is NOT the issue (and
perhaps I should not have even brought it up).  The issue is sock puppets
and their elimination from the voting pool.  This can be done, and, I would
argue, MUST be done in order to maintain the fairness of the voting process.
(And I hope that this much, at least, is self evident.)

Neither you nor I are sock puppets, and thus, the careful technical
elimination of sock puppets, if done properly, should have no effect
whatsoever on either you or I, or for that matter on any other actual
and legitimate independently-acting homo sapien.


>That's said, I also feel very uncomfortable not knowing who I'm speaking to, but not because the process doesn't allow it, but because I think as humans, we prefer to know the "face" of the people (that's why it is important to participate in meetings), and more important, we can better understand the other people positions if we know what is their work and background, etc.


My own concern goes well beyond mere discomfort.

As you and others on this list should surely know, there has been quite
a lot of hanky panky of late, by certain Bad Actors, trying to inject
themselves into the structures and/or processes of global Internet
governance.  The recent unusual increase in AFRINIC mailing list signups
certainly suggests the very real possibility that these signup are a part
of a very deliberate effort to seize some measure of power via unscruplous
means.  This cannot be allowed to stand.

As noted above, there are many practical and effective counter-measures
that could be deployed, right now, to counter this sort of thing.  I will
be more than happy to go into more detail, however I think that anyone
who researches the topic, and looks into how reality is already routinely
being separated from fiction, e.g. on the web sites of, and in the sign-up
processes of various cryptocurrency exchanges, will quickly see that
there are a lot of possibilities, ranging from simple CAPTCHAs on up
through quite invasive identification/verification methods.

One thing I can say, quite definitively, is that a simple banning, from
voting, of any account that has been active for less than 6 months feels
like a rather eentirely ham-fisted approach to the problem, and one that
quite certainly will not stand the test of time.  This is merely "security
by kicking the can own the road".  There has to be a better way.


Regards,
rfg