<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Title" content="">
<meta name="Keywords" content="">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Comic Sans MS";
panose-1:3 15 7 2 3 3 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman";}
p.gmail-m-7598441032701404597msolistparagraph, li.gmail-m-7598441032701404597msolistparagraph, div.gmail-m-7598441032701404597msolistparagraph
{mso-style-name:gmail-m_-7598441032701404597msolistparagraph;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman";}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:Calibri;
color:windowtext;}
span.msoIns
{mso-style-type:export-only;
mso-style-name:"";
text-decoration:underline;
color:teal;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:595.0pt 842.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body bgcolor="white" lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri">Serge,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri">Publishing that a company has been subject of audit is VERY CERTAINLY confidential information.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri">Secondly, if someone is requesting an audit against someone else – 100% there is an accuser – you do not request an audit of someone without in effect accusing them of something.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri">Thirdly, an individual can be a member of AfriNIC in their own right – it does not have to be a corporate entity, and this is a key distinction. The data protection act refers to living
individuals – the moment you publish anything that contains any information about a person without his consent you can run foul of that act. If I as an individual held space allocated to be my AfriNIC and they were to publish that they did an audit against
me, I would argue that they were in violation of that act, and it would be subject to litigation.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri">If you publish that you audited a company at all – that company has every right to recourse.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri">Again – I ask you WHY are you refusing to put in this policy that the person being audited gets to know the identity of the complainant so that if the accusation made that caused the audit
is frivolous the company being audited has recourse? If all allegations are substantiated and there is reason for the audit – that recourse will never come into play – however, if fallacious accusations are made to force audit to tie up company resources it
will. So, by putting it in there, you are merely ensuring that the intent of the policy is followed and anyone who abuses it pays for their actions. Why are you and your fellow authors point blank refusing to look at making the people who are requesting
audits accountable for their actions?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri">Furthermore – let me say this very clearly – any company that is subject to an audit may require an NDA for that audit to happen – if you’ve ever been under financial audit NDA’s are clearly
in place between companies and auditors, because by nature audits deal with sensitive information. If a company chose to demand an NDA – there would be zero grounds to refuse such and it would invalidate and conflict with section 3.6.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri">This policy is not workable – and until the above issues are addressed I honestly believe and am becoming more convinced by the moment that the true intent of this policy is not being stated
on this list. Give us the protections we ask to prevent this policy being abused and it may get less *<b>valid and sustained</b>* objections.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri">Andrew<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span style="font-family:Calibri;color:black">From: </span>
</b><span style="font-family:Calibri;color:black">serge ilunga <sergekbk@gmail.com><br>
<b>Date: </b>Thursday, 17 November 2016 at 17:30<br>
<b>To: </b>Andrew Alston <Andrew.Alston@liquidtelecom.com><br>
<b>Cc: </b>ALAIN AINA <aalain@nsrc.org>, AfriNIC List <rpd@afrinic.net><br>
<b>Subject: </b>Re: [rpd] [Community-Discuss] Update to Resources review policy proposal<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-size:11.0pt;font-family:Calibri">Andrew,<br>
<br>
First of all, once we agreed that the reviews of the allocations/assignments are mandatory in accordance to RSA and policies, it is our collective responsibility to make this policy proposal acceptable to all by proposing amendments.
<br>
The number resources reviews are based on compliance with RSA and policies. Why are these questions raised here and not on the RSA and the allocations policies themselves? I found it strange that all of these noises are coming from a board member whose
role is to make sure the organisation enforce its rules.<br>
<br>
Nevertheless, find below inline, few comments:</span><o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On Thu, Nov 17, 2016 at 3:24 AM, Andrew Alston <<a href="mailto:Andrew.Alston@liquidtelecom.com" target="_blank">Andrew.Alston@liquidtelecom.com</a>> wrote:<o:p></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-GB" style="font-size:11.0pt;font-family:Calibri">Ok, Fair point that anyone can request an audit against anyone – now, lets ask some very specific questions which
are again, valid concerns and objections that that in order to achieve the definition of consensus have to be addressed.</span><span lang="EN-GB"><o:p></o:p></span></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"> <span style="font-size:11.0pt;font-family:Calibri">++++++++++++++++++++<br>
<br>
Hmmm. There is no such “prosecutor”vs “accuser” here. AFRNIC allocate public ressources to members based on needs with members bound on reporting usage to AFRINIC all times.
<br>
Anyone who think that the ressources are not used as they should have been, can alert AFRINIC which if convinced, may initiative reviews. So it is always AFRINIC vs Members relationship.<br>
<br>
See the new 3.3.3 (b) which has been amended to address previous concerns from you.
<br>
<br>
=============<br>
3.3.3 Reported: Here, members are reviewed either because:<br>
<br>
a..They have requested the review themselves or<br>
b. There has been a community complaint made against them that warrants investigation. Complaints shall be backed by evidence and AFRINIC staff shall evaluate the facts as appropriate to conduct the review. However this review is not applicable to a member
with the same resources portfolio on which a full review has been completed in the preceding 24 months.<br>
<br>
+++++++++++++++++++++++++++</span><o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<div>
<div>
<p class="gmail-m-7598441032701404597msolistparagraph"><span lang="EN-GB" style="font-size:11.0pt;font-family:Calibri"><br>
<br>
a.)</span><span lang="EN-GB" style="font-size:7.0pt"> </span><span lang="EN-GB" style="font-size:11.0pt;font-family:Calibri">Why to the authors refuse to respond on the issue of allowing the entity to be audited know who requested the audit and under
what grounds. Why is there in effect prosecution without the chance to confront the accuser.</span><span lang="EN-GB"><o:p></o:p></span></p>
<p class="gmail-m-7598441032701404597msolistparagraph"><span lang="EN-GB" style="font-size:11.0pt;font-family:Calibri">b.)</span><span lang="EN-GB" style="font-size:7.0pt">
</span><span lang="EN-GB" style="font-size:11.0pt;font-family:Calibri">Why are the random choices limited to those categories, why should EVERY category not be subject to the same random picks – if you gonna apply it, let it apply globally</span><span lang="EN-GB"><o:p></o:p></span></p>
<p class="gmail-m-7598441032701404597msolistparagraph"><span lang="EN-GB" style="font-size:11.0pt;font-family:Calibri">c.)</span><span lang="EN-GB" style="font-size:7.0pt">
</span><span lang="EN-GB" style="font-size:11.0pt;font-family:Calibri">Why should AfriNIC publish the list of companies audited, especially if they are found to have clean audits - and not publish the name of the individual that requested the audit along with
it</span><span lang="EN-GB"><o:p></o:p></span></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri">+++++++++++++++++++++++++++<br>
<br>
Among concerns raised during previous discussions is the fact that reviews will impose additional burden on staff resulting in additional cost. It was just proposed to make the “random” reviews limited for these categories.
<br>
There are few of them, using large proposition of the ressources. They are 2 other classes (“selected” and “reported”) which allow review of all categories of members.<br>
<br>
But if you want to extend the “random” class to all categories, it is very easy: propose text to the section 3.3.1.
<br>
<br>
+++++++++++++++++++++++++++<br>
d.)</span><span style="font-size:7.0pt"> </span><span style="font-size:11.0pt;font-family:Calibri">Why should entities that request an audit not be subject to automatic audit themselves</span><o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<div>
<div>
<p class="gmail-m-7598441032701404597msolistparagraph"><span lang="EN-GB" style="font-size:11.0pt;font-family:Calibri">e.)</span><span lang="EN-GB" style="font-size:7.0pt">
</span><span lang="EN-GB" style="font-size:11.0pt;font-family:Calibri">In the event that resource is held by an individual in their own right please explain to me how this entire policy would not put AfriNIC in direct violation of clause 4.d of the RSA, considering
that any investigation into an individual could be classified as sensitive information under the Mauritian Data Protection act of 2004.</span><span lang="EN-GB"><o:p></o:p></span></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri">+++++++++++++<br>
<br>
Ressources held by individual on their “own right” ? <br>
<br>
All number ressources allocated are by “right to use” granted by AFRINIC to users under conditions and subject to review. AFRNIC through 4.d of the RSA is committed to comply with all applicable data protection and privacy laws of Mauritius. No problem
here… <br>
<br>
+++++++++<br>
<br>
</span><o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<div>
<div>
<p class="gmail-m-7598441032701404597msolistparagraph"><span lang="EN-GB" style="font-size:11.0pt;font-family:Calibri">f.)</span><span lang="EN-GB" style="font-size:7.0pt">
</span><span lang="EN-GB" style="font-size:11.0pt;font-family:Calibri">Please explain what would happen if an individual went through the routing tables, found 300 members that are not announcing space, and requested audits against all 300 of them simultaneously
– which under the auspicious of this policy would be an entirely valid thing to do – and where the resources in a company that has less 1/6h of that number in terms of staff is meant to accomplish this</span><span lang="EN-GB"><o:p></o:p></span></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri">+++++++++++++++++++++++++++<br>
<br>
Looking at the routing table to measure the status of the ressources should be done by AFRINIC routinely which may decide to act as per the class “selected”. But in all cases AFRINIC decides at its discretion who to review and when.<br>
<br>
+++++++++++++++++++++++++<br>
g.)</span><span style="font-size:7.0pt"> </span><span style="font-size:11.0pt;font-family:Calibri">Please explain to me why anyone requesting an audit, and the audit is found to be frivolous upon investigation should be bare the entire cost of the work
done – as is common in civil cases that are found to frivolous<br>
+++++ <br>
<br>
As said many times, it is up to AFRINIC after evaluation and analysis of the facts and evidences provided, to decide if a review should be conducted or not.<br>
<br>
++++++<br>
h.)</span><span style="font-size:7.0pt"> </span><span style="font-size:11.0pt;font-family:Calibri">Explain how AfriNIC is meant to deal with the situation where they may be under NDA with a particular organisation as a result of the fact that said organisation
has demanded such in order to submit application information</span><o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<div>
<div>
<p class="gmail-m-7598441032701404597msolistparagraph"><span lang="EN-GB" style="font-size:11.0pt;font-family:Calibri">i.)</span><span lang="EN-GB" style="font-size:7.0pt">
</span><span lang="EN-GB" style="font-size:11.0pt;font-family:Calibri">Please explain how AfriNIC is meant to comply with its own public statements that information about an application is held confidentially – since disclosure of the outcome of an audit to
have any meaning will mandate disclosing the original reason for request for IP space</span><span lang="EN-GB"><o:p></o:p></span></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri">+++++++++++++++++++++++++++++<br>
Section 3.6 reads:<br>
"3.6 Compliance Report<br>
AFRINIC shall publish an annual report describing the members which have been reviewed and their level of compliance."<br>
<br>
Publishing level of compliance involve no confidential information.<br>
++++++++++++++++++++++++++++++++++ <br>
</span><o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-GB" style="font-size:11.0pt;font-family:Calibri"> </span><span lang="EN-GB"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-GB" style="font-size:11.0pt;font-family:Calibri">Every single one of these points reflect lack of detail in this policy ad should be taken as a fundamental and valid
objection to this policy unless adequately answered, and the objections shall be sustained unless they are answered fully and addressed directly.</span><span lang="EN-GB"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-GB" style="font-size:11.0pt;font-family:Calibri"> </span><span lang="EN-GB"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-GB" style="font-size:11.0pt;font-family:Calibri">Andrew</span><span lang="EN-GB"><o:p></o:p></span></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Serge I. <o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-GB" style="font-size:11.0pt;font-family:Calibri"> </span><span lang="EN-GB"><o:p></o:p></span></p>
<div>
<div style="border:none;border-top:solid windowtext 1.0pt;padding:3.0pt 0cm 0cm 0cm;border-color:-moz-use-text-color -moz-use-text-color">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><span style="font-size:11.0pt;font-family:Calibri">From:</span></b><span style="font-size:11.0pt;font-family:Calibri"> ALAIN AINA [mailto:<a href="mailto:aalain@nsrc.org" target="_blank">aalain@nsrc.org</a>]
<br>
<b>Sent:</b> 16 November 2016 20:31<br>
<b>To:</b> AfriNIC List <<a href="mailto:rpd@afrinic.net" target="_blank">rpd@afrinic.net</a>></span><span lang="EN-GB"><o:p></o:p></span></p>
<div>
<div>
<p class="MsoNormal"><span lang="EN-GB"><br>
<b>Subject:</b> Re: [rpd] [Community-Discuss] Update to Resources review policy proposal<o:p></o:p></span></p>
</div>
</div>
</div>
</div>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-GB"> <o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-GB"> <o:p></o:p></span></p>
<div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-GB">On Nov 16, 2016, at 8:14 PM, Andrew Alston <<a href="mailto:Andrew.Alston@liquidtelecom.com" target="_blank">Andrew.Alston@liquidtelecom.com</a>> wrote:<o:p></o:p></span></p>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-GB"> <o:p></o:p></span></p>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-GB">I actually disagree with this stance Mark,<br>
<br>
I believe that if any member, irrespective of size, is subject to the policy, then policy should apply to ALL members.<br>
<br>
I see absolutely no reason that if someone can request an audit on a medium or large member, then by the same token, a member holding a /24 should be subject to the same conditions.<o:p></o:p></span></p>
</div>
</blockquote>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-GB"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-GB"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-GB">Please read the proposal again <a href="http://www.afrinic.net/en/community/policy-development/policy-proposals/1827-internet-number-resources-review-by-afrinic" target="_blank">http://www.afrinic.net/en/community/policy-development/policy-proposals/1827-internet-number-resources-review-by-afrinic</a><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-GB"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-GB">3.1 The reviews shall be based on compliance with the terms outlined in the RSA and Allocation/Assignment Policies.<o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-GB">3.2 The reviews cover all allocated/Assigned resources, but priority goes to IPv4 and ASN mappable to two-octet ASN.<o:p></o:p></span></p>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-GB">And the 3.3 defines classes which cover all.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-GB"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-GB">—Alain<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:12.0pt"><span lang="EN-GB"><o:p> </o:p></span></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:12.0pt"><span lang="EN-GB"><br>
I point out at that the vast majority of space that is allocated and not in the tables is held by members who are holding /24s, 23/s and /22s, that analysis was clear.<br>
<br>
Also, differentiating between end users and LIR's in this regard is also problematic. If you are going to make people subject to audit under a policy which is rife for witch hunts and abuse - then make EVERYONE subject to it. Anything else again, makes me
question the real motivations behind this policy. I have to wonder if this policy not in fact designed so that people can demand audits on specific companies and individuals that they not prepared to name on this, and that the real motivation behind this policy
is to give them grounds for a witch hunt rather than having anything to do with conservation or efficient use of resources.<br>
<br>
I have these thoughts based on the fact that up until now, no one has shown ANY substantial evidence of resources being used outside of policy, nor have I seen any willingness to put proper protections in place, nor have I seen pre-emptive moves by supports
of this policy to justify their usage publically when questioned, despite supporting a policy that if applied to them would mandate that AfriNIC makes public disclosure of the findings of investigations - but curiously enough - I then discover that those same
people are not subject to their own audit policy because of their membership category.<br>
<br>
I'm not saying anything dodgy is going on here for certain... but I will say that I am beginning to openly question the motivations for the policy and until proven wrong by the authors through proper substantiated evidence, those doubts will linger in my mind,
and every member of this list looking at policies like this, should take a long hard introspective look and ensure they understand the true motivations behind the document.<br>
<br>
Andrew<br>
<br>
<br>
-----Original Message-----<br>
From: Mark Elkins [<a href="mailto:mje@posix.co.za" target="_blank">mailto:mje@posix.co.za</a>]
<br>
Sent: 16 November 2016 18:40<br>
To: rpd >> AfriNIC Resource Policy <<a href="mailto:rpd@afrinic.net" target="_blank">rpd@afrinic.net</a>><br>
Subject: Re: [rpd] [Community-Discuss] Update to Resources review policy proposal<br>
<br>
What was the motive for this policy?<br>
<br>
+------------------------<br>
| stockpiling and non-efficient use<br>
+------------------------<br>
<br>
What did it go out to fix in the first place?<br>
<br>
A thought in the back of my head is this would be used to mainly audit people with lots of space?<br>
<br>
+--------------------------------<br>
| 3.3 Classes of review: Members to be reviewed shall be selected <br>
| according to the following classes:<br>
|<br>
| 3.3.1 Random: The member is chosen by AFRINIC at random between <br>
| members of the following categories:<br>
|<br>
| Medium and above<br>
| IPv6-only Large<br>
| EU-AS<br>
+--------------------------------<br>
<br>
So we ignore smallish LIR's<br>
but not smallish EU's<br>
I think less than medium EU's should also be ignored.<br>
Do we really need to include IPv6 today?<br>
<br>
<br>
+--------------------------------<br>
| 3.3.2 Selected:<br>
|<br>
| A member is selected because of an internal report or due to a lack of <br>
| contact between the AFRINIC and the member.<br>
|<br>
| 3.3.3 Reported: Here, members are reviewed either because:<br>
|<br>
| They have requested the review themselves or There has been a <br>
| community complaint made against them<br>
| that warrants investigation.<br>
+-------------------------------<br>
<br>
If people report "out of business" businesses with IP Resources, no problem.<br>
<br>
However, it appears that anyone (including a non-member) can call for a review of a large member. Still sounds like an excuse for a witch hunt.<br>
This needs to be much better worded control.<br>
<br>
1 - Only Members (preferably in "Good Standing") can file a report.<br>
<br>
2 - They can only do so if they are within 50% of the size (in contested address space) of the Member they are calling out. Perhaps a "Group Action" can be established to achieve this requirement.<br>
<br>
3 - They can expect to be audited themselves - especially if the requested audit comes out clean.<br>
<br>
4 - On the other hand, the AFRINIC Board can always call for an Audit (I trust them).<br>
<br>
<br>
<br>
Anyway, where do I find the complete current Draft? I've been looking at:-<br>
<br>
<a href="http://afrinic.net/en/community/policy-development/policy-proposals/1827-internet-number-resources-review-by-afrinic" target="_blank">http://afrinic.net/en/community/policy-development/policy-proposals/1827-internet-number-resources-review-by-afrinic</a><br>
<br>
<br>
<br>
On 16/11/2016 12:43, Andrew Alston wrote:<o:p></o:p></span></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:12.0pt"><span lang="EN-GB">So,<br>
<br>
<br>
<br>
I have a hypothetical question – and it will become a lot less <br>
hypothetical once I’ve run the numbers which I’m currently doing.<br>
<br>
<br>
<br>
Let’s say we implement this audit policy – and then – because we have <br>
to act consistently – we act against every member who is not <br>
announcing space because they cannot justify not announcing it – and <br>
we terminate their membership.<br>
<br>
<br>
<br>
Are the authors of this policy and those supporting it prepared to <br>
bear the cost of the fee increases that would be necessary to back <br>
fill the loss in revenue that would effectively bankrupt AfriNIC? <br>
Running through the preliminary statistics – firstly the auditing <br>
process would be immensely expensive in HR cost – secondly – <br>
termination of members that aren’t “legitimately” announcing space by <br>
rough calculations could cost AfriNIC in excess of 15% of its revenue <br>
by the latest numbers available in the financial reports and <br>
correlating the unannounced space that is allocated with the billing file.<br>
<br>
<br>
<br>
Now, some would argue that is all the more reason to implement the <br>
audit policy – but here is a wake up call – the space you would <br>
recover in that call on those calculations – amounts to less than 10% <br>
of space that AfriNIC has allocated legitimately since May – so <br>
effectively, for the gain of looking tough and being rigid, we may end <br>
up bankrupting the organisation while recovering potentially a /15 worth of space.<br>
Alternatively, from any logical business perspective – that money <br>
would have to be recovered from the members who are legitimately <br>
announcing space – because it certainly can’t just disappear.<br>
<br>
<br>
<br>
So, has anyone ACTUALLY thought through the implications of this <br>
policy? I remain firmly opposed.<br>
<br>
<br>
<br>
Andrew<br>
<br>
<br>
<br>
<br>
<br>
*From:*Dewole Ajao [<a href="mailto:dewole@forum.org.ng" target="_blank">mailto:dewole@forum.org.ng</a>]<br>
*Sent:* 16 November 2016 12:52<br>
*To:* sergekbk <<a href="mailto:sergekbk@gmail.com" target="_blank">sergekbk@gmail.com</a>>; Arnaud AMELINA
<br>
<<a href="mailto:amelnaud@gmail.com" target="_blank">amelnaud@gmail.com</a>>; rpd >> AfriNIC Resource Policy
<br>
<<a href="mailto:rpd@afrinic.net" target="_blank">rpd@afrinic.net</a>>; General Discussions of AFRINIC
<br>
<<a href="mailto:community-discuss@afrinic.net" target="_blank">community-discuss@afrinic.net</a>><br>
*Subject:* Re: [Community-Discuss] Update to Resources review policy <br>
proposal<br>
<br>
<br>
<br>
I think all policies (if we really intend to implement them) must be <br>
clear and leave no room for variable interpretation as ambiguity will <br>
put additional burdens of interpretation on staff.<br>
<br>
If the community's preference is for the 24-month window to become <br>
invalid on allocation/assignment of new resources, then the policy<br>
(proposal) should state it clearly; If on the other hand, the <br>
intention is for the 24-month window to stay in place come-what-may, <br>
it's better for the policy (proposal) to be explicit about it.<br>
<br>
Please see below, additional questions for the community to consider.<br>
Hopefully, they can be discussed and the authors can (if they so<br>
choose,) take the inputs from the community into their modified proposal.<br>
<br>
3.3.2 Selected:<br>
<br>
<br>
A member is selected because of an internal report or due to a lack of <br>
contact between the AFRINIC and the member.<br>
<br>
Q1. Do we presently have an existing (effective) structure (apart from<br>
billing) that measures degree of contact with members?<br>
If there is no agreed means of measuring the degree contact, we need <br>
to define degrees of contact so that "lack of contact" (as referred to <br>
in the proposal) can be measured objectively.<br>
<br>
/Perhaps as a first step for ensuring regular contact without using up <br>
too many resources, this proposal might want to borrow a leaf from <br>
RIPE's Assisted Registry Check (ARC). See <br>
<a href="https://www.ripe.net/manage-ips-and-asns/resource-management/assisted-" target="_blank">https://www.ripe.net/manage-ips-and-asns/resource-management/assisted-</a><br>
registry-check/<br>
<br>
/Basically, the RIR does a consistency check on members' Registry, <br>
Resource, and Route/rDNS information and then sends emails to the <br>
contacts on file showing their view. They then schedule a telephone <br>
call to work with the member and fix any identified issues. /<br>
<br>
/My understanding from RIPE is that these non-invasive checks <br>
sometimes reveal issues that may warrant more detailed investigation. <br>
The primary model is by random checks but done in a manner that checks <br>
every member at least once in 3 years (given the size of RIPE). They <br>
also have ARCs that are initiated as a result of information received <br>
from the member or third parties. /<br>
<br>
Q2. Can reachability/cooperation of a member for such a consistency <br>
check-and-fix activity as described above be used to measure the <br>
degree of contact?<br>
<br>
Q3. Given the fact that time taken for consistency checks are more <br>
predictable, can these be implemented as a preliminary step in <br>
addressing the "lack of investigation" problem as well as the concern <br>
about taking up much of members' and/or AFRINIC hostmasters' time?<br>
<br>
Regards,<br>
Dewole.<br>
(with apologies for continuing the cross-posting between RPD and<br>
Community-discuss)<br>
<br>
On 15/11/2016 20:18, sergekbk wrote:<br>
<br>
Hello Dewole,<br>
<br>
<br>
Thanks for this comment.<br>
The limit of 24 months applies to a member based on ressources <br>
portfolio. If the portfolio changes with new allocation, member<br>
can be audited anytime on the new ressources if required.<br>
<br>
Is this clear enough or shall we make it explicit ?<br>
<br>
Kind Regards.<br>
<br>
<br>
<br>
*/Serge Ilunga/*<br>
<br>
*/Cell: <a href="tel:%2B243814443160" target="_blank">+243814443160</a>/*<br>
<br>
*/Skype: sergekbk/*<br>
<br>
*/R.D.Congo/*<br>
<br>
-------- Original message --------<br>
<br>
From: Dewole Ajao <<a href="mailto:dewole@tinitop.com" target="_blank">dewole@tinitop.com</a>> <<a href="mailto:dewole@tinitop.com" target="_blank">mailto:dewole@tinitop.com</a>><br>
<br>
Date: 11/15/2016 11:38 (GMT+01:00)<br>
<br>
To: Arnaud AMELINA <<a href="mailto:amelnaud@gmail.com" target="_blank">amelnaud@gmail.com</a>> <<a href="mailto:amelnaud@gmail.com" target="_blank">mailto:amelnaud@gmail.com</a>>,<br>
"rpd >> AfriNIC Resource Policy" <<a href="mailto:rpd@afrinic.net" target="_blank">rpd@afrinic.net</a>><br>
<<a href="mailto:rpd@afrinic.net" target="_blank">mailto:rpd@afrinic.net</a>>, General Discussions of AFRINIC<br>
<<a href="mailto:community-discuss@afrinic.net" target="_blank">community-discuss@afrinic.net</a>>
<br>
<<a href="mailto:community-discuss@afrinic.net" target="_blank">mailto:community-discuss@afrinic.net</a>><br>
<br>
Subject: Re: [Community-Discuss] Update to Resources review policy<br>
proposal<br>
<br>
<br>
<br>
Thanks for working to apply the community's input to your proposal,<br>
Arnaud.<br>
<br>
To test the proposed re-wording, consider the following sequence of<br>
events:<br>
<br>
Member XYZ initiates self-requested review;<br>
Review is completed by AFRINIC in X weeks;<br>
After review, Member XYZ applies for "large chunk" of number resources;<br>
Member XYZ receives "large chunk" of number resources in say 60 days;<br>
Member XYZ happens to make some unacceptable use of (previous or<br>
new) number resources and it somehow becomes known to the community;<br>
Regardless of convincing evidence, Member XYZ cannot be subjected to<br>
a review until 24 months have elapsed since the last review.<br>
<br>
Is this a design feature or a bug?<br>
<br>
Regards,<br>
<br>
Dewole.<br>
<br>
<br>
<br>
On 15/11/2016 10:48, Arnaud AMELINA wrote:<br>
<br>
Hi community !<br>
Following, recent discussions and in accordance with text<br>
proposal from Owen and others contributors, authors propose this<br>
as replacement to the section 3.3.3<br>
<br>
-'---old version---''<br>
<br>
3.3.3 Reported: Here, members are reviewed either because:<br>
<br>
a. They have requested the review themselves or<br>
b. There has been a community complaint made against them that<br>
warrants investigation.<br>
<br>
----new version-----<br>
<br>
3.3.3 Reported: Here, members are reviewed either because:<br>
<br>
a..They have requested the review themselves or<br>
b. There has been a community complaint made against them that<br>
warrants investigation. Complaints shall be backed by evidence<br>
and AFRINIC staff shall evaluate the facts as appropriate to<br>
conduct the review. However this review is not applicable to a<br>
member on which a full review has been completed in the<br>
preceding 24 months.<br>
<br>
Regards.<br>
<br>
Arnaud.<br>
<br>
<br>
<br>
<br>
_______________________________________________<br>
<br>
Community-Discuss mailing list<br>
<br>
<a href="mailto:Community-Discuss@afrinic.net" target="_blank">Community-Discuss@afrinic.net</a>
<br>
<<a href="mailto:Community-Discuss@afrinic.net" target="_blank">mailto:Community-Discuss@afrinic.net</a>><br>
<br>
<a href="https://lists.afrinic.net/mailman/listinfo/community-discuss" target="_blank">https://lists.afrinic.net/mailman/listinfo/community-discuss</a><br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
_______________________________________________<br>
RPD mailing list<br>
<a href="mailto:RPD@afrinic.net" target="_blank">RPD@afrinic.net</a><br>
<a href="https://lists.afrinic.net/mailman/listinfo/rpd" target="_blank">https://lists.afrinic.net/mailman/listinfo/rpd</a><o:p></o:p></span></p>
</blockquote>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-GB"><br>
--<br>
Mark James ELKINS - Posix Systems - (South) Africa<br>
<a href="mailto:mje@posix.co.za" target="_blank">mje@posix.co.za</a> Tel: <a href="tel:%2B27.128070590" target="_blank">
+27.128070590</a> Cell: <a href="tel:%2B27.826010496" target="_blank">+27.826010496</a><br>
For fast, reliable, low cost Internet in ZA: <a href="https://ftth.posix.co.za" target="_blank">
https://ftth.posix.co.za</a><br>
<br>
_______________________________________________<br>
RPD mailing list<br>
<a href="mailto:RPD@afrinic.net" target="_blank">RPD@afrinic.net</a><br>
<a href="https://lists.afrinic.net/mailman/listinfo/rpd" target="_blank">https://lists.afrinic.net/mailman/listinfo/rpd</a><o:p></o:p></span></p>
</div>
</blockquote>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-GB"> <o:p></o:p></span></p>
</div>
</div>
</div>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
_______________________________________________<br>
RPD mailing list<br>
<a href="mailto:RPD@afrinic.net">RPD@afrinic.net</a><br>
<a href="https://lists.afrinic.net/mailman/listinfo/rpd" target="_blank">https://lists.afrinic.net/mailman/listinfo/rpd</a><o:p></o:p></p>
</blockquote>
</div>
<p class="MsoNormal"><br>
<br clear="all">
<br>
-- <o:p></o:p></p>
<div>
<div>
<p class="MsoNormal" align="center" style="text-align:center"><b><span style="font-family:"Comic Sans MS";color:blue;background:#EEEEEE">Serge ILUNGA KABWIKA</span></b><o:p></o:p></p>
<p class="MsoNormal" align="center" style="text-align:center"><b><span style="font-family:"Comic Sans MS";color:blue;background:#EEEEEE">Skype: sergekbk</span></b><span style="color:blue;background:#EEEEEE"><br>
</span><b><span style="font-family:"Comic Sans MS";color:blue;background:#EEEEEE">Cell: +243814443160</span></b><o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
</body>
</html>