<div dir="ltr"><div><div>Hi Community, <br></div>Dear PDPWG, please find bellow The New Staff assessment concerning our Proposal on "Internet Number Resources Review by AFRINIC" and for your information the Old assessment follow the new one. Thanks<br><br></div><div>Regards<br><br></div><div>Arnaud<br></div><div><b><font size="4"><br></font></b></div><b><font size="4">New Assessment : </font></b><br>===============================================<br><h2 class="gmail-contentheading">Staff Assessment for : Internet Number Resources Review by AFRINIC<br></h2><div class="gmail-article-rel-wrapper"><h2 class="gmail-contentheading"> </h2>
</div>
<table style="width:100%" border="1">
<tbody>
<tr>
<td bgcolor="#999999"><strong>Proposal</strong></td>
<td bgcolor="#FFFFFF">
<p>AFPUB-2016-GEN-001-DRAFT-04</p>
</td>
</tr>
<tr>
<td bgcolor="#999999"><strong>Title</strong></td>
<td bgcolor="#FFFFFF">
<p> Internet Number Resources Review by AFRINIC</p>
</td>
</tr>
<tr>
<td bgcolor="#999999"><strong>URL</strong></td>
<td bgcolor="#FFFFFF">
<p><a href="https://afrinic.net/en/community/policy-development/policy-proposals/2073-internet-numberresources-review-by-afrinic">https://afrinic.net/en/community/policy-development/policy-proposals/2073-internet-numberresources-review-by-afrinic</a></p>
</td>
</tr>
<tr>
<td bgcolor="#999999"><strong>Assessed</strong></td>
<td bgcolor="#FFFFFF">
<p>26/April/2017</p>
</td>
</tr>
</tbody>
</table>
<p> </p>
<h3>1.0 Staff Understanding of the Proposal</h3>
<ul><li>AFRINIC to conduct resource utilization reviews (audits) of IPv4, IPv6 and ASN resources randomly, <span style="background-color:initial">periodically and/or triggered by a whistleblower to ensure compliance with policy provisions and all </span><span style="background-color:initial">terms of the AFRINIC RSA.</span></li><li>Non-Compliant resources to be recovered (and can be reallocated).</li><li>An arbitration team (whose decision is final) to be instituted (by AFRINIC) to handle any complaints by <span style="background-color:initial">members unsatisfied with the review/audit report.</span></li><li>A report of all review/audit activity conducted every year will be published on the website, contents of <span style="background-color:initial">which must comply with the Mauritius Data Protection Act as well as any NDA in place with any AFRINIC </span><span style="background-color:initial">member.</span> <br></li></ul>
<h3>2.0 Staff Comments</h3>
<ul><li>On Sec 13.6 - Our previous concerns that AFRINIC may be legally exposed regarding what member data <span style="background-color:initial">can be published in the annual "Compliance Report" seem to have been addressed by the inclusion of </span><span style="background-color:initial">"in accordance with Mauritius Data Protection Act and NDA with members." The act however, only </span><span style="background-color:initial">concerns personal information. The kind of information to include in the compliance report should </span><span style="background-color:initial">preferably be to the discretion of AFRINIC.</span></li><li>Authors to clarify on if the arbitration process can be initiated by the member anytime during or (only) <span style="background-color:initial">after the review is completed. There also needs to be a time limit around when the arbitration process </span><span style="background-color:initial">must complete (for the arbitration team to produce their findings/report).</span></li><li>On Staff Workload: All review requests shall be handled First in, First Out (at staff discretion) - in which <span style="background-color:initial">case, no significant impact to staff workload is expected.</span></li><li>On the clause: “The review shall be conducted in full transparency and neutrality”. Authors need to <span style="background-color:initial">expound more on what this means - as AFRINIC cannot disclose details of an ongoing audit/review to </span><span style="background-color:initial">the public while doing the review - if this is what authors meant by "transparency".</span></li><li>On the Clause: “AFRINIC shall publish the resources to be recovered for a period of three (3) months; <span style="background-color:initial">during which the organization may at any time, seek compliance” - AFRINIC will add “remarks” attributes </span><span style="background-color:initial">to the concerned whois database objects, with information regarding the ongoing review. We think that </span><span style="background-color:initial">this is sufficient to address the "publish" requirement in this clause.</span> <br></li></ul>
<h3>3.0 Comments from Legal Counsel</h3>
<p><strong>Legal Counsel’s Assessment</strong></p>
<p>1. In the implementation phase staff will have to deal with evidence emanating from several jurisdictions. <span style="background-color:initial">Moreover, staff will face the arduous task of assessing evidence/information/data from different </span><span style="background-color:initial">sources and of different evidential value. Staff will be burdened with testing the reliability of this </span><span style="background-color:initial">evidence/information/data to assess and weigh theses evidences and to decide whether same may be </span><span style="background-color:initial">used to establish abuse or wrongful use of Internet Number Resources.</span></p>
<p>The possibility of collecting evidence/information/data coming from different sources via affidavits or <span style="background-color:initial">depositions before Commissioner of Oath may have to be envisaged to partly ease pressure on staff.</span></p>
<p>AFRINIC will have to protect itself and act only on reliable, cogent and admissible evidence before finally <span style="background-color:initial">revoking allocation of resources which the investigated member claims has been prejudicial to it and </span><span style="background-color:initial">consequently claims for compensation. This possibility should always be envisaged. The increasing value </span><span style="background-color:initial">of IPv4 resources point in that way.</span></p><p>2. What modus operandi should be put into place to “hear” the investigated party to ensure fairness? The <span style="background-color:initial">policy proposal does not provide anything in this regard and should address it.</span></p><p>3. It will not always be possible to confront the investigated party with data/documents/evidence coming <span style="background-color:initial">from third parties who may have disclosed same in confidence and have expressly refused to be named </span><span style="background-color:initial">or referred to.</span></p><p>4. The arbitration referred to in the proposal has to be effected within the jurisdiction of one country – <span style="background-color:initial">and the main question is – which would this country be?</span></p><p>5. Section 13.5 of the proposal states: “the outcome of the arbitration process is unequivocal”. This is in <span style="background-color:initial">contradiction of, Articles 1027 to 1027-9 of the Code de Procedure Civile of Mauritius which provides </span><span style="background-color:initial">that a party to an arbitration may seek the “annulation “of an award by seizing the Supreme Court.</span></p><p>6. The "Mauritius Data Protection Act" only applies to personal information/data.</p>
<p><br></p><p><font size="4"><b>The Old One : </b></font><br></p><p>********************************************************************************************</p><p><a href="http://afrinic.net/en/community/policy-development/policy-proposals/1947-internet-number-resources-review-by-afrinic">http://afrinic.net/en/community/policy-development/policy-proposals/1947-internet-number-resources-review-by-afrinic</a> <br></p><h2 style="font-size:24px;line-height:24px;text-align:center"><em>Staff & Legal Assessment and Comments</em></h2>
<p><em><strong>Staff Comments</strong>:</em></p>
<ul><li><em>The proposal appears to be enabling AFRINIC to
“enforce” article 4(b) the Registration Services Agreement, a matter of
procedure and process.</em></li><li><em>We already have the ability to enforce the RSA, and the RSA already includes a requirement for policy compliance.</em></li><li><em>We already have the ability, in terms of the RSA,
to recover resources that are not being used for the purpose for which
they were allocated/assigned.</em></li><li><em>AFRINIC already reviews or audits members when
they request additional resources. We also have the ability to review at
other times, but we do not regularly exercise such ability.</em></li><li><em>We see no problem in principle with allowing complaints to trigger a review, but we are concerned about the details.</em></li><li><em>It's not clear who decides whether a complaint
"warrants investigation". We interpret this part of the proposal as
giving AFRINIC staff the discretion to decide which complaints to
investigate or not to investigate.</em></li><li><em>Each investigation will have large impact on
staff workload, and is also likely to have a large impact on the
organisation being investigated. We are especially concerned about the
impact of unjustified complaints.</em></li><li><em>AFRINIC staff workload may be greatly increased
by a large number of requests for review or audit. The requirement that
the complaint "warrants investigation" may mitigate this issue, if staff
have the ability to decide that certain complaints do not warrant
investigation, but staff resources will nevertheless be expended on
determining whether or not the complaint warrants investigation.</em></li><li><em>There is no policy requirement for visibility in
the global routing table. AFRINIC will have no contractual basis for
treating "lack of visibility of the resource on the global routing
table" as a problem under this policy. We suggest that this proposal
should focus on policy violations, and leave the issue of global routing
visibility to some other proposal that might be introduced in future.</em></li><li><em>There is a reference to "unauthorised transfers".
At present, all transfers (other than under mergers and acquisitions)
are unauthorised. Even under possible future transfer policy, any
"unauthorised transfer" would be in violation of such policy.
Accordingly, we suggest that there is no need to treat unauthorised
transfers differently from any other policy violation.</em></li><li><em>The requirement that "<span>the
records of the previous holder of the recovered resource shall be
removed from AFRINIC databases"is in conflict with current practice that
when a resource is returned or transferred, it remains possible to find
out information about the previous holder of the resource.</span></em></li><li><em>The requirement that the review be conducted with
"full transparency" may be in conflict with privacy provisions in NDAs,
in the RSA, or in law.</em></li><li><em>The requirement to publish a "compliance report" may be in conflict with privacy provisions in NDAs, in the RSA, or in law.<span><br></span></em></li><li><em>There is a requirement for AFRINIC to create and
document an appeal process, and appoint a pool of arbitrators. Creating
the process, including a public comment period and subsequent revisions,
would probably take 3 to 6 months. Calling for volunteers and
appointing them would probably take another 2 months.</em></li></ul>
<p><em><strong>Legal</strong>:</em></p>
<ul><li><em>TheRSAisacommunityapproveddocument and all
members are bound by each and every clause thereof once they sign the
agreement. It isacontractwherebothpartiessubscribetoclearobligations.</em></li><li><em>In application of the law of contract of
Mauritius as found in Article 1134 of the Mauritius Civil Code Section
4, the RSA is already binding,asaresult,onallmemberswhosigntheagreement.</em></li><li><em>It is perfectly lawful , in terms of the
application of the Mauritius Civil Code , for AFRINIC to act under the
said section and reclaim
resourcesfromthosememberswho/whichfailanaudit/reviewexercise.</em></li><li><em>The policy can do no more than allow AFRINIC to
do what it is already doing in a clear and transparent manner on the
basis of a community approveddocument</em></li></ul></div>