<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div>Tutu or whichever alias is used,</div><div id="AppleMailSignature"><br></div><div id="AppleMailSignature">You better have a look at icp2 that is where icann / iana defines the role of a rir.</div><div id="AppleMailSignature"><br></div><div id="AppleMailSignature">Some</div><div id="AppleMailSignature">Things are privileged information. Even we</div><div id="AppleMailSignature">As having been board members had no access to</div><div id="AppleMailSignature">Those information. It is attached within the bounds of the CEO and staff. </div><div id="AppleMailSignature"><br></div><div id="AppleMailSignature">Rules which you want to change are</div><div id="AppleMailSignature">Beyond ourselves. That is why a</div><div id="AppleMailSignature">Policy is being proposed.but a policy does not override what an rir has signed with icann on first place.</div><div id="AppleMailSignature"><br></div><div id="AppleMailSignature">People we need to be rational know our limits.</div><div id="AppleMailSignature">And bear in mind that RIPE act based on enough proof to carry out an audit. Not because is talking about a suspicion that can lead to legal</div><div id="AppleMailSignature">Implications. Be wary of that, I could also anonymously say that "seacom" are</div><div id="AppleMailSignature">Malicious using the resources or</div><div id="AppleMailSignature">Someone else as well. Where is the proof</div><div id="AppleMailSignature">That would pull The resources to do so. </div><div id="AppleMailSignature"><br></div><div id="AppleMailSignature">As nishal said there should. Be no</div><div id="AppleMailSignature">Exception at all. No one gets</div><div id="AppleMailSignature">Away but who will</div><div id="AppleMailSignature">Provide the money and resources to</div><div id="AppleMailSignature">Audit our 1500 Members. I also know of academia not respecting the sla should we</div><div id="AppleMailSignature">Take their resources away. Some</div><div id="AppleMailSignature">Are making some</div><div id="AppleMailSignature">Money with that and they are supposed to</div><div id="AppleMailSignature">So apart from</div><div id="AppleMailSignature">Research.</div><div id="AppleMailSignature"><br></div><div id="AppleMailSignature">Lets be very pragmatic and not with hunts from</div><div id="AppleMailSignature">A policy designed such ways.</div><div id="AppleMailSignature"><br>Kris</div><div><br>On 27 Jun 2017, at 20:10, Tutu Ngcaba <<a href="mailto:pan.afrikhan@gmail.com">pan.afrikhan@gmail.com</a>> wrote:<br><br></div><blockquote type="cite"><div><div dir="auto"><div><div data-smartmail="gmail_signature">On 27 Jun 2017 8:45 p.m., "Andrew Alston" <<a href="mailto:Andrew.Alston@liquidtelecom.com">Andrew.Alston@liquidtelecom.com</a>> wrote:<br></div><div class="gmail_extra"><div class="gmail_quote"><blockquote class="quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-GB" link="blue" vlink="purple">
<div class="m_-7863698519535272587WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Tutu,<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Sorry, but you honestly do not know what you are talking about here.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Firstly – there is information that can be disclosed to AfriNIC – and there is information contained in systems that will NEVER be disclosed – particularly
because AfriNIC does not have NDA’s with its members (and a few years ago, I tried to get one signed to provide them information they asked for – they refused – though that situation may have changed under the new management)<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Secondly – there is absolutely no way for AfriNIC to verify any information in an audit without substantial access to sensitive information – information
which AfriNIC can provide zero assurances is going to be safely kept and guarded – and that is access that no large commercial company will grant any RIR without seriously paperwork in place. And the agreement in the RSA about confidentiality – quite frankly
– doesn’t cut it – no way – no how.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Thirdly – I can put any information I like into a management system – would it be trusted? Where is the line – there is only one ground truth –
what is configured and running on the devices. When you are running a network of 20+ thousand potential IP enabled devices that are routing multiple blocks, are running tens of thousands of customers with static assignments, when the base routing tables
don’t tell even a fraction of the story because of space inside vrf’s, and sometimes even inside CinC VRF’s – to even COMPILE that information into a form that is sanitized enough that it could be given to an untrusted third party (which is what AfriNIC is
in this case) is time consuming, a massive drain on resource, and expensive.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">I have PERSONALY conducted proper deep IP audits in the past on three networks – NONE of them took less than a month to complete – and that was with
a lot of dedicated hard working resources that cost a fortune – and that is when the information is being compiled straight into secured system and does not need to be sanitized for consumption by an external party who cannot be held accountable should the
information disclosed by leaked.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">So sorry Tutu – you are just flat wrong here</span></p></div></div></blockquote></div></div></div><div dir="auto"><br></div><div dir="auto">Bra Andrew,</div><div dir="auto"><br></div><div dir="auto">so after reading you mean to said that you customer informations is private like ip address you gave them to connect to the internet. But why you will hide this ip address in confidentiality?</div><div dir="auto"><br></div><div dir="auto">Telkom or MTN they have so many million customers and am sure they can tell which customer used which ip address if police come to ask for example of abuse like in america they do. so it means the isp will always have this information and easy to give.</div><div dir="auto"><br></div><div dir="auto">also if it was this long one month you take to do audit in your past maybe the afrinic can take 4 months but the important is the review is done and completed. dont worry about the time bra.</div><div dir="auto"><br><span style="font-family:sans-serif">Best Regards,</span><br style="font-family:sans-serif"><span style="font-family:sans-serif">Tutu Ngcaba</span><br style="font-family:sans-serif"></div></div>
</div></blockquote><blockquote type="cite"><div><span>_______________________________________________</span><br><span>RPD mailing list</span><br><span><a href="mailto:RPD@afrinic.net">RPD@afrinic.net</a></span><br><span><a href="https://lists.afrinic.net/mailman/listinfo/rpd">https://lists.afrinic.net/mailman/listinfo/rpd</a></span><br></div></blockquote></body></html>