<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On Apr 28, 2019, at 14:54 , Arnaud AMELINA <<a href="mailto:amelnaud@gmail.com" class="">amelnaud@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class=""><div dir="ltr" class=""><div dir="auto" class="">Owen,</div><div dir="auto" class=""><br class=""></div><div dir="auto" class="">The "This policy is not needed", "but if you want it, address A,B,C " game continues. See inline</div></div></div></div></blockquote><div><br class=""></div>This policy is not needed. Someone asked me to specifically identify changes that would render it less harmful. I did so in an attempt to be cooperative.</div><div><br class=""></div><div>I’d much prefer to abandon the proposal and end the game, but the authors seem determined to inflict something else on the community, so, as long as they force the community to have this albatross weighing down the policy development process, I will continue to work within the policy process to render it harmless (in case it somehow gains consensus despite such objection) and will continue to encourage its withdrawal.</div><div><br class=""><blockquote type="cite" class=""><div class=""><div dir="ltr" class=""><br class=""><div class="gmail_quote"><div dir="ltr" class="gmail_attr">Le dim. 7 avr. 2019 à 17:53, Owen DeLong <<a href="mailto:owen@delong.com" target="_blank" class="">owen@delong.com</a>> a écrit :<br class=""></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class="">This change is trivial and does not address the vast majority of issues raised with the previous version of the proposal.</div></blockquote><div class=""> </div><div class="">This new change addresses a new issue raised and agreed during the last
meeting. Not all objections raised are adopted and lead to change to
proposals. <br class=""></div></div></div></div></blockquote><div><br class=""></div>Sure, but until all of the objections raised are addressed with something beyond “we don’t care”, those objections can be sustained and will continue to block any legitimate declaration of consensus for the proposal.</div><div><br class=""><blockquote type="cite" class=""><div class=""><div dir="ltr" class=""><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class=""><div class="">I hereby request that if the authors will not allow this proposal to expire as it should, that they at least provide a substantive update which addresses the majority of the issues raised to date:</div></div></blockquote><div class=""><br class=""></div><div class=""><div dir="auto" class="">You seem to be expecting the expiration of the proposal
and did not speak up when authors asked several times for comments and
suggestions after Hammamet.</div><div dir="auto" class="">So, why waste valuable
time in responding to the points below? People change their mind. You
opposed after you supported. You may change again. Here you go.</div></div></div></div></div></blockquote><div><br class=""></div>Actually NONE of the objections I’ve raised recently are new. I’ve raised them repeatedly on prior versions of the proposal, so you really can’t claim that I failed to speak up in a timely manner. The fact that the authors have continued to ignore those issues doesn’t change the fact that I raised them some time ago.</div><div><br class=""></div><div>I never supported most of the provisions in the current proposal. IIRC, I said that I would not strenuously object to the idea of a resource review when it was a much less onerous proposal with little potential for harm and some additional clarity to the process.</div><div><br class=""></div><div>The current form of the proposal is more vague than the RSA and has great potential for harm that has been added since the last time I stated anything short of opposition to the proposal.</div><div> <br class=""><blockquote type="cite" class=""><div dir="ltr" class=""><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class=""><div class=""><span class="m_962685655339986626m_3229832248786967562gmail-m_-2740474882150224374Apple-tab-span" style="white-space:pre-wrap"> </span>+<span class="m_962685655339986626m_3229832248786967562gmail-m_-2740474882150224374Apple-tab-span" style="white-space:pre-wrap"> </span>Potential for abuse of the complaint process as a DOS attack on large organizations</div></div></blockquote><div class=""><br class=""></div><div class=""><div dir="auto" class="">This was discussed intensively and remains at the stage of potentiality not proven. <br class=""></div></div></div></div></blockquote><div><br class=""></div>Huh? How can one prove the behavior of a policy that has not been adopted?</div><div><br class=""></div><div>However, with a very small amount of imagination and some basic mathematics, it’s pretty easy to understand the DOS vectors in this proposal…</div><div><br class=""></div><div>1.<span class="Apple-tab-span" style="white-space:pre"> </span>There’s no limit to the number of concurrent investigations AfriNIC can be forced to open against a company based on</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>specious complaints.</div><div><br class=""></div><div>2.<span class="Apple-tab-span" style="white-space:pre"> </span>There’s no protection in the current proposal against specious complaints and AfriNIC staff is not given discretion to reject</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>them. All staff is empowered to do is insist that the complaint be signed and in writing. After that, the policy requires them</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>to fully investigate the complaint with all the overhead that implies for the organization being investigated.</div><div><br class=""></div><div>3.<span class="Apple-tab-span" style="white-space:pre"> </span>Since there’s no provision in the proposal for consolidating complaints or investigations, repetitive complaints against the</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>same organization in rapid succession have the potential to be tremendously disruptive both to the organization in question</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>and to AfriNIC.</div><div><br class=""></div><div>4.<span class="Apple-tab-span" style="white-space:pre"> </span>This is disproportionately impactful to larger organizations because the overhead of dealing with each such investigation</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>grows somewhat exponentially with the size of the organization.</div><div> <br class=""><blockquote type="cite" class=""><div dir="ltr" class=""><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class=""><div class=""><span class="m_962685655339986626m_3229832248786967562gmail-m_-2740474882150224374Apple-tab-span" style="white-space:pre-wrap"> </span>+<span class="m_962685655339986626m_3229832248786967562gmail-m_-2740474882150224374Apple-tab-span" style="white-space:pre-wrap"> </span>The proposal is unnecessary as the useful portions are already enshrined in existing policy</div><div class=""><span class="m_962685655339986626m_3229832248786967562gmail-m_-2740474882150224374Apple-tab-span" style="white-space:pre-wrap"> </span>and the RSA.</div></div></blockquote><div class=""><br class=""></div><div class=""><div dir="auto" class="">Hummmm ! Can you please point to these documents and sections ?</div></div></div></div></blockquote><div><br class=""></div>I’ve already pointed to the documents… They are the consolidated policy manual and the registration services agreement.</div><div><br class=""></div><div>The policy manual provides several provisions about how number resources are allocated and to be used within the AfriNIC</div><div>region. These are distributed throughout the policy manual.</div><div><br class=""></div><div>The ability for AfriNIC to verify compliance and to rescind resources in a case of fraudulent representations or other violations</div><div>of AfriNIC policy by the resource holder is enshrined in the RSA. Unfortunately, I’m having trouble finding the RSA on the</div><div>AfriNIC web site. Searches for RSA and Registration Services Agreement do not turn up the actual RSA for reasons passing</div><div>understanding (perhaps someone from staff will be kind enough to fix this).</div><div><br class=""></div><div>I did finally find it following some links related to becoming a resource member here:</div><div><a href="https://afrinic.net/membership/agreements#rsa" class="">https://afrinic.net/membership/agreements#rsa</a></div><div><br class=""></div><div>Relevant sections are:</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>1.(a).(v)</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>1.(b)</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>1.(c)</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>2.(b)</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>2.(d)</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>2.(e)</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>2.(f)</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>2.(g)</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>3. in its entirety</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>4.(b)</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>4.(c)</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>6.(a)</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>6.(b)</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>6.(c)</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>6.(d)</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>7 in its entirety</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>11.(d).(iii) et. seq.</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>11.(e)</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>13 in its entirety</div><div><br class=""></div><div><br class=""></div><div>Of those, the most important and most directly related sections are:</div><div><br class=""></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>1.(b) (the power of AfriNIC to amend policies)</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>2.(b) (accurate information required in application)</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>2.(d) (requirement to keep supplied information current)</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>2.(f) (requirement to provide relevant information online)</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>2.(g) (requirement to maintain accurate contact information on file)</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>3.(a) (applicant accepts subjugation to AfriNIC policies)</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>3.(b) (applicant accepts subjugation to AfriNIC internal business process and policies)</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>4.(b) (applicants obligation to cooperate)</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Specifically 4.(b).(ii) Applicants obligation to cooperate with AfriNIC investigation reviewing applicant’s utilization. (mis-spelled in the RSA as utiliSation, btw)</div><div><span class="Apple-tab-span" style="white-space:pre"> </span> 4.(c).(i) and (ii) (commitment to use services sold for purpose requested and commitment to full and unreserved compliance with policies, respectively)</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>4.(c).(iii) AfriNIC’s right to investigate or cause to be investigated the applicant’s use of services by appropriate and competent authority(ies).</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>— In this context, I believe AfriNIC itself constitutes an appropriate and competent authority.</div><div><br class=""></div><div>There’s nothing useful in this policy that isn’t already provided for in the above referenced sections of the RSA and the existing number resource policies.</div><div><br class=""></div><div><br class=""><blockquote type="cite" class=""><div dir="ltr" class=""><div class="gmail_quote"><div class=""> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class=""><div class=""><span class="m_962685655339986626m_3229832248786967562gmail-m_-2740474882150224374Apple-tab-span" style="white-space:pre-wrap"> </span>+<span class="m_962685655339986626m_3229832248786967562gmail-m_-2740474882150224374Apple-tab-span" style="white-space:pre-wrap"> </span>Please also address the grammatical errors (e.g. “within the four weeks.”)</div></div></blockquote><div class=""><br class=""></div><div class=""><div dir="auto" class="">Oh for sure... Will be fixed. Thanks for pointing this out.</div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class=""><div class=""><span class="m_962685655339986626m_3229832248786967562gmail-m_-2740474882150224374Apple-tab-span" style="white-space:pre-wrap"> </span>+<span class="m_962685655339986626m_3229832248786967562gmail-m_-2740474882150224374Apple-tab-span" style="white-space:pre-wrap"> </span>The term “annual meaningful report” is not defined. Specifically, what constitutes “meaningful” in this context</div><div class=""><span class="m_962685655339986626m_3229832248786967562gmail-m_-2740474882150224374Apple-tab-span" style="white-space:pre-wrap"> </span>and, absent a clear definition, how is this decided by whom?</div></div></blockquote><div class=""><br class=""></div><div class="">This is left to staff to decide. This point was also discussed
intensively and have evolved from the original proposal to the current
text:</div></div></div></blockquote><div><br class=""></div>It needs to evolve further before it is useful policy language.<br class=""><blockquote type="cite" class=""><div dir="ltr" class=""><div class="gmail_quote"><div class=""><div dir="auto" class=""><br class=""></div><div dir="auto" class="">--- initial text---</div><div dir="auto" class="">3.6 Compliance Report</div><div dir="auto" class="">AFRINIC shall publish an annual report describing the members which have been reviewed and their level of compliance.</div><div dir="auto" class=""><br class=""></div><div dir="auto" class="">--- 1st amendment---</div><div dir="auto" class="">13.6 Compliance Report</div><div dir="auto" class=""><br class=""></div><div dir="auto" class="">AFRINIC
shall publish an annual report describing review activities, in
accordance with Mauritius Data Protection Act and NDA with members.</div><div dir="auto" class=""><br class=""></div><div dir="auto" class="">---Current text---</div><div dir="auto" class="">13.6 Compliance Report</div><div dir="auto" class="">AFRINIC
shall publish an annual meaningful report describing review activities,
in accordance with all applicable laws and regulations.</div><div dir="auto" class="">----</div><div dir="auto" class=""><br class=""></div><div dir="auto" class="">As you can see the consensus was to allow Staff to publish a comprehensive report which obey the laws and regulations.</div></div></div></div></blockquote><div><br class=""></div>Nope… There is no consensus. As I can see, the language has changed over time and the last attempt at consensus</div><div>was based on what you say above.</div><div><br class=""></div><div>The word meaningful here is a no-op at best. It has not definition and therefore no effect.</div><div><br class=""></div><div>Even if one wishes to retain it, the wording is awkward and should be changed to:</div><div><br class=""></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>AfriNIC shall publish a meaningful annual report describing review activities. This requirement does not request or</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>extend authority to publish protected or private data or data which would otherwise be unlawful to publish.</div><div><br class=""></div><div>Even then, the word meaningful should simply be defined or deleted.</div><div><br class=""><blockquote type="cite" class=""><div dir="ltr" class=""><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class=""><div class=""><span class="m_962685655339986626m_3229832248786967562gmail-m_-2740474882150224374Apple-tab-span" style="white-space:pre-wrap"> </span>+<span class="m_962685655339986626m_3229832248786967562gmail-m_-2740474882150224374Apple-tab-span" style="white-space:pre-wrap"> </span>There is no provision for satisfactory outcome without a complete review by AfriNIC staff, even if it is</div><div class=""><span class="m_962685655339986626m_3229832248786967562gmail-m_-2740474882150224374Apple-tab-span" style="white-space:pre-wrap"> </span>obvious that there is no need for further action. This is unnecessarily costly to both AfriNIC and the</div><div class=""><span class="m_962685655339986626m_3229832248786967562gmail-m_-2740474882150224374Apple-tab-span" style="white-space:pre-wrap"> </span>organization being reviewed.</div></div></blockquote><div class=""> </div><div class="">The proposal does not tell Staff how and when to complete a review, as by default staff know what to do to conduct reviews. <br class=""></div></div></div></blockquote><div><br class=""></div>This is not true. The proposal, as written, mandates that if staff receives a complaint, they must conduct a review. It does not</div><div>place any limits on the number of reviews instantiated contemporaneously by the receipt of multiple complaints, nor does it</div><div>provide staff the discretion to combine such complaints with a review in progress.</div><div><br class=""></div><div>The policy as written does not leave these issues to the staff… It is specific and it prevent staff from doing the right and</div><div>reasonable thing in these circumstances… Thus my calling it potentially harmful and a DOS vector.</div><div><br class=""><blockquote type="cite" class=""><div dir="ltr" class=""><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class=""><div class=""><span class="m_962685655339986626m_3229832248786967562gmail-m_-2740474882150224374Apple-tab-span" style="white-space:pre-wrap"> </span>+<span class="m_962685655339986626m_3229832248786967562gmail-m_-2740474882150224374Apple-tab-span" style="white-space:pre-wrap"> </span>As written, in the reported case, AfriNIC staff cannot reject a review where the evidence supported</div><div class=""><span class="m_962685655339986626m_3229832248786967562gmail-m_-2740474882150224374Apple-tab-span" style="white-space:pre-wrap"> </span>does not justify one. They can insist upon a sworn submission of the complaint and evidence, but,</div><div class=""><span class="m_962685655339986626m_3229832248786967562gmail-m_-2740474882150224374Apple-tab-span" style="white-space:pre-wrap"> </span>the policy does not give the discretion to reject or ignore a specious sworn complaint. This is a</div><div class=""><span class="m_962685655339986626m_3229832248786967562gmail-m_-2740474882150224374Apple-tab-span" style="white-space:pre-wrap"> </span>clear path to abuse.</div></div></blockquote><div class=""> </div><div class=""><div dir="auto" class="">Not true. </div><div dir="auto" class=""><br class=""></div><div dir="auto" class="">The
current text was also a consensus of the WG discussion. Lawyers advised
that the word 'Warrant' be used to guarantee that staff has full right
to not trigger a review if the evidences do not justify one. See text
below</div></div></div></div></blockquote><div><br class=""></div>The current text was not a consensus of the WG discussion as there has never been a consensus of the WG discussion on this proposal.</div><div><br class=""><blockquote type="cite" class=""><div dir="ltr" class=""><div class="gmail_quote"><div class=""><div dir="auto" class="">----</div><div dir="auto" class="">B) There has been a
community complaint made against them that warrants investigation.
Complaints shall be backed by evidence and AFRINIC staff shall evaluate
the facts as appropriate to conduct the review. However this review is
not applicable to a member with the same resources portfolio on which a
full review has been completed in the preceding 24 months.</div><div dir="auto" class="">AFRINIC
staff may, at its sole discretion, after having assessed the nature of
the evidence found in the community complaint, require that such
evidence be (i) submitted in the form of a sworn affidavit or (ii)
declared to be true before a Commissioner of Oath.</div></div></div></div></blockquote><div><br class=""></div>I suppose there is a legitimate argument that the initial phrase is vague enough to allow AfriNIC to reject a complaint until such time</div><div>as the complainant sues them for such refusal to act claiming that the complaint does warrant investigation. Personally, not the way</div><div>I want to see AfriNIC spending its legal budget trying to fend off an attempted DOS attack against either AfriNIC, a large resource</div><div>member, or both.</div><div><br class=""><blockquote type="cite" class=""><div dir="ltr" class=""><div class="gmail_quote"><div class=""><div dir="auto" class="">------</div></div><div class=""> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class=""><div class=""><span class="m_962685655339986626m_3229832248786967562gmail-m_-2740474882150224374Apple-tab-span" style="white-space:pre-wrap"> </span>+<span class="m_962685655339986626m_3229832248786967562gmail-m_-2740474882150224374Apple-tab-span" style="white-space:pre-wrap"> </span>The numbering of the paragraphs outside of the actual policy being coincident with the numbering</div><div class=""><span class="m_962685655339986626m_3229832248786967562gmail-m_-2740474882150224374Apple-tab-span" style="white-space:pre-wrap"> </span>of the paragraphs in the proposal should be eliminated. It should be clear and unambiguous which</div><div class=""><span class="m_962685655339986626m_3229832248786967562gmail-m_-2740474882150224374Apple-tab-span" style="white-space:pre-wrap"> </span>text is intended to be applied to the policy manual and which is metadata for the proposal.</div></div></blockquote><div class=""><br class=""></div><div class="">Some disorganisation occurred during the migration to the CPM's format. It will updated. Expect a new version of the proposal.</div></div></div></blockquote><div><br class=""></div>OK.</div><div><br class=""><blockquote type="cite" class=""><div dir="ltr" class=""><div class="gmail_quote"><div class=""><br class=""></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class=""><div class=""><span class="m_962685655339986626m_3229832248786967562gmail-m_-2740474882150224374Apple-tab-span" style="white-space:pre-wrap"> </span>+<span class="m_962685655339986626m_3229832248786967562gmail-m_-2740474882150224374Apple-tab-span" style="white-space:pre-wrap"> </span>The mechanism of priority in 13.2 and, indeed, the meaning of “priority is given” is undefined.</div></div></blockquote><div class=""><br class=""></div><div class=""><div dir="auto" class="">Hmmmmm. Do we really need to define " priority is given" ? Let's review the text again.</div><div dir="auto" class=""><div dir="auto" class="">----</div><div dir="auto" class="">13.2 The reviews cover all allocated/Assigned resources, but priority goes to IPv4 and ASN mappable to two-octet ASN.</div><div dir="auto" class="">-----</div><div dir="auto" class=""> </div></div></div></div></div></blockquote><div><br class=""></div>Yes… We do. Does priority is given mean that 80% of random audits are against IPv4 and ASN numbers ≤65535?</div><div>Does it mean 60%? Does it mean priority only in the case of a stack of complaint based reviews that exceed staff’s</div><div>ability to act?</div><div><br class=""></div><div>It’s literally unclear to me what action to expect staff to take as a result of this directive.</div><div><br class=""><blockquote type="cite" class=""><div dir="ltr" class=""><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class=""><div class=""><span class="m_962685655339986626m_3229832248786967562gmail-m_-2740474882150224374Apple-tab-span" style="white-space:pre-wrap"> </span>+<span class="m_962685655339986626m_3229832248786967562gmail-m_-2740474882150224374Apple-tab-span" style="white-space:pre-wrap"> </span>13.3.1 does not define the intended fraction of members to be reviewed in any given time period.</div><div class=""><span class="m_962685655339986626m_3229832248786967562gmail-m_-2740474882150224374Apple-tab-span" style="white-space:pre-wrap"> </span>Is AfriNIC expected to conduct 5 random reviews per year, or 500?</div></div></blockquote><div class=""><br class=""></div><div class="">This is left to staff to decide in the limit of available resources (human and financial) as discussed and agreed.</div></div></div></blockquote><div><br class=""></div>So if AfriNIC decides to conduct one random review per year and call that sufficient, the authors are satisfied?</div><div><br class=""><blockquote type="cite" class=""><div dir="ltr" class=""><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class=""><div class=""><span class="m_962685655339986626m_3229832248786967562gmail-m_-2740474882150224374Apple-tab-span" style="white-space:pre-wrap"> </span>+<span class="m_962685655339986626m_3229832248786967562gmail-m_-2740474882150224374Apple-tab-span" style="white-space:pre-wrap"> </span>The 24 month exemption in section 13.3.3 ignores the fact that “full review completed” is vague and</div><div class=""><span class="m_962685655339986626m_3229832248786967562gmail-m_-2740474882150224374Apple-tab-span" style="white-space:pre-wrap"> </span>opens multiple channels of abuse…</div><div class=""><span class="m_962685655339986626m_3229832248786967562gmail-m_-2740474882150224374Apple-tab-span" style="white-space:pre-wrap"> </span>-<span class="m_962685655339986626m_3229832248786967562gmail-m_-2740474882150224374Apple-tab-span" style="white-space:pre-wrap"> </span>What constitutes a full vs. partial review?</div><div class=""><span class="m_962685655339986626m_3229832248786967562gmail-m_-2740474882150224374Apple-tab-span" style="white-space:pre-wrap"> </span>-<span class="m_962685655339986626m_3229832248786967562gmail-m_-2740474882150224374Apple-tab-span" style="white-space:pre-wrap"> </span>In the case where AfriNIC has satisfied itself after reviewing 80% or even 90% of an organizations</div><div class=""><span class="m_962685655339986626m_3229832248786967562gmail-m_-2740474882150224374Apple-tab-span" style="white-space:pre-wrap"> </span>resources and AfriNIC terminates the review process, does that constitute completion of a full</div><div class=""><span class="m_962685655339986626m_3229832248786967562gmail-m_-2740474882150224374Apple-tab-span" style="white-space:pre-wrap"> </span>review, or, is such an organization subject to being put through the full process all over again</div><div class=""><span class="m_962685655339986626m_3229832248786967562gmail-m_-2740474882150224374Apple-tab-span" style="white-space:pre-wrap"> </span>within 24 months?</div><div class=""><span class="m_962685655339986626m_3229832248786967562gmail-m_-2740474882150224374Apple-tab-span" style="white-space:pre-wrap"> </span>-<span class="m_962685655339986626m_3229832248786967562gmail-m_-2740474882150224374Apple-tab-span" style="white-space:pre-wrap"> </span>Can additional complaints filed during a review trigger additional reviews contemporaneously?</div><div class=""><br class=""></div><div class=""><br class=""></div></div></blockquote><div class="">As one can see from the text below, the base idea is that an INR cannot
be subject to review more than once in 24 months. Member's resources
portfolio changes over time. <br class=""></div></div></div></blockquote><div><br class=""></div>That may be the intent, but it’s not the proposal.</div><div><br class=""><blockquote type="cite" class=""><div dir="ltr" class=""><div class="gmail_quote"><div class=""><div dir="auto" class="">----</div><div dir="auto" class="">B) There has been a community
complaint made against them that warrants investigation. Complaints
shall be backed by evidence and AFRINIC staff shall evaluate the facts
as appropriate to conduct the review. However this review is not
applicable to a member with the same resources portfolio on which a
full review has been completed in the preceding 24 months.</div><div dir="auto" class="">------</div></div><div class=""><br class=""></div></div></div></blockquote><div><br class=""></div>The devil here is in the details.</div><div><br class=""></div><div>The completion of a full review of a large organization is not unlikely to be 18 months ore more after said review started. Additional reviews can be triggered during that 18 months and the policy provides no discretion for staff to merge new complaints into the existing review.</div><div><br class=""></div><div>There are multiple paths in the details of the existing text that could well put some large resource members into a permanent state of review.</div><div><br class=""><blockquote type="cite" class=""><div dir="ltr" class=""><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class=""><div class=""></div><div class="">Most, if not all of these problems have been reported previously. It’s likely there are other problems remaining as well,</div><div class="">but the above is based on a fresh review of the text below.</div></div></blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class=""><div class=""><br class=""></div><div class="">I renew my call for the authors to recognize that this proposal at best causes more problems than it solves and lacks community consensus or any likelihood of achieving community consensus.</div><div class=""><br class=""></div><div class="">At a minimum, I ask that the authors either withdraw the proposal or provide a substantial update which addresses each and every concern stated above.</div><div class=""><br class=""></div><div class="">Owen</div><div class=""><br class=""></div></div></blockquote><div class="">On behalf of authors <br class=""></div><div class=""><br class=""></div><div class="">Arnaud <br class=""></div></div></div></blockquote><div><br class=""></div>Thank you sincerely, Arnaud, for finally at least treating my objections as substantive and responding to them</div><div>in a manner that reflects a genuine honest effort to work within the process to develop the policy.</div><div><br class=""></div><div>While I still do not agree with you that this policy is needed or should move forward, I do sincerely respect</div><div>your effort here and appreciate finally (after how many years) getting a response that does more than dismiss</div><div>my objections outright.</div><div><br class=""></div><div>As men of good character, we are well within our rights and it is not uncommon for us to respectfully disagree</div><div>and legitimately draw different conclusions from the same facts and words. Such is likely the case here as all</div><div>of our ability to interpret same is colored by our life experiences.</div><div><br class=""></div><div>I hope that going forward, other authors and supporters of this proposal can learn a lesson from you here and</div><div>begin treating the opposition with appropriate respect and attention to our objections.</div><div><br class=""></div><div>I hope you will take the time to review the RSA and especially those most important clauses which I have</div><div>referenced to see that the entirety of useful action from this proposal is already enshrined in the RSA and </div><div>staff has everything they need in order t begin random and/or complaint based investigations as it currently stands.</div><div><br class=""></div><div>Since it is authors intent to leave to staff discretion the amount, frequency, and pace of such reviews, there’s</div><div>really nothing in this proposal that changes the current abilities or requirements under the RSA.</div><div><br class=""></div><div>Owen</div><div><br class=""><blockquote type="cite" class=""><div dir="ltr" class=""><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class=""><div class=""></div><div class=""><div class=""><br class=""><blockquote type="cite" class=""><div class="">On Apr 6, 2019, at 8:12 AM, Arnaud AMELINA <<a href="mailto:amelnaud@gmail.com" target="_blank" class="">amelnaud@gmail.com</a>> wrote:</div><br class="m_962685655339986626m_3229832248786967562gmail-m_-2740474882150224374Apple-interchange-newline"><div class=""><div dir="ltr" class=""><div dir="ltr" class=""><div dir="ltr" class=""><div dir="ltr" class=""><div class="">Hi Ernest and Co-chairs, <br class=""></div><div class=""><br class=""></div><div class="">Please find below an update of our Policy proposal "Internet Number Resources Review by AFRINIC", for future discussions on the list. <br class=""></div><div class=""><br class=""></div><div class="">Regards <br class=""></div><div class=""><br class=""></div><div class="">------------------------------------------------------------------------------- Begin ---------------------------------------------------------------------------------<br class=""><br class=""> Name : Internet Number Resources Review by AFRINIC (Draft 7)<br class=""> Ref. Name: AFPUB-2016-GEN-001-DRAFT07<br class=""> Status: Under Discussion<br class=""> Date: 6 April 2019<br class=""> <br class="">Authors:<br class=""> (a) Amelina A. A. Arnaud | <<a href="mailto:arnaud.amelina@togorer.tg" target="_blank" class="">arnaud.amelina@togorer.tg</a>> | AUF/TogoRER<br class=""> (b) Jean-Baptiste Millogo |<<a href="mailto:jean.millogo@orange.com" target="_blank" class="">jean.millogo@orange.com</a>>| Orange Burkina <br class=""> (c) Marcus ADOMEY <<a href="mailto:madomey@ug.edu.gh" target="_blank" class="">madomey@ug.edu.gh</a>> | University of Ghana<br class=""><br class="">13.0 Summary of the Problem Being Addressed by this Policy Proposal<br class=""><br class="">As Internet Number resources are finite, their allocation is based on the operational needs of end-users and Internet Services Providers, while avoiding stockpiling in accordance with RFC7020, IPv4 Allocation Policy CPM 5.5, IPv6 Allocation and assignment policy CPM 6.5 and Policy for Autonomous System Numbers (ASN) Management in the AFRINIC region CPM 7.0.Section 4 of the Registration Service Agreement (RSA) provides the framework for investigations of the usage of allocated Internet Number resources, defines members’ obligation to cooperate and the measures to be taken by AFRINIC in case of failure to comply. The lack of such investigation or regular control can lead to inefficient usage of the Internet Number resources, to stockpiling and other type of abuses.<br class=""> <br class="">13.0.1 Summary of How this Proposal Addresses the Problem<br class=""><br class="">In order to ensure efficient and appropriate use of resources, AFRINIC shall conduct regular reviews of resource utilization held by its members. This would allow recovery of any type of resource, where usage is not in compliance with the RSA. Those resources can be reallocated for better usage.<br class=""><br class="">13.0.2 Proposal<br class=""><br class="">The policy proposal will modify the CPM as follows:<br class=""><br class="">Insert a section 13 to the CPM as follows:<br class=""><br class="">13.0 Internet Number Resources Review<br class=""><br class="">Regular reviews of resource utilization are conducted by AFRINIC to ensure efficient and appropriate usage of resources. This allows for recovery of any type of resource where usage is not in compliance with the RSA; to allow such resources to be reallocated for better usage.<br class=""><br class="">13.1 The reviews shall be based on compliance with the terms outlined in the RSA and Allocation/Assignment Policies.<br class=""><br class="">13.2 The reviews cover all allocated/Assigned resources, but priority goes to IPv4 and ASN mappable to two-octet ASN.<br class=""><br class="">13.3 Classes of review: Members to be reviewed shall be selected according to the following classes:<br class=""><br class="">13.3.1 Random<br class=""><br class="">The member is chosen by AFRINIC at random between the membership.<br class=""><br class=""><br class="">13.3.2 Selected<br class=""><br class=""> Member is selected because of an internal report or due to a lack of contact between the AFRINIC and the member.<br class=""><br class="">13.3.3 Reported: Here, members are reviewed either because:<br class=""><br class="">A) They have requested the review themselves or<br class=""><br class="">B) There has been a community complaint made against them that warrants investigation. Complaints shall be backed by evidence and AFRINIC staff shall evaluate the facts as appropriate to conduct the review. However this review is not applicable to a member with the same resources portfolio on which a full review has been completed in the preceding 24 months.<br class=""><br class=""> AFRINIC staff may, at its sole discretion, after having assessed the nature of the evidence found in the community complaint, require that such evidence be (i) submitted in the form of a sworn affidavit or (ii) declared to be true before a Commissioner of Oath.<br class=""><br class="">13.4 In case of non-compliance and if evidence has been established in accordance with:<br class=""><br class="">• Breach of AFRINIC policies<br class="">• Breach of the provisions of the registration service agreement or other legal agreements between the organization holding the resource and AFRINIC.<br class=""><br class="">AFRNIC shall initiate the resource recovery process.<br class=""><br class="">A) AFRINIC shall attempt to contact the organization and correct any discrepancy towards the RSA. Except in cases of fraudulent resource acquisition or unlawful usage and abuse, the organization shall be given a minimum of six months to effect the return of the resources.<br class=""><br class="">If the organization is cooperative and working in good faith to substantially restore compliance or has a valid need for additional time to renumber out of the affected blocks, AFRINIC shall negotiate a longer term.<br class=""><br class="">The acceptance level of compliance and duration of the longer term are at AFRINIC staff discretion. <br class=""><br class="">B) If the situation cannot be rectified and the member did not transfer the ressources to meet other AFRINIC-approved needs as per adopted policies<br class=""><br class=""> AFRINIC shall publish the resources to be recovered for a period of three (3) months; during which the organization may at any time, seek compliance or transfer the ressources to other members <br class=""><br class=""> After this period, the resource shall be recovered and therefore the records of the previous holder of the recovered resource shall be updated in AFRINIC’s databases.<br class=""><br class="">C) Any Internet Number Resources recovered under this policy may be assigned/allocated under existing Allocation and Assignment Policies.<br class=""><br class="">13.5 Appeal procedure<br class=""><br class="">Reviewed members who are not satisfied have the right to appeal against the result within the four weeks. Appeals shall follow an arbitration process as provided for in the<br class="">Code de Procedure Civile (Code of Civil Procedure) of the Republic of Mauritius. AFRINIC may, on request from an aggrieved party, suggest a pool of arbitrators who shall be knowledgeable volunteers from the community.<br class=""><br class="">13.6 Compliance Report<br class=""><br class="">AFRINIC shall publish an annual meaningful report describing review activities, in accordance with all applicable laws and regulations.<br class=""><br class="">13.7 Acknowledgements<br class=""><br class="">The authors thank Ms Wafa Dahmani Zaafouri (become Afrinic GC Chair), Mr Serge ILUNGA (become Afrinic Board member) and Mr Alain P. Aina for their contributions in the development of this Policy proposal.<br class=""><br class="">The authors also thank the community for the discussions and contributions.<br class=""> <br class="">4.0 Revision History<br class=""><br class="">18 May 2016<br class=""> Version 1.0<br class="">- First Draft AFPUB-2016-GEN-001-DRAFT01<br class="">- Posted on RPD list<br class=""><br class="">05 Aug 2016<br class=""> Version 2.0<br class="">- Second Draft AFPUB-2016-GEN-001-DRAFT02<br class="">- Change on the policy’s name<br class="">- Addition of the Acknowledgement section<br class="">- Rephrasing of section 3.3.3<br class=""><br class="">18 Nov 2016<br class="">Version 3.0<br class="">- Third Draft AFPUB-2016-GEN-001-DRAFT03<br class="">- Update of section 3.3.3 from discussions on mailing list<br class="">- Update of section 3.7 (Acknowledgements) to thank the community for discussions and contributions<br class=""><br class="">11 Apr 2017<br class="">Version 4.0 <br class="">- Fourth Draft AFPUB-2016-GEN-001-DRAFT04<br class="">- Update and Rephrasing of section 3.4<br class="">- Update and Rephrasing of section 3.5<br class="">- Update and Rephrasing of section 3.6<br class=""><br class="">21 Oct. 2107<br class="">Version 5.0 <br class="">- Fifth Draft AFPUB-2016-GEN-001-DRAFT05<br class="">- Adding the paragraphe C to 13.3.3. according to the legal counsel proposition<br class="">- Rephrasing the paragraphe 13.5 to comply with staff and legal assessment <br class="">- Rephrasing the paragraphe 13.6 to comply with staff assessment and avoid any ambiguity <br class="">- Changing the co-authors list<br class="">- Updating the Acknowledgement session<br class="">- Amending 13.4 (B) to reflect the Transfer policies<br class=""><br class="">06 Apr. 2018<br class="">Version 6.0 <br class="">- Sixth Draft AFPUB-2016-GEN-001-DRAFT06<br class="">- Removing categorization between membership in random class section 13.3.1<br class=""><br class="">06 Apr. 2019<br class="">Version 07<br class="">- Seventh Draft AFPUB-2016-GEN-001-DRAFT07<br class="">- Modifying section 13.4 Paragraph A) to clarify the resources recovery process: set conditions under which a member could be given longer term to effect the return of the resources. <br class=""><br class="">------------------------------------------------------------------------------- End ---------------------------------------------------------------------------------<br class=""></div><div class=""><br class=""></div><div class="">AAAA./<br class=""></div></div></div></div></div><br class=""><div class="gmail_quote"><div dir="ltr" class="gmail_attr">Le mar. 3 avr. 2018 à 07:51, Ernest Byaruhanga <<a href="mailto:ernest@afrinic.net" target="_blank" class="">ernest@afrinic.net</a>> a écrit :<br class=""></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class="">Hi Arnaud,<div class=""><div class=""><br class=""><blockquote type="cite" class=""><div class="">On 31 Mar 2018, at 18:41, Arnaud AMELINA <<a href="mailto:amelnaud@gmail.com" target="_blank" class="">amelnaud@gmail.com</a>> wrote:</div><br class="m_962685655339986626m_3229832248786967562gmail-m_-2740474882150224374gmail-m_-8108743837464194404Apple-interchange-newline"><div class=""><div dir="ltr" class=""><div class="">Dear PDWG,</div><div class="">As you can see through the Lagos PPM minutes [1], all pending legal concerns have been addressed. Last suggestion received abiut removing categories in section 13.3.1( make the random selection applies to all members) was accepted by working group and will reflect in the next version to come.</div><div class=""><br class=""></div><div class="">While awaiting the new version, please send any new comments, suggestions you may have on the proposal [2]</div><div class=""><br class=""></div><div class="">[1] <a href="https://afrinic.net/fr/library/policies/archive/ppm-minutes/2261-afrinic-27-pdwg-meeting-minutes" target="_blank" class="">https://afrinic.net/fr/library/policies/archive/ppm-minutes/2261-afrinic-27-pdwg-meeting-minutes</a></div><div class="">[2] <a href="https://afrinic.net/fr/community/policy-development/policy-proposals/2231-internet-number-resources-review-by-afrinic" target="_blank" class="">https://afrinic.net/fr/community/policy-development/policy-proposals/2231-internet-number-resources-review-by-afrinic</a></div></div></div></blockquote><div class=""><br class=""></div></div>Please send the new version well ahead of the recommended CPM 3.4.2 deadline to allow reasonable time for staff's assessment of the updated proposal.</div><div class=""><br class=""></div><div class="">Regards,</div><div class="">Ernest.</div></div></blockquote></div>
_______________________________________________<br class="">RPD mailing list<br class=""><a href="mailto:RPD@afrinic.net" target="_blank" class="">RPD@afrinic.net</a><br class=""><a href="https://lists.afrinic.net/mailman/listinfo/rpd" target="_blank" class="">https://lists.afrinic.net/mailman/listinfo/rpd</a><br class=""></div></blockquote></div><br class=""></div></div></blockquote></div></div>
</blockquote></div><br class=""></body></html>