Dear SIG Members,
Please find below the Secretariat impact assessment for prop-171-v001:
Operational Accountability for Abuse Contacts in Sub-Allocated Address Space
Dave Phelan
Policy Manager and Senior Network Analyst
-------
1. APNIC’s Understanding of the Proposed Policy
APNIC understands this proposal as requiring an upstream holder to ensure there
is a reliable operational path from the registered abuse or IRT contact to the
party able to investigate and act on abuse reports for sub-delegated address
space.
The proposal does not propose a Whois schema change or a new validation
frequency.
APNIC Secretariat has noted that the issue may already be addressed under the
current IRT policy, as members can create individual IRT objects for customers
or use their own IRT where they remain responsible. If IRT details are invalid
or unresponsive, community members can already submit invalid or unresponsive
IRT contact requests
2. Impact of Proposed Policy on Registry and Addressing System
No Whois schema change has been identified. However, the proposal may affect
Whois and IRT operational practice.
The proposal also does not specify a minimum size for sub-delegations, which
could imply IRT expectations down to very granular levels for large
organisations. This may create practical issues for Whois lookups and IRT
records where multiple contacts could apply to a single address
3. Impact of Proposed Policy on APNIC Operation/Services
The main impact is not system change, but defining and validating what a
‘reliable operational path’ means.
If an upstream holder keeps responsibility for abuse handling, APNIC would need
guidance on what suitable arrangements look like and how the Secretariat is
expected to assess or validate them.
This could create significant workload, particularly if APNIC is expected to
review forwarding arrangements, downstream responsibility, or complaints that
abuse reports are not reaching the right party.
There is also a risk that the proposal may create expectations that APNIC will
assess the effectiveness of abuse handling, even though the proposal says it
does not create a new audit or compliance
4. Legal Impact of Policy
The Proposed Policy would add a new principle to APNIC-127. This principle
would require an upstream holder to ensure that abuse reports can reach the
party able to resolve them when address space has been sub-delegated.
We note that upstream holders already remain responsible for their
sub-delegations. Under prop-125, if a downstream abuse contact is not
reachable, the upstream holder remains responsible for meeting the contact
validation requirements. However, the current policy does not require the
upstream holder to be responsible for how abuse reports are handled after they
are received.
We understand that it is not intended for APNIC to enforce this new principle
directly. Instead, the Secretariat would develop operational guidance in
consultation with the community. However, the use of terms such as
"accountability" and "responsibility" could be interpreted as implying some
level of enforcement, even though the proposal states that it does not give
APNIC any new investigative or enforcement role.
We therefore assume the intention is to provide guidance on community
expectations and good operational practice, rather than to create any new
enforcement obligations for APNIC.
5. Implementation
There are a number of clarifications required in this assessment that would
need to be resolved before implementation actions can be determined(Other than
changes to APNIC-127).
Until such point as these clarifications are made, we are unable to make a
determination on implementation process and time frames.
_______________________________________________
SIG-policy - https://mailman.apnic.net/[email protected]/
To unsubscribe send an email to [email protected]
