Hi Dave, It will be good to clarify why prop-125 was implemented in the policy manual in a different way it reached consensus in the community, as this seems to be part of the problem about why this is not being as effective as expected.
That said, the escalation process to APNIC works (after some tunning), and when an email is not reaching the abuse-c, I’ve been able to submit the issue to APCNIC and it seems the resource holder was properly contacted and resolved it. But I should insist in what I said in my previous email. We have a different text that the one that reached consensus, which is not correct in my opinion. Regards, Jordi @jordipalet > El 26 ago 2026, a las 11:48, Dave Phelan <[email protected]> escribió: > > Dear SIG Members, > > Please find below the Secretariat impact assessment for prop-172-v001: > Defining Internet Abuse through IP Addresses > > > Dave Phelan > > Policy Manager and Senior Network Analyst > > -------- > > 1. APNIC’s Understanding of the Proposed Policy > > APNIC understands this proposal as introducing a formal definition of > ‘Internet Abuse through IP Addresses’ into APNIC policy. > > The proposal states that it does not create new enforcement powers, reporting > requirements, or compliance mechanisms. However, the text also says APNIC > retains responsibility for holding resource holders accountable for > responding to and addressing abuse. > > APNIC Secretariat have noted that this overlaps with the current IRT policy, > which already requires IRT contacts to be maintained and validated. > > 2. Impact of Proposed Policy on Registry and Addressing System > > No direct registry impact expected > > 3. Impact of Proposed Policy on APNIC Operation/Services > > APNIC Secretariat notes that the main issue is ambiguity about APNIC’s role. > The proposal says APNIC does not have the power to adjudicate abuse, but also > says APNIC retains responsibility for holding resource holders accountable > for responding to and addressing abuse. It is unclear how both can be true > without creatingn some form of operational enforcement role. > APNIC is not currently resourced to perform this work, and the associated > cost may not be something the membership would expect or support. > > As of 17 Aug, 2026, 2,359 out of a total of 10,815 active APNIC accounts > (21.8%) had no validated IRT emails associated with their resources. APNIC > marks IRT emails as invalid 15 days after sending the validation request and > restricts MyAPNIC access if the validation is not completed in 30 days. > This figure does not take into account those that will validate within the 30 > day window, it is a point-in-time reference. > > 4. Legal Impact of Policy > > The proposal would define "Internet Abuse through IP Addresses" as the use of > IP addresses in a way that causes technical harm to the security, stability, > or trust of the Internet. It would also include facilitating unlawful conduct > that the resource holder has the practical ability to address. > > Although presented as a definition, the proposal also discusses > responsibilities, how abuse is determined, and circumstances where a resource > holder may be protected from further action. These elements appear to go > beyond a simple definition and could be interpreted as introducing broader > operational expectations. A number of legal and implementation issues may > arise if the proposal is adopted. > > The reference to "unlawful conduct" creates uncertainty because APNIC serves > account holders operating across many different jurisdictions. Conduct that > is unlawful in one jurisdiction may be lawful in another. In some cases, > conduct that is unlawful in one jurisdiction may even be required by law in > another. Resource holders may also be based in, and operate across multiple > jurisdictions, so the legality of behaviour may differ between those > different locations. > > The proposal states that APNIC does not have the power to adjudicate abuse. > However, it also states that APNIC has an existing responsibility to hold > resource holders accountable for responding to and addressing abuse. We do > not consider this to be an accurate reflection of current policy. Section > 5.3.3 of the APNIC Internet Number Resource Policies requires resource > holders to maintain responsive IRT contacts and requires APNIC to validate > those contacts. It does not require APNIC to investigate alleged abuse, > determine whether abuse has occurred, or assess whether a resource holder's > response was adequate. > > There also appears to be some conflict between these two statements. > Determining whether abuse has been "addressed" would generally require first > determining whether abuse occurred. This would place APNIC in an adjudication > role, which the proposal expressly states APNIC does not have. In any case, > only a competent authority (e.g. – a court) is capable of determining whether > conduct is unlawful. > > It is also unclear what is meant by "fraudulently ... sub-allocating IP > address resources" and how such conduct would occur in practice. > > The policy objective states that the definition is intended to serve as a > foundation for future policy proposals. While we would not normally comment > on possible future proposals, it is worth noting that any future policy > requiring APNIC to assess or enforce whether abuse has been addressed would > represent a significant expansion of APNIC's current role. Historically, > APNIC's responsibilities have focused on Internet number resource management > and related technical matters rather than assessing conduct or content. Such > a change would likely require additional resources, expertise, and risk > management measures and should be considered expressly in advance of any such > change. > > If "unlawful conduct" remains part of the definition, several practical > questions would remain unresolved. For example, when would a finding of > unlawfulness be considered sufficiently final? Would all appeals need to be > exhausted? How would conflicting decisions from different jurisdictions be > handled? These issues could create substantial administrative complexity and > may affect APNIC's neutrality. > > The Secretariat notes that implementation may benefit from greater clarity > about the intended scope of the definition. In particular, it may be helpful > to confine matters to a technical definition of abuse without any operational > or enforcement expectations that may arise from it. A definition based on > established technical standards (such as those from IETF) may provide a more > objective foundation than concepts based on lawfulness, although this would > not resolve all implementation issues. Terms such as "facilitating", > "hosting", "phishing", "fraud", "scam", and "impersonation" should also be > carefully considered to ensure the definition does not unintentionally expand > APNIC's role into determining questions of unlawful conduct or content. > > 5. Implementation > > Until such point as the above clarifications are made, we are unable to make > a determination on implementation process and time frames. > > _______________________________________________ > SIG-policy - https://mailman.apnic.net/[email protected]/ > To unsubscribe send an email to [email protected] ********************************************** IPv4 is over Are you ready for the new Internet ? http://www.theipv6company.com The IPv6 Company This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.
_______________________________________________ SIG-policy - https://mailman.apnic.net/[email protected]/ To unsubscribe send an email to [email protected]
