[anti-abuse-wg] 2019-03 and over-reach

The aim of the 2019-03 proposal, as far as I understand it, is to grant 
the RIPE NCC the authority to make formal judgements about alleged abuse 
of network resources with the implicit intention that unless the party 
involved ends the alleged abuse, the RIPE NCC would enforce the 
judgement by LIR shutdown if the alleged infringer were a member, or 
refusal to provide service if the alleged infringer were not.

There are several aspects of this proposal that are pretty disturbing, 
but the two that jump out are 1. over-reach by the RIPE Community, 2. 
encroachment into the arena of supranational law enforcement.

I'm not going to go into the technical content of the proposal, despite 
the fact that I don't believe it would have any impact whatever on 
dealing with the problem of hijacking.  Limited companies can be 
registered for tiny amounts of money, and it's naive to believe that any 
actor who is dishonest enough to engage in persistent bgp hijacking 
would think twice about switching from one company to another in a 
heartbeat, in order to avoid the consequences of a policy like 2019-03.

Regarding over-reach, the RIPE NCC was instituted as a numbering 
registry and as a supporting organisation for the RIPE Community, whose 
terms of reference are described in the RIPE-1 document.  The terms of 
reference make it clear that the purpose of the RIPE Community and the 
RIPE NCC is internet co-ordination and - pointedly - not enforcement.  
Proposal 2019-03 goes well outside the scope of what the RIPE Community 
and the RIPE NCC were constituted to do, and I do not believe that the 
Anti Abuse working group has the authority to override this.

The second point relates to the long term consequences of the proposal.  
If the RIPE Community were to pass this policy, then it would direct the 
RIPE NCC to act as both a judiciary and policing agency for internet 
abuse.  Judgement and enforcement of behaviour are the competence of 
national governments, courts and law enforcement agencies, not of 
private companies.  If the RIPE NCC starts encroaching in this 
territory, it should expect national governments and law enforcement 
agencies to start taking an active interest in taking control.  This 
scenario would not be beneficial to the RIPE Community.

There are other pile of other considerations here, not least whether the 
RIPE NCC would have any legal jurisdiction to deregister resources where 
it had determined "abuse", and what the legal liability of the company 
would be if it were determined that they didn't have jurisdiction to act.

I don't question the motives of the authors of this proposal - neither 
of them has anything but the best of intentions in mind.  Regarding BGP 
hijacking in general, I've been involved in attempting to deal with many 
hijackings over the years and am as frustrated as anyone.  Like many 
other people in this community, I have also spent a lot of time and 
effort trying to deal with the problem from a practical point of view, 
both in terms of tooling and deployment standards for IXPs and service 
providers.

But, this is not how to handle the problem of BGP hijacking.  Even if it 
had the slightest possibility of making any difference at a technical 
level (which it won't), the proposal would set the RIPE Community and 
the RIPE NCC down a road which I believe would be extremely unwise to 
take from a legal and political point of view, and which would be 
difficult, if not impossible to manoeuver out of.

Nick

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.ripe.net/ripe/mail/archives/anti-abuse-wg/attachments/20190322/b541b5bf/attachment.html>