[members-discuss] Registry Services Ticket Response Time

Hi Kurtis,

On Wed, Sep 22, 2021 at 01:48 Kurtis Lindqvist <kurtis at linx.net> wrote:

>
>
>         Hi Elvis!
>
> > On 21 Sep 2021, at 00:55, Elvis Daniel Velea <elvis at v4escrow.net> wrote:
> >
> > What I meant to say was that all members should understand that what
> they hold in their accounts are numbers that have a high value and
> therefore they should do everything they can to secure their accounts
> because there are fraudsters out there trying to hack into their accounts
> to steal their prized assets.

[…]

>
> > How can someone be sure that an ink signature is not fake always amazes
> me, there are highly skilled individuals that authenticate autographs that
> have done this for a life and can still make mistakes.. Why has the NCC
> gone this route with 30+ people, none with the right skills or training to
> do this?

[…]

>
> > The owners of the LIR accounts should be responsible for their own
> passwords/authentication methods and who they give access to the resources
> to. They should also be responsible for the documentation provided by their
> company to the RIPE NCC and acknowledge that the NCC may refer cases to
> LEAs/justice when they have reasons to believe this
> information/documentation is fake.
>
>
> You are making the assumption that there are no undisputed resources at
> the moment, that there is a clear ownership for every single resource, that
> “password hacking” is the only way to claim or steal resources etc. Neither
> of these are true.


No, I am not making this assumption. What I am saying is that the NCC is
basing the security of those resources and the ‘holdership’ of a resource
based on the SSO owner and the documents they receive from him/her. They
evaluate these documents by comparing them visually, but they don’t really
have any real training in identifying a fake signature, they can suspect
it, maybe.
The NCC RS dept. has never had people specialized in identifying fake
documentation. It is very hard to identify abuse or faked documentation
considering the large service region it covers. Deregistering resources or
refusing services based on suspicion is just an invitation to the NCC being
sued and losing more time in a court than evaluating requests.
All the NCC is basing its decisions on is that by catching the bad guys
those will not have the knowledge or willingness to take it to court.
That is why it is very important that the NCC focuses it’s effort in
ensuring the members have secure access to the LIR Portal and the tools
available.

Ever wondered why we have only heard of a handful of deregistrations in
almost 30 years?
Why the NCC has rarely gone (or been taken) to court? It’s because it is
not their job to prove fraud and even when they do, the NCC should first
report it to LEAs and let them investigate.


> There are plenty of disputed resources, many other ways to steal or claim
> resources. Disputes will arise as a result of company mergers, splits or
> defaults.


Again, everything is reduced to an SSO holder which the NCC talks to. All
other cases need to resolve by mediation or court decisions. I believe that
because as IP Broker I’ve had customers with all kind of weird mergers or
splits and have seen how complicated some of these are. In the end, what’s
registered is hard to be changed or deregistered even with enough proof in
hand.

And when it comes to legacy blocks, the NCC rarely does anything,
especially when the original resource holder does not know of the hijack or
does not even exist any longer so they can’t report it. I know that for a
fact as I’ve previously reported at least one hijack of a large block and
they have not been able to investigate or revert any changes made by what I
believed to be hijackers.


>
> Miscreants can claim ROAs for resources with loose controls or ownership
> structures. As a community we should all want the NCC to ensure we are
> protected from this as these all put us at risk.


Only if they have access to the SSO which in turn has access to the LIR
Portal account. I doubt the NCC have the training to really provide this
‘protection’. Some cases may be blatantly fraudulent (like when the NCC
received a copy of an ID foe John Doe with Cher’s picture on) but even
then, deregistering a resource should be done very carefully.


>
> You seem to focus on the easy of the transfer market only but the that is
> not the NCCs goal, far from it. NCC has other, and in my view much more
> important objectives they need to fulfil to protect us all. To do this they
> need to uphold processes that might impact the speed of the transfer
> market, but I personally think that is a price worth paying for a robust
> system and community trust. That said, the checks should be streamlined and
> effective, but not compromise the integrity of the data.


I am not talking only about transfers here. ALL tickets are delayed, even
those where people just want to open an LIR. You see that I’m an IPv4
Broker an guess that’s my only concern. That’s not correct and you are
wrong here to make that assumption.
The Registration Services department is failing to reply within the agreed
SLA and some tickets take months to resolve (see Felipe’s presentation
showing that there are over 100-150 tickets opened monthly that take more
than 8 weeks or/and 10 replies to be resolved, at least 1/3rd of these are
improvable so something is wrong with some of the processes or
communication, see slide 7 *)

Since the Customer Services Department has been merged with the
Registration Services Department, it is now one big department, the only
department communicating with the members.
RS is the link between the NCC and the membership, they have a clear SLA
which they fail to respect almost daily, for years now.. that is my
concern. It’s even worse that in early August we received a message saying
‘we’ll do even worse before we improve’.

I am not asking for any compromise or anything that would compromise the
accuracy of the registry.
I am asking for a review of the processes and of the reason the delay in
processing request is getting worse because, it is my opinion, the RS
management has recently made some poor decisions in creating/modifying
processes for sanctions checks and anti-fraud checks that delay almost all
the tickets processed by that department and miss the SLA daily.

I have also been asking for a clear picture of the number of days the SLA
has been violated, the NCC is still refusing to provide that number.

* https://ripe82.ripe.net/archives/video/584/

-- 
Kind regards,
Elvis Daniel Velea
Chief Executive Officer
V4Escrow LLC
www.v4escrow.com
elvis at v4escrow.net
+1-702-970-0921


>
> - kurtis -
>
-- 
This message was sent from a mobile device. Some typos may be possible.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.ripe.net/ripe/mail/archives/members-discuss/attachments/20210922/48030968/attachment.html>