RIPE NCC Audit Activity

Introduction

The RIPE NCC has a mandate from the RIPE community to keep an up-to-date and correct Internet number resource registry (RIPE Registry).

After Internet number resources have been registered in the RIPE Registry, the RIPE NCC performs audits to ensure compliance with the RIPE Policies and to actively check the quality and validity of the data in the RIPE Registry (Section 2 of the RIPE NCC procedural document “Due Diligence for the Quality of the RIPE NCC Registration Data”).

This document outlines the audit activity the RIPE NCC performs.

Table of contents

1. Scope of the Audit Activity
2. Types of Audits
3. Process
4. Appeal

1. Scope of the Audit Activity

Every party that has entered into an agreement with the RIPE NCC is contractually obliged to provide the RIPE NCC with complete, updated and accurate information necessary for the provision of RIPE NCC services and to assist the RIPE NCC with audits and security checks (Article 6.2. of the RIPE NCC Standard Service Agreement, RIPE NCC procedural document “Due Diligence for the Quality of the RIPE NCC Registration Data”).

More specifically, it is the contractual obligation of: 

• The RIPE NCC members for the RIPE NCC services they receive, including the Internet number resources they hold or they are responsible for as sponsoring LIRs, with either case including Legacy resources
• The Legacy Internet number resource holders that have entered into a contractual relationship with the RIPE NCC

For the purposes of this document either of the above is referred to as “Resource Holder”.

The Internet number resources that may be subject to an audit are: 

• Internet number resources registered in the RIPE Registry in accordance with the relevant RIPE Policies
• Legacy Internet number resources subject to a contractual relationship with the RIPE NCC or a sponsoring LIR as described in the RIPE Policy “RIPE NCC Services to Legacy Internet Resource Holders”
• Legacy Internet number resources that are not subject to a contractual relationship with the RIPE NCC or a sponsoring LIR, for which a Resource Holder requests the RIPE NCC to update their registration data

2. Types of Audits

Depending on the reason an audit is initiated, the RIPE NCC performs the following types of audits:

2.1. Assisted Registry Check (ARC)

The Assisted Registry Check (ARC) is an audit the RIPE NCC performs with the aim of providing personalised support to a Resource Holder that is a RIPE NCC member in order to help them keep their data in the RIPE Registry correct and accurate.

An ARC may be initiated upon a RIPE NCC member’s request or the RIPE NCC’s selection of a member on a random basis or due to a specific matter regarding this member.

During an ARC the RIPE NCC, together with the relevant member, will review the member’s data in the RIPE Registry, including the accuracy of their legal name, address, contact details, their registered contact persons, and the correctness of the registration of the relevant Internet number resources in the RIPE Database, etc.

2.2. Selected

The RIPE NCC may initiate an audit on its own initiative when there are suspicions that a Resource Holder is maintaining inaccurate data in the RIPE Registry, is in violation of the RIPE Policies and/or the RIPE NCC procedures.

Depending on the reason a selected audit was initiated and when this is considered appropriate, the RIPE NCC may inform the relevant Resource Holder that they are being audited and request any relevant information.

2.3. Reported

A reported audit may be initiated as a reaction to a complaint submitted to the RIPE NCC by a third party.

Upon receipt of such a complaint, the RIPE NCC will evaluate its merits and if sufficient evidence is provided by the reporting party, the RIPE NCC will initiate the audit and investigate the matter further.

Unless it is proven that the reporting party has a valid claim on the Internet number resources under audit, the RIPE NCC will not report its findings to the reporting party due to confidentiality reasons.

Note
For the purposes of the RIPE NCC audit activity ‘’Hijacking’’ is referred to any attempt to gain control of, or acquire, Internet number resources under false pretenses. In cases of suspected Hijacking, any type of audit, as deemed appropriate by the RIPE NCC and described in Section 2.0 of this document, may be initiated regardless of the reason that triggered its initiation.

3. Process

3.1 Supporting Documentation

During an audit the RIPE NCC may request any documentation relevant to the under audit matter and it is the Resource Holder’s obligation to assist the RIPE NCC and provide the requested information.

A non-exclusive indication of information and documentation the RIPE NCC may request during an audit is:

1. Supporting documentation proving the Resource Holder’s existence (e.g. registration papers from the local authorities of the country the relevant organisation is registered, proof of identification in case of a natural person, confirmation by an authorised representative of the organisation)
2. Contact details of the parties involved
3. Any additional documentation such as relevant agreements, declarations proving the accuracy and correctness of the data under audit in the RIPE Registry, or court decisions establishing, recognising or ordering a change on the data of the relevant Internet number resources

The RIPE NCC reserves the right to check the validity of the provided documentation by requesting support from third parties and/or by undertaking any other action necessary to this regard (e.g. request for the documents to be notarised). For more information, see the RIPE NCC procedural document “Due Diligence for the Quality of the RIPE NCC Registration Data”.

It shall not be expected that the RIPE NCC will conduct a full audit of all registration data held by a Resource Holder or of their compliance with RIPE Policies, if this is not related to the reason the audit was initiated. It is up to the RIPE NCC to decide to restrict an audit to the particular issue that triggered its initiation or to extend its scope to other matters as well.

3.2 Time Frame  

The time required for each audit depends on the complexity of each case. However, an audit may not be ongoing for an indefinite period of time.

The RIPE NCC will set concrete time frames within which the requested information must be provided by the Resource Holder under audit and will inform them accordingly. Failure to provide the requested information within the set time frame may constitute the failure of the Resource Holder to comply with the RIPE NCC audits and thus may lead to the termination of the relevant contractual agreement (see points A.1.2.2.h, C.1.2.2.h of the RIPE NCC procedural document “Closure of Members, Deregistration of Internet Resources and Legacy Internet Resources”).

Once all the appropriate actions are undertaken by the RIPE NCC or by the Resource Holder as requested by the RIPE NCC, the audit will be concluded.

3.3 Possible Outcomes of an Audit

The RIPE NCC may provide recommendations to the under audit Resource Holder and if necessary, request that they make any updates and corrections to their data in the RIPE Registry. The Resource Holder shall comply with the given recommendations in a timely manner.

If the Resource Holder does not assist the RIPE NCC with the audit, remains unresponsive or fails to cooperate with the RIPE NCC’s requests regarding the under audit matter, the RIPE NCC has the right to terminate the relevant contractual agreement (the RIPE NCC Standard Service Agreement, RIPE NCC Services for Legacy Internet Resources Agreement (Legacy Agreement)) and, when applicable, proceed with the deregistration of their Internet number resources in accordance with the RIPE NCC procedural document, “Closure of Members, Deregistration of Internet Resources, and Legacy Internet Resources” (see Section A.1.2.2.d).

If during an audit it is proven that the Resource Holder has provided the RIPE NCC with incorrect or fraudulent information either during the audit, upon the conclusion of the relevant agreement with the RIPE NCC or during its term, the RIPE NCC has the right to terminate the relevant agreement and, when applicable, proceed with the deregistration of their Internet number resources in accordance with the RIPE NCC procedural document “Closure of Members, Deregistration of Internet Resources, and Legacy Internet Resources” (see Section A.1.2.2.g). In particular, if the information the Resource Holder has provided the RIPE NCC with is fraudulent, the RIPE NCC will file a report to the relevant authorities for their further investigation.

In case of Hijacking and in cases where a transfer of Internet number resources has taken place under false or incorrect information and documentation, the RIPE NCC reserves the right to reverse or update the data in the RIPE Registry.

If considered necessary, and in cases where another RIR is involved (e.g. in cases of Inter-RIR transfers), the RIPE NCC may hand information regarding the audit to the relevant RIR for their actions on the matter under audit.

4. Appeal

If the Resource Holder does not agree with the outcome of the performed audit, they can apply for the initiation of the RIPE NCC Conflict Arbitration Procedure.