[anti-abuse-wg] Policy Proposal: Frequent Update Reminder

Hello,

as promised I updated the policy proposals from APNIC and send it to
this list and beginning of next week I will start the RIPE NCC Policy
Proposal Process.

Please review and give feedback. And yes, there are still some things in
the proposal, where some people might not like. I just would like to see
the opinion of the RIPE members first and not only from people who have
read my proposals on other mailinglists before.

Thank you very much.

Tobias


________________________________________________________________________

Frequent Update Reminder
________________________________________________________________________


Author:    	Tobias Knecht
           	<tk at abusix.com>
	   	CEO - abusix.org
		Co-Chair AK-EMAIL eco e.V.

Version:   	1

Date:      	August 11th 2010

RIPE WGs:  	AA + DB

Proposal Type:	new

Policy Term: 	permanent



1.  Introduction
----------------

This is a proposal for RIPE to regularly contact all RIPE current
account holders with resources in the RIPE Whois Database to ask them
to actively check that all their details in whois are up to date.

To actively check details, the object owner has to log into the LIR Portal
and acknowledge the accuracy of data in their object(s) or update
all existing objects if needed. The update date will be shown in the
"changed" attribute of every single object.


2.  Summary of current problem
------------------------------

Whois database data accuracy has been a big issue for years now. There
have been several approaches to get better data accuracy within
whois information all over the world.

There are two main reasons for data inaccuracy in whois:

    a) Wrong data is published to camouflage illegal actions.

    b) Wrong data is published because object owners forget to update
       the whois information as changes occur within their organization
       (staff changes, etc.)


A secondary problem is data incompleteness:

    - Sometimes, there are changes to the structure of whois data, such
      as additional mandatory objects or attributes (for example, the
      IRT object). Object owners usually do not immediately make these
      changes to the objects they are responsible for. So there is
      always data missing in the whois database.


3.  Situation in other RIRs
---------------------------

ARIN conducts an annual POC (point of contact) validation process:

    https://www.arin.net/policy/nrpm.html#three6

APNIC is still discussing about a similar approach at the moment:

    http://www.apnic.net/__data/assets/file/0006/22857/prop-084-v002.txt

If the current APNIC and RIPE proposals are successful, the author
plans to submit a similar proposal for AfriNIC, LACNIC regions.


4.  Details of the proposal
---------------------------

It is proposed that RIPE:

4.1 Send an update notification for all existing objects to the
    corresponding responsible organization once every X months.

    This notification will explain that object owners must log in
    the LIR Portal and verify all objects they are responsible
    for.

    The objects covered by this proposal are:

        - inetnum
        - inet6num
        - aut-num
        - person
        - role
	- org
	- irt

    Object owners must actively click and acknowledge the correctness of
    the objects they are responsible for.

        - If an object needs updating, or a new object needs to be added
          (for example, an IRT object), the owner can do this via
          the LIR Portal.

        - If a new object or attribute is made mandatory via another
          RIPE policy, then the responsible organization will be
          required to make this update, if not already made, at the time
          of notification.

    Even if the owner only verifies existing data and has not made any
    changes, the "changed" attribute in the whois database objects will
    include the date the owner verified the object. This will give
    users of whois an idea on how recently the object owner verified
    the accuracy of the data.


4.2 Send update notifications to responsible organizations at times
    shorter than the regular period described in section 4.1 if RIPE
    is made aware that the organization's object contain invalid
    information.

4.3 RIPE will offer web form which gives whois users the ability to
    report invalid whois objects. See APNIC webform as example:

	http://www.apnic.net/invalidcontact

    A link to the webform shall be linked in all whois output for
    reporting invalid contact information.


4.4 Handle non-responsive object owners in the following way:

    - Owners will have 60 days from the time of initial message
      from APNIC to confirm that their objects are up to date.

    - If the object owner does not respond to the initial message,
      reminder emails will be sent 10, 30 and 50 days after the
      original email.

    - After the 60-day period has passed, if the object owner has not
      verified their object details, APNIC will add the ranges of
      resources maintained by the non-responsive object owner to the
      publicly available list of resources described in 4.5.1 below.


4.5 Maintain two publicly available lists:

    4.5.1 Resources associated with non-responsive object owners

          - This list would include resources associated with object
            owners who have not responded to RIPE's requests as
            described in section 4.4 above.


    4.5.2 Resources associated with known invalid contact details

          - This list would include resources that have been reported
            to contain invalid contact details.

          - It is left to the discretion of the RIPE Secretariat
            whether to include an explicit remark in the corresponding
            database objects to show that the information in the objects
            is invalid.


5.  Advantages and disadvantages of the proposal
------------------------------------------------

5.1 Advantages

    - A frequent reminder and the need to actively verify will solve the
      problem of forgetting to update objects.

    - All objects will follow the latest requirements for registration
      in the RIPE Whois Database. For example if there is a mandatory
      field added within X months every object will be updated.

    - More people will use the LIR Portal.


5.2 Disadvantages

    - No disadvantages are foreseen.


6.  Effect on RIPE members
---------------------------

Members have to update or verify their objects once every X months.
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: RIPE:frequent-update-v001.txt
URL: </ripe/mail/archives/anti-abuse-wg/attachments/20100930/68d11cc4/attachment.txt>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 262 bytes
Desc: OpenPGP digital signature
URL: </ripe/mail/archives/anti-abuse-wg/attachments/20100930/68d11cc4/attachment.sig>