[anti-abuse-wg] Notice: Fradulent RIPE ASNs

Hi,

> For the benefit of someone... me, in particular... who is not only not
> a RIPE member, but who is also even physically located outside of the
> RIPE region, could you elaborate a bit on this "mandate" you speak of?

Well, all resource holders must sign a contract these days, and there is an official procedure called 'Closure of Member and Deregistration of Internet Number Resources': https://www.ripe.net/ripe/docs/ripe-578. All members signed the Standard Service Agreement, of which ripe-578 is an integral part.

RIPE-578 contains the following text about fraudulent LIRs:

---8<---
Untruthful information
======================
The RIPE NCC concludes the SSA and provides services to Members in good faith. The Member is in breach of good faith in the following cases:
 - Falsified/incorrect information

If the Member repeatedly provides falsified data or information, or purposefully and/or repeatedly provides incorrect data or information (for example, falsified registration documents or IDs, incorrect/inaccurate contact details, etc.)
 - Fraudulent requests

If the Member submits repeatedly fraudulent requests for Internet number resources (for example, providing incorrect purpose/need or falsified information about the network, etc.)

Procedure
=========
The RIPE NCC will:
 - Send an email to the registered contact(s) indicating:
    - The reason for termination of the SSA
    - The immediate termination of the SSA
 - Terminate the progress of any open requests for RIPE NCC services

The RIPE NCC Managing Director will send an official notification of termination of the SSA (i.e., closure of the Member’s account) to all registered postal and email addresses of the Member.
---8<---

And terminating the SSA (Standard Service Agreement) means: "Upon termination of the SSA, Members lose all rights to RIPE NCC services and their RIPE NCC member status."  That section contains the text "The RIPE NCC will deregister the relevant Internet number resource records. The procedure for deregistration is described in section B.2. The RIPE NCC will also revoke any certificates generated by the RIPE NCC Certification Service."

And that also includes independent (PI) resources they hold: "The RIPE NCC will send an official notification to all registered contacts stating that the Independent Internet number resources will be deregistered, explaining the reasons for this deregistration and the procedure for the deregistration. The Member must immediately inform the End User about the imminent deregistration."

So yes: the NCC can act on fraud and deregister the resources.

> I'm really just curious about one thing.  For its region, ARIN actually
> has an explicit policy that in the event of any person or entity
> being caught deliberately defrauding ARIN, ARIN will (allegedly[1])
> make contact with law enforcement authorities, inform them of the
> fraud, and (I believe) ask those authorities to take action against
> the perpetrator(s).

The RIPE documents don't say anything about the RIPE NCC contacting law enforcement AFAIK. With all the different countries and all their different laws that might be harder to do for the RIPE NCC than in the ARIN region. But if it's possible: good idea.

> It is certainly pleasing to know that RIPE NCC already has in its hand an
> explicit mandate from the membership to take action to undo the effects
> of any fraud or frauds that have been perpetrated against it, however
> I cannot help but be curious as to whether or not that is the outer
> limit of RIPE NCC's mandate with regards to such incidents.

I think it's all in RIPE-578.

Cheers,
Sander