[anti-abuse-wg] 2019-03 New Policy Proposal (BGP Hijacking is a RIPE Policy Violation)

In message <E1h6E3W-00051F-BF at www-apps-1.ripe.net>,  
Marco Schmidt <mschmidt at ripe.net> wrote:

>You can find the full proposal at:
>https://www.ripe.net/participate/policies/proposals/2019-03
 
Anyway who knows the first thing about me will know that I'm
strongly in favor of the general thrust of this proposal,
generally speaking.  In fact I would only want to quibble
with a few of the finer points of the implementation details.
 
With respect to those, I'd like to see there be a bit more
formality (in the specification of the adhjudication procedures),
and a bit less (mandated) fooling around before any particular
"deliberate" hijacker can be formally and finally kicked to
the curb.

I have a lot of thoughts about how all this could be and should
be structured and operated, but I don't want to bring in too
much of that fine detail at this point in the discussion for
fear that it might obscure the more fundamental question on the
table, which is simply whether or not this is a good idea gnerally.
(I personally think that it is.)  So for now I'll just say that
I think this proposal is on the Right Track generally, and that
I think that it can be and should be revised and evolved to make
all of the adjuducation procedures transparent, faster, and yet
still unarguably fair to those accused.

Mostly, I personally would like to see the time frames specified
in the current draft tightened up (i.e. reduced) generally, and
the entire process streamlined somewhat.  These are not capital
murder cases we are talking about after all!

Specifically, I think that it should be adequate to have there
be a period of *no more than* two weeks, during which the case is
argued, by both the accused and (perhaps) by an NCC staff member
presenting the case for the prosecution, all in front (via email)
of a smallish set of adjuducators (perhaps five, chosen by random
lots) after which there should be a period of *no more than* one
week of deliberation, and then a final judgement and report.  And
lastly, after that, I think that it would be more than sufficient
if there were only one avenue of appeal, which would be to the
RIPE Board, which would be required to decide any appeal within
*no more than* four weeks.

In practice, I think that even these time frames will, in the end,
be seen to have been excessively and pointlessly generous in virtually
all actual cases.  I am thinking back on all of the cases I have seen
of deliberate hijacks, and there have been many of those.  None of
those cases was really very ambiguous at all, and none of them would
have required more than a day or two, once all of the facts were
gathered, to persuade any reasonable and knowledgable observer of
the truth of what had happened and/or its clearly deliberate nature.
Nor would any of those who had been caught red handed pulling this
kind of nonsense ever be at all likely to appeal from the obvious
facts.  But due proces is never something to be dispensed with lightly,
and we should not do so in this instance.  Thus, I agree that it *is*
necessary to have a formal and fair process, including a right of
appeal.  I just hope that it can be moved along at a rather more
rapid pace (even in the worst case) than what the proposal at hand
is currently calling for.


Regards,
rfg