[anti-abuse-wg] 2019-03 New Policy Proposal (BGP Hijacking is a RIPE Policy Violation)

In message <alpine.LRH.2.21.1903200903330.23614 at noc.ilan.net.il>, 
Hank Nussbacher <hank at efes.iucc.ac.il> wrote:

>More or less I agree with the proposal.  But what happens after a LIR is 
>found to be violation of the policy?  RIPE NCC puts out a statement "LIR X 
>is in violation of Policy nnnn"?  So what?  How does this policy assist 
>stopping the BGP hijack from taking place, even if it takes 1-2 months to 
>handle the paperwork?

I've been trying to think about how the mechanics of a truly effective
and efficient policy addressing hijacking would, could, or should work,
in practice.   As I've already said, I'm very much in favor of the
general idea of introducing some disipline, so that deliberate hijackers
don't get get a free pass.  Beyond that however there's an awful lot
to think about when it comes to how to make this all work, in practice.

Two obvious considerations are (1) how to make the process as expeditious
as possible while still providing accused parties with due process and
a fair chance to be heard, and (2) how to make the process cost effictent...
because I don't see there as being any "white knight" who is going to
show up to pay for any of this.

It occurred to me last night that one possible pre-existing model of a
speedy and efficient dispute resolution policy that might serve as a
model of how all this could be done, quickly and cheaply, is ICANN's
Uniform Domain Name Dispute Resolution Policy (UDRP):

https://en.wikipedia.org/wiki/Uniform_Domain-Name_Dispute-Resolution_Policy

The whole point of this policy was to provide a quick and efficient way
to resolve disputes, at least those relating to domain names, short of
actually going into court.  From the Wikipedia page:

    The goal of the UDRP is to create a streamlined process for resolving
    such disputes. It was envisioned that this process would be quicker
    and less expensive than a standard legal challenge. The costs to hire
    a UDRP provider to handle a complaint often start around US$1,000 to
    $2,000.

When considering cases of IP block hijacking, I need to say that I don't
actually see a need for "experts" per se.  In most of the actual cases
I've seen, the facts are fairly plain and apparent.  Property is property,
and ownership is ownership, even when it comes to the intangible real
estate of the Internet, and if someone comes to your house, bulldozes it,
and puts a freeway where it used to be, then you have a pretty clear
basis for complaint.  In short, I do believe that the arbitrarion panels
used in cases where the ICANN UDRP process is employed would be adequate
to the task of sorting out whether some RIPE member had or had not been
deliberately hijacking IP space.  It's just not really that technically
complicated to see what's really going on in these instances.

Other than that, the only thing standing in the way of using a process
modeled on the UDRP process for quickly and efficiently adjudicating a
case of alleged IP block hijacking is the cost.  Who would pay?  I've
found and brought to public attention a few hijacks in my time, and in
most or all of these cases, I would have been happy to have been the
"prosecutor" presenting the case (and in effect, I actually was) but I'm
not at all keen on the notion of -me- shelling out $1,000-$2,000 (USD)
to expeditiously resolve any such case.  And I don't know anyone else
who would be easger to do this either.  So obviously, that's a rather
big fly in the ointment.  Justice is good.  Justice is admirable.  But
like many good things, it may have a finite and non-zero cost.  So who
would pay for the justice sought, assuming that a policy based on UDRP
were adopted (using outside arbitrators) for adjudicating these matters?
I have no answer to that, but felt that it might be of value to put
forward the general idea, and the question.


Regards,
rfg