[anti-abuse-wg] 2019-03 and over-reach

Hi,

> The aim of the 2019-03 proposal, as far as I understand it, is to grant the RIPE NCC the authority to make formal judgements about alleged abuse of network resources with the implicit intention that unless the party involved ends the alleged abuse, the RIPE NCC would enforce the judgement by LIR shutdown if the alleged infringer were a member, or refusal to provide service if the alleged infringer were not.
> 
> There are several aspects of this proposal that are pretty disturbing, but the two that jump out are 1. over-reach by the RIPE Community, 2. encroachment into the arena of supranational law enforcement.
> 
> I'm not going to go into the technical content of the proposal, despite the fact that I don't believe it would have any impact whatever on dealing with the problem of hijacking.  Limited companies can be registered for tiny amounts of money, and it's naive to believe that any actor who is dishonest enough to engage in persistent bgp hijacking would think twice about switching from one company to another in a heartbeat, in order to avoid the consequences of a policy like 2019-03.
> 
> Regarding over-reach, the RIPE NCC was instituted as a numbering registry and as a supporting organisation for the RIPE Community, whose terms of reference are described in the RIPE-1 document.  The terms of reference make it clear that the purpose of the RIPE Community and the RIPE NCC is internet co-ordination and - pointedly - not enforcement.  Proposal 2019-03 goes well outside the scope of what the RIPE Community and the RIPE NCC were constituted to do, and I do not believe that the Anti Abuse working group has the authority to override this.
> 
> The second point relates to the long term consequences of the proposal.  If the RIPE Community were to pass this policy, then it would direct the RIPE NCC to act as both a judiciary and policing agency for internet abuse.  Judgement and enforcement of behaviour are the competence of national governments, courts and law enforcement agencies, not of private companies.  If the RIPE NCC starts encroaching in this territory, it should expect national governments and law enforcement agencies to start taking an active interest in taking control.  This scenario would not be beneficial to the RIPE Community.
> 
> There are other pile of other considerations here, not least whether the RIPE NCC would have any legal jurisdiction to deregister resources where it had determined "abuse", and what the legal liability of the company would be if it were determined that they didn't have jurisdiction to act.
> 
> I don't question the motives of the authors of this proposal - neither of them has anything but the best of intentions in mind.  Regarding BGP hijacking in general, I've been involved in attempting to deal with many hijackings over the years and am as frustrated as anyone.  Like many other people in this community, I have also spent a lot of time and effort trying to deal with the problem from a practical point of view, both in terms of tooling and deployment standards for IXPs and service providers.
> 
> But, this is not how to handle the problem of BGP hijacking.  Even if it had the slightest possibility of making any difference at a technical level (which it won't), the proposal would set the RIPE Community and the RIPE NCC down a road which I believe would be extremely unwise to take from a legal and political point of view, and which would be difficult, if not impossible to manoeuver out of.

I fully agree with Nick. BGP hijacking has to be fought, but this is not the way…

Cheers,
Sander

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 488 bytes
Desc: Message signed with OpenPGP
URL: </ripe/mail/archives/anti-abuse-wg/attachments/20190322/42cce690/attachment.sig>