[anti-abuse-wg] 2019-03 and over-reach

Hi Nick,

El 23/3/19 12:32, "Nick Hilliard" <nick at foobar.org> escribió:

    JORDI PALET MARTINEZ via anti-abuse-wg wrote on 22/03/2019 22:55:
    > The legal bindings of the NCC already have that for those that don’t 
    > follow existing policies, don’t pay bills, etc. So, the proposal is 
    > adding in the table a policy for confirming what is a hijack according 
    > to the community consensus. Same way we did for how we distribute 
    > resources, do transfers, etc.
    
    Hi Jordi,
    
    couple of things:
    
    1. it's not the job of the RIPE NCC to make up for a short-fall of civil 
    legislation in this area, no matter how distasteful we might find the 
    consequences of this;

And we aren't doing that.
    
    2. you can throw anything into a contract, but that doesn't mean it's 
    enforceable or even lawful.

If our membership/SSA agreement includes a clause to allow that, yes, we can, unless a new law or court order come into force later that say that "this or that policy is against law".
    
    In other words, if the RIPE Community were to pass a particular policy, 
    that wouldn't mean the policy would automatically be binding on the RIPE 
    NCC membership, even if the RIPE NCC SSA includes a clause to state that 
    a member will adhere to RIPE policies.

Please read my previous examples of the beer or the swimming cap. Doesn't matter if those conditions where in the membership agreement since the beginning or have been adopted under the membership agreement rules.
    
    In this particular case, the suggestion is for the RIPE NCC to start 
    making judgements about potentially legal actions between second or 
    third parties, potentially involving non-related resources and to deny 
    and/or withdraw number registration services on that basis.  This does 
    not sound legally enforceable.

No, it is not a matter of parties. It is a matter of the membership rules.

If somebody got resources from RIPE NCC using fake information, and there is a form for third parties (even if they aren't impacted at all by anything wrong with those resources) to report that case, it is clear that under our rules, those resources will be claimed back.

Otherwise everybody will also be able to fake the information to repeat the same. Rule are to be followed when you sign a membership agreement.
    
    What complicates things further is that the RIPE NCC has an effective 
    monopoly for internet number registration services in this part of the 
    world.  If withdrawal of these monopoly services were found to be 
    unlawful, this would be taken extremely seriously by any court or 
    regulatory authority.
 
If the reason for the withdrawal is doing actions that are used to make or facilitate illegal activities (again spam, DDoS, child pornography, etc.), I doubt it will be the reason for courts or regulators to change the situation. In fact, it might happen that then new laws are made to support that BGP hijacking is a criminal activity.

I can see that if there is any reason for a BGP hijacking to be done for a legitimate act (which I doubt), we can exclude it, and in fact that's why I suggested that in some cases the experts can consider a warning (for example, a student doing a research?).
   
    Nick
    



**********************************************
IPv4 is over
Are you ready for the new Internet ?
http://www.theipv6company.com
The IPv6 Company

This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.