[anti-abuse-wg] 2019-04 Discussion Phase (Validation of "abuse-mailbox")

Even if it's the only restaurant serving food in the region it can
impose restrictions, as long as they are reasonable.


And having a working abuse e-mail address seems very reasonable for any
kind of organization working in the internet.

There are many norms that are not laws, that still apply. Try to get on
a plane misbehaving. Try to enter a government building misbehaving.


We're having this discussion, because the "it will go away if we ignore
it" approach, is just not working.

Serge



On 30.04.20 15:01, Sascha Luck [ml] wrote:
> On Thu, Apr 30, 2020 at 12:42:09PM +0000, Suresh Ramasubramanian wrote:
>> RIPE NCC need not decide whether a behaviour is legal or not in order
>> to prohibit use of resources that it allocates for such behaviour.
>>
>> Wearing a T-shirt, shorts and flip flops is perfectly legal and yet
>> you can be refused entry into a fancy restaurant if you wear them.
>>
>> Nobody gets to sue the restaurant for refusing admission by claiming
>> that tshirts and flip flops are perfectly legal attire, and even
>> nudity is legal in some parts of Europe (German topless and nude
>> beaches say).
> 
> If this restaurant were the only source of food in a region, it
> would damn well be illegal to refuse service no matter how (or
> if) the client is dressed.
> 
> Why are we havijg thjis discussion yet again?
> 
> rgds,
> Sascha Luck
> 
>>
>> --srs
>> ________________________________
>> From: Nick Hilliard <nick at foobar.org>
>> Sent: Thursday, April 30, 2020 5:43:04 PM
>> To: Suresh Ramasubramanian <ops.lists at gmail.com>
>> Cc: anti-abuse-wg at ripe.net <anti-abuse-wg at ripe.net>
>> Subject: Re: [anti-abuse-wg] 2019-04 Discussion Phase (Validation of
>> "abuse-mailbox")
>>
>> Suresh Ramasubramanian wrote on 30/04/2020 01:58:
>>> Why would I ask about something I am posting as an individual in my
>>> personal capacity?
>>
>> because your day job involves abuse / security and in that capacity you
>> may have access to good quality legal resources.
>>
>>> I see great pains being taken to have NCC stay hands off and arms length
>>> from abuse issues at its members. I understand the motivation.
>>>
>>> However, being in a fiduciary role - with IPv4 being traded like
>>> currency these days the description fits - RIPE NCC can�t not get
>>> involved.
>>>
>>> I am concerned that this is eventually going to lead to heavy handed
>>> state regulation if a regulator gets involved after some particularly
>>> egregious misbehaviour by a (hypothetical at this point but the risk
>>> exists or might even exist now) shell company that gets itself
>>> membership, even LIR status and then uses a large allocation of IPs
>>> exclusively for crime.
>>>
>>> NCC owes it to the rest of its membership and the internet community at
>>> large to take a more active role in this matter.
>>>
>>> Though those of us that are saying this are probably voices in the
>>> wilderness at this point.
>>
>> Couple of general observations:
>>
>> - internet abuse is a specific instance of general societal abuse. It's
>> a complex problem and one where punishment / the threat of punishment is
>> one of many methods of handling it, and arguably not one of the better
>> ones from a general application point of view.
>>
>> - The RIPE NCC is not constituted to evaluate what is and isn't legal in
>> the 75+ countries that it services.  E.g. should it revoke numbering
>> resources due to CSAM because that's illegal in NL?  What about
>> blasphemous material, which is such a no-no in several other service
>> countries that it attracts capital punishment?  It's a difficult
>> proposition to suggest that the RIPE NCC should start getting into the
>> business of evaluating what is and isn't abuse.
>>
>> - we already have structures in place to handle evaluation of what
>> constitutes acceptable or unacceptable behaviour.  The international
>> nature of the internet has strained this to the point where it often
>> doesn't work.
>>
>> - there's a consistent undercurrent of thought here of feeling that
>> because other societal mechanisms for controlling abuse have not stopped
>> abuse on the internet, that the RIPE NCC is obliged to act.  This
>> assumption needs to be questioned.
>>
>> - almost all of the policy proposals in AAWG over the last several years
>> have been aimed at using the RIPE number registry as a social behaviour
>> enforcement mechanism.  There are other ways of handling social
>> behaviour issues, e.g. standards creation + compliance, community
>> forums, etc, etc, etc.
>>
>> - complex problems aren't amenable to simple fixes.
>>
>> - the primary concern expressed by the people I've talked to in law
>> enforcement is: "where should the warrant be served?"
>>
>> - the RIPE NCC operates in a complex legal environment.  There's a
>> substantial risk that the types of proposals that are being pushed in
>> AAWG would be found to be illegal and would open the organisation up to
>> damages or prosecution if applied (e.g shutting down a company because
>> they insisted on using a web form instead of SMTP for handling abuse
>> reports).  Alex de Joode's emails in the last round of discussion
>> indicated some of the difficulties involved here.
>>
>> Nothing in any of this invalidates the frustration that everyone has for
>> continued problems relating to fraud and abuse.
>>
>> Nick
> 

-- 
Dr. Serge Droz
Chair of the FIRST Board of Directors
https://www.first.org