[anti-abuse-wg] 2019-04 Discussion Phase (Validation of "abuse-mailbox")

I will interject here and say that the WG exists because of the community, not the NCC. There may be perceived hair splitting here, but it is important.

Obviously 2019-04 does directly ask the NCC to take an action, but we aren't here because of that organisation, we're here because we care about the operation of the Internet.

As to why we're having this discussion again, it's because the Co-Chairs judged that a sufficient portion of the Working Group wanted us to and I think the conversation so far has proven that judgement to be correct.

There may be intractable issues here, it's possible we're even asking the wrong questions and certainly we would love to hear from voices that haven't been active in this conversation before, in addition to those who have. This isn't a simple problem, for a variety of reasons, including that 70+ country, 20,000+ members consideration, but remember, Jordi isn't the only person who can propose policies or policy changes and I would encourage others to think about other questions we could ask?

Thanks,

Brian
Co-Chair, RIPE AA-WG


Brian Nisbet

Service Operations Manager

HEAnet CLG, Ireland's National Education and Research Network

1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland

+35316609040 brian.nisbet at heanet.ie www.heanet.ie

Registered in Ireland, No. 275301. CRA No. 20036270

________________________________
From: anti-abuse-wg <anti-abuse-wg-bounces at ripe.net> on behalf of Suresh Ramasubramanian <ops.lists at gmail.com>
Sent: Thursday 30 April 2020 14:07
To: Sascha Luck [ml] <aawg at c4inet.net>; anti-abuse-wg at ripe.net <anti-abuse-wg at ripe.net>
Subject: Re: [anti-abuse-wg] 2019-04 Discussion Phase (Validation of "abuse-mailbox")


CAUTION[External]: This email originated from outside of the organisation. Do not click on links or open the attachments unless you recognise the sender and know the content is safe.


What would get discussed in an anti abuse wg? All the reasons why the organisation due to which the wg exists must sit on their thumbs and do nothing about abuse?

--srs
________________________________
From: anti-abuse-wg <anti-abuse-wg-bounces at ripe.net> on behalf of Sascha Luck [ml] <aawg at c4inet.net>
Sent: Thursday, April 30, 2020 6:31:11 PM
To: anti-abuse-wg at ripe.net <anti-abuse-wg at ripe.net>
Subject: Re: [anti-abuse-wg] 2019-04 Discussion Phase (Validation of "abuse-mailbox")

On Thu, Apr 30, 2020 at 12:42:09PM +0000, Suresh Ramasubramanian wrote:
>RIPE NCC need not decide whether a behaviour is legal or not in order to prohibit use of resources that it allocates for such behaviour.
>
>Wearing a T-shirt, shorts and flip flops is perfectly legal and yet you can be refused entry into a fancy restaurant if you wear them.
>
>Nobody gets to sue the restaurant for refusing admission by claiming that tshirts and flip flops are perfectly legal attire, and even nudity is legal in some parts of Europe (German topless and nude beaches say).

If this restaurant were the only source of food in a region, it
would damn well be illegal to refuse service no matter how (or
if) the client is dressed.

Why are we havijg thjis discussion yet again?

rgds,
Sascha Luck

>
>--srs
>________________________________
>From: Nick Hilliard <nick at foobar.org>
>Sent: Thursday, April 30, 2020 5:43:04 PM
>To: Suresh Ramasubramanian <ops.lists at gmail.com>
>Cc: anti-abuse-wg at ripe.net <anti-abuse-wg at ripe.net>
>Subject: Re: [anti-abuse-wg] 2019-04 Discussion Phase (Validation of "abuse-mailbox")
>
>Suresh Ramasubramanian wrote on 30/04/2020 01:58:
>> Why would I ask about something I am posting as an individual in my
>> personal capacity?
>
>because your day job involves abuse / security and in that capacity you
>may have access to good quality legal resources.
>
>> I see great pains being taken to have NCC stay hands off and arms length
>> from abuse issues at its members. I understand the motivation.
>>
>> However, being in a fiduciary role - with IPv4 being traded like
>> currency these days the description fits - RIPE NCC can’t not get involved.
>>
>> I am concerned that this is eventually going to lead to heavy handed
>> state regulation if a regulator gets involved after some particularly
>> egregious misbehaviour by a (hypothetical at this point but the risk
>> exists or might even exist now) shell company that gets itself
>> membership, even LIR status and then uses a large allocation of IPs
>> exclusively for crime.
>>
>> NCC owes it to the rest of its membership and the internet community at
>> large to take a more active role in this matter.
>>
>> Though those of us that are saying this are probably voices in the
>> wilderness at this point.
>
>Couple of general observations:
>
>- internet abuse is a specific instance of general societal abuse. It's
>a complex problem and one where punishment / the threat of punishment is
>one of many methods of handling it, and arguably not one of the better
>ones from a general application point of view.
>
>- The RIPE NCC is not constituted to evaluate what is and isn't legal in
>the 75+ countries that it services.  E.g. should it revoke numbering
>resources due to CSAM because that's illegal in NL?  What about
>blasphemous material, which is such a no-no in several other service
>countries that it attracts capital punishment?  It's a difficult
>proposition to suggest that the RIPE NCC should start getting into the
>business of evaluating what is and isn't abuse.
>
>- we already have structures in place to handle evaluation of what
>constitutes acceptable or unacceptable behaviour.  The international
>nature of the internet has strained this to the point where it often
>doesn't work.
>
>- there's a consistent undercurrent of thought here of feeling that
>because other societal mechanisms for controlling abuse have not stopped
>abuse on the internet, that the RIPE NCC is obliged to act.  This
>assumption needs to be questioned.
>
>- almost all of the policy proposals in AAWG over the last several years
>have been aimed at using the RIPE number registry as a social behaviour
>enforcement mechanism.  There are other ways of handling social
>behaviour issues, e.g. standards creation + compliance, community
>forums, etc, etc, etc.
>
>- complex problems aren't amenable to simple fixes.
>
>- the primary concern expressed by the people I've talked to in law
>enforcement is: "where should the warrant be served?"
>
>- the RIPE NCC operates in a complex legal environment.  There's a
>substantial risk that the types of proposals that are being pushed in
>AAWG would be found to be illegal and would open the organisation up to
>damages or prosecution if applied (e.g shutting down a company because
>they insisted on using a web form instead of SMTP for handling abuse
>reports).  Alex de Joode's emails in the last round of discussion
>indicated some of the difficulties involved here.
>
>Nothing in any of this invalidates the frustration that everyone has for
>continued problems relating to fraud and abuse.
>
>Nick

-------------- next part --------------
An HTML attachment was scrubbed...
URL: </ripe/mail/archives/anti-abuse-wg/attachments/20200430/8ce5b7bf/attachment.html>