<html> <head> <meta http-equiv="Content-Type" content="text/html; charset=Windows-1252"> </head> <body> <div> <div> <div style="direction: ltr;">RIPE NCC need not decide whether a behaviour is legal or not in order to prohibit use of resources that it allocates for such behaviour.</div> <div><br> </div> <div style="direction: ltr;">Wearing a T-shirt, shorts and flip flops is perfectly legal and yet you can be refused entry into a fancy restaurant if you wear them. </div> <div><br> </div> <div style="direction: ltr;">Nobody gets to sue the restaurant for refusing admission by claiming that tshirts and flip flops are perfectly legal attire, and even nudity is legal in some parts of Europe (German topless and nude beaches say).</div> </div> <div><br> </div> <div class="ms-outlook-ios-signature"> <div style="direction: ltr;">--srs</div> </div> </div> <hr style="display:inline-block;width:98%" tabindex="-1"> <div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Nick Hilliard <nick@foobar.org><br> <b>Sent:</b> Thursday, April 30, 2020 5:43:04 PM<br> <b>To:</b> Suresh Ramasubramanian <ops.lists@gmail.com><br> <b>Cc:</b> anti-abuse-wg@ripe.net <anti-abuse-wg@ripe.net><br> <b>Subject:</b> Re: [anti-abuse-wg] 2019-04 Discussion Phase (Validation of "abuse-mailbox")</font> <div> </div> </div> <div class="BodyFragment"><font size="2"><span style="font-size:11pt;"> <div class="PlainText">Suresh Ramasubramanian wrote on 30/04/2020 01:58:<br> > Why would I ask about something I am posting as an individual in my <br> > personal capacity?<br> <br> because your day job involves abuse / security and in that capacity you <br> may have access to good quality legal resources.<br> <br> > I see great pains being taken to have NCC stay hands off and arms length <br> > from abuse issues at its members. I understand the motivation.<br> > <br> > However, being in a fiduciary role - with IPv4 being traded like <br> > currency these days the description fits - RIPE NCC can’t not get involved.<br> > <br> > I am concerned that this is eventually going to lead to heavy handed <br> > state regulation if a regulator gets involved after some particularly <br> > egregious misbehaviour by a (hypothetical at this point but the risk <br> > exists or might even exist now) shell company that gets itself <br> > membership, even LIR status and then uses a large allocation of IPs <br> > exclusively for crime.<br> > <br> > NCC owes it to the rest of its membership and the internet community at <br> > large to take a more active role in this matter.<br> > <br> > Though those of us that are saying this are probably voices in the <br> > wilderness at this point.<br> <br> Couple of general observations:<br> <br> - internet abuse is a specific instance of general societal abuse. It's <br> a complex problem and one where punishment / the threat of punishment is <br> one of many methods of handling it, and arguably not one of the better <br> ones from a general application point of view.<br> <br> - The RIPE NCC is not constituted to evaluate what is and isn't legal in <br> the 75+ countries that it services. E.g. should it revoke numbering <br> resources due to CSAM because that's illegal in NL? What about <br> blasphemous material, which is such a no-no in several other service <br> countries that it attracts capital punishment? It's a difficult <br> proposition to suggest that the RIPE NCC should start getting into the <br> business of evaluating what is and isn't abuse.<br> <br> - we already have structures in place to handle evaluation of what <br> constitutes acceptable or unacceptable behaviour. The international <br> nature of the internet has strained this to the point where it often <br> doesn't work.<br> <br> - there's a consistent undercurrent of thought here of feeling that <br> because other societal mechanisms for controlling abuse have not stopped <br> abuse on the internet, that the RIPE NCC is obliged to act. This <br> assumption needs to be questioned.<br> <br> - almost all of the policy proposals in AAWG over the last several years <br> have been aimed at using the RIPE number registry as a social behaviour <br> enforcement mechanism. There are other ways of handling social <br> behaviour issues, e.g. standards creation + compliance, community <br> forums, etc, etc, etc.<br> <br> - complex problems aren't amenable to simple fixes.<br> <br> - the primary concern expressed by the people I've talked to in law <br> enforcement is: "where should the warrant be served?"<br> <br> - the RIPE NCC operates in a complex legal environment. There's a <br> substantial risk that the types of proposals that are being pushed in <br> AAWG would be found to be illegal and would open the organisation up to <br> damages or prosecution if applied (e.g shutting down a company because <br> they insisted on using a web form instead of SMTP for handling abuse <br> reports). Alex de Joode's emails in the last round of discussion <br> indicated some of the difficulties involved here.<br> <br> Nothing in any of this invalidates the frustration that everyone has for <br> continued problems relating to fraud and abuse.<br> <br> Nick<br> </div> </span></font></div> </body> </html>