Suresh Ramasubramanian wrote on 30/04/2020 01:58:
> Why would I ask about something I am posting as an individual in my
> personal capacity?

because your day job involves abuse / security and in that capacity you
may have access to good quality legal resources.

> I see great pains being taken to have NCC stay hands off and arms length
> from abuse issues at its members. I understand the motivation.
>
> However, being in a fiduciary role - with IPv4 being traded like
> currency these days the description fits - RIPE NCC can’t not get involved.
>
> I am concerned that this is eventually going to lead to heavy handed
> state regulation if a regulator gets involved after some particularly
> egregious misbehaviour by a (hypothetical at this point but the risk
> exists or might even exist now) shell company that gets itself
> membership, even LIR status and then uses a large allocation of IPs
> exclusively for crime.
>
> NCC owes it to the rest of its membership and the internet community at
> large to take a more active role in this matter.
>
> Though those of us that are saying this are probably voices in the
> wilderness at this point.

Couple of general observations:

- internet abuse is a specific instance of general societal abuse. It's
a complex problem and one where punishment / the threat of punishment is
one of many methods of handling it, and arguably not one of the better
ones from a general application point of view.

- The RIPE NCC is not constituted to evaluate what is and isn't legal in
the 75+ countries that it services.  E.g. should it revoke numbering
resources due to CSAM because that's illegal in NL?  What about
blasphemous material, which is such a no-no in several other service
countries that it attracts capital punishment?  It's a difficult
proposition to suggest that the RIPE NCC should start getting into the
business of evaluating what is and isn't abuse.

- we already have structures in place to handle evaluation of what
constitutes acceptable or unacceptable behaviour.  The international
nature of the internet has strained this to the point where it often
doesn't work.

- there's a consistent undercurrent of thought here of feeling that
because other societal mechanisms for controlling abuse have not stopped
abuse on the internet, that the RIPE NCC is obliged to act.  This
assumption needs to be questioned.

- almost all of the policy proposals in AAWG over the last several years
have been aimed at using the RIPE number registry as a social behaviour
enforcement mechanism.  There are other ways of handling social
behaviour issues, e.g. standards creation + compliance, community
forums, etc, etc, etc.

- complex problems aren't amenable to simple fixes.

- the primary concern expressed by the people I've talked to in law
enforcement is: "where should the warrant be served?"

- the RIPE NCC operates in a complex legal environment.  There's a
substantial risk that the types of proposals that are being pushed in
AAWG would be found to be illegal and would open the organisation up to
damages or prosecution if applied (e.g shutting down a company because
they insisted on using a web form instead of SMTP for handling abuse
reports).  Alex de Joode's emails in the last round of discussion
indicated some of the difficulties involved here.

Nothing in any of this invalidates the frustration that everyone has for
continued problems relating to fraud and abuse.

Nick