2013-01 New Policy Proposal (Openness about Policy Violations)
![](https://secure.gravatar.com/avatar/abc3db61010cc890b177b2dc96e32bdd.jpg?s=120&d=mm&r=g)
Dear Colleagues, A new RIPE Policy Proposal has been made and is now available for discussion. You can find the full proposal at: https://www.ripe.net/ripe/policies/proposals/2013-01 We encourage you to review this proposal and send your comments to <anti-abuse-wg@ripe.net> before 14 March 2013. Regards Emilio Madaio Policy Development Officer RIPE NCC
![](https://secure.gravatar.com/avatar/1f6335590da3d7fe44697e44ee390206.jpg?s=120&d=mm&r=g)
Hi Sander, I think I understand the intent of the proposal, however I would think I would want a bit more reluctant in going overboard on the transparency. What I read in the proposal is that you want to know if you made a complained, that you want to know the status, steps taken etc. However until that is processed (resources revoked), is it required to have it published publicly? I don't think so, especially to avoid slander as the form of attack by anonymous complainers. If someone complains about someone/somebody/resource, should it not be a better way to have that status info between the complainer, the owner of the resource / object and RIPE ? Especially if you want to make sure that everyone involved is updated about the status. That could be done behind a RIPE NCC account, where the owner of the resource can see who has complained and the complainer can see the status or a ticket status system with a unique ID per entry and a pin number for added safety. If there are things that are not correct and resources are revoked, it could be listed somewhere that the resource was revoked based on a violation of the policy, with a key-word indicating why (incorrect contact details or contact lost, returned or policy violation etc. ) Investigated complains, which are processed but no violation, should be communicated back to the complainer, but not posted publicly imho. The idea of publicly publishing entries about certain resource (holders) based on anonymous complains is something I don't like. Yes I think I understand why one would want to be anonymous in certain cases, but if we are going to publish that kind of data, it should only be the actual problems and not all open and closed cases. Regards, Erik Bais
![](https://secure.gravatar.com/avatar/dee82a22b9a73f459fe180128811e4c1.jpg?s=120&d=mm&r=g)
Hi Erik,
I think I understand the intent of the proposal, however I would think I would want a bit more reluctant in going overboard on the transparency.
What I read in the proposal is that you want to know if you made a complained, that you want to know the status, steps taken etc.
Correct
However until that is processed (resources revoked), is it required to have it published publicly? I don't think so, especially to avoid slander as the form of attack by anonymous complainers.
If someone complains about someone/somebody/resource, should it not be a better way to have that status info between the complainer, the owner of the resource / object and RIPE ? Especially if you want to make sure that everyone involved is updated about the status.
Ok
That could be done behind a RIPE NCC account, where the owner of the resource can see who has complained and the complainer can see the status or a ticket status system with a unique ID per entry and a pin number for added safety.
I still would like to give complainers the option not to have their identity published. That option already exists today and I don't want to remove it. If someone wants to comlain about i.e. a criminal organisation I can understand their need to remain anonymous (at least publicly)
If there are things that are not correct and resources are revoked, it could be listed somewhere that the resource was revoked based on a violation of the policy, with a key-word indicating why (incorrect contact details or contact lost, returned or policy violation etc. )
That is in the proposed 'returned' file.
Investigated complains, which are processed but no violation, should be communicated back to the complainer, but not posted publicly imho.
That would be an acceptable compromise for me.
The idea of publicly publishing entries about certain resource (holders) based on anonymous complains is something I don't like. Yes I think I understand why one would want to be anonymous in certain cases, but if we are going to publish that kind of data, it should only be the actual problems and not all open and closed cases.
I still want to have a bit more openness than that. I see that we'll never get consensus on publishing all reports. I wanted to see where the limits are, and publishing everything seems to go too far :-) I want to suggest the following direction for this proposal: Change section 1 (1. Transparency on reported policy violations) to: - RIPE NCC publishes statistics on complaints/reports (number of complaints in each state: new, under investigation, etc) - RIPE NCC provides a way for the complainer and resource holder to see the progress, keeping the currently existing privacy options And leave section 2 (2. Transparency on reclaimed resources) as it currently is. I haven't seen any objections to that part yet. Thanks, Sander
![](https://secure.gravatar.com/avatar/1f6335590da3d7fe44697e44ee390206.jpg?s=120&d=mm&r=g)
Hi Sander,
That could be done behind a RIPE NCC account, where the owner of the resource can see who has complained and the complainer can see the status or a ticket status system with a unique ID per entry and a pin number for added safety.
I still would like to give complainers the option not to have their identity published. That option already exists today and I don't want to remove it. If someone wants to comlain about i.e. a criminal organisation I can understand their need to remain anonymous (at least publicly)
As I said in my email, I understand the requirement for anonymous communication (so that basically removes the option of using a RIPE NCC account :-) ), however one should also take their own safety in mind and the fact that in case of harassment or abuse, the RIPE NCC might get forced by court to disclose all information like: - mail information - Source IP address(es) - (IP address) log information from the whois db for certain searches - date / timestamps etc. and other things that might provide insight in certain disclosing the identity of a certain complainer. It should be stated clearly to the complainer that information won't be disclosed willingly, but that the RIPE NCC has to act according to local law and that it might have to disclose information based on a court ruling. Regards, Erik Bais
![](https://secure.gravatar.com/avatar/dee82a22b9a73f459fe180128811e4c1.jpg?s=120&d=mm&r=g)
Hi Erik,
It should be stated clearly to the complainer that information won't be disclosed willingly, but that the RIPE NCC has to act according to local law and that it might have to disclose information based on a court ruling.
I am sure the NCC legal department can take care of the necessary procedures for this :-) Thanks, Sander
participants (3)
-
Emilio Madaio
-
Erik Bais
-
Sander Steffann