Re: [members-discuss] Administrative procedures within RIPE NCC: Any way to soften it ?
Dear Clement, all Thank you for sharing your concerns and apologies for the late reply. We recognise that providing documentation can take a lot of time and keeps you from your real work. However, we need to be clear on exactly who the resource holder is - to prevent hijacks as you note, but also to avoid legal disputes over the resources in the future. This is a risk when company structures are changing or companies are being spun off, and untangling this to see what is actually changing is not always straightforward. Our transfer procedure was updated after a board resolution in 2016 which stated that all transfers, including mergers and acquisitions, must follow the RIPE transfer policy unless supported by documentation from a national authority[1]. This closed a well-known and abused loophole that members were using to transfer resources outside of the policy. The other important point to note here is that under Dutch law, memberships are not transferrable. What we therefore need to establish in these cases is whether a separate legal entity is receiving the resources. If this is indeed what's happening, they will need to become a member. This is because a non-member cannot receive resources and they are not able to assume the membership of the company they are getting the resources from. Of course, if the receiving party is already a member, they will not have to open an additional membership to acquire the resources. Finally, it is worth noting that we have invested quite a lot of effort into improving our due diligence processes. We have recently developed an approach that should ease a lot of the burden for members in terms of documentation. We will share some more details about this in the near future. Regards Athina Fragkouli Chief Legal Officer RIPE NCC [1] RIPE NCC Members and Multiple LIR Accounts - Decisions and Next Steps: https://www.ripe.net/ripe/mail/archives/ncc-announce/2016-April/001031.html
Hello, even if Dutch law doesn't allow memberships transfers, this problem can be solved easily. Just allow members to sign new SSA together with termination of existing SSA and *without* requirement of sign-up fee payment in such cases (where organisational change is properly documented). This quite simple administrative procedure is not blocked by law, is blocked only by current internal rules (designed and proposed to us primary by NCC staff/board). And these can be changed/updated... Out of curiosity - how many hijacks were caused by fraudlent organisational changes and how many disputes over the resources was there due to this (relatively to total number of changes)? - Daniel On 7/16/20 3:30 PM, Athina Fragkouli wrote:
Dear Clement, all
Thank you for sharing your concerns and apologies for the late reply.
We recognise that providing documentation can take a lot of time and keeps you from your real work. However, we need to be clear on exactly who the resource holder is - to prevent hijacks as you note, but also to avoid legal disputes over the resources in the future. This is a risk when company structures are changing or companies are being spun off, and untangling this to see what is actually changing is not always straightforward.
Our transfer procedure was updated after a board resolution in 2016 which stated that all transfers, including mergers and acquisitions, must follow the RIPE transfer policy unless supported by documentation from a national authority[1]. This closed a well-known and abused loophole that members were using to transfer resources outside of the policy.
The other important point to note here is that under Dutch law, memberships are not transferrable. What we therefore need to establish in these cases is whether a separate legal entity is receiving the resources. If this is indeed what's happening, they will need to become a member. This is because a non-member cannot receive resources and they are not able to assume the membership of the company they are getting the resources from. Of course, if the receiving party is already a member, they will not have to open an additional membership to acquire the resources.
Finally, it is worth noting that we have invested quite a lot of effort into improving our due diligence processes. We have recently developed an approach that should ease a lot of the burden for members in terms of documentation. We will share some more details about this in the near future.
Regards
Athina Fragkouli Chief Legal Officer RIPE NCC
[1] RIPE NCC Members and Multiple LIR Accounts - Decisions and Next Steps: https://www.ripe.net/ripe/mail/archives/ncc-announce/2016-April/001031.html
_______________________________________________ members-discuss mailing list members-discuss@ripe.net https://lists.ripe.net/mailman/listinfo/members-discuss Unsubscribe: https://lists.ripe.net/mailman/options/members-discuss/danny%40danysek.cz
On 16 Jul 2020, at 17:30, Daniel Suchy via members-discuss <members-discuss@ripe.net> wrote:
Hello, even if Dutch law doesn't allow memberships transfers, this problem can be solved easily. Just allow members to sign new SSA together with termination of existing SSA and *without* requirement of sign-up fee payment in such cases (where organisational change is properly documented).
This quite simple administrative procedure is not blocked by law, is blocked only by current internal rules (designed and proposed to us primary by NCC staff/board). And these can be changed/updated...
That is true. Re-reading the announcement from 2016, the intent at the time seems pretty clear https://www.ripe.net/ripe/mail/archives/ncc-announce/2016-April/001031.html <https://www.ripe.net/ripe/mail/archives/ncc-announce/2016-April/001031.html>
The Board has decided on a measure to be taken immediately to deter the acquiring of /22s of address space with the sole purpose of transferring it to another legal entity. The RIPE NCC will therefore broaden the definition of policy transfers by including network acquisitions in the scope of the transfer policy.
I am sure the board would like to hear from the broader membership if this should be changed. My recommendation would be an holistic approach to the fee structure rather than exceptions from the main rule that may require interpretation.
Out of curiosity - how many hijacks were caused by fraudlent organisational changes and how many disputes over the resources was there due to this (relatively to total number of changes)?
What we have is the number of transfers that are disputed in any way: We have been tracking those cases for a number of years: 2015: 5 2016: 5 2017: 7 2018: 13 2019: 16 2020: 9 (so far) Some of these went to arbitration: https://www.ripe.net/about-us/legal/arbitration/summary-of-arbitration-rulin... <https://www.ripe.net/about-us/legal/arbitration/summary-of-arbitration-rulings> Regards, Hans Petter Holen Managing Director RIPE NCC
Hello, On 7/22/20 3:15 PM, Hans Petter Holen wrote:
The Board has decided on a measure to be taken immediately to deter the acquiring of /22s of address space with the sole purpose of transferring it to another legal entity. The RIPE NCC will therefore broaden the definition of policy transfers by including network acquisitions in the scope of the transfer policy.
This is completly *unrelated* to this topic (organisational changes in well-established LIRs, which exists for many years). Board measurement was targetted against *new* LIRs, which were created just to grab declining IPv4 addresses (and I know this was huge problem). But this is like throwing the baby out with the bathwater. Why apply such requirement for changes requiring new payment to parties, where their organisational are well-documented and officially confirmed (by courts, company registries etc)? If company-spinoff is performed legally according to all laws and legal successor is clearly vissible even in formal public documentation (public company registry), I don't see logical reason to apply that "protective" measurements... that was not their purpose. It's simply extensive interpretation of the law and rules in my eyes just to simplify work at NCC. It's not a service for members, it's stick in the way making life much harder. And more expensive.
I am sure the board would like to hear from the broader membership if this should be changed.
It's quite complicated I think wait here from wider audience (with respect to recent topic-hijacks to unrelatted discussions in the past). And non-affected LIRs have no reason to raise their concerns. Until they'll face similar problems... that's normal behavior.
My recommendation would be an holistic approach to the fee structure rather than exceptions from the main rule that may require interpretation.
There's already such exception, which is widely in use. If I sign new SSA according to section 4.0 of RIPE-709, there's no signup payment (even SSA mentions signup payment requirement). Major question is still unanswered. If there's legal sucessor after documented organisational change, why isn't possible to sign new SSA and terminate existing one (action like during company name change). If needed, also transfer agreement can be signed in one batch to confirm change. Involved member did not asked for new addresses, he just wanted to move it's membership from one company to another, from mother to child... just because not only name, but also registration *number* changed (because legal spin-off procedure according to law forces this in some cases). And finally - we're even not talking about documented policies. As we see, this is simple board decision hidden deeply in mailing-lists archives, but NCC staff hides itself behind policies. And Dutch law is just another excuse, which doesn't have real justification. Finally, NCC staff (both registration services & legal department) aren't able to point to these decisions, that's real experience... I think these "board decisions" (which have long-term impact) should be also clearly documented on NCC website in parts, which are focused for particular task (organisational changes in this cases). - Daniel
Re-reading the announcement from 2016, the intent at the time seems pretty clear https://www.ripe.net/ripe/mail/archives/ncc-announce/2016-April/001031.html The Board has decided on a measure to be taken immediately to deter the acquiring of /22s of address space with the sole purpose of transferring it to another legal entity
This should have been a temporary change, and "undone" once it was no longer possible/practical/necessary to address. Penalising everyone to limit a few miscreants may be appropriate for an oppressive regime, but not for a member based organisation like RIPE 😝 Has this been raised with the board for review by anyone yet ? Rob
Hi, On Wed, Jul 22, 2020 at 03:15:38PM +0200, Hans Petter Holen wrote:
The Board has decided on a measure to be taken immediately to deter the acquiring of /22s of address space with the sole purpose of transferring it to another legal entity. The RIPE NCC will therefore broaden the definition of policy transfers by including network acquisitions in the scope of the transfer policy.
I am sure the board would like to hear from the broader membership if this should be changed.
Since there are no more "/22 to be acquired", I would argue for "this can be reverted, 2 years after the last /22 has been given out". While I did (and do) agree with the decision back then, the intent of the policy is "govern transfers between independent legal entities", and "I buy your business, including your assets" is not what was the original target (as this sort of "transfer" has always been possible, without explicit governing policy).
My recommendation would be an holistic approach to the fee structure rather than exceptions from the main rule that may require interpretation.
I would not object to that :-) Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279
Hello Athina, I do not deny the fact that transfer procedures have to be clear and somewhat strict in order to prevent hijacks/legal disputes/etc. I do not know which loophole you are refering on your email (I'd be curious about that one, btw, on a side note). Regarding the dutch law: Could you please let us know more about it ? If membership is not "transferrable" because of the dutch law, could you please at least try to create some specific use case, like ease new "forced" membership with no setup fees (and no /24 eligibility in that case, of course, in order to avoid abuses), if the "offering party" has to become an empty (and yet to terminate) LIR? Having to provide documentation, at first, and then having to create a new LIR with all the related paperwork then, and finally having to pay for two memberships for 2020 + signup fees sounds a bit like a punishment to me. And in the meantime, anything can be done or requested by any of those LIRs (Initially, I needed to request an ASN, which I still couldn't request) Let's see how your due diligence processes are improved, then :-) Thanks, -- Clément Cavadore Le jeudi 16 juillet 2020 à 15:30 +0200, Athina Fragkouli a écrit :
Dear Clement, all
Thank you for sharing your concerns and apologies for the late reply.
We recognise that providing documentation can take a lot of time and keeps you from your real work. However, we need to be clear on exactly who the resource holder is - to prevent hijacks as you note, but also to avoid legal disputes over the resources in the future. This is a risk when company structures are changing or companies are being spun off, and untangling this to see what is actually changing is not always straightforward.
Our transfer procedure was updated after a board resolution in 2016 which stated that all transfers, including mergers and acquisitions, must follow the RIPE transfer policy unless supported by documentation from a national authority[1]. This closed a well-known and abused loophole that members were using to transfer resources outside of the policy.
The other important point to note here is that under Dutch law, memberships are not transferrable. What we therefore need to establish in these cases is whether a separate legal entity is receiving the resources. If this is indeed what's happening, they will need to become a member. This is because a non-member cannot receive resources and they are not able to assume the membership of the company they are getting the resources from. Of course, if the receiving party is already a member, they will not have to open an additional membership to acquire the resources.
Finally, it is worth noting that we have invested quite a lot of effort into improving our due diligence processes. We have recently developed an approach that should ease a lot of the burden for members in terms of documentation. We will share some more details about this in the near future.
Regards
Athina Fragkouli Chief Legal Officer RIPE NCC
[1] RIPE NCC Members and Multiple LIR Accounts - Decisions and Next Steps: https://www.ripe.net/ripe/mail/archives/ncc-announce/2016-April/001031.html
_______________________________________________ members-discuss mailing list members-discuss@ripe.net https://lists.ripe.net/mailman/listinfo/members-discuss Unsubscribe: https://lists.ripe.net/mailman/options/members-discuss/ccavadore%40vedege.ne...
participants (6)
-
Athina Fragkouli -
Clement Cavadore -
Daniel Suchy -
Gert Doering -
Hans Petter Holen -
rob.golding＠astutium.com