- ripe-list - mailman.ripe.net

LIR and Member Agreements
by Alex de Joode 01 Feb '22

01 Feb '22

Hi Dennis, Thanks for the lengthy mail, you touch upon many valid points, however one point is not valid: Article 2.3 "The RIPE NCC reserves the right to amend this Agreement. The RIPE NCC shall notify the Member of such amendments at least one month before these amendments come into effect." This clause is almost certainly unenforceable. It is also ridiculous. It says the RIPE NCC can make any change it wants to this agreement at any time (after you have signed it) without any consultation with any individual, group or community and without any consensus, approval or acceptance and put the change into effect and expect all LIRs to comply with the change. If the NCC wants to fix the simple grammar errors, they would probably get away with it. Any substantive change would almost certainly be met with a legal challenge. They cannot impose a substantive change on 20k+ signatories. Actually, they can. Under Dutch law you have the option to update the T&C, inform your customers about the change and give them some time (3 months is standard) to either accept or move out. Customers can accept the updated T&C, by either doing nothing or by accepting them explicitly, so the new T&S will be come active on the communicated date. Or they can reject the changes, this means normally the agreement ends. This is a real shocker to many foreign companies (I know from experience), but it is possible and common practise in NL based contracts. -- IDGARA | Alex de Joode | alex(a)idgara.nl | +31651108221 On Mon, 31-01-2022 16h 20min, denis walker <ripedenis(a)gmail.com> wrote: > Colleagues > > [I make no apologies for the length of this email. There are so many > errors to discuss. For an overview you can stop reading at the line of > '----'. Below that is the detailed review of all the errors.] > > I have been reading lots of policies, procedures and > agreements/contracts over the last couple of months to catch up with > current and historical developments of address policy and it's > application to allocating resources. It has been an eye opener. Right > now I want to focus mainly on the 'RIPE NCC LIR Account Agreement'. > Most of the documents I have read are poorly written. This is probably > one of the worst. I will itemise below the details of what is wrong > with this document. But firstly I will point out some of the serious > mistakes. > > In this agreement there is a definition in Article 1... > > -RIPE NCC services > The Membership Services provided through an LIR account as specified > in the current version of the RIPE NCC Activity Plan. > > In the 'RIPE NCC Standard Service Agreement" there is also this > definition in Article 1... > > -RIPE NCC services > The Membership Services as specified in the current version of the > RIPE NCC Activity Plan. > > There are no Membership Services specified in the current version of > the RIPE NCC Activity Plan. There hasn't been such a specification > since the activity plan of 2017. So for the last 5 years all the > active SSAs and LIR Agreements have been referring to an 'empty list'. > As both these agreements revolve heavily around these services, I have > no idea what the legal significance is of agreements based on an empty > list of services. > > Another serious issue is the absolute, total lack of any legal > definition of an LIR (Local Internet Registry) and LIR account and the > relationship between LIR and Member. I have not been able to find any > such definitions anywhere on the ripe.net website. I fear they may be > mentioned in some early RIPE document written 20 years ago that no one > could reasonably be expected to find in relation to these agreements. > > Then we have in Article 3 of the SSA: > "the Member acknowledges and accepts that it has obtained the right to > use the RIPE NCC services under the conditions outlined in this > agreement." > > And in Article 3 of the LIR Agreement: > "the Member acknowledges and accepts that it has obtained the right to > use the RIPE NCC services through this LIR account under the > conditions outlined in this Agreement." > > So under what conditions can a Member use these (undefined) services? > -those in the SSA > -those in the LIR Agreement > -a superset of the two sets > -the intersection of the two sets > > ********** > I want to put forward a suggestion that the RIPE NCC engages the > services of, or employs, a professional contract lawyer to review and > if necessary re-write all of the agreements/contracts used by the RIPE > NCC. Or at least someone with legal training and experience in the > area of contract writing. > ********** > > It was said in a zoom meeting last Wednesday (about reviewing the PDP) > that we should keep to a minimum the legal terminology and rely on > common sense. That was a valid mindset in the 1990s when the internet > was mostly an 'old boys/girls club'. In 2022 this is a very different > global, critical industry. The IPv4 market has also changed this > industry. There is so much money invested in IPv4 addresses that one > 'wrong' decision by the RIPE community could face a legal challenge. > If the RIPE NCC has to go to court to defend such an action they would > have a better defence based on rock solid, well written, legally > watertight contracts than based on a set of poorly written, > contradictory documents, common sense and a generally accepted view of > how things work(ed). > > Almost every document I have read has mistakes in it. Some have lots > more than others. I wondered why people sign contracts with so many > mistakes. Then I realised that most of the Members are not native > English speakers, and neither are their lawyers. They almost certainly > pass these documents through some translation app. Probably they > accept some of the errors as translation errors. So if they go to > court over these contracts it will be a case of an LIR arguing over > what they think they signed, vs the RIPE NCC defending what they think > they wrote. Neither will be a true reflection of reality. > > I know some people will criticise me for pointing out 'trivial' > grammar errors in this document. (Some people will just criticise me > anyway.) They will say they are not important. There are much bigger > issues to deal with. We don't want to get lawyers involved in this > process. Common sense will always prevail. If it ain't broke don't fix > it...etc etc. This LIR Agreement is a legal contract at the core of > the RIRs business (and it is broken). The quality of this document > should reflect the professionalism of the RIR. As a legal contract it > should be rock solid, well written and legally watertight. If there is > ever a legal dispute with a Member, this contract, along with the > equally error ridden SSA, may take centre stage. Do you really want to > gamble on a contract that looks like it was written as an > undergraduate project? For a native English speaker reading these > documents, the grammar errors just leap off the page. They are trivial > to find and fix. (So why have they not already been fixed?) For the > legal and other content errors, a contract lawyer would not be > expected to make such basic, clumsy mistakes. It is the three 'C's > that present the biggest problem - Consistency, Continuity and > Contradiction. Someone needs to have a clear view in their mind of the > entire document set. When a document is changed or a new document is > written they should know where to look to ensure integrity is > maintained across the whole set. That simply has not been the case up > to now. > > ---------------------------------------------------- > > So let's look at this LIR agreement in more detail. I am basing my > comments on this version: > https://www.ripe.net/about-us/legal/ripe-ncc-lir-account-agreement > > There is no definition of LIR or LIR account or any explanation of the > relationship between a Member and an LIR (account). > > Article 1 > "The Membership Services provided through an LIR account as specified > in the current version of the RIPE NCC Activity Plan." > There is no list of services in the activity plan. > > Article 2.2 > "To enter into this Agreement for additional LIR accounts the Member > must send to the RIPE NCC...one copy of the Agreement containing the > handwritten signature of an authorised representative of the Member." > This is ambiguous. It could suggest you sign one agreement for the > initial LIR and one agreement for all additional LIR accounts, not one > agreement for 'each' additional account. It should say: > "To enter into this Agreement for each additional LIR account, the > Member must..." > > Is it possible for a Member to delegate operational control of an LIR > account to another (anonymous) company or natural person in the same > way some Members delegate management of their RIPE Database objects to > a consultant? It is not clear if an LIR account is an administrative > concept or something tangible that can be delegated. As the initial > LIR account is not subject to any agreement (see below) that one can > certainly be delegated. > > Article 2.3 > "The RIPE NCC reserves the right to amend this Agreement. The RIPE NCC > shall notify the Member of such amendments at least one month before > these amendments come into effect." > This clause is almost certainly unenforceable. It is also ridiculous. > It says the RIPE NCC can make any change it wants to this agreement at > any time (after you have signed it) without any consultation with any > individual, group or community and without any consensus, approval or > acceptance and put the change into effect and expect all LIRs to > comply with the change. If the NCC wants to fix the simple grammar > errors, they would probably get away with it. Any substantive change > would almost certainly be met with a legal challenge. They cannot > impose a substantive change on 20k+ signatories. > > The SSA says: > "2.3 The Member acknowledges and accepts that the RIPE NCC Standard > Service Agreement may be amended by a resolution of the General > Meeting of the RIPE NCC according to the procedure outlined in the > RIPE NCC Articles of Association. An amendment shall automatically > become effective upon the date mentioned in the resolution or the date > of first publication of the resolution of the General Meeting and the > full text of the amended agreement on https://www.ripe.net, whichever > is the latest, without the re-signing of the RIPE NCC Standard Service > Agreement being necessary." > The same conditions must apply to changing the LIR Agreement. > > Article 3.3 > "The Member acknowledges applicability of, and adheres to, the RIPE > Policies and RIPE NCC procedural documents." > Use of 'Member' and 'LIR' are interchanged throughout these documents. > This agreement is about an LIR account. Do policies also apply to the > LIR account or just to the Member? This is not clearly defined. > > Article 3.4 > "The Member shall provide the RIPE NCC with complete, updated and > accurate information necessary for the provision of the RIPE NCC > services and shall assist the RIPE NCC with audits and security checks > as outlined in the RIPE NCC procedural documents, and in particular > with the RIPE NCC procedural document “Due Diligence for the Quality > of the RIPE NCC Registration Data”." > Is this the same information required by Article 2.2 of the SSA? > Articles 2, 3 and 6 of the SSA overlap considerably with Articles 2 > and 3 of the LIR Agreement. Such overlaps encourage contradictions > between separate contracts. > > Article 3.6 refers to the document ‘Closure of Members, Deregistration > of Internet Resources and Legacy Internet Resources' > https://www.ripe.net/publications/docs/ripe-775 > This document (ripe-775) was last updated on 30 Dec 2021, which is > quite recent. Yet in Section B.1.b it says: > "Internet number resources are allocated/assigned based on a specific > need. When the original technical requirements or the business purpose > for the use of the Internet number resources changes, the > allocation/assignment becomes invalid. If the RIPE NCC notices any > change in the original technical criteria or the original business > purposes for using the Internet number resources, the RIPE NCC is > authorised to deregister the relevant Internet number resources." > > This conflicts with ripe-733 'IPv4 Address Allocation and Assignment > Policies for the RIPE NCC Service Region', Section 5.1 which says: > "On application for IPv4 resources LIRs will receive IPv4 addresses > according to the following: > > - All allocation requests are placed on a first-come-first-served > waiting list. No guarantees are given about the waiting time. > - The size of the allocation made will be exactly one /24. > - The sum of all allocations made to a single LIR by the RIPE NCC is > limited to a maximum of 256 IPv4 addresses (a single /24). If this > allocation limit has been reached or exceeded, an LIR cannot request > an IPv4 allocation under this policy." > > No mention of any 'need' based requirement. This has been the case at > least since November 2019. This shows the lack of continuity and > contradictions between these documents. > > Article 3.7 says: > "Unless otherwise specified in this Agreement, this Agreement is valid > only for one specific LIR account. If the Member wishes to operate an > additional LIR accounts, the Member shall sign an additional RIPE NCC > LIR Account Agreement." > > Note the plurality of "an additional LIR accounts". It may be a simple > typo. But as written it supports my comment above on Article 2.2 that > maybe only one agreement needs to be signed for all additional LIR > accounts. > > Article 4.2 > "The Member's obligation to pay any fees corresponding for the LIR > account of this Agreement" > 'for' instead of 'to' - Another simple grammar error. > > Article 4.3 > "The Member shall make the payment to the RIPE NCC within 30 days of > date of invoice" > of 'the' date - Another simple grammar error. (Or perhaps even 'within > 30 days of the date of the invoice') > > Article 4.4 > "without prejudice to any other of the RIPE NCC's rights which it may > revoke against the Member in connection with the latter's failure to > effect (timely) the payment." > 'other' is in the wrong place, 'to any of the RIPE NCC's other rights' > 'revoke' instead of 'invoke' > '(timely) the payment' instead of 'the (timely) payment' > More simple grammar errors. > > Article 4.1 refers to the 'RIPE NCC Charging Scheme 2022' and > Article 4.6 refers to the 'RIPE NCC Billing Procedure and Fee Schedule' document > This takes us off into billing and fees documents. I have reviewed > these documents at the end. > > Article 5.2 > "The Member shall be entitled to terminate this Agreement at any time." > It doesn't say if the Member needs to give any notice period. Maybe: > "The Member shall be entitled to terminate this Agreement at any time > with immediate effect." > > Article 6.1 > "The Member shall also be liable for all aspects of its use and all > that ensues from its use from the Internet number resources." > It should say 'its use of the Internet...' > This wording, 'its use', only puts liability onto the Member if they > use the resources themselves. It does not put liability onto the > Member if they allow someone else to use the resources by assigning > them. The wording should be 'the use' or 'any use'. Then the Member > accepts full liability for use of these resources by anyone. > > Article 6.6 > "The Member shall indemnify the RIPE NCC against any and all third > party claims filed against the RIPE NCC in relation to the Member's > use of the RIPE NCC services." > Again the indemnity is limited to claims resulting from only the > Member's use of the services. This article should say: > "The Member shall indemnify the RIPE NCC against any and all third > party claims filed against the RIPE NCC in relation to the any use of > the RIPE NCC services provided to this Member through any of it's LIR > accounts." > Then it doesn't matter who is using the services. > > Article 6.7 > "In any event the RIPE NCC's liability shall be limited to a maximum > amount equivalent to the Member's service fee of the relevant > financial year" > This may apply in the event of the Member filing a claim against the > RIPE NCC. If a third party files a claim against the RIPE NCC, I don't > think the RIPE NCC can set it's own limit on the claim within an > agreement the third party has not signed. > > Article 7.2 > "The RIPE NCC's intellectual property (agreements, documents, > software, databases, website, etc.) may only be used, reproduced and > made available to third parties upon prior written authorisation from > the RIPE NCC." > If the Member has been allocated address space and they sub-allocate > part of that space to another organisation, this is an acceptable use > of the address space. By making assignments from the sub-allocation > the second organisation will make use of the RIPE Database. This is an > acceptable use of the RIPE NCC's intellectual property (database) > without written authorisation needed. > > Article 8.2 > "Any disputes that may arise from this Agreement shall be settled in > accordance with the RIPE NCC Conflict Arbitration Procedure." > This highlights one of the base issues with this LIR Agreement. It > clearly started life as a copy of the SSA which was then modified to > create the LIR Agreement. If you replace 'this Agreement' with 'the > RIPE NCC SSA' you have the basis of Article 11.2 of the SSA. The > problem in this Article 8.2 is that the Conflict Arbitration Procedure > (ripe-691) is specific to the SSA. Disputes arising from the LIR > Agreement are not within scope, according to both the Introduction and > Section A.1. of the Procedure. But even in Article 11.2 of the SSA > "shall be settled" should be changed to "may be settled". There is > always the option to take a dispute to a national court. > > (Incidentally after a quick read, I only found one error in ripe-691. > In Section C.1. "timeframe cannot not exceed".) > > Article 2.2 > "By signing the RIPE NCC Standard Service Agreement as instructed by > the RIPE NCC the Member confirms that they have read, understood and > agree to be bound by the terms of this agreement for an initial LIR > account." > After writing all of the above I was told by a Member that they don't > sign an LIR Agreement for their initial LIR account. It is somehow > implied by signing the SSA. The LIR Agreement is only signed for > >

1 0

RIPE community session on proposed revised PDP - Next Steps
by Mirjam Kuehne 27 Jan '22

27 Jan '22

Dear colleagues, Many thanks to those who particpated in this very productive session yesterday. The recording, slides and minutes will be published soon. I will then send a summary to this list so we can continue the discussion here. Based on that we will publish a new draft Policy Development Process (PDP) document and share it with you. Kind regards, Mirjam RIPE Chair

1 0

NRO NC Election Result
by Ulka Athale 25 Jan '22

25 Jan '22

Dear colleagues, The election to fill one seat on the Number Resource Organization Number Council (NRO NC) / Address Supporting Organization Address Council (ASO AC) from the RIPE NCC service region took place during RIPE 83 (22-26 November 2021). Sander Steffann was elected for a three-year term starting in January 2022. Congratulations Sander! The original announcement made during the Closing Plenary of RIPE 83 can be found here: https://ripe83.ripe.net/archives/video/721/ The announcement posted to the NRO NC webpages can be found here: https://www.ripe.net/participate/internet-governance/internet-technical-com… The full list of NRO NC representatives is available at: https://www.nro.net/about/address-supporting-organization/the-nro-number-co… This announcement should have been sent shortly after the election results were announced. I apologise for this oversight and the delay in informing the list. Kind regards, Ulka Athale Senior Communications Officer RIPE NCC

1 0

RIPE NCC Open House: DNS4EU - 31 January, 13:00 UTC
by Chris Buckridge 25 Jan '22

25 Jan '22

Hi all, The European Commission’s recent launch of a tender process to establish a European public DNS resolver service (“DNS4EU”) has generated significant interest and attention. Reflecting that, the RIPE NCC will hold an ‘Open House’ online discussion next Monday, 31 January from 13:00-14:00 UTC (14:00-15:00 CET). We invite anyone with an interest in this issue to join for an opportunity to exchange insight and perspectives. RIPE NCC staff will provide a background presentation to kick off the discussion. You can find additional information and register for the session here: https://www.ripe.net/participate/meetings/open-house/ripe-ncc-open-house-dn… I look forward to seeing many of you there next Monday! Best regards, Chris Buckridge Advisor to the Managing Director, Global Strategic Engagement RIPE NCC

1 0

On RIPE Labs: The RIPE Chair Team Reports - Planning for 2022
by Mirjam Kuehne 24 Jan '22

24 Jan '22

Dear colleagues, In our first report of the year, as well as taking a look back at some of the highlights of 2021, we're also looking forward to new topics and challenges we as a community are likely to face in the year to come: https://labs.ripe.net/author/mirjam_kuhne/the-ripe-chair-team-reports-plann… Kind regards, Mirjam Kühne & Niall O'Reilly RIPE Chair Team

1 0

Re: [ripe-list] SBAS Operator Survey
by David Hausheer 24 Jan '22

24 Jan '22

Dear RIPE listeners, We'd like to bring to your attention that our Secure Backbone AS (SBAS) Operator Survey is still open and we would be very grateful for your response, which should not take more than 10 minutes of your time. Your answers will greatly help us to assess governance, feasibility and operator incentive aspects related to the deployment of our proposed SBAS architecture. The survey, together with a 3-minute video about SBAS, is available here: https://docs.google.com/forms/d/e/1FAIpQLSc4VCkqd7i88y0CbJ31B7tVXyxBlhEy_zs… Many thanks for your help! Best regards, David Hausheer On 16/12/2021 08:29, perrig(a)gmail.com wrote: > Dear RIPE, > > Knowing how challenging it is to apply new technologies to current > networks, in a collaboration between ETH, Princeton University, and > University of Virginia, we constructed a system that provides security > benefits for current Internet users while requiring minimal changes to > networks. Our design can be built on top of the existing Internet to > prevent routing attacks that can compromise availability and cause > detrimental impacts on critical infrastructure – even given a low adoption > rate. This provides benefits over other proposed approaches such as RPKI > that only protects a route’s origin first AS, or BGPsec that requires > widespread adoption and significant infrastructure upgrades. > > Our architecture, called Secure Backbone AS (SBAS), allows clients to > benefit from emerging secure routing deployments like SCION by tunneling > into a secure infrastructure. SBAS provides substantial routing security > improvements when retrofitted to the current Internet. It also provides > benefits even to non-participating networks and endpoints when > communicating with an SBAS-protected entity. > > Our ultimate aim is to develop and deploy SBAS beyond an experimental > scope. We have designed a survey to capture the impressions of the network > operator community on the feasibility and viability of our design. The > survey is anonymous and takes about 10 minutes to complete, including > watching a brief 3-minute introductory video. > > https://docs.google.com/forms/d/e/1FAIpQLSc4VCkqd7i88y0CbJ31B7tVXyxBlhEy_zs… > > We thank you for helping inform our further work on this project. We will > be happy to share the results with the community. > > With kind regards > Prateek Mittal, Adrian Perrig, Yixin Sun

1 0

Reminder: RIPE community session on proposed revised PDP - 26 January 2022
by Mirjam Kuehne 21 Jan '22

21 Jan '22

Dear colleagues, In case you missed the earlier announcement, here is the link and invitation for the meeting next week. You can find more details about the meeting in my mail from 12 January: https://www.ripe.net/ripe/mail/archives/ripe-list/2022-January/002410.html Kind regards, Mirjam Kühne ========= Topic: RIPE Workshop on revised PDP Time: Jan 26, 2022 16:00 - 17:30 Amsterdam time (UTC+1) Join Zoom Meeting https://ripe.zoom.us/j/98728370455?pwd=RXh5UStFRm9vaXFTMjVFcTJ4UERadz09 Meeting ID: 987 2837 0455 Passcode: 860568 Join by SIP 98728370455(a)zoomcrc.com Join by H.323 162.255.37.11 (US West) 162.255.36.11 (US East) 221.122.88.195 (China) 115.114.131.7 (India Mumbai) 115.114.115.7 (India Hyderabad) 213.19.144.110 (Amsterdam Netherlands) 213.244.140.110 (Germany) 103.122.166.55 (Australia Sydney) 103.122.167.55 (Australia Melbourne) 209.9.211.110 (Hong Kong SAR) 64.211.144.160 (Brazil) 69.174.57.160 (Canada Toronto) 65.39.152.160 (Canada Vancouver) 207.226.132.110 (Japan Tokyo) 149.137.24.110 (Japan Osaka) Meeting ID: 987 2837 0455 Passcode: 860568

1 0

New on RIPE Labs: RIPE NCC Information Security Controls Framework For Cloud Services
by Ivo Dijkhuis 18 Jan '22

18 Jan '22

Dear colleagues, Having shared the final version of our cloud strategy with you last October, we've now published a RIPE Labs article in which we present the RIPE NCC Cloud Security Controls Framework. This is the framework we'll be using to assess whether cloud providers meet the security requirements for our services. The details of how we came up with the framework and how it will be put into effect are available in the article: https://labs.ripe.net/author/ivodijkhuis/ripe-ncc-information-security-cont… If you have any questions or comments, we'd be happy to hear from you. Kind regards, Ivo Dijkhuis Senior Information Security Officer RIPE NCC

1 0

Preparation for RIPE community session on proposed revised PDP - 26 January 2022
by Mirjam Kuehne 12 Jan '22

12 Jan '22

Dear colleagues, As promised, here are some more details in preparation for the online session on the revised version of the PDP that we will hold on 26 January. You can find the zoom link at the end of this email. In April 2021 I sent two mails to this list with a number of concrete questions regarding suggested changes to the PDP. The first mail dealt with general changes to the document: https://www.ripe.net/ripe/mail/archives/ripe-list/2021-April/002203.html The second one focused specifically on the appeals process: https://www.ripe.net/ripe/mail/archives/ripe-list/2021-April/002204.html Please review the questions and reasoning behind the suggested changes laid out in these two emails as this will be the basis for our meeting. For reference, please also note the two documents that led to these suggested changes: - Review of the RIPE Appeals Procedure https://www.ripe.net/publications/docs/ripe-760 - Evolution of the RIPE Policy Development Process https://www.ripe.net/publications/docs/ripe-761 In my mail from 28 October I summarised the changes we made to the PDP based on the suggestions made in April: https://www.ripe.net/ripe/mail/archives/ripe-list/2021-October/002350.html You can find the new draft document at the link below. At the end of this web page, you will see how the new document differs from the current one: https://www.ripe.net/publications/docs/ripe-documents/other-documents/polic… Please let me know if you have any questions. Looking forward to a constructive session. Kind regards, Mirjam Kühne ============= Topic: RIPE Workshop on revised PDP Time: Jan 26, 2022 16:00 Amsterdam time (UTC+1) Join Zoom Meeting https://ripe.zoom.us/j/98728370455?pwd=RXh5UStFRm9vaXFTMjVFcTJ4UERadz09 Meeting ID: 987 2837 0455 Passcode: 860568 Join by SIP 98728370455(a)zoomcrc.com Join by H.323 162.255.37.11 (US West) 162.255.36.11 (US East) 221.122.88.195 (China) 115.114.131.7 (India Mumbai) 115.114.115.7 (India Hyderabad) 213.19.144.110 (Amsterdam Netherlands) 213.244.140.110 (Germany) 103.122.166.55 (Australia Sydney) 103.122.167.55 (Australia Melbourne) 209.9.211.110 (Hong Kong SAR) 64.211.144.160 (Brazil) 69.174.57.160 (Canada Toronto) 65.39.152.160 (Canada Vancouver) 207.226.132.110 (Japan Tokyo) 149.137.24.110 (Japan Osaka) Meeting ID: 987 2837 0455 Passcode: 860568

1 0

Confirmation of subscription
by Jason Larus Limited 12 Jan '22

12 Jan '22

jason.larus(a)gmail.com

1 0