2026-02 New Policy Proposal (Contractual Accountability Framework for Infrastructure-Level Network Abuse)
Please find attached Excedo Networks AB's comments on proposal 2026-02, reviewed by Excedo Security Operations Center. Drawing on our round-the-clock abuse investigations, coordination with law enforcement, and legal escalation work, we support stronger accountability but consider substantial revisions necessary before adoption. Our response addresses evidentiary standards, effective mitigation, proportionality, and procedural safeguards. We particularly highlight active ASNs and associated prefixes operating under unverifiable or struck-off entities, and the need to remove ROA deletion as standalone proof of remediation. We welcome further discussion with the proposer and the working group. Excedo Networks AB Michael Duffy, CEO/CISO _________________________________________________________________________ Excedo Networks AB - Jan Stenbecks Torg 17, 164 40 KISTA, SWEDEN Telephone: +46-8-5016 12 00 Email: michael.duffy@excedo.se<mailto:michael.duffy@excedo.se> Web: www.excedo.se _________________________________________________________________________ This e-mail (including any attachments) is confidential and may be privileged. It may be read, copied and used only by the intended recipient. If you are not the intended recipient, any dissemination, distribution or copying of this e-mail is strictly prohibited. If you have received this e-mail in error, please contact the sender immediately by return e-mail, then delete it from your system and do not disclose its contents to any person. No other person than the intended recipient may rely on this e-mail for any purpose and Excedo accepts no liability or responsibility for any reliance that a third party may place on it.
Hi Michael Thank you for your exceptionally thorough and operationally grounded analysis. Input of this caliber from an active Security Operations Center and Digital Crimes Unit is invaluable. It has taken me two days and a lot of deep thinking, but I believe I have addressed all your points. My responses are attached below. cheers denis Retired RIPE Database senior analyst & engineer On Tue, 13 Oct 2026 at 19:24, Michael Duffy via Security-wg < security-wg@ripe.net> wrote:
Please find attached Excedo Networks AB’s comments on proposal 2026-02, reviewed by Excedo Security Operations Center.
Drawing on our round-the-clock abuse investigations, coordination with law enforcement, and legal escalation work, we support stronger accountability but consider substantial revisions necessary before adoption.
Our response addresses evidentiary standards, effective mitigation, proportionality, and procedural safeguards.
We particularly highlight active ASNs and associated prefixes operating under unverifiable or struck-off entities, and the need to remove ROA deletion as standalone proof of remediation.
We welcome further discussion with the proposer and the working group.
*Excedo Networks AB* Michael Duffy, CEO/CISO _________________________________________________________________________ Excedo Networks AB – Jan Stenbecks Torg 17, 164 40 KISTA, SWEDEN <https://www.google.com/maps/search/Jan+Stenbecks+Torg+17,+164+40+KISTA,+SWEDEN?entry=gmail&source=g>
Telephone: +46-8-5016 12 00 Email: michael.duffy@excedo.se
Web: www.excedo.se
_________________________________________________________________________
*This e-mail (including any attachments) is confidential and may be privileged. It may be read, copied and used only by the intended recipient. If you are not the intended recipient, any dissemination, distribution or copying of this e-mail is strictly prohibited. If you have received this e-mail in error, please contact the sender immediately by return e-mail, then delete it from your system and do not disclose its contents to any person. No other person than the intended recipient may rely on this e-mail for any purpose and Excedo accepts no liability or responsibility for any reliance that a third party may place on it.*
----- To unsubscribe from this mailing list or change your subscription options, please visit: https://mailman.ripe.net/mailman3/lists/security-wg.ripe.net/ As we have migrated to Mailman 3, you will need to create an account with the email matching your subscription before you can change your settings. More details at: https://www.ripe.net/membership/mail/mailman-3-migration/
Colleagues, Many of you may see this as a complex proposal, but the core principle is very simple: - An End User engaged in infrastructure-level network abuse is listed on an Approved Blocklist. - An accredited CSIRT or affected operator or security agent notifies the RIPE NCC. - The RIPE NCC sends a remediation notice to the resource holder. - The resource holder can request a grace period extension or challenge the telemetry directly with the notifier via an anonymised ticket protocol. - If the resource holder takes the abusive infrastructure offline, the process ends. - If not, the RIPE NCC’s automated software programmatically applies an intermediate registry restriction. - Once the abusive infrastructure is taken offline, the restriction is automatically removed. That is it. The operational complexity sits entirely behind the scenes in determining which specific registry restriction applies. There are numerous permutations across RPKI deployments and RIPE Database object structures—permutations that can be routinely used or intentionally manipulated to hide non-compliant infrastructure. But that technical logic is handled programmatically by software, not by RIPE NCC staff making subjective judgments. I hope this provides clarity and gives colleagues the confidence to engage directly on the core objective of this framework. Cheers, *Denis Walker* *Retired RIPE Database Senior Analyst & Engineer* On Thu, 15 Oct 2026 at 20:03, denis walker <ripedenis@gmail.com> wrote:
Hi Michael
Thank you for your exceptionally thorough and operationally grounded analysis. Input of this caliber from an active Security Operations Center and Digital Crimes Unit is invaluable. It has taken me two days and a lot of deep thinking, but I believe I have addressed all your points. My responses are attached below.
cheers denis Retired RIPE Database senior analyst & engineer
On Tue, 13 Oct 2026 at 19:24, Michael Duffy via Security-wg < security-wg@ripe.net> wrote:
Please find attached Excedo Networks AB’s comments on proposal 2026-02, reviewed by Excedo Security Operations Center.
Drawing on our round-the-clock abuse investigations, coordination with law enforcement, and legal escalation work, we support stronger accountability but consider substantial revisions necessary before adoption.
Our response addresses evidentiary standards, effective mitigation, proportionality, and procedural safeguards.
We particularly highlight active ASNs and associated prefixes operating under unverifiable or struck-off entities, and the need to remove ROA deletion as standalone proof of remediation.
We welcome further discussion with the proposer and the working group.
*Excedo Networks AB* Michael Duffy, CEO/CISO _________________________________________________________________________ Excedo Networks AB – Jan Stenbecks Torg 17, 164 40 KISTA, SWEDEN <https://www.google.com/maps/search/Jan+Stenbecks+Torg+17,+164+40+KISTA,+SWEDEN?entry=gmail&source=g>
Telephone: +46-8-5016 12 00 Email: michael.duffy@excedo.se
Web: www.excedo.se
____________________________________________________________ _____________
*This e-mail (including any attachments) is confidential and may be privileged. It may be read, copied and used only by the intended recipient. If you are not the intended recipient, any dissemination, distribution or copying of this e-mail is strictly prohibited. If you have received this e-mail in error, please contact the sender immediately by return e-mail, then delete it from your system and do not disclose its contents to any person. No other person than the intended recipient may rely on this e-mail for any purpose and Excedo accepts no liability or responsibility for any reliance that a third party may place on it.*
----- To unsubscribe from this mailing list or change your subscription options, please visit: https://mailman.ripe.net/ mailman3/lists/security-wg.ripe.net/ As we have migrated to Mailman 3, you will need to create an account with the email matching your subscription before you can change your settings. More details at: https://www.ripe.net/membership/mail/mailman-3- migration/
participants (2)
-
denis walker -
Michael Duffy