Publication of Information (Draft-2) Archived

Proposal

1. Summary of the problem being addressed by this proposal

Recent discussions in the RPD and unprecedented situations in AFRINIC demonstrated that some of the information provided for the justification of the requests for resources could be used maliciously and not discovered at a first sight when those recourses are allocated/assigned.

This is especially harmful to the community and the AFRINIC region in general when resources are being exhausted as is the case now for IPv4 and must be avoided.

At the same time, it is understandable that the justification of a request for resources can be confidential as it can provide insights into a business plan to competitors. However, it is also obvious that in the Internet business, time passes very quickly and the need for confidentiality vanishes very quickly. It is difficult to believe, for example, that you request resources for the next 5 years and only in year 5 your business will be public.

In summary, the problem is that long-term confidentiality of a resource request justification is against the principles of openness, transparency and fairness.

2. Summary of how this proposal addresses the problem

This simple proposal looks for the publication of information about resource request justifications after a community agreed period of time unless there is a valid demonstration of the need to extend the confidentiality period.

Note that the information to be published is not the already existing resource registration in whois as per the actual CPM. This proposal looks for publication of the overall resource request justification (justification of the need), which allows understanding of the justified need is sustained at the publication time or not.

3. Proposal

New 13.0 of the CPM, as follows:

Revision History

Revision History

AFRINIC Policy Impact Assessment

AFRINIC Staff Assessment

15 November 2021

1.0) Staff Interpretation & Understanding of the proposal

1. AFRINIC allocates resources(IPv4, IPv6, and ASN) to its members based on the latter submitting their needs to justify the resource requests.
2. As per this proposal, AFRINIC must publicly publish a short summary of the justifications provided in the resource requests two years after the resource has been issued to the Resource Member.
3. The proposal leaves the decision of where to publish these justification summaries to staff.
4. The proposal explains that this will be done as follows:-
   1. AFRINIC will monitor the resources that have reached 21 monthly anniversary date
   2. AFRINIC staff will prepare a summary of the justification needs for these resources, based on the information that is held in tickets pertaining to these resource requests
   3. AFRINIC will send a notification to those members holding the said resources, which will also contain the summary (this happens 3 months prior to the 2-year anniversary date)
   4. The Resource can either agree to the publication or provide an alternative text or defer the communication by stating their reasons(extension of 1 year) within one month of receiving the notification.
   5. AFRINIC has one month to accept the justification for non-publication of the details of its needs and can escalate to the AFRINIC Board if in doubt.
5. Mention is made that 'This policy shall be implemented in such a way that all the resources allocated/assigned for over 2 years, will be chronologically warned, allowing the staff to process the possible responses of “non-disclosure” without requiring extra human resources. Staff interprets this as meaning the implementation will be done so that resource members automatically receive a notification request with a copy of their and the Resource Members shall confirm to AFRINIC if the text can be published or provide alternate text or request for an extension.

2.0) AFRINIC Staff Comments

1. AFRINIC has issued ~6500 ASNs, IPv4 and IPv6 prefixes to its members since 2005
2. ~5000 of the above have reached their 2-year anniversary to date.
3. The needs justifications are provided to AFRINIC through the different platforms made available to gather such information and are therefore kept in tickets that are logged as a result of a resource request.
4. The information submitted by AFRINIC Resource Members is bound to be confidential and used only for the evaluation of the resource requests in compliance with the resource policies in the policy manual. ]
5. AFRINIC neither keeps a summary of these justifications nor has sought the agreement of the AFRINIC Resource Member so that same can be published.
6. The AFRINIC Resource Members to whom resources have already been issued have not provided any agreement/consent that AFRINIC can publish a summary of their justification.
7. The author has clarified that staff is being mandated by the proposal to summarise the needs and share the latter with the Resource Members in the warning issued 3 months before the 2-year anniversary date of a particular resource. For ~5000 resources that have reached their 2-year anniversary date(issuance date is up to Nov 2019), staff will have to examine ~5000 records and make a summary
8. Staff will therefore do more work than "process the possible responses of “non-disclosure” without requiring extra human resources" & additional human resources will be required, even if a phased approach is being suggested by the author.
9. The proposal as styled lacks an element in regard to AFRINIC explicitly seeking the consent of the Resource Members to publicly publish its justification summary and the consequences of a member refusing to comply.
10. The attention of the author is drawn to the statement "allowing the staff to process the possible responses of “non-disclosure” without requiring extra human resources" and that staff will need to process ~5000 records pertaining to the ~5000 resources that have reached their 2-year anniversary. To date, AFRINIC has also issued ~6500 resources to its Resource Members.
11. AFRINIC takes note of the author's comments that automation may not be possible and further mentions that the justified needs do not exist on AFRINIC systems at the moment in a single standardised way.
12. We would like to mention that AFRINIC expects resulting questions, clarifications, and disagreements in respect to the text to be published or consent.
13. On the other hand, in the case of new member requests, the organisations may be requested to furnish an additional summary of their needs justification, in addition to the detailed needs, and provide their consent that the said summary will be publicly published 2 years from the date they were allocated/assigned their IPv4 and/or IPv6, ASN resources.

3.0) Staff Comments On Areas of Impact

Impact on Registry Functions

The attention of the PDWG and Author is drawn to Section 4(d) of the Registration Services Agreement "AFRINIC will comply with all applicable data protection and privacy laws of the Republic of Mauritius in its handling of data and information submitted to it by the Applicant in furtherance of an application for services and use thereof." The proposal as written exposes AFRINIC to a potential breach of section 4d of the Registration Services Agreement, should it be driven by the proposal to publish a public summary in the case where no feedback or consent is received from the member within 30 days.

The proposal will introduce an additional workload for the registry operations team to draw summaries for ~5000 support requests that have already reached the 2 years threshold. In addition, human resources will be required to handle the workload as well as manage the Resource members' subsequent requests.

Legal Assessment

The legal observations on the texts of the proposal are as follows:

1. The present proposal aims at providing for the disclosure/publication of information pertaining to a Resource Member’s needs, i.e. information which would have been shared with AFRINIC during the pre-contractual stage.
2. It is apposite to state that all information exchanged between AFRINIC and an applicant (resource member) either prior or during the tenure of the RSA fall under the regime of confidentiality at common law such that AFRINIC cannot, without the express consent of the concerned resource member or pursuant to a Judge's Order, disclose this information to third parties. In fact, this is not something that can unilaterally be imposed on individual resource members by AFRINIC through the latter’s PDP framework. Accordingly, there is no legal soundness to this proposal.

Financial Assessment

This section will be updated once clarifications have been received and confidentiality concerns have been addressed.

4.0) Implementation

The timeline will be made available once issues have been clarified.