AFPUB-2018-GEN-001-DRAFT07

AFPUB-2018-GEN-001-DRAFT01: Abuse Contact Policy Update (Draft 1) Archived

8.1 Introduction This policy specifies a dedicated object

AFPUB-2018-GEN-001-DRAFT02: Abuse Contact Policy Update (Draft 2) Archived

3.1 Amending 8.0 of the CPM, as follows:

All resources allocated by AFRINIC must include a mandatory "abuse-c" contact attribute (abuse contact) in their corresponding WHOIS entry, with at least one valid, monitored and actively managed email inbox (abuse-mailbox) intended for receiving manual or automatic reports regarding abusive behavior, security issues, and the like.

Resources allocated/assigned by AfriNIC must include a mandatory "abuse-c" contact attribute (abuse contact) in their corresponding WHOIS entry, with at least one valid, monitored and actively managed email inbox (abuse-mailbox) intended for receiving manual or automatic reports regarding abusive behavior, security issues, and the like.

Lack of compliance will initially lead to the blocking of that account’s access to its resources, except for updating the abuse-c/abuse-mailbox. The account blocking will be released upon re-validation of the abuse-c/abuse-mailbox. AFRINIC will do a more exhaustive follow-up, in accordance with the relevant AFRINIC policies/procedures, especially those related to revocation of resources.

Lack of compliance will lead to a more exhaustive follow-up, warnings and blocking of certain services, at AFRINIC discretion, in accordance with the relevant policies/procedures.

an escalation method should be provided (for example, a mailbox such as " This email address is being protected from spambots. You need JavaScript enabled to view it. "), thus allowing for a re-validation (according to section 8.5 above) and even the intermediation by AFRINIC and, where appropriate, the application of the relevant policies/procedures, especially those related to revocation of resources. 3.2 Additional Information

8.6 Escalation to AFRINIC In order to allow escalation of fraudulent behavior (for example, an "abuse-mailbox" that only replies to AFRINIC's emails, or to messages with a specific subject or content), or failure to comply with the remaining aspects of this policy (incorrect or lack of response to cases of abuse), an escalation method should be provided, thus allowing for a re-validation (according to section 8.5 above). 3.2 Additional information:

The alphanumeric code will only be valid for a maximum of two working days. If the code is not entered within that time, the system will mark the "abuse-c" as "temporarily invalid” and will alert AFRINIC staff so that they can initiate a personalized follow-up with the LIR. If no reply is received confirming that the situation has been corrected, after an additional period of three business days, the "abuse-c" will be permanently marked as "invalid". The validation process

The alphanumeric code will only be valid for a maximum of 15 working days. If the code is not entered within that time, the system will mark the "abuse-c" as "temporarily invalid” and will alert AFRINIC staff so that they can initiate a personalized follow-up with the resource-holder. If no reply is received confirming that the situation has been corrected, after an additional period of 15 business days, the "abuse-c" will be permanently marked as "invalid". AFRINIC must ensure

2) Avoid automated processing. 3) Confirm that the person performing the validation understands the procedure and the policy, that they regularly monitor the "abuse-mailbox", that measures are taken, and that the abuse report receives a response. 4) Validation period

1. Avoid exclusively automated processing. 1. Confirm that the person performing the validation understands the procedure and the policy, that they regularly monitor the "abuse-mailbox", that measures are taken, and that the abuse report receives a response. 1. Validation period

3.2 Additional Information After this proposal is implemented, AFRINIC will publish the IRT also as abuse-c, in order to facilitate the search in whois for the same information, regardless if looking for abuse-c or IRT. The rest of the actual information in the IRT, can be kept as per the actual guidelines (which will need to be updated by AFRINIC). This is done in order to assimilate the IRT to the majority of the RIRs where it is abuse-c. Example of the validation procedure.

3.2 Additional information: Since this proposal is implemented, AFRINIC will publish the IRT as an alias to the abuse-c, in order to facilitate the search in whois for the same information, regardless if looking for abuse-c or IRT. The rest of the actual information in the IRT, can be kept as per the actual guidelines (which will need to be updated AFRINIC). This is done in order to assimilate the IRT to the majority of the RIRs where it is abuse-c. Example of the validation procedure.

This allows automatic reporting, for example, via fail2ban, SpamCop or others, keeping costs at a minimum for both parties involved. 8.4 Objectives

This allows automatic reporting, for example, via fail2ban, SpamCop or others, keeping costs at a minimum for both parties involved. Commonly, if a ticket number has been generated, it should be kept (typically as part of the subject) through successive communications. 8.4 Objectives

If no reply is received confirming that the situation has been corrected, after an additional period of three business days, the "abuse-c" will be permanently marked as "invalid". The validation process will be repeated automatically

AFRINIC must ensure that all possible means of “warning” the resource-holder are put in place, such as periodic emails to other email boxes, alert pop-ups, etc. All those must contain the policy text and reminders about consequences in case of continued policy violation. Means of blocking access to certain services should be also considered. The validation process will be repeated automatically

Resources allocated/assigned by AfriNIC must include a mandatory "abuse-c" contact attribute (abuse contact) in their corresponding WHOIS entry, with at least one valid, monitored and actively managed email inbox (abuse-mailbox)

Resources allocated/assigned by AFRINIC must include a mandatory "abuse-c" contact attribute (abuse contact), pointing to a person or role, with at least one valid, monitored and actively managed email inbox (abuse-mailbox)

If validation fails, escalate to other LIR contacts and set a new validation period not to exceed 15 days.

If validation fails, escalate to other member contacts and set a new validation period not to exceed 15 days.

Lack of compliance will lead to a more exhaustive follow-up, warnings and blocking of certain services, at AFRINIC discretion, in accordance with the relevant policies/procedures.

This is also contradictory with RSA, that states that information in databases must be accurate. This policy ensures that this can be automatically and periodically verified by AFRINIC, without entering in the operational details of how to do it.

Since this proposal is implemented, AFRINIC will publish the IRT as an alias (or pointer) to the abuse-c, in order to facilitate the search in whois for the same information, regardless if looking for abuse-c or IRT.

If this proposal reaches consensus, to comply with it, AFRINIC must rename mnt-IRT to abuse-c. It is an operational AFRINIC decision if an alias (pointer, duplicated attibute, or any other alternative) to mnt-IRT is kept and for how much time (transition period)

Confirm that the resource holder understands the procedure and the policy, that they regularly monitor the abuse-mailbox, that measures are taken, and that abuse reports receive a response.

Confirms that the resource holder: * has read the procedure and the policy * regularly monitor the abuse-mailbox * measures are taken * abuse reports receive a response.

The proposal is expected to be implemented in 90 days, to be confirmed by AfriNIC, a reasonable time frame to allow both the staff to develop the tool and the members to update their abuse-c contacts.

Due to the significant amount of systems impacted and coding required to onboard the AFRINIC members into adopting the abuse-c contact, 90 days for implementation cannot be met. The AFRINIC team can implement the policy within the 6 months from the Last Call as mandated by the CPM on its systems and 12 months to get the members to comply with the policy.

An equivalent proposal has been accepted in APNIC (already implemented) and is under discussion in the ARIN, LACNIC and RIPE regions.

An equivalent proposal has been accepted in APNIC (already implemented) and LACNIC (under implementation) and is under discussion in the RIPE.

As a matter of clarification, the “initial” and “escalation” validation periods may be modified by AFRINIC, if deemed appropriate, provided it informs the community of its motivation for doing so.

8.7 Slow-start and progress follow-up The initial/escalation periods and the validation periodicity set by this policy can be amended yearly by AFRINIC, considering internal procedures, staffing needs and actual data, considering both, a slow-start and follow-up of the accuracy of the data. The reasons for the amendments shall be properly communicated to the community.

AFRINIC is assuming that the abuse-c will not be mandatory for inetnum and aut-num that hold legacy status. Clear guidance from the author is required on this matter.

As in all the other policies, this one doesn’t set specific different conditions for legacy holders. This is a generic AFRINIC issue that should be tackled in a uniform way for all the policy manual. Similarly, the policy doesn’t state the consequences of lack of compliance, as this is generically stated in the RSA.

6.0 Finance Recruitment of additional support staff to cater for the increase in tickets that the implementation of the policy will generate.

5 Financial Impact No impact

AFPUB-2018-GEN-001-DRAFT01: Abuse Contact Policy Update (Draft 6) Archived

ID AFPUB-2018-GEN-001-DRAFT07 Date Submitted 17 May 2021 Author(s) Jordi Palet Martínez Version 7 Obsoletes Abuse Contact Policy (Section 8.0 of the CPM) Status Ratified

8.7 Slow-start and progress follow-up The initial/escalation periods and the validation periodicity set by this policy can be amended yearly by AFRINIC, considering internal procedures, staffing needs and actual data, considering both, a slow-start and follow-up of the accuracy of the data. The reasons for the amendments shall be properly communicated to the community.

15 May 2022 Version 8: AFPUB-2018-GEN-001-DRAFT08 * Version update without changes to extend the policy proposal validity to allow the Board ratification. However, the info in the references section has been updated so as to be consistent with the actual status in other RIRs.

In this regard, should this policy gain consensus, AFRINIC will adopt a phased implementation while keeping the community informed.

AFRINIC Staff Assessment (In Progress)

ID AFPUB-2018-GEN-001-DRAFT07 Date Submitted 17 May 2021 Author(s) Jordi Palet Martínez Version 7 Obsoletes Abuse Contact Policy (Section 8.0 of the CPM) Status Ratified

Proposal Name Abuse Contact Policy Update (Draft 8) Archived ID AFPUB-2018-GEN-001-DRAFT01 Date Submitted 2020-08-05 Author(s) Refer to Proposal Tab Status Archived