Summary

  • AFRINIC published AFPUB-2018-GEN-001-DRAFT03 on 5 June 2019. The act was publication of a proposal, not proof of consensus, ratification, implementation, enforcement or a completed validation case.
  • Draft 3’s defining institutional contribution was to separate validation of the registered abuse-contact channel from judgment about how an operator handled an abuse report.
  • A registry may test delivery, authenticate the controller of a contact record and mark that record’s validation state. None of those acts proves an allegation, identifies the responsible service, measures adequate remediation or justifies loss of unrelated registry services.
  • Dead contacts create real costs, but the proportionate answer is a bounded, auditable contactability protocol with notice and cure—not a private registry acting as regulator, police force, court or confiscation authority.

The publication that put two different questions on the table

On 5 June 2019, AFRINIC published AFPUB-2018-GEN-001-DRAFT03, the third version in its Abuse Contact Policy Update proposal family. The concrete institutional act matters. A draft was placed into a policy process. The publication did not, by itself, show that the proposal had achieved consensus, been ratified by a board, entered operational use or produced a sanction against anyone. No member can responsibly be described as having lost a vote, a portal function, a registry service or number-resource continuity under Draft 3 on the basis of this event.

Yet the publication deserves close attention because Draft 3 identified a category error that can turn a modest registry function into something much larger. It distinguished the validation of an abuse contact from the substantive handling of an abuse report. The first question is administrative and technically testable: does the directory point to a route that works, and is the party controlling that route connected to the relevant registration?

The second is evidentiary and contested: did the reported conduct occur, who controlled the implicated system, what did the logs show, what remediation was appropriate, and who has authority to impose a consequence?

For an operator, the difference is the line between correcting a stale public record and defending its conduct before an institution that may lack the evidence and authority to judge it. For a complainant or another network, it is the difference between reaching a functioning desk and being led to believe that a successful delivery creates a decision on the merits. For downstream customers, it is the difference between an administrative defect being fixed at its source and that defect contaminating services on which live networks depend. Draft 3’s separation therefore was not drafting housekeeping. It exposed an institutional boundary.

The narrowness of that boundary is what makes it useful. A message can be delivered without being understood. It can be acknowledged without being investigated. It can be investigated without establishing the allegation. A report can be accurate yet misdirected to a resource holder that did not operate the service at the relevant time. An operator can accept that an incident occurred but disagree about the appropriate remedy. These are different states, produced by different evidence and handled by different actors. Collapsing them creates speed, but only by replacing inquiry with assumption.

The affected roles are equally distinct. AFRINIC maintains number-resource records and contact fields. A resource holder or authenticated contact maintains accurate registration data. An abuse desk receives and triages reports. A network operator can inspect operational evidence, preserve logs, identify the customer or system involved and take technically appropriate action. A complainant supplies an allegation and supporting observations. Courts, regulators or law-enforcement bodies may act where law gives them competence. No one of these roles automatically inherits the powers of the others merely because all of them touch the same email.

Why Draft 2 was the necessary, but limited, baseline

Draft 3’s clarification is intelligible only against the immediate Draft 2 baseline. Published in November 2018, Draft 2 treated abuse-c and an actively managed abuse mailbox as parts of the proposed registry-data obligation. It contemplated checks when a record was created or updated, periodic validation at least every six months and additional validation at AFRINIC’s discretion. Its normative text allowed an initial validation period of no more than 15 days and an escalation period of no more than a further 15 days.

That timing was not wholly tidy even within the Draft 2 material. An example still described a two-working-day period followed by three business days, a much shorter rhythm than the normative 15-plus-15-day structure. The mismatch illustrates why a reader should avoid turning examples, aspirations and operative rules into one undifferentiated command. More importantly for Draft 3, the baseline did not keep validation cleanly confined to the state of the contact record.

It connected suspected gaming, an incorrect response or the absence of a response to an abuse case with revalidation, AFRINIC intermediation and possible resort to other procedures.

That connection made the distinction urgent. “The mailbox answers” and “the operator gave the right answer” are not stronger and weaker versions of one fact. They are different facts. A validation system is designed to determine the first. To determine the second, an examiner would need the underlying report, trustworthy attribution, relevant technical records, the operator’s explanation, an account of what action was possible, a governing substantive standard and a process for resolving disagreement. An organisation that possesses a registry database does not possess those things by implication.

The institutional concern was visible before Draft 3 appeared. In an assessment dated 20 April 2019, AFRINIC staff indicated that a proposed account restriction could affect functions in MyAFRINIC, including voting. AFRINIC’s legal adviser regarded loss of voting rights for failure to update a contact as disproportionate, while saying that it was not illegal under Mauritian law. That assessment does not establish that Draft 3 imposed, retained or applied such a consequence. It provides narrower context: even inside the proposal’s own development, participants could see that a defect in one field might be made to reach unrelated rights.

Proportionality begins by naming the actual defect. If the defect is a dead address, the appropriate objective is a correct address. If the defect is that the listed party no longer controls the record, the appropriate objective is authenticated control. Neither defect proves an abusive act, a failure to remediate, bad faith or a reason to disable participation. Draft 3’s separation was consequential precisely because it interrupted the movement from a directory problem to an assessment of conduct.

Draft 2 should not be made the protagonist of this story. Its clocks, assessment and escalation language are the immediate baseline, not a substitute subject. Nor should the timing of its provisions be attributed to Draft 3 without specific support. The secure conclusion is the one Draft 3 itself makes possible: contact validation and abuse handling must be treated separately. That is enough to expose what a registry test can and cannot establish.

Six stages that must not be compressed into “response”

The word “response” hides several transitions. The first is deliverability. A mail server may accept a message for a declared address. That proves, at most, that a technical path existed at that moment. It does not show that the intended team saw the message, that a human understood it or that the recipient was responsible for the reported system.

The second is authenticated control. A challenge can require an authenticated registry contact to demonstrate control of the role address or confirm that it belongs to the registration. This is stronger than unauthenticated delivery because it links the communication route to a party entitled to maintain the record. It remains a statement about the contact route, not the truth of a third party’s allegation.

The third is acknowledgement. A receipt can tell a sender that the report entered a queue. It may also provide a ticket number or direct the sender to a structured intake. Acknowledgement is valuable: it reduces repeated submissions and uncertainty. But an autoresponder can acknowledge a malformed, duplicate or irrelevant report as easily as a well-supported one. It cannot stand in for judgment.

The fourth is triage. A capable abuse function decides whether the report contains enough information to investigate and where it should go. A timestamp, affected address, protocol, direct observation and a reliable reply route may be necessary to identify the event. Triage may reveal that the complaint concerns a customer, a downstream network, an address no longer assigned to the operator or a service for which a different team retains the logs. The registry is poorly placed to infer those relationships from receipt time alone.

The fifth is remediation. An operator may preserve evidence, contact a customer, filter traffic, patch a system, suspend a service under its contract, or determine that the allegation is mistaken. Different incidents demand different interventions. Some acts should be quick; others require logs, lawful authority or caution to avoid harming innocent users. The duration of that work is not a simple truth meter. Delay can indicate neglect, but it can also reflect complexity, volume, language, time zones, evidentiary preservation or the need to avoid a destructive false positive.

The sixth is adjudication. Here the question is no longer whether a route works or a ticket exists. It is whether disputed conduct occurred, what legal or contractual rule applies, whether the identified party is responsible and what coercive consequence is justified. Adjudication requires authority, standards, evidence, procedural fairness and review. A private technical registry does not acquire public-law adjudicative power because a message crossed a server it can test.

These stages can inform one another without being merged. A repeated delivery failure is relevant to the accuracy of the contact record. A confirmed receipt may help a complainant know where the report sits. A triage handoff can improve the likelihood that evidence reaches the party able to act. But the output of each stage must stay tied to its input. Contact evidence supports a contact status. Incident evidence may support operational action. Legal evidence before a competent body may support a legal remedy. Moving straight from one kind of evidence to another kind of consequence is not efficiency; it is a change of function.

What the historical record does—and does not—permit

The published lifecycle must remain separated by version. Draft 3 was published in 2019. A later AFRINIC record identifies Draft 7, dated 17 May 2021, in the same proposal family. AFRINIC’s ratified-policy overview then records ratification of Draft 7 on 4 February 2026. Those later facts show that the family continued to evolve and eventually reached a ratified version. They do not reach backward through time and convert Draft 3 into an adopted or implemented rule.

Version discipline is more than bibliographic caution. Later drafts can contain different notice periods, cure procedures, escalation ladders or institutional compromises. Importing their terms into an earlier draft would create an instrument that never existed. It would also obscure the significance of Draft 3’s own contribution: a conceptual separation rather than proof of a completed enforcement architecture.

The available history establishes no named member subjected to a Draft 3 validation, no particular abuse allegation, no service interruption, no measurable loss and no selective enforcement. It would therefore be wrong to narrate an aggrieved operator or successful complainant as though a case file existed. The effects considered below are mechanisms and risks: what follows when a contact test is kept narrow, and what could follow if it is allowed to determine conduct or trigger unrelated consequences. Analysis can be concrete without pretending that a hypothetical pathway was an observed event.

That evidentiary restraint strengthens rather than weakens the argument. The point is not that AFRINIC was proved to have punished someone under Draft 3. The point is that Draft 3 identified the boundary any legitimate validation design must preserve before a case arises. Institutions are safest when roles are specified while the question is procedural, not after an individual operator must resist an overbroad consequence.