Summary

  • Draft 4 of Abuse Contact Policy Update removed Draft 3’s thirteen-step example, including temporary and permanent invalidity, repeated validation, policy-breach language, AFRINIC intermediation and the express reference to resource-revocation procedures. It did not remove the general clause joining non-compliance to exhaustive follow-up, warnings and blocking of certain services at AFRINIC discretion.
  • The proposal kept a 15-day initial validation period and a further period of no more than 15 days after escalation to other LIR contacts. Those were contact-validation windows, not deadlines for resolving the substance of an abuse report. It also kept revalidation when someone alleged test gaming or an incorrect or absent response.
  • A reachable role mailbox is a legitimate registry objective. A private technical bookkeeper can test neutral deliverability, notify contacts and correct its record. It cannot acquire regulatory or adjudicative authority by calling a complainant’s dissatisfaction a validation issue or by making unrelated services leverage for a contact defect.
  • The fair replacement is a bounded notice-and-cure system: objective tests, documented notice, correction access, a predictable cure window, a dated data-quality flag and continuity for unrelated registry-facing functions. The truth of an abuse allegation belongs to the operator, its contracts or a competent public authority with actual jurisdiction.

The deletion that concealed the surviving power

The decisive fact about Draft 4 is not that it was shorter. It is what disappeared and what remained. Draft 3 had set out a thirteen-step example that carried a failed contact test through temporary invalidity, personalised follow-up, permanent invalidity, another validation round, a declaration of policy breach, possible AFRINIC intermediation and, at the far end, an express reference to procedures especially related to resource revocation. Draft 4 deleted that sequence.

But its section 8.5 still said non-compliance would bring more exhaustive follow-up, warnings and blocking of certain services at AFRINIC discretion under relevant policies and procedures. Section 8.6 still allowed revalidation after allegations of validation gaming or an incorrect or missing response to an abuse case. The initial validation window remained 15 days, followed after failure by escalation to other LIR contacts and a further period of no more than 15 days.

That combination matters in the first reading, because it prevents two convenient but inaccurate accounts. Draft 4 did not expressly threaten revocation: the reference to revocation procedures vanished with Draft 3’s detailed example. But Draft 4 did not make the scheme consequence-free: the service-blocking clause survived. The revision therefore reduced the declared hard tail while leaving a broad middle of coercion in place. It also stripped away much of the sequence by which a resource holder could see how one failure became the next status, warning or consequence.

A shorter rule can be narrower in one respect and less determinate in another. Draft 4 was both.

The proposal’s own date record reinforces the need for precision. AFRINIC’s details panel identifies Abuse Contact Policy Update, proposal AFPUB-2018-GEN-001-DRAFT04, as version 4.0, authored by Jordi Palet Martinez and aimed at amending article 8.0 of the Consolidated Policy Manual. The panel displays 4 November 2019. The revision table on the same preserved page displays 02 November 2019 and describes Version 4 as an overall simplification of Version 3. The page also displays 8 November 2019 as its last-modified date. The two November dates should not be harmonised into a false certainty, nor treated as evidence of two distinct versions. They are a documentary discrepancy attached to one Draft 4 record.

What Draft 4 sought to validate was also broader than whether an address accepted mail. For directly allocated or assigned resources, the proposal required an abuse-c reference and at least one valid, monitored and actively managed abuse-mailbox. Messages to that mailbox had to require intervention by the recipient. A reporter could not be forced to complete a form, and the channel had to allow receipt of reports together with material such as logs, examples or email headers. Those requirements respond to a real operational problem: an address that exists only as decoration does not reduce the cost of reaching whoever can investigate a report.

But the validation objectives went past the objective state of the channel. The process was meant to establish that the contact understood the procedure and policy, monitored the mailbox regularly, took measures and responded to abuse reports. Each of those questions demands a different kind of evidence. Deliverability can be tested with a neutral message. Monitoring may require an inference from behaviour over time. Whether adequate measures were taken depends on the report, the network, the customer relationship, the available evidence and the operator’s lawful powers. Whether a response was correct is more difficult still.

It turns a routing and contactability check into an assessment of substantive conduct.

The timing architecture applied to validation, not to the merits of an underlying complaint. Draft 4 allowed no more than 15 days for initial validation. On failure, AFRINIC would escalate to other LIR contacts and provide a further validation period of no more than 15 days. The text also required validation when the relevant attributes were created or updated, at least once every six months, and whenever AFRINIC saw fit. AFRINIC could change the initial period, escalation period and recurring frequency if it informed the community of its reasons.

The additional explanation contemplated a first year with one check and later increases, possibly to quarterly checks. None of that created a 15-plus-15-day obligation to prove that an abuse allegation had been resolved. Treating those clocks as an abuse-response service level would rewrite the proposal.

The change from Draft 3 becomes clearer when the shared surfaces are separated from the deleted ones. Both drafts used the 15-day initial period and the further period of up to 15 days. Both required recurring checks at least every six months, checks on creation or update and checks whenever AFRINIC saw fit. Both contained the broad consequence language about follow-up, warnings and blocking certain services at AFRINIC discretion. Those elements were not the simplification.

The simplification was the removal of the extended example that had specified two validation emails, a code lasting up to 15 working days, temporary invalidity after the first failure, personalised follow-up, permanent invalidity after a further 15 business days without confirmed correction, warning through every possible channel, another automatic validation, policy breach, intermediation and the express revocation-oriented reference.

Removing those steps did take something serious out of the proposal. Draft 4 no longer drew an explicit line from the failed contact procedure to resource revocation. It no longer announced temporary and permanent invalidity as successive statuses. It no longer said that continued failure after an automatic repeat became a policy breach. Any account that carries those words into Draft 4 would manufacture a threat the fourth draft did not state. The redline should receive credit for narrowing the text in that specific way.

Yet deletion also removed procedural landmarks. Draft 3’s example was troubling in substance, but at least it revealed the intended ascent: first message, second message, invalidity, broader notice, repeat, breach, intermediation, then the hard tail. Draft 4 retained “blocking of certain services” without naming the services in that clause. It did not supply a proportionality scale, an independent merits reviewer, an appeal forum or a restoration rule beyond the logic of revalidation.

A resource holder could read that a consequence existed but not tell which registry-facing dependency might be affected, how the choice would be made or how a disputed response-quality allegation would be resolved. The simplification made the most extreme stated endpoint less severe and the surviving discretionary field less auditable.

Section 8.6 deepened that uncertainty. It addressed suspected gaming, such as a mailbox configured to respond only to AFRINIC or to a particular subject or message content. That is a proper concern for an objective test: a channel that recognises the examiner but ignores ordinary reporters is not genuinely available. The same section, however, also allowed an incorrect or lacking response to an abuse case to be reported to AFRINIC for revalidation under section 8.5. “Lacking” may sometimes be observable. “Incorrect” is a merits judgment.

A complainant may be wrong about the subscriber, the timestamp, the address, the conduct, the remedy or the law. An operator may reasonably decline a demand while still monitoring the mailbox and investigating the evidence. Once disagreement can reopen validation, the registry sits above the operator as an indirect reviewer of response quality.

The documentary limit is as important as the textual finding. Draft 4 was a proposal. Its preserved page proves publication, wording, version details and the redline against Draft 3. It does not prove adoption or implementation. It identifies no resource holder subjected to the draft, no actual service block, no vote loss, no revocation, no routing interruption, no outage, no quantified economic harm and no adjudicated abuse misconduct. The proposal also does not establish which services the drafters had in mind.

Analysis must therefore explain the mechanism and institutional risk without turning a contingent design into a reported enforcement event.

Within those limits, the question raised by Draft 4 can be answered directly. It narrowed enforcement at the explicit outer edge by deleting the revocation-related tail. It did not confine the remaining remedy to correction of contact data. Because the undefined service-blocking clause and response-quality trigger survived while the detailed ladder disappeared, the revision made the exercise of consequence less legible. That is not mere tidying. It changes the distribution of uncertainty between the private coordinator that chooses a response and the operator that depends on registry-facing services.