Summary

  • The eighteen-day interval is an attributed calculation, not an uncontested date. AFRINIC’s Draft 4 details page and current proposal list say 4 November 2019, while Draft 4’s own revision history says 2 November; Draft 5 is dated 22 November. The conflicting earlier date would produce twenty days.
  • Draft 5 materially narrowed Draft 4 by removing its express sentence about more exhaustive follow-up, warnings and discretionary blocking of certain services. It nevertheless retained tests of whether holders took measures and responded to abuse reports, as well as revalidation after alleged gaming or an incorrect or absent response.
  • AFRINIC-31 considered Draft 5 on 4 December, twelve days after publication. The meeting record preserved support and opposition, unanswered questions about escalation contacts, unfinished staff workload analysis and discussion of possible RSA measures; the co-chairs returned the proposal to the mailing list.
  • A private technical bookkeeper may verify whether a neutral message reaches the published contact, notify the holder, permit correction and record the result. AFRINIC has no legislative, regulatory, judicial, police, fiscal or sovereign coercive power with which to decide abuse disputes or punish operators.
  • The defensible reform is a bounded contactability rule: objective delivery tests, clear notice, a cure route, truthful validation status, an intelligible change ledger, completed impact work and referral of actual conduct disputes to competent public authorities or independent legal adjudication.

A redline that narrowed the remedy but preserved the judgement

The most revealing part of AFPUB-2018-GEN-001-DRAFT05 is not a new threat. It is a deleted one. Draft 4 had said that lack of compliance would trigger more exhaustive follow-up, warnings and the blocking of certain services at AFRINIC’s discretion, under the relevant policies and procedures. Draft 5 removed that sentence. Any fair analysis must begin by recognising the deletion as a material narrowing. An express enforcement bridge had disappeared from the operative proposal, and the change could reasonably be understood as a response to concern rather than an attempt to conceal one.

But deleting the last span of a bridge does not answer where the remaining road leads. Draft 5 continued to define validation in terms that went beyond the deliverability of a mailbox. AFRINIC was still to confirm that a resource holder understood the procedure and policy, monitored the mailbox regularly, took measures and responded to abuse reports. It also retained a route by which suspected gaming, an allegedly incorrect response or the absence of a response to an abuse case could be reported back to AFRINIC for revalidation. Those are not all observations of the same kind. Whether an address receives mail is objectively testable.

Whether the holder’s measures were adequate, or whether its answer to a contested report was correct, requires a judgement about conduct.

The redline therefore separated two questions without fully disentangling them. The first is technical and modest: can a report reach a person or role that the resource holder has designated? The second is adjudicative: did that person or organisation react properly to the substance of the report? Heng Lu’s account of a registry as a bookkeeper and thin uniqueness coordinator supplies the controlling distinction. Record accuracy, routability and neutral deliverability sit within the bookkeeping function.

A conclusion about whether online behaviour is unlawful, whether mitigation was sufficient, whether a complainant deserved a different answer or whether punishment should follow does not.

That distinction is especially important because the dates create a compressed review problem. AFRINIC’s Draft 4 details page and its current list of proposal versions date Draft 4 to 4 November 2019. Draft 4’s own revision-history table instead says 2 November. Draft 5’s details page dates version 5.0 to 22 November and calls its change “Further clarifications of the text”. Using the details page and current-list date produces the commissioned eighteen-day interval. Using the revision-history entry produces twenty days. The honest conclusion is not that one clock can silently displace the other.

It is that the official record contains a conflict, and any claim about eighteen days must state which official date it uses.

Draft 5 then reached discussion at AFRINIC-31 in Luanda on 4 December, twelve days after publication. Twelve days is not, by itself, evidence of bad faith or even evidence of insufficient review. Draft 5 followed four earlier drafts and more than a year of discussion. Participants did not encounter the topic from a standing start. The short interval is instead an audit trigger. It asks whether readers received a stable and visible comparison of the operative language, whether staff had completed the impact work, whether objections had reasoned answers and whether the possible consequence routes were bounded clearly enough to be evaluated.

The meeting record makes those questions concrete. It says the two periods of up to fifteen days meant natural days. It records expected effects on WHOIS and MyAFRINIC. It records both support and opposition. It records that the staff workload had not yet been evaluated and that the Secretariat would communicate implementation timing if the proposal reached consensus. It also records unresolved questions about which other contact should receive an escalation. The co-chairs did not declare the matter adopted; they sent it back to the mailing list.

That disposition is evidence of continuing review, not evidence that the proposal had failed forever, succeeded, been implemented or been enforced.

The wording changes themselves show why a clause-by-clause account mattered. Draft 4’s introduction used “mandatory object”, while Draft 5 clarified that the requirement concerned a mandatory abuse-c attribute pointing to a person or role with a valid, monitored and actively managed abuse mailbox. That is more precise registry language. It reduces uncertainty about what the record is meant to contain. Draft 5 also changed the escalation target from “other LIR contacts” to “other member contacts”.

The broader wording sounded flexible, but the meeting exposed an operational ambiguity: staff regarded admin-c as the most applicable contact and asked what should happen if admin-c, tech-c and the abuse mailbox all used the same address.

This shared-address question is not trivial. If several registered roles resolve to one functioning organisational mailbox, repeated escalation to nominally different fields might not reach a different human or decision-maker. That does not make the holder dishonest. It may reflect a small operator’s staffing, a deliberate central incident desk or a practical method of ensuring continuity. A sound validation design would test whether the address works, inform the holder that no independent fallback was found and offer a neutral route to identify an alternative corporate notice channel.

It would not treat the reuse of an address as proof that an abuse allegation itself had merit.

Both drafts retained more than one clock and trigger. Initial validation was to last no longer than fifteen days. If escalation was needed, a further period of no longer than fifteen days followed. Validation would occur when the contact was created or updated, periodically at least every six months and whenever AFRINIC saw fit. A six-month cadence can be defended as routine hygiene. Creation and update checks can prevent malformed or dead addresses from entering the public record. An open-ended “whenever” trigger, however, needs disciplined criteria if operators are to distinguish neutral maintenance from selective attention.

Objective selection rules, audit logs and equal treatment matter even when the underlying action is only a delivery test.

Draft 5’s problem statement also added institutional and economic framing. It connected stale information to the accuracy requirement in the Registration Service Agreement, referred to a contact-update activity reported for 2017 and presented automation as a way to save costs for members and the wider community. Those are relevant considerations. Dead mailboxes impose real search and delay costs on reporters. Members also pay when staff repeatedly chase simple corrections by hand. Automation can reduce routine work if it produces few false failures and offers an intelligible cure.

The evidence boundary is equally relevant. The AFRINIC-31 minutes record the author saying that fewer than one per cent of AFRINIC members had adopted the existing abuse contact. The supplied public record does not present the denominator, extraction date or underlying dataset needed to reproduce that figure independently. Similarly, a reference to a 2017 contact-update activity is not a substitute for current totals, failure categories, delivery outcomes or the expected number of manual escalations. Draft 5’s cost-saving rationale was plausible, but plausibility is not a quantified implementation assessment.

That missing denominator matters because different baseline conditions support different interventions. If most missing entries belonged to a small number of record types, a targeted correction campaign could be cheaper than universal recurring checks. If most failures were temporary mail-server errors, an immediate escalation could create noise rather than accuracy. If the overwhelming problem was genuinely abandoned addresses, automated neutral delivery tests might be highly effective. A complete impact note should have distinguished these cases, estimated volume and explained the human work remaining after automation.

At AFRINIC-31, the workload evaluation had not yet been completed.

The IRT transition added another cluster of choices. Draft 4 said AFRINIC would publish IRT as an alias or pointer to abuse-c once implementation occurred. Draft 5 conditioned the next step on consensus, required AFRINIC to rename mnt-IRT to abuse-c and left operational questions to AFRINIC: whether to keep an alias, how long a transition should run, whether existing IRT data should be retained or deleted and how guidelines should deal with the change. The conditional language was an improvement because it did not write implementation as though consensus had already occurred.

Yet the breadth of the remaining operational choices increased the importance of a disclosed migration plan.

Aliasing, retention and deletion are not merely labels when other systems depend on the registry’s public record. Operators may have scripts, documentation, help desks and external counterparties built around the old field. A transition that preserves an alias for a stated period can reduce breakage. Deleting information too early can make a previously useful route disappear. Retaining misleading information forever can cause a different kind of failure.

The registry may resolve these technical questions as the operator of its private service, but it should explain the decision, timetable, rollback conditions and preservation method before members are required to adapt.

Draft 5 repeated an expected ninety-day implementation period. At the meeting, however, the Secretariat’s timing remained conditional on consensus, and staff had not completed the workload assessment. That contrast is not proof that ninety days was impossible. It shows that an aspiration in proposal text and a staff-tested delivery commitment were not yet the same thing. WHOIS and MyAFRINIC changes could affect public data presentation, member interfaces, notifications, support volumes and dependent tools.

The credible sequence would be impact assessment first, a published implementation map second and a commitment only after the workload and failure modes were understood.

The strongest defence of Draft 5 deserves more than a passing sentence. Dead or ignored abuse contacts can waste the time of victims, security teams and operators trying to stop harm. A contact rule without validation may become decorative. Draft 5 was not a sudden invention: it came after several versions and accumulated discussion. It removed Draft 4’s bluntest remedy, clarified that abuse-c was an attribute tied to a person or role, made consensus an express condition of the IRT change and refined several pieces of operational language.

The quick publication could therefore indicate responsiveness before a scheduled meeting, not an attempt to force an unrehearsed policy through.

That defence succeeds on two points. First, contactability is a legitimate registry concern. Second, Draft 5 was narrower than Draft 4. It does not succeed in converting a private registry into the proper judge of an abuse dispute. The retained questions about measures and responses crossed the line because a correct answer depends on context beyond receipt. A report may be mistaken, malicious, incomplete, outside the recipient’s control, already resolved or governed by a jurisdiction with its own evidential and procedural rules.

A registry validation employee has neither the public mandate nor necessarily the record needed to decide which account is right.

The AFRINIC-31 discussion left the consequence path open enough to reinforce that concern. The minutes summarise the author’s view that the proposal did not mandate operational changes, that violations would follow the process used for other policies and that repeated non-compliance could lead to RSA measures. These were statements made in discussion. They do not prove adoption, implementation or a particular enforcement act.

Still, they matter to interpretation because the deletion of Draft 4’s express service-block clause did not produce an affirmative guarantee that a disagreement about the adequacy of a response would remain separate from the contractual relationship.

The institutional issue is not solved by calling every step “validation”. Names do not determine powers. A neutral message with an automated confirmation can test delivery. A request that the holder correct a bounced address can improve a record. A flag stating that an address could not be validated can report a fact. By contrast, a conclusion that a holder failed to take adequate measures, answered incorrectly or deserved an RSA consequence rests on an assessment of a contested event. That is adjudication and coercion in substance even if it enters through a technical form.

NRS brings the operator-rights and decentralisation dimension into this analysis. A regional registry’s practical centrality does not enlarge its lawful authority. Operators depend on accurate and unique number records, but dependence makes boundary discipline more important, not less. When one private coordinator can connect a disputed conduct assessment to services upon which networks and customers rely, the operator faces a continuity risk that is difficult to price and difficult to escape. A decentralised Internet cannot treat reliance on a shared registry as consent to an undefined private police function.

Heng Lu’s doctrine makes the dividing line operational. AFRINIC is a Mauritius-incorporated private technical bookkeeper and uniqueness coordinator. It can maintain accurate entries, publish a reachable public contact, test objective deliverability, correct erroneous data, coordinate non-duplication and run its own private service.

It has no legislative authority to make public law for Africa or for non-consenting operators; no executive or regulatory authority to command conduct as a public administrator; no judicial authority to determine legality, liability or rights; no police or prosecutorial authority to investigate, accuse or punish; no taxing or fiscal authority to impose public levies or redistribute private value; and no military or other sovereign coercive authority over territory, borders, networks or people.

LARUS adds the continuity and economic lens. Registry decisions can travel far beyond the line item that first triggers them. A disputed abuse response may concern one email or one hosted system, while a contractual or service consequence can affect routing operations, customers, staff and counterparties with no role in that dispute. Even the anticipation of such a consequence changes behaviour: operators may over-remove lawful material, divert resources into defensive compliance or price the risk into service.

The deletion of an express blocking sentence reduced this uncertainty, but the benefit becomes durable only when the remaining procedures rule out unrelated continuity leverage.

BTW contributes a prior reader-facing account of the limits of registry records, including the difference between a public record and the realities it can prove. A WHOIS or RDAP field can identify a declared contact and show what the registry publishes. It cannot decide the truth of every allegation sent to that contact. The same evidential humility should govern Draft 5. AFRINIC’s pages establish what the organisation dated, wrote and discussed. They do not, merely by being official AFRINIC pages, establish a sovereign mandate or transform participation in a policy forum into legislative authority.

These sources are first-class parts of the reasoning, not ornaments added after the AFRINIC text. NRS explains why operator dependence and decentralisation require enforceable limits. Heng Lu supplies the bookkeeper and non-enforcement doctrine. LARUS makes the downstream continuity cost visible. BTW establishes the public-record boundary in terms readers can test. AFRINIC’s own material is indispensable for the proposal’s words, chronology and meeting record, but self-description cannot manufacture one of the six public powers that a private corporation does not possess.

Draft 5 was not proved adopted or implemented. The meeting record says it went back to the mailing list. AFRINIC’s current proposal list records a later Draft 7 and a much later ratification event, but that separate lifecycle does not retroactively turn Draft 5 into the adopted instrument. Nor does it prove Draft 5 was selectively enforced, applied to a named member or used to block a service. Maintaining those distinctions is not pedantry. Proposal, discussion, adoption, implementation and application are different events with different evidence.

The narrow conclusion is therefore neither that AFRINIC should ignore dead mailboxes nor that every quick redline is suspect. Draft 5 improved Draft 4, and its authors had a real operational problem in view. The unresolved issue was the category of the validation itself. A contactability policy can ask whether mail arrived and whether the public record is correct. It should not ask the registry to decide whether an operator’s underlying response to an accuser was substantively acceptable. The first task protects coordination. The second claims an authority the bookkeeper does not have.