Summary

  • Draft 1 proposed that the justification for every accepted resource request move towards publication after two years, with three months’ warning, a chance to submit alternative text or seek a one-year extension, and possible Board review.
  • The proposal never resolved whether the public object would be the full justification, the draft summary mentioned in its notice process, or a selected set of fields. That ambiguity sits at the centre of its privacy and accountability problem.
  • A private registry can make its decisions comparable without making a customer’s business file public. Safe identifiers, dates, policy versions, reason codes, exceptions and correction history can form a useful public receipt, while sensitive evidence remains protected.
  • Transparency needs a field-by-field purpose test. Collection for a private coordination decision does not by itself justify later publication to an undefined audience.
  • The available evidence establishes publication of Draft 1 on 11 October 2021. It does not establish consensus, adoption, an effective rule, implementation, any individual disclosure, or any resulting harm.

A clock attached to private evidence

The proposal identified as AFPUB-2021-GEN-001-DRAFT01, version 1.0, was submitted by Jordi Palet Martinez and published by AFRINIC on 11 October 2021. It proposed a new article 13.0 for the Consolidated Policy Manual. Its operative idea was a two-year switch in the treatment of information. When a resource request was accepted, the justification that supported it would not remain indefinitely within the private decision process. Two years after acceptance, the proposal said, that justification must be published.

The sequence matters because the proposed protection was procedural and temporary. Three months before the expected publication, AFRINIC would warn the resource member and provide a draft summary of what was to be published. The member would then have one month to offer alternative text or ask for a one-year extension. The stated basis for an extension was narrow: patent-related information, or similar uniquely sensitive information about services, whose disclosure could damage the business. AFRINIC would have one month to accept the confidentiality case.

If it was in doubt, the question could go to the Board, which would decide within a further month after hearing the resource holder.

Draft 1 also contemplated a historical queue. Resources allocated or assigned more than two years earlier would enter a chronological warning sequence. The proposal presented that ordering as a way for staff to process objections or non-disclosure responses without additional human resources. No workload figures accompanied that expectation. The proposed sequence was therefore clear enough to reveal a series of clocks, but not clear enough to reveal the object moving through them.

That distinction is decisive. At one point, the text directed publication of the request justification. Later, it referred to sending the member a draft summary of the material to be published. A justification and a summary are not interchangeable. A justification might encompass the applicant’s own explanation, supporting claims, operational assumptions and attachments. A summary could be a fresh institutional description, a member-supplied replacement, or a selected extract. Draft 1 did not choose among those possibilities.

Nor did it state whether the public release would reproduce the original material, paraphrase it, select particular fields, or combine evidence with AFRINIC’s own account.

It is tempting to solve this ambiguity on the proposal’s behalf. Reading “summary” as the final public object makes the mechanism appear narrower. Reading “justification” literally makes it appear more intrusive. Neither choice is justified by the text available for this analysis. The honest conclusion is that Draft 1 left the disclosure object undefined.

Because the object was undefined, the proposal also left unanswered the basic questions that normally determine whether disclosure is proportionate: which exact bytes would leave the protected file, who would receive them, where they would appear, how long they would remain accessible, and what would happen when they became inaccurate or dangerous.

The timing safeguards did not answer those questions. Notice can help a member prepare, but notice does not establish that publication is necessary. Alternative text can reduce exposure, but only if the standard for accepting it is known and the public can understand what has been omitted or changed. A one-year extension can defer a risk, but it does not explain whether the same risk can justify another extension, whether protection expires automatically, or why information that is sensitive in year two ceases to be sensitive in year three.

Board escalation can add a second institutional view, but “in doubt” was not defined as an operational trigger. The proposal also supplied no independent appeal outside AFRINIC and its Board.

What the official act proves

Precision about institutional stage is especially important here. An author submitted text. AFRINIC published Draft 1. Those are the acts established by the official proposal record and revision history. Publication made the proposal available for consideration; it did not transform the proposal into a rule. The available evidence does not establish consensus, adoption, ratification, an effective date, implementation, a warning sent to a member, a justification released to the public, an extension sought, or a Board ruling under this mechanism. The fact that the current official page is archived does not fill any of those gaps.

The proposal’s own premises require the same discipline. Draft 1 asserted that request justifications could be used maliciously without detection when resources were allocated, and that the danger was particularly serious during IPv4 exhaustion. It also acknowledged that justifications may reveal confidential business plans while claiming that the need for confidentiality disappears quickly. Openness, transparency, fairness and the language of community resources framed its case.

Those assertions explain why the proposal was offered. They do not prove that its mechanism would work. The available material supplies no named case in which later publication would have detected abuse, no denominator against which to measure the scale of the alleged problem, no quantified loss, and no comparison showing that publishing request material improves allocation quality. It provides no field-specific finding that business sensitivity reliably vanishes after two years. An institutional page is authoritative evidence of what AFRINIC published and what the proposal said.

It is not an independent witness for the proposal’s policy premises.

This separation does not presume that abuse is impossible, confidentiality eternal, or every applicant’s claim accurate. It simply keeps the burden of proof attached to the proposed intervention. If a public field is supposed to reveal inconsistent allocation, its designer should identify the inconsistency that the field can expose. If a disclosure is supposed to deter manipulation, its designer should explain why publication is necessary rather than protected audit or independent review. If two years is supposed to mark a change in sensitivity, the proposal should show why that interval fits the information being released.

A clock is not a necessity test.

Nor does absence from the evidence used here prove that no private or later record ever existed. It means only that those matters are not established for this Draft 1 analysis. That boundary prevents later knowledge from making the first draft appear clearer, narrower or more operationally complete than it was on 11 October 2021.

The ambiguity was a control problem

The uncertainty over “justification” and “summary” was not merely an editorial flaw. It determined who controlled the transformation from evidence to publication. If the full justification was the object, the applicant’s original disclosure would become public by default after a timer expired. If a summary was the object, someone would have to choose what the summary said, what it omitted, and how faithfully it represented the private file. If selected fields were the object, someone would have to define those fields, their precision and their public purpose. Each model creates a different risk and requires a different correction process.

A complete control surface would begin much earlier than the three-month warning. It would preserve a stable request identifier, resource class and aggregate size, request and acceptance dates, the exact policy and version applied, and the role responsible for the decision. It would identify each proposed public field and the registry function served by that field. It would distinguish the original evidence from any institutional summary and from any member-proposed alternative. It would state the audience, access mode, redaction rule and retention period. It would record notice, response, extension dates, reasons, escalation and hearing.

It would preserve correction and supersession history without keeping obsolete sensitive material public forever.

Draft 1 did not provide that architecture. It did not state a field-level publication map, venue, redaction standard, personal-data rule, trade-secret classification, security review, retention period, correction history, breach response or independent review route. Its examples of patent-related and similarly sensitive service information appeared as grounds for requesting delay, not as a complete account of what must never be released. It therefore proposed a process for contesting disclosure before defining the disclosure itself.

That reversal matters. A member cannot meaningfully assess a notice unless the notice identifies the exact proposed public material and its source. AFRINIC cannot apply a consistent exception unless the protected classes and evidence standard are known. A Board cannot review doubt predictably unless the escalation trigger and governing test are stated. The public cannot compare decisions unless it can distinguish an original justification, an edited summary and an alternative text. Clocks organize administration; they do not supply these missing rules.

The most responsible reading of Draft 1 is consequently narrow in historical claim and demanding in institutional analysis. It was a published proposal for a two-year disclosure mechanism. It exposed a genuine question about accountability in scarce-resource decisions. But it did not establish what public transparency required at the level where privacy, business risk and correction actually live: the individual field.