APNIC’s AI incident triage plan and the evidence gap

Summary

APNIC’s Executive Council approved a 2027 plan that puts exploration of an internal AI “first responder” for infrastructure-incident triage in Q3. The plan specifies no deployment status or agent decision powers.
In a 2021 Whois disclosure, APNIC said a database copy may have been public for three months. Complete access logs were unavailable, so the organization could not determine whether anyone accessed it; investigators found no sign of suspicious update activity.

The answer stopped at “unknown”

In June 2021, APNIC had two different incident questions to answer. It could fix the configuration that exposed a copy of its Whois database. It could not say who, if anyone, had seen it.

APNIC’s incident disclosure says a database dump had been copied to a Google Cloud storage bucket that staff believed was private. A configuration error made the bucket public. The dump contained hashed maintainer and Incident Response Team authentication details, as well as private Whois objects. APNIC said the private objects were current only to October 2017.

An independent researcher told APNIC about the exposure on 4 June. APNIC corrected the bucket configuration and removed the copy. It said the file may have been publicly visible for three months. Complete access logs were unavailable; the organization therefore could not determine whether the data had been accessed. Its investigation found no sign of suspicious updates. APNIC reset maintainer and IRT passwords and guided about 50 resource holders who had actively used email-based Whois updates during the previous six months through their own resets.

Both findings belong in the record because they answer different questions. “No suspicious updates” describes what the investigation found in the update record. “Access unknown” describes the question the missing logs could not settle. A response can contain the exposure and rotate credentials while leaving the audience of a disclosure unresolved.

APNIC’s adopted 2027 Activity Plan now says it will “Explore developing internal AI agent capable of ‘first responder’ workflow to triage infrastructure incidents (Q3).” The Executive Council approved and adopted the plan and budget by unanimous resolution; the minutes were adopted on 19 October. The verb is explore. The record does not say that the agent exists, has production access or can change an incident’s status.

The plan gives the proposal a job and a quarter. It omits the evidence the agent may inspect, its output, the escalation owner, the human override, incident-record retention and the evaluation method; publishing those details would show whether the agent sorts a queue or gates human attention.

The queue is part of incident response

Triage looks administrative until an incident arrives. A label sets an order. An order determines which report a person sees first and which evidence is attached to it. If a system quietly classifies an incomplete record as routine, the next person inherits the classification along with the alert. If it preserves the evidence gap, the investigator can decide what to collect next.

That distinction is especially important for a first responder. APNIC’s own Information Security Policy says security incidents are to be reported, investigated and acted on systematically and in a timely manner. A triage tool sits inside that sequence, before investigation has finished. It can affect what gets attention without being the authority that closes the investigation.

APNIC draws another boundary on its security page: incident response and law enforcement on Member networks are outside its RIR role. The proposed agent concerns APNIC’s own infrastructure. Its plan assigns no policing of security incidents across the membership.

The 2021 disclosure is not identified as the reason for the 2027 proposal. It is a concrete test of the kind of record an incident system must preserve: what was exposed, when it was removed, which credentials were reset, what the investigation found and what remained unknowable. An AI system cannot reconstruct access logs that were never complete. It can keep their absence visible, point to the unanswered question and route the investigation without turning “unknown” into “no access.”

The next public evidence should be an operating description before a performance claim: permitted sources, generated fields, escalation owner, human override, retention and an evaluation that tests incomplete records. A useful exercise would give the agent a closed incident file with a known evidence gap and check whether it marks the gap, cites the records it used and asks for a human decision rather than inventing closure. APNIC’s plan separately sets 99.99% availability objectives for Whois, RDAP, RPKI, RDNS and IRR; that is a service target, not an AI triage score.

The Council approved an exploration for Q3 2027. The first test is whether the record can still say “unknown” when that is all the evidence allows.