Summary

  • APNIC 62 made no consensus call on prop-172. The proposal remains under discussion; it has not changed APNIC policy.
  • Version 2 narrows “IP address abuse” to technical harm and leaves first-instance decisions with resource holders. It does not settle how APNIC could judge whether a disputed response was adequate.

Analysis

Defining abuse sounds like a vocabulary exercise until a policy uses the definition to decide which complaints a resource holder must handle. APNIC’s prop-172 puts that boundary in view. Its second version removes the word “unlawful” from the operative definition, so the test no longer depends on different legal standards across the region. It instead covers conduct that causes, attempts to cause, or creates a material risk of technical harm to Internet security, stability, or trust, where the holder can practically address it.

The examples are concrete: malware hosting, distributed denial-of-service traffic, malicious scanning or intrusion, routing-layer abuse such as BGP hijacking, fraudulent resource transfers, and infrastructure used for phishing or impersonation. Version 2 also adds attempted harm, a good-faith safe harbor, and more explicit limits on how that safe harbor interacts with national law. These revisions answer some concerns raised after version 1; they do not make every report self-proving.

The proposal’s authors say it would add no new obligation, reporting requirement, or compliance mechanism. APNIC’s current APNIC-127 policy already requires an Incident Response Team object for each resource record, regular monitoring of its listed contacts, and prompt responses to abuse complaints. Prop-172 would supply a definition for the existing response duty and a starting point for later policy proposals. That is a meaningful change in how the duty could be interpreted even if no new enforcement tool is added today.

The proposal assigns first-instance decisions to the resource holder when a report has a legitimate basis and the holder can act. It also says APNIC cannot adjudicate abuse, while describing a role for APNIC in holding holders accountable for ignoring legitimate reports in bad faith. The unresolved step is how to test that accountability without indirectly deciding whether the underlying conduct was abuse. APNIC’s Secretariat raised a similar concern in an impact assessment explicitly marked for version 1; version 2 acknowledges the question but leaves it to a proposed working group and future policy discussion.

At APNIC 62, the chairs made no consensus call. APNIC’s meeting recap says discussion will continue on the Policy SIG mailing list. This is not a vote against prop-172 or a rejection. APNIC’s current proposal overview lists it as still under discussion; no new definition is in force. Under the Policy Development Process, a proposal that gains consensus moves through member review, final comment, Executive Council endorsement, and implementation. Those steps have not occurred for this proposal.

The outcome leaves a governance problem, not a verdict. A usable abuse contact needs a clear path from report to the operator able to act. A resource holder also needs enough evidence and procedural protection to avoid treating an unverified allegation as a finding. The next draft will need to keep those functions separate: prompt response can be required without quietly turning APNIC into the tribunal for every disputed case.

Sources