Summary

  • Prop-173 proposes a separate, versioned acceptable-use policy for ordinary WHOIS, RDAP, web searches and equivalent APIs; it is still a mailing-list proposal, not adopted policy.
  • Its legitimacy will depend on notice, operationally workable permissions, understandable rate limits and a review route for users blocked in error.

An address lookup can be routine infrastructure work: confirming who operates a prefix, checking a routing contact, investigating abuse or repairing reverse DNS. Yet the answer can also be copied into a monitoring system, stored for months, combined with other datasets or sold as an enrichment service. Those actions have different consequences, while the interface may present them as one simple query.

That is the gap Jonathan Brewer’s prop-173 tries to address. Its problem statement says APNIC’s existing acceptable-use agreement is built around bulk Whois access and does not clearly set rules for ordinary ad-hoc lookups. The proposal asks for a separate public, versioned policy across WHOIS, RDAP, web search and equivalent APIs. APNIC currently lists it as published to the mailing list; it has not reached consensus on that page.

The distinction matters because ordinary lookup and bulk access are not the same product. The current bulk-access agreement limits full database downloads to specified Internet-operational purposes and restricts reproduction and onward transfer. Prop-173 says ordinary query terms should be separate, while also making clear that an ordinary query does not confer a right to mirror or assemble a substitute database. That gives a network operator room to troubleshoot without silently granting a data broker the same use rights.

The proposal goes further than a copyright footer. It would list permitted tasks such as routing coordination, identifying a resource holder, technical research and responding to security incidents. It would bar uses such as marketing lists, geographic profiling, resale as a directory product and systematic harvesting. It would address temporary caching, rate and concurrency limits, terms notices in WHOIS and RDAP responses, a stable policy URL, version history, advance notice of material changes and review for a user who believes a restriction was mistaken.

Each is a design choice, not a present APNIC rule. The proposal itself recognizes that an operational query by a commercial network or security provider is not automatically improper merely because the user is a business. The relevant distinction is whether data are being used to operate or secure a network, or turned into a separate product. Without that distinction, a broad “commercial use” ban could catch the very services that keep networks interoperable. Without limits on extraction and resale, the registry’s operational record could become a source of unreviewable commercial profiles.

This is a control-surface problem. The database has a record; the service supplies it; the user decides what to do next. A clear contract needs to describe all three, and the enforcement layer needs to make its decisions legible. If the terms appear only after a query, arrive through one interface but not another, or point to a changing document without a version history, consent and compliance become difficult to establish. If an automated limiter can block a researcher or abuse team without explaining how to request review, the restriction can outlast the event that triggered it.

The proposal also recognizes that directory data may be referred from another registry. Its draft would apply APNIC’s terms to APNIC-authoritative records while leaving referred data subject to the authoritative source’s terms. That boundary is practical but demanding: a service must preserve provenance well enough for a user to know which rules apply to which result.

Prop-173 therefore asks more than whether APNIC owns a database. It asks whether routine access is governed by terms that can be read before use, applied consistently across protocols, and challenged when the operational classification is wrong. The proposal is still open for discussion. Its adoption, wording and implementation remain undecided.

Sources

The Heng Lu note below is an analytical lens on participation and authority, not evidence about APNIC.