Summary

  • Prop-172 would define categories of Internet abuse involving IP addresses, while expressly creating no new reporting, compliance or enforcement mechanism.
  • The proposed text leaves first-instance judgement with a notified resource holder that has the practical ability to act, and says APNIC has no power to adjudicate abuse.
  • The 10 September APNIC 62 discussion should make the boundary durable: vocabulary now, and a separate evidence-and-authority test for any later obligation or remedy.

One IP address can sit at the junction of very different facts. A route may have been deliberately hijacked. A phishing page may have been placed on a customer’s hosting account. A routing error may have been identified and corrected promptly. The address helps locate infrastructure. It does not, by itself, establish who acted, what they knew, whether the holder could intervene, which law applies, what evidence is sufficient or what remedy should follow.

That distinction is the real work inside prop-172-v001. The proposal, posted on 10 August and listed for discussion at the APNIC 62 Open Policy Meeting, would add “Internet Abuse through IP Addresses” to an APNIC policy document. The final location is not settled; the proposal names the IRT-object provisions as one possible home. APNIC’s meeting preview describes the change as a shared definition rather than a new enforcement system.

A category is not a verdict

Version 1 names a broad but recognizable set of conduct. It includes malware and botnet command-and-control hosting; DDoS traffic that is originated, amplified or reflected; deliberate or grossly negligent routing abuse such as BGP hijacking; fraudulent acquisition, transfer or sub-allocation of number resources; and infrastructure used for phishing, scams, fraud or impersonation.

The text also draws exclusions. A good-faith operational error that is identified and corrected promptly would not qualify. Nor would third-party unlawful conduct automatically make the resource holder an abuser if the holder addresses it promptly after notice. An isolated delayed or imperfect response is not enough on its own. Record retention is encouraged, not required.

Those qualifications matter because they prevent the list from functioning as a strict-liability switch. The proposal says that a resource holder decides in the first instance whether reported conduct falls within the definition, where the reporter has a legitimate basis, the holder has been notified and the holder has practical ability to act. It protects reasonable good-faith action on a substantiated notice and says that action does not create a wider monitoring duty or admit liability.

Most importantly, the operative text says APNIC does not have the power to adjudicate abuse. That sentence should control how the rest of the proposal is read.

One phrase still carries too much weight

The difficulty is the sentence that follows. It says APNIC retains an existing responsibility to hold resource holders accountable for responding to and addressing abuse. The proposal also says that it creates no new obligation, report, compliance mechanism or enforcement power.

Both statements can coexist only if “holding accountable” remains tied to APNIC’s existing registry and contact-response functions, not to deciding the truth of a complaint. Version 1 does not identify a case-decider after the holder’s first judgement. It does not define the evidentiary standard for a “substantiated” notice, the meaning of “promptly”, the threshold for a pattern of non-response, the treatment of conflicting jurisdictions or the remedy for disagreement.

The proposer argues that an undefined term makes enforcement nearly impossible, contributes to bulletproof hosting and leaves a gap compared with abuse-contact rules in other regions. Those are the proposer’s claims in this source packet, not independently established findings. The same is true of the description of how other RIRs address the issue. APNIC’s Secretariat impact assessment, posted on 26 August, says no direct registry impact is expected and warns that deciding whether abuse occurred or whether a response was adequate would move APNIC beyond current IRT-contact validation.

Definition first, authority later

A shared vocabulary has value. It lets operators distinguish a corrected mistake from deliberate routing conduct, and a single lapse from a pattern. It can improve the questions asked of abuse desks without requiring APNIC to investigate content or judge liability.

But a definition is also a foundation on which later power may be built. The words “without limitation”, content-adjacent categories such as fraud, and references to unlawful conduct create interpretation pressure. That is not proof of present overreach. It is a reason to record the boundary while the proposal is still narrow.

The disciplined conclusion is neither to reject every definition nor to treat terminology as harmless. Adopt vocabulary only with a visible allocation of decision rights: reporters allege; resource holders assess and act in the first instance; APNIC administers number-resource and contact obligations; any later investigator, reviewer or sanctioning body must receive authority through a separate policy.

Sources