Summary

  • Prop-173 is a version-one proposal under discussion, not an adopted APNIC rule. It would create public, versioned acceptable-use terms for ordinary WHOIS, RDAP, web and equivalent directory queries, including notices and a reviewable enforcement ladder.
  • APNIC should pair those terms with a machine-readable rights ledger that distinguishes facts, authored expression, selection or arrangement, contributor material, mirrored values, privacy duties and service rules field by field.

One response, several kinds of claim

Imagine an ordinary RDAP response opened on an operator’s screen. It may identify a resource range, status, registration event, organisational role, contact channel, remarks and links. The response is assembled and served by a registry, but its contents did not necessarily originate in one place. A registry may have assigned an identifier and recorded a date. A resource holder may have supplied contact language. Another registry may be authoritative for a referred object. A service process may add a notice. Software renders the pieces into one JSON document.

Prop-173 would put a policy notice into that encounter. The proposal asks APNIC to publish a separate, public and versioned acceptable-use policy for ordinary access to WHOIS, RDAP, web searches and equivalent APIs. It would state permitted low-volume operational and technical-research uses and restrict activities including systematic harvesting, marketing, profiling, geolocation inference, commercial data products, rate-limit evasion and some persistent copying or redistribution. It would also permit warnings, throttling, suspension, blocking or termination, including automated measures, subject to review.

That is a serious response to a real gap. APNIC already provides bulk Whois data under a signed acceptable-use agreement. Its public bulk-access materials restrict onward bulk distribution and uses such as targeted advertising or geographic mapping. An engineer making an ordinary query, however, does not encounter the same explicit bargain. Prop-173 tries to make the boundary visible where the data are actually retrieved.

Visibility is not the same as provenance. A notice can say that terms apply. It cannot, by itself, show that APNIC owns copyright in every value, that a contributor assigned a right, that a mirrored field is governed by APNIC rather than its authoritative source, or that a restriction rests on copyright at all. The policy needs two ledgers: a use ledger that tells the reader what conduct is allowed, and a rights ledger that shows why each material restriction can be asserted.

The proposal is not yet the rule

The status must remain precise. APNIC published prop-173 version 1 to the Policy SIG mailing list on 17 August 2026. The canonical proposal page labels it “Published to Mailing List.” In the checked record there is no Secretariat impact assessment, consensus finding, adoption decision, effective date or implementation.

That procedural state matters because the text is still an invitation to test the design. It should not be described as APNIC policy, and the existence of a technically valid notice mechanism should not be mistaken for deployment. The policy community can still ask what the notice claims, what evidence supports it, how automated restrictions will be explained and which appeals can change an outcome.

The proposal’s versioning discipline is one of its strongest elements. It calls for a stable policy URL, an amendment archive and consultation before protections are materially weakened. Those features allow an operator to identify the rule that applied at a particular time. They also create the natural place for a rights ledger: every policy version can point to a corresponding statement of sources, legal bases, permissions and remedies.

Copyright cannot carry every governance burden

Prop-173 asks APNIC to assert all copyright and other rights available under Australian law. That formulation may be intended to avoid accidental waiver. As public governance language, however, it is too compressed. “All rights available” does not tell a directory user which right exists, in what object, for whose benefit, or how a permitted operational use relates to a statutory exception or contractual permission.

Australian copyright law recognises original literary works and includes tables or compilations expressed in words, figures or symbols within the definition of a literary work. It also separates subsistence, ownership, acts comprised in copyright, substantial-part analysis and exceptions. The Attorney-General’s Department explains the basic distinction in plainer terms: copyright protects original expression of ideas or information, rather than ideas or information themselves.

The High Court’s IceTV decision makes caution especially important. The dispute concerned television schedule information used in an electronic guide. The Court’s official summary says IceTV did not infringe copyright by using time and title information, assuming without deciding that copyright subsisted in Nine’s database. The reasoning focused on originality, authorship, the information-expression distinction and the quality of what was taken, rather than rewarding an undifferentiated claim over data because labour had been spent assembling it.

IceTV does not decide APNIC’s rights. An article cannot decide them either. It does show why the policy should not make a single copyright sentence do the work of a provenance system. A resource range may be a fact in a protected compilation. A free-text remark may contain authored expression. A registry’s selection or arrangement may carry a different claim from the values contributed by a holder. A referred record may arrive under another source’s terms. These possibilities need classification, not a public conclusion that everything is either owned or free.

Coordination facts are not institutional property

The distinction is constitutional as well as legal. An Internet number registry performs a uniqueness-coordination function. It records which resource is associated with which account, authority or status so that networks and other systems can rely on a coherent public record. The record may require investment, security, validation and careful administration. Those costs justify sustainable service rules. They do not mean the institution should appear to own the underlying coordination fact merely because it operates the database.

This is the point at which Heng Lu’s distinction between bookkeeper and principal becomes useful. A recordkeeper can have rights in software, explanatory text, selection, arrangement and service infrastructure. It can enforce contracts and protect personal data. It can limit requests to preserve availability. None of those powers automatically turns an address range, an autonomous system number or the historical fact of a registration event into the registry’s asset.

The danger is not only rhetorical. If copyright becomes the default explanation for every restriction, portability and independent verification acquire a cloud of permission. Researchers may not know whether retaining a record for longitudinal analysis is a copyright issue, a privacy issue or a contractual caching limit. Operators may not know whether sharing evidence during an incident is permitted operational use. Competing data services may be accused of appropriating registry property when the actual concern is bulk load, personal-data aggregation or misleading republication.

A narrow rights statement would strengthen APNIC rather than weaken it. It would reserve proprietary claims for the objects and acts to which they plausibly attach, while giving privacy, security, contract and continuity rules their own explicit authority.

RDAP can carry a notice, not prove its basis

RFC 9083 already gives RDAP a place to communicate service-wide information. Its notices structure can describe terms of use and link to a policy. The RFC even supplies an example containing a copyright statement. That makes prop-173 technically unsurprising: a stable terms link and short notice can travel with the response without changing the substantive registration object.

The protocol field is a container, not an adjudicator. RFC 9083 does not determine whether copyright subsists in a response, whether APNIC is the owner, whether a use is fair dealing, whether a contract was formed, or whether a privacy duty requires restriction. A well-formed notice proves that the server communicated text. It does not prove the text’s legal basis.

That boundary should shape implementation. The response notice can remain concise: identify the applicable policy version, provide a stable link and flag that use restrictions may depend on the data class and purpose. The linked rights ledger should carry the detail. For mirrored or referred values, it should identify the authoritative source rather than implying that the serving registry supplies every right. For personal fields, it should point to privacy classification and correction. For service limits, it should identify availability protection rather than forcing the language into copyright.

What a directory rights ledger should contain

The ledger should be public, versioned and machine-readable. Its unit should be a field or coherent field class, not the database as one indivisible object. Each entry should answer a bounded set of questions.

First, where did the value come from? The ledger should name the authoritative source and contributing actor class: registry-created identifier, holder-supplied contact, registry-authored explanatory text, derived status, mirrored value, referral or service metadata. It need not expose a person or internal system to describe that provenance.

Second, what right or rule is asserted? The answer may be copyright in original expression or arrangement, a contributor licence, a service contract, privacy law, confidentiality, security, rate-limiting for availability, registry policy or the terms of a third-party authoritative source. More than one basis can apply, but each should remain named.

Third, who can exercise it? A rights holder, contracting party, data subject, authoritative registry and service operator are not interchangeable. The ledger should record the relevant actor class and identify when APNIC acts on another party’s authority rather than its own ownership.

Fourth, what can a user do? Operational troubleshooting, abuse response, routing security, technical research, journalism, historical verification and limited caching should have intelligible permissions. Redistribution, persistent storage and combination can be described by data class and purpose instead of one vague prohibition. Where an exception or permission requires contextual judgement, the ledger should say so rather than promising certainty.

Fifth, what happens when the rule is enforced? Every automated intervention should produce a public-safe reason code tied to a policy and ledger version, the affected interface or request class, the enforcement actor and a review route. Thresholds that would enable evasion can remain confidential. The user still needs enough information to distinguish load protection from suspected harvesting, privacy risk or contractual misuse.

Finally, how does the record change? Each entry needs an effective version, change notice, superseded rule, caching or deletion treatment and correction path. A claimant who says a field was misclassified should be able to challenge the classification without first disputing an entire acceptable-use regime.

The ledger must be disciplined about what it does not publish. It should not expose personal information, confidential agreements, privileged legal advice, abuse-detection signals or exact thresholds that make evasion easier. Transparency concerns the authority model, not every security control.

Enforcement must preserve explanation

Prop-173’s enforcement ladder is more defensible than an immediate block. Warning, throttling, suspension, blocking and termination recognise that conduct and harm differ. Review matters because automation can confuse legitimate parallel queries, shared infrastructure, research crawls and malicious harvesting.

The review mechanism nevertheless needs a reviewable object. “Excessive use” without a rule version, request class and reason code leaves the reviewer reconstructing the system’s conclusion. A copyright notice without a field or right leaves the user unable to explain why an operational use was restricted. A rights ledger turns the dispute from an argument over institutional authority into a testable question: which rule applied to which data and act?

APNIC should also separate urgent service protection from final policy judgement. A temporary throttle may be necessary before intent is known. It should be possible to restore service, preserve logs and classify the event later without treating the first automated signal as proof of copyright infringement or prohibited commercial use. Emergency action and durable finding are different acts.

Comparative practice is useful but not dispositive. RIPE NCC and ARIN publish terms for their registry information services. Their approaches can reveal common categories of permitted purpose, misuse and limitation. They do not determine APNIC’s rights, legal setting or community decision. Prop-173 should borrow clarity, not outsource authority.

Sources