Summary

  • APNIC said on 21 August that it had completed the sale of 6 Cordelia Street, moved to a temporary office at 35 Boundary Street and directed formal physical service to the new street address; its post-office box and telephone numbers did not change.
  • The live RPKI Certification Practice Statement still names 6 Cordelia as a contact address and says APNIC owns the building where RPKI CA operations are conducted in a protected area. The CPS separately places CA computers and cryptographic modules in two external data centres.
  • Propagation has begun, not failed wholesale: APNIC Hostmaster and Network Operations records show the PO box and 26 August modification times, while an APNIC organisation object, infrastructure contact and route description captured through WHOIS/RDAP still carry 6 Cordelia.
  • APNIC should publish a versioned relocation change set that assigns every old-address occurrence a semantic role, owner, effective time, transitional state, verification result and correction history instead of applying an indiscriminate string replacement.

The record moved in layers

APNIC’s announcement does several jobs cleanly. It says the sale of its office at 6 Cordelia Street, South Brisbane, is complete. It identifies Ground Floor, 35 Boundary Street as a temporary office. It tells anyone serving notices, documents or correspondence physically to use Boundary Street. It preserves PO Box 3646 for post and says telephone numbers are unchanged. It also says that a permanent office has not been finalised and that services, operations and Member support continue normally.

Those are not interchangeable address fields. A street for formal service answers a different question from a postal box. An ordinary office location answers a different question from a facility described in a security practice statement. A label in a route object may simply describe the organisation associated with a resource; it does not locate a router, authorise an origin or reveal where an abuse team works.

The first public evidence after the announcement shows exactly why that distinction matters. In the APNIC-HM lookup, APNIC Hostmaster and Network Operations both use PO Box 3646. Their records show modifications just after 00:40 UTC on 26 August. An operator reading only those contacts might conclude that the relevant address work had already been completed.

The live record for 1.0.0.0 tells a less uniform story. The APNIC Research and Development organisation object ORG-ARAD1-AP still gives 6 Cordelia Street as its address. The infrastructure contact AIC3-AP still carries a label containing the old street. The route description for 1.0.0.0/24 still pairs APNIC Research and Development with 6 Cordelia. The associated IRT record uses the PO box. APNIC’s RDAP response exposes materially the same mix.

This is partial propagation. Saying that plainly prevents two opposite errors. It would be wrong to say that APNIC has not updated its registry data: two relevant records carry 26 August modification times. It would also be wrong to treat those two changes as proof that every public surface has been reconciled. The captured objects retain several old-address meanings, and the CPS retains the strongest one.

The CPS makes a claim about control, not merely correspondence

A Certification Practice Statement is not a contact directory with a security-themed cover. It tells relying parties how a certification authority says it operates. APNIC’s live CPS names 6 Cordelia in the contact details for its Infrastructure and Development Director. More importantly, section 5.1.1 says that APNIC’s RPKI CA operations, including hosted CAs, are conducted in a physically protected area of an office building owned by APNIC at 6 Cordelia Street.

The section describes offices, meeting spaces and a machine room. It says the machine room is used to operate remotely two external data centres that host the CA computers and cryptographic modules. The next section separates those external facilities from the office, saying access to CA systems in the data centres is restricted to selected staff using key cards.

That separation is a reason for care, not alarm. The sale of an office does not establish that a CA computer or hardware security module moved. Nothing in the frozen evidence shows a validation outage, compromised key, unauthorised access or weakening of data-centre controls. APNIC expressly says operations continue normally, and the evidence packet contains no service observation to the contrary.

The unresolved question is narrower: what is now true of the office-side claims? APNIC may retain access during a transition. The completion date for the property sale may differ from the date on which an operational room ceased to be used. A replacement control point may exist without being public. Some CPS language may remain accurate for a limited period under an arrangement that the relocation announcement did not need to describe.

All of those possibilities are compatible with the public record. None is confirmed by it. The appropriate response is therefore not to infer a security incident. It is to require a disposition for the claims that readers are currently asked to rely on: still true until, superseded on, not applicable to the temporary office, or awaiting confirmation, with an owner and a date.

One search-and-replace would be the wrong repair

It might seem efficient to find every instance of “6 Cordelia” and replace it with “35 Boundary”. That would convert a visible mismatch into potentially false precision.

Boundary Street has been designated for temporary office use and physical service. The announcement does not say that APNIC owns that building. It does not say an RPKI protected area or machine room moved there. Substituting the temporary address into the ownership sentence would create a new claim without evidence. Substituting it into a route description might preserve an address that the descriptive field no longer needs at all. Substituting it for the PO box would contradict the announcement.

The work is semantic rather than typographic. Each occurrence must first be classified. Is it the address for service of legal documents, ordinary post, visitor access, an accountable role, a physical-control assertion, an organisation record, a contact label or a descriptive note about an Internet resource? Who has authority over that field? Does the old value remain valid during a transition? What public readback demonstrates that the change reached the intended interface?

That exercise also reveals places where deletion may be more accurate than replacement. If a route description’s street address contributes no current operational meaning, a controlled removal could be better than following APNIC from one office to another indefinitely. If a CPS sentence describes a real control function that has moved, the replacement needs to describe the new practice at a safe level—not expose sensitive facility detail. If a contact is supposed to receive post, the unchanged PO box may already be the correct terminal state.

A versioned change set would turn ambiguity into accountable work

The useful evidence object is a relocation change set, not a single corrected PDF. It should have an identifier, version, accountable owner, announcement time and effective time. Every row should point to a precise public surface and field or CPS clause.

The next column should state semantic role. Formal physical service, postal delivery, ordinary office, role contact, facility/control claim, registry organisation, registry contact and resource description are different classes even when the characters in their old values are identical. The change set should preserve the old value, confirmed or proposed new value and authority for making the change.

Most importantly, it should admit transitional states. A row could be false and overdue for correction. It could remain true until a documented end condition. It could be deliberately retained because the PO box has not changed. It could be inapplicable to the temporary office. It could await a facilities or security review. Unknown is a valid state when it has an owner and review date; silent ambiguity is not.

The CPS rows deserve separate treatment. The contact address, building ownership statement, protected-area statement, machine-room role and external-data-centre controls should not travel as one bundle. Updating one does not prove the others changed. The same applies to WHOIS/RDAP: organisation, role, IRT, resource and route-description fields have different maintainers and consequences.

Every completed row should record its test. That might be a cache-bypassed read of the long-lived CPS URL, a WHOIS query, an RDAP response or verification that a formal-service page shows the effective address. Corrections and supersessions should append to the record rather than erase the earlier state. A reader should be able to tell what APNIC asserted on 21 August, what changed on 26 August and what remained open at the next review.

The PDF date cannot settle the substance

At capture, APNIC’s long-lived CPS URL redirected to a PDF served with an HTTP Last-Modified value of 17 May 2021. That is useful operational evidence about the file delivered by the server. It is not a safe substitute for the document’s approval history, and it cannot prove that every clause has been untouched since that date.

The CPS itself says that, when amended, a new version is posted to the repository and the long-lived URL is updated. That creates a clear public point at which to verify the next state. The important result will not be merely a newer HTTP date. It will be whether the served document explains the disposition of the ownership and office-control statements without confusing them with the external data centres.

Versioning matters because a move has more than one effective time. The property transaction can close on one date. Staff can occupy temporary space on another. Legal service can switch immediately. Registry contacts can be edited in batches. A security practice can change before or after its public document catches up. A single last modified value flattens this sequence and hides which assertion it governs.

This is a reliability opportunity, not a scandal

Public infrastructure institutions are often judged harshly for inconsistencies that ordinary organisations treat as clerical. The higher standard is justified because registry records and trust documents exist to make distributed reliance possible. But the standard should be precise. It should reward visible correction and measured uncertainty, not manufacture an incident from a text comparison.

APNIC has already supplied two ingredients of a good record: a dated announcement with functional address distinctions, and evidence that some registry contacts changed within five days. Publishing the remaining disposition would show that the institution sees a move as a controlled transition across systems rather than as a facilities memo.

If the old CPS statement remains true for a transition, saying so with an end condition is better than rushing an inaccurate replacement. If it ceased to be true when the sale completed, a superseding CPS version should preserve that effective time. If the machine-room language no longer describes the control path, it should be rewritten without implying that the external CA systems moved. If an old street in a route description is only historical decoration, APNIC can remove it while preserving the resource record’s audit history.

The result would be more valuable than a clean search result. It would demonstrate how APNIC distinguishes legal reachability, human contact, registry data and RPKI physical controls when one shared address stops tying them together.

Sources