Summary

  • The RIPE policy that created annual abuse-c validation (proposal 2017-02, which became RIPE-705) explicitly states the RIPE NCC "has no mandate to interfere with the internal abuse handling procedures of resource holders" [1].
  • RIPE NCC's 2025 Annual Report (RIPE-855) records 86,959 validated abuse-c email addresses and 2,320 validation investigations, up from 83,509 addresses and 2,366 investigations in 2024 (RIPE-840). These are contact-data quality metrics, not remediation outcomes [2].
  • At RIPE 89 (Prague, October 2024), rights holders BeIN and the Premier League described live piracy from the same RIPE-region IPv4 addresses and difficulty obtaining responses from network operators [3].
  • No case appears in the reviewed public record of an arbitration or closure/deregistration proceeding triggered by a third-party abuse report. The registry's disciplinary machinery demonstrably fires for registration disputes, not reported abuse.

A chain that only validates its first link

The RIPE region's abuse-handling system rests on a registry object, the abuse-c, whose email address must work. Proposal 2017-02, which became RIPE-705, gave the RIPE NCC an explicit mandate to validate that contact annually. The same text drew a boundary around the one scenario that matters to a complainant: cases where the abuse-mailbox attribute is correctly configured but reports are not followed up in the way the complainant would like. There, the policy text says, the RIPE NCC "has no mandate to interfere with the internal abuse handling procedures of resource holders" [1].

The policy document itself records the asymmetry. Over the preceding five years, the NCC investigated and resolved more than 1,000 external reports of incorrect abuse-mailbox attributes without ever triggering closure or deregistration of a member — a mechanism described as a last resort, with a three-month window for the holder to resolve the issue [1].

What the annual reports measure

The figures the RIPE NCC publishes about abuse measure inputs, not outcomes. The 2025 Annual Report (RIPE-855) records 2,825 Assisted Registry Checks (exceeding a 2,400 target), 2,320 abuse-c validation investigations (801 LIR accounts, 764 LIR resources, 755 end users), 77,086 abuse-c ROLE objects created or updated, and 86,959 abuse-c email addresses validated — 85,696 automated, 899 manual — up from 83,509 in 2024. The NCC states it successfully validated all abuse-c addresses to comply with RIPE-705; the figures are unaudited [2].

The 2024 report (RIPE-840) had recorded 2,445 Assisted Registry Checks (versus 2,297 in 2023) resulting in about 5,500 corrective actions, 2,366 validation investigations, and abuse-c ROLE objects created or updated falling from 149,228 in 2023 to 102,939 in 2024 [4].

None of these magnitudes is a count of third-party abuse reports filed, acknowledged, escalated, or closed with verified remediation. The registry publishes no such dataset. The RIPE NCC Academy training slides dated January 2025 confirm the gap implicitly: they frame abuse handling as operator-side inbound processing, handling and remediation/mitigation, stress speed as the key factor, and propose measuring success with statistics such as issues reported, end users contacted and issues resolved — an operator-side metric, not an NCC enforcement outcome [5].

Who complains, and what happens

The strongest non-operator corroboration comes from rights holders. The Security Working Group minutes from RIPE 89 (Prague, October 2024) record a presentation by Lee Kent (BeIN) and Andrew Willatt (Premier League) describing live piracy via RIPE-region IPv4 addresses, repeat infringement from the same addresses, and difficulty obtaining responses from network operators. They called on RIPE NCC to improve transparency and communication and to develop policies addressing repeat infringers.

Hans Petter Hollen of the RIPE NCC responded with abuse-c and registry-accuracy detail and statistics — that is, at the input-quality layer the complaint did not concern [3].

The policy machinery, meanwhile, stood still. The former Anti-Abuse Working Group was renamed and re-chartered as the Security WG, approved at RIPE 89, with its original page retained as an archive [6]. The Security WG charter lists "tackling abuse of Internet infrastructure and resources" as a core goal while stating the WG is not the place to report abuse or spam [7]. The RIPE 90 minutes (13 May 2025) record administrative matters, approval of the RIPE 89 minutes and calls for more discussion on the new mailing list — no policies under discussion [8].

The RIPE 91 minutes (21 October 2025) again show no policies under discussion; co-chairs Brian Nisbet, Tobias Knecht and Markus de Brün said they would assist with and route relevant proposals to suitable venues if the Security WG was not the right home [9].

On the Security WG mailing list, a contributor argued in a post dated 4 August 2026 that some organisations ignore abuse complaints because it is cheaper and there is no penalty, distinguishing "opportunistic" non-compliance from abuse-dependent business models and suggesting the RIPE region lacks any mechanism that makes ignoring third-party abuse reports costly, pointing to a LACNIC-style approach [10]. Other discussion floated progressive sanctions, such as blocking database object updates, without adoption [11]. These are individual mailing-list opinions, not RIPE policy or NCC action.

The pattern of absence

No case appears in the reviewed public record of a published arbitration or closure/deregistration proceeding triggered by a third-party abuse report. The enforcement machinery demonstrably fires for registration disputes and violations of the SSA; the 2017-02 text places holders' internal abuse handling outside the NCC's mandate [1]. This report publishes that as a pattern of absence in the reviewed record, not a proven universal.

The gaps are explicit: there is no per-complaint outcome dataset, the named rights holders have received no public operator response, there is no recurrence metric, and the driver of the 2024-to-2025 rise in validated addresses is unverified.

Sources

  1. RIPE policy proposal 2017-02 (RIPE-705)
  2. RIPE NCC Annual Report 2025 (RIPE-855)
  3. Security Working Group minutes, RIPE 89
  4. RIPE NCC Annual Report 2024 (RIPE-840)
  5. RIPE NCC Academy abuse-desk training slides, January 2025
  6. RIPE Anti-Abuse Working Group page
  7. RIPE Security Working Group charter
  8. Security Working Group minutes, RIPE 90
  9. Security Working Group minutes, RIPE 91
  10. Security WG mailing list, post of 4 August 2026
  11. Anti-Abuse WG mailing list archive thread
  12. Archived Anti-Abuse Working Group page