Summary

  • The RIPE NCC operates two parallel control stacks. One — the Conflict Arbitration Procedure and the closure ladders of RIPE-578 and its successor RIPE-858 — is fully operational and produces published, named, dated outcomes for registration-data and membership disputes. The other — the abuse-c regime through which third parties report spam, phishing and botnet activity — has no documented escalation path into that machinery at all.
  • The arbitration record is concrete. Case #20 (June 2019) consolidated 28 members whose Standard Service Agreements the RIPE NCC terminated for misleading registration data after a 2018 audit; the arbiter upheld the registry. Case #22 (April 2021) affirmed the RIPE NCC's mandate to audit and enforce data correctness. Case #23 (January 2022) ordered conditional reinstatement — and the arbiter expressly observed that the process overran its defined timeline.
  • The closure ladder is equally concrete: an initial warning email, a 30-day reminder, a 60-day second reminder, and a 90-day official termination notification from the Managing Director. RIPE-858, revised on 7 May 2026, removed the postal reminders and narrowed notification to email.
  • What triggers this machinery is defined narrowly: violations of RIPE policies and procedures, unresponsiveness to the registry itself, and audit findings. The RIPE NCC's own reporting procedure routes third-party abuse complaints to the operator's abuse-c mailbox and states that if the operator chooses not to respond, "there is nothing we can do."
  • Independent academic measurement found that between 85.9% and 92.8% of abuse contacts did not respond to reports even when the address was deliverable. The gap, in other words, sits upstream of any escalation mechanism that actually exists.

Two stacks, one registry

To understand how an abuse complaint travels — and where it stops — it helps to first map the machinery the RIPE NCC does operate. The registry is not a passive record-keeper. Its founding documents assign it a genuine enforcement apparatus, and the paper trail shows it in use.

The first stack is dispute resolution. Article 12.4 of the RIPE NCC Articles of Association requires an arbitration procedure for disputes between members and the Management Team over Standard Service Agreement decisions. Under the current Conflict Arbitration Procedure, RIPE-844 — the latest version of a procedure whose numbered lineage also includes RIPE-670 and the related document RIPE-840, both reflected on the registry's arbitration pages — a dispute must first be documented and the parties must attempt to resolve it themselves. Only then can a Request for Arbitration Form be filed — within one year of the dispute's start. The arbiter must communicate a ruling within 12 calendar weeks of the arbitration commencing, a deadline extendable at the arbiter's discretion. The parties then have two calendar weeks to comply or take the dispute to a competent national court; if they do neither, the RIPE NCC Standard Service Agreement is terminated under the closure procedure. Procedural costs are borne by the losing party and are capped below EUR 5,000.

The second stack is closure and deregistration. RIPE-578, the earlier closure procedure, defines a graduated ladder for "Violation of RIPE Policies and RIPE NCC procedures": an initial email stating the violation and warning that the SSA will be terminated in three months if it continues; a reminder at 30 days; a second reminder at 60 days; and after 90 days an official termination notification from the RIPE NCC Managing Director to all registered postal and email addresses. A separate, longer path runs to 120 days, with services stopped at 90. The document also defines "Unresponsiveness" precisely: not reacting to a specific RIPE NCC email or request about an incorrect or ambiguous registration of Internet number resources — regardless of whether the member responds to other requests or keeps paying fees.

The current version, RIPE-858, reproduces the same ladder with modifications: the 60-day step now uses a second email reminder without postal mail, following the 7 May 2026 revision that removed paper reminders from the enforcement procedure; the member is suspended; and maintainer attributes are updated so that only a RIPE NCC maintainer remains. If a member does not respond within four weeks of a deregistration notice, the registry changes the maintainer status, adds a warning to RIPE Database records, withdraws reverse delegation, may contact upstreams about possible hijacking, and may delete the relevant objects.

The machinery fires — and the record is public

These are not dead-letter provisions. The registry publishes a report for every completed arbitration case, and since an October 2016 amendment to the procedure, those reports include the names of the involved parties. The published index of rulings runs from 2004 to 2022 and is dominated by exactly the subjects the closure ladder governs: termination of the Standard Service Agreement, deregistration of Internet number resources, transfers and reversions of resources, and billing disputes. Named entries include a 2019 "Termination of the SSA — Provision of misleading information," a 2019 "Deregistration — Provision of falsified information," and a 2020 "Deregistration of Internet Number Resources — Revert the transfer... based on the provision of falsified information, termination of the SSA."

Individual cases show the apparatus working at scale and in detail. In Arbitration Case #20, dated June 2019, the RIPE NCC had terminated the SSAs of 28 members under Article 9.4.h of the SSA — provision of misleading data — after a 2018 audit. The audit itself was triggered by the registry's own observation of coordinated behaviour among members based in Seychelles: the same postal address on their agreements, the same reply about where they were signed, near-identical documentation templates. The Arbiters Panel consolidated the 28 materially identical requests into a single case and rejected the members' request to declare the terminations unjustified, finding the RIPE NCC had acted correctly.

Case #22, April 2021, went the other way on the surface of the dispute but confirmed the registry's underlying mandate: Inter Connects Inc challenged the RIPE NCC's rejection of notarised documents and its refusal of a transfer, and the arbiter ruled in the registry's favour, holding that ensuring registration-data correctness under the Due Diligence procedure — and auditing for it — falls within the RIPE NCC's mandate.

Case #23, January 2022, is the most instructive of the three. UMOS LLC disputed the termination of its SSA over allegedly fraudulent documents supporting an IPv4 transfer. The RIPE NCC had contacted the named notary, who said he had had no contact with the member and had not performed the notarial acts in question — only, later, that he had certified a translation. The arbiter found it very difficult to confirm whether the notarised statement was fraudulent, held that the registry's contact with the notary was justified due diligence, and ordered the SSA reinstated — but under conditions: verification that the implicated former employees had left the company, a six-month freeze on transfers, and at least one year of enhanced due diligence. The arbiter also observed, on the record, that the arbitration took much longer than the procedure's defined timeline, and recommended reminding the parties of the RIPE Code of Conduct.

Taken together, the cases establish three things: the escalation machinery exists; it fires, including against the registry's own first decisions; and its outcomes are published, named and dated. This is, by the standards of internet governance institutions, an unusually verifiable control surface.

The stack that has no floor

Now consider where a third-party abuse complaint goes. The RIPE NCC's own reporting procedure tells the complainant to find the network's abuse contact — in practice via the RIPEstat Abuse Contact Finder — and to mail the operator's abuse-c mailbox directly. The complaint never becomes a case before the registry. And the registry's own pages are explicit about what happens if the operator ignores it: there is, the RIPE NCC states, nothing it can do.

The trigger definitions in the closure ladder make this structural, not incidental. RIPE-578 and RIPE-858 fire on violations of RIPE policies and procedures, on unresponsiveness to the registry's own requests about registration data, and on audit findings. Nowhere in either document is an operator's failure to answer third-party abuse reports listed as a trigger. The word "unresponsiveness" is scoped to the registry's correspondence, not to a mailbox full of complaints from strangers.

The arbitration procedure, likewise, is available to members and the Management Team over SSA decisions — a category that, on the published record, has never included abuse-report handling.

The published arbitration index makes the point by omission. Across eighteen years of indexed rulings covering SSA terminations, deregistrations, transfers and billing, no case summary concerns a dispute triggered by an operator ignoring third-party abuse reports. It is possible — unverifiable — that one of the pre-2016 unnamed reports touches the subject. But the dominant pattern is clear: the registry's only verifiable escalation machinery is driven by registration-data integrity and membership compliance, not by abuse response.

The gap upstream

How much does this matter in practice? Independent academic measurement supplies the uncomfortable number: in peer-reviewed work presented at the WISCS workshop, Moore and colleagues documented that between 85.9% and 92.8% of abuse contacts did not respond to abuse reports — even when the address was technically deliverable. Prior BTW reporting has shown that the registry's annual validation tests only deliverability, never response, and that the RIPEstat lookup layer itself admits its results are often incorrect or unavailable.

Put the two stacks side by side and the asymmetry is stark. If a member submits falsified registration data, the registry audits, warns on a 90-day clock, terminates the SSA, deregisters the resources — and if the member disputes it, an arbiter rules within a target of twelve weeks and publishes the outcome with names attached. If a member ignores every abuse report that arrives in its validated mailbox, the registry's documented response is: nothing. The mechanism that demonstrably works has never been connected to the problem most complainants actually have.

None of this requires assuming bad faith. The closure ladder's narrow triggers reflect a defensible scope: the RIPE NCC's contractual relationship is with its members, and policing registration data is core to its registry function. But the effect is the same. The institution has built, tested and published an enforcement apparatus — and left the abuse-c regime outside it. For the complainant whose report disappears into a deliverable, unread mailbox, the two stacks produce a single outcome: the machinery that could compel a response is never asked to.

What a remedy would require

The asymmetry is not immutable; it is a design choice that could be revised. Connecting abuse handling to the existing escalation machinery would require three things the registry has already built for other disputes. First, a defined trigger: an operator's documented non-response to verified third-party abuse reports, framed the way "unresponsiveness" to the registry is framed today. Second, a measured consequence: the closure ladder's graduated reminders, applied to the abuse-response obligation rather than only to registration-data obligations.

Third, verifiable adjudication: arbitration reports that record, like Cases #20 through #23, who disputed what and how it was resolved.

Whether the RIPE NCC membership would consent to such a widening is a governance question, not a technical one. Prior BTW coverage documented a 2019 reform proposal aimed at testing abuse-contact response that was withdrawn over cost consensus. What the arbitration record adds is a demonstration that the registry can run enforcement with published, named, dated outcomes — the exact properties the abuse-c regime lacks. The precedent exists. What is missing is the decision to extend it.