Resource Hijacking is a Policy Violation

Definition and substantive scope of resource hijacking · The supplied new text broadens the operative concept from announcing a prefix without the holder's consent to announcing any IPv4, IPv6, or ASN resource through BGP without consent, expressly including unallocated or unassigned resources. It also addresses leasing or selling resources without consent and identifies affected recipients and paying users as victims.

Connection required between the suspected hijacker and LACNIC policies · The supplied old text states that the locations of the holder and hijacker are irrelevant and that a violation may exist even when both are outside the LACNIC service region. The supplied new text instead says that an investigation will accept only reports in which the suspected hijacker is related to LACNIC policies.

Eligible events and reporting parties · The supplied new text adds that the mechanism concerns persistent and deliberate events, limits submission to directly affected networks, defines qualifying victims, excludes reports from unaffected submitters, limits consideration of evidence more than six months old, and later requires regular and repeated hijacking before violation procedures may be applied. The supplied old text did not contain these detailed standing and repetition requirements and instead allowed consideration of persistent cases or cases reported within six months after cessation.

Report contents and public disclosure · The supplied old text called for a public reporting form, public availability of reports so third parties could contribute, and a private section for sensitive information. The supplied new text adds impact and hijacked ASN information to the example report fields and limits public disclosure to information about hijacked routes or ASNs, primarily to avoid duplicate reports.

Expert review deadline and consequence of delay · The supplied new text changes the deadline for the experts' judgment from four weeks to six weeks after receipt of a report and expressly requires dismissal if the report is not completed within that six-week period.

Treatment of upstream or first-hop transit providers · The supplied old text allowed a first warning to direct upstreams and possible treatment as involved parties after repeated intentional cases. The supplied new text instead mandates notification to upstream or first-hop transit providers that permit the hijack, specifies that this is not a formal warning and requires no reply, and frames it as a request for information or investigation.

Accidental events and compromised infrastructure · The supplied old text stated that accidental or not-clearly-intentional cases would receive a warning that could be considered if repeated. The supplied new text requires experts to dismiss clearly accidental cases while documenting them for notification, supplies similarity of prefixes or ASNs as an example indicator of accident, and retains an exclusion for infrastructure shown to have been tampered with by a third party.

Expert qualifications and pool governance · The supplied new text adds a definition of an expert, including desired eBGP, peering, transit, and interconnection-agreement experience. It also adds random and balanced case assignment, confidentiality of selected experts, confidentiality agreements, response and deadline-based replacement rules, and a requirement that equal expert numbers apply to each phase rather than merely being determined during implementation.

Investigation and initial decision procedure · The supplied new text adds dismissal of reports lacking sufficient information, notice and an opportunity for the suspected hijacker to submit evidence, verification of that evidence, a joint expert report, majority agreement to determine intentionality, and a prohibition on experts adding accused parties. It also narrows permissible administrative support by excluding contact with claimants for further information and disclosure of confidential member information.

Appeal decision standard · Both supplied texts provide a separate expert group and a four-week appeal review, but the supplied new text adds that the appeal is dismissed if a majority cannot agree and states that maintaining an initial deliberate-hijacking decision requires the expert majority to be maintained during the appeal.

Ratification authority and public consultation · The supplied old text assigned ratification of a policy violation to the LACNIC Board. The supplied new text replaces Board ratification with unanimous ratification by all experts involved after a two-week public consultation, with dismissal if unanimity is not achieved and authority for experts to refuse ratification based on undisclosed sources or consultation information.

Transition-period exclusions for existing bogons · Both supplied texts establish a six-month warning-only transition for non-malicious announcements of unassigned resources. The supplied new text additionally treats bogons existing when implementation begins as exclusions and requires cases referring to them to be dismissed before assignment to experts.