Transcript ppt - apnic
Proposed APNIC protocol for handling of abuse complaints Network abuse BOF Gerard Ross, APNIC <[email protected]> Background • Spam and abuse complaints – Daily drain on APNIC resources – Problem likely to get worse for a long time before it gets better – Complaints come from outside APNIC membership and generally outside of AP region – APNIC seeks guidance from membership of correct role Proposed protocol for handling abuse complaints • Intentions – To start discussion on appropriate role for APNIC – To seek membership approval for proposed use of APNIC efforts and resources Guiding principles • APNIC’s core responsibilities: – Distribution of IP (and related) resources – Public registration database • APNIC is responsible for maintaining registration of the allocations and assignments it makes • LIRs and NIRs are responsible for maintaining registration of allocations and assignments they make • APNIC’s mandate is technical rather than behavioural Balancing perception and reality • Can’t expect general public to understand RIR system – Complaints will continue – …and will be repeated • APNIC should help fellow Internet community members, but not at undue cost to APNIC membership – Core responsibilities should not be compromised Specific actions - abuse • Clear instructions on website – Outlining APNIC’s actual role – Specifying mailboxes for abuse complaints • All reports of abuse will be answered with a standard response – No further response will be sent unless additional relevant information is received Specific actions - contact problems • If network contact fails to respond to complaints – APNIC will not take action – Out of APNIC’s powers to compel networks to respond • If network contacts bounce complaints or are otherwise invalid – APNIC will fix records it maintains – APNIC will refer problems to responsible party if records not maintained by APNIC – APNIC will report action taken to complainant Other general actions • Develop suitable information on website to help public track abuse effectively • Develop materials to raise membership awareness of issues, responsibilities, and preventative measures • Training modules – Web site content – Apster • Provide forum for discussion of anti-abuse strategies Discussion… • Does this approach seem reasonable and appropriate? • Are there other roles for APNIC? • Is it acceptable to require that bad contact reports are submitted by web form only?