Publication of Information (Draft-1) Archived

1. Summary of the problem being addressed by this proposal

Recent discussions in the RPD and unprecedented situations in AFRINIC demonstrated that some of the information provided for the justification of the requests for resources could be used maliciously and not discovered at a first sight when those recourses are allocated/assigned.

This is especially harmful to the community and the AFRINIC region in general when resources are being exhausted as is the case now for IPv4 and must be avoided.

At the same time, it is understandable that the justification of a request for resources can be confidential as it can provide insights into a business plan to competitors. However, it is also obvious that in the Internet business, time passes very quickly and the need for confidentiality vanishes very quickly. It is difficult to believe, for example, that you request resources for the next 5 years, and only in year 5, your business will be public.

In summary, the problem is that the long-term confidentiality of a resource request justification is against the principles of openness, transparency, and fairness.

2. Summary of how this proposal addresses the problem

This simple proposal looks for the publication of information about resource request justifications after a community agreed period of time unless there is a valid demonstration of the need to extend the confidentiality period.

3. Proposal

New 13.0 of the CPM, as follows:

Current

Proposed

None

13.0 Publication of Information Following the principles of openness, transparency, and fairness and considering that we are dealing with community resources that aren’t property, after 2 years of every accepted resource request, the justification of that request must be published. The resource member will be warned 3 months before the publication with a draft of the summary to be published. In case there are reasons (such as patents or similar ones), that avoid the publication of those details and demonstrate the unique nature of the services offered which, if disclosed, could damage the resource member business, it will have up to 1 month, to provide an alternative text to be published or request an extension of 1 year on that publication. AFRINIC will have 1 month to accept the justification and, in doubt, escalate to the Board that must resolve in a maximum of 1 month after hearing the resource holder. This policy shall be implemented in such a way that all the resources allocated/assigned for over 2 years, will be chronologically warned, allowing the staff to process the possible responses of “non-disclosure” without requiring extra human resources.

Revision History

Date	Details
11 Oct 2021	Version 1: AFPUB-2021-GEN-001-DRAFT01 * Draft proposal submitted

AFRINIC Staff Assessment

Date of Assessment: 27 October 2021

1.0) Staff Interpretation & Understanding of the proposal

AFRINIC allocates resources(IPv4, IPv6 and ASN) to its members based on the latter submitting their needs to justify the resource requests. As per this proposal, AFRINIC must publish the justifications provided in the resource requests two years after the resource has been issued to the Resource Member. The proposal does not say where such publication shall be done.

The proposal also states that AFRINIC shall automatically notify the member 3 months before the publication of the needs with a draft summary of the information shall be published. In case the member feels that for reasons mentioned in the proposal, AFRINIC cannot publish the text, the Resource Member shall then have up to 1 month to provide an alternative text to be published or request an extension of 1 year on that publication. AFRINIC has one month to accept the justification for non-publication of the details of its needs and can escalate to the AFRINIC Board if in doubt. The Board will have 1 month to resolve the matter once they hear the resource holder.

2.0) AFRINIC Staff Comments

AFRINIC notes that as per Sections 5 & 6 of the CPM, the resource members have to register (publish) the usage which is logically assigned to the needs in the AFRINIC whois database. These registrations are voluntarily done by the members and enforced by AFRINIC, especially when additional resource requests are being evaluated.

The policy proposal as styled lacks clarity in regard to where the information about the members’ demonstrated needs shall be published by AFRINIC. The author is requested to clarify this.

The information submitted by AFRINIC Resource Members is bound to be confidential and used only for the evaluation of the resource requests in compliance with the resource policies in the policy manual.

A member, if holding more than one resource, will receive notifications for each resource 3 months prior to their 2-year anniversary date.

The needs justifications are provided to AFRINIC through the different platforms made available to gather such information and are therefore kept in tickets that are logged as a result of a resource request.

The automation mentioned in the proposal cannot happen for the existing resources that have been issued to the AFRINIC Resource Members until now as the needs are not consolidated centrally in AFRINIC systems and have to be manually imported.

For new member requests, the organisations may be requested to furnish the details of the need that will be publicly published 2 years from the date they were allocated/assigned their IPv4 and/or IPv6, ASN resources.

3.0) Staff Comments On Areas of Impact

3.1) Impact on Registry Functions

This section will be updated once clarifications have been received and confidentiality concerns have been addressed.

3.2) Legal Assessment

The legal observations on the texts of the proposal are as follows:

(a) The present proposal aims at providing for the disclosure/publication of information pertaining to a Resource Member’s needs, i.e. information which would have been shared with AFRINIC during the pre-contractual stage.

(b) It is apposite to state that all information exchanged between AFRINIC and an applicant (resource member) either prior or during the tenure of the RSA fall under the regime of confidentiality at common law such that AFRINIC cannot, without the express consent of the concerned resource member, disclose this information to third parties. In fact, this is not something that can unilaterally be imposed on individual resource members by AFRINIC through the latter’s PDP framework. Accordingly, there is no legal soundness to this proposal

(c) On another note, it is observed that the author’s problem statement makes an implied reference to the cases of Cloud Innovation whereby the issue of 'disclosed needs' is still a live issue. Accordingly, that issue is sub-judice and thus, premature to be discussed at this stage.

3.3) Financial Assessment

This section will be updated once clarifications have been received and confidentiality concerns have been addressed.

4.0) Implementation

The timeline will be made available once issues have been clarified.