AFRINIC Resource Members Assisted Review

 

Introduction

The AFRINIC Assisted Review (AR) is an exercise that AFRINIC conducts with its Resource Members to ensure registry data that is current, comprehensive, accurate, and complete. During the exercise, AFRINIC staff reach out to the registered contacts of the Resource Members to run consistent checks of their information in its registry, notably MyAFRINIC member portal and WHOIS database. 

 

1) What is an Assisted Review?

The Registration Service Agreement (RSA) signed by the Resource Members enables AFRINIC to trigger a review. The RSA is obvious regarding the requests for information by AFRINIC and the obligation of making such information available by Resource Members. Such information may be requested either at the time of an application to become a member or at any time during the currency of the RSA. Such information may be required to either ensure existing data is up to date or to ensure compliance with existing/new policies and Bylaws or even in the normal course of business as and when the Registration Service deems necessary.

The relevant sections in the RSA are replicated below for ease of reference:

 

2. Membership application

Applicants shall:

1. comply with the application process as defined and time by time updated on AFRINIC’s website (www.afrinic.net);
2. provide accurate and complete information when applying for services. Incomplete application will not be accepted and applicant will be notified;
3. clearly indicate the service(s) for which the application is being made;
4. where the original information submitted has been the subject of any change, same has to be notified promptly, accurately and fully to AFRINIC by an authoritative and valid contact;
5. promptly, accurately and completely reply to any enquiry made by AFRINIC during the application or within the currency of the agreement;
6. provide the relevant information regarding the membership type as indicated online on AFRINIC website and reflected in the membership form;
7. provide and ensure accurate contact information are stored in AFRINIC databases (Whois and MyAFRINIC).

 

---

 

4. Conditions of service

1. (Where a member, receiving service under an existing agreement applies for a change or a variation of the type of such service which AFRINIC has been supplying to it, evaluation of such a “change request” will be effected in terms of the provisions of clause (2) of the present agreement.
2. Cooperation:
   1. An applicant receiving service under an agreement is at all times bound to provide to AFRINIC such information, assistance and cooperation as may be reasonably required by the latter in the provision of the service.
   2. Such request for information may also be made where AFRINIC is investigating (reviewing) the applicant’s utilisation of the number resources already assigned to it.
   3. Failure by the applicant, to comply with a request made at above may:
      1. entail revocation or withholding of the service supplied by AFRINIC;
      2. be taken into account by AFRINIC in its evaluation for further and future assignment or allocation of number resources;
      3. lead to the closure of an LIR and termination of the agreement by AFRINIC.
3. Applicant’s use of the service
   The Applicant hereby irrevocably:
   1. Commits itself to using the services solely for the purpose for which it was requested.
   2. Commits itself to using the services in full and unreserved compliance with AFRINIC’s policies and mandate:
      1. without knowingly infringing the rights and/or interests of other users of such services,
      2. within the limits of applicable laws and/or regulations of the jurisdiction in which it operates.
   3. Further acknowledges that AFRINIC may at its own discretion and for good cause and common Interest of the stability of the Internet, investigate or cause to be investigated, the Applicant’s use of the services by the appropriate and competent authority(ies).
   4. Hereby binds itself to:
      1. notify AFRINIC whenever its circumstances so change that it is no longer in need of the Internet number resources supplied or being supplied to it under a Registration Service Agreement;
      2. surrender to AFRINIC within 15 days of the service of the notice at (iv)(1) above the Internet number resources supplied or being supplied to it under a Registration Service Agreement;
      3. update any data submitted to AFRINIC in the context of:
         1. an application for a Registration Service Agreement or
         2. the renewal of any Registration Service Agreement whenever such data have been the subject of amendment, change or have become outdated.
4. AFRINIC will comply with all applicable data protection and privacy laws of the Republic of Mauritius in its handling of data and information submitted to it by the Applicant in furtherance of an application for services and use thereof.

 

When AFRINIC receives service or resource requests, it verifies that the registry data is up to date. However, members who do not approach AFRINIC over an extended period may not undergo this verification. Consequently, this leads to service delivery becoming time-consuming and increasing non-compliance issues due to:

• Outdated contact information on record;
• New registered contacts who are unaware of the need to comply with the AFRINIC business rules and policies;
• Lack of knowledge about the information that AFRINIC keeps;
• Penalty and other fees incurred due to their inability to settle their invoices;
• Outdated information.

 

The Assisted review is conducted in two approaches, namely: Routine and Extended reviewsThe purpose of the Routine review is to verify that our databases have complete information with the members and to help the members keep their data up to date (name, address, contact details, and registered contacts info). A registry with updated records and members who are policy compliant will obtain services from AFRINIC faster due to compliance to the Contractual Obligation Checks and policy compliance.

Certain observations during the routine review may trigger an in-depth review (extended review) if deemed necessary. An approach is followed to rectify the anomaly/ies detected from a Routine Review. This will be treated on a case by case basis depending on the nature of the anomaly/ies and may also necessitate formally engaging the said organisation, which may lead to requests for IP address utilisation details, evidence of TCP/IP network operations, affidavits, notarised documents, or an explanation of a senior authority of the organisation.

 

2) How is the Assisted Review beneficial to members?

An assisted review:

1. Enables a focussed approach to handle the review proactively
2. Short sessions that empower the registered contacts to manage their resources autonomously
3. Provides for quicker turnaround times when requesting assistance and resources
4. Enables reduced dependency on AFRINIC RS staff.
5. Provides for a seamless experience for the members in ensuring compliance
6. While English is the official communication language used by AFRINIC, some
7. Arabic and French-speaking members will benefit from interactions with the Arabic or French-speaking staff conducting the review.
8. Assistance with creation/update and deletion of WHOIS DATABASE objects, removal of inconsistent records and information
9. Clarifications on AFRINIC Resource Policies, RSA sections, and business rules.

In cases of persisting non-compliance, AFRINIC will enforce the provisions of the RSA stipulations.

 

3) What happens during an Assisted Review

Assisted Review Process - if a substantive anomaly is observed with its information or resources. AFRINIC will provide a summarised report on its website. 

The purpose of the Routine review is to check the records of the members and assist them with the following :

1. Verify that our databases have complete information with the members and help the members
2. keep their data up to date(name, address, contact details, and registered contacts info)
3. Correcting their lame reverse DNS delegations
4. Adoption of the BCRYPT/PGP encryption method for their maintainers
5. Migrate away from the RIPE_NO_AUTH database to the AFRINIC IRR
6. Identify potential policy non-compliance issues(e.g. no reverse unless assigned, abuse contact)
7. Detect & correct inconsistencies that will impact the members when autonomously managing their resources
8. Hear the “voice of the Resource Members” concerning the services and tools that AFRINIC offers them
9. Onboard some requirements of Resource Members so that we can refine the services offered (Signed RSA, hard copies of invoices, Invoice Currency) 

 

4) Is it an existing practice among the RIRs?

Reviews are an existing operational practice in the RIRs as per the Service Agreements. RIR conducts reviews mainly because the quality of registry information is of high importance for efficient registry operations and an effective WHOIS service.

Following various provisions in each RIR’s service agreement, RIRs may undertake reviews while evaluating requests for additional resources and ensure that respective resource members are compliant with all necessary provisions.

In the AFRINIC service region, the reviews are done under Clauses 2 and Clause 4(b)(ii) of its Registration Service Agreement. In a similar approach, other RIRs also have similar sections guiding their respective approaches as listed below:

1. AFRINIC - Section of https://www.afrinic.net/ast/pdf/services/afrinic-rsa-en-201801.pdf
2. APNIC - https://www.apnic.net/community/policy/resources#4.1.1.-Review
3. ARIN - https://www.arin.net/about/corporate/agreements/rsa.pdf
4. LACNIC - https://www.lacnic.net/innovaportal/file/2399/2/rsa-en.pdf
5. RIPE NCC - https://www.ripe.net/publications/docs/ripe-745

 

5) Frequency of Assisted Reviews

The first iteration of this review started in May 2020 and is expected to cover all the active Resource Members in AFRINICs registry. A member may be subject to additional reviews. If a substantive anomaly is observed with its information or resources. AFRINIC will provide a summarised report on its website.

 

6) Summary of Assisted Reviews

There are 11 resource members undergoing review.The review triggered by AFRINIC has so far brought up several observations concerning the objectives.

The majority of the reviews have resulted in successful information updates (Organisation details, registered contacts) and maintainer password updates for resource management in the WHOIS database for up to 32 members as of the end of Quarter 2 of 2021.

The accuracy of invoices issued to members and their timely settlement of fees depends on the Organisations name on record. As part of the review, 18 members detected that their records were outdated following legal name changes or mergers/acquisitions. This situation caused some members to incur late penalty fees or receive final closure notices due to RSA breaches. At the end of the review, they got their information updated and could settle the fees.

The review enabled 3 resource members to re-assess their IP needs resulting in 1 resource member voluntarily returning part of the resources they no longer need. In comparison, 2 members noticed that their current allocation/assignment is running out, and they immediately proceeded to request additional resources.

Resource members are bound to comply with the existing resource policies, the bylaw, and the RSA.

The review enabled 2 members to be assisted and comply with relevant resource policies within the provided timeline. However, 5 other members could not successfully comply due to the following reasons:

• 2 member accounts were found to have been fraudulently hijacked and could not justify their membership
• 1 member was found to have made use of forged documents
• 1 member had undergone a liquidation procedure.
• 1 member resisted the review and opted to reply through a court injunction