Suresh, thank you for your comment. I understand and respect your intentions. But good intentions need to be seen in context of principles or they may very well not yield good results. Internet Address distribution is based on documented need and policies developed by the community. The current policies are here: http://www.ripe.net/ripe/docs/ripe-498.html I am sure that the "sbl listed outfits" justified their address space need according to these policies just like everyone else. Now imagine the justified public outcry if the RIPE NCC were to take unrelated criteria such as black lists into account! We have resisted other threats to community governance by standing up,for example, to the UK SOCA; see http://www.eweekeurope.co.uk/news/news-security/russian-police-and-internet-registry-accused-of-aiding-cybercrime-2164 and http://www.ripe.net/news/rbn.html So, as McTim notes, the way to realise your intentions is to rally support for policy changes. Note well that RIPE has an active anti-abuse working group that may very well be a sympathetic forum for this. Note also that the desires of the anti-abuse working group are often at odds with the interests of others in the RIPE community and compromises need to be found. Last but not least I suggest you have a look at https://labs.ripe.net/Members/jsq/economic-incentives-for-internet-security Daniel

However, he had an extremely valid point, which was entirely lost in all the righteous indignation that his statement provoked. > ""If we were being harsh, we could say that Ripe has received criminal > funds and was involved in money-laundering offences. We are not treating > it that way, but you could see it like that." Correct in that the the front organization was the RBN, and that the funds were criminal. Also correct that RIPE did not know either of these facts and had clean hands. I still can't help wondering what effect believing a bit less in the "we are not the (routing|internet|whatever) police" mantra would have had on policy enforcement. ps: The justification paperwork for a /15 dedicated to sending bulk mail would be interesting, I dare say.

Policy proposals have been submitted, presentations have been made, etc etc. I do look forward to what Uwe Rasmussen submits to RIPE. But "is not the routing police" .. If a bank were to keep sanctioning loans on the basis of fake documentation (shell companies etc), and then say they arent the document police, that'd be interesting. http://www.ripe.net/ripe/wg/ncc-services/r59-minutes.html H. Recovering resources assigned to non-existing entities http://www.ripe.net/ripe/meetings/ripe-59/presentations/rasmussen-recovering-resources.pdf Uwe Manuel Rasmussen, Microsoft Ruediger pointed out the importance of distinguishing between actual criminal activity on the net and the ways to fight this from the administrative procedures. It is not related to the RIPE administration processes. Uwe agreed with this, but mentioned that this didn't lead to the entity with the real responsibility. Ruediger stated again that the registration is not the point, and that you must get to the "box" and that this may be a botnet. The administrative data in the RIPE Database is irrelevant to this. Uwe stated that there should be a check that organisations requesting resources actually exist before assigning to them. Nick Hilliard (INEX) pointed out that this check is already done by the RIPE NCC. However, there is little the RIPE NCC can do if documents are fake. The RIPE NCC is not the routing police. Uwe agreed but would still like a way to be able to challenge an assignment. Carsten Schiefner (DENIC) commented that there is a similarity with TLDs. There is still no solution to guarantee WHOIS accuracy. Uwe explained that he was not looking for WHOIS accuracy, but for a solution to remove the people that don't exist. John Curran (ARIN) explained how this is done in the ARIN region. He said that ARIN does verification, but when a fraud is uncovered, ARIN does act to revoke resources. This is not related directly to the criminal activities, but due to a violation of the policy. Uwe agreed that it is not the RIPE NCC's job to determine what is legal or not, but pointed out that allowing somebody that obtained resources to use these resources for illegal purposes leaves him outside the law. He said that he will present propositions to the mailing list to reformulate the text in RIPE Document ripe-452 to revoke resources if an organisation if found not to actually exist.

Sequence of events - 1. Richard Cox posted an article on spamhaus.org critical of RIPE's effectiveness in terms of (not) preventing malicious entities from acquiring large chunks of IP space. http://www.spamhaus.org/news.lasso?article=663 2. Richard Cox is then removed from his role as co-chair of the RIPE anti abuse working group. http://ripe.net/ripe/maillists/archives/anti-abuse-wg/2010/msg00416.html Way to go. As Richard said in his article

RIPE (the Regional Internet Registry, or number-address co-ordinating body, for Europe and the Middle East) is one of the bodies shouting loudest for the principle that internet crime is not their concern. But the governance of RIPE appears to be under the control of less than 1000 self-appointing individuals who bear zero responsibility to anyone other than themselves for the impact of their actions. That was fine for as long as their actions only impacted on each other, but with recent developments in the forms of subterfuge employed by Trans-National Organised Criminals being specifically enabled by a weakness in RIPE's operating structure - a weakness specifically absent from the other four Regional Internet Registries - Spamhaus has to question whether RIPE's form of internet governance is anywhere near fit for purpose.