prop-171: Operational Accountability for Abuse Contacts in Sub-Allocated Address Space

This proposal seeks to establish a principle of operational accountability for abuse contacts in sub-allocated address space.
If adopted, APNIC policy would require that where address space is sub-allocated, assigned, or otherwise used by a downstream organisation, the upstream holder must ensure there is a reliable operational path from the registered abuse contact to the party responsible for handling abuse reports for that address space.
This principle applies regardless of the sub-allocation tier or organisational model involved. It does not prescribe a single operational model for how abuse handling should be organised, nor does it require the public disclosure of all downstream contact information. The intent is to ensure that the registered contact is operationally meaningful, not merely reachable.
This proposal does not alter the existing validation requirement under APNIC-127. It does not introduce a new audit or compliance mechanism. The operational guidance needed to implement this principle across different sub-allocation tiers will be developed by the APNIC Secretariat in consultation with the community.

Tsung-Yi Yu and Alban Kwan

1. APNIC’s Understanding of the Proposed Policy

APNIC understands this proposal as requiring an upstream holder to ensure there is a reliable operational path from the registered abuse or IRT contact to the party able to investigate and act on abuse reports for sub-delegated address space.

The proposal does not propose a Whois schema change or a new validation frequency.

APNIC Secretariat has noted that the issue may already be addressed under the current IRT policy, as members can create individual IRT objects for customers or use their own IRT where they remain responsible. If IRT details are invalid or unresponsive, community members can already submit invalid or unresponsive IRT contact requests

2. Impact of Proposed Policy on Registry and Addressing System

No Whois schema change has been identified. However, the proposal may affect Whois and IRT operational practice.

The proposal also does not specify a minimum size for sub-delegations, which could imply IRT expectations down to very granular levels for large organisations. This may create practical issues for Whois lookups and IRT records where multiple contacts could apply to a single address

3. Impact of Proposed Policy on APNIC Operation/Services

The main impact is not system change, but defining and validating what a ‘reliable operational path’ means.

If an upstream holder keeps responsibility for abuse handling, APNIC would need guidance on what suitable arrangements look like and how the Secretariat is expected to assess or validate them.

This could create significant workload, particularly if APNIC is expected to review forwarding arrangements, downstream responsibility, or complaints that abuse reports are not reaching the right party.

There is also a risk that the proposal may create expectations that APNIC will assess the effectiveness of abuse handling, even though the proposal says it does not create a new audit or compliance

4. Legal Impact of Policy

The Proposed Policy would add a new principle to APNIC-127. This principle would require an upstream holder to ensure that abuse reports can reach the party able to resolve them when address space has been sub-delegated.

 We note that upstream holders already remain responsible for their sub-delegations. Under prop-125, if a downstream abuse contact is not reachable, the upstream holder remains responsible for meeting the contact validation requirements. However, the current policy does not require the upstream holder to be responsible for how abuse reports are handled after they are received.

 We understand that it is not intended for APNIC to enforce this new principle directly. Instead, the Secretariat would develop operational guidance in consultation with the community. However, the use of terms such as “accountability” and “responsibility” could be interpreted as implying some level of enforcement, even though the proposal states that it does not give APNIC any new investigative or enforcement role.

 We therefore assume the intention is to provide guidance on community expectations and good operational practice, rather than to create any new enforcement obligations for APNIC.

5. Implementation

There are a number of clarifications required in this assessment that would need to be resolved before implementation actions can be determined(Other than changes to APNIC-127).

Until such point as these clarifications are made, we are unable to make a determination on implementation process and time frames.