On Jan 31, 2020, at 09:38 , David Conrad <drc@virtualized.org> wrote:

Ronald,

Speaking only for myself…

As I’ve recently seen complaints about RIRs directed to ICANN (in a different context than the issues at AfriNIC), a bit of clarification may be in order:

What can or should be done when a registry goes rogue?

In my view, it is primarily the responsibility of the community served the the RIR to reign it in if it goes rogue.

And to be clear, I am most definitely *not* talking about
an investigation performed by what is effectively AFRINIC's parent company,
ICANN.

ICANN is not the parent company of AfriNIC (or any other RIR, some of which existed prior to ICANN being created). While ICANN recognizes new RIRs (according to https://www.icann.org/resources/pages/new-rirs-criteria-2012-02-25-en) and recognizes “global policies” that reach consensus across all RIRs, there are no policies, processes, or mechanisms by which ICANN can exert any form of control over the RIRs. ICANN performs a set of functions for the RIRs at their request via the IANA functions and can be seen in that light as a service provider to the RIRs.

It is probably most accurate to view ICANN and the RIRs as peer organizations, connected operationally via the IANA functions, which primarily focus on different universes (domain names in ICANN’s case, IP addresses in the RIRs’ case).

It is sad to see this statement coming from someone so high up in ICANN…

I would say it is more accurate to refer to ICANN in the context of the RIRs as a vendor and little more. ICANN performs services (maintenance of the central registry and coordination of large blocks of number resources being delegated to the individual RIRs from that central registry). Technically, I believe this is done through PTI, though I admit that I still haven’t managed to gain 100% clarity on how the PTI<->ICANN relationship functions or whether the RIRs are contracted to ICANN or to PTI or to both.