GOpenCNR licensed exit operator terms

What these terms cover

GOpenCNR has no exit of its own. Its hubs forward only packets whose source and destination both lie inside GOpenCNR ranges or a named interconnect, so GOpenCNR never carries traffic between the internet and other members, and members never offer exits to each other. A member may still expose its own services on its own internet uplink, outside GOpenCNR; that is not an exit. The only way from GOpenCNR to the public internet is a licensed exit operator: a telecommunications provider accredited under these terms, which serves only the members who opt into it.

These terms are between Gelhaus Solutions, as Tier 0 of GOpenCNR, and an exit operator. The operator accepts them in writing when it applies, and they bind it from its accreditation. The GOpenCNR terms and the acceptable use policy bind the operator for its connection to GOpenCNR as they bind every member, and the general terms of service carry warranty, the limits of liability and the governing law.

Accreditation

• Who can be accredited. A business that offers internet access as a telecommunications provider, has notified that service where its law requires (in Germany, to the Bundesnetzagentur under Section 5 TKG), and runs its own data retention, lawful interception and abuse handling under the law that applies to it. Like every holder, it is screened against the EU consolidated financial sanctions list by its verified name and country, when it becomes a holder and every day.
• How. The operator applies to Tier 0 with proof of its notification; a description of its retention, its lawful interception and its abuse handling; its terms and privacy information for members; its abuse contact; the countries in which its exit leaves for the internet; and whether and what it charges members. Tier 0 checks the application and puts it to the GOpenCNR Community Council as a motion, under the GOpenCNR charter rider and the shared part of the charter. Tier 0 accredits the operator when the motion passes.
• What the accreditation states. The operator, its notification, the countries in which its exit leaves, any fee, and what it charges members if anything.
• What is public. The accredited exit operators, with what their accreditations state, are listed in the GOpenCNR portal, and every accreditation, suspension and withdrawal is recorded in the transparency log. The motions stay public for good, like every governance record.
• An accreditation belongs to the operator and cannot be transferred.

What the exit operator provides

• Its own notification and its own duties. The operator stays a notified provider for as long as it is accredited, and carries every duty its own law sets for a provider of internet access itself, including the secrecy of telecommunications. It tells Tier 0 at once if its notification ends or it can no longer carry those duties.
• Abuse handling. It publishes its own abuse contact and acts on reports about traffic leaving through its exit, under its own procedures. A report that concerns a GOpenCNR member's conduct goes to abuse@gplatform.org with only what the case needs: the member's GOpenCNR address, the time and the nature of the report. The case then runs under the abuse and sanctions policy, with the member acting first.
• Lawful interception and retention under its own law. The operator answers the authorities of its own country for its exit itself. Requests for GOpenCNR's data go to GOpenCNR, under the authority request policy.
• Logging as its own controller. Whatever the operator logs about the traffic at its exit, such as address translations or connection records, it logs as its own controller, only as far as its law requires or allows, and tells members what it logs, why and for how long. GOpenCNR receives none of it beyond what a case needs.
• Transparency to members. Its terms and privacy information are shown to every member before it opts in, and say in plain words who the operator is, where its exit leaves, under which law it retains data and intercepts, what it logs and for how long, its abuse contact and what it charges.
• Opted-in members only. It accepts traffic only from the GOpenCNR addresses of members who opted into it, and carries nothing from the internet into GOpenCNR except the return traffic of their connections.
• No spoofing. It sends to the internet only traffic with source addresses of its own, and keeps the policies of its upstream providers.
• Closed prefixes stay closed. Closed routes travel only through Tier 0's and certified hubs and never reach an exit, and the operator makes no attempt to reach closed space.
• Security. It keeps its systems current and access to them limited and logged, reports to Tier 0 without undue delay any incident that affects members, and makes its own incident reports under its own law.

What GOpenCNR provides

• Routing, and nothing else. GOpenCNR routes the traffic of the members who opted into the operator to its exit, and the return traffic back to them. Every other member's traffic never reaches it.
• Only what serving the members needs. We pass the operator the handles and GOpenCNR addresses of the members who opted into it, and in a case, what that case needs. We hold no traffic records to pass on: hubs keep counters, not records of who talked to whom.
• Our own checks. Each tunnel accepts only sources inside the member's registered space, so nobody reaches the exit with somebody else's GOpenCNR address. Tier 0 may probe an exit to check that it serves only opted-in members and keeps these terms.
• No service level, in either direction.

Members' opt-in

• Opt-in is per member and per operator, and never the default. It is recorded with the version of the operator's terms the member was shown. A member may withdraw its opt-in at any time, and routing to that exit then stops.
• Before it opts in, a member is told:
• who the operator is, and in which country its exit leaves for the internet;
• that the operator is a separate provider and a separate controller, under its own terms and privacy information;
• that its traffic leaves GOpenCNR's encryption at the exit and reaches the internet as any internet access does;
• that the internet sees the operator's addresses, and that the operator can link them to the member's GOpenCNR address;
• under which law the operator retains data and intercepts, what it logs and for how long;
• the operator's abuse contact, and what it charges, if anything.
• When an accreditation is suspended or withdrawn, the members who opted in are told at once.

Suspension and withdrawal of an accreditation

• By motion. A motion of the GOpenCNR Community Council may withdraw an accreditation, for a breach of these terms, for the end of the operator's notification, for failing to handle abuse, or because the operator can no longer serve members safely. The operator is heard before the vote.
• By Tier 0 in an emergency. Tier 0 may suspend an exit at once only in the cases where the general terms of service let us act first, such as an attack on GOpenCNR or on others, malware, a match on a sanctions list or a binding order of a court or an authority. An emergency suspension only suspends or tightens. It lapses after 90 days unless it is reaffirmed, and after one year at the latest.
• Sanctions. The abuse and sanctions policy, its sanctions ladder and the one case system apply to the operator's own conduct as to every holder's.
• Reasons and appeal. The operator receives a statement of reasons for every measure, no later than when it takes effect, unless the law forbids telling it. A measure Tier 0 takes, a sanction or an emergency suspension, may be appealed within six months to the GOpenCNR Registry Council, and whoever took the decision does not vote on the appeal. While Tier 0 still holds that council's seats, Tier 0 reviews the appeal itself and says so in its answer. The courts remain open whatever the outcome.
• Giving it up. The operator may give up its accreditation and end these terms with three months' notice, without giving reasons, and tells the members it serves. It may also end them at once for cause. On our side, an accreditation ends only by a motion of the GOpenCNR Community Council, as above, or at once for cause as an emergency, in one of the cases where the general terms of service let us act first.
• When an accreditation ends, routing to the exit stops, the members are told, and their opt-ins for that operator lapse. The operator keeps what its own law requires it to retain and deletes the rest. What we keep about the operator afterwards, and for how long, is in the GOpenCNR privacy notice.

Fees

No fee is owed under these terms, by either side, unless the accreditation sets one. Whatever the operator charges members is stated in its accreditation and shown to every member before it opts in.

Data protection roles

• The exit operator is a separate controller for everything it processes at its exit and about the members it serves, under its own privacy information. It is neither our processor nor a joint controller with us.
• Gelhaus Solutions is the controller for GOpenCNR's registry, its routing data and its counters, as the GOpenCNR privacy notice describes.
• We pass the operator the handles and GOpenCNR addresses of the members who opted into it, so that it can provide the exit they asked for (Art. 6(1)(b) GDPR). Each side passes the other what a particular case needs (Art. 6(1)(f) GDPR, the legitimate interest being the handling of abuse). Neither uses what it receives for anything else.
• Where the operator's exit leaves outside the EU, members are told so before they opt in, and what reaches the operator is then governed by the law of that country.

Law

These terms are governed by German law, and the place of jurisdiction is as the general terms of service set it out. The operator's own duties as a telecommunications provider, its notification, retention, lawful interception and the secrecy of telecommunications, are governed by the law of the country where it provides its exit, and it answers for that law itself.

Everything else

Warranty and liability are as the general terms set them out. A material change to these terms is emailed to the operator at least six weeks before it takes effect and put to it for acceptance in writing, in full and linked in the document archive, without a list of what changed. A new version applies to the operator only once it accepts it. Until then, the version it accepted stays in force until the accreditation ends as "Suspension and withdrawal of an accreditation" sets out, and the operator is not restricted for not accepting. Every version stays in the document archive.