[RSSAC Caucus] Incident Response for ICANN

[Wessels, Duane]

> On Mar 2, 2023, at 7:00 PM, Alejandro Acosta <alejandro at lacnic.net> wrote:
> 
> P.S2. I don't think it's possible, but it would be nice if there is a way to "simulate" what could have happen (scope) if the prefix would have had a ROA.

This essentially did happen because two prefix hijacks happened at the same time: 2001:500:a8::/48 (NASA) and 2001:500:2f::/48 (ISC).  The first does not have a ROA but the second does.  According to our preliminary investigation, the hijacked prefix without ROA was seen at 5 of 520 vantage points, while the prefix with ROA was seen at 2 of 520.

DW