Rogue Certificate on a 22-Member Permissioned Network

Start from what the credential grants, not from the IP address. In a Fabric-style MSP model, a peer-role certificate lets the holder join channels the MSP is a member of, gossip, receive blocks, and serve ledger queries for data on those channels. The admin attribute is the serious part: depending on how the channel's policies are written, an admin identity may be able to install or approve chaincode, update the MSP configuration, or satisfy endorsement policies that list the MSP's admin role. If any endorsement or lifecycle policy is written as 'one admin of any member', the perimeter is already gone.

Determine, in this order:

1. Which channels is LogiCore a member of, and what data is on them? That sets the confidentiality exposure - in a trade consortium, bilateral pricing and instrument terms are the crown jewels.
2. What has the identity actually done? Query the node's logs, the ordering service's block delivery records, and chaincode invocation history for this certificate's subject.
3. Which chaincode policies reference admin or peer roles in a way this identity could satisfy? Enumerate endorsement policies and lifecycle approvals.
4. Is the intermediate CA key itself safe, or was only this leaf issued carelessly? The answer changes everything: a leaf is a revocation problem; a compromised intermediate is a member-wide re-key.

Blast-radius statement for the board: at minimum, unauthorised read access to LogiCore's channels and participation in gossip; at worst, ability to influence chaincode lifecycle or satisfy endorsement on any policy that accepts a LogiCore admin. The 19-day age matters - assume the identity has been used, not merely created.

Containment is not optional and cannot wait for the next scheduled change window. The trade-off is between speed and coordination legitimacy, and it should be made explicitly.

Immediate actions (0–72 hours):

1. Emergency channel configuration update revoking the specific leaf certificate, coordinated with the minimum majority of organisations reachable on a pre-agreed emergency bridge. Every consortium should have an emergency change clause in its agreement; if Netra does not, the shared-services company's incident lead must invoke it and ratify afterwards.
2. Network-level block at the peer gateway and at every member's firewall to the offending cloud range, as a stopgap that does not depend on consensus - imperfect, since the identity can move, but it buys the hours the config update needs.
3. Suspension, not immediate intermediate revocation. Revoking LogiCore's intermediate kills all of LogiCore's legitimate nodes, halting real logistics traffic; hold that option pending step 4 of the impact assessment. Short-lived emergency certificates can be issued to LogiCore's valid nodes so service continues.
4. Credential scan across all 22 members for contractor-issued certificates with no change ticket. The LogiCore contractor is unlikely to be unique.
5. Preserve evidence - the node's gossip history and the issuing intermediate's logs - before anything is torn down.

What to tell members: what was exposed, what was revoked, what remains uncertain, and the date of the ratified retrospective. Silence here is worse than the incident; members will discover it from their own logs.

The incident is a symptom of a governance design where identity is issued locally but revoked globally, with no shared visibility. Four changes address the cause.

1. Short-lived credentials. Issue leaf certificates with hours-to-days validity and automate renewal against an attestation service. Revocation latency stops mattering because an unrevoked certificate expires before it can be useful. One-year validity for a contractor 'testing node' is the actual defect.
2. A membership transparency log. Append-only, publicly readable within the consortium, recording every issuance and revocation with issuer, subject, role, and justification. Members monitor for certificates issued under their own intermediate that they did not request. This is the single highest-leverage control: the missing log is why a 19-day-old rogue certificate was discovered by watching IP ranges.
3. Role minimisation and policy review. Retire the generic admin attribute; replace it with narrowly scoped attributes and endorsement policies that name specific organisational roles rather than 'any admin'. Audit every policy that can be satisfied by one member's admin.
4. Emergency revocation as a designed path, not an improvisation: a pre-signed, pre-agreed policy that a quorum of three named members plus the shared-services security lead can revoke within four hours, with mandatory retrospective ratification at the next governance meeting. Practise it twice a year with a live drill, because an 11-day coordination time is a governance failure that will recur under pressure.

Also require contractor onboarding through the same ticket and approval flow as employees, with a named sponsor and an expiry date on every credential.