[ppml] Staff Comments Regarding Policy Proposal 2006-1

These are the ARIN staff comments regarding Policy Proposal 2006-1:
Residential Customer Privacy. These comments include those of the ARIN
General Counsel and ARIN staff, and contain analysis of legal,
procedural, and resource concerns regarding the implementation of this
policy proposal as it is currently stated. Any changes to the language
of this proposal may necessitate further analysis by Counsel and staff.
Policy Proposal 2006-1 restated below and available at:
http://www.arin.net/policy/proposals/2006_1.html.

This policy calls for the suppression of certain items of information
regarding customers of organizations that receive allocations of
Internet number resources from ARIN. The ARIN General Counsel sees no
liability risk for ARIN but has some concerns. Counsel states: "However,
this type of policy may have a series of impacts in different portions
of the Internet community. Let me give a single example: Law enforcement
authorities have a desire for real time ability to obtain information of
the type that will now be masked. This may increase the burden on ISP's
who must be correspondingly contacted more often to obtain such
information. The government's might wish a different policy. Issues of
customer privacy and how ARIN's policies impact such issues remains an
area of ongoing legal concern and attention."

ARIN staff concerns relate to whether or not this policy is interpreted
to mean suppression of information that is collected as opposed to
suppression of information that is available to the general public. ARIN
has a stringent non disclosure policy concerning the protecting of
information. Such non disclosure can be applied to any information that
is to be suppressed from access by the general public. Staff calls to
the attention of the community the effect of the suppression of
information from the general public that is currently used by those who
use this data in research. This data would have a diminished value as
the use of a term such as "private residence" or "private customer" may
not necessarily reflect the accurate distribution of the address space
by the customers of ARIN. The community may want to consider further
definition of these terms to provide clarity to the research community.

If on the other hand this policy would permit the suppression of
information being presented to ARIN, staff has additional concerns to
those described above. These concerns relate to the ability of ARIN to
verify the validity of the information as it is reported by the
customers of ARIN as required by current policy. It would be easier for
less than scrupulous organizations when reporting utilization
information of the address space entrusted to them to hide or otherwise
provide false information such as substituting "private residence" when
in fact the information relates to a business. This impacts ARIN's
ability to exercise the stewardship role that has been entrusted to it
by the community. If adopted this policy replaces policy text in
sections 4.2.3.7.6 and 6.5.5.1 as well as remove the words "that
includes displaying only the city, state, zip code, and country" from
section 3.2.

The resource impact of implementing this policy is viewed as moderate.
Barring any unforeseen resource requirements, this policy could be
implemented within 90 days from the date of the ratification of the
policy by the ARIN Board of Trustees. Implementation would not require
the acquisition of staff personnel or equipment. It will require the
following:

- Changes to the current software suite
- Revisions to registration guidelines
- Staff Training

Respectfully submitted,

Member Services
American Registry for Internet Numbers (ARIN)


##*##


Policy Proposal 2006-1: Residential Customer Privacy

Policy statement

Proposal type: modify (NRPM sections 4.2.3.7.6 and 6.5.5.1)

Policy Term: permanent

An organization with downstream residential customers may substitute
that organization's name for the customer's name, e.g. 'Private customer
- XYZ Network', and the customer's entire address may be replaced with
'Private Residence'. Each private downstream residential reassignment
must have accurate upstream Abuse and Technical POCs visible on the
WHOIS record for that block.

NRPM Section 3.2 on Distributed Information Server Use Requirements
(from policy proposal 2003-5) is also updated by striking the words
"that includes displaying only the city, state, zip code, and country".

Policy Rationale

This policy allows for a residential customer's entire physical address
to be suppressed, not just the street name and number. It also removes
the US-centric phrases "state" and "zip code" from the NRPM, reflecting
ARIN's broader service area.

In many cases, a postal code or even a city name can identify few enough
individuals, particularly considering the set of those likely to have
their own IP assignments, that the intent of policy proposal 2003-3 is
constructively defeated.

Timetable for implementation: Immediately upon approval.