[ppml] Staff Comments Regarding Policy Proposal 2006-3

These are the ARIN staff comments regarding Policy Proposal 2006-3:
Capturing Originations in Templates. These comments include those of the
ARIN General Counsel and ARIN staff, and contain analysis of legal,
procedural, and resource concerns regarding the implementation of this
policy proposal as it is currently stated. Any changes to the language
of this proposal may necessitate further analysis by Counsel and staff.
Policy Proposal 2006-3 restated below and available at:
http://www.arin.net/policy/proposals/2006_3.html.

This policy provides for capture and publicly available mapping of
authorized prefix originations by ASNs.  The ARIN General Counsel sees
no liability risk for ARIN.

ARIN staff believes the policy is not entirely clear.  Specifically the
term "user" could apply to both direct registrants as well as
reassignments and needs further definition.  The policy duplicates
capabilities of the routing registry and could be addressed by enhancing
this existing functionality. If adopted the policy statement will be
inserted into a new section numbered 3.5.

The resource impact of implementing this policy is significant.
Barring any unforeseen resource requirements, this policy could be
implemented within 3-6 months from the date of the ratification of the
policy by the ARIN Board of Trustees. Implementation would not require
the acquisition of staff personnel or equipment. It will require the
following:

- Template change
- Revision to Registration Software
- Revision to Directory Services
- Revisions to registration guidelines
- Staff Training

Respectfully submitted,

Member Services
American Registry for Internet Numbers (ARIN)


##*##


Policy Proposal 2006-3: Capturing Originations in Templates

Policy statement

Proposal type: new

Policy term: permanent

Policy statement:

ARIN will collect an optional field in all IPv4 and IPv6 address block
transactions (allocation and assignment requests, reallocation and
reassignment actions, transfer and experimental requests). This
additional field will be used to record a list of the ASes that the user
permits to originate address prefixes within the address block.

ARIN will produce a collection of the mappings from address blocks to
ASes permitted to originate that address block, The collection will
consist of a list where each entry will consist, at a minimum, of an
address block, a list of AS numbers, and a tag indicating the type of
delegation of the address block. This collection will be produced at
least daily.

ARIN will make the collected mappings from address blocks to AS numbers
available for bulk transfer in one or more formats chosen at its own
discretion, informed by the community's current needs. This data will
not be subject to any redistribution restrictions -- it may be
republished or repackaged it any form. Should ARIN choose to use WHOIS
bulk transfer as the bulk form of data access required by this
paragraph, the address block to AS mappings will not be subject to any
redistribution restrictions, but the remainder of the WHOIS data will
remain subject to the terms of the then-current AUP regarding bulk
access to WHOIS data.

ARIN may also make the collected or individual mappings from address
blocks to AS numbers available in other forms, possibly query services,
chosen at its own discretion, informed by the community's current needs.
ARIN may require agreement to an acceptable use policy for access to the
data in these forms.

Policy Rationale

Origination of prefixes by ASes that have no authority for the
origination is a recurring problem in the Internet routing system. A
list of authorized prefix originations would be beneficial to operators in

     * constructing routing filter lists to counter bogus originations,
     * interacting with customers requesting routing of a prefix, and
     * diagnosing routing problems.

A list of authorized prefix originations is also the necessary first
step for any known solution for securing the routing system.

Prefix originations can be stored in routing registry RPSL route
objects. However, the authority for addresses and for ASes belongs to
the RIRs. There is presently no mechanism to translate ARIN's authority
for number resources to an IRR. Furthermore, operators have been less
than diligent in creating and maintaining route objects. Capturing the
prefix origination authorization in number resource registrations with
ARIN has two main goals:

     * benefit from the scrutiny with which ARIN verifies initial
requests and authenticates subsequent transactions, and
     * inherit the operators' self-discipline in completing resource
requests and transactions.

As an additional benefit, this could take a step toward populating the
IRR with data known to be accurate.

The intended use of this data means that both query for individual
entries and bulk access to a list of the collected entries, without
restriction on redistribution, is required. This policy requires that
the additional data be provided through the usual whois query service
and some bulk access service that has no restrictions. It permits ARIN
to provide the bulk access through the existing bulk whois service if
the new additional data is not subject to the bulk whois AUP
restrictions. The policy does not limit ARIN to providing only those two
services (whois query and unrestricted bulk access); other additional
services may be developed at ARIN's discretion.

It is expected that entries in the list of collected entries will
include at a minimum the present NetRange and NetType attributes, with a
new attribute, perhaps named OriginatingASList, for the list of
permitted originating ASes.

This policy will presumably be incorporated into NRPM section 3.4.

Timetable for implementation: Within sixty (60) days of approval.