[ARIN-consult] Consultation on Retiring the Officer Attestation Requirement

[Rob Seastrom]

> On Aug 3, 2021, at 8:13 AM, ARIN <info at arin.net> wrote:
> 
> ... conditions have changed since this requirement was established, and ARIN believes that the Officer Attestation for resource request tickets is no longer necessary for the following reasons:
> 
> - Today IPv4 resources are issued by ARIN predominantly via the Waitlist policy, and this policy has been revised to only allow one small request per party (thus avoiding the original risk of “hoarding” via large suspect requests prior to runout).

To what degree did the requirement for officer attestation contribute to ARIN staff smoking out the abuse of the waitlist that resulted in the revision of the policy a couple of years back?

Is there any kind of downside in terms of getting law enforcement involved for fraudulent requests if we get rid of this requirement?  That is to say, does LE view the application differently with vs. without the officer attestation when evaluating whether there was an act that they're going to use scarce prosecutorial resources on?  Interested in Counsel's take on this.

> - With regard to transfers of IPv4 resources obtained via the transfer market, the inherent costs for large transfers ensures organizational officers are “in the know”.

That depends on the size of the organization.  The cost of a /16 on the transfer market is a rounding error in some departmental budgets, with no particular visibility to people at a level that we think of as corporate officers.

> - Given IPv6 availability, officer attestation of need for IPv6 resources is not necessary.

I have never been wholly in favor of requiring an officer attestation for resources for which there is no scarcity/hoarding incentive (i.e. IPv6 blocks and 32 bit ASNs).  For those resources I agree that the administrative burden significantly exceeds any potential upside.

For IPv4 number resources, my position requires some more thought and am eagerly anticipating more community input.

> The review identified that at this point in time the Officer Attestation process is problematic for many customers, predominantly posing an administrative burden that does not materially improve policy implementation and resulting in numerous complaints and adding unnecessary delay (varying between two days and an entire week) to completion of resource request tickets.
> 
> In light of the administrative burden to customers and undefined benefit, ARIN proposes dropping the Officer Attestation requirement – note that this specifically does not change documentation requirements related organization recovery of IP number resources or related anti-fraud measures that ARIN has implemented.

This is an interesting analysis and I look forward to seeing it, along with the results of this consultation, in a future Policy Experience Report.

Thank you!

-r