[arin-discuss] Dean -vs- ARIN... again (Re: The joy of SWIPping)

[michael.dillon at bt.com]

> I disagree, the issue is whether or not you have to put 
> specific customer information in RWHOIS or SWIP, I haven't 
> seen anyone from ARIN answer that yet.  

We're all ARIN members here, aren't we? Who makes ARIN policies?
Members plus other interested parties make the rules so if the 
rules are out of sync with reality, we should not just knuckle
down and follow the rules, we should change them.

> You can assert 
> anything you want, but I want to hear it from the people who 
> are going to approve/deny my next IP space request.

As far as I'm aware, the rules covering what must be published 
in the ARIN whois directory (via SWIP or RWHOIS) are not connected
to the rules for allocating new IP space.

In any case, I rather doubt whether ARIN hostmasters ever look
at this list, and even if they did, I doubt that their bosses
would allow them to post anything on the issue. At best, you
will get someone from ARIN management to make a statement.

I've already mentioned that my company does not publish
any more than customer name and city for business customers.
No street address, no zip code. Yet we have successfully
received /16 (or better) allocations several times over the last
6 years or so. We do however, provide the ARIN hostmasters with
full detail on every internal allocation or assignment, right
down to the /32 level, but that is under NDA and even the ARIN 
management are not allowed to look at that information.

> Please note 
> that until your prior utilization is verified to meet the 80% 
> requirement, ARIN can neither process nor approve a request 
> for additional addresses."

That's the key sentence. They want proof, not records published
in the whois directory. We have provided database dumps, charts
of actual vs. forecast growth, pointers to public web pages which
list PoP cities and other miscellanea.

> I cannot find any "ARIN privacy policy for publishing data in 
> a public forum"
> 
> So, the question remains, do you have to put the true POC 
> information for each of your customers in SWIP and expose it 
> to the Internet and your competitors?

It really depends on your IQ, and business acumen. I seriously recommend
that you do not publish any zip codes or street addresses, and only
publish
company names for larger customers where it isn't much of a secret
anyway. 
If ARIN's hostmaster complains, be direct with them and tell them why
you
will not publish the information, remind them of the NDA that they have
signed,
and submit the info to the hostmaster only. If this lack of publishing
the
information is the sole sticking point, then sue ARIN. 

It is unfair, in a legal sense, for ARIN to force one of its members to
publish commercially sensitive information that will benefit your
competitors,
namely other ARIN members. This is not the kind of level playing field
that
one expects to be created by "self regulation" and if ARIN is not
willing
to play fair, sue the bastards to get it on the public record.

Quite frankly, I doubt that it would ever get to this point because if
your
lawyer writes ARIN's lawyer a letter, then ARIN's lawyer will point out
that
you have misunderstood the hostmaster and that the sticking point on
your 
application was not related to the incomplete data in the whois
directory.

In any case, the ARIN employees really should not be posting
interpretations
of policy to this list. 

--Michael Dillon