<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><br><div><div>On Dec 5, 2012, at 13:18 , John Curran <<a href="mailto:jcurran@arin.net">jcurran@arin.net</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<base href="x-msg://833/">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
<div>
<div>On Dec 5, 2012, at 3:21 PM, "George, Wes" <<a href="mailto:wesley.george@twcable.com">wesley.george@twcable.com</a>> wrote:</div>
<br class="Apple-interchange-newline">
<blockquote type="cite">
<div lang="EN-US" link="blue" vlink="purple" style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; ">
<div class="WordSection1" style="page: WordSection1; ">
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<span style="font-size: 11pt; ">[WEG] Sorry John, that’s kind of a cop-out answer to a legitimate question. I am neither a lawyer, a CEO, nor an expert when it comes to PKI, but If I were being asked to set up a procedural and contractual framework for a new
type of PKI that had potentially nasty new failure modes and questions over liability, one of the first places I would look for precedent and clues would be existing CAs, with a specific eye toward whether they use the indemnification/hold harmless model vs
something less stringent like “no warranty” or if they instead acknowledge that there is a potential for liability if there is demonstrable negligence on the part of the CA. I’d even be looking to see if there were relevant cases stemming from the breaches
of Diginotar and Comodo that dealt with liability/negligence, especially as it related to third-party involvement.</span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
Are you telling me that as a part of ARIN’s lengthy due dilligence regarding the legal issues surrounding this that you didn’t look at this for guidance? As a related question to Chris’s, is there something about the operating agreement that the other RIRs
have in place with their members or the laws in the region in which they’re incorporated that hasn’t made them all say “aha, ARIN is right, we should all implement an RPA lest we get sued” ?</div>
</div>
</div>
</blockquote>
<div><br>
</div>
<div>Wes - </div>
<div><br>
</div>
<div> We've done extensively legal work, but outlining the circumstances of </div>
<div> potential liability publicly is not something that makes sense for ARIN </div>
<div> to do. If you obtain commercial certificates (e.g. SSL), you will generally</div>
<div> find that you enter into agreements that require you provide indemnification </div>
<div> to the provider based on your use of the certificate.</div></div></div></blockquote><div><br></div>But the purchaser (web site) is rarely the relying party (visitor to web site).</div><div><br></div><div>With ARIN RPKI, you've seriously expanded and effectively reversed the</div><div>nature of the contractual relationship in the creation of the RPA. You're</div><div>not only requiring those receiving certificates to sign, you're requiring</div><div>those obtaining certificate data to sign.</div><div><br></div><div>Owen</div><div><br></div><br></body></html>