<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<base href="x-msg://833/">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
<div>
<div>On Dec 5, 2012, at 3:21 PM, "George, Wes" <<a href="mailto:wesley.george@twcable.com">wesley.george@twcable.com</a>> wrote:</div>
<br class="Apple-interchange-newline">
<blockquote type="cite">
<div lang="EN-US" link="blue" vlink="purple" style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; ">
<div class="WordSection1" style="page: WordSection1; ">
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<span style="font-size: 11pt; ">[WEG] Sorry John, that’s kind of a cop-out answer to a legitimate question. I am neither a lawyer, a CEO, nor an expert when it comes to PKI, but If I were being asked to set up a procedural and contractual framework for a new
type of PKI that had potentially nasty new failure modes and questions over liability, one of the first places I would look for precedent and clues would be existing CAs, with a specific eye toward whether they use the indemnification/hold harmless model vs
something less stringent like “no warranty” or if they instead acknowledge that there is a potential for liability if there is demonstrable negligence on the part of the CA. I’d even be looking to see if there were relevant cases stemming from the breaches
of Diginotar and Comodo that dealt with liability/negligence, especially as it related to third-party involvement.</span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
Are you telling me that as a part of ARIN’s lengthy due dilligence regarding the legal issues surrounding this that you didn’t look at this for guidance? As a related question to Chris’s, is there something about the operating agreement that the other RIRs
have in place with their members or the laws in the region in which they’re incorporated that hasn’t made them all say “aha, ARIN is right, we should all implement an RPA lest we get sued” ?</div>
</div>
</div>
</blockquote>
<div><br>
</div>
<div>Wes - </div>
<div><br>
</div>
<div> We've done extensively legal work, but outlining the circumstances of </div>
<div> potential liability publicly is not something that makes sense for ARIN </div>
<div> to do. If you obtain commercial certificates (e.g. SSL), you will generally</div>
<div> find that you enter into agreements that require you provide indemnification </div>
<div> to the provider based on your use of the certificate.</div>
<div> </div>
<blockquote type="cite">
<div lang="EN-US" link="blue" vlink="purple" style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; ">
<div class="WordSection1" style="page: WordSection1; ">
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<span style="font-size: 11pt; ">[WEG] It’s possible that these are mutually exclusive goals. Unless there is precedent to the contrary, I think it is a reasonable expectation that if you wish to be trusted as a certificate authority or TA, you have to have
the necessary documented rigor in your processes and methods to be seen as a trustworthy source, such that it is defensible when someone comes back trying to blame you when something goes pear-shaped.
</span></div>
</div>
</div>
</blockquote>
<div><br>
</div>
Indeed. In fact, we likely are stronger there in terms of process and systems</div>
<div>than anyone would expect.</div>
<div><br>
<blockquote type="cite">
<div lang="EN-US" link="blue" vlink="purple" style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; ">
<div class="WordSection1" style="page: WordSection1; ">
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<span style="font-size: 11pt; ">A signed contract indemnifying you is unlikely to prevent savvy lawyers from trying to prove demonstrable negligence if they believe that it exists, while proof that you have good process in place and you followed it exactly
but something happened beyond your control will go a long way.</span></div>
</div>
</div>
</blockquote>
<div><br>
</div>
Agreed. I am not at all worried about our performance or any fault on ARIN's part,</div>
<div>but that will not deter a multiyear litigation over proving exactly that fact. This is</div>
<div>why an indemnification is rather important, because it reduces the potential for</div>
<div>such litigation upfront, and hence why it is a standard component of many types</div>
<div>of service contracts including ISP and certificate providers.</div>
<div><br>
</div>
<div>FYI,</div>
<div>/John</div>
<div><br>
</div>
<div>John Curran</div>
<div>President and CEO</div>
<div>ARIN</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
<br>
</div>
<div><br>
</div>
</body>
</html>