[ppml] POC verification process

[william at elan.net]

> Purpose:  This policy is intended to provide the Internet community with
> information regarding the accuracy of POC data listed in the ARIN whois
> database.  This policy is designed to provide a framework for the ARIN
> staff to implement a system to publicly track the accuracy of a POC's data.

So we're now assuming its OK for AC and public in general to provide comments
and procedures on operational issues to be dealt with by ARIN staff. Good.

> Requirements: ARIN will setup a webform on their website to allow the
> Internet community at large to notify ARIN that a POC may be inaccurate.
> The public database states will be displayed in whois including the last
> verified date.
I agree with above. Would like to note that link needs to exist directly 
from website index page and from the page where whois results are 
displayed to the user. 

Might also be good idea to add comments additional comments to whois output
(at the end after all the results are displayed) that if any data is known
to be inaccurate the user should go to particular page or send email to 
hostmaster to report a problem.
 
> Public Database States: 
> - Active: The POC has been verified within the last year or there have been
> no reports that the POC data is inaccurate. 
> - In-Process: The ARIN staff is currently investigating the accuracy of the
> POC.
> - Unverified: ARIN has been unable to verify the accuracy of the POC data.

I'm assuming state names and name of the field are not "set" yet. I do not 
like names "active" & "unverified" for the status, it should be 
"verified", "verification in process", "unverified" or better something
like "Verification Status:" - "OK", "currently being verifiied", "inaccurate"
My own names are not the best either ...

Also what happens when telephone is ok but email is not? Maybe ARIN 
should specify what type of verification regarding accuracy of data
ARIn did (i.e. if ARIN verified POC by telephone, email, address, etc).

Also note that with ICANN they require user to send confirmation email
they they indeed send report that something is not accurate with domain 
whois data (this protects against those who just want to annoy somebody or 
send these inacurate reports on purpose). The email reply to confirm 
report should be adapted by ARIN as well.

> - Last Verified Date: The database will list the date when the POC data was
> last verified or if the data has never been verified the date when ARIN
> first displayed the accuracy state in whois.
> 
> ARIN should also develop any additional private database states that are
> necessary to fulfill the verification process of the policy.
> 
> Verification Process:
> If ARIN receives notification either internally or externally that a POC
> record may be inaccurate ARIN should start the process of verifying the POC
> if the POC has not been verified or updated within one year.
One year is way too long. One month would be better (but I'm sure people 
will again scream at me on this being too short). Like I did with Whois 
AUP policy proposal it might be best to leave the up to ARIN staff when 
its decides that data needs to be verified but specify that if it has been 
verified in > 1 year ago they MUST do verification, otherwise then CAN do 
it, if ARIN staff receives too many reports that data is not accurate.

> ARIN should mark the POC as "In-Process" and send an email to the POC
> notifying them to verify the accuracy of the data listed.  The email should
> contain the full POC information, information on how the user can update
> the data, and a method (email and/or webform) for the POC to certify the
> POC as accurate.
> 
> If the POC has not been updated or certified within 15 days ARIN should
> send a fax if the POC has a listed fax number, if there is no fax listed
> the next verification method should be used.
Which one is next, phone?

> If the POC has not been updated or certified within the last 15 days of the
> last ARIN notice, ARIN should attempt to verify the POC by telephone call.
I think ARIN should change status for POC after first 15 days to indicate 
that verification by email has failed and after 30 days that verification 
by telephone has failed as well but after 30 days it should send a letter 
to listed address and if ARIN does not receive reply after the letter 
then after another 30 days (so total 60 days from start of the process), 
it should mark POC data as completely unverifiable (i.e. email, 
telephone, address verification all failed).

> If ARIN has been unable to reach the POC via telephone ARIN should send via
> regular mail a notice to the POC to update or certify their POC record.
> 
> If the record has not been updated or verified within 20 days of notice via
> regular mail the record should be marked "Unverified" or "Delinquent".
See my comments above on this. Also maybe one week before marking it 
completely inaccurate ARIN should attempt one last time by email and 
inform POC that if they do not respond data will be marked as complete 
inaccurate.

Also in my opinion keeping there should be some consecuence to the company 
if their POC data is inaccurate (I'll separately from ARIN keep list of 
inaccurate POCs and ip blocks to which they correspond - first edition of 
this will be ready end of this month actually; but somethig more official
maybe good idea as well). 

I don't want to immediatly get the ip block removed from ARIN database, 
but possibly the following are ok to do:
 1. If this is SWIP, the parent ISP should be informed and maybe they can 
contact their client and get their POC data corrected if ISP can take 
decide remove the swip.
 2. If this is ip block directly from ARIN, if there is yearly maintainer 
fee involved and all POCs for ip block are not accurate, ARIN billing 
should not allow to pay for ip block until data has been corrected.
 3. For legacy ip blocks, I have no good suggestion on what to do. But
possibly this should initiate futher investigation and ARIN should check
if that business is still active or not (i.e. check state corporation 
records, etc). Possibly ARIN can try to verify data using older data if 
there were updates for ip blocks (yes, this works - sometimes old data 
is more accurate :)

-- 
William Leibzon
Elan Networks
william at elan.net