[ppml] ARIN text on requirements of reporting customer reassignments in whois needs to be more clear

[william at elan.net]

I've been in discussions with somebody and it seems some ISPs (Level3 for 
example) when reading ARIN policies come to conclusion that while they have
to report reassignments to ARIN, this does not mean they have to do it to
the public. My underestanding is different (as I undetstood especially 
after discussions of 2003-3) and I also pointed out that at
http://www.arin.net/policy/ipv4.html#requirements it does say
"This information must be visible via WHOIS prior to submitting a
request for a new allocation". However that this is not mentioned anywhere 
else is a problem (particularly that its not mentioned at 
http://www.arin.net/policy/ipv4.html#reassign). 

While I'm not certain if we need completely new policy proposal to just 
clairify it (can ARIN just add comments from #requirements to #reassign
to make for purposes of not introducing new policy but clarifying existing 
one, but without this actually being voted word-word on the meeting?) it 
does need to be addressed. I also noticed that new policy proposal 2003-11
(which is actually named "Purpose and Scope of WHOIS Directory" !) does 
not mention this either, and the closest we do have is 2003-5 which focuses
requirements of ISPs when they maintain their own reassignment server.
But something does need to be done to make it clear to ISPs that they are 
in fact required to provide customer reassigment information in whois and 
not only to ARIN staff.

Below are discussions I had so you could understand why they are problems 
with current wording.
---------- Forwarded message ----------

> > My understanding of ARIN policy is that they are required to provide
> > this information, but that it does NOT have to be provided to the
> > public. It just has to be provided to ARIN.

> That is not correct. I've been involved with discussions at ARIN
> mailing lists about this and at the meeting. It is clear that policy
> is that ISP are supposed to report data in whois and must report
> accurate data on their customers (with exception that address for ip
> block assigned to individuals can be blanked out).

http://arin.net/policy/ipv4.html
has no specific mention that the data must be made available to anyone
other than ARIN itself.

The implication at http://arin.net/policy/ipv4.html#reassign seems to be
that the reassignment information is primarily for ARIN to determine
current utilization.

Requesters must satisfy the following requirements for ARIN to determine
whether allocated space is being used efficiently:

   1.  Provide utilization information via SWIP or RWhois for all /29 and
   shorter prefix lengths. SWIP and RWhois reassignments should show each
   client's organizational information. The format below should be used to
   provide the required information for utilization of blocks smaller than
   /29 and for describing internal networks.
  
There's no mention anywhere that this information must or should be
public.

Also, from http://arin.net/library/guidelines/swip.html:

   Introduction

   Internet Service Providers (ISPs) that receive IP address space from
   ARIN directly or indirectly (as a downstream customer of another ISP)
   MUST use either Shared WHOIS Project known as SWIP or a Referral
   WHOIS server known as RWhois to provide reassignment information for
   /29 and larger blocks to ARIN. 

This specifically says "provide reassignment information.... TO ARIN"
(emphasis mine).

Again, I'm not saying I don't agree that the information SHOULD be
publicly available, but I don't see anything in the text to support the
argument that it must be.