[ppml] Last Call for Comment: Policy Proposal 2003-5

[Michael.Dillon at radianz.com]

>*** Last Call: Policy Proposal 2003-5: Distributed Information Server
>Use Requirements ***

>The distributed information service must return reassignment
>information for the IP address queried. The service may
>allow for privacy protections for customers. Minimally, the
>service must provide only the person's name, city, state,
>zip code, and country. The service shall follow ARIN's privacy
>policy for publishing data in a public forum.

This "minimal" specification conflicts with the residential
privacy proposal.

The text seems to assume that a customer is equivalent to
a person whereas in the real world, customers are often
companies. The purpose of having a minimal set of information
rather than publishing everything, is to avoid facilitating
physical attacks on individual persons. The distinction between
a person and an organization is an important one and the
language in the policy should not contribute to making
this fuzzy.

In addition, I assume that the intent of not including
a street address was to avoid facilitating physical attacks
on individuals. In that case, it is inappropriate to
include a zip code since that narrows down the physical
location to a small area in a city. In Canada, this area
is approximately one side of a street in a single block
or a single apartment building.