[ppml] Whois & privacy related changes - ideas for future

[Jim Bujno]

I think this is a very good idea.
I currently swip my dsl customers by city now as a /24 for the market
because most allocations are less than a /29 and i send in my
spreadsheets showing utilization.

This keeps our company's customers, mostly residential and small
businesses private.

This also takes a load off of ARIN.




Jim Bujno
Senior Network Engineer
Cisco Certified Network & Design Professional
Work  #248-440-0202
Cell     #313-268-1183
Fax     #248-440-0500

LDMI Telecommunications
300 Galleria Suite 100
Southfield, Mi. 48034

U.S. Army Veteran

>>> "william(at)elan.net" <william at elan.net> 10/19/2004 7:03:26 PM >>>

Personally I'm not happy about 2004-6 or 2004-7 text and think larger
changes
are needed on how whois is used by arin and users, but I could never
quite
put it into normative text. But as we're discussing all this today,
please
read below on my ideas and maybe this is something that AC can work on
later and can come up with text for a proposal.

First here is what I see as a problem
 1. ARIN database seems overwhelmed by amount of small assignments
whois data
 2. Current ARIN privacy policy for residential customers is already
abused
    and having "private customers" seems like waste of database space
(what
    use is it to see "private customer/private residence' record in
whois) 
 3. Researches don't want addresses of customers completely hidden
because 
    they use that to establish geographical mapping of the net
 4. Those doing abuse investigations don't want names hidden
(especially
    for any large block).
 5. Residential and small business customers want privacy for their
records

So here are my ideas on what could be done:
 1. Change policy to require full reassignment SWIP if its > 128 ips or

    possibly > 254 ips
 2. For smaller reassignments do not require all of then to be 
    reported as individual reassignment and create instead new form
    of multi-reassignment SWIP which would list number of
reassignments
    of each size without actually listing each customer name and
address.
    The actual physical address listed under SWIP would have to
correspond 
    to same geographical area as all customers in that larger swip and
    maybe something like address of CO or datacenter or company city
office.
 3. Get rid of current residential customer privacy policy.

Here is why I think this is good and would be ok for most of what we
want:
 1. The amount of data being entered and maintained in database would
    decrease dramaticaly because currently > 75% of it are those small
    < /24 reassignment SWIPs. This is easier both for ARIN and for
ISPs.
 2. Residential customers and small business who desire privacy get it
    as their info is not reported any more
 3. Researches are still able to get all the info about geographical 
    location, in fact it even becomes easier when this data for number
    of small blocks is aggregated together
 4. Based on what I've seen almost all spammers with directly assigned

    blocks have > /24 (usually around /21 or /22) of ip space. It
appears
    the big ones have very serious operations that smaller space would
not
    work for them and smaller ones go for dedicated servers with few
ips 
    and many/most dedicated server companies don't report those ips in

    swips anyway. So dropping info on small blocks would probably not
    cause serious issues for abuse investigations.

Question remains if this is ok with ARIN as instead of getting actual
list of customers with exact ip blocks they use, ARIN info would now
be
just number of reassignments of different sizes - but I have feeling
that 
maye exactly what ARIN wants and uses when determening utilization
anyway...
Plus if they need more info, they can always ask.

So if you think this is worth it, feel free to discuss it more and
maybe
an exact proposal can be created based on the above ideas.

-- 
William Leibzon
Elan Networks
william at elan.net