[arin-ppml] Policy Proposal: Customer Confidentiality - revised

[Ted Mittelstaedt]

Robert Bonomi wrote:
>> Date: Wed, 10 Jun 2009 10:53:27 -0700
>> From: Ted Mittelstaedt <tedm at ipinc.net>
>> Subject: Re: [arin-ppml] Policy Proposal: Customer Confidentiality - revised
>>
>>> I do not believe that this should be the sole prerogative of the ISP.
>>>
>>> Change the wording to something like:
>>>
>>>   "An ISP may, _at_their_customer's_request_, enter the following information:
>>>      {customer's actual name}
>>>      C/O {the ISP's NAME and address}
>>>      {the ISP's phone number}
>>>    in lieu of the customer's address and phone number.  The customer's actual
>>>    information must be provided to ARIN on request and will be held in the
>>>    strictest confidence."
>>>
>> This is intrusion of operational details into the NRPM and has 
>> historically been opposed by the community.
>>
>> Nothing in the proposal prevents the ISP from telling all their 
>> customers that by default, SWIP data will contain the ISP's data, unless 
>> a customer opts-out.
> 
> I don't want the ISP _requiring_ the listing that way, regardless of
> customer opinio
> 
>> If you want to run your ISP like this, fine.
>>
>> Just don't tell me how to run my ISP.
> 
> It says 'may'.  
> 

The proposal is
effectively modifying one of the terms of the RSA - which is that 
previously the RSA required the ISP to supply contact data that could
be published to the general public.  With the proposal the RSA would 
only require the ISP to supply contact data that can be seen by ARIN, 
without the requirement that it can be seen by the general public

Your wording suggestion extends the proposal way beyond a modification
of the RSA terms to the ISP, into an operational detail of 
ISP-to-customer relations.

> It says you have to have the customer's consent, to intercept their mail
> and phone calls.
> 
> And regardless of what the NPRM says, an ISP who does so, has to worry about
> 18 USC 1700, and nearby sections.
> 

No doubt.  But, why does ARIN and the policy manual need to worry about 
that?

Ted