[arin-ppml] How bad is it really?

[Owen DeLong]

On Jul 15, 2010, at 12:58 AM, <michael.dillon at bt.com> wrote:

>> ARIN doesn't have a fraud or abuse department. 
> 
> The why do you keep making such a big deal about reporting things to ARIN's
> fraud and abuse department?
> 
I never used the term fraud and abuse department.

I used the term fraud and abuse reporting process. This is a documented
process which is available through the ARIN web site and which is handled
by the registration services department.

>> The fraud and abuse
>> complaints to ARIN are handled by Registration Services almost
>> identical
>> to the way CCing hostmaster as you mention above will get handled.
> 
> Then you should drop the inflamatory language and just tell people to
> send an email to Registration Services via the hostmaster email 
> address.
> 
Again, you are putting different words in my mouth than what I sand and
then complaining about the new words.

>> I don't see how reporting this kind of violation of the RSA through the
>> ARIN process intended for such reports will result in lawsuits. Could
>> you
>> please explain that rather bizarre conclusion?
> 
> You, as an ARIN official, keep making comments about how these operational
> errors are FRAUD. That is getting close to libel and slander. If lots
> of others pick up on this language it is only a matter of time before
> it spreads and someone makes serious allegations of fraud that threaten
> to damage someone's business. At that point, I would expect to see lawsuits
> and they would naturally include you, the ARIN official who started it all,
> and ARIN itself.
> 
You see them as operational errors. I see them as operational error until
reports to said org go unheeded and they willfully fail to correct the
situation. At that point, they become abuse. When said org then gets
more space based on this non-existent utilization, it becomes fraud.
 
> Can we just drop this whole "big stick" attitude and focus on carrots?
> 
No, at this point, given the willful nature of at least some of the violations
I am aware of, I'm not in the mood to give carrots to those ORGs and I
think it is time to start wielding the stick.

> ARIN has never made it easy to clean up this kind of thing. If ARIN would
> simply engage with some of the larger providers and ask what could be
> done to help them audit their IP address records, and clean up leftover
> addresses from incomplete decommissioning processes, then I think you
> would get much, much further than with threats.
> 
Sure it is.... You simply submit a SWIP delete template.

I worked for a large provider and we completely automated this process.
Our registration system would automatically send in SWIPs for all address
registration transactions. It only took a few lines of PERL code to make
it all work. It even parsed the ARIN responses and notified a human if
there was a problem.

> It would also provide an opportunity for providers to share best practice
> tips on address auditing and perhaps develop some tools which could be
> run internally on management networks to identify unused address blocks.
> 
That doesn't seem like it would be all that hard under the current situation
and should be even easier when ARIN launches RESTful whois, assuming
they can make it work this time.

Owen