[arin-ppml] Audits

[Matthew Petach]

On Sat, Nov 6, 2010 at 1:03 PM, William Herrin <bill at herrin.us> wrote:
> On Sat, Nov 6, 2010 at 12:18 PM, John Curran <jcurran at arin.net> wrote:
>> Send listed contact Mr. John Smith an email, and Mr. Smith writes
>> back and says: "Yep, the Company ABC is deceased (which I did list
>> in my LinkedIN profile and am a contact for); you should contact Bob
>> who I think was the owner at 1-234-555-1212"... We call this supplied
>> number and then accept whatever the person claiming to be Bob then
>> tells us?
>>
>> Example:  Bob says: "No, it's still around.  We are actually using
>> those numbers internally.  Please update the records to say "BobNet"
>> which is our DBA name for Company ABC & here's my new email address"
>> Or do we only accept what Bob says if he claims the resources should
>> be returned?
>>
>> Note the liability to ARIN in either of the above cases in acting
>> without clear legal documentation (not just attestation from "Bob")
>> is likely unacceptable, and doesn't improve the database integrity
>> but actually weakens it (not to mention the resource hijacking or
>> potentially wrongful reclamation from an otherwise unreachable
>> company which Mr. Smith or "Bob" are now seeking revenge against...)
>
> John,
>
> At some point within the next 24 months I think it very likely that
> this community will ask ARIN to aggressively recover unused space.
> This will likely include some sort of mechanism for recovering space
> whose registrants can't be contacted or won't confirm the resources'
> continued use.  I think it would be very helpful to have some legal
> guidance from ARIN counsel as to the least risky approaches to doing
> so before that policy gets drafted.
>
> Regards.
> Bill Herrin

I'm feeling kinda dumb right now, so I apologize to the rest of the list
for having to ask simple questions, but isn't recovering unused space
a trivial matter of looking to see who hasn't paid their annual fees?

Or are you talking about reclaiming space that is being paid for by a
current POC, whose records are up to date, who is in good standing
as a member organization of ARIN, but is somehow otherwise lacking
in right attributes according to the rest of the community, and must
therefore give up any rights to the space it is paying for?

If you're talking about organizations that have fallen into disarrears, I
think the non-payment of fees case should be sufficient for starting
the reclamation process, and we already have perfectly good policy
to address that.

If you're talking about taking resources away from members that are
otherwise in good standing, however, I think that's highly unconscionable,
and quite frankly would be a slap in the face to the nature of the ARIN
organization.  Pitting one member against another, encouraging us to
become informants, whispering the secrets of our fellow organizations
to anonymous tip lines in the hopes of seeing the IP Gestapo haul them
away (have I managed to invoke Godwin's law yet?) so that perhaps some
day we might be able to lay claim to their resources is barbaric, and I
cannot believe we as a community are seriously considering this.

If an organization is up to date with their contacts and their annual fees,
we have no reason to second-guess ARIN's evaluation of their IP needs,
and go stomping in, all a-jackbooted to take them back.  If their POC
data is suspected of becoming stale, *look at who is paying the annual
fees* and contact them to find out what the state of the POCs is.  Unless
people are paying ARIN by leaving unmarked bills in a paper sack outside
the front door with a note stapled to it, there should be some trail on the
money that leads back to whomever sent it.

I agree spam is a evil, nasty, icky problem.  But trying to solve that problem
by taking number resources away from organizations is the wrong way to
attack the problem.  No matter how much the workers at the DMV may dislike
child pornography on the internet, they do not deny the renewal of a person's
drivers license based on their evaluation of a person's ill-choice of viewing
material--it's not their purpose to be the judge and enforcement branch of
society around those issues.  Likewise, ARIN is responsible for stewardship
of number resources, *not* the being gatekeeper for what we consider to be
Internet decency.  If an organization provided adequate documentation to
satisfy the ARIN staff evaluation of need in order to obtain  the number
resources in the first place, and are paying their fees, and maintaining
their status as a member of ARIN in good standing, then we have no
reason to go back and try to reverse the decision of that ARIN staff
member; why are we even debating this?

Again, apologies for asking such dumb questions; I just don't understand
why we're spending so many cycles talking about taking resources back
from members in good standing who obtained them after due diligence
on the part of ARIN staff members (unless perhaps what's really obliquely
being said is that the community no longer trusts the hiring practices of
ARIN, and suspects the staffers of not adequately performing the
aforementioned due diligence, which would be a most unfortunate charge.)  :(

Thanks!

Matt