[arin-ppml] Clarify /29 assignment identification requirement

[Cameron Byrne]

On Apr 26, 2012 3:39 PM, "William Herrin" <bill at herrin.us> wrote:
>
> Template: ARIN-POLICY-PROPOSAL-TEMPLATE-2.0
>
>   1. Policy Proposal Name: Clarify /29 assignment identification
requirement
>   2. Proposal Originator
>         1. name: William Herrin
>         2. email: bill at herrin.us
>         3. telephone: 703-534-2652
>         4. organization: self
>   3. Proposal Version: 1.0
>   4. Date: 4/26/2012
>   5. Proposal type: new
>   6. Policy term: permanent
>   7. Policy statement:
>
> Where ARIN must evaluate a LIR's IPv4 address utilization in order to
> perform any duty, ARIN shall not compel the production of customer
> identities for any customer holding a total of less than 8 IPv4
> addresses unless all reasonable alternatives for verifying utilization
> have been exhausted.
>
>   8. Rationale:
>
> Per http://lists.arin.net/pipermail/arin-ppml/2012-April/024523.html ,
> ARIN believes the /29 border for identifying customers called out
> seven distinct times in the NRPM applies only to publication of such
> records. Author contends that the policy intention is and should be
> that the identity of such small consumers of IP addresses remain a
> private matter between the ISP and its customer.
>
>   9. Timetable for implementation: immediate
>
> END OF TEMPLATE
>
>
> --
> William D. Herrin ................ herrin at dirtside.com  bill at herrin.us
> 3005 Crane Dr. ...................... Web: <http://bill.herrin.us/>
> Falls Church, VA 22042-3004
>

+1 support

In many cases, this data is so transient it has no audit value.

Smartphones, for example, seldom have ip assignments that last longer than
12 hours and are so unsticky they are likely to never have the same ip twice

Furthermore, folks who interface with arin && gear may only know a custimer
via a customer id or phone number.  The asociated personally identifiable
information (pii ) of such a subscriber may be in a protected data
warehouse that network folks dont have access too.

In fact, this name to ip address correlation business process may only be
in place for the purpose of lawful intercept under court issued warrant.

I believe arin is generally doing the right thing today.  But, clarifying
this process is prudent.  I am happy to provide gear configs and logs to
arin for justification, but pii is sacred ground.

Cb

_______________________________________________
> PPML
> You are receiving this message because you are subscribed to
> the ARIN Public Policy Mailing List (ARIN-PPML at arin.net).
> Unsubscribe or manage your mailing list subscription at:
> http://lists.arin.net/mailman/listinfo/arin-ppml
> Please contact info at arin.net if you experience any issues.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.arin.net/pipermail/arin-ppml/attachments/20120426/9a7f2f2a/attachment.htm>