[arin-ppml] Clarify /29 assignment identification requirement

[John Curran]

On Apr 30, 2012, at 10:14 AM, Jack Bates wrote:

> This was my big concern, and I did warn (after the fact) the telco that didn't talk to their lawyer before sending the information to ARIN (probably didn't get an NDA, either). They were most likely audited for asking for some obscene CIDR block initially, but that probably isn't unusual out of people switching from PA to PI. In their ignorance, they ask for someone big and cool and ARIN corrects them in the followup for what they justify.
> 
> However, as an ISP that serve's ISPs, I've never been requested to go to my ISP customers and ask them for this information. Some of them would laugh in my face. I wonder if this doesn't create an extra hardship between PI and PA justifications, and if that is something that is desired.
> 
> Also, are we just picking on the little guy, while some of the largest networks (as mentioned elsewhere) are leaving huge blocks of networks SWIP'd after they've been released and possibly asking for more space? The smaller ISPs are more likely to have a 4-30% static assignment ratio compared to the larger ISPs, which seems to indicate they are more likely to get PII detail audits. Only ARIN can confirm what size of aggregate allocated space tends to generate this kind of detail, though.

Jack - 

If a significant amount of your utilization is based on discrete customer
assignments (and we have no record of your previous utilization rates, as
is common for an organization coming directly to ARIN for the first time),
you are likely to be asked followup questions to verify that some of the 
individual customer assignments were done for actual customers.

Also, if you're not actually an ISP serving customers, but instead a nice
facade which has been created and carefully developed over several months for 
the sole purpose of getting a PI-allocation IPv4 address block out of ARIN, 
and now asserting a significant amount of utilization is based on unnamed 
customer assignments, you are also likely to be asked followup questions
to verify the some of the individual customer assignments.  (Note - If you
do get an ARIN allocation for your "ISP", you're on your way to then having
lots more imaginary firms rotating in and our as customers in the process
getting your real business done, e.g. innovative marketing efforts, and by 
'disconnecting those bad customers' repeatedly you've probably got a year or
two until folks realize that you & your customers are one and the same...)  

While ARIN is concerned about IP address management, there are some interesting
side effects of allowing ISP allocations to parties that are not actually ISPs
(particularly when those parties are 'managed' via IP address block reputation-
based countermeasures.)

As long as the community recognizes that the two requests above (ISP, faux ISP)
look nearly identical at first, we can perform whatever level of verification is 
(or is not) desired, and would definitely encourage discussion of the verification
topic on this list.

Thanks!
/John

John Curran
President and CEO
ARIN