[arin-ppml] Clarify /29 assignment identification requirement

[John Curran]

On May 4, 2012, at 10:24 AM, William Herrin wrote:

> On 5/4/12, John Curran <jcurran at arin.net> wrote:
>>   In lieu of asking for customer reassignments data to support claimed
>>   utilization of an address block, what information do you propose that
>>   ARIN accept?
> 
> Hi John,
> 
> Proof of infrastructure? You can check whether or not equipment is in
> place with ordinary ratios for the claim.

I believe you are saying that ARIN should consider proof of infrastructure to 
be sufficient validation for an assertion of IP utilization typical for such 
equipment.  We can do that rather than request customer reassignment information 
if the community so desires. I do not know whether it would encourage requests 
for additional resources from folks with otherwise lightly-utilized equipment, 
but the potential for completely fabricated requests would indeed be limited by 
the ability to prove actual infrastructure.

> Proof of traffic? You can spot-check packet patterns to see if they're
> consistent with real users versus careless assignment.

We would need significantly more detail to understand exactly what traffic 
would constitute validation for an asserted IP address utilization.

> But let me turn the question around: ARIN staff have been doing this
> for quite a while. How would staff handle the hospital as ISP scenario
> I posited? HIIPA says you don't get to look at the user data. It's the
> law. So what would data would staff seek for their audit instead?


Your hypothetical lacks sufficient detail to answer with certainty.  It's
likely we would request customer reassignment data to verify utilization.  
I am confident that sufficient information could be provided to ARIN under 
NDA as needed which would not violate HIPPA's "protected health information"
requirements, just as we have been able to work with parties with PII, CPNI,
and related issues.

Thanks!
/John

John Curran
President and CEO
ARIN