[arin-ppml] Clarify /29 assignment identification requirement

[John Curran]

On May 4, 2012, at 2:33 PM, William Herrin wrote:
> Now I'm confused. Which is it: you can find a way to work with
> statistical approaches instead of PII or you can't?

Bill - I really don't know either way as the situation hasn't arose.  

We process thousands of requests each year, but if that particular weird 
hybrid network of an ISP for hospitals (but with individual patient/customer 
assignments) came in, we'd request the reassignment information.

Unless there was a strong alternative proposed by the ISP that provided 
for realistic verification of utilization, I'd need to say "no" based
on current policy.  If there was very good alternative proposed for this 
one situation which still provided us sufficient confidence in the network
utilization, then we'd try to accommodate it in good faith, but I have no 
idea how to make general policy based on something that hasn't occurred yet.

>>  If you would like ARIN to consider customer assignments as
>>  utilized without further verification, or consider proof of
>>  infrastructure to be sufficient validation for an assertion
>>  of IP utilization typical for such equipment, then please
>>  propose such as a change to number resource policy.
> 
> What I assert is that much of the community would like ARIN to verify
> utilization using best available approaches at its discretion
> -excluding- those which would have ARIN consume PII about downstream
> ISP customers holding fewer than 8 IP addresses.

If that's the case, you should then propose policy which precludes 
ARIN from requesting that information.  It's simple, clear, and can
be discussed by the community in a straightforward manner.

Instead, you have proposed a process change that ARIN can request 
this information, but only as last resort. Given that requesting 
this information is the typical method for verifying utilization 
of networks consisting of customer reassignments, I've asked you
several times what alternatives you propose for verifying the 
utilization of these networks.

Those coming in for address space do not seem to have a problem 
providing customer reassignment information, and this is running
code.  Under your proposed process change, I'm not certain what 
you want ARIN to ask for instead, and the discussion on the list 
has not made that any clearer. 

> We have a whole policy development process available to find out
> whether that assertion is correct. However, since you have expressed a
> belief that my way of phrasing it violates the boundary between policy
> and process, I seek your assistance in phrasing this community
> requirement in a manner that is acceptable within the process.


You should propose policy which precludes ARIN from requesting such 
information if that is what you desire. We would then take customer 
redelegations as valid as presented, and that should address your
concern.

The only other option that has been clearly defined would be for ARIN 
not ask for individual reassignments to customers but instead to consider 
proof of infrastructure to be sufficient validation for an assertion of 
IP utilization typical for such equipment.  This is appears to be a 
workable policy change to address your concern.  

It would be helpful (as was alluded to by another participant on the list) 
to make a proposal which changes policy in either of the options above if 
that's what is actually intended.

Thanks!
/John

John Curran
President and CEO
ARIN