[arin-ppml] Regarding unauthorized changes (Re: Policy question)

[Owen DeLong]

On Sep 20, 2012, at 21:13 , Jimmy Hess <mysidia at gmail.com> wrote:

> On 9/20/12, Owen DeLong <owen at delong.com> wrote:
> [snip]
>> If the officers are not listed POCs, how does ARIN validate that they
>> are, in fact, officers? How is the situation you describe above
>> distinguishable
> 
> In most places, corporations have a registration requirement, and the names
> of a corporation's officers, such as CEO, and legal agent are often part of the
> registration  papers and filings which are a public record,  so ARIN can check
> them independently, or rather, require a certified copy....
> 

ARIN deals with a lot of organizations that are not corporations.

Also, what you describe above generally applies only to certain types of corporations.
There are many types of corporations for which that data is not necessarily so public.

> ARIN can also lookup the  signed RSA that the resources were issued
> under, and check who actually signed it...

Not at all unlikely in many such cases that it was the terminated employee.
I've certainly signed plenty of ARIN RSAs as an authorized agent of several
organizations where I was not an officer or an employee in the past. Since
they started requiring officer attestation for resources, I usually get said officer
to sign the RSA now, but I don't know that everyone does so.

> 
> Unless  there was something very unusual such as two organizations
> claiming the same identity,  the truly  unauthorized POC  should have
> very little chance of being able to furnish  the same....
> 

You would think so, but I've seen multiple instances where the management
team knew virtually nothing about how the company got its address space
and the documentation virtually all favored the rogue former administrator.

No, it's not the most common case, but, it happens often enough that I understand
and respect ARIN's inability to know for sure whether or not that is what is
happening and thus requiring people who can't meet that burden of proof
to instead seek adjudication.

Owen