[arin-ppml] Draft Policy ARIN-2016-8: Removal of Indirect POC Validation Requirement

[William Herrin]

On Thu, Dec 22, 2016 at 12:41 PM, Alyssa Moore <alyssa.moore at cybera.ca> wrote:
> I think the unsolicited commercial e-mail argument is a bit of a straw-man,
> at least from a legal perspective. Perhaps not from a landing ARIN on
> anti-spam lists perspective.

Hi Alyssa,

It's solicited by acquisition of the associated block of IP addresses.
But even if it were unsolicited, it would be unsolicited bulk email
(UBE) not unsolicited commercial email.


> Under the Canadian anti-spam law (CASL), [...]
> Not sure what that looks like stateside, or in the Caribbean. I'd appreciate
> if a lawyer on the list could weigh in.

There is no uniform spam law stateside. There are laws related to
fraudulent email including emails which attempt to hide their origin
(e.g. by using spoofed from addresses or botnets) but that's not
applicable here and spam is a much broader category.

State by state laws vary from nothing more than the federal
requirements to no unsolicited sales contacts. Even the most stringent
would not make ARIN's email unlawful.

Of course, lawfulness is not the proper criteria for assessing whether
something is spam. Paraphrasing, unsolicited bulk email (UBE) is a
substantively identical message sent to three or more recipients for
which no precipitating event reasonably invites the contact. Spam ==
UBE. UCE is the subset of UBE that seeks money.

ARIN POC validation requests are substantively identical and are sent
to more than three recipients but there is a reasonable and
unambiguous precipitating event which invites the contact.


> If we're going to pursue an alternative policy proposal that falls in the
> middle ground between eliminating indirect POC validation and validating
> every indirect POC, I like Scott's assertion that an immediate approach to
> validation of a new resource user is necessary, if only for socialization of
> the relationship going forward. This deviates from policy-making and enters
> the weeds of ARIN operations, though.

I agree that there should be an immediate validation upon entry of a
new POC email address via SWIP, regardless of any policy change.
Acquiring the IP address block and receiving the first contact from
ARIN should be temporally connected.

Regards,
Bill Herrin



-- 
William Herrin ................ herrin at dirtside.com  bill at herrin.us
Owner, Dirtside Systems ......... Web: <http://www.dirtside.com/>