[arin-ppml] [EXT] Re: Open Petition for ARIN-prop-266: BGP Hijacking is an ARIN Policy Violation

[Owen DeLong]

> On May 1, 2019, at 18:08 , Fernando Frediani <fhfrediani at gmail.com> wrote:
> 
> On 01/05/2019 17:17, Joe Provo wrote:
>> 
>> "Distribution function" is indeed merely agreeing that the data
>> recorded in the registry is accurate. There's no dibursement of
>> anything. When we bought our house and land, the registry of
>> deeds was similar only involved in verifying that the transfer
>> from the previous holders to us was a valid contract within the
>> scope of its operations (the state in which we live). When a
>> neighbor was doing a construction project and we had to go block
>> their heavy equipment, the registrar of deeds sure didn't come
>> and settle the dispute. We went down, got the county map and
>> they agreed. if they hadn't, law enforcement and courts would
>> have been the next step.
>> 
>> This, like all Internet analogies, is poor; my thrust is that rfg's
>> is worse. To parallel ARIN with a transportation agency's "line
>> drawing" and officials embued with law enforcement is wildly off
>> track.
> That's not that same thing unfortunately. Your house and land belong to you until you sell it, the resources the RIR assign to people **never** belong to them, they are not a property. Instead they remain under their responsibility and they may unassigned if misused or for other reasons.

The following is strictly my opinion. It may well deviate from the legal theories under which the RIRs currently operate.

The county can revoke your deed if you don’t pay your property taxes.

ARIN can revoke your registration if you don’t pay your ARIN fees.

The county can revoke your deed if they find that it was recorded under fraudulent pretense.

ARIN can revoke your resources if they find  your registration was obtained under fraudulent pretense.

The only difference is in what is being registered/recorded by the different registries. The property registry in the various counties registers property.

ARIN registers numbers to guarantee uniqueness among cooperating parties.

As has been repeatedly stated in this debate, ARIN has no control or authority over non-cooperating parties that have not signed a contract with ARIN.

An entity which has no contract with the RIRs really can use any integers they want in any way they want to the extent that others are willing to accept that use.

If someone wants to claim 10.0.0.0/8 as a public address and route it on the internet, the RIRs cannot do anything to stop them unless it violates an RIR contract that said entity is a party to.

If they can find enough ISPs willing to route that on their behalf, then de facto, that address range will be theirs and it really doesn’t matter what the RIRs have to say about it.

The internet works because the vast majority of networks choose to cooperate with the RIR system and work within the system to preserve uniqueness.

There’s no law that prevents this from becoming balkanized and disintegrating into competing non-unique uses of address space. I hope that doesn’t happen and fortunately, there’s enough financial interest in the process to make sure the majority of ISPs continue to not want it as well.

Nonetheless, it is important to understand just how fragile this ecosystem actually is and just how limited the power of the RIRs actually is.

Owen