[arin-ppml] Reclamation of Number Resources

[John Curran]

> On 14 Jul 2022, at 5:35 PM, William Herrin <bill at herrin.us> wrote:
> ...
> I think maybe you missed my point. We don't know how ARIN would treat
> Ronald's information if filed in a formal complaint and can't
> rationally discuss whether that enforcement is consistent with our
> policy-level expectations because ARIN doesn't publish enough details
> about the complaints, their investigations and the results.

Bill – 

If the community desires such an approach, it can be readily accomplished –
but there is quite a bit to consider (See below.) 

Also, I would recommend that some thought be given to the actual “problem” 
being solved here, since there may be other approaches with different tradeoffs 
that are superior for some classes of problems (e.g., use of a review panel for 
requests of concern, more details disposition of fraud or number resource review 
cases, etc.) 
 
> There ought to be a way to open that black box without unduly harming the
> folks who get investigated. Like making it all public upon the
> investigation's conclusion when all the information is on the table.
> Upon finding the complaint unsubstantiated, ARIN could even offer the
> registrant the opportunity to redact anything they considered a trade
> secret before publication. We'd still end up with a heck of a lot more
> information and quite possibly enough information to inform a policy
> discussion.

A few details to consider for those wish to pursue this particular direction of 
“making it all public” –

1.  While you suggest “trade secret” redaction, I am fairly confident that the information 
     withheld from disclosure will be almost always intersect the information at the crux of 
     the dispute about the validity of the request, so a very high level of clarity will need to 
     be provided since ARIN will effectively be “left on the hook” to administer that rather 
     problematic aspect of this new fraud review publication policy. 

2.  We would need to be exceptionally clear about the possibility of public review when 
     requesting supporting information _and in fairness would only be able to apply it to 
     number resource requests made after adoption of this fraud review disclosure policy_
     (as parties provided supporting information in the past under a significantly different 
     understanding than contemplated in this discussion.) 

3.  To the extent that public disclosure of fraud report review details is indeed desired, 
     I would suggest augmenting NRPM section 12 with the necessary policy and guidelines, 
     as the number resource review policy is of similar function, and would also need be 
     reconciled with any new public disclosure practices for number resource review cases.

4.  It also goes without saying, but any change in this regard should be carefully evaluated
     by the community not only from the viewpoint of the fraud report submitter but also from
     the viewpoint of those subject to inquisition, as we do rather frequently receive reports of 
     alleged number resource fraud that turn out to be the result of insufficient understanding 
     on the part of the submitter. 

Thanks!
/John

John Curran
President and CEO
American Registry for Internet Numbers