[arin-ppml] Policy Proposal 2003-1: Required Performance of Abuse Contact

[Matthew Petach]

Doh!

I should have waited two more minutes before hitting send.

John said everything I said in much more concise form.   ^_^;;

Matt

On Fri, Aug 29, 2025 at 2:32 PM John Curran <jcurran at arin.net> wrote:

>
> > On Aug 29, 2025, at 4:59 PM, Shawn Bakhtiar <shashaness at gmail.com>
> wrote:
> > ….
> > As others have mentioned. ARIN is not LE (Law Enforcement), however,
> this does not mean it can’t (and in fact it should) set policy. Once the
> policy is established, then we can use it as a basis for enforcement, this
> could come in the form of a civil law suite, etc...
>
> Shawn -
>
> Alas, that is not the case - ARIN policy is used for operation of the
> number resource registry and does not equate to “public law”; i.e. you
> can’t engage law enforcement to complain about a violation of ARIN policy.
>
> > I can't go to courts and say hold someone to a standard that has not
> been set. I need the policy, in order to establish the bad behavior.
> >
> > The difference in having this policy or not, is the difference on
> whether I can pursue damages. Without it, the courts will simply say, they
> have no obligation. With it the court can hold them to the obligation.
>
> A lot of different concepts are being conflated here - in order to pursue
> damages against a party, you’d need to show that they had some obligation
> to your organization – this isn’t even the case with ARIN policy, at best,
> resource holders have an obligation to _ARIN_ through their RSA to adhere
> to ARIN policy, and that’s not something that your organization can seek
> recourse for violation of…  ARIN can, and would do so as specified by
> policy.
>
> > ARIN would never even be involved, netizens would simply litigate
> through the civil courts.
>
> As noted above, that is not the case.    If you want enforcement in the
> court system, then you need actual public law an applicable jurisdiction.
>
> > Again, I don't want to conflate enforcement with policy. All I'm asking
> for here is a policy to be set (updated). I'm not asking ARIN to enforce
> it. The community will do it through the normal legal and enforcement
> channels. But we can't do that, when there is no policy to point to.
>
> Setting a policy in this area is fine (if the community wishes such), and
> there’s a range of things that ARIN can do with respect to enforcement that
> are short of resource revocation – if the community clearly specifies such
> actions.
>
> For example, it’s possible to publicly mark the registry records of those
> networks with abuse contacts found to be non-responsive (however
> “non-responsive" gets defined).  It’s also possible to publish list of
> those networks which have nonresponsive abuse contacts, and therefore
> enable those who think that's a problem to filter accordingly.   ARIN can
> also contact organizations – and would most certainly do so in the process
> of any material enforcement action (and hence there are costs involved to
> be considered with any policy and enforcement action.)
>
> However, to be clear - ARIN policy won’t provide you a cause of action to
> seek recourse in the courts (not unless the policy is made into public law
> or you have inserted compliance requirements in your contracts with other
> transit/peering providers and those happen to be the violators.)
>
> Thanks,
> /John
>
> John Curran
> President and CEO
> American Registry for Internet Numbers
>
> _______________________________________________
> ARIN-PPML
> You are receiving this message because you are subscribed to
> the ARIN Public Policy Mailing List (ARIN-PPML at arin.net).
> Unsubscribe or manage your mailing list subscription at:
> https://lists.arin.net/mailman/listinfo/arin-ppml
> Please contact info at arin.net if you experience any issues.
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.arin.net/pipermail/arin-ppml/attachments/20250829/2c45b7ef/attachment.htm>