<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<TITLE>RE: [arin-discuss] Privacy of Reassignment Information</TITLE>
<META content="MSHTML 6.00.2900.2838" name=GENERATOR></HEAD>
<BODY>
<DIV dir=ltr align=left><FONT face=Arial color=#0000ff size=2>
<DIV dir=ltr align=left><SPAN class=639105120-10042006><FONT face=Arial
color=#0000ff size=2>I never said there is a law preventing companies from
publishing this data. However, the USA does have very strict privacy laws
regarding to HIPPA healthcare information. If HIPPA healthcare clearing
system gets SWIPed it may provide a vector.</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=639105120-10042006><FONT face=Arial
color=#0000ff size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=639105120-10042006><FONT face=Arial
color=#0000ff size=2>I am here in Montreal at ARINXVII and I have talked to
every ISP I can think of. Every one has either directly placed bad info in
whois or have nudge, nudge, wink wink told customers directly how to do
it.</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=639105120-10042006><FONT face=Arial
color=#0000ff size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=639105120-10042006><FONT face=Arial
color=#0000ff size=2><SPAN class=639105120-10042006><FONT face=Arial
color=#0000ff size=2>How accurate and useful is
this?</FONT></SPAN></FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=639105120-10042006><FONT face=Arial
color=#0000ff size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=639105120-10042006><FONT face=Arial
color=#0000ff size=2>If you have no requirement for privacy on reassignments, do
not use them. However there are some reasons that customers need
it.</FONT></SPAN></DIV>
<DIV><FONT face=Arial color=#0000ff size=2></FONT> </DIV>
<DIV><SPAN class=639105120-10042006><FONT face=Arial color=#0000ff
size=2>-dsd</FONT></SPAN></DIV><!-- Converted from text/plain format -->
<P><FONT size=2>David Divins<BR>Principal Engineer<BR>ServerVault Corp.<BR>(703)
652-5955</FONT></P></FONT></DIV><BR>
<DIV class=OutlookMessageHeader lang=en-us dir=ltr align=left>
<HR tabIndex=-1>
<FONT face=Tahoma size=2><B>From:</B> Internet Partners, Inc. Tech Support
[mailto:support@ipinc.net] <BR><B>Sent:</B> Monday, April 10, 2006 4:39
PM<BR><B>To:</B> Divins, David; Owen DeLong;
ARIN-discuss@arin.net<BR><B>Subject:</B> RE: [arin-discuss] Privacy of
Reassignment Information<BR></FONT><BR></DIV>
<DIV></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><SPAN class=769162720-10042006><FONT face=Arial size=2>Please cite the
privacy law you are referring to that prohibits a company from placing it's
name, phone number</FONT></SPAN></DIV>
<DIV><SPAN class=769162720-10042006><FONT face=Arial size=2>and role contact
information on an IP assignment. I am unaware of any such
law.</FONT></SPAN></DIV>
<DIV><SPAN class=769162720-10042006><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=769162720-10042006><FONT face=Arial size=2>Just because there's
ISP's out there who feel that they can ignore the rules and fill in bogus
contact</FONT></SPAN></DIV>
<DIV><SPAN class=769162720-10042006><FONT face=Arial size=2>information does not
mean we should rewrite the system to cater to these people</FONT></SPAN></DIV>
<DIV><SPAN class=769162720-10042006><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=769162720-10042006><FONT face=Arial size=2>There are always
people who regard public trusts as their own personal property, to abuse as they
see</FONT></SPAN></DIV>
<DIV><SPAN class=769162720-10042006><FONT face=Arial size=2>fit, and to ignore
the rules the rest of us have setup, because they feel that somehow they are
"special"</FONT></SPAN></DIV>
<DIV><SPAN class=769162720-10042006><FONT face=Arial size=2>that because of who
they are and what they do that the rules need to be adjusted to suit their
own</FONT></SPAN></DIV>
<DIV><SPAN class=769162720-10042006><FONT face=Arial size=2>personal
agenda. </FONT></SPAN><SPAN class=769162720-10042006><FONT face=Arial
size=2>This is called regarding yourself as above the law.</FONT></SPAN></DIV>
<DIV><SPAN class=769162720-10042006><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=769162720-10042006><FONT face=Arial size=2>If we trade in the
mandate for ISP's to place valid, public data for reassignment information into
the</FONT></SPAN></DIV>
<DIV><SPAN class=769162720-10042006><FONT face=Arial size=2>database, in
exchange for some sort of "NDA trade out" as you are advocating, then we may
make</FONT></SPAN></DIV>
<DIV><SPAN class=769162720-10042006><FONT face=Arial size=2>a small minority
happy and make a problem go away, for the time being.</FONT></SPAN></DIV>
<DIV><SPAN class=769162720-10042006><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=769162720-10042006><FONT face=Arial size=2>Then when the next
small minority has a beef with the system we are going to adjust the
system</FONT></SPAN></DIV>
<DIV><SPAN class=769162720-10042006><FONT face=Arial size=2>to suit them -
because after all we did it for the private numbers people. And so on and
so on.</FONT></SPAN></DIV>
<DIV><SPAN class=769162720-10042006><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=769162720-10042006><FONT face=Arial size=2>Eventually the
Internet becomes nothing more than what happened in Europe in the Middle
Ages</FONT></SPAN></DIV>
<DIV><SPAN class=769162720-10042006><FONT face=Arial size=2>with everyone with
their own little fiefdom and their own little laws.</FONT></SPAN></DIV>
<DIV><SPAN class=769162720-10042006><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=769162720-10042006><FONT face=Arial size=2>If an ISP or a
company does not like the requirement to disclose who they are, they can simply
not</FONT></SPAN></DIV>
<DIV><SPAN class=769162720-10042006><FONT face=Arial size=2>connect to the
Internet. Nobody is holding a gun to anyone's head and telling them they
must be</FONT></SPAN></DIV>
<DIV><SPAN class=769162720-10042006><FONT face=Arial size=2>connected to the
Internet or else. If they absoluely have to have e-mail, why last I
checked UUCP</FONT></SPAN></DIV>
<DIV><SPAN class=769162720-10042006><FONT face=Arial size=2>worked just fine and
did not require a public IP address.</FONT></SPAN></DIV>
<DIV><SPAN class=769162720-10042006><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=769162720-10042006><FONT face=Arial size=2>Ted
Mittelstaedt</FONT></SPAN></DIV>
<DIV><SPAN class=769162720-10042006><FONT face=Arial size=2>NOC
Manager</FONT></SPAN></DIV>
<DIV><SPAN class=769162720-10042006><FONT face=Arial size=2>Internet Partners,
Inc.</FONT></SPAN></DIV>
<BLOCKQUOTE dir=ltr
style="PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV class=OutlookMessageHeader dir=ltr align=left><FONT face=Tahoma
size=2>-----Original Message-----<BR><B>From:</B>
arin-discuss-bounces@arin.net [mailto:arin-discuss-bounces@arin.net]<B>On
Behalf Of </B>Divins, David<BR><B>Sent:</B> Friday, April 07, 2006 10:26
PM<BR><B>To:</B> Owen DeLong; ARIN-discuss@arin.net<BR><B>Subject:</B> Re:
[arin-discuss] Privacy of Reassignment Information<BR><BR></FONT></DIV><!-- Converted from text/rtf format -->
<P><FONT face=Arial color=#0000ff size=2>All IP Allocations are done based
upon trust. If an ISP just wanted to obscure a reassignment they could
simply make up a customer.</FONT></P>
<P><FONT face=Arial color=#0000ff size=2>Allowing ISP's to enter into NDA type
status for reassignments and representing these reassignments as private in
public servers should provide the registrar with more accurate information--
as that is the basis for the reassignment policy. Additionally, this
provides much needed privacy for companies that must adhere to ever more
restrictive privacy laws. This allows a valid mechanism.</FONT></P>
<P><FONT face=Arial color=#0000ff size=2>Why is a corporate entities right to
privacy any less than an individuals (when it comes to IP space-- and remember
not all companies are public)?</FONT></P>
<P><FONT face=Arial color=#0000ff size=2>Why is there a need to know what
company owns a block provided there is a valid contact provided? This probably
brings the question of how can we ensure a valid contact. Since all
assignments are done based on trust, there must be some base assumption that
for the most part ISP's act according to ARIN rules-- I am not aware of
any ARIN para-military-esque auditing arm that checks ISP corporate accounting
against IP assignments to see who skirts the rules.</FONT></P>
<P><FONT face=Arial color=#0000ff size=2>Honestly, I would be content to see a
policy that allows an ISP to go full NDA with ARIN and provide reassignment
information to ARIN on a private basis. Under this condition, the ISP
would need to maintain valid contact (abuse/noc) for all address space it has
been assigned and not publicly reassigned.</FONT></P>
<P><FONT face=Arial color=#0000ff size=2>I firmly believe that this issue will
not be going away.</FONT> </P>
<P><FONT face=Arial color=#0000ff size=2>-dsd</FONT> </P>
<P><FONT face=Arial size=2>David Divins</FONT> <BR><FONT face=Arial
size=2>Principal Engineer</FONT> <BR><FONT face=Arial size=2>ServerVault
Corp.</FONT> <BR><FONT face=Arial size=2>(703) 652-5955</FONT> </P><BR>
<P><FONT face=Tahoma size=1>_____________________________________________
</FONT><BR><B><FONT face=Tahoma size=1>From: </FONT></B> <FONT
face=Tahoma size=1>Owen DeLong [</FONT><A
href="mailto:owen@delong.com"><U><FONT face=Tahoma color=#0000ff
size=1>mailto:owen@delong.com</FONT></U></A><FONT face=Tahoma size=1>]
</FONT><BR><B><FONT face=Tahoma size=1>Sent: </FONT></B> <FONT
face=Tahoma size=1>Friday, April 07, 2006 11:56 PM</FONT> <BR><B><FONT
face=Tahoma size=1>To: </FONT></B> <FONT face=Tahoma
size=1>Divins, David; ARIN-discuss@arin.net</FONT> <BR><B><FONT face=Tahoma
size=1>Subject: </FONT></B> <FONT
face=Tahoma size=1>Re: [arin-discuss] Privacy of Reassignment
Information</FONT> </P>
<P><FONT face=Arial size=2>* PGP Signed by an unknown key: 04/07/2006 at
11:55PM</FONT> </P><BR><BR>
<P><FONT face=Arial size=2>--On April 7, 2006 10:25:11 PM -0400 "Divins,
David" <dsd@servervault.com></FONT> <BR><FONT face=Arial
size=2>wrote:</FONT> </P>
<P><FONT face=Arial size=2>> All,</FONT> <BR><FONT face=Arial size=2>>
</FONT><BR><FONT face=Arial size=2>> Provided an ISP, or other direct
assignment recipient, supplies valid</FONT> <BR><FONT face=Arial size=2>>
and responsive (24x7) Abuse, NOC, and other pertinent contact</FONT> <BR><FONT
face=Arial size=2>> information, a reassignment should be allowed to remain
private.</FONT> <BR><FONT face=Arial size=2>> </FONT><BR><FONT face=Arial
size=2>First, a direct assignment recipient cannot reassign, so, this
would</FONT> <BR><FONT face=Arial size=2>not apply to a direct assignment
recipient.</FONT> </P>
<P><FONT face=Arial size=2>Second, the policy was abandoned fairly recently
due to lack of</FONT> <BR><FONT face=Arial size=2>support by the community and
lack of consensus to move forward.</FONT> </P>
<P><FONT face=Arial size=2>IP resources are an element of public trust.
It is common and widespread</FONT> <BR><FONT face=Arial size=2>practice to
disclose as a matter of public record possessory interest</FONT> <BR><FONT
face=Arial size=2>in public resources. The public interest in an open
and equitable</FONT> <BR><FONT face=Arial size=2>system of resource
assignments and allocations overrides ISPs</FONT> <BR><FONT face=Arial
size=2>interest in hiding the identities of their customers.</FONT> </P><BR>
<P><FONT face=Arial size=2>> The ability for an ISP to selectively and
voluntarily make an assignment</FONT> <BR><FONT face=Arial size=2>> private
will still allow ARIN to have accurate reassignment information</FONT>
<BR><FONT face=Arial size=2>> as the assignments will be provided to ARIN
privately whenever address</FONT> <BR><FONT face=Arial size=2>> utilization
must be determined.</FONT> <BR><FONT face=Arial size=2>> </FONT><BR><FONT
face=Arial size=2>ARIN is a stewardship organization. The IP addresses
are no more owned</FONT> <BR><FONT face=Arial size=2>by ARIN than by any
recipient organization. They are administered by</FONT> <BR><FONT
face=Arial size=2>ARIN and the ISPs in the public trust. They are public
resources.</FONT> </P>
<P><FONT face=Arial size=2>> The private designation in no way relieves the
ISP of its responsibility</FONT> <BR><FONT face=Arial size=2>> to the
Internet community. In fact, a private reassignment expands this</FONT>
<BR><FONT face=Arial size=2>> responsibility as the ISP actually must take
on the responsibility</FONT> <BR><FONT face=Arial size=2>> providing valid
24x7 point of contact.</FONT> <BR><FONT face=Arial size=2>>
</FONT><BR><FONT face=Arial size=2>The community vehemently opposed adding
such a requirement to the previous</FONT> <BR><FONT face=Arial size=2>attempt
at such a policy.</FONT> </P>
<P><FONT face=Arial size=2>> If an ISP is unable or unwilling to provide a
responsive NOC/abuse</FONT> <BR><FONT face=Arial size=2>> contact, then
they may not designate any reassignments as private.</FONT> <BR><FONT
face=Arial size=2>> </FONT><BR><FONT face=Arial size=2>How would you
propose to prevent ISPs from ignoring this requirement?</FONT> </P>
<P><FONT face=Arial size=2>Owen</FONT> </P>
<P><FONT face=Arial size=2>-- </FONT><BR><FONT face=Arial size=2>If it wasn't
crypto-signed, it probably didn't come from me.</FONT> </P><BR>
<P><FONT face=Arial size=2>* Unknown Key</FONT> <BR><FONT face=Arial size=2>*
0x0FE2AA3D - unknown</FONT> </P></BLOCKQUOTE></BODY></HTML>