<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Calibri","sans-serif";}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoPlainText>The Digital Crimes Unit within Microsoft investigates cybercrime attacks against our customers and services. We rely on information from the ARIN database to correlate and identify the source of nefarious online activities. As such, we oppose any policy change that would lessen the quantity and quality of information in the ARIN database. While we recognize the importance of data privacy, we strongly believe that the proposed changes would only hamper the security community's ability to investigate and mitigate cybercrime. <o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>Restricting access to the WHOIS data has the potential to slow or bottleneck investigations and security initiatives because customer addresses and phone numbers are critical to anti-abuse investigations. Although the current WHOIS data is not wholly reliable, further anonymizing and restricting the available data would only serve to weaken security and anti-abuse efforts. At best, requiring anti-abuse researchers and investigators to formally request needed customer data from ARIN will delay progress on time sensitive investigations and incur additional costs for both ARIN and the security community. At worst, the policy, as written, could seriously obstruct investigations if the policy were to be construed as conferring on ARIN a duty to shield that information. <o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>That ambiguity itself raises serious concerns about how the policy changes would be implemented in practice. According to the proposal language, "the customer's actual information must be provided to ARIN on request and will be held in the strictest confidence." This leaves open the question of when and under what circumstance this data would or could be shared with investigators, with the likely outcome being uncertain and inconsistent standards for both withholding and disclosing data. <o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>Given these serious concerns, we urge that this policy change not be adopted and we thank you for considering this feedback on Draft Policy 2010-3.<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>Richard Boscovich<o:p></o:p></p><p class=MsoPlainText>T.J. Campana<o:p></o:p></p><p class=MsoPlainText>Angeline Lee<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p></div></body></html>