<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
On Dec 4, 2014, at 1:12 PM, William Herrin <<a href="mailto:bill@herrin.us" class="">bill@herrin.us</a>> wrote:<br class="">
<div>
<blockquote type="cite" class=""><br class="Apple-interchange-newline">
<div class="">
<div dir="ltr" class="">
<div class="">On Thu, Dec 4, 2014 at 10:59 AM, John Curran <<a href="mailto:jcurran@arin.net" class="">jcurran@arin.net</a>> wrote:<br class="">
> Actually, the terms regarding indemnification and warrant disclaimer are nearly<br class="">
> identical to that contained in the other RIR's RPKI agreements; are those also<br class="">
> problematic, or is the difficultly that principally that ARIN agreeing to the<br class="">
> terms explicit rather than implicit?<br class="">
<br class="">
</div>
Hi John,<br class="">
<br class="">
I've seen a lot of hand waving, but I still have no clue how the publication of RPKI data places ARIN at a different risk than publication of registration data via whois. </div>
</div>
</blockquote>
<br class="">
</div>
<div>Bill - </div>
<div> </div>
<div> Parties are likely to use RPKI services such that (as someone put</div>
<div> it recently) - "routing decisions are affected and breakage happens” </div>
<div><br class="">
</div>
<div> While such impacts could happen with whois, parties would have to </div>
<div> create the linkages themselves, whereas with RPKI it is recognized</div>
<div> that the system is designed to provide information for influencing of</div>
<div> routing decisions (a major difference, and one that a judge could be</div>
<div> made to recognize if some service provider has a prolonged outage</div>
<div> due to their own self-inflicted Whois data wrangling into routing filters.)</div>
<div><br class="">
</div>
<div> Given the nature of RPKI, it is clear that ARIN needs to engineer the </div>
<div> service with full awareness of the potential risks (even though such </div>
<div> risks are predominantly the result of parties using RPKI data without </div>
<div> appropriate best practices.) We have no problem offering a highly-</div>
<div> reliable service; the risk of concern stems from third-parties who suffer</div>
<div> major damages and want to assert that it was the result of an ISP’s </div>
<div> misusage of ARIN’s RPKI service or ARIN’s RPKI service itself, even </div>
<div> if the underlying cause in truth was completely unrelated to ARIN’s </div>
<div> RPKI services. Recognize that large harmed parties tend to litigate </div>
<div> everyone, with the innocent parties extracting themselves only after </div>
<div> lengthy battles, and such battles are very difficult when it comes to </div>
<div> proving the proper state of technical service at a given point in time.</div>
<div><br class="">
</div>
<div> I hope this helps in outlining some of the significant differences.</div>
<div><br class="">
</div>
<div>/John</div>
<div><br class="">
</div>
<div>John Curran</div>
<div>President and CEO</div>
<div>ARIN</div>
<div><br class="">
</div>
<div> </div>
<div><br class="">
</div>
<div><br class="">
</div>
<div> </div>
</body>
</html>