<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
On 3 Feb 2017, at 8:15 AM, LOOS Eric (BCS/CBU) <<a href="mailto:eric.loos@bics.com" class="">eric.loos@bics.com</a>> wrote:<br class="">
<div>
<blockquote type="cite" class=""><br class="">
</blockquote>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
</div>
<blockquote type="cite" class="">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">IANAL, but I have worked enough with our legal department to see some red flags in the RPA:<o:p class=""></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt 36pt; font-size: 12pt; font-family: 'Times New Roman', serif; text-indent: -18pt;" class="">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">-<span style="font-size: 7pt; line-height: normal; font-family: 'Times New Roman';" class=""> </span></span><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Possibility
for on-sided modifications of the T&C with automatic acceptance thereof<o:p class=""></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt 36pt; font-size: 12pt; font-family: 'Times New Roman', serif; text-indent: -18pt;" class="">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">-<span style="font-size: 7pt; line-height: normal; font-family: 'Times New Roman';" class=""> </span></span><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Complete
indemnification of ARIN et al.<o:p class=""></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span></div>
</blockquote>
<blockquote type="cite" class="">
<div class="">
<div class="WordSection1" style="page: WordSection1; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">So I definitely sympathize with the point that the RPA as worded there is probably unacceptable for many carriers (us included)<o:p class=""></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">I also agree that it is a moot point whether this is a click through before a download is possible or fine print of the website which is presumable accepted once
the service is accessed; it is in fact indeed commendable that ARIN does not try to let companies agree to such far reaching legal language without at least raising the flag.
</span></div>
</div>
</div>
</blockquote>
<div><br class="">
</div>
<div>Eric - </div>
<div><br class="">
</div>
<div>
<div>ARIN does indeed call out the entry into a RPKI legal agreement, and this is an </div>
<div>agreement that includes indemnification (whereas other RIRs rely upon implicit </div>
<div>binding via use to similar provisions in their overall registry agreements.)</div>
<div class=""><br class="">
</div>
</div>
<blockquote type="cite" class="">
<div class="">
<div class="WordSection1" style="page: WordSection1; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Therefore the points made by Wes during his nanog talk regarding the modification of the RPA are pertinent here.</span></div>
</div>
</div>
</blockquote>
<div><br class="">
</div>
<div>After Wes’ presentation, access to ARIN’s TAL was changed to no longer require </div>
<div>explicit acceptance (via entry of email address and access via emailed link) and </div>
<div>instead allow direct download, but it remains unclear whether implicit agreement </div>
<div>via having the TAL bundled with other software would suffice for the same purposes</div>
<div>(at least in the US.)</div>
</div>
<div><br class="">
</div>
<div>
<blockquote type="cite" class="">
<div class="">
<div class="WordSection1" style="page: WordSection1; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">I wonder why the trustees have chosen to take such a defensive approach on information contained in the RKPI, after all we have had RBL lists in the past for
blocking mail, we pretty much all uses RIR routing registries for building our filters, many people rely on PeeringDB for keeping their peering records up to date and I have not encountered such defensive position before.<o:p class=""></o:p></span></div>
</div>
</div>
</blockquote>
<div class="">
<div class="WordSection1" style="page: WordSection1; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""><o:p class=""><br class="">
</o:p></span></div>
<div>It is true that the ARIN RPA contains an indemnification clause, but as I pointed out to </div>
<div>Wes, it is remarkably similar to the indemnification clauses that are contained in many</div>
<div>carriers' Internet service contracts. Providing and purchasing Internet services under</div>
<div>such indemnification provisions does tend to belie claims that those same provisions for </div>
<div>RPKI are burdensome, and further those provisions serve an important role in making</div>
<div>sure that ARIN’s overall registry services (used by many thousands of organizations) </div>
<div>cannot be impacted by any adverse outcome resulting from less-than-diligent RPKI usage. </div>
<div><br class="">
</div>
</div>
</div>
<blockquote type="cite" class="">
<div class="">
<div class="WordSection1" style="page: WordSection1; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Especially RPKI requires a wide acceptance to be able to do anything useful.<o:p class=""></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">What would be the process for the trustees to review this matter and share their insights on this matter?</span></div>
</div>
</div>
</blockquote>
<br class="">
</div>
<div>The ARIN Board of Trustees has spent a very significant amount of time in recent</div>
<div>years on RPKI services, including their availability, terms of service and related risks – </div>
<div>this has resulted in continuous improvement to both the agreements and methods of </div>
<div>access to the TAL as noted above. </div>
<div><br class="">
</div>
<div>The Trustees are all on this mailing list, and I will (as previously noted) bring this </div>
<div>topic to them at their next meeting for further review. I also note that the ARIN </div>
<div>Board of Trustees holds a public session at each ARIN meeting and is available </div>
<div>to address questions such as these if a more interactive format is preferred.</div>
<div><br class="">
</div>
<div>Thanks!</div>
<div>/John</div>
<div><br class="">
</div>
<div>John Curran</div>
<div>President and CEO</div>
<div>ARIN</div>
<div><br class="">
</div>
<div><br class="">
</div>
<br class="">
</body>
</html>