<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
On 13 Jul 2019, at 1:53 AM, David Farmer <<a href="mailto:farmer@umn.edu" class="">farmer@umn.edu</a>> wrote:<br class="">
<div>
<blockquote type="cite" class="">
<div class=""><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class="">
<div class="gmail_quote" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">
<div dir="ltr" class="gmail_attr">On Fri, Jul 12, 2019 at 12:14 PM John Curran <<a href="mailto:jcurran@arin.net" target="_blank" class="">jcurran@arin.net</a>> wrote:<br class="">
</div>
<blockquote class="gmail_quote" style="margin: 0px 0px 0px 0.8ex; border-left-width: 1px; border-left-style: solid; border-left-color: rgb(204, 204, 204); padding-left: 1ex;">
<div class="">
<div class="">The problem with that reasoning is that the registrants "use of ARIN’s registration services" generally continues just fine… i.e. they can receive additional resources, update their number resources entries, etc. Thus, ARIN would likely face
challenges in attempting to assert violation of the Prohibited Conduct clause on such a basis. </div>
<div class=""><span class="m_-4787022214495879955m_-7421705351070862885m_-6957213731093441082m_-8907735655722735596m_2637472130810333746gmail-m_5498879303841031385Apple-tab-span" style="white-space: pre-wrap;"></span></div>
<div class=""><span class="m_-4787022214495879955m_-7421705351070862885m_-6957213731093441082m_-8907735655722735596m_2637472130810333746gmail-m_5498879303841031385Apple-tab-span" style="white-space: pre-wrap;"></span>If the community really wishes that those
participating in the ARIN registry commit to specific routing behavior, then such an obligation should be made quite explicit in the RSA.</div>
</div>
</blockquote>
<div class=""><br class="">
</div>
<div class="">I think the same logic would apply to ARIN's Whois service as well. If Whois were interfered with and taken offline in some way, registrants "use of ARIN’s registration services" generally continues just fine too, i.e. the service that really
matters the uniqueness of the resources are unaffected. I think the same applies to RPKI, if the RPKI repository were interfered with or was unavailable for whatever reason the Internet should keep working just fine.</div>
</div>
</div>
</blockquote>
<div><br class="">
</div>
David - </div>
<div><br class="">
</div>
<div>You are incorrect - if a party managed to interfere with ARIN’s registry services (including the publication of information via Whois) on a large scale, it would be relatively straightforward to show them to be in violation of the prohibited conduct clause. </div>
<div><br class="">
</div>
<div>For example, if the route hijacking was for the IP address blocks that ARIN uses for providing services to the community, then that would indeed qualify as prohibited conduct. </div>
<div>
<div class="">
<div class="gmail_quote" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">
<div class=""><br class="">
</div>
</div>
</div>
<blockquote type="cite" class="">
<div class="">
<div class="gmail_quote" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">
<div class="">Using the standard you provide above, it seems to me, the Prohibited Conduct clause is useless and would never apply to anything meaningful.</div>
</div>
</div>
</blockquote>
<div><br class="">
</div>
<div>The clause reads (in part): "In using any of the Services, Holder shall not: (i) disrupt or interfere with the security or use of any of the Services; …”</div>
<div><br class="">
If you engage in a significant disruption of ARIN’s services, then it applies. For example, if we had a horrible coding/security flaw such that a specific Whois query shutdown our services, I can understand someone doing it once or twice to confirm before
reporting it to ARIN. However, doing such a query every 5 minutes to disrupt our operations would be a fine example of "prohibited conduct”. </div>
<div><br class="">
</div>
<blockquote type="cite" class="">
<div class="">
<div class="gmail_quote" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">
<div class="">So I ask, what kind of disruption or interference would the Prohibited Conduct clause actually apply too? How are they different than routing behavior? And why don't they need to be made equally explicit then? (I don't need or expect an exhaustive
list, but a couple of examples would be instructive)</div>
</div>
</div>
</blockquote>
<div><br class="">
</div>
See above - the key element is disruption of ARIN’s services. We don’t consider invoking prohibited conduct clause against a resource holder simply because they interfered with someone’s access to ARIN’s services – such a reading could support ARIN seeking
remedies against ISPs who had any form of service outage, and that is definitely not the intent. </div>
<div><br class="">
</div>
<div>
<blockquote type="cite" class="">
<div class="">
<div class="gmail_quote" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">
<blockquote class="gmail_quote" style="margin: 0px 0px 0px 0.8ex; border-left-width: 1px; border-left-style: solid; border-left-color: rgb(204, 204, 204); padding-left: 1ex;">
<div class="">
<div class=""><span class="m_-4787022214495879955m_-7421705351070862885m_-6957213731093441082m_-8907735655722735596m_2637472130810333746gmail-m_5498879303841031385Apple-tab-span" style="white-space: pre-wrap;"></span>For example – "Address Holder agrees to
only announce routing for its own address blocks, or those address blocks for which it has obtained permission of the registrant as listed in the Internet Number Registry System.” </div>
<div class=""><br class="">
</div>
<div class=""><span class="m_-4787022214495879955m_-7421705351070862885m_-6957213731093441082m_-8907735655722735596m_2637472130810333746gmail-m_5498879303841031385Apple-tab-span" style="white-space: pre-wrap;"></span>It is unclear if such an obligation should
exist, and I would advise the community to very carefully consider the implications that would result. </div>
<div class=""><br class="">
</div>
<div class=""><span class="m_-4787022214495879955m_-7421705351070862885m_-6957213731093441082m_-8907735655722735596m_2637472130810333746gmail-m_5498879303841031385Apple-tab-span" style="white-space: pre-wrap;"></span>(If there were a consultation that showed
significant support, then the Board of Trustees could consider recommending such an RSA change – note that the latest version of the RSA provides that ARIN may only modify the RSA in response to a specific change in the law, or after ratification by Member
vote… i.e. adding such an obligation would require recommendation of the Board followed by an affirmative ballot of the ARIN Membership.) </div>
</div>
</blockquote>
<div class=""><br class="">
</div>
Personly, I'd be fine with that.<br class="">
</div>
</div>
</blockquote>
<div><br class="">
</div>
If the community wanted it, and the obligation was plainly identified in the RSA, then I’d be fine with it as well. However, that’s quite different that creating very specific obligations on how parties do their routing thru aggressive reading of the overall
prohibited conduct clause in the RSA. <br class="">
<div class="">
<div class="gmail_quote" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">
<br class="">
</div>
</div>
<blockquote type="cite" class="">
<div class="">
<div class="gmail_quote" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">
However, you seem to be saying that, ARIN and the other RIRs can do nothing to enforce the uniqueness of resources in the context of the Internet? </div>
</div>
</blockquote>
<br class="">
</div>
<div>ARIN is a Internet number registry – we administer the registry on behalf of the community; we don’t control or administer the Internet routing system. </div>
<div><br class="">
</div>
<div>Thanks,</div>
<div>/John</div>
<div><br class="">
</div>
<div>
<div>John Curran</div>
<div>President and CEO</div>
<div>American Registry for Internet Numbers</div>
<div><br class="">
</div>
<div><br class="">
</div>
</div>
<br class="">
</body>
</html>