<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Helvetica;
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;
font-weight:normal;
font-style:normal;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple style='word-wrap:break-word'><div class=WordSection1><p class=MsoNormal>Hi Matthew,<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Thank you for reminding us that this relates only to transfers of expensive IP addresses.<o:p></o:p></p><p class=MsoNormal>So protections against fraud which were vital to protect the free pool can be relaxed a bit in the context of buying addresses.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I don’t think this is a very important issue, but we have seen transfers delayed while locating the appropriate party to meet ARIN’s requirements for an “officer.” <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I lean towards support for the policy just because removing non-essential verbiage from the NRPM makes it clearer and easier to understand.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Has ARIN ever utilized an officer attestation in a fraud investigation related to an address buyer, as opposed to free-pool recipient?<o:p></o:p></p><p class=MsoNormal>What additional legal benefit does the notarized attestation afford ARIN if fraud is suspected?<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Regards,<br>Mike<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b>From:</b> ARIN-PPML <arin-ppml-bounces@arin.net> <b>On Behalf Of </b>Noah<br><b>Sent:</b> Thursday, June 23, 2022 1:08 PM<br><b>To:</b> Matthew Wilder <matthew.wilder@telus.com><br><b>Cc:</b> PPML <arin-ppml@arin.net><br><b>Subject:</b> Re: [arin-ppml] Draft Policy ARIN-2022-3: Remove Officer Attestation Requirement for 8.5.5<o:p></o:p></p></div><p class=MsoNormal><o:p> </o:p></p><div><div><p class=MsoNormal>Hi Matthew<o:p></o:p></p><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>In my humble opinion, attestation is a very fundamental obligation and responsibility. The obligator is accountable and lack of accountability is what creates room for fraud.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Removing a means by which the parties involved are able to retain confidence in the process is rather unwise. <o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>If the party in Authority is aware of the transfer transaction, then let them legitimize that awareness by attesting and in case of fraudsters gaming the process, then folks at ARIN or parties involved would have a starting point in ref: accountability.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>The premise for cost and time should not overlook the need for a legitimate process.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Cheers<o:p></o:p></p></div><div><p class=MsoNormal>Noah<o:p></o:p></p></div></div><p class=MsoNormal><o:p> </o:p></p><div><div><p class=MsoNormal>On Thu, 23 Jun 2022, 19:06 Matthew Wilder, <<a href="mailto:matthew.wilder@telus.com" target="_blank">matthew.wilder@telus.com</a>> wrote:<o:p></o:p></p></div><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in'><div><p class=MsoNormal>Hi Noah, et al.<o:p></o:p></p><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>It appears that a few of you are not convinced of the problem statement for this Draft policy. Just a reminder this is a draft policy authored by the Policy Experience Working Group, to solve a customer experience problem identified by staff. Also, taking off my AC hat and putting on my day job hat for a moment - I can assure you that if you are at an organization of significant scale and complexity - this is indeed a real problem. In the case of qualification for transfers (8.5.5) this is a redundant step, in practice, since significant sums of money must be approved by executives in order to execute transfers.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Swapping back to my AC hat now. To my mind, the introduction of officer attestations generally helped achieve two positive outcomes. First, it supported the principle of conservation. Second, it reduced the opportunity for fraud. There may be other benefits obtained by the requirement for officer attestation, and I am open to hearing everyone's perspective on this.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>This draft policy would do away with the need for officer attestation for justification of transfers, but only because the market provides the same benefits mentioned above. Would-be fraudsters on the transfer market would now face significant cost to execute a transfer, and presumably, an organization operating in bad faith could easily provide officer attestation. Similarly, documentation of an overly-optimistic plan - securing more resources than realistically needed - will mean a higher cost to the organization bankrolling the transfer. As a result, the individuals accountable for the organization's decisions are well aware of - and implicitly supportive of - the plan. An officer attestation is therefore redundant in both cases.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>To Noah and others who have voiced opposition - let me know if you see a case where the officer attestation in 8.5.5 protects the interests of ARIN and the community.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Best regards,<o:p></o:p></p></div><div><p class=MsoNormal>Matthew<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div></div><p class=MsoNormal><o:p> </o:p></p><div><div><p class=MsoNormal>On Tue, Jun 21, 2022 at 9:15 PM Noah <<a href="mailto:noah@neo.co.tz" target="_blank">noah@neo.co.tz</a>> wrote:<o:p></o:p></p></div><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in'><div><p class=MsoNormal style='margin-bottom:12.0pt'><o:p> </o:p></p><div><div><p class=MsoNormal>On Wed, 22 Jun 2022, 04:56 ARIN, <<a href="mailto:info@arin.net" target="_blank">info@arin.net</a>> wrote:<o:p></o:p></p></div><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in'><div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>On 16 June 2022, the ARIN Advisory Council (AC) accepted "ARIN-prop-309: Remove Officer Attestation Requirement for 8.5.5" as a Draft Policy.<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Draft Policy ARIN-2022-3: Remove officer attestation requirement for 8.5.5<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Problem Statement:<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Requiring an officer attestation requires unnecessary resources and increases the time to complete an IPv4 transfer.<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Policy statement:<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>8.5.5. Block Size<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Organizations may qualify for the transfer of a larger initial block, or an additional block, by providing documentation to ARIN which details the use of at least 50% of the requested IPv4 block size within 24 months.<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Removing “An officer of the organization shall attest to the documentation provided to ARIN.<o:p></o:p></p></div></div></blockquote></div><div><p class=MsoNormal>Using time as an excuse does not fly. Attestation is accountability and enforces legitimacy.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>An authorized officer should not only be aware but MUST also be involved in attesting of documents that involve any Internet Number Resources transfers.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>We have experienced fast hand on the negative impact of Admin Contacts being clueless to what its that Tech contacts do.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>So I oppose the policy for using time as an excuse to remove an important process that ensures legitimacy.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Noah<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div></div><p class=MsoNormal>_______________________________________________<br>ARIN-PPML<br>You are receiving this message because you are subscribed to<br>the ARIN Public Policy Mailing List (<a href="mailto:ARIN-PPML@arin.net" target="_blank">ARIN-PPML@arin.net</a>).<br>Unsubscribe or manage your mailing list subscription at:<br><a href="https://lists.arin.net/mailman/listinfo/arin-ppml" target="_blank">https://lists.arin.net/mailman/listinfo/arin-ppml</a><br>Please contact <a href="mailto:info@arin.net" target="_blank">info@arin.net</a> if you experience any issues.<o:p></o:p></p></blockquote></div><p class=MsoNormal><br clear=all><o:p></o:p></p><div><p class=MsoNormal><o:p> </o:p></p></div><p class=MsoNormal>-- <o:p></o:p></p><div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><b><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#767171'>Matthew Wilder</span></b><span style='color:#222222'><o:p></o:p></span></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#767171'>Sr Engineer - IPv6, IP Address Management</span><span style='color:#222222'><o:p></o:p></span></p></div></div></blockquote></div></div></div></body></html>