Policy Proposal: whois POC e-mail cleanup

[Member Services]

ARIN received the following policy proposal. In accordance with the ARIN
Internet Resource Policy Evaluation Process, the proposal is being
posted to the ARIN Public Policy Mailing List (PPML) and being placed on
ARIN's website.

The ARIN Advisory Council (AC) will review this proposal at their next
regularly scheduled meeting. The AC may decide to:

     1. Accept the proposal as written. If the AC accepts the proposal,
it will be posted as a formal policy proposal to PPML and it will be
presented at a Public Policy Meeting.

     2. Postpone their decision regarding the proposal until the next
regularly scheduled AC meeting in order to work with the author. The AC
will work with the author to clarify, combine or divide the proposal. At
their following meeting the AC will accept or not accept the proposal.

     3. Not accept the proposal. If the AC does not accept the proposal,
the AC will explain their decision via the PPML. If a proposal is not
accepted, then the author may elect to use the petition process to
advance their proposal. If the author elects not to petition or the
petition fails, then the proposal will be closed.

The AC will assign shepherds in the near future. ARIN will provide the
names of the shepherds to the community via the PPML.

In the meantime, the AC invites everyone to comment on this proposal on
the PPML, particularly their support or non-support and the reasoning
behind their opinion. Such participation contributes to a thorough
vetting and provides important guidance to the AC in their deliberations.

The ARIN Internet Resource Policy Evaluation Process can be found at:
http://www.arin.net/policy/irpep.html

Mailing list subscription information can be found at:
http://www.arin.net/mailing_lists/

Regards,

Member Services
American Registry for Internet Numbers (ARIN)


## * ##


Policy Proposal Name: whois POC e-mail cleanup

Author: Ted Mittelstaedt

Proposal Version: 1

Submission Date: 8/20/2008

Proposal type: new

Policy term: permanent

Policy statement:

Under Directory Services in the NRPM

add section 3.6 titled "Reliability of Whois information"

3.6.1  ARIN will use an automated system that once a year will attempt
to e-mail all separate e-mail addresses in the directory. (including
abuse addresses)  At it's discretion, ARIN will attempt to contact by
regular mail or phone all POC entries that have invalid e-mail addresses
(i.e. e-mail addresses that bounce mail sent to them) and give them a 3
month deadline for correction of their mail address.  The automated
system will not use a mail cluster or other mail transmission software
that is incompatible with commonly available anti-spam technologies,
such as greylisting.

LIR POC's that fail to respond to paper mails or telephone calls will
have Their e-mail address replaced with "REFUSED RESPONSE" in the
directory. Non-legacy POCs will be requested to remedy the situation by
their next billing date.  At it's discretion and considering the size or
number of complaints about an organization, ARIN may require the
organization to supply accurate contact information in it's directory
entry as a condition of accepting payment from the organization for
registration renewals.

POCs belonging to blocks reassigned by LIRs who fail to respond will be
replaced by the POC of the reassigning LIR.

The automated e-mails will have a text string titled "ARIN Automated POC
e-mail test" identifying them so that automated trouble ticket systems
can be programmed to automatically delete the mail messages instead of
replying to them.

Other standard mailing list practices will be followed by ARIN to insure
the absence of e-mail loops, etc.

3.6.1  ARIN will supply a report to the community, updated monthly, that
lists the percentage of "REFUSED RESPONSE" POCs, the percentage of POCs
that accept e-mails, and the percentage of POC addresses that have not
responded but have not yet been notified by paper mail or telephone.

Rationale:

As the entire Internet community gets closer to the date that IPv4 will
be exhausted, more attention is being focused on the possibility that
there is significant amounts of allocated IPv4 that is abandoned.  There
are also concerns that as the amount of usable IPv4 space gets more and
more crowded, that Internet criminals are turning to abandoned IPv4
space that is still listed as allocated in the whois directories to use
to make attacks on hosts on the Internet.  Because of these reasons, it
is becoming more important that users of ARIN's whois data have a
reasonable expectation that it is accurate.

The current NRPM has a mechanism for adding, modifying, and deleting
POCs. However it also carries an assumption that POCs belonging to
defunct companies will be removed when the bills for allocated IP
addressing cease being paid, and the address resources are then returned
to the ARIN pool as a result. The problem is that this assumption does
not hold true for so-called "Legacy" IP address holders since they do
not pay a yearly fee.  Furthermore, billing for the IP addressing
allocations is done through paper mail, thus it is possible for a POC to
have a valid street address, but an invalid E-mail address, and not be
caught because they are current on their account.  This is becoming a
serious issue because contacting a POC via a street address is too slow
for victims of an attack from a hijacked IP block to be able to complain
to the block owners and the block owners to be able to catch the
perpetrators.

Timetable for implementation: Immediate