LAST CALL - Recommended Draft Policy ARIN-2017-3: Update to NRPM 3.6: Annual Whois POC Validation

[ARIN]

The ARIN Advisory Council (AC) met on 18 April 2018 and decided to send 
the following Recommended Draft Policy to Last Call:

ARIN-2017-3: Update to NRPM 3.6: Annual Whois POC Validation

The AC issued the following statement regarding changes made prior to 
Last Call:

"After receiving clear support from the community during discussions at 
ARIN 41 and on PPML, the Advisory Council has moved Recommended Draft 
Policy 2017-3: Update to NPRM 3.6: Annual Whois POC Validation to last 
call with (i) an editorial change to the title, changing NPRM to NRPM, 
and (ii) the implementation direction that annual validation emails 
continue to be sent to POCs associated with reassignments until such a 
time that POC validation upon reassignment is in place for at least one 
year."

Feedback is encouraged during the Last Call period. All comments should 
be provided to the Public Policy Mailing List. Last Call will expire on 
7 May 2018.

The Recommended Draft Policy text is below and available at:
https://www.arin.net/policy/proposals/

The ARIN Policy Development Process is available at:
https://www.arin.net/policy/pdp.html

Regards,

Sean Hopkins
Policy Analyst
American Registry for Internet Numbers (ARIN)



Recommended Draft Policy ARIN-2017-3: Update to NRPM 3.6: Annual Whois 
POC Validation

AC Assessment of Conformance with the Principles of Internet Number 
Resource Policy:

This proposal is technically sound and enables fair and impartial number 
policy as it encourages more accurate Whois data collection by 
restricting organizations without at least one validated Admin or Tech 
POC from using ARIN Online services outside of payment and contact 
update functionalities.

Problem Statement:

Many of the Point of Contacts listed in ARIN's public Whois database 
contain out-of-date and inaccurate contact information.

Policy statement:

Current Text:

3.6 Annual Whois POC Validation

3.6.1 Method of Annual Verification

During ARIN's annual Whois POC validation, an email will be sent to 
every POC in the Whois database. Each POC will have a maximum of 60 days 
to respond with an affirmative that their Whois contact information is 
correct and complete. Unresponsive POC email addresses shall be marked 
as such in the database. If ARIN staff deems a POC to be completely and 
permanently abandoned or otherwise illegitimate, the POC record shall be 
marked invalid. ARIN will maintain, and make readily available to the 
community, a current list of number resources with no valid POC; this 
data will be subject to the current bulk Whois policy.

Proposed Revised Text:

3.6 Annual Validation of ARIN's Public Whois Point of Contact Data

3.6.1 Annual POC Verification

ARIN will perform an annual verification of specific Points of Contact 
registered in the public Whois using the criteria and procedures 
outlined in sections 3.6.2, 3.6.3, and 3.6.4.

3.6.2 Specified Public Whois Points of Contact for Verification

Each of the following Points of Contact are to be verified annually, and 
will be referred to as Point of Contact or POC throughout this policy, 
and should be understood to be both organization and resource POCs:

    - Admin
    - Tech
    - NOC
    - Abuse

3.6.3 Organizations Covered by this Policy

This policy applies to every Organization that has a direct assignment, 
direct allocation, or AS number from ARIN (or one of its predecessor 
registries) or a reallocation from an upstream ISP. This includes but is 
not limited to upstream ISPs and their downstream ISP customers (as 
defined by NRPM 2.5 and 2.6), but not reassignments made to their 
downstream end user customers.

3.6.4 Procedure for Verification

An annual email notification will be sent to each of the Points of 
Contact outlined in section 3.6.2 on an annual basis. Each Point of 
Contact will have up to sixty (60) days from the date of the 
notification in which to respond with an affirmative that their Whois 
contact information is correct and complete or to submit new data to 
correct and complete it.  If after careful analysis, ARIN staff deems a 
POC to be completely and permanently abandoned or otherwise 
illegitimate, the POC record shall be marked invalid in Whois.

3.6.5 Non-Responsive Point of Contact Records

An invalid POC is restricted to payment and contact update functionality 
within ARIN Online. As a result, an organization without any valid POCs 
will be unable to access further functionalities within ARIN Online 
until at least one Admin or Tech POC validates that their information is 
accurate or modifies a POC to contain accurate information.

Comments:

Timetable for implementation: to be based upon discussions with ARIN's 
staff.