I just want to take a moment and say how much I appreciate John Curran's speedy reply to my two questions. Coming from him, I feel sure that I have answers which are coming straight from the proverbial horse's mouth, as it were. Thanks John!
I resopond briefly below. In message <[email protected]>, John Curran <[email protected]> wrote: >> 1) What sorts of documents, exactly, must either party `A' or party >> `B' in the above scenario submit to ARIN in order to establish their >> bona fides to ARIN's satisfaction? >At a minimum, Incorporation documents which align with their state >registration. Additional information will likely be required, depending >on the circumstances. The above answer is, of course, entirely sensible. But I've just now realized that I may have actually asked the wrong question. Naturally, when a -new- legal entity shows up at the door of ARIN, asking to be let in, ARIN is going to do some good and proper due diligence to see that they are who they say they are. But the scenario I described is a bit different. In that scenario, party `B' shows up at ARIN's door -pretending- to be the already-vetted party `A', and then proceeds to request ``additional'' number resources, i.e. either additional AS numbers, or additional IP blocks or both. (The newly-allocated numbers would then be formally assigned by ARIN to party `A', but it seems at least theoretically possible that `A' might not even find out about these supplimental allocations, thus leaving party `B' free to do as it will with them.) I had actually intended to ask about ARIN's process for vetting these kinds of ``supplimental'' allocations, but thinking about it now I've just realized that actually, I'm not sure that I want to know, or rather, I'm fairly sure that I -do not- want John to elaborate in any detail on the internal processes used to vet supplimental allocation requests. Not in public anyway. If there's one thing that both history and recent current events has taught me it is that in order for any party to ``beat'' he system, that party first has to know the system. For this reason it is probably better that the fine details of ARIN's vetting processes should be left unspoken. But with respect to the ``supplimental allocation'' scenario I've described, I will just offer up the (naive?) observation that I suspect that supplimental allocation requests are, most likely, not subjected to quite the same level of scrutiny as are original/primary allocation requests. (That is almost certainly both reasonable and unavoidable. I doubt that ARIN members would like being asked to prove their identities all over again for each additional allocation request. That would be neither convenient nor terribly practical.) Regarding my second question, I asked if there was any existing written policy covering ARIN's actions in cases where it might see evidence of bald faced fraud, and asked specifically about these four possibilities: > a) ARIN will report the fraud to law enforcement > b) ARIN will initiate civil legal action against party `B' > c) both of the above > d) none of the above Once again I thank John for providing a crisp, clear, and on-point response. John said that ARIN may do any of the above, and that the actions taken in any given case are not, at present, governed by written policy. I actually find that all to be quite reasonable, and having already said that my goal was neither to create debate about any of this, nor to participate in any such debate that might arise as a result of my questions, I do feel constrained by that earlier comment. Nontheless, I can't help but put forward some modest suggestions for minor changes: 1) I think it would be Good if ARIN had at least some written policy with respect to fraud, even if that was only very minimal. ARIN has been the victim of fraud on multiple occasions in the past, and given the both the incentives and the increasingly chaotic nature of life on the Internet, I believe that this is likely to be an issue in the future as well. 2) With respect to civil litigation, I am personally and painfully aware of the old saying ``You can't get blood out of a turnip'', and that thus, civil litigation is often just not worth it. Thus I think that it is eminently appropriate to leave decisions about civil litigation entirely up to to the good judgement and discretion of John and his colleagues. That having been said however, my personal preference would be to have in place a formal ARIN policy which would unambiguously direct ARIN management to file a formal report with law enforcement in each and every case where the available facts indicate that there is probably cause to believe that criminal fraud has occured. Borrowing from the language of the RFCs, I would prefer to see this converted from a MAY to a MUST. Any fraudster who is intent upon deceiving ARIN in a material way should have no illusions that his actions will go unreported. Regards, rfg _______________________________________________ PPML You are receiving this message because you are subscribed to the ARIN Public Policy Mailing List ([email protected]). Unsubscribe or manage your mailing list subscription at: http://lists.arin.net/mailman/listinfo/arin-ppml Please contact [email protected] if you experience any issues.
