Re: Proof of ownership; when someone demands you remove a prefix

["Naslund, Steve" <SNaslund () medline com>]

The fact that it is a newer customer would make me talk to the RIR direct and verify that a dispute is really in 
progress.  I would also look at some looking glasses and see if the prefix is being announced elsewhere, if so that 
might indicate that your customer is indeed stepping on a legit owner.  I would also make it clear to the new customer 
that they are on thin ice here to light a fire under their process.  Let them know that it is up to them to convince 
you that they are the legit owner.  No one wants to lose a customer but they are threatening your business and putting 
you in legal jeopardy if they are not legit.

Steven Naslund
Chicago IL

> -----Original Message-----
> From: NANOG [mailto:nanog-bounces () nanog org] On Behalf Of Sean Pedersen
> Sent: Tuesday, March 13, 2018 12:39 PM
> To: nanog () nanog org
> Subject: RE: Proof of ownership; when someone demands you remove a prefix
>
> This is more or less the situation we're in. We contacted the customer and they informed us the matter is in dispute 
> with the RIR and that their >customer (the assignee) is in the process of resolving the issue. We have to allow them 
> time to accomplish this. I've asked for additional information >to help us understand the nature of the dispute. In 
> that time we received another request to stop announcing the prefix(s) in addition to a new set of >prefixes, and a 
> threat to contact our upstream providers as well as ARIN - which is not the RIR the disputed resources are allocated 
> to.
>
> This is a new(er) customer, so there is some merit to dropping the prefix and letting them sort it out based on the 
> current RIR contact(s). However, >there is obvious concern over customer service and dropping such a large block of 
> IPs. 
>
> I'm definitely leaning toward "let the customer (or customer's customer) and the RIR sort it out" if the POC validates 
> the request weighed responsibly >against customer age. However, from a customer service perspective, I think we owe it 
> to our customers to make sure a request is legitimate before we >knock them offline. With a limited toolset to 
> validate that information, I can't help but feel conflicted.
>
> I appreciate all the feedback this thread has generated so far!