Re: Open Petition for ARIN-prop-266: BGP Hijacking is an ARIN Policy Violation (fwd)

[Owen DeLong <owen () delong com>]

> I personally support the petition. I think the out of scope reasoning is flawed. By enforcing minimum assignment 
> sizes, ARIN has long acted as a gatekeeper to the routing system, controlling who can and can not participate. For 
> better or worse, that puts the proposal in scope.

Speaking only for myself and not as a representative of the ARIN AC…

I believe this is a distortion of the realities of the situation and of the history.

ARIN actually led the charge to lengthen the maximum IPv6 prefix accepted by ISPs (from /32 all the way to /48).

ARIN prefix size limits have almost always been equal to or longer than those accepted by a majority of providers on 
the internet and in almost all cases where those limits changed, ARIN changed first, with providers changing as a 
result of the pressure that created.

As to how those were decided within the ARIN process, please note that it was community consensus that drove those 
changes (and resisted them in the earlier days). Nonetheless, the reason for having those limits had to do with how 
ARIN was managing the resources on behalf of the community. Any impact or lack thereof on the routing table was a 
secondary effect. The policy was in scope because it affected how ARIN managed the registry.

The current proposal doesn’t actually affect any action ARIN takes in managing the registry. It attempts to expand the 
scope of ARIN’s mission to include some vague form of policing routing. It doesn’t provide any real information about 
how this new mission should be accomplished, nor does it take into account the fact that since ARIN controls only a 
small handful of routers, it has little to no ability to make any decisive or useful action in this regard. It seems to 
assume that those hijacking resources are ARIN members (or at least ARIN resource holders who signed an RSA subjecting 
them to ARIN policy).

It is utterly untested waters as to whether ARIN has any ability to take any action against a party that hasn’t got a 
contract with ARIN for violating the rights of a party that does have a contract with ARIN. To be useful, this policy 
would, IMHO, need to somehow empower ARIN to do that. I am not a lawyer, but I doubt such empowerment can come from 
anything short of regulation, thus certainly out of scope of ARIN policy.

I agree with Bill that such empowerment would not be a good thing anyway, so it’s not like I want to see that 
regulation come about, but until it does, I don’t see an in-scope effect from this proposal.

Owen