Re: DOD prefixes and AS8003 / GRSCORP

[Owen DeLong via NANOG <nanog () nanog org>]

> On Mar 15, 2021, at 15:07 , Tom Beecher <beecher () beecher cc> wrote:
>
> I think it’s a general matter of public interest how this reassignment of a massive government-owned block of well 
> over sixteen million IP addresses happened. Even if not fraudulent, the public has a right to know who is behind this 
> huge transfer of wealth.
>
> Don’t you?

> On Mon, Mar 15, 2021 at 3:35 PM Mel Beckman <mel () beckman org <mailto:mel () beckman org>> wrote:
> Owen,
>
> I think one cause for concern is why “almost all DOD prefixes (7.0.0.0/8,11.0.0.0/8,22.0.0.0/8 
> <http://7.0.0.0/8,11.0.0.0/8,22.0.0.0/8> and bunch of /22s) are now announced under AS8003 <> (GRSCORP) which was 
> just formed a few months ago,” which, according to ARIN WHOIS, had a source registry of “DoD Network Information 
> Center”. 

Somehow, I’m of the impression that DoD is quite capable of defending their own property if necessary. I’m also not of 
the same belief as you that GRSCORP was just formed a few months ago. It seems to have bounced back and forth between 
Florida and Delaware one or more times, but that’s not all that uncommon for a corporation physically located in 
Florida. Corporations change their state of incorporation somewhat regularly for a variety of legal forum shopping 
purposes, including but not limited to tax advantages, court jurisdictional advantages, etc.


> I think it’s a general matter of public interest how this reassignment of a massive government-owned block of well 
> over sixteen million IP addresses happened. Even if not fraudulent, the public has a right to know who is behind this 
> huge transfer of wealth.

I don’t see a transfer of wealth. I see DOD finally having a contractor originate their prefixes in order to make life 
more difficult for squatters, hijackers, and other miscreants. About time, if you ask me. I mean, I’m sure that in 
order to provide that level of sink-hole, GRSCORP is having to pay some hefty transit bills and maintain some 
significant infrastructure and likely passing all that cost along to DoD at a hefty markup, so I suppose that’s some 
level of transfer of wealth, but as DoD contracts go, I somehow don’t think this one would be regarded as “significant”.

Owen

> Don’t you?
>
>  -mel beckman
>
> > On Mar 15, 2021, at 12:23 PM, Owen DeLong via NANOG <nanog () nanog org <mailto:nanog () nanog org>> wrote:
> >
> >  According to the timeline posted to this list (by you, Siyuan), Globl Resource Systems, LLC was registered in 
> > Delaware on September 8, 2020.
> > Your timeline also shows the resources being issued to GRS by ARIN on September 11, september 14, 2020
> > It looks to me like they subsequently registered the corporation in Florida and moved the company address there.
> >
> > I don’t see anything suspicious here based on your own statements, so I’m a bit confused what you are on about.
> >
> > Owen
> >
> > > On Mar 12, 2021, at 03:34 , Siyuan Miao <aveline () misaka io <mailto:aveline () misaka io>> wrote:
> > >
> > > Hi John,
> > >
> > > My biggest concern is why the AS8003 was assigned to the company (GLOBAL RESOURCE SYSTEMS, LLC) even before its 
> > > existence.
> > >
> > > When we were requesting resources or transfers, ARIN always asked us to provide a Certificate of Good Standing and 
> > > we had to pay the state to order it.
> > >
> > > However, it appears that a Certificate of Good Standing is not required or ARIN didn't validate it in this case. 
> > >
> > > Regards,
> > > Siyuan
> > >
> > > On Fri, Mar 12, 2021 at 7:17 PM John Curran <jcurran () arin net <mailto:jcurran () arin net>> wrote:
> > > On 11 Mar 2021, at 7:56 AM, Siyuan Miao <aveline () misaka io <mailto:aveline () misaka io>> wrote:
> > > > Hi Folks,
> > > >
> > > > Just noticed that almost all DOD prefixes (7.0.0.0/8,11.0.0.0/8,22.0.0.0/8 
> > > > <http://7.0.0.0/8,11.0.0.0/8,22.0.0.0/8> and bunch of /22s)  are now announced under AS8003 (GRSCORP) which was 
> > > > just formed a few months ago.
> > > >
> > > > It looks so suspicious. Does anyone know if it's authorized?
> > >
> > > Siyuan - 
> > >
> > > If you have concerns, you can confirm whether these IP address blocks are being routed as intended by verification 
> > > with their listed technical contacts - e.g. https://search.arin.net/rdap/?query=22.0.0.0 
> > > <https://search.arin.net/rdap/?query=22.0.0.0>  
> > >
> > > As I noted on this list several weeks back - "lack of routing history is not at all a reliable indicator of the 
> > > potential for valid routing of a given IPv4 block in the future, so best practice suggest that allocated address 
> > > space should not be blocked by others without specific cause. Doing otherwise opens one up to unexpected surprises 
> > > when issued space suddenly becomes more active in routing and is yet is inexplicably unreachable for some 
> > > destinations."
> > >
> > > Thanks!
> > > /John
> > >
> > > John Curran
> > > President and CEO
> > > American Registry for Internet Numbers