ARIN RPKI TAL deployment issues

Wed Sep 26 02:55:45 UTC 2018

On 25 Sep 2018, at 7:11 PM, Jared Mauch <jared at puck.nether.net> wrote:
> 
> Why is ARIN making it so hard for it’s members to get the benefits of the global ecosystem for their RIR controlled space?  What makes ARIN IP space so unique in this sense?  As part of a global ecosystem it’s incumbent of many of us to do the right thing here and ARIN is increasing the friction on the part of everyone to do the right thing.

Jared - 

Indeed - In the process of complying with a different legal environment, ARIN sometimes has to behave differently than RIRs that are located elsewhere...

In order to protect the stability of the services we provide to all ARIN customers, we have those relying on ARIN’s certificate services indemnify ARIN from claims of damages in connection with their usage.  Such indemnification isn’t unique to ARIN - RIPE has RPKI publishers indemnify RIPE, APNIC has any users of APNIC digital certificates indemnify APNIC, etc.   

The significant difference for ARIN is that we operate under a different legal regime, and as a matter of US law, it appears that we cannot rely only upon terms and conditions published in our website as evidence of informed agreement; i.e. within the US legal framework, we need a specific act of acceptance in order to have a binding agreement.  

We originally accomplished this binding via an explicit click-box acknowledgement and emailing the the TAL to agreeing party, then managed to evolve it over time to just the click-box acceptance of terms, and now are able to consider the act of simply downloading of the TAL itself as sufficient to constitute agreement to terms. 

Different legal regimes result in different implementations, even when the terms (such as indemnification) are similar. 

Thanks,
/John

John Curran
President and CEO
American Registry for Internet Numbers