Draft Policy ARIN-2021-7 [Archived]

Make Abuse Contact Useful

Status: Abandoned
Shepherds: Amy Potter, Alyssa Quinn

Current Text (17 December 2021)

Problem Statement:

ARIN’s process of attaching an abuse contact to resource records is of limited utility. The phone number is often an unmanned voicemail that refers the caller to a web page while the email address is commonly an auto-responder which does the same. Because the emails often involve problematic content they can get lost in filters making it hard to even find the URL let alone get an abuse report to go through. This is further exacerbated by folks who write programs to automatically generate unverified abuse reports and email them to the ARIN contact, flooding the mailbox with useless reports that no human being is assigned to look through.

With responsible network providers, the process for dealing with network abuse instead usually starts with a web page. The web page provides instructions and may offer forms for describing the abuse and uploading supporting material of the nature that the service provider needs in order to take action.

It would be helpful for ARIN to support the abuse reporting process they actually use.

Policy statement:

Section 2.12- add “Organizations may provide an optional abuse URL for reporting abuse” to end of paragraph.

Section 4.2.3.7.3.2: add “and may have an optional abuse URL” after “Each private downstream residential reassignment must have accurate upstream Abuse and Technical POCs” so the sentence reads…

“Each private downstream residential reassignment must have accurate upstream Abuse and Technical POCs and may have an optional abuse URL visible on the WHOIS or Distributed Information Service record for that block.”

Section 6.5.5.3.1: add “and may have an optional abuse URL” after “Each private downstream residential reassignment must have accurate upstream Abuse and Technical POCs” so that the sentence reads

“Each private downstream residential reassignment must have accurate upstream Abuse and Technical POCs and may have an optional abuse URL visible on the WHOIS or Distributed Information Service record for that block.”

Timetable for implementation: Whenever

Anything Else:

Initial implementation suggested to replace the abuse POC with a URL pointing to ARIN’s display of the same POC record which was used for abuse reporting.

Should support multiple URLs so that if desired an organization can specify both “mailto:somebody@here” and “tel:1234567” if that’s how they actually want abuse reported to them.

Staff and Legal Review (14 March 2022)

Staff Understanding

ARIN-2021-7 would update several sections of the NRPM relating to Abuse Contacts, with the specific allowance and addition of a URL for abuse reporting, rather than solely a contact person.

Staff understands the proposed changes in the Policy Statement to be a straightforward direction for Abuse Contact creators to utilize the existing “Public Comment” section of the contact record.

The Problem Statement and Comments appear to allude to replacing/changing the record itself, which staff understands is no longer the intent of the Draft Policy itself.

Staff notes that the Draft Policy title and comments on alternative implementation may be confusing to some, as the record itself is not being changed by suggested policy text.

Implementable as Written?: Yes

Impact on ARIN Registry Operations and Services:

This change would necessitate instructional text for the public comment field during Point of Contact Record creation workflow.

Legal Review:

No material legal issue.

Implementation Timeframe Estimate: Three months

Implementation Requirements:

• Minor updates to ARIN Online
• Community outreach upon implementation within ARIN Online
• Staff training
• Updates to public documentation
• Updates to internal procedures and guidelines

Proposal/Draft Policy Text Assessed: 17 December 2021

History and Earlier Versions

Related Meetings