Re: Proof of ownership; when someone demands you remove a prefix

[Job Snijders <job () ntt net>]

Dear Sean,

On Tue, Mar 13, 2018 at 10:38:49AM -0700, Sean Pedersen wrote:
> This is more or less the situation we're in. We contacted the customer
> and they informed us the matter is in dispute with the RIR and that
> their customer (the assignee) is in the process of resolving the
> issue. We have to allow them time to accomplish this. I've asked for
> additional information to help us understand the nature of the
> dispute. In that time we received another request to stop announcing
> the prefix(s) in addition to a new set of prefixes, and a threat to
> contact our upstream providers as well as ARIN - which is not the RIR
> the disputed resources are allocated to.

I've seen disputes too between end users and RIRs - usually this is due
to non-payment. It can be helpful to do two things: set a reasonable
deadline for the customer to resolve this, and verify with the RIR
whether the dispute is actually ongoing or whether the RIR closed the
case. Example case: customer said they were in dispute, but RIR
indicated that the case was closed. If the RIR closed the case, I'd lean
to dropping the announcement.

> This is a new(er) customer, so there is some merit to dropping the
> prefix and letting them sort it out based on the current RIR
> contact(s). However, there is obvious concern over customer service
> and dropping such a large block of IPs. 

Size of the block often is a poor indicator for legitimacy.

Kind regards,

Job