Policy
Letters of Authorisation
Liberty Security Services, LLC — AS21990
A Letter of Authorisation is how one organisation tells another that it may accept and announce a block of IP address space. This page covers both directions: the LOA we issue for 206.109.108.0/23, and what we require before we will announce address space held by somebody else.
What an LOA is not
An LOA is a piece of paper. It carries no cryptographic weight, it cannot be checked by a machine, and a convincing forgery costs nothing to produce. It records intent; it does not prove authority.
The control that actually works is RPKI. A Route Origin Authorisation is published by the resource holder under their RIR, is checked by every operator on the path, and cannot be forged by whoever happens to be holding a PDF. We treat the ROA as authoritative and the letter as the paperwork around it.
That is why the process below leans on registry data rather than on the document, and why a completed letter on its own does not get a prefix announced.
The LOA we issue
If you are an upstream, a peer, a transit provider or an exchange point and you need written authority to carry 206.109.108.0/23, email peering@as21990.net and we will issue a completed and signed copy.
The blank is published so you can see the form before you ask for it, and so you can tell whether a copy you have been handed has been altered:
Everything the letter asserts is independently checkable, and we would rather you checked it than took our word:
| Registry | ARIN RDAP — the prefix is a direct allocation to Liberty Security Services, LLC (Org LSSL-7) |
| RPKI | ROA published under the ARIN trust anchor: origin AS21990, maxLength /23 |
| IRR | Route objects registered in ARIN and RADB |
| PeeringDB | net/40787 |
To confirm a letter is genuine, telephone +1-845-418-3577 ext. 4 or write to noc@as21990.net. Both are registered with ARIN, so you can take them from the registry rather than from this page.
Our letters carry an expiry date no more than twelve months out, and do not auto-renew. An expired or revoked letter is not authority to keep announcing the prefix.
The LOA we require from you
If you hold address space and want AS21990 to originate or carry it, complete this and return it to peering@as21990.net:
How we validate it
In this order. A request stops at the first step that does not clear, and we will tell you which one.
| Step | What we check |
|---|---|
| 1. Registry match | The organisation named on the letter must match the holder recorded at the RIR for that prefix. A mismatch stops the request until it is explained. |
| 2. Signatory authority | The signatory must be a point of contact registered against the resource at the RIR, an officer of the holder, or able to evidence authority some other way. |
| 3. Out-of-band confirmation | We contact a point of contact taken from the RIR record, not an address supplied on the letter, and confirm the request independently. A genuine letter survives this trivially. That is the point of it. |
| 4. RPKI | We require a valid ROA authorising the originating ASN, published by you under your RIR. We will not announce space that RPKI marks invalid, and where no ROA exists we ask you to publish one before turn-up. |
| 5. IRR | A route object matching the prefix and origin ASN, in a registry our upstreams accept. |
| 6. Expiry | We diary the expiry date and re-validate before it passes. If it lapses, we withdraw the announcement. |
Twelve months is the maximum term, in both directions. We neither issue nor accept open-ended letters, and we do not accept multi-year ones: an authorisation that outlives the business relationship justifying it is one nobody can later tell is still good. A year means somebody looks at it once a year. Renewal is a fresh letter rather than an extension.
If step 4 is a problem, say so before you send paperwork rather than after. There are real situations where a ROA cannot be published yet, and they are worth a conversation.
Withdrawal
You may revoke your authorisation at any time by written notice to noc@as21990.net. We withdraw the announcement on receipt and confirm to you when it is withdrawn.
We may withdraw an announcement without notice where the law, an upstream provider, or a live abuse or routing-security incident requires it.