LETTER OF AUTHORISATION Authority for AS21990 to announce address space held by another party -------------------------------------------------------------------- TEMPLATE - to be completed by the registered holder of the address space, not by Liberty Security Services. Complete this if you hold Internet number resources and want AS21990 to originate or carry them. Return it to peering@as21990.net . Read section 7 before you start. A completed letter is not by itself enough for us to announce your space, and section 7 says what else we need and why. Fields in [BRACKETS] are yours to fill in. -------------------------------------------------------------------- Date: [DATE, YYYY-MM-DD] To: Liberty Security Services, LLC 877 Grant Ave, Lake Katrine, NY 12449, United States ARIN Organisation ID: LSSL-7 Autonomous System 21990 From: [YOUR ORGANISATION, FULL LEGAL NAME] [YOUR ADDRESS] [YOUR RIR ORGANISATION ID / HANDLE] 1. AUTHORISATION [YOUR ORGANISATION] is the registered holder of, or otherwise holds the right to route, the Internet number resources listed in section 2. [YOUR ORGANISATION] hereby authorises Liberty Security Services, LLC to accept, announce and propagate those resources, originated from the Autonomous System stated in section 2, for the period in section 4. 2. RESOURCES COVERED Prefix or prefixes: [PREFIX, IN CIDR NOTATION - one per line] Originating ASN: [THE ASN THESE WILL BE ORIGINATED FROM - either AS21990, or your own ASN if you are originating and we are carrying] RIR: [ARIN / RIPE NCC / APNIC / LACNIC / AFRINIC] Registered to: [THE ORGANISATION NAME EXACTLY AS IT APPEARS IN THE RIR RECORD - see section 7, first check] 3. AUTHORITY OF THE SIGNATORY The person signing in section 6 confirms that they are authorised to bind [YOUR ORGANISATION] in respect of these resources, and is one of the following. Tick one: [ ] A point of contact registered against these resources at the RIR named in section 2. [ ] An officer or director of the registered holder. [ ] Otherwise authorised. Attach evidence of that authority. RIR point of contact handle, if applicable: [HANDLE] 4. PERIOD Effective from: [DATE, YYYY-MM-DD] Expires: [DATE, YYYY-MM-DD - required; see below] An expiry date is required, and it may be no more than twelve months after the effective date. We do not accept open-ended letters, and we do not accept multi-year ones: an authorisation that outlives the business relationship justifying it is one nobody can later tell is still good. Twelve months means somebody looks at it once a year. Renewal is a fresh letter, not an extension of this one. You may revoke this authorisation at any time by written notice to noc@as21990.net . We will withdraw the announcement on receipt and confirm to you when it is withdrawn. 5. UNDERTAKINGS [YOUR ORGANISATION] confirms that: - It has the right to route the resources in section 2, and no other party holds a conflicting authorisation for them. - It will tell Liberty promptly if that ceases to be true, including on transfer or sale of the resources. - It accepts that Liberty may withdraw the announcement without notice where required by law, by an upstream provider, or to respond to abuse or a routing security incident. 6. SIGNATURE Name: [NAME] Title: [TITLE] Email: [EMAIL - must be reachable independently; see section 7] Telephone: [TELEPHONE] Signature: ______________________________ Date: [DATE, YYYY-MM-DD] 7. WHAT WE DO WITH THIS, AND WHAT ELSE WE NEED This section is Liberty's process rather than part of your declaration. It is here so there are no surprises about why a letter alone does not get a prefix announced. An LOA is a piece of paper. It carries no cryptographic weight and cannot be verified by a machine, and a convincing forgery is inexpensive. It records intent; it does not prove authority. So we check it against sources you do not control: 1. Registry match. The organisation in section 2 must match the holder in the RIR record for that prefix. A mismatch stops the request until it is explained. 2. Signatory authority. We confirm the signatory against the RIR's registered points of contact, or against the evidence attached under section 3. 3. Out-of-band confirmation. We contact a point of contact taken from the RIR record - not an address supplied in this letter - and confirm the request independently. A letter that is genuine survives this trivially; this step exists because a forged one does not. 4. RPKI. We require a Route Origin Authorisation authorising the originating ASN in section 2, published by you under your RIR. This is the control that actually works: RPKI is checkable by every operator on the path, and this letter is not. We will not announce space that RPKI marks invalid, and where no ROA exists we will ask you to publish one before turn-up. 5. IRR. A route object matching the prefix and origin ASN, in a registry our upstreams accept. 6. Expiry. We diary the expiry date in section 4 and re-validate before it passes. We withdraw the announcement if it lapses. If you cannot complete step 4, tell us early. There are situations where a ROA genuinely cannot be published yet, and they are worth discussing before you send paperwork rather than after. Send the completed letter to peering@as21990.net . Questions about the process go to noc@as21990.net .