But it doesn't answer the basic questions. How do you tell the difference between a legitimate change and an illegitmate change? If ARIN makes it extremely difficult to update registry records, the records will get even more out of date. On the other hand if ARIN makes it too easy to update registry records, the wrong people can make unauthorized changes.

That's a good question, Sean. However there is another way. ARIN and the other RIRs need to stop publishing the whois directories as they stand today. There is no good reason for publishing most of the information that they do publish. All of this garbage information clogs up the system and makes it easier for spammers and outlaws to hide. The Internet is no longer a collegial project where we can request that all people with a directory on an ARPANET host who is capable of passing traffic across the ARPANET should be registered in the whois directory. (Ref RFC 812) In fact, we haven't done this for at least 10 years. We already have a two-tiered system in place where the bulk of users with directories on an Internet-connected system capable of initiating Internet traffic are only registered with their service provider. Only network operators are expected to register in the whois directory. I think that it is time to tighten up on these requirements even further. The published whois directory should only contain the up-to-date contact information of people responsible for enforcing network AUPs and rooting out network abuse. If an organization is allocated or assigned IP space from their upstream then their info should not be published in the whois directory unless they agree to be directly responsible for AUPs and abuse mitigation. This contact information should be checked more than once per year (twice yearly or quarterly) and if it becomes stale, then it should be immediately updated to indicate that it is stale. The incorrect phone numbers and email domains should be removed from the published directory. If there is an upstream then the address contact info should revert to the upstream since it is not possible for a non-contactible entity to be responsible for AUP enforcement and abuse mitigation. In the case of address blocks allocated directly by a registry, this means they must virtually disappear from the whois. The only information left will be "Previously allocated, no current contact info". In one fell swoop, this will enable people to block just about every possible source of spam. If anyone is actually still using their addresses, this will also bring them out of the woodwork to update their contact info and get with the program. There will be zero impact on anyone who gets their addresses from an upstream since the contact info will revert to the upstream until such time as the upstream fomrally delegates the abuse handling responsibility to the customer by submitting correct contact info. Of course, none of this will happen unless network operators stop chasing symptoms and start thinking more deeply about the roots of the problem. One of these roots is the lack of a web of accountability for IP address space. --Michael Dillon