Summary

  • At ARIN 57 in April 2026, John Curran said ARIN staff had no basis to require customers to deploy RPKI on the organization’s own initiative. An external requirement or a rule made through the community policy process would have a different source of authority.
  • The previous day, he had framed RPKI, ROAs and ASPA as operator decisions with deployment costs, offering to adapt ARIN’s training to the direction users gave it.

The question from the floor was tempting: if uptake lags, why not make everyone use RPKI? At ARIN 57, Altie Jackson asked about enforcement, particularly for customers in the Caribbean. Brad Gorman said signup was optional and described it in sweeping, permanent terms. John Curran rose to sharpen the answer. ARIN could run the registry and its RPKI service; its staff could not, on their own authority, order every holder to deploy it. An outside party could impose its own requirement. The community could also make policy through the policy process. Curran’s point was about who gets to make the call.

That distinction sounds dry until a registry starts speaking in the imperative. ARIN can offer a certificate service, publish ROAs, improve interfaces, explain route validation and teach operators how to avoid painful mistakes. Turning that menu into an obligation changes the relationship between the service operator and the people it serves. Curran’s memorable shorthand was that the registry belonged to its users and ARIN was running it. The person with the keys was declining to treat the keys as a vote.

The previous day’s transcript supplies the practical half of the story. Kevin Blumberg asked whether ARIN’s RPKI training should mention ASPA as the next step rather than leave customers to discover another task later. Curran acknowledged that RPKI, ROA creation and route validation involved choices for operators; ASPA carried a deployment cost too. He did not want ARIN to present a new practice as a compulsory default without clear direction. He agreed that training could mention ASPA and its place in the sequence. An explanation is a service; a command needs a mandate.

No RPKI mandate emerged from those exchanges. The interesting act was Curran’s refusal to let enthusiasm for a useful security tool silently expand the power of the organization operating it. Better tools and better teaching were available immediately. A binding rule belonged to a different process, with different people carrying responsibility for its consequences.