[ppml] Policy Proposal 2007-15 - Staff Assessment

Policy Proposal 2007-15
Authentication of Legacy Resources

ARIN Staff Assessment

The assessment of this proposal includes comments from ARIN staff and
the ARIN General Counsel. It contains analysis of procedural, legal, and
resource concerns regarding the implementation of this policy proposal
as it is currently stated. Any changes to the language of the proposal
may necessitate further analysis by staff and Counsel.

I. Proposal

Policy Proposal is available as Annex A below and at:
http://www.arin.net/policy/proposals/2007_15.html

II. Understanding of the proposal

ARIN staff understands that the proposal would add new sections to the
NRPM, 4.9 regarding legacy resources. The purpose is to encourage
"legacy resource holders" to sign the RSA.

III. Comments

   A. ARIN Staff

   ARIN interprets "evaluate and verify chain of custody of any resource
records" as the standard ARIN vetting and verification procedures
currently in use.

   B. ARIN General Counsel

"This policy may have legal implications. The ARIN board has authorized
the creation of legacy RSA 1.0 which contains very favorable terms for
legacy address holders designed to entice, or provide incentives to both
sign the specifically designed rsa to obtain continued future services,
and to return under utilized resources to ARIN.
Policy 2007-15 takes this one step further and adds the incentive of the
future fixed date reduction of in-addr services, or stick, not carrot,
to the policy alternatives.

If the policy is adopted, there is modest risk legacy holders who have
received free services in the past, without any agreement with ARIN,
could attempt to litigate about such policy. Currently I am unaware of
any contractually binding or implied duty of ARIN to maintain such
service in the absence of policy to this effect.
Therefore I have no current legal objection to the proposed policy."

Resource Impact – Significant

The resource impact of implementing this policy is viewed as
significant. Barring any unforeseen resource requirements, this policy
could be implemented from 6 months to 1 year from the date of the
ratification of the policy by the ARIN Board of Trustees.  It will
require the following:

-  Updates to Registration Services Guidelines will be required
-  Staff training will be required
-  Additional staff may be required
-  Database changes
-  New tracking tools

Respectfully submitted,

Member Services
American Registry for Internet Numbers (ARIN)


##*##


Annex A

Policy Proposal 2007-15
Authentication of Legacy Resources

Author: Andrew Dul

Proposal type: New

Policy term: Permanent

Policy statement:

Add new NRPM section 4.9 - Legacy Records

4.9 - Legacy Records

Legacy resource record holders shall be permitted to sign a registration
services agreement which permits the legacy organization which is
currently using the resources as of January 1, 2007 to continue to use
those resources as long as a valid registration services agreement is in
effect for the organization. ARIN will evaluate and verify the chain of
custody of any resource records prior to executing a registration
services agreement with an organization.

ARIN shall use all reasonable methods to attempt to contact legacy
record holders starting on January 1, 2008 to notify them of this change
in policy. ARIN shall also post information on the public website
regarding this outreach to legacy resource holders.

No changes shall be made to legacy resource records which are not
covered by a registration services agreement after December 31, 2007.
If a legacy resource holder requests additional IPv4 resources all IPv4
resources (legacy and non-legacy) shall be evaluated to determine
utilization for additional allocations or assignments under NRPM
sections 4.2 or 4.3.

Rationale:

An ARIN Legacy resource holder is an organization which was issued
number resources prior to the formation of ARIN and whose registration
information was not transferred to another RIR through the Early
Registration Transfer Project (http://www.arin.net/registration/erx).
Legacy resource holders were issued number resources through an informal
process. This policy proposal attempts to bring these legacy resource
holders into a formal agreement with ARIN, the manager of the IP
numbering resources for many of the legacy record holders.

This policy is similar to a policy which has been adopted in the APNIC
region. (http://www.apnic.net/docs/policy/proposals/prop-018-v001.html)
Some legacy resource holders have expressed concerns about committing to
a registration service agreement (RSA) when the legacy resource holder
cannot be assured that they will be permitted to retain their resources
for the long-term. This policy proposal requests ARIN to develop a RSA
which will allow legacy resource holders to continue to use IPv4
resources which were assigned or allocated prior to ARIN's formation. It
is also suggested that the Board of Trustees formalize the annual
maintenance fees for legacy resource holders at a level similar to the
$100 USD per year for end-sites or provide fee-waivers as an incentive
for legacy holders to sign a registration services agreement.

The dates in this policy proposal were arbitrarily chosen based upon an
expected ratification by the ARIN Board of Trustees by December 31,
2007. If this policy is implemented after December 31, 2007, the trigger
dates in the policy should be adjusted appropriately.

Given the informal relationship under which the resources were granted,
ARIN currently maintains the records including WHOIS and in-addr.arpa
delegations in a best-effort fashion. Some believe that ARIN may not be
obligated to maintain these records. ARIN has also experienced some
difficulty maintaining these records. Legacy records have been a popular
target for hijackers, in part due to the out of date information
contained in these records. Having up to date contact information and a
formal relationship with legacy record holders would assist ARIN and
ISP's in insuring these records are maintained accurately.

Legacy resource holders who sign a RSA would continue to receive all the
services that are currently provided by ARIN plus they would be eligible
for any future services that ARIN may offer, such as cryptographic
signing of resource records.

Timetable for implementation: As stated in policy