[arin-ppml] Draft Policy 2011-2: Protecting Number Resources

[ARIN]

Draft Policy ARIN-2011-2
Protecting Number Resources

On 28 January 2011 the ARIN Advisory Council (AC) selected "Protecting
Number Resources" as a  draft policy for adoption discussion on the PPML
and at the Public Policy Meeting in San Juan, Puerto Rico in April.

The draft was developed by the AC from policy proposal "ARIN-prop-120.
Protecting Number Resources". Per the Policy Development Process the AC
submitted text to ARIN for a staff and legal assessment prior to its
selection as a draft policy. Below the draft policy is the ARIN staff
and legal assessment, followed by the text that was submitted by the AC.

Draft Policy ARIN-2011-2 is below and can be found at:
https://www.arin.net/policy/proposals/2011_2.html

You are encouraged to discuss Draft Policy 2011-2 on the PPML prior to
the April Public Policy Meeting. Both the discussion on the list and
at the meeting will be used by the ARIN Advisory Council to determine
the community consensus for adopting this as policy.

The ARIN Policy Development Process can be found at:
https://www.arin.net/policy/pdp.html

Draft Policies and Proposals under discussion can be found at:
https://www.arin.net/policy/proposals/index.html

Regards,

Member Services
American Registry for Internet Numbers (ARIN)


## * ##


Draft Policy ARIN-2011-2
Protecting Number Resources

Version/Date: 28 January 2011

Policy statement:

ARIN shall use any reasonable and practical methods to proactively look
for fraudulently obtained or abandoned number resources and seek the
return of those resources to ARIN.

Abandoned resources include, but are not limited to:

   * resources with no valid POC (per section 3.6),

   * resources assigned or allocated to a deceased individual,

   * resources assigned or allocated to a defunct or otherwise no longer
viable entity, and

   * resources declared unused or abandoned by the organization to which
they are allocated.

A report of activities under this policy shall be delivered at each ARIN
meeting.

Rationale:

ARIN has generally only reactively looked for fraudulently obtained or
abandoned number resources, generally via reports to
https://www.arin.net/resources/fraud/.

Taking these community reports is a good first step, but ARIN can be in
a far better position to know which resources were fraudulently obtained
or abandoned due to the additional paperwork that ARIN holds which is
not available to the public, and the record of interactions (or lack
thereof) with the resource holder.

Implementation suggestions:

It is expected that the board/executive management will interpret
"reasonable and practical" to mean "some amount of staff time that is
not zero", but will also be fiscally viable, and to direct reviews in
such a way as to provide the community a good return on invested
resources. For example, ARIN could check resources without a valid POC,
reclaim resources that aren't being routed, and contact the
announcing/upstream ASNs of any resources that are being routed to
implement record updates or to implement section 8 transfers as
appropriate. The next lowest hanging fruit might be prefixes that were
originally visible in the routing table, but have not been present for a
long time.

ARIN should also 1) report on the aggregate quantity of number resources
that were returned due to this proactive activity, 2) report on the
aggregate cost to the members of this activity, and 3) obtain feedback
from the membership as to whether more or less resources should be
devoted to this endeavor.

Resources in use by a successor organization should not be considered
abandoned, but may be reviewed as appropriate via the processes outlined
in current ARIN policy (for example, sections 8.2 or 12 of the NRPM).

ARIN should attempt to contact all known POCs for a block, and only
determine that it is abandoned if no POC indicates it is still in use.
If a BGP advertisement for the resource in question is visible in the
Internet routing table, ARIN should attempt to contact the organization
responsible for the advertising ASN, as well as any organizations seen
to be providing transit services for the resource, to inform them that
the resource is being considered for abandoned status.

At least 30 days before reclaiming any number resource, ARIN should
publicly announce their declaration that the resource is considered
abandoned, and shall reconsider such declaration if additional
information is provided to ARIN about the use of the resource in question.

Timetable for implementation: immediate


#####


STAFF ASSESSMENT

Proposal: “Protecting Number Resources” (pp 120)
Policy Version (Date):  9 January 2011
Date of Assessment:  27 January 2011

1. Proposal Summary (Staff Understanding)

This policy directs ARIN to pro-actively identify and research
abandoned, unused, or fraudulently obtained number resources for the
purposes of trying to reclaim them when appropriate.  It would require
staff to report on the activities associated with this policy (without
improperly disclosing details of individual matters) during ARIN’s
Public Policy meetings.

2. Comments

A.   ARIN Staff Comments

• Based on staff’s experience with resource reclamations and
revocations, the process of identifying and reclaiming resources
(especially due to fraud or misuse) can take anywhere from a few days to
several weeks from start to finish, so there will be a significant time
factor involved.

• Given the current workload at ARIN and the limited number of staff
available to do this type of work, additional experienced staff would be
needed before this policy could be fully implemented.

• This policy could have very significant financial implications due to
the need for additional staff, the time involved in identifying,
researching, and reclaiming these resources, and the potential
additional legal fees involved for review.

• Reclaiming legacy resources is more complex than reclaiming ARIN
issued resources. Therefore, ARIN staff would need to carefully consider
this complexity when determining which number resources to seek out first.

• Staff will need to develop detailed, well thought out, and
well-documented procedures due to the potential legal issues involved in
reclaiming resources.

B. ARIN General Counsel

No legal comments

3. Resource Impact

This policy would have a moderate resource impact from an initial
implementation aspect.  It is estimated that implementation would occur
within 6 – 9 months after ratification by the ARIN Board of Trustees.

However, this policy will have a significant resource impact from an
execution aspect.  Based on our experience with resource reclamations
and revocations, the process of identifying and reclaiming resources
(especially due to fraud or misuse) takes a great deal of time from
start to finish.  It requires significant research, documentation, and
fact checking. A single fraudulent event can take a number of days or
weeks, to properly fact-find and document.

The following would be needed in order to implement and fulfill:
• Updated documentation on the ARIN website

• Significant staff training

• Additional staff to proactively seek, research and reclaim unused IP
number resources

•Software development to create new tools to assist in identifying
unused resources

4. Proposal Text

Policy statement: ARIN shall use any reasonable and practical methods to
proactively look for fraudulently obtained or abandoned number resources
and seek the return of those resources to ARIN.

Abandoned resources include, but are not limited to, resources with no
valid POC (per section 3.6), resources assigned or allocated to a
deceased, defunct, or otherwise no longer viable entity, and resources
declared unused or abandoned by the organization to which they are
allocated.
A report of activities under this policy shall be delivered at each ARIN
meeting.

Rationale:

ARIN has generally only reactively looked for fraudulently obtained
or abandoned number resources, generally via reports to
https://www.arin.net/resources/fraud/ <https:// <https:/>
www.arin.net/resources/fraud/ <http://www.arin.net/resources/fraud/> > .
Taking these community reports is a good first step, but ARIN can be in
a far better position to know which resources were fraudulently obtained
or abandoned due to the additional paperwork that ARIN holds which is
not available to the public, and the record of interactions (or lack
thereof) with the resource holder.

Implementation suggestions:

It is expected that the board/executive management will interpret
reasonable and practical to be some amount of staff time that is not
zero, but will also not "break the bank". For example, ARIN could first
check resources with no valid POCs, reclaim the ones that aren't being
routed, and contact the announcing/upstream ASNs of any that are being
routed to get records updated or section 8 transfers completed. The next
lowest hanging fruit might be prefixes that were originally visible in
the routing table, but have not been present for a long time.
ARIN should also report on the aggregate quantity of number resources
that were returned due to this proactive activity, as well as the
aggregate cost to the members of this activity, and obtain feedback from
the membership as to whether more or less resources should be used in
this area.

Resources in use by a successor organization should not be considered
abandoned, but may be reviewed as appropriate via the processes outlined
in current ARIN policy (for example, sections 8.2 or 12 of the NRPM).
ARIN should attempt to contact all known POCs for a block, and only
declare that it is abandoned if no POC contradicts the claim. If a BGP
advertisement for the resource in question is visible in the Internet
routing table, ARIN should attempt to contact the organization
responsible for the advertising ASN, as well as any ASNs seen to be
providing transit services for the resource, to inform them that the
resource is being considered for abandoned status.
At least 30 days before reclaiming any number resource, ARIN should
publicly announce their declaration that the resource is considered
abandoned, and shall reconsider such declaration if additional
information is provided about the use of the resource.