[arin-ppml] ARIN-prop-171 Section 8.4 Modifications: ASN and legacy resources

[Owen DeLong]

On Jun 7, 2012, at 11:49 AM, Lindsey, Marc wrote:

> The policy proposal addresses many of the current “tensions” arising out of the legacy resource trading market.  It recognizes, in policy, the practical reality that attempting to extend ARIN’s existing policies designed for numbers under contract with ARIN (where ARIN has direct control) to legacy numbers that are not under contract with ARIN (where ARIN has no direct control) has its limits and is currently producing (possibly) unintended consequences that I believe are undesirable for the community. 
>  
> E.g., Increasing inaccuracies in the WHOIS databases; and limiting ARIN members’ access to “off-contract” legacy numbers (while still remaining compliant with policy) due to burdens imposed on both the source and the recipient under the current 8.3 transfer policy (where the needs justification requirements impose a cap of 24 months’ supply that supplants the recipient’s own business judgment on how best to use its capital to manage  the risks to its business presented by the depletion of the RIR free pool of unallocated IPv4 numbers).
>  
> I like many aspects of the proposal, but I do have some questions for Martin and others about it.    
>  
> 8.4.3 Needs Assessments and Utilization Requirements
>  
>     Needs assessments and utilization requirements for legacy number resources and ASN's are waived.
>  
> [[What’s your view on whether the recipient should be required to execute an RSA or LRSA as a condition for ARIN to update the database where the requirements of 8.4.4-8.4.5 are otherwise met?]] 

Recipient must sign an RSA as far as I am concerned.

However, I oppose this policy as written precisely because of the elimination of needs basis.

>  
> 8.4.4 Registry Services
>  
> ARIN will insure that all parties to a legacy number resource or ASN transfer agree to provide and maintain accurate WHOIS contact data in compliance with WHOIS policy. Transfers shall not be completed until all submitted WHOIS update data has been verified as accurate.
>  
> 8.4.5. Chain of Custody Validation
>  
> No resources may be transferred without a verifiable chain of custody demonstrating that a party desiring to transfer a resource is the legitimate holder of such a resource and is eligible to transfer the resource. Upon confirmation of a valid chain of custody of a resource, ARIN will certify that resource as transferable. ARIN will maintain this certification on file for future reference.
>  
> [[Very good addition to the process.   Who do you think should perform the chain of custody validation to satisfy this requirement?  Is this an ARIN direct responsibility, something that would be performed by a qualified third-party under certain standards, or both?]]

ARIN staff would have to perform the validation.

>  
> 8.4.6 Flawed Custody and Fraudulent Applications
>  
> ARIN will reclaim resources that fail chain of custody certifications or are deemed to have been fraudulently obtained and presented for transfer.
> Such reclaimed resources will be immediately placed on an Abandoned Resources List and in escrow. The list shall be made available to the public.
>  
> [[This one concerns me.   Specifically, the part about reclaiming resources that fail the chain of custody search.  It may be that the requestor isn’t the rightful holder, but some other entity may still have a strong claim to the numbers.  In addition, many who make claims to legacy numbers are acting in good faith, but may just not be able to sufficiently demonstrate via supporting documentation an unbroken chain of custody. 
>  
> This could chill the willingness of some legacy holders (those with less than perfect, but still reasonable, claims to the legacy numbers) to use the ARIN process for fear that they will lose their numbers in the event that the chain of custody validation fails. Numbers in this category may either be traded outside the ARIN process or simply remain dormant and unused. 
>  
> Like a typical critic, I see the flaws in 8.4.6 but I don’t yet have a better alternative to propose that balances the need to re-purpose abandoned numbers without extinguishing the rights entities have in their legacy numbers.   A fair, independent, and transparent processes to appeal reclamation decisions and resolve competing claims to contested legacy numbers prior to declaring them abandoned might help.  I’m interested in other’s thoughts on this point.]]

The risk to the organization of supporting such questionable claims is very high.

Especially if the transfer is completed and a more legitimate claim comes along later.

Owen

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.arin.net/pipermail/arin-ppml/attachments/20120607/73790e1e/attachment.htm>