From info at arin.net Wed Oct 1 17:11:34 2008 From: info at arin.net (Member Services) Date: Wed, 01 Oct 2008 17:11:34 -0400 Subject: New Remote Participation Features at ARIN XXII Message-ID: <48E3E786.90707@arin.net> Even if you can?t be with us in LA, you don?t have to miss out on all the fun! Join us online by registering as a remote participant to take advantage of our improved options to participate in policy discussions and other meeting sessions included in the ARIN XXII webcast. Go to ?Meeting Registration? at http://www.arin.net/ARIN-XXII/ and choose "ARIN XXII Remote Participant" from the drop-down. Before you register as a remote meeting participant, make sure you have a Jabber Identfier (JID). You will need to provide your JID on the remote participation registration form in order to log in to the restricted meeting chats. To learn more about the ARIN meeting chats and available free Jabber services please go to: www.arin.net/ARIN_XXII/remote.html All remote participants are subject to the Remote Participation Acceptable Use Policy (AUP). Additional information about remote participation, including the Remote Participation AUP, is available at: http://www.arin.net/ARIN-XXII/remote_aup.html Be sure to download your participant?s packet to help you follow along with the meeting program, discussion guide, and other meeting support documents. Registration is not required to view the webcast or live transcript, but as a registered remote chat participant, you will be able to submit comments for moderated presentation during normal question and answer periods, and ?raise your hand? to be counted during polling. You will also have full access to the popular Cyber Caf?, where you can connect with colleagues, access educational materials, and participate in daily meeting raffles to win fabulous prizes. We will also have a live transcript to accompany the webcast to further enhance your remote meeting experience. We look forward to your participation in ARIN XXII. Meeting details are available at http://www.arin.net/ARIN-XXII/. We hope that the new features we are piloting at ARIN XXII will give you the full public policy meeting experience. Your post-meeting feedback will be critical as we evaluate the success of these enhancements. Please contact Member Services at info at arin.net if you have any questions. Regards, Member Services Department American Registry for Internet Numbers (ARIN) From info at arin.net Wed Oct 1 17:25:34 2008 From: info at arin.net (Member Services) Date: Wed, 01 Oct 2008 17:25:34 -0400 Subject: New Remote Participation Features at ARIN XXII (correction) Message-ID: <48E3EACE.2090509@arin.net> In our enthusiasm to share the news about our remote participation enhancements, a rather critical typographical error snuck through. To learn more about the meeting chats and free Jabber services, you will need to go to: http://www.arin.net/ARIN-XXII/remote.html We apologize for any inconvenience. Regards, Member Services The American Registry for Internet Numbers (ARIN) From info at arin.net Thu Oct 2 13:58:45 2008 From: info at arin.net (Member Services) Date: Thu, 02 Oct 2008 13:58:45 -0400 Subject: Reminder: Sign up for ARIN XXII Open Policy Hour Message-ID: <48E50BD5.2090503@arin.net> Sign up today to present your ideas at the ARIN XXII Open Policy Hour, Tuesday, 14 October, from 6:00-7:00 PM (PDT). The Open Policy Hour is the showroom for your policy ideas. Sign up by 10 October to get your turn at the microphone. Send an e-mail to policy at arin.net with your name, organization, and a general description of the policy subject you wish to present. Everyone is invited to attend the session and raise ideas and suggestions. You do not need to have a formal presentation in order to participate. Information on this and other sessions is available at: http://www.arin.net/ARIN-XXII/agenda.html Can?t join us in LA? No worries! Join us online via the webcast, live transcript, and moderated chat available at: http://www.arin.net/ARIN-XXII/remote.html Regards, Member Services American Registry for Internet Numbers (ARIN) From info at arin.net Fri Oct 3 14:16:47 2008 From: info at arin.net (Member Services) Date: Fri, 03 Oct 2008 14:16:47 -0400 Subject: Policy Proposal: Annual WHOIS POC Validation - Revised Message-ID: <48E6618F.50103@arin.net> The author submitted a revised version of the proposal. The ARIN Advisory Council (AC) will review this proposal at their next regularly scheduled meeting. The AC may decide to: 1. Accept the proposal as written. If the AC accepts the proposal, it will be posted as a formal policy proposal to PPML and it will be presented at a Public Policy Meeting. 2. Postpone their decision regarding the proposal until the next regularly scheduled AC meeting in order to work with the author. The AC will work with the author to clarify, combine or divide the proposal. At their following meeting the AC will accept or not accept the proposal. 3. Not accept the proposal. If the AC does not accept the proposal, the AC will explain their decision via the PPML. If a proposal is not accepted, then the author may elect to use the petition process to advance their proposal. If the author elects not to petition or the petition fails, then the proposal will be closed. In the meantime, the AC invites everyone to comment on this proposal on the PPML, particularly their support or non-support and the reasoning behind their opinion. Such participation contributes to a thorough vetting and provides important guidance to the AC in their deliberations. The ARIN Internet Resource Policy Evaluation Process can be found at: http://www.arin.net/policy/irpep.html Mailing list subscription information can be found at: http://www.arin.net/mailing_lists/ Regards, Member Services American Registry for Internet Numbers (ARIN) ## * ## Policy Proposal Name: Annual WHOIS POC Validation Author: Chris Grundemann Proposal Version: 2 Submission Date: 2 October 2008 Proposal type: new Policy term: permanent Policy statement: ARIN will conduct POC validation annually. This validation will employ an automated system which will send a message to every separate email address in the whois directory. The message sent will request that the receiver verify that they are in fact the POC in question by replying to the email in a manner which will satisfy the automated systems requirements. The email message will also include information and instructions for reporting suspected fraud. If a valid response is not received within the response period, every instance of the unresponsive email address will be marked with "NO RESPONSE" in the whois directory. Expected transmission dates and sender email addresses will be published as widely and be as readily available as is reasonable and practical. The list of POCs with this marking will be reviewed by ARIN staff and manual contact attempts (telephone, postal mail) can be made at their discretion. After a minimum of three manual contact attempts have been made, with at least one to each physical address and telephone number provided and a minimum of three calendar months have passed from the third qualifying attempt; the POC record should be locked or deleted. The decision of whether to lock or delete the account should be made on a case by case basis. Following this validation each year, a list of address blocks with zero valid POCs should be made easily available to the community. Accurate annual records should be kept with regard to the total number of POCs, the number of POCs marked with "REFUSED RESPONSE," the number of locked POCs and the number of deleted POCs in addition to any other data that ARIN staff believes is appropriate to record with regard to this validation process. These records should be available to the public on request. Rationale: The intention of this proposal is to ensure valid whois POC information with an annual validation process. It further aims to mitigate any risk that it creates in so doing. One of the most important resources when dealing with abuse (including hijacking, spam, ddos, etc) is whois. ARIN's whois data is only useful if it is known to be valid. The current NRPM does not address this in a manner which ensures up to date POC contact information in all cases. The focus is on valid email addresses because this is the contact method of choice for most in the Internet community when dealing with abuse or hijacking issues. POC information that can not be confirmed can be judged as not valid. A netblock with no valid POC presents a target to hijackers. Once POC info is marked or tagged as invalid (like this policy proposes), it becomes possible for potential hijackers to locate such netblocks by searching the whois database. As a defense against such hijacking attempts, this policy proposes that the information be presented in full to the entire community. This should do at least one of two things; bring the netblock to the attention of whomever is responsible for it and/or allow other network operators to understand the potential risk and take appropriate action to mitigate. Timetable for implementation: The first validation should take place within one calendar year of the policy being accepted. From info at arin.net Mon Oct 6 09:43:08 2008 From: info at arin.net (Member Services) Date: Mon, 06 Oct 2008 09:43:08 -0400 Subject: Policy Proposal 2007-14 Discussed at ARIN Caribbean Sector Meeting Message-ID: <48EA15EC.1040301@arin.net> Policy Proposal 2007-14 Resource Review Process On 17 September 2008 ARIN held a Public Policy Meeting at its Caribbean Sector Meeting in Nassau, Bahamas, to discuss active policy proposals in the ARIN region and gain a Caribbean perspective on ARIN policies and procedures. Leo Bicknell, as a representative of the ARIN Advisory Council, presented the proposal and its rationale. Leo explained that this was a recently revised version, incorporating feedback from previous ARIN meetings. Leo explained that it clarified ARIN?s ability to do audits, and at the same time limited ARIN to how often an audit could be performed. A couple attendees expressed support for the proposal. The Advisory Council received a report summarizing the policy discussion for use in its deliberations. Complete notes from the discussion about "Policy Proposal 2007-14: Resource Review Process" are available at http://www.arin.net/meetings/minutes/carib_fall_08/csm1_notes.html#anchor_7 The full report of that meeting, which includes presentations and summary notes, is available on the ARIN website at http://www.arin.net/meetings/minutes/carib_fall_08/csm.html Regards, Member Services American Registry for Internet Numbers (ARIN) From info at arin.net Mon Oct 6 09:43:24 2008 From: info at arin.net (Member Services) Date: Mon, 06 Oct 2008 09:43:24 -0400 Subject: Policy Proposal 2008-2 Discussed at ARIN Caribbean Sector Meeting Message-ID: <48EA15FC.4060000@arin.net> Policy Proposal 2008-2 IPv4 Transfer Policy Proposal On 17 September 2008 ARIN held a Public Policy Meeting at its Caribbean Sector Meeting in Nassau, Bahamas, to discuss active policy proposals in the ARIN region and gain a Caribbean perspective on ARIN policies and procedures. Robert Seastrom, as a representative of the ARIN Advisory Council, presented the proposal and its rationale. Robert provided background for proposal. Meeting participants made comments about the pressure on the routing table that this may cause and spoke about transition to IPv6. Robert polled the attendees using the survey that was conducted on PPML. The Advisory Council received a report summarizing the policy discussion for use in its deliberations. Complete notes from the discussion about " Policy Proposal 2008-2: IPv4 Transfer Policy Proposal" are available at http://www.arin.net/meetings/minutes/carib_fall_08/csm1_notes.html#anchor_9 The full report of that meeting, which includes presentations and summary notes, is available on the ARIN website at http://www.arin.net/meetings/minutes/carib_fall_08/csm.html Regards, Member Services American Registry for Internet Numbers (ARIN) From info at arin.net Mon Oct 6 09:43:39 2008 From: info at arin.net (Member Services) Date: Mon, 06 Oct 2008 09:43:39 -0400 Subject: Policy Proposal 2008-3 Discussed at ARIN Caribbean Sector Meeting Message-ID: <48EA160B.2040601@arin.net> Policy Proposal 2008-3 Community Networks IPv6 Allocation On 17 September 2008 ARIN held a Public Policy Meeting at its Caribbean Sector Meeting in Nassau, Bahamas, to discuss active policy proposals in the ARIN region and gain a Caribbean perspective on ARIN policies and procedures. Lea Roberts, as a representative of the ARIN Advisory Council, presented the proposal and its rationale. Meeting participants pointed out that the proposal text contains the term ?non-profit? which can have legal consequences depending on the economy or country in question. After being asked if the proposal text served the community networks in the countries of the attendees, one attendee pointed out that ?200? can be a very large number in regards to some of the islands in the Caribbean. The Advisory Council received a report summarizing the policy discussion for use in its deliberations. Complete notes from the discussion about " Policy Proposal 2008-3: Community Networks IPv6 Allocation" are available at http://www.arin.net/meetings/minutes/carib_fall_08/csm1_notes.html#anchor_15 The full report of that meeting, which includes presentations and summary notes, is available on the ARIN website at http://www.arin.net/meetings/minutes/carib_fall_08/csm.html Regards, Member Services American Registry for Internet Numbers (ARIN) From info at arin.net Mon Oct 6 09:44:03 2008 From: info at arin.net (Member Services) Date: Mon, 06 Oct 2008 09:44:03 -0400 Subject: Policy Proposal 2008-4 Discussed at ARIN Caribbean Sector Meeting Message-ID: <48EA1623.9030504@arin.net> Policy Proposal 2008-4 Minimum Allocation in the Caribbean Region On 17 September 2008 ARIN held a Public Policy Meeting at its Caribbean Sector Meeting in Nassau, Bahamas, to discuss active policy proposals in the ARIN region and gain a Caribbean perspective on ARIN policies and procedures. Leo Bicknell, as a representative of the ARIN Advisory Council, presented the proposal and its rationale. Meeting participants made statements of support for the proposal. There was discussion about allocations and assignments; most attendees were in favor of extending the policy to include assignments. The Advisory Council received a report summarizing the policy discussion for use in its deliberations. Complete notes from the discussion about "Policy Proposal 2008-4: Minimum Allocation in the Caribbean Region" are available at http://www.arin.net/meetings/minutes/carib_fall_08/csm1_notes.html#anchor_16 The full report of that meeting, which includes presentations and summary notes, is available on the ARIN website at http://www.arin.net/meetings/minutes/carib_fall_08/csm.html Regards, Member Services American Registry for Internet Numbers (ARIN) From info at arin.net Mon Oct 6 09:44:15 2008 From: info at arin.net (Member Services) Date: Mon, 06 Oct 2008 09:44:15 -0400 Subject: Policy Proposal 2008-5 Discussed at ARIN Caribbean Sector Meeting Message-ID: <48EA162F.80105@arin.net> Policy Proposal 2008-5 Dedicated IPv4 block to facilitate IPv6 Deployment On 17 September 2008 ARIN held a Public Policy Meeting at its Caribbean Sector Meeting in Nassau, Bahamas, to discuss active policy proposals in the ARIN region and gain a Caribbean perspective on ARIN policies and procedures. Stacy Hughes, as a representative of the ARIN Advisory Council, presented the proposal and its rationale. Meeting participants suggested that the /12 could come from any of ARIN?s address space (as opposed to coming from the last /8). It was also suggested that the space for the /12 should be identified and reserved now, instead of waiting for the last /8. The Advisory Council received a report summarizing the policy discussion for use in its deliberations. Complete notes from the discussion about "Policy Proposal 2008-5: Dedicated IPv4 block to facilitate IPv6 Deployment" are available at http://www.arin.net/meetings/minutes/carib_fall_08/csm1_notes.html#anchor_6 The full report of that meeting, which includes presentations and summary notes, is available on the ARIN website at http://www.arin.net/meetings/minutes/carib_fall_08/csm.html Regards, Member Services American Registry for Internet Numbers (ARIN) From info at arin.net Mon Oct 6 09:44:31 2008 From: info at arin.net (Member Services) Date: Mon, 06 Oct 2008 09:44:31 -0400 Subject: Policy Proposal 2008-6 Discussed at ARIN Caribbean Sector Meeting Message-ID: <48EA163F.8090209@arin.net> Policy Proposal 2008-6 Emergency Transfer Policy for IPv4 Addresses On 17 September 2008 ARIN held a Public Policy Meeting at its Caribbean Sector Meeting in Nassau, Bahamas, to discuss active policy proposals in the ARIN region and gain a Caribbean perspective on ARIN policies and procedures. Robert Seastrom, as a representative of the ARIN Advisory Council, presented the proposal and its rationale. Robert explained how this proposal is different from 2008-2. Several meeting participants made statements of support for this more concise proposal over 2008-2. And there was some discussion of address reclamation. The Advisory Council received a report summarizing the policy discussion for use in its deliberations. Complete notes from the discussion about "Policy Proposal 2008-6: Emergency Transfer Policy for IPv4 Addresses" are available at http://www.arin.net/meetings/minutes/carib_fall_08/csm1_notes.html#anchor_10 The full report of that meeting, which includes presentations and summary notes, is available on the ARIN website at http://www.arin.net/meetings/minutes/carib_fall_08/csm.html Regards, Member Services American Registry for Internet Numbers (ARIN) From info at arin.net Mon Oct 6 09:44:49 2008 From: info at arin.net (Member Services) Date: Mon, 06 Oct 2008 09:44:49 -0400 Subject: Policy Proposal 2008-7 Discussed at ARIN Caribbean Sector Meeting Message-ID: <48EA1651.30904@arin.net> Policy Proposal 2008-7 Whois Integrity Policy Proposal On 17 September 2008 ARIN held a Public Policy Meeting at its Caribbean Sector Meeting in Nassau, Bahamas, to discuss active policy proposals in the ARIN region and gain a Caribbean perspective on ARIN policies and procedures. Leo Bicknell, as a representative of the ARIN Advisory Council, presented the proposal and its rationale. Some meeting participants expressed statements of support for the proposal, saying that ARIN should recoup costs for services, and in addition, ARIN should have contracts with those it provides services to. Some meeting participants stated their disfavor, saying that the intended outcome, better WHOIS data, would not result. One attendee noted that the proposal seemed more geared towards getting the RSA signed vs. WHOIS integrity. The Advisory Council received a report summarizing the policy discussion for use in its deliberations. Complete notes from the discussion about "Policy Proposal 2008-7: Whois Integrity Policy Proposal" are available at http://www.arin.net/meetings/minutes/carib_fall_08/csm1_notes.html#anchor_11 The full report of that meeting, which includes presentations and summary notes, is available on the ARIN website at http://www.arin.net/meetings/minutes/carib_fall_08/csm.html Regards, Member Services American Registry for Internet Numbers (ARIN) From info at arin.net Mon Oct 6 14:34:57 2008 From: info at arin.net (Member Services) Date: Mon, 06 Oct 2008 14:34:57 -0400 Subject: [arin-ppml] Revision to 2007-14 -- Minor edits requested by ARIN Counsel and staff In-Reply-To: References: Message-ID: <48EA5A51.3000004@arin.net> Policy Proposal 2007-14 Resource Review Process This proposal has been revised. It is open for discussion on this mailing list and will be on the agenda at the upcoming ARIN Public Policy Meeting. The current policy proposal text is provided below and is also available at: http://www.arin.net/policy/proposals/2007_14.html Regards, Member Services American Registry for Internet Numbers (ARIN) Owen DeLong wrote: > > Apologies for the late revision. Authors have been communicating with ARIN > > counsel in an effort to refine language and try to achieve agreement > on the content > > of the policy proposal. > > > Changes in this revision: > > > Minor edits to bring the language closer to compliance with requests > from staff > > and legal. Authors do not believe these edits constitute substantive > change > > to the intent of the policy. > > > Minor changes to language to improve clarity and sentence structure. > > Authors do not believe these edits constitute a substantive change to the > > intent of the policy. > > > In fairness, not all of the requests from legal were addressed the way > legal > > wanted. There are limitations on ARIN contained in this proposal which > > counsel opposed. I'll leave it to legal to present those in their analysis > > which should come out shortly because I do not want to mis-characterize > > them. > > > However, the authors have been in contact with legal and the places where > > we have agreed to disagree are not new to this version of the policy. > > > > ################################################################# > > Policy Proposal 2007-14 > Resource Review Process > > Author: Owen DeLong, Stephen Sprunk > > Proposal Version: 3.1 > > Date: 14 August 2008 > > Proposal type: modify > > Policy term: permanent > > Policy statement: > > Add the following to the NRPM: > > Resource Review > > 1. ARIN may review the current usage of any resources maintained in > the ARIN database. The organization shall cooperate with any request > from ARIN for reasonable related documentation. > > 2. ARIN may conduct such reviews: > > a. when any new resource is requested, > > b. whenever ARIN has reason to believe that the resources were > originally obtained fraudulently *or in contravention of existing > policy*, or > > c. at any other time without having to establish cause unless a prior > review has been completed in the preceding 24 months. > > 3. ARIN shall communicate the results of the review to the organization. > > 4. Organizations found by ARIN to be * materially* out of compliance > with current ARIN policy shall be requested or required to return > resources as needed to bring them into (or reasonably close to) > compliance. > > 4a. The degree to which an organization may remain out of compliance > shall be based on the reasonable judgment of the ARIN staff and shall > balance all facts known, including the organization?s utilization rate, > available address pool, and other factors as appropriate so as to > avoid forcing returns which will result in near-term additional > requests or unnecessary route de-aggregation. > > 4b. To the extent possible, entire blocks should be returned. Partial > address blocks shall be returned in such a way that the portion > retained will comprise a single aggregate block. > > 5. If the organization does not voluntarily return resources as > requested, ARIN may revoke any resources issued by ARIN as required to > bring the organization into overall compliance. ARIN shall follow the > same guidelines for revocation that are required for voluntary return > in the previous paragraph. > > 6. Except in cases of fraud, or violations of policy, an organization > shall be given a minimum of six months to effect a return. ARIN shall > negotiate a longer term with the organization if ARIN believes the > organization is working in good faith to substantially restore > compliance and has a valid need for additional time to renumber out of > the affected blocks. > > 7. ARIN shall continue to provide services for the resource(s) while > their return or revocation is pending,* however,* any maintenance fees > assessed during that period shall be calculated as if the return or > revocation was complete. > > 8. ARIN will not reclaim or revoke Legacy resources in active use, > regardless of utilization. However, the utilization of legacy > resources shall be considered during a review to assess overall > compliance. > > 9. In considering compliance with policies which allow a timeframe > (such as a requirement to assign some number of prefixes within 5 > years), failure to comply cannot be measured until after the timeframe > specified in the applicable policy has elapsed. Blocks subject to such > a policy shall be assumed in compliance with that policy until such > time as the specified time since issuance has elapsed. > > > Delete NRPM sections 4.1.2, 4.1.3, 4.1.4 > > > Remove the sentence "In extreme cases, existing allocations may be > affected." from NRPM section 4.2.3.1. > > > Rationale: > > Under current policy and existing RSAs, ARIN has an unlimited > authority to audit or review a resource holder's utilization for > compliance at any time and no requirement to communicate the results > of any such review to the resource holder. > > > This policy attempts to balance the needs of the community and the > potential for abuse of process by ARIN in a way that better clarifies > the purpose, scope, and capabilities of ARIN and codifies some > appropriate protections for resource holders while still preserving > the ability for ARIN to address cases of fraud and abuse on an > expedited basis. > > > The intended nature of the review is to be no more invasive than what > usually happens when an organization applies for additional resources. > Additionally, paragraph 2c prevents ARIN from doing excessive > without-cause reviews. > > > The authors believe that this update addresses the majority of the > feedback received from the community to date and addresses most of the > concerns expressed. > > ##### > > > > > > > > > > > > > ------------------------------------------------------------------------ > > _______________________________________________ > PPML > You are receiving this message because you are subscribed to > the ARIN Public Policy Mailing List (ARIN-PPML at arin.net). > Unsubscribe or manage your mailing list subscription at: > http://lists.arin.net/mailman/listinfo/arin-ppml > Please contact info at arin.net if you experience any issues. From info at arin.net Wed Oct 8 16:19:09 2008 From: info at arin.net (Member Services) Date: Wed, 08 Oct 2008 16:19:09 -0400 Subject: Policy Proposal 2008-4 - Staff Assessment Message-ID: <48ED15BD.9060904@arin.net> Policy Proposal: 2008-4 Title: Minimum Allocation in the Caribbean Region Revised: 18 August 2008 Assessment: 8 October 2008 ARIN Staff Assessment The assessment of this proposal includes comments from ARIN staff and the ARIN General Counsel. It contains analysis of procedural, legal, and resource concerns regarding the implementation of this policy proposal as it is currently stated. Any changes to the language of the proposal may necessitate further analysis by staff and Counsel. I. Proposal Policy Proposal is available below and at: http://www.arin.net/policy/proposals/2008_4.html II. Proposal Summary ARIN staff understands that this policy would lower the minimum allocation size to a /22 for ISPs in the Caribbean region. The ARIN Caribbean service area consists of the locations listed at http://www.arin.net/community/ARINcountries.html, with the exception of the US, Canada, Antarctica, Bouvet Islands, US Minor Outlying Islands, St Pierre and Miquelon, Heard and McDonald Islands and St Helena. III. Comments A. ARIN Staff 1. Staff foresees no implementation problems with this policy. 2. End-users are excluded from this policy which might be viewed as offering an unfair advantage to ISPs in the region. B. ARIN General Counsel Counsel sees no significant legal or litigation risk regarding this policy. IV. Resource Impact ? Minimal The resource impact of implementing this policy is viewed as minimal. Barring any unforeseen resource requirements, this policy could be implemented within 30 ? 90 days from the date of the ratification of the policy by the ARIN Board of Trustees. It will require the following: ? Updates to Guidelines will be required ? Staff training will be required ? Updates to the ARIN web page of the ?List of Countries in ARIN?s Geographical Areas? to indicate which countries are considered part of the Caribbean region will be required. Regards, Member Services American Registry for Internet Numbers (ARIN) ##### Policy Proposal 2008-4 Minimum Allocation in the Caribbean Region Author: Cathy Aronson and Paul Andersen Date: 18 August 2008 Proposal type: new Policy term: renewable Policy statement: Add the following as section 4.8 of NRPM: 4.8. Minimum Allocation. The minimum IPv4 allocation size for ISPs from the Caribbean portion of the ARIN region is /22. 4.8.1. Allocation Criteria. * The requesting organization must show the efficient utilization of an entire previously allocated /22 from their upstream ISP. This allocation (/22) may have been provided by an ISP's upstream provider(s), and does not have to be contiguous address space. The organization must meet the requirement of efficient use of 4 /24s. * A multi-homed organization must show the efficient utilization of an entire previously allocated /23 from their upstream ISP. This allocation (/23) may have been provided by an ISP's upstream provider(s), and does not have to be contiguous address space. The organization must meet the requirement of efficient use of 2 /24s. * Utilization Reporting and Justification. All other ARIN policies regarding the reporting of justification information for the allocation of IPv4 and IPv6 address space will remain in effect. Rationale: ARIN staff have noted that organizations in the Caribbean region have problems meeting the current criteria due to the fact that the population in the region is smaller than that of Canada and the US. There is also a lack of competition with many countries in the region faced with a monopoly or duopoly situation in terms of transport providers. To spur development in the region a similar proposal was passed in this region for the portion of the African region that ARIN administered prior to the formation of AfriNIC. This proposal seeks a similar outcome. Timetable for implementation: immediate Revisions Made: * 2008-4.02 - Minor edit to specify proposed NRPM section number From info at arin.net Wed Oct 8 16:20:07 2008 From: info at arin.net (Member Services) Date: Wed, 08 Oct 2008 16:20:07 -0400 Subject: Policy Proposal 2007-14 - Staff Assessment Message-ID: <48ED15F7.7090702@arin.net> Policy Proposal 2007-14 Title: Resource Review Process Revised: 6 October 2008 Assessment: 8 October 2008 ARIN Staff Assessment The assessment of this proposal includes comments from ARIN staff and the ARIN General Counsel. It contains analysis of procedural, legal, and resource concerns regarding the implementation of this policy proposal as it is currently stated. Any changes to the language of the proposal may necessitate further analysis by staff and Counsel. I. Proposal Policy Proposal is available below and at: http://www.arin.net/policy/proposals/2007_14.html II. Proposal Summary This policy proposal provides clear policy authority to audit or reclaim resources, guidelines for how it shall be done, and a guarantee of a (minimum) six-month grace period so that the current user shall have time to stop using any resources that will be reclaimed due to non-compliance. III. Comments A. ARIN Staff 1. Section 2c does not reconcile with the RSA, which grants ARIN authority to request any data necessary and does not specify any sort of limitation to frequency. 2. Section 3 requires staff to share the results of an audit of an organization?s resources. Staff often reviews an organization?s transaction history and resources during fraud or suspicious activity investigations and feels that it is not always prudent to share those results. 3. Section 4b uses the term ?single aggregate block? Does this refer to a single CIDR prefix, or to ?a contiguous range of addresses?? 4. Section 7 states that ?no new maintenance fees will be assessed? while a return or revocation of resources is pending. Fee discussions are not policy and should be considered separately. B. ARIN General Counsel This policy seeks to codify and define those instances where ARIN has the right to demand data, or seeks to terminate and revoke resources previously granted. It will guide ARIN, and any reviewing arbitration required to evaluate a resulting dispute, or revocation, or refusal to provide data. Writing down the terms of such policies and authorities may provide greater clarity as well as support for ARIN's application of such policies. However, this writing can become a serious legal concern if the language is not carefully constructed or conflicts with the RSA. Counsel shared some of these concerns with the authors. To date, counsel has significant legal concerns regarding paragraphs 7 and 8 of the current draft. Paragraph 7 is a broad and ambiguous description which could contradict rights and obligations in 12,000 current RSA?s. Paragraph 8 contains ambiguous language that is potentially overbroad that addresses legally hazardous rights. Both need careful review. 7. ARIN shall continue to maintain the resource(s) while their return or revocation is pending, except any maintenance fees assessed during that period shall be calculated as if the return or revocation was complete. In Section 8, replace the first sentence, ?ARIN will not reclaim or revoke Legacy resources in active use, regardless of utilization? with ?This policy does not create any additional authority for ARIN to revoke legacy address space.? IV. Resource Impact ? Minimal The resource impact of implementing this policy is viewed as minimal. Barring any unforeseen resource requirements, this policy could be implemented within 30 ? 90 days from the date of the ratification of the policy by the ARIN Board of Trustees. Depending on the impact to RSD this may require additional staff. It will require the following: * Guidelines Changes * Registration System Changes * Staff training * May increase RSD workload which could slow down response times Regards, Member Services American Registry for Internet Numbers (ARIN) ##### Policy Proposal 2007-14 Resource Review Process Author: Owen DeLong, Stephen Sprunk Proposal Version: 3.1 Date: 6 October 2008 Proposal type: modify Policy term: permanent Policy statement: Add the following to the NRPM: Resource Review 1. ARIN may review the current usage of any resources maintained in the ARIN database. The organization shall cooperate with any request from ARIN for reasonable related documentation. 2. ARIN may conduct such reviews: a. when any new resource is requested, b. whenever ARIN has reason to believe that the resources were originally obtained fraudulently or in contravention of existing policy, or c. at any other time without having to establish cause unless a prior review has been completed in the preceding 24 months. 3. ARIN shall communicate the results of the review to the organization. 4. Organizations found by ARIN to be materially out of compliance with current ARIN policy shall be requested or required to return resources as needed to bring them into (or reasonably close to) compliance. 4a. The degree to which an organization may remain out of compliance shall be based on the reasonable judgment of the ARIN staff and shall balance all facts known, including the organization?s utilization rate, available address pool, and other factors as appropriate so as to avoid forcing returns which will result in near-term additional requests or unnecessary route de-aggregation. 4b. To the extent possible, entire blocks should be returned. Partial address blocks shall be returned in such a way that the portion retained will comprise a single aggregate block. 5. If the organization does not voluntarily return resources as requested, ARIN may revoke any resources issued by ARIN as required to bring the organization into overall compliance. ARIN shall follow the same guidelines for revocation that are required for voluntary return in the previous paragraph. 6. Except in cases of fraud, or violations of policy, an organization shall be given a minimum of six months to effect a return. ARIN shall negotiate a longer term with the organization if ARIN believes the organization is working in good faith to substantially restore compliance and has a valid need for additional time to renumber out of the affected blocks. 7. ARIN shall continue to provide services for the resource(s) while their return or revocation is pending, however, any maintenance fees assessed during that period shall be calculated as if the return or revocation was complete. 8. ARIN will not reclaim or revoke Legacy resources in active use, regardless of utilization. However, the utilization of legacy resources shall be considered during a review to assess overall compliance. 9. In considering compliance with policies which allow a timeframe (such as a requirement to assign some number of prefixes within 5 years), failure to comply cannot be measured until after the timeframe specified in the applicable policy has elapsed. Blocks subject to such a policy shall be assumed in compliance with that policy until such time as the specified time since issuance has elapsed. Delete NRPM sections 4.1.2, 4.1.3, 4.1.4 Remove the sentence "In extreme cases, existing allocations may be affected." from NRPM section 4.2.3.1. Rationale: Under current policy and existing RSAs, ARIN has an unlimited authority to audit or review a resource holder's utilization for compliance at any time and no requirement to communicate the results of any such review to the resource holder. This policy attempts to balance the needs of the community and the potential for abuse of process by ARIN in a way that better clarifies the purpose, scope, and capabilities of ARIN and codifies some appropriate protections for resource holders while still preserving the ability for ARIN to address cases of fraud and abuse on an expedited basis. The intended nature of the review is to be no more invasive than what usually happens when an organization applies for additional resources. Additionally, paragraph 2c prevents ARIN from doing excessive without-cause reviews. The authors believe that this update addresses the majority of the feedback received from the community to date and addresses most of the concerns expressed. From info at arin.net Wed Oct 8 16:20:38 2008 From: info at arin.net (Member Services) Date: Wed, 08 Oct 2008 16:20:38 -0400 Subject: Policy Proposal 2008-2 - Staff Assessment Message-ID: <48ED1616.3000005@arin.net> Policy Proposal 2008-2 Title: IPv4 Transfer Policy (authors ARIN AC) Revised: 18 September 2008 Revised Assessment: 8 October 2008 ARIN Staff Assessment The assessment of this proposal includes comments from ARIN staff and the ARIN General Counsel. It contains analysis of procedural, legal, and resource concerns regarding the implementation of this policy proposal as it is currently stated. Any changes to the language of the proposal may necessitate further analysis by staff and Counsel. I. Proposal Policy Proposal is available below and at: http://www.arin.net/policy/proposals/2008_2.html II. Proposal Summary ARIN staff understands that this proposal introduces a new set of criteria to justify transfers of IPv4 address space. Specifically, the existing Transfer Policy sections are consolidated from three sections to two (8.1 and 8.2) and a new section 8.3 is added that defines criteria for ?Simple Transfers?, which allow an organization with excess IPv4 addresses to transfer those addresses to an organization with a need for additional IPv4 addresses, and creates a listing service to bring the two parties together. III. Issues and Concerns A. ARIN Staff Comments: 1. The second paragraph of 8.1 states that ?number resources are assigned to an organization for its exclusive use for the purpose stated in the request, provided the terms of the Registration Services Agreement continue to be met?. Not all number resources involved in a transfer are covered under an ARIN RSA. If this is the intent of this policy, it should be explicitly stated. 2. In addition, ?the stated purpose? for the original allocation may be difficult for an organization to provide given the requester may not be the original holder of the number resources. 3. The newly proposed title for section 8.2 ?Transfers as an Artifact of Change in Resource Holder Ownership? is overly complex and may be difficult for readers to discern what this section pertains to which may result in them bypassing this section altogether. 4. In addition, this title refers to ?resource holder ownership? ? this directly conflicts with the existing transfer policy text and the RSA which both state that number resources are not ?owned?. Staff suggests that the existing title for this section ?Transfer Requirements? be retained for clarity and consistency. 5. The newly proposed title for section 8.2 .1 ?Documentation Requirement for Transfers as an Artifact of Change in Resource Holder Ownership? is overly complex and may be difficult for readers to discern what this section pertains to, which may result in them bypassing this section altogether. 6. In addition, the title refers to ?resource holder ownership? - this directly conflicts with the existing transfer policy text and the RSA which state that number resources are not ?owned?. Staff suggests that the existing title for this section ?Document Requirements? be retained for clarity and consistency. 7. In section 8.3.3 the statement ?The IPv4 block must currently be registered for use within the ARIN service area? is unclear and should be further defined by the author so that staff has a clear understanding of how to apply this criteria. 8. This policy proposal addresses the same subject matter as 2008-2. They both specify requirements that Transferor and address space be recognized by ARIN, Transferee demonstrate need and Transferee sign an RSA. Additionally, they both include provisions on deaggregation, minimum prefix size and directory services. They differ in that this policy is not limited in duration and it does provide criteria on matters such as facilitating and establishing eligibility for the transfer. B. ARIN General Counsel Counsel believes passage of 2008-2 is better for ARIN than continuing its current policy that is highly restrictive in the right of parties to transfer number resources. Notes: This policy is a major departure from existing ARIN policy which has generally prohibited transfers except in specific, limited circumstances. We therefore address the overall intent of the policy from a legal perspective. No matter what transfer policy ARIN implements, it seems likely that there will be more disputes, and hence more legal risk, once ARIN can no longer satisfy requests for v4 resources. But if ARIN continues its existing community created policy to prohibit most transfers, counsel anticipates that widespread transfers in conflict with ARIN?s current policy would nonetheless occur -- imposing significant future legal costs including the costs of investigation, revocation, arbitration, and litigation. A more permissive transfer policy would likely relieve ARIN of legal risks and costs. We therefore seek to balance risks created by the community?s adoption of the proposed policy compared to the risks of retaining the current policy. By creating a well understood set of rules for transfer of v4 resources, the transfer of which are currently prohibited, the policy arguably advances competition. The final wording of any transfer policy will have to be carefully reviewed to ensure it supports to the bedrock legal theory of the Internet community that numbers are not "owned." In particular, ARIN must be able to demonstrate that what is being transferred is the right to make beneficial use of number resources consistent with applicable policy, but not ownership. We currently have no concerns in this regard about the language of this proposal. The current draft of 2008-2 is sufficiently ?built out? to provide guidance on many issues. IV. Resource Impact ? High The resource impact of implementing this policy is high. Barring any unforeseen resource requirements, this policy could be implemented in excess of 180 days from the date of the ratification of the policy by the ARIN Board of Trustees. It will require the following: ? Significant staff training, particularly in relation to maintaining a listing service ? A new template ? Updates to guidelines ? New hardware may be required ? A new set of processes and procedures regarding pre-qualification, certification, transfer and the listing service will need to be developed and all corresponding software/ tools will need to be developed. ? A system for maintaining a log of all ?simple? transfers will need to be developed ? The mechanism and access restrictions for the listing service will need to be developed. Regards, Member Services American Registry for Internet Numbers (ARIN) ##### Policy Proposal 2008-2 IPv4 Transfer Policy Proposal Author: ARIN Advisory Council Proposal Version: 1.4 Date: 18 September 2008 Proposal type: modify Policy term: permanent Policy statement: Modify the current NRPM section 8 as follows -- 8. Transfers [8.1. Transfers ? retain as is] [8.2 ? remove the word ?only?, and retitle to ?Transfers as an Artifact of Change in Resource Holder Ownership?] [Renumber existing 8.3 to 8.2.1 and retitle to ?Documentation Requirements for Transfers as an Artifact of Change in Resource Holder Ownership?] [Add the following new section:] 8.3. Simple Transfer of IPv4 Addresses In light of the pending exhaustion of the IANA IPv4 free pool, ARIN will also process IPv4 address transfer requests subject to the following conditions. These conditions apply only to Simple IPv4 transfers, not to transfers performed according to section 8.2. 8.3.1 Conditions on the transferor (the organization providing addresses for transfer): ? The transferor has no outstanding balances with ARIN. ? The transferor has not received any IPv4 allocations or assignments from ARIN (through ordinary allocations or assignments, or through this Simple Transfer policy) within the preceding 12 months. ? If the transferor elects to retain a portion of a block pursuant to 8.3.6, rather than transferring an entire block, the transferor must sign (or have previously signed) a RSA or LRSA covering the retained portion. 8.3.2 Conditions on the transferee (the organization receiving the transferred addresses): ? The transferee intends to use the transferred IPv4 addresses within the ARIN service area. ? The transferee has no outstanding balances with ARIN. ? The transferee?s need is confirmed by ARIN, according to current ARIN policies. ? The transferee signs (or has previously signed) an RSA covering the IPv4 addresses transferred. ? The transferee may request and receive a contiguous CIDR block large enough to provide a 12 month supply of IPv4 addresses. ? The transferee may only receive one IPv4 address transfer through this Simple Transfer process every 6 months. 8.3.3 Conditions on the IPv4 address block to be transferred: ? The IPv4 block must comply with applicable ARIN allocation requirements, including minimum allocation size. However, an IPv4 allocation or assignment of /24 or larger, but smaller than the current minimum allocation size, may be transferred as a whole resource (but may not be subdivided). ? The IPv4 block must currently be registered for use within the ARIN service area. ? There must be no dispute as to the status of the IPv4 block or regarding the allocation or assignment of such block to the transferor. 8.3.4 [Section omitted] 8.3.5 Pre-qualification ? An interested transferee must seek pre-qualification from ARIN to confirm its eligibility to receive a transfer (including satisfaction of need according to current ARIN policies) before making any solicitation for transfer. Upon pre-qualification, ARIN will provide the transferee with documentation of the pre-qualification, including the size (CIDR prefix length) of the largest IPv4 address block the transferee is eligible to receive, and the expiration date of the pre-qualification. ? An interested transferor may seek pre-qualification from ARIN to confirm its eligibility to offer a transfer before offering IPv4 address resources for transfer. Upon pre-qualification, ARIN will provide the transferor with documentation of the pre-qualification, including the network block and the expiration date of the pre-qualification. 8.3.6 De-aggregation when Permitted by ARIN ARIN may allow transferors to subdivide network blocks. ARIN will attempt to ensure an adequate supply of small blocks while minimizing de-aggregation. 8.3.7. Safe Harbor The fact that an IPv4 address holder is making IPv4 addresses available for transfer, pursuant to this policy, does not, in and of itself, indicate that the address holder lacks the need required for an allocation under ARIN policy. 8.3.8. Organizations under Common Ownership or Control If an IPv4 transferor or transferee is under common ownership or control with any other organization that holds one or more IPv4 blocks, the IPv4 transfer request must report all such organizations under common ownership or control. When evaluating compliance with IPv4 Simple Transfer conditions, ARIN may consider a transfer request in light of requests from other organizations under common ownership or control. 8.3.9. Record-keeping and Publication ARIN will develop and operate a listing service to assist interested transferors and transferees by providing them a centralized location to post information about IPv4 blocks available from pre-qualified transferors and IPv4 blocks needed by pre-qualified transferees. Participation in the listing service is voluntary. After completion of a transfer, ARIN will update the registration and WHOIS records pertaining to the IPv4 block. ARIN will also publish a log of all transfers, including block, transferor, transferee, and date. Rationale: The ARIN Board of Trustees asked the Advisory Council to consider a set of questions around the depletion of the free pool of IPv4 addresses, the transition to IPv6 for Internet address needs in the future, and ARIN's possible role in easing the transition. Over the course of the year, the Advisory Council has worked to solicit input from all parts of the policy-making community, through the ARIN XXI public policy meeting, the Public Policy Mailing List (PPML), sector meetings, and a poll of PPML subscribers. As a result of the input received, this policy has been simplified considerably, removing or modifying text and restrictions deemed unnecessary, while preserving those aspects that seem to be supported by consensus. This policy proposal would create a transfer mechanism for IPv4 number resources between those who have excess resources and those who have a need, thereby allowing ARIN to continue to serve its mission after IANA free pool exhaustion. This proposal would also set conditions on such transfers intended to preserve as much as possible the existing policy related to efficient, needs-based resource issuance, and would leverage ARIN's control systems, audit trails, and recognized position as a trusted agent to avoid speculation and hoarding and diminish the likelihood and extent of an uncontrolled 'black market' where the risk and potential for fraud is immeasurably higher. Many of the transfer conditions are self-explanatory, but some worth highlighting are that: ? To discourage speculation, a waiting period (proposed at 12 months) is required before a recipient of space can transfer it to another organization. ? Transferees must qualify for IPv4 space (just as they do today when getting it from ARIN) before they can receive address space by transfer, or solicit space on a listing service. ? To discourage unnecessarily rapid growth of routing tables, an allocation or assignment may not be arbitrarily deaggregated. To ensure an adequate supply of small blocks while minimizing deaggregation, ARIN may allow transferors to subdivide network blocks. A suggested starting point is to allow transferors to subdivide an IPv4 block into up to four smaller blocks on CIDR bit-boundaries, provided each resulting block satisfies the minimum allocation size. ? A transferee may receive one transfer every 6 months, and may receive at least 12 months worth of space, so they?ll be incented to transfer a block appropriately sized for their needs, which will further discourage deaggregation and keep smaller blocks available for smaller organizations. The proposal would also have ARIN develop and operate a listing service to facilitate transfers and provide an authoritative central source of information on space available and requested for transfer. It would not prohibit private party transactions, but would encourage potential transferors and transferees be pre-qualified first, so that neither party will encounter any surprises when they ask ARIN to process the transfer. Timetable for implementation: immediately upon ratification by the Board of Trustees From info at arin.net Wed Oct 8 16:21:07 2008 From: info at arin.net (Member Services) Date: Wed, 08 Oct 2008 16:21:07 -0400 Subject: Policy Proposal 2008-3 - Staff Assessment Message-ID: <48ED1633.2020601@arin.net> Policy Proposal 2008-3 Title: Community Networks IPv6 Allocation Revised: 16 September 2008 Revised Assessment: 8 October 2008 ARIN Staff Assessment The assessment of this proposal includes comments from ARIN staff and the ARIN General Counsel. It contains analysis of procedural, legal, and resource concerns regarding the implementation of this policy proposal as it is currently stated. Any changes to the language of the proposal may necessitate further analysis by staff and Counsel. I. Proposal Policy Proposal is available below and at: http://www.arin.net/policy/proposals/2008_3.html II. Proposal Summary ARIN staff understands this policy would provide an IPv6 assignment of a /48 or larger to any community network that has at least 100 users and, if it has less than 200 users, projects to double its user base within one year. III. Issues and concerns A. ARIN Staff Comments No modification to section 6.5.8.1b is necessary. The new section 6.5.9 contains all necessary policy information. The policy text for 6.5.9.3 requires the community network to provide a plan for doubling its user base within one year if it currently has less than 200 users. This would penalize networks that are close to the 200 user requirement. For example, a network with 199 users would need to show a plan for 398 users within one year, while a network with 100 users would need to show a plan for 200 users within a year. A network with 200 users wouldn?t need to provide any plan to double its user base, even though it has just one more user than the network with 199. Is this intended? If not, the requirement should be converted to a hard target, such as ?must show a plan to provide service to at least 200 users within one year?. For clarity, 6.5.9 should follow the format established by current section 6.5.8. Section 6.5.9.1 should be entitled "Qualification Criteria" and contain the text in 6.5.9.3. A suggested wording based on the concerns expressed in #2 above is: 6.5.9.1 Qualification Criteria To qualify for a direct assignment, a community network must demonstrate it will immediately provide service to at least 100 users and must demonstrate a plan to provide service to at least 200 users within one year. Section 6.5.9.2 ("Initial assignment size") should have the text currently listed as 6.5.9.1 with the first sentence removed. Section 6.5.9.3 ("Subsequent assignment size") should have the text currently listed as 6.5.9.2. B. ARIN General Counsel Counsel sees no significant legal or litigation risk regarding this policy. IV. Resource Impact - Minimal The resource impact of implementing this policy is minimal. Barring any unforeseen resource requirements, this policy could be implemented within 120 days from the date of the ratification of the policy by the ARIN Board of Trustees. It will require the following: - New template - Registration software changes - New set of guidelines - Staff training Regards, Member Services American Registry for Internet Numbers (ARIN) ##### Policy Proposal 2008-3 Community Networks IPv6 Allocation Author: Joshua King Date: 16 September 2008 Proposal type: new Policy term: permanent Policy statement: [Add Section 2.8 to the NRPM.] 2.8 Community Network A community network is a generic reference to a network that is operated by a group of people living in a particular local area organized for the purposes of delivery or provision of free or low-cost network services to the residents of an incorporated or unincorporated regional municipality, city, town, village, rural municipality, township, county, district or other municipality or other such geographic space, however designated. In order to qualify as a community network under this policy, the community network must certify to ARIN that their staff is at least half volunteer and that their annual revenue is less than $250000 (in 2009 dollars, adjusted for inflation). Legal responsibility for the network as a whole must be held by an organization either possessing non-profit status or fiscally sponsored by a non-profit organization or university. [Modify 6.5.8.1b as follows.] b. qualify for an IPv4 assignment or allocation from ARIN under the IPv4 policy currently in effect or be a qualifying Community Network as defined in Section 2.8, with allocation criteria defined in section 6.5.9. [Add Section 6.5.9 to the NRPM.] 6.5.9 Community Network Allocations 6.5.9.1. Initial assignment size Organizations defined as Community Networks under section 2.8 are eligible to receive a direct assignment. The minimum size of the assignment is /48. Organizations requesting a larger assignment must provide documentation of the characteristics of the Community Network's size and architecture that require the use of additional subnets. An HD-Ratio of .94 with respect to subnet utilization within the network must be met for all assignments larger than a /48. These assignments shall be made from a distinctly identified prefix and shall be made with a reservation for growth of at least a /44. This reservation may be assigned to other organizations later, at ARIN's discretion. 6.5.9.2. Subsequent assignment size Additional assignments may be made when the need for additional subnets is justified. Justification will be determined based on a detailed plan of the network's architecture and the .94 HD-Ratio metric. When possible, assignments will be made from an adjacent address block. 6.5.9.3. Number of customers Community Networks seeking an allocation must demonstrate that they provide for a user base of at least 100 through connectivity to homes and businesses, public facilities, public access points, or mobile users. Community Networks with user bases of under 200 must also submit a plan for doubling their service base over the next year. Rationale: There are currently a number of projects globally that aim to develop community network infrastructure and related technologies. These are usually coordinated by volunteer-run, grassroots organizations which lack many of the resources of traditional internet service providers and other network operators. They have diverse goals, including public policy, software development, and implementation of community services and resources. Many of them provide services free of charge, and thus lack any paying user base. However, in order to create and maintain community networks that are often composed of hundreds if not thousands of inexpensive consumer-grade network devices, a significant amount of address space will be required. Current-generation workarounds to this problem, such as NAT, not only make it difficult to develop next-generation decentralized network technology by segmenting the community's architecture from the Internet as a whole, but will cease to be as viable a stopgap as the Internet moves towards IPv6 integration. Community-based, volunteer-run organizations that are operated with an eye towards the public good often do not have the resources to qualify as an LIR under the current policy. They are often multi-homed networks utilizing multiple, relatively inexpensive consumer-grade internet uplinks and lacking the funds to meet the qualifications for an IPv4 allocation, but which wish an avenue to develop future IPv6 capability for their constituent users. If this proposal is adopted, I intend to immediately move forward with the process to request a change in fee structure for community networks so that they are permitted to pay a small percentage of their annual revenue in lieu of a flat fee. By establishing a procedure by which these organizations can seek to acquire the resources they require for further development, ARIN can reach out to this active community and establish a small but definite space for them in the future of Internet. Timetable for implementation: Immediate. From info at arin.net Wed Oct 8 16:21:57 2008 From: info at arin.net (Member Services) Date: Wed, 08 Oct 2008 16:21:57 -0400 Subject: Policy Proposal: 2008-5 - Staff Assessment Message-ID: <48ED1665.7020805@arin.net> Policy Proposal: 2008-5 Title: Dedicated IPv4 block to facilitate IPv6 deployment Submitted: 6 June 2008 Assessment: 8 October 2008 ARIN Staff Assessment The assessment of this proposal includes comments from ARIN staff and the ARIN General Counsel. It contains analysis of procedural, legal, and resource concerns regarding the implementation of this policy proposal as it is currently stated. Any changes to the language of the proposal may necessitate further analysis by staff and Counsel. I. Proposal Policy Proposal is available below and at: http://www.arin.net/policy/proposals/2008_5.html II. Proposal Summary ARIN staff understands that this policy would set aside a contiguous /10 to facilitate IPv6 deployment when ARIN receives its last /8 from IANA. III. Comments A. ARIN Staff 1. The timeframe for ?immediate IPv6 deployment requirements? is not defined anywhere within this policy. It is unclear whether staff would issue a 30 day supply of addresses or a 6 month supply. 2. In section 3 of this policy, the author says ?previous allocations/assignments under this policy must meet the utilization requirements of end user assignments. Is the author saying that for subsequent allocations under this policy, the requestor must be at 80% utilization? If so, then this needs to be stated explicitly rather than referring to the current end user policy which is subject to change over time. 3. Section 6 says that ?recipient organizations must be members in good standing of ARIN ? Membership isn't currently required to request new resources from ARIN and end users who currently hold resources from ARIN are generally not members of ARIN unless they pay a separate $500 membership fee. If the intent of this item is to ensure that all organizations requesting resources under this policy have no outstanding bills due to ARIN, then this is not needed because it is a current ARIN business practice. ARIN will continue to issue resources only to organizations that have paid their bills. 4. The policy proposal will affect DNS operations for independent allocations made that are longer than a /24. B. ARIN General Counsel Counsel sees no significant legal or litigation risk regarding this policy. IV. Resource Impact ? Moderate The resource impact of implementing this policy is viewed as minimal. Barring any unforeseen resource requirements, this policy could be implemented within 120-180 days from the date of the ratification of the policy by the ARIN Board of Trustees. It will require the following: ? Updates to Guidelines will be required. ? Staff training will be required. ? The minimum/maximum block sizes, defined range, and sparse allocation required by this policy would require software changes to registration software. ? Operational modifications and guidelines for managing reverse DNS for allocations longer than a /24 will be required. Regards, Member Services American Registry for Internet Numbers (ARIN) ##### Policy Proposal 2008-5 Dedicated IPv4 block to facilitate IPv6 deployment Author: Alain Durand Date: 6 June 2008 Proposal type: New Policy term: Permanent Policy statement: When ARIN receives its last /8 IPv4 allocation from IANA, a contiguous /10 IPv4 block will be set aside and dedicated to facilitate IPv6 deployment. Allocations and assignments from this block must be justified by immediate IPv6 deployment requirements. Examples of such needs include: IPv4 addresses for key dual stack DNS servers, and NAT-PT or NAT464 translators. ARIN staff will use their discretion when evaluating justifications. This block will be subject to a minimum size allocation of /28 and a maximum size allocation of /24. ARIN should use sparse allocation when possible within that /10 block. In order to receive an allocation or assignment under this policy: 1. the applicant may not have received resources under this policy in the preceding six months; 2. previous allocations/assignments under this policy must continue to meet the justification requirements of this policy; 3. previous allocations/assignments under this policy must meet the utilization requirements of end user assignments; 4. the applicant must demonstrate that no other allocations or assignments will meet this need; 5. on subsequent allocation under this policy, ARIN staff may require applicants to renumber out of previously allocated / assigned space under this policy in order to minimize non-contiguous allocations; 6. recipient organizations must be members in good standing of ARIN. Rationale for reserving IPv4 space: This policy provides predictability on how the end game of IPv4 is going to be played after IANA completion. It will facilitate IPv6 deployment by ensuring that some small chunks of IPv4 space will remain available for a long time to ease the co-existence of IPv4 & IPv6. Rationale for reserving a contiguous /10 This is a balance between setting aside too much space and not having enough to facilitate IPv6 deployment for many years. Out of the last /8, that would leave the equivalent of 3 /10 to ARIN either for business as usual or for other policies in the spirit of this one. A /10 represents 4,194,304 IP addresses, If all of them were to be used in NAT-PT or NAT464 type devices with a consolidation factor of 100 users behind each IP address, that would represent about 400 million users. Most networks today filter IPv4 announcements more specific than /24. This policy creates allocations & assignment prefixes as long as /28. Allocating out of a contiguous block will mitigate the impact of this policy on filter lists. Rationale for minimum size allocation of /28 This minimum size allocation will put a cap at 250k additional entries in the global IPv4 routing table. Rationale for maximum size allocation of /24 and for the 6 month delay between allocations This maximum allocation size coupled with the requirement of a 6 months delay between allocations will prevent hoarding and make sure this pool will last several years. Rationale for forced renumbering for further allocation The minimum allocation size of /28 may create a huge increase in the IPv4 routing table size. Forcing renumbering for subsequent allocations under this policy will somehow limit the growth of the routing table size by enabling the announcement of aggregated space. It is expected that the savings in routing table entries will outweigh the pain of forced renumbering. However, renumbering is never an easy task, so it should only be considered as last resort. it is expected that sparse allocation techniques will prevent the need of force renumbering for a fairly long time. Note: This policy proposal hints that the /10 should come out of the last /8 received by ARIN from IANA. However, it does not say so explicitly, leaving the final decision up to the ARIN staff. Timetable for implementation: As soon as ARIN gets its last /8 allocation from IANA. From info at arin.net Wed Oct 8 16:22:23 2008 From: info at arin.net (Member Services) Date: Wed, 08 Oct 2008 16:22:23 -0400 Subject: Policy Proposal 2008-6 - Staff Assessment Message-ID: <48ED167F.5050000@arin.net> Policy Proposal 2008-6 Title: Emergency Transfer Policy for IPv4 Addresses Submitted: 15 August 2008 Assessment: 8 October 2008 ARIN Staff Assessment The assessment of this proposal includes comments from ARIN staff and the ARIN General Counsel. It contains analysis of procedural, legal, and resource concerns regarding the implementation of this policy proposal as it is currently stated. Any changes to the language of the proposal may necessitate further analysis by staff and Counsel. I. Proposal Policy Proposal is available below and at: http://www.arin.net/policy/proposals/2008_6.html II. Proposal Summary ARIN staff understands that this policy would create a second set of transfer requirements when implemented. A resource holder deemed legitimate by ARIN may transfer IPv4 addresses to a recipient that qualifies for IPv4 addresses as long as the original block isn't broken into more than four blocks. III. Comments A. ARIN Staff 1. The meaning of "without the active involvement of ARIN" in the first sentence is unclear and should be further defined by the author. 2. Section 1 indicates the transfer must be done by the "legitimate and exclusive holder of those resources". The term ?legitimate and exclusive holder? is vague and must be clearly defined with accompanying criteria to help staff determine who is eligible to transfer resources under this policy. 3. Section 2 says that the recipient must have ?documented operational need in accordance with current ARIN policy?. Current ARIN policies do not allow the issuance of /23s and /24s with the exception of the micro-allocation policy. This would indicate that no organization would be allowed to transfer /23s and /24s under this policy unless they could qualify under the micro-allocation policy which has very limited eligibility. 4. This policy would become 8.4 in the NRPM and not 8.2.1 as indicated. 5. This policy proposal addresses the same subject matter as 2008-2. They both specify requirements that Transferor and address space be recognized by ARIN, Transferee demonstrate need and Transferee sign an RSA. Additionally, they both include provisions on deaggregation, minimum prefix size and directory services. They are distinguishable in a number of other respects: for example, this policy would only be in effect for three (3) years from its implementation, unlike 2008-2, and it does not include specific criteria on matters such as facilitating and establishing eligibility for the transfer. For a complete list of differences, see comparison attached. B. ARIN General Counsel Counsel believes passage of an additional, more permissive transfer policy would reduce potential legal risks and costs to ARIN arising from transfer disputes as available IPv4 address space is depleted. Specifically, counsel believes passage of 2008-2 or 2008-6 is better for ARIN than continuing its current policy that is highly restrictive in the right of parties to transfer number resources. We now turn to more specific concerns of this particular transfer policy. This policy is a major departure from existing ARIN policy which has generally prohibited transfers except in specific, limited circumstances. We therefore address the overall intent of the policy from a legal perspective. The first legal concern in evaluating the specifics of any transfer policy is whether it is consistent with antitrust law. Currently, this policy does not create concerns. By creating a white market for transfer of v4 resources, the policy arguably advances competition. In this regard, there is no difference between 2008-2 and 2008-6. Second, any new policy should be consistent with the legal theory of the Internet community that numbers are not "owned." We have no concerns about the language of this proposal in this regard. In this regard, there is no difference between 2008-2 and 2008-6. No matter what transfer policy ARIN implements, it seems likely that there will be more disputes, and hence more legal risk, once ARIN can no longer satisfy requests for v4 resources. But if ARIN continues its existing community created policy to prohibit most transfers, counsel anticipates that widespread transfers in conflict with ARIN?s current policy would nonetheless occur ? imposing significant future legal costs including the costs of investigation, revocation, arbitration, and litigation. A carefully drafted but more permissive transfer policy would likely relieve ARIN of legal risks and cost. We therefore seek to balance risks created by the community?s adoption of the proposed policy compared to the risks of retaining the current policy. This policy could lead to future legal costs due to disputes arising from the lack of specific criteria on transfer eligibility and other matters, which ARIN staff would need to supply, and which would not have a community consensus as a standards defense. Choosing between 2008-2 and 2008-6 should reflect the community evaluation of whether the additional issues addressed in 2008-2 are correctly stated, or those issues are best left to future policy development or staff interpretation. If a court were to construe an application of 2008-6 if adopted, the court might find any issue explicitly addressed in 2008-2 and not in 2008-6 cannot be applied as interpretive policy. IV. Resource Impact ? Minimal The resource impact of implementing this policy is viewed as minimal. Barring any unforeseen resource requirements, this policy could be implemented within 90 days from the date of the ratification of the policy by the ARIN Board of Trustees. It will require the following: ? Updates to Guidelines will be required ? Staff training will be required Regards, Member Services American Registry for Internet Numbers (ARIN) ##### Policy Proposal 2008-6 Emergency Transfer Policy for IPv4 Addresses Author: Bill Darte Date: 26 August 2008 Proposal type: New Policy term: Temporary Policy statement: 8.2.1 Emergency Transfer Policy for IPv4 Addresses For a period of 3 years from policy implementation, transfer of ARIN IPv4 addresses between two entities in the ARIN region, without the active involvement of ARIN as an intermediary, will be considered legitimate and will be documented accordingly under the following conditions: 1. Transfer takes place from a holder of IPv4 addresses recognized by ARIN as the legitimate and exclusive holder of those resources. 2. Transfer takes place to a recipient that has documented operational need in accordance with current ARIN policy and that signs an RSA with ARIN covering those resources in advance of transfer. 3. Transfer of addresses takes place in such a way that the original contiguous block(s) are not disaggregated into more than 4 resultant network blocks each being greater than or equal to the current minimum sizes specified in applicable ARIN policy. 4. Transfer is complete and unrestricted and is supported by documentation that ARIN deems satisfactory. Rationale: In order for ARIN to fulfill its mission and to facilitate a continuing supply of IPv4 address resources to its service community when ARIN resources are no longer adequate, and to preserve the integrity of documentation and ARIN services for those resources, this policy may be implemented. Its intent is to preserve the current tradition of need-based allocation/assignments for those still needing IPv4 resources during a transition period as the industry adopts IPv6. This policy is not intended to create a 'market' for such transfers and does not introduce or condone the monetization of address resources or a view of addresses as property. It does recognize that organizations making available unused or no longer needed address resources may incur certain costs that might be compensated by those acquiring the resources. This policy is intended to be transient and light-weight and does not encourage a sustained or continuing role for IPv4, but rather helps to mitigate a transitional crisis that may emerge while the industry adopts IPv6 in accordance with the recommendation of ARIN's Board of Trustees. Timetable for implementation: This policy, once ratified by the ARIN Board of Trustees, would be implemented when either the free-pool of IANA addresses is exhausted or IPv4 address resources in the ARIN Region reaches a threshold of scarcity recognized by the ARIN Board of Trustees as requiring this policy implementation. ####################################################### 2008-6 and 2008-2 Compared 1. Issues Addressed in Both Policies: ? Transferor and address space recognized by ARIN ? Transferee demonstrates need ? Transferee signs RSA ? Deaggregation o 8-2: Unlimited o 8-6: Not more than 4 pieces (each greater than minimum prefix size) ? Minimum prefix size o 8-2: /24 o 8-6: Based on current policy. ? Directory Services o WHOIS updated 2. Policy Guidance is included in 2008-2, but not found in 2008-6: ? Conditions on the transferor (source) o No outstanding balance o Has not received space from ARIN in preceding 12 months o If retains portion of space, must sign SA ? Conditions on the transferee (recipient) o Intent to use space in ARIN service area o No outstanding balance o Not more than a 12-month supply o Not more often than once per 6 months ? Safe harbor text o Availability for transfer does not give okay to ARIN to take it back. ? Organizations under Common Ownership or Control o ARIN may consider this during requests. ? Listing Service o Voluntary ? Directory Services o Log of transfers From info at arin.net Wed Oct 8 16:22:48 2008 From: info at arin.net (Member Services) Date: Wed, 08 Oct 2008 16:22:48 -0400 Subject: Policy Proposal 2008-7 - Staff Assessment Message-ID: <48ED1698.4030006@arin.net> Policy Proposal 2008-7 Title: Whois Integrity Policy Proposal Submitted: 15 August 2008 Assessment: 8 October 2008 ARIN Staff Assessment The assessment of this proposal includes comments from ARIN staff and the ARIN General Counsel. It contains analysis of procedural, legal, and resource concerns regarding the implementation of this policy proposal as it is currently stated. Any changes to the language of the proposal may necessitate further analysis by staff and Counsel. I. Proposal Policy Proposal is available below and at: http://www.arin.net/policy/proposals/2008_7.html II. Proposal Summary ARIN staff understands that this policy would require that a resource be covered by a valid ARIN RSA before it can be updated. III. Comments A. ARIN Staff 1. Requiring all requestors to have a signed RSA (Legacy or Standard) prior to ARIN making any updates to their records could cause a serious delay in the completion of the update which could negatively affect an organization?s business. 2. This policy may cause additional information to become stale in Whois since non-RSA/LRSA signatories will no longer be able to update their information. 3. Since reverse DNS data is part of WHOIS data, a delay in processing or a refusal to process delegation update requests could negatively impact requestor?s DNS operations even if the contact information in WHOIS is correct. B. ARIN General Counsel Clearly protecting or enhancing the accuracy of Whois data is an appropriate goal of standard setting, and if that creates collateral requirements, they are likely to be upheld by any reviewing legal authority. ARIN currently provides free services to legacy holders, including those who have no written agreement with ARIN for specific legacy resources, and makes changes for them in Whois that conform to other policies. ARIN has never adopted a policy requiring such free services be provided by ARIN but has customarily done this for legacy holders. This policy would change ARIN?s customary practice by requiring such a written agreement before ARIN would continue to provide such free services as changing Whois data. From the standpoint of legal obligations, counsel is not aware of any legal theory that would require ARIN to continue to provide free services if it chose to discontinue providing such services for free. It is likely enactment of the current draft may result in litigation testing why the policy was enacted and whether it is reasonably related to achievement of an appropriate standard setting objective. One or more legacy holder(s) might object to this new requirement for a written agreement that requires a series of contractual promises by the legacy holder claiming such a step violates antitrust or other aspects of legally protected commerce policies. They may also argue that since ARIN could charge a fee for service as one alternative to requiring a more comprehensive written agreement, the requirement for the more extensive agreement is legally impermissible. IV. Resource Impact ?Major The resource impact of implementing this policy is viewed as major. Barring any unforeseen resource requirements, this policy could take over 180 days to be implemented from the date of the ratification of the policy by the ARIN Board of Trustees. It will require the following: ? Updates to Guidelines ? Staff training ? New software tools will need to be developed that will identify whether a resource is covered under a RSA. ? Existing software tools will need to be modified to flag those resources that are not covered by a RSA for analysis by staff. ? May require additional staff to handle increased number of manually processed requests. Regards, Member Services American Registry for Internet Numbers (ARIN) ##### Policy Proposal 2008-7 Whois Integrity Policy Proposal Author: Heather Schiller Date: 26 August 2008 Policy statement: To ensure the integrity of information in the ARIN WHOIS Database a resource must be under an RSA (either legacy or traditional) in order to update the WHOIS record. ARIN will not update historical information in the ARIN Whois Database until the resource holder can prove the organization's right to the resource. Rationale: ARIN currently maintains WHOIS and in-addr.arpa delegation records in a best-effort fashion. In many cases ARIN does not have a formal agreement with the legacy resource holders. Legacy records are frequently out of date and have become an increasingly popular target for hijackers. Having up to date contact information and a formal relationship with legacy record holders would assist ARIN and ISP's in ensuring these records are maintained accurately. A similar policy was successfully adopted in the APNIC region. (http://www.apnic.net/policy/proposals/prop-018-v001.html) Timetable for implementation: Within sixty (60) days of approval - with notification to current POC email addresses listed on historical assignments, or as soon as reasonable for ARIN staff. From info at arin.net Fri Oct 10 11:47:23 2008 From: info at arin.net (Member Services) Date: Fri, 10 Oct 2008 11:47:23 -0400 Subject: [arin-ppml] Revised Policy Proposal 2007-14 In-Reply-To: References: Message-ID: <48EF790B.5050005@arin.net> Policy Proposal 2007-14 Resource Review Process This proposal has been revised. It is open for discussion on this mailing list and will be on the agenda at the upcoming ARIN Public Policy Meeting. The current policy proposal text is provided below and is also available at: http://www.arin.net/policy/proposals/2007_14.html Regards, Member Services American Registry for Internet Numbers (ARIN) Owen DeLong wrote: > Some last minute changes to address concerns raised by staff and legal. > > These changes do not change the intent of the policy. > > > Changes include: > Paragraph 3 replaced with language proposed by staff > Paragraph 8 replaced with language proposed by counsel > > I apologize for the last minute nature of these changes, however, > the staff, counsel, and the authors have been working diligently > over the last several days to address these issues as a result of > the information in the recent staff/legal assessments posted to the > list. > > Thanks, > > Owen > > Policy statement: > > Add the following to the NRPM: > > Resource Review > > 1. ARIN may review the current usage of any resources issued by ARIN > to an organization. The organization shall furnish whatever records > are necessary to perform this review. > > 2. ARIN may conduct such reviews: > > a. when any new resource is requested, > b. whenever ARIN has cause to believe that the resources had > originally been obtained fraudulently, or > c. at any other time without cause unless a prior review has been > completed in the preceding 24 months. > > 3. At the conclusion of a review in which ARIN has solicited > information from the resource holder, ARIN shall communicate to the > resource holder that the review has been concluded and what, if any, > further actions are required of said resource holder. > > 4. Organizations shown to be substantially out of compliance with > current ARIN policy shall return resources as needed to bring them > into (or reasonably close to) compliance. > > 4a. The extent to which an organization may remain out of compliance > shall be based on the best judgment of the ARIN staff and shall > balance the organizations utilization rate, available address pool, > and other factors as appropriate so as to avoid forcing returns which > will result in near-term additional requests or unnecessary route de- > aggregation. > > 4b. To the extent possible, entire blocks should be returned. Partial > address blocks shall be returned in such a way that the portion > retained will comprise a single aggregate block. > > 5. If the organization does not voluntarily return resources as > required, ARIN may revoke any resources issued by ARIN as required to > bring the organization into overall compliance. ARIN shall follow the > same guidelines for revocation that are required for voluntary return > in the previous paragraph. > > 6. Except in cases of fraud, an organization shall be given a minimum > of six months to effect a return. ARIN shall negotiate a longer term > with the organization if ARIN believes the organization is working in > good faith to substantially restore compliance and has a valid need > for additional time to renumber out of the affected blocks. > > 7. ARIN shall continue to maintain the resource(s) while their return > or revocation is pending, except no new maintenance fees shall be > assessed for the resource(s). > > 8. This policy does not create any additional authority for ARIN to > revoke legacy address space. However, the utilization of legacy > resources shall be considered during a review to assess overall > compliance. > > 9. In considering compliance with policies which allow a timeframe > (such as a requirement to assign some number of prefixes within 5 > years) failure to comply cannot be measured until after the timeframe > specified in the applicable policy has elapsed. Blocks subject to such > a policy shall be assumed in compliance with that policy until such > time as the specified time since issuance has elapsed. > > > > Delete NRPM sections 4.1.2, 4.1.3, 4.1.4 > > Remove the sentence "In extreme cases, existing allocations may be > affected." from NRPM section 4.2.3.1. > > Rationale: > > ARIN feels that current policy does not give them the power to review > or reclaim resources except in cases of fraud, despite this being > mentioned in the Registration Services Agreement. This policy proposal > provides clear policy authority to do so, guidelines for how and under > what conditions it shall be done, and a guarantee of a (minimum) six- > month grace period so that the current user shall have time to > renumber out of any resources to be reclaimed. > > The nature of the "review" is to be of the same form as is currently > done when an organization requests new resources, i.e. the > documentation required and standards should be the same. > > The intent of paragraph 2c is to prevent ARIN from doing more than one > without-cause review in a 24 month period. > > The renumbering period does not affect any "hold" period that ARIN may > apply after return or revocation of resources is complete. > > The deleted sections/text would be redundant with the adoption of this > proposal. > > Timetable for implementation: Immediate > > > > _______________________________________________ > PPML > You are receiving this message because you are subscribed to > the ARIN Public Policy Mailing List (ARIN-PPML at arin.net). > Unsubscribe or manage your mailing list subscription at: > http://lists.arin.net/mailman/listinfo/arin-ppml > Please contact info at arin.net if you experience any issues. > > From info at arin.net Tue Oct 14 18:52:52 2008 From: info at arin.net (Member Services) Date: Tue, 14 Oct 2008 18:52:52 -0400 Subject: [arin-ppml] Errors in 2007-14 Revision 3.2 In-Reply-To: <3B7D6BB9-955C-4992-99DE-BE47D082C269@delong.com> References: <3B7D6BB9-955C-4992-99DE-BE47D082C269@delong.com> Message-ID: <48F522C4.2050404@arin.net> Policy Proposal 2007-14 Resource Review Process This proposal has been revised. It is open for discussion on this mailing list and will be on the agenda at the upcoming ARIN Public Policy Meeting. The current policy proposal text is provided below and is also available at: http://www.arin.net/policy/proposals/2007_14.html Regards, Member Services American Registry for Internet Numbers (ARIN) Owen DeLong wrote: > Unfortunately, somehow the version 3.2 that was sent to the mailing list > was apparently the result of applying the intended 3.2 updates to an older > version than 3.1. > > Below is the corrected 3.2 which for clarity I will call version 3.3. > > Apologies for any inconvenience or misunderstanding. The updates actually > conducted remain the same... > > Section 3 updated to address concerns from ARIN staff. > Section 7 and 8 changed to address concerns from legal. > > > Policy Proposal 2007-14 > Resource Review Process > > Author: Owen DeLong, Stephen Sprunk > > Proposal Version: 3.3 > > Date: 14 October 2008 > > Proposal type: modify > > Policy term: permanent > > Policy statement: > > Add the following to the NRPM: > > Resource Review > > 1. ARIN may review the current usage of any resources maintained in > the ARIN database. The organization shall cooperate with any request > from ARIN for reasonable related documentation. > > 2. ARIN may conduct such reviews: > > a. when any new resource is requested, > > b. whenever ARIN has reason to believe that the resources were > originally obtained fraudulently or in contravention of existing > policy, or > > c. at any other time without having to establish cause unless a > prior review has been completed in the preceding 24 months. > > 3. At the conclusion of a review in which ARIN has solicited > information from the resource holder, ARIN shall communicate to the > resource holder that the review has been concluded and what, if any, > further actions are required. > > 4. Organizations found by ARIN to be materially out of compliance with > current ARIN policy shall be requested or required to return resources > as needed to bring them into (or reasonably close to) compliance. > > 4a. The degree to which an organization may remain out of > compliance shall be based on the reasonable judgment of the ARIN > staff and shall balance all facts known, including the > organization?s utilization rate, > available address pool, and other factors as appropriate so as to > avoid forcing returns which will result in near-term additional > requests or unnecessary route de-aggregation. > > 4b. To the extent possible, entire blocks should be returned. > Partial address blocks shall be returned in such a way that the > portion retained will comprise a single aggregate block. > > 5. If the organization does not voluntarily return resources as > requested, ARIN may revoke any resources issued by ARIN as required to > bring the organization into overall compliance. ARIN shall follow the > same guidelines for revocation that are required for voluntary return > in the previous paragraph. > > 6. Except in cases of fraud, or violations of policy, an organization > shall be given a minimum of six months to effect a return. ARIN shall > negotiate a longer term with the organization if ARIN believes the > organization is working in good faith to substantially restore > compliance and has a valid need for additional time to renumber out of > the affected blocks. > > 7. ARIN shall continue to provide services for the resource(s) while > their return or revocation is pending, except any maintenance fees > assessed during that period shall be calculated as if the return or > revocation was complete. > > 8. This policy does not create any additional authority for ARIN to > revoke legacy address space. However, the utilization of legacy > resources shall be considered during a review to assess overall > compliance. > > 9. In considering compliance with policies which allow a timeframe > (such as a requirement to assign some number of prefixes within 5 > years), failure to comply cannot be measured until after the timeframe > specified in the applicable policy has elapsed. Blocks subject to such > a policy shall be assumed in compliance with that policy until such > time as the specified time since issuance has elapsed. > > Delete NRPM sections 4.1.2, 4.1.3, 4.1.4 > > Remove the sentence "In extreme cases, existing allocations may be > affected." from NRPM section 4.2.3.1. > > Rationale: > > Under current policy and existing RSAs, ARIN has an unlimited > authority to audit or review a resource holder's utilization for > compliance at any time and no requirement to communicate the results > of any such review to the resource holder. > > This policy attempts to balance the needs of the community and the > potential for abuse of process by ARIN in a way that better clarifies > the purpose, scope, and capabilities of ARIN and codifies some > appropriate protections for resource holders while still preserving > the ability for ARIN to address cases of fraud and abuse on an > expedited basis. > > The intended nature of the review is to be no more invasive than what > usually happens when an organization applies for additional resources. > Additionally, paragraph 2c prevents ARIN from doing excessive > without-cause reviews. > > The authors believe that this update addresses the majority of the > feedback received from the community to date and addresses most of the > concerns expressed. > > > ------------------------------------------------------------------------ > > _______________________________________________ > PPML > You are receiving this message because you are subscribed to > the ARIN Public Policy Mailing List (ARIN-PPML at arin.net). > Unsubscribe or manage your mailing list subscription at: > http://lists.arin.net/mailman/listinfo/arin-ppml > Please contact info at arin.net if you experience any issues. From info at arin.net Wed Oct 15 11:26:01 2008 From: info at arin.net (Member Services) Date: Wed, 15 Oct 2008 11:26:01 -0400 Subject: ARIN XXII Now Underway Message-ID: <48F60B89.9070108@arin.net> The ARIN XXII Public Policy and Members Meeting begins today in Los Angeles, California. For those in the community who were unable to make it to LA, ARIN is offering a webcast and live transcript of the Public Policy and Members Meetings. The times of the broadcast are as follows: Public Policy Meeting (Policy and technical discussions) Wednesday, 15 October 11AM - 5PM Thursday, 16 October 9AM - 4:30PM Members Meeting (ARIN reports, Board of Trustees and Advisory Council reports, and candidate speeches) Friday, 17 October 9AM - 12PM All times are Pacific Daylight Time (PDT), (UTC/GMT -7 hours) You may register as a remote participant at any time throughout the meeting, and registered remote participants may join in the meeting chat to vote in straw polls and submit questions or comments during the times listed above. Pre-register your Jabber Identifier (JID) to have full chat room access from the start of the meeting. You can register a JID at any time, but we will only be adding new participants during scheduled breaks in the meeting. The full agenda is available at http://www.arin.net/ARIN-XXII/agenda.html. For details about how to connect to the webcast, chat, and live transcript, or to refer to the Remote Participation Acceptable Use Policy, please see: http://www.arin.net/ARIN-XXII/remote.html Regards, Member Services American Registry for Internet Numbers (ARIN) From info at arin.net Mon Oct 20 13:50:26 2008 From: info at arin.net (Member Services) Date: Mon, 20 Oct 2008 13:50:26 -0400 Subject: Policy Proposal: Annual WHOIS POC Validation - Revised Message-ID: <48FCC4E2.40600@arin.net> The author submitted a revised version of the proposal. The ARIN Advisory Council (AC) will review this proposal at their next regularly scheduled meeting. The AC may decide to: 1. Accept the proposal as written. If the AC accepts the proposal, it will be posted as a formal policy proposal to PPML and it will be presented at a Public Policy Meeting. 2. Postpone their decision regarding the proposal until the next regularly scheduled AC meeting in order to work with the author. The AC will work with the author to clarify, combine or divide the proposal. At their following meeting the AC will accept or not accept the proposal. 3. Not accept the proposal. If the AC does not accept the proposal, the AC will explain their decision via the PPML. If a proposal is not accepted, then the author may elect to use the petition process to advance their proposal. If the author elects not to petition or the petition fails, then the proposal will be closed. In the meantime, the AC invites everyone to comment on this proposal on the PPML, particularly their support or non-support and the reasoning behind their opinion. Such participation contributes to a thorough vetting and provides important guidance to the AC in their deliberations. The ARIN Internet Resource Policy Evaluation Process can be found at: http://www.arin.net/policy/irpep.html Mailing list subscription information can be found at: http://www.arin.net/mailing_lists/ Regards, Member Services American Registry for Internet Numbers (ARIN) ## * ## Policy Proposal Name: Annual WHOIS POC Validation Author: Chris Grundemann Proposal Version: 3 Submission Date: 20 October 2008 Proposal type: new Policy term: permanent Policy statement: ARIN will validate each WHOIS POC at least annually. Unresponsive POC email addresses shall be marked as such in the database. If ARIN staff deems a POC to be completely and permanently abandoned or otherwise illegitimate, the record shall be locked or deleted. ARIN will maintain, and make readily available to the community, a current list of address-blocks with no valid POC. Rationale: The intention of this proposal is to ensure valid whois POC information with an annual validation process. It further aims to mitigate any risk that it creates in so doing. One of the most important resources when dealing with abuse (including hijacking, spam, ddos, etc) is whois. ARIN's whois data is only useful if it is known to be valid. The current NRPM does not address this in a manner which ensures up to date POC contact information in all cases. The focus is on valid email addresses because this is the contact method of choice for most in the Internet community when dealing with abuse or hijacking issues. POC information that can not be confirmed can be judged as not valid. A netblock with no valid POC presents a target to hijackers. Once POC info is marked or tagged as invalid (like this policy proposes), it becomes possible for potential hijackers to locate such netblocks by searching the whois database. As a defense against such hijacking attempts, this policy proposes that the information be presented in full to the entire community. This should do at least one of two things; bring the netblock to the attention of whomever is responsible for it and/or allow other network operators to understand the potential risk and take appropriate action to mitigate. Timetable for implementation: The first validation should take place within one calendar year of the policy being accepted. From info at arin.net Wed Oct 22 15:34:09 2008 From: info at arin.net (Member Services) Date: Wed, 22 Oct 2008 15:34:09 -0400 Subject: 2008-5: Dedicated IPv4 block to facilitate IPv6 deployment - Last Call Message-ID: <48FF8031.4010807@arin.net> Policy Proposal 2008-5 Dedicated IPv4 block to facilitate IPv6 deployment On 17 October 2008 the ARIN Advisory Council (AC), acting under the provisions of the ARIN Internet Resource Policy Evaluation Process, determined that the community supports this proposal and moves it to last call. Feedback is encouraged during this last call period. All comments should be provided to the Public Policy Mailing List. This last call will expire at 23:59 EDT, 7 November 2008. The policy proposal text is provided below and is also available at: http://www.arin.net/policy/proposals/2008_5.html The ARIN Internet Resource Policy Evaluation Process can be found at: http://www.arin.net/policy/irpep.html Regards, Member Services American Registry for Internet Numbers (ARIN) ## * ## Policy Proposal 2008-5 Dedicated IPv4 block to facilitate IPv6 deployment Author: Alain Durand Date: 6 June 2008 Proposal type: New Policy term: Permanent Policy statement: When ARIN receives its last /8 IPv4 allocation from IANA, a contiguous /10 IPv4 block will be set aside and dedicated to facilitate IPv6 deployment. Allocations and assignments from this block must be justified by immediate IPv6 deployment requirements. Examples of such needs include: IPv4 addresses for key dual stack DNS servers, and NAT-PT or NAT464 translators. ARIN staff will use their discretion when evaluating justifications. This block will be subject to a minimum size allocation of /28 and a maximum size allocation of /24. ARIN should use sparse allocation when possible within that /10 block. In order to receive an allocation or assignment under this policy: 1. the applicant may not have received resources under this policy in the preceding six months; 2. previous allocations/assignments under this policy must continue to meet the justification requirements of this policy; 3. previous allocations/assignments under this policy must meet the utilization requirements of end user assignments; 4. the applicant must demonstrate that no other allocations or assignments will meet this need; 5. on subsequent allocation under this policy, ARIN staff may require applicants to renumber out of previously allocated / assigned space under this policy in order to minimize non-contiguous allocations; 6. recipient organizations must be members in good standing of ARIN. Rationale for reserving IPv4 space: This policy provides predictability on how the end game of IPv4 is going to be played after IANA completion. It will facilitate IPv6 deployment by ensuring that some small chunks of IPv4 space will remain available for a long time to ease the co-existence of IPv4 & IPv6. Rationale for reserving a contiguous /10 This is a balance between setting aside too much space and not having enough to facilitate IPv6 deployment for many years. Out of the last /8, that would leave the equivalent of 3 /10 to ARIN either for business as usual or for other policies in the spirit of this one. A /10 represents 4,194,304 IP addresses, If all of them were to be used in NAT-PT or NAT464 type devices with a consolidation factor of 100 users behind each IP address, that would represent about 400 million users. Most networks today filter IPv4 announcements more specific than /24. This policy creates allocations & assignment prefixes as long as /28. Allocating out of a contiguous block will mitigate the impact of this policy on filter lists. Rationale for minimum size allocation of /28 This minimum size allocation will put a cap at 250k additional entries in the global IPv4 routing table. Rationale for maximum size allocation of /24 and for the 6 month delay between allocations This maximum allocation size coupled with the requirement of a 6 months delay between allocations will prevent hoarding and make sure this pool will last several years. Rationale for forced renumbering for further allocation The minimum allocation size of /28 may create a huge increase in the IPv4 routing table size. Forcing renumbering for subsequent allocations under this policy will somehow limit the growth of the routing table size by enabling the announcement of aggregated space. It is expected that the savings in routing table entries will outweigh the pain of forced renumbering. However, renumbering is never an easy task, so it should only be considered as last resort. it is expected that sparse allocation techniques will prevent the need of force renumbering for a fairly long time. Note: This policy proposal hints that the /10 should come out of the last /8 received by ARIN from IANA. However, it does not say so explicitly, leaving the final decision up to the ARIN staff. Timetable for implementation: As soon as ARIN gets its last /8 allocation from IANA. From info at arin.net Wed Oct 22 15:39:25 2008 From: info at arin.net (Member Services) Date: Wed, 22 Oct 2008 15:39:25 -0400 Subject: 2008-4: Minimum Allocation in the Caribbean Region - Last Call Message-ID: <48FF816D.7060207@arin.net> Policy Proposal 2008-4 Minimum Allocation in the Caribbean Region On 17 October 2008 the ARIN Advisory Council (AC), acting under the provisions of the ARIN Internet Resource Policy Evaluation Process, determined that the community supports this proposal and moves it to last call as amended. The AC removed the second bullet from the 4.8.1 text because it was redundant, and modified the region to refer to it as the Caribbean and North Atlantic Islands. Feedback is encouraged during this last call period. All comments should be provided to the Public Policy Mailing List. This last call will expire at 23:59 EDT, 7 November 2008. The policy proposal text is provided below and is also available at: http://www.arin.net/policy/proposals/2008_4.html The ARIN Internet Resource Policy Evaluation Process can be found at: http://www.arin.net/policy/irpep.html Regards, Member Services American Registry for Internet Numbers (ARIN) ## * ## Policy Proposal 2008-4 Minimum Allocation in the Caribbean Region Author: Cathy Aronson and Paul Andersen Date: 22 October 2008 Proposal type: new Policy term: renewable Policy statement: Add the following as section 4.8 of NRPM: 4.8. Minimum Allocation for the Caribbean and North Atlantic Islands The minimum IPv4 allocation size for ISPs from the Caribbean and North Atlantic Islands sector of the ARIN region is /22. 4.8.1. Allocation Criteria * The requesting organization must show the efficient utilization of an entire previously allocated /22 from their upstream ISP. This allocation (/22) may have been provided by an ISP's upstream provider(s), and does not have to be contiguous address space. The organization must meet the requirement of efficient use of 4 /24s. * Utilization Reporting and Justification. All other ARIN policies regarding the reporting of justification information for the allocation of IPv4 and IPv6 address space will remain in effect. Rationale: ARIN staff have noted that organizations in the Caribbean region have problems meeting the current criteria due to the fact that the population in the region is smaller than that of Canada and the US. There is also a lack of competition with many countries in the region faced with a monopoly or duopoly situation in terms of transport providers. To spur development in the region a similar proposal was passed in this region for the portion of the African region that ARIN administered prior to the formation of AfriNIC. This proposal seeks a similar outcome. Timetable for implementation: immediate From info at arin.net Wed Oct 22 15:40:18 2008 From: info at arin.net (Member Services) Date: Wed, 22 Oct 2008 15:40:18 -0400 Subject: AC to work with proposal authors Message-ID: <48FF81A2.70307@arin.net> On 17 October 2008 the ARIN Advisory Council (AC), acting under the provisions of the ARIN Internet Resource Policy Evaluation Process, determined that the following policy proposals need to be revised: 2008-7: Whois Integrity Policy Proposal 2008-6: Emergency Transfer Policy for IPv4 Addresses 2008-3: Community Networks IPv6 Allocation 2007-14: Resource Review Process The policy proposal texts are available at the Policy Proposal Archive, located at: http://www.arin.net/policy/proposal_archive.html The AC postponed making a decision on the following proposals in order to work with the authors with the intent to merge the proposals: Annual WHOIS POC Validation Whois POC e-mail cleanup Whois Authentication Alternatives These proposals are in the AC Initial Review stage and can be found at: http://www.arin.net/policy/proposals/submission_archive.html Regards, Member Services Department American Registry for Internet Numbers (ARIN) From info at arin.net Wed Oct 22 15:40:54 2008 From: info at arin.net (Member Services) Date: Wed, 22 Oct 2008 15:40:54 -0400 Subject: 2008-2: IPv4 Transfer Policy Proposal - Abandoned Message-ID: <48FF81C6.2010902@arin.net> Policy Proposal 2008-2 IPv4 Transfer Policy Proposal On 17 October 2008 the ARIN Advisory Council (AC), acting under the provisions of the ARIN Internet Resource Policy Evaluation Process, determined that this proposal did not have the support of the community and decided to abandon it. The AC stated that they are not abandoning the concept of transfers, however they are abandoning this specific proposal. At this time the author of the proposal may elect to use the petition process to attempt to advance the proposal. The deadline for the author to initiate a petition is 23:59 EDT, 29 October 2008. If the author chooses not to petition or the petition is unsuccessful, then the determination of the AC stands and the proposal is abandoned. The policy proposal text is provided below and is also available at: http://www.arin.net/policy/proposals/2008_2.html The ARIN Internet Resource Policy Evaluation Process can be found at: http://www.arin.net/policy/irpep.html Regards, Member Services American Registry for Internet Numbers (ARIN) ## * ## Policy Proposal 2008-2 IPv4 Transfer Policy Proposal Author: ARIN Advisory Council Proposal Version: 1.4 Date: 18 September 2008 Proposal type: modify Policy term: permanent Policy statement: Modify the current NRPM section 8 as follows -- 8. Transfers [8.1. Transfers ? retain as is] [8.2 ? remove the word ?only?, and retitle to ?Transfers as an Artifact of Change in Resource Holder Ownership?] [Renumber existing 8.3 to 8.2.1 and retitle to ?Documentation Requirements for Transfers as an Artifact of Change in Resource Holder Ownership?] [Add the following new section:] 8.3. Simple Transfer of IPv4 Addresses In light of the pending exhaustion of the IANA IPv4 free pool, ARIN will also process IPv4 address transfer requests subject to the following conditions. These conditions apply only to Simple IPv4 transfers, not to transfers performed according to section 8.2. 8.3.1 Conditions on the transferor (the organization providing addresses for transfer): ? The transferor has no outstanding balances with ARIN. ? The transferor has not received any IPv4 allocations or assignments from ARIN (through ordinary allocations or assignments, or through this Simple Transfer policy) within the preceding 12 months. ? If the transferor elects to retain a portion of a block pursuant to 8.3.6, rather than transferring an entire block, the transferor must sign (or have previously signed) a RSA or LRSA covering the retained portion. 8.3.2 Conditions on the transferee (the organization receiving the transferred addresses): ? The transferee intends to use the transferred IPv4 addresses within the ARIN service area. ? The transferee has no outstanding balances with ARIN. ? The transferee?s need is confirmed by ARIN, according to current ARIN policies. ? The transferee signs (or has previously signed) an RSA covering the IPv4 addresses transferred. ? The transferee may request and receive a contiguous CIDR block large enough to provide a 12 month supply of IPv4 addresses. ? The transferee may only receive one IPv4 address transfer through this Simple Transfer process every 6 months. 8.3.3 Conditions on the IPv4 address block to be transferred: ? The IPv4 block must comply with applicable ARIN allocation requirements, including minimum allocation size. However, an IPv4 allocation or assignment of /24 or larger, but smaller than the current minimum allocation size, may be transferred as a whole resource (but may not be subdivided). ? The IPv4 block must currently be registered for use within the ARIN service area. ? There must be no dispute as to the status of the IPv4 block or regarding the allocation or assignment of such block to the transferor. 8.3.4 [Section omitted] 8.3.5 Pre-qualification ? An interested transferee must seek pre-qualification from ARIN to confirm its eligibility to receive a transfer (including satisfaction of need according to current ARIN policies) before making any solicitation for transfer. Upon pre-qualification, ARIN will provide the transferee with documentation of the pre-qualification, including the size (CIDR prefix length) of the largest IPv4 address block the transferee is eligible to receive, and the expiration date of the pre-qualification. ? An interested transferor may seek pre-qualification from ARIN to confirm its eligibility to offer a transfer before offering IPv4 address resources for transfer. Upon pre-qualification, ARIN will provide the transferor with documentation of the pre-qualification, including the network block and the expiration date of the pre-qualification. 8.3.6 De-aggregation when Permitted by ARIN ARIN may allow transferors to subdivide network blocks. ARIN will attempt to ensure an adequate supply of small blocks while minimizing de-aggregation. 8.3.7. Safe Harbor The fact that an IPv4 address holder is making IPv4 addresses available for transfer, pursuant to this policy, does not, in and of itself, indicate that the address holder lacks the need required for an allocation under ARIN policy. 8.3.8. Organizations under Common Ownership or Control If an IPv4 transferor or transferee is under common ownership or control with any other organization that holds one or more IPv4 blocks, the IPv4 transfer request must report all such organizations under common ownership or control. When evaluating compliance with IPv4 Simple Transfer conditions, ARIN may consider a transfer request in light of requests from other organizations under common ownership or control. 8.3.9. Record-keeping and Publication ARIN will develop and operate a listing service to assist interested transferors and transferees by providing them a centralized location to post information about IPv4 blocks available from pre-qualified transferors and IPv4 blocks needed by pre-qualified transferees. Participation in the listing service is voluntary. After completion of a transfer, ARIN will update the registration and WHOIS records pertaining to the IPv4 block. ARIN will also publish a log of all transfers, including block, transferor, transferee, and date. Rationale: The ARIN Board of Trustees asked the Advisory Council to consider a set of questions around the depletion of the free pool of IPv4 addresses, the transition to IPv6 for Internet address needs in the future, and ARIN's possible role in easing the transition. Over the course of the year, the Advisory Council has worked to solicit input from all parts of the policy-making community, through the ARIN XXI public policy meeting, the Public Policy Mailing List (PPML), sector meetings, and a poll of PPML subscribers. As a result of the input received, this policy has been simplified considerably, removing or modifying text and restrictions deemed unnecessary, while preserving those aspects that seem to be supported by consensus. This policy proposal would create a transfer mechanism for IPv4 number resources between those who have excess resources and those who have a need, thereby allowing ARIN to continue to serve its mission after IANA free pool exhaustion. This proposal would also set conditions on such transfers intended to preserve as much as possible the existing policy related to efficient, needs-based resource issuance, and would leverage ARIN's control systems, audit trails, and recognized position as a trusted agent to avoid speculation and hoarding and diminish the likelihood and extent of an uncontrolled 'black market' where the risk and potential for fraud is immeasurably higher. Many of the transfer conditions are self-explanatory, but some worth highlighting are that: ? To discourage speculation, a waiting period (proposed at 12 months) is required before a recipient of space can transfer it to another organization. ? Transferees must qualify for IPv4 space (just as they do today when getting it from ARIN) before they can receive address space by transfer, or solicit space on a listing service. ? To discourage unnecessarily rapid growth of routing tables, an allocation or assignment may not be arbitrarily deaggregated. To ensure an adequate supply of small blocks while minimizing deaggregation, ARIN may allow transferors to subdivide network blocks. A suggested starting point is to allow transferors to subdivide an IPv4 block into up to four smaller blocks on CIDR bit-boundaries, provided each resulting block satisfies the minimum allocation size. ? A transferee may receive one transfer every 6 months, and may receive at least 12 months worth of space, so they?ll be incented to transfer a block appropriately sized for their needs, which will further discourage deaggregation and keep smaller blocks available for smaller organizations. The proposal would also have ARIN develop and operate a listing service to facilitate transfers and provide an authoritative central source of information on space available and requested for transfer. It would not prohibit private party transactions, but would encourage potential transferors and transferees be pre-qualified first, so that neither party will encounter any surprises when they ask ARIN to process the transfer. Timetable for implementation: immediately upon ratification by the Board of Trustees From info at arin.net Tue Oct 28 15:04:06 2008 From: info at arin.net (Member Services) Date: Tue, 28 Oct 2008 15:04:06 -0400 Subject: ARIN XXII Meeting Report Now Available Message-ID: <49076226.8020800@arin.net> From 15-17 October, the ARIN community took part in the ARIN XXII Public Policy and Members Meeting, held in Los Angeles. The report of that meeting, which includes presentations, summary notes, and transcripts of the entire meeting, is now available on the ARIN website at: http://www.arin.net/meetings/minutes/ARIN_XXII/ Please check back next week when an archive of the meeting's webcast will be available. We thank everyone in the community who participated in person or remotely and those who responded to the surveys. We look forward to seeing you 26-29 April 2009 for ARIN XXIII in San Antonio, Texas. Regards, Member Services American Registry for Internet Numbers (ARIN)