[ppml] Policy Proposal 2007-14 - Staff Assessment

Revised Staff Assessment - 17 October 2007

Policy Proposal 2007-14
Resource Review Process

ARIN Staff Assessment

The assessment of this proposal includes comments from ARIN staff and
the ARIN General Counsel. It contains analysis of procedural, legal, and
resource concerns regarding the implementation of this policy proposal
as it is currently stated. Any changes to the language of the proposal
may necessitate further analysis by staff and Counsel.

I. Proposal

Policy Proposal is available as Annex A below and at:
http://www.arin.net/policy/proposals/2007_14.html

II. Understanding of the proposal

This policy proposal provides clear policy authority to audit or reclaim
resources, guidelines for how it shall be done, and a guarantee of a
(minimum) six-month grace period so that the current user shall have
time to stop using any resources to be reclaimed.


III. Comments

   A. ARIN Staff

1) 2c does not reconcile with the RSA, which grants ARIN authority to
request any data necessary and does not specify any sort of limitation
to frequency.

2) Point 3 requires ARIN notify an organization each time a review is
conducted.  ARIN interprets a review to mean a full audit of an
organization's resources conducted by ARIN staff.

3) Point 4 uses the terms “single aggregate block”.and “whole
resources”.  Are these terms used synonymously to refer to a single CIDR
prefix, or to “a contiguous range of addresses”?

4) Point 6 compels ARIN to take action which doesn’t reconcile with the
RSA, which (as articulated above) allows ARIN to take whatever action is
necessary.

5) Author did not indicate placement in the NRPM. We would insert as
"Section 12 Resource Review Process."

   B. ARIN General Counsel
"Counsel strongly supports some version of this policy being enacted and
believes adoption of this policy will save significant future legal
fees. This policy proposal spells out a series of customary and
contractual policies and rights that are important to make as clear as
possible.

Counsel does not agree with that portion of the description which states
ARIN "feels that current policy does not give them the power...." And
believes such powers are adequately vested in ARIN' but believes instead
such powers can always be more carefully delineated for ease of
understanding."

IV. Resource Impact –  Minimal

The resource impact of implementing this policy is viewed as minimal.
Barring any unforeseen resource requirements, this policy could be
implemented within 30 – 90 days from the date of the ratification of the
policy by the ARIN Board of Trustees. Depending on the impact to RSD
this may require additional staff. It will require the following:

Guidelines Changes
Registration System Changes
Staff training
May increase RSD workload
May increase turnaround times


Respectfully submitted,

Member Services
American Registry for Internet Numbers (ARIN)


##*##


Annex A

Policy Proposal 2007-14
Resource Review Process

Author: Owen DeLong, Stephen Sprunk

Proposal type: modify

Policy term: permanent

Policy statement:

Add the following to the NRPM:

Resource Review

1. ARIN may review the current usage of any resources issued by ARIN to
an organization. The organization shall furnish whatever records are
necessary to perform this review.

2. ARIN may conduct such reviews:

     a. when any new resource is requested,
     b. whenever ARIN has cause to believe that the resources had
originally been obtained fraudulently, or
     c. at any other time without cause unless a prior review has been
completed in the preceding 12 months.

3. ARIN shall communicate the results of the review to the organization.

4. If the review shows that existing usage is substantially not in
compliance with current allocation and/or assignment policies, the
organization shall return resources as needed to bring them
substantially into compliance. If possible, only whole resources shall
be returned. Partial address blocks shall be returned in such a way that
the portion retained will comprise a single aggregate block.

5. If the organization does not voluntarily return resources as
required, ARIN may revoke any resources issued by ARIN as required to
bring the organization into overall compliance. ARIN shall follow the
same guidelines for revocation that are required for voluntary return in
the previous paragraph.

6. Except in cases of fraud, an organization shall be given a minimum of
six months to effect a return. ARIN shall negotiate a longer term with
the organization if ARIN believes the organization is working in good
faith to substantially restore compliance and has a valid need for
additional time to renumber out of the affected blocks.

7. Legacy resources in active use, regardless of utilization, are not
subject to revocation by ARIN. However, the utilization of legacy
resources shall be considered during a review to assess overall compliance.

Delete NRPM sections 4.1.2, 4.1.3, 4.1.4

Remove the sentence "In extreme cases, existing allocations may be
affected." from NRPM section 4.2.3.1.

Rationale:

ARIN feels that current policy does not give them the power to review or
reclaim resources except in cases of fraud, despite this being mentioned
in the Registration Services Agreement. This policy proposal provides
clear policy authority to do so, guidelines for how and under what
conditions it shall be done, and a guarantee of a (minimum) six-month
grace period so that the current user shall have time to renumber out of
any resources to be reclaimed.

The nature of the "review" is to be of the same form as is currently
done when an organization requests new resources, i.e. the documentation
required and standards should be the same.

The renumbering period does not affect any "hold" period that ARIN may
apply after return or revocation of resources is complete.

The deleted sections/text would be redundant with the adoption of this
proposal.

Timetable for implementation: Immediate