[ppml] Policy Proposal 2008-2 - Staff Assessment

Policy Proposal 2008-2
Title:  IPv4 Transfer Policy (authors ARIN AC)
Revision Submitted: Mar 7, 2008
Date of Assessment:  March 21, 2008

ARIN Staff Assessment

The assessment of this proposal includes comments from ARIN staff and
the ARIN General Counsel. It contains analysis of procedural, legal, and
resource concerns regarding the implementation of this policy proposal
as it is currently stated. Any changes to the language of the proposal
may necessitate further analysis by staff and Counsel.

I.      Proposal

Policy Proposal is available as Annex A below and at:
http://www.arin.net/policy/proposals/2008_2.html

II.           Understanding of the proposal:

ARIN staff understands that this proposal introduces a new set of
criteria to justify transfers of the available IANA IPv4 unicast address
pool following the depletion of this space. Specifically, the existing
Transfer Policy sections are consolidated from three sections to two
(8.1 and 8.2) and a new section 8.3 is added that defines criteria for
“Simple Transfers”, which allow an organization with excess IPv4
addresses to transfer those addresses to an organization with a need for
additional IPv4 addresses, and creates a listing service to bring the
two parties together.

III.     Issues and Concerns

A.      ARIN Staff Comments:

8.0      Transfers

General Observations

•	Policy language and stated criteria are generally broad and subjective
(most criteria contain words like “may” and “should” vs concrete words
like “will” and “must”).  This leads requestors to believe that they are
not obligated to provide documentation and justification for their
transfer.  The author should consider using a reference such as RFC 2119
to define how these words are generally interpreted.

8.1      Transfers

•	This policy does not cover those Internet Number Resources that are
neither covered the ARIN Registration Services Agreement or the ARIN
Legacy Registration Services Agreement.
•	The stated purpose for the original allocation may be difficult for an
organization to provide given the requester may not be the original
holder of the number resources.
•	It is unclear from the text whether all resources being transferred
have to be re-justified according to current ARIN policy.

8.2      Transfers as an Artifact of Change in Resource Holder Ownership

It is difficult if not impossible for a new requestor to provide
“evidence that the new entity has acquired the assets which had, as of
the date of the acquisition or proposed reorganization, justified the
current entity's use of the number resource."  Again, the requestor may
not be the original holder of the number resources.

8.2.1     Documentation Requirements

•	It maybe difficult for some requestors to obtain the legal instrument
that effected the transfer
•	Legal documents may be unavailable, particularly when the transactions
occurred years before
•	Transactions between small private entities are often difficult to
authenticate or verify due to lack of support documentation.  Some are
based on an anecdotal “gentleman’s agreement.
•	Legal documents are often difficult to authenticate because parties to
maybe unreachable.
8.3. Simple Transfer of IPv4 Addresses
•	8.3.2 "business failure" is a nebulous term and could represent an
avenue of abuse.  Staff recommends removal of this term from the policy
text.

•	8.3.6 puts a great deal of responsibility into ARIN staff hands to
control the supply in the listing service. This will require a
significant amount of work to develop procedures, communication
practices, and staff training.  This will take approximately 3 to 6
months for this to occur.

•	8.3.7 provides for an audit exemption.  Under the current RSA, ARIN
has the right to audit a block at any given time.


B.    ARIN General Counsel

This policy is a major departure from existing ARIN policy which has
generally prohibited transfers except in specific, limited
circumstances. We therefore address the overall intent of the policy
from a legal perspective.

No matter what policy ARIN implements, it seems likely that there will
be more disputes, and hence more legal risk, once ARIN can no longer
satisfy requests for v4 resources.  But if ARIN attempted to continue
its existing policy to prohibit most transfers, counsel anticipates that
widespread transfers would nonetheless occur -- imposing significant
future legal costs including the costs of investigation, arbitration,
and litigation.  By providing a realistic mechanism for transfers to
occur, a broader and more permissive transfer policy would likely
relieve ARIN of many such costs.  We therefore consider risks under the
proposed policy compared to the risks of retaining the current policy.

We now turn to more specific concerns.

The first legal concern in evaluating the specifics of any transfer
policy is whether it is consistent with antitrust law. Currently, this
policy does not create concerns.  By creating a white market for
transfer of v4 resources, the policy arguably advances competition.

Second, a serious risk implicit in the creation of a transfer policy is
that it will lead to additional litigation if ARIN, for example, refuses
to permit a transfer it finds inconsistent with any policy eventually
adopted. However, we believe this risk is adequately managed in the
current draft, particularly because concern over this issue must be seen
the context of the likelihood of expensive litigation to enforce the
current policy if a new transfer policy is not adopted in some form.

Third, the new policy will have to be carefully reviewed to ensure it
supports to the legal theory of the Internet community that numbers are
not "owned."  In particular, ARIN will continue to claim that it does
not grant "ownership," and that what is being transferred is the right
to make beneficial use of number resources consistent with applicable
policy. Poorly drafted transfer policies could undercut this current
clear understanding. However, we currently have no serious concerns
about the language of this proposal.


IV. Resource Impact – Moderate

The resource impact of implementing this policy is moderate. Barring any
unforeseen resource requirements, this policy could be implemented
within 180 days from the date of the ratification of the policy by the
ARIN Board of Trustees.  It will require the following:
• Updates to guidelines will be required
• Staff training will be required
• A new template will be required
• Software will be needed
• New hardware may be required
• Details of the systems to implement the request, pre-qualification
certification, transfer and listing service would need to be identified.
This would require additional information about the form of the document
to certify the pre-qualification and the mechanism and access
restrictions for the listing service.

Respectfully submitted,

Member Services
American Registry for Internet Numbers (ARIN)


####


Annex A

Policy Proposal 2008-2
IPv4 Transfer Policy Proposal

Author: ARIN Advisory Council

Proposal Version: 1.1

Date: 7 March 2008

Proposal type: modify

Policy term: permanent

Policy statement:

Replace the current NRPM section 8 with the following --

8. Transfers

[8.1. Transfers – retain as is:

Number resources are non-transferable and are not assignable to any
other organization unless ARIN has expressly and in writing approved a
request for transfer. ARIN is tasked with making prudent decisions on
whether to approve the transfer of number resources.

It should be understood that number resources are not "sold" under ARIN
administration. Rather, number resources are assigned to an organization
for its exclusive use for the purpose stated in the request, provided
the terms of the Registration Services Agreement continue to be met and
the stated purpose for the number resources remains the same. Number
resources are administered and assigned according to ARIN's published
policies.

Number resources are issued, based on justified need, to organizations,
not to individuals representing those organizations. Thus, if a company
goes out of business, regardless of the reason, the point of contact
(POC) listed for the number resource does not have the authority to
sell, transfer, assign, or give the number resource to any other person
or organization. The POC must notify ARIN if a business fails so the
assigned number resources can be returned to the available pool of
number resources if a transfer is not requested and justified.]

[8.2 – remove the word “only”, and retitle to “Transfers as an Artifact
of Change in Resource Holder Ownership”:

8.2. Transfers as an Artifact of Change in Resource Holder Ownership
ARIN will consider requests for the transfer of number resources upon
receipt of evidence that the new entity has acquired the assets which
had, as of the date of the acquisition or proposed reorganization,
justified the current entity's use of the number resource. Examples of
assets that justify use of the number resource include, but are not
limited to:
• Existing customer base
• Qualified hardware inventory
• Specific software requirements.]
[Renumber existing 8.3 to 8.2.1 and retitle to “Documentation
Requirements for Transfers as an Artifact of Change in Resource Holder
Ownership”:

8.2.1. Documentation Requirements for Transfers as an Artifact of Change
in Resource Holder Ownership In evaluating a request for transfer, ARIN
may require the requesting organization to provide any of the following
documents, as applicable, plus any other documents deemed appropriate:
• An authenticated copy of the instrument(s) effecting the transfer of
assets, e.g., bill of sale, certificate of merger, contract, deed, or
court decree
• A detailed inventory of all assets utilized by the requesting party in
maintaining and using the number resource
• A list of the requesting party's customers using the number resource.
If further justification is required, the requesting party may be asked
to provide any of the following, or other supporting documentation, as
applicable:
• A general listing of the assets or components acquired
• A specific description of acquisitions, including:
o Type and quantity of equipment
o Customer base
• A description of how number resources are being utilized
• Network engineering plans, including:
o Host counts
o Subnet masking
o Network diagrams
o Reassignments to customers]

8.3. Simple Transfer of IPv4 Addresses

After the exhaustion of the IANA IPv4 free pool (when IANA allocates its
last unallocated unicast IPv4 address block), ARIN will also process
IPv4 address transfer requests subject to the following conditions.
These conditions apply only to Simple IPv4 transfers, not to transfers
performed according to section 8.2.

8.3.1 Conditions on the transferor (the organization providing addresses
for transfer):
• The transferor resides in the ARIN service area.
• The transferor has signed an RSA and/or a legacy RSA covering the IPv4
addresses transferred.
• The transferor has no outstanding balances with ARIN.
• The transferor has not received any IPv4 allocations or assignments
from ARIN (through ordinary allocations or assignments, or through this
Simple Transfer policy) within the preceding 24 months.
• The transferor may not request any IPv4 allocations or assignments
from ARIN (through ordinary allocations or assignments, or through this
Simple Transfer policy) within the subsequent 24 months.

8.3.2 Conditions on the transferee (the organization receiving the
transferred addresses):
• The transferee resides in the ARIN service area and intends to use the
transferred IPv4 addresses within the ARIN service area.
• The transferee has no outstanding balances with ARIN.
• The transferee’s need is confirmed by ARIN, according to current ARIN
policies, including but not limited to confirmation of utilization rate
of any prior IPv4 allocations, assignments, or previously transferred
IPv4 addresses held by the transferee.
• The transferee signs (or has previously signed) an RSA covering the
IPv4 addresses transferred.
• The transferee has not provided any IPv4 addresses for transfer
through this Simple Transfer process within the preceding 24 months.
• The transferee may not provide any IPv4 addresses for transfer through
this Simple Transfer process within the subsequent 24 months, except in
the case of business failure.
• The transferee may request and receive a contiguous CIDR block large
enough to provide a 12 month supply of IPv4 addresses.
• The transferee may only receive one IPv4 address transfer through this
Simple Transfer process every 6 months.

8.3.3 Conditions on the IPv4 address block to be transferred:
• The IPv4 block must comply with applicable ARIN requirements,
including minimum allocation size (i.e. NRPM 4.2.2., 4.2.4., 4.3.2.,
4.3.6.). However, an IPv4 allocation or assignment of /24 or larger, but
smaller than the current minimum allocation size, may be transferred as
a whole resource, but may not be subdivided.
• The IPv4 block must currently be registered for use within the ARIN
service area, either as part of an address block assigned by IANA to
ARIN, or as part of a legacy address block allocated within the ARIN
service area.
• There must exist no dispute as to the status of the IPv4 block or
regarding the allocation or assignment of such block to the transferor.
• The transferor may retain one contiguous address range out of their
original allocation or assignment for their own use, and transfer the
other contiguous address range. If the address range to be transferred
consists of multiple non-aggregatable CIDR blocks, each may be
transferred to a different transferee. The retained address range may
not be further subdivided or transferred for a period of 12 months.
Notwithstanding the preceding, the block may be subdivided as provided
in section 8.3.6.

8.3.4 Fees
• Completion of a transfer requires payment of a transfer fee according
to ARIN’s schedule of fees.
• The transferee will be subject to all future ARIN membership and
service fees according to the transferee’s total address holdings.

8.3.5 Pre-qualification

• An interested transferee must seek pre-qualification from ARIN to
confirm its eligibility to receive a transfer (including satisfaction of
need according to current ARIN policies) before making any solicitation
for transfer. Upon pre-qualification, ARIN will provide the transferee
with documentation of the pre-qualification, including the size (CIDR
prefix length) of the largest IPv4 address block the transferee is
eligible to receive, and the expiration date of the pre-qualification.
• An interested transferor must seek pre-qualification from ARIN to
confirm its eligibility to offer a transfer (including lack of
outstanding balances and having signed an RSA) before offering IPv4
address resources for transfer. Upon pre-qualification, ARIN will
provide the transferor with documentation of the pre-qualification,
including the network block and the expiration date of the
pre-qualification.

8.3.6 Deaggregation when Permitted by ARIN

If ARIN determines that there is an inadequate supply of small blocks,
ARIN may allow transferors to subdivide network blocks beyond the
limited subdivision permitted under 8.3.3. ARIN will attempt to ensure
an adequate supply of small blocks while minimizing deaggregation.

8.3.7. Safe Harbor for IPv4 Transfers through this Simple Transfer Process

When an IPv4 address resource is made available for transfer, it shall
be deemed exempt from ARIN utilization audit until 90 days after its
transfer pre-qualification or until the transfer is completed, whichever
comes first.

In the event that a transfer is not consummated within the
prequalification time period, the block may be immediately
re-prequalified for transfer. Notwithstanding the current offered state
of the address resource, however, the audit exemption period shall
expire untolled 90 days after the expiration of the first
pre-qualification period. After the expiration of any utilization audit
exemption period, ARIN shall have 90 days in which to initiate a
utilization audit. In no event shall non-exempt time be construed to
extend the end of the next exemption period.

8.3.8. Simple IPv4 Transfers to or from Organizations Under Common
Ownership or Control

If an IPv4 transferor or transferee is under common ownership or control
with any other organization that holds one or more IPv4 blocks, the IPv4
transfer request must report all such organizations under common
ownership or control.

When evaluating compliance with IPv4 Simple Transfer conditions, ARIN
may consider a transferor’s transfer request in light of requests from
other organizations under common ownership or control with the
transferor. Similarly, ARIN may consider a transferee’s request in light
of requests from other organizations under common ownership or control
with the transferee. In evaluating requests from other organizations
under common ownership or control, ARIN staff will consider the
relationship between the organizations, the degree of coordination
between the organizations, and the bona fide use of the addresses at
issue to determine whether all appropriate conditions are met.

8.3.9. Record-keeping and Publication of Simple Transfers of IPv4 Addresses

ARIN will develop and operate a listing service to assist interested
transferors and transferees by providing them a centralized location to
post information about IPv4 blocks available from prequalified
transferors and IPv4 blocks needed by prequalified transferees.
Participation in the listing service is voluntary.

After completion of the transfer, ARIN will update the registration
records pertaining to the IPv4 block at issue. ARIN will adjust its
records as to the holdings of the transferor and transferee.

After the transfer, ARIN will publish WHOIS data that reflects the
current allocation or assignment of the transferred block. ARIN will
also make available information about any prior recipient(s) of such
block. ARIN will also publish a log of all transfers, including block,
transferor, transferee, and date.


Rationale:
The ARIN Board of Trustees asked the Advisory Council to consider a set
of questions around the depletion of the free pool of IPv4 addresses,
the transition to IPv6 for Internet address needs in the future, and
ARIN's possible role in easing the transition.

Over the past few years the AC has spent a great deal of time reflecting
on these issues — as a group, as individuals, and in consultation with
the community. One outcome of this process is this policy proposal,
which the AC is submitting for consideration at the next meeting. We are
proposing some changes to existing ARIN policy regarding the transfer of
IP address block registrations between subscribers, which will allow for
the emergence of trade in IPv4 address space, with ARIN to provide a
listing service for address blocks available for transfer under the
liberalized policy. We are aware that this proposal, if adopted, will
mark a major change in ARIN's role in the community and the Internet.

This policy proposal would create a transfer mechanism for IPv4 number
resources between those who have excess resources and those who have a
need, thereby allowing ARIN to continue to serve its mission after IANA
free pool exhaustion. This proposal would also set conditions on such
transfers intended to preserve as much as possible the existing policy
related to efficient, needs-based resource issuance, and would leverage
ARIN's extensive control systems, audit trails, and recognized position
as a trusted agent to avoid speculation and hoarding and diminish the
likelihood and extent of an uncontrolled 'black market' where the risk
and potential for fraud is immeasurably higher.

Many of the transfer conditions are self-explanatory, but some worth
highlighting are that:
• To discourage speculation, a waiting period (proposed at 24 months) is
required before a transferee (or ordinary resource recipient) can become
a transferor, or vice versa.
• Transferees must qualify for IPv4 space (just as they do today when
getting it from ARIN) before they can receive address space by transfer,
or solicit space on a listing service.
• To discourage unnecessarily rapid growth of routing tables, an
allocation or assignment may not be arbitrarily deaggregated. To allow a
transferor to downsize within their existing space, they may split off a
contiguous address range, once every 12 months, and transfer the
resulting netblock(s), which are subject to ARIN’s minimum allocation
size, to one or more transferee(s).
• A transferee may receive one transfer every 6 months, so they’ll be
incented to transfer a block appropriately sized for their needs, which
will further discourage deaggregation and keep smaller blocks available
for smaller organizations.
The proposal would also have ARIN develop and operate a listing service
to facilitate transfers and provide an authoritative central source of
information on space available and requested for transfer. It would not
prohibit private party transactions, but would require that potential
transferors and transferees be pre-qualified first, so that neither
party will encounter any unexpected surprises when they ask ARIN to
process the transfer.

Timetable for implementation: Immediately, with most aspects of policy
taking effect upon IANA exhaustion, per the policy text.