[ppml] Policy Proposal 2007-15: Authentication ofLegacyResources

[michael.dillon at bt.com]

> I find it distasteful to discuss sticks before we try to come 
> up with carrots and see how effective they are.  At minimum, 
> it shows bad faith. 

I mentioned a non-stick idea back in May but nobody had much to say
about it.
http://lists.arin.net/pipermail/ppml/2007-May/007068.html

If you hate following up URLs, here is the gist of it:

I would prefer to see a new policy that says effective immediately, all
applications for assignments or allocations must include the answers to
a set of questions about the organization's preparations for IPv6. This
is not an arduous requirement because it doesn't force the applicant to
do anything more than research information internally and report it to
ARIN. This is the kind of thing that the contacts already do. But it
does raise the awareness of IPv6 inside these organizations because the
questions are being asked.

I haven't specified the exact questions because this is not a formal
proposal. But I would think that they should be the type of questions
that are meaningful for reporting statistics about IPv6 planning.
Ideally, the author of the questions would seek some assistance from a
university department (sociology, economics) to help structure the
questions so that the statistics can detect movement through stages
getting closer to a fully-functional network service.

> Likewise, I don't see much purpose in discussing carrots 
> until ARIN does some outreach to at least make legacy holders 
> aware of ARIN and give them an opportunity to join on the 
> existing terms.

Let's not get carried away with sequencing here. Yes, ARIN shoul make an
attempt to contact every single legacy holder in the ARIN region, and
update their contact data on whois. If an organization has ceased to
exist, that should be put in the whois (DEFUNCT). If contact attempts
fail utterly, that should go in whois. If the result is ambiguous, i.e.
postal mail not returned but also not answered, put that in the whois.

I do believe that legacy holders who do not sign the RSA and present
proof to ARIN that they continue to have a technical justification for
their address blocks, run the risk of losing their address rights during
the IPv4 endgame. I believe that when a corporation is refused IPv4
addresse because ARIN has run out, that corporation will launch lawsuits
against legacy address holders and ARIN, to force the reclamation and
reallocation of legacy address ranges. This lawsuit could be fought and
won by a corporation entirely separate from ARIN. The concept of address
as property does not come to play at all in such a suit, merely the fact
that corporation X has been a member in good standing of ARIN for many
years while Legacy Holder Y has not. Therefore Legacy Holder Y has
effectively waived their rights to continue using that IPv4 address
range.

The risk is there. Even if a legacy holder ends up keeping their IPv4
addresses after such a lawsuit, they still end up with a substantial
legal bill. 

> We've heard from legacy holders here that want to join and 
> can't figure out how, and there are thousands that have never 
> even heard of ARIN.  IMHO, those problems need to be solved 

Yes, this problem does need to be solved and I suggest that everyone who
is concerned about this contact the individual members of the Board of
Trustees and urge them to fix this pronto.
http://www.arin.net/about_us/bot.html I don't believe this is a policy
issue.

--Michael Dillon