[arin-ppml] Legacy RSA (was: Whois Integrity Policy Proposal)

[Howard, W. Lee]

Bill Herrin said:
> An "evil" ARIN eh? Hmm, let's see...

I know, it's a contradiction in terms.
But compare to what an evil legacy holder could do!

> 4.d.ii. You host a whistleblower site on the IP addresses 
> through which classified information is leaked. Having broken 
> the law in a manner associated with the IP addresses, an evil 
> ARIN is permitted to cancel your registration, at which point 
> the IP addresses revert to ARIN's control.

I see your point that that would be aggressive application of the
clause, but really. . .  you broke the law, you don't have my 
sympathy.

> 6.b. An evil ARIN could reinterpret 6b. Means 1 or 2, not 1 and 2.
> Since it's 2013 and all end-user maintenance fees have 
> increased to $50k/year (the money redistributed to help the 
> poor backbones cope with the IPv4 route explosion in the wake 
> of IPv6's failure) that includes the legacy maintenance fee. 
> Now the onus is on the registrant to successfully bring 
> action under 14.c, which requires him to attend 15.l. 
> arbitration in Washington DC. And then having gone to that 
> time and expense, he has to actually convince the arbitrator 
> that 6b really does require ARIN to meet BOTH criteria 1 and 2.

It says "and."  That's pretty clear:
After 2013, ARIN, by vote of ARIN's Board, may annually increase the
Legacy Fee by no more than (1) the amount charged non-Legacy holders for
this maintenance service; and (2) no increase per year greater than $25.

That would indeed be a pretty evil bunch of Trustees, elected
by a pretty evil bunch of members, to try redefining "and" to 
mean "or", knowing that they would lose in arbitration. 

The intent of this clause is pretty clearly to limit the amount
ARIN can hit you for.


> 14.a. An evil ARIN could simply give 30 days' notice to the 

Huh.  That's a scenario I hadn't considered.  Thanks.

 
> Want another? I can keep going for a while.

I'll refer you to ARIN's counsel below, but so far I think it's 
a draw.  

> > My experience is such that
> > I trust ARIN more than some people, so I have a paucity of 
> > imagination.
> 
> The courts are full of good, trustworthy people suing each 
> other over broken promises. Stuff happens. Priorities change. 
> Even with the best intentions, perceptions of "fair" drift apart.
> 
> A good system is resilient in the face of that drift.

Absolutely.  But people keep saying this contract offers no
protection, so I hope to understand others' perceptions better.

> > Extra points if you suggest terms of enforcement.
> 
> Have termination for any cause other than non-communication, 
> non-payment or unlawful action specifically against ARIN to 
> cause control of the addresses to revert to the current 
> status quo, similar to the results of having successfully 
> completed 14.c.

One of the benefits to the community is that legacy resource
holders agree to follow the same policies as everyone else, 
except that ARIN will continue to provide service for numbers
as described in 10(b).  If legacy holders can terminate the
contract because they don't agree with community consensus,
but still keep the addresses, that benefit is lost.

E.G., what if a transfer policy allowing deaggregation to /22
were passed, but you (a signatory to the LRSA) heard a rumor 
that somebody would pay good money for /32s? 

> Also, 14c and 14f are in conflict. The number resources can't 
> resume the status they had prior to the legacy agreement if 
> questionable sections (like 9) survive the contract's 
> termination. In an ordinary contract of adhesion like this, 
> the ambiguity would be resolved against the drafter (ARIN). 
> The LRSA specifically excludes that in 15i.

You're right, parts of the agreement survive termination.  I do
think that if you have any question about section 9, your lawyer
should discuss it with ARIN's lawyer before signing the LRSA, so
that the terms are clear.  The Legacy RSA FAQ has the contact
information for ARIN's General Counsel:
http://www.arin.net/registration/legacy/index.html


Let me be clear that I am not speaking on behalf of ARIN; I do
believe the LRSA is an olive branch extended for legacy resource
holders, and I think its terms are reasonable.  However, if I
misunderstand a clause or misrepresent ARIN or the document, it's
because I'm ignorant and didn't ask my lawyer.

Lee