[arin-ppml] LRSA concerns (Re: Policy Proposal: Whois IntegrityPolicy Proposal)

[William Herrin]

On Thu, Aug 21, 2008 at 6:59 PM, Matthew Wilder
<Matthew.Wilder at telus.com> wrote:
> At the same time, I am at a loss as I try to understand
> the mentality of someone who believes that any kind of
> resource like IP Addresses could be under the ownership
> of anyone other than the governing bodies, in this case
> ARIN or at least [IANA].

Hi Matthew,

The law recognizes physical items as property as well as a very narrow
set of intangible items. IP addresses are not one of the intangibles
recognized as property, hence they are not property. That's a
double-edged sword because if they're not property then neither ARIN
nor IANA nor any governing body can own them either.

Thus it breaks into two main questions:

1. Rights to to use, such as by announcing addresses via BGP
2. Rights to receive related services, such as whois or rdns from ARIN

#2 is more or less settled: your sole rights to receive services like
rdns arise under your contract with ARIN. No contract, no rights. ARIN
continues providing DNS to legacy registrants anyway because if they
stopped before bringing the vast majority of legacy registrants under
a contract, there'd be political hell to pay.

#1 is problematic.

Since the late '90s, everyone who has "received" IP addresses has
received them under a legal contract, the Registration Services
Agreement. The RSA spells out the registrants rights with respect to
the resources (very few and very specific) and that's the start and
end of the story. There is a gentlemen's agreement between ISPs
(completely outside ARIN's scope) not to announce routes that folks
pluck from the ether without a registration and it's likely that
intentionally attempting to use someone else's IP addresses would run
afoul of computer fraud statutes and as well as civil problems like
tortious interference. ARIN got the authority to do this by virtue of
the fact that network solutions decided to stop. Later they negotiated
contracts with IANA/ICANN and normalized the arrangement into
something pretty solid.

Prior to ARIN's inception, IP addresses were assigned by various other
entities, the last one being Network Solutions. These "legacy"
assignments were no-promises-made and no-strings-attached. These are
your numbers for use with the TCP/IP protocol. They are unique from
any others. Have fun. The gentlemen's agreement between ISPs (over
which ARIN has no control) extends to routing those addresses for the
respective assignees as well. The key thing to understand here is
this: ARIN probably has no legal standing in this part of the picture
at all. The original assignees appear to have some legal standing with
respect to control of the addresses but because of the shifting legal
landscape behind the scenes and the internationalization of the
Internet, it's not entirely clear who else does. It is entirely
plausible that no one else does.


Now, this issue -could- be resolved legislatively. The US Congress
could pass a law stating that Department of Commerce is directed to
contract someone to assign all number resources permitted to be used
on Internet-connected networks in the United States. DOC would then
assign that authority to ICANN who would assign it to IANA who would
assign it to ARIN. The legacy registrant's standing with respect to
the legacy address ranges would be moot and because addresses weren't
property to begin with, their rights have not been violated.

However, it is not in ARIN's best interest to take this course of
action. You see, ARIN's authority doesn't currently derive from ICANN
or the US Government. It's independent and it maintains it's
prominence through contracts it has negotiated favorably with ICANN
and through the ongoing ISP gentlemen's agreement.

In essence, ARIN's relationship with ICANN and the USG is a whole lot
like the legacy registrants' relationship with ARIN. They have
authority over the number resources only because nobody else does.

As a result, ARIN has near complete autonomy, which they've used to
great effect. They never have to answer to Senator Ted "Tubes"
Stevens. They're able to implement an operations process that's very
close to the technical community they serve without having to worry
about interference from the politically well-connected or financially
powerful.

Which IMHO is fantastic and ARIN has done a great job. But it does
mean that the legacy registrants retain essentially indisputable
control over their pre-ARIN address assignments, a reality that the
rest of the community is stuck with if they want to retain the
advantage of ARIN's autonomy.

And IMO it would be better for all involved if we bowed to that
reality and tried to focus our actions on the improvements where we
actually do have consensus. It isn't about what's fair or unfair, it's
about what achieves the best result both individually and for the
community as a whole.

Regards,
Bill Herrin

-- 
William D. Herrin ................ herrin at dirtside.com bill at herrin.us
3005 Crane Dr. ...................... Web: <http://bill.herrin.us/>
Falls Church, VA 22042-3004