[arin-ppml] ARIN's Authority - One view (was: Re: LRSA concerns)

[John Curran]

On Aug 21, 2008, at 7:54 PM, William Herrin wrote:
> ... ARIN got the authority to do this by virtue of the fact
> that network solutions decided to stop. Later they negotiated
> contracts with IANA/ICANN and normalized the arrangement into
> something pretty solid.

Bill - This actually isn't correct.

First, for background, it's important to note that while the IANA
may have operated on behalf of the community under guidance of the
Internet Activities Board (IAB), the authority for its operation
was held by US FRICC / Federal Network Council (FNC) (which was the
US Government's body for coordinating those agencies that supported
the Internet [reference: RFC 1160, V. Cerf, May 1990]).

If you'd like to verify this, refer to RFC 1174 which is a *request*
from the IAB to the US FNC for approval to alter DNS & IP aspects of
the Internet Registry (IR) system as a result of removal of "connected"
status. It also recommends allowing CCIRN-designated regional Internet
registries for international purposes, thus enabling delegation of IR
functions to RIPE NCC & APNIC. The Internet Registry functions known as
the DDN-NIC/INTERNIC/IR/IANA have been contracted over time by (D)ARPA,
DCA/DISA, the National Science Foundation, and the US Department of
Commerce; meanwhile, the oversight of these functions has been provided
by then-current body coordinating US agency activities for the Internet
(although happily it has been less and less direct oversight as the
Internet has matured over time.)  As a result, any early IP address
allocations were made pursuant to a US Government contract, and this
has some rather interesting implications to consider later.

Now, with respect to ARIN, it was Jon Postel (who served as the IANA
from the very beginning) and Don Telage of Network Solutions (who was
leading the group in Network Solutions at the time) who recommended
forming ARIN to provide Internet numbering resource administration
for the "rest of world" region, i.e. those areas outside of the RIPE
and APNIC regions.  Many folks in the ISP community were heavily
involved in its formation (some of whom remain actively involved in
RIR and ISP operational communities even today), and I can say that
the FNC, NSF, the Dept of Commerce, the FCC, and even the Executive
branch were involved in the review and approval of ARIN's formation.

The decision to proceed with ARIN's formation was communicated on
June 23, 1997 with Amendment #6 of the National Science Foundation
Cooperative Agreement NCR-9218742 with Network Solutions for
Registration Services <http://www.secinfo.com/dsvRq.838t.d.htm>:

  "Approval of your Year 5 Program Plan constitutes full approval
   by the Foundation that the Awardee proceed with the formation
   of ARIN as outlined in the Program Plan."

and it was finalized (after ARIN incorporation and transition) on
December 3rd of 1997 with Amendment 7 of the same agreement
<http://www.icann.org/en/nsi/coopagmt-amend7-03dec97.htm> which
"relieves, releases, and discharges Network Solutions, Inc. from
any responsibility for the IP Number assignment, Autonomous System
Number assignment, and INADDR.ARPA tasks being performed under
Cooperative Agreement No. NCR-9218742."

So, it's not quite just that Network Solution decided to stop, it's
that the community asked in many forums for ARIN to happen, and the
entity that could authorize the change (i.e. US Government) agreed.

> Prior to ARIN's inception, IP addresses were assigned by various other
> entities, the last one being Network Solutions. These "legacy"
> assignments were no-promises-made and no-strings-attached. These are
> your numbers for use with the TCP/IP protocol. They are unique from
> any others. Have fun. The gentlemen's agreement between ISPs (over
> which ARIN has no control) extends to routing those addresses for the
> respective assignees as well. The key thing to understand here is
> this: ARIN probably has no legal standing in this part of the picture
> at all. The original assignees appear to have some legal standing with
> respect to control of the addresses but because of the shifting legal
> landscape behind the scenes and the internationalization of the
> Internet, it's not entirely clear who else does. It is entirely
> plausible that no one else does.
>
> Now, this issue -could- be resolved legislatively. The US Congress
> could pass a law stating that Department of Commerce is directed to
> contract someone to assign all number resources permitted to be used
> on Internet-connected networks in the United States. DOC would then
> assign that authority to ICANN who would assign it to IANA who would
> assign it to ARIN. The legacy registrant's standing with respect to
> the legacy address ranges would be moot and because addresses weren't
> property to begin with, their rights have not been violated.
>
> However, it is not in ARIN's best interest to take this course of
> action. You see, ARIN's authority doesn't currently derive from ICANN
> or the US Government.

It is correct that the legacy IP assignments were made by various
other entities, but it's also important to note that all of those
allocations were performed as task or function under US Government
contract or cooperative agreement, and that in its region ARIN is
actually *already* performing these functions as the US Government
directed successor.  It's actually that simple.

Frankly, I'd rather not think about this, and hope that this
particular chain of succession remain nothing more than an
interesting historical tidbit best ignored. It's theoretically
possible to ask the "US Government" for support in performing our
task, but we have to remember that the Internet has a much, much
broader constituency than in the early days, and also that it has
been generally accepted policy since ARIN's inception that the
Internet is best served by industry self-determination... (one
might even consider that one of the basic premises behind ARIN's
formation.)

In the end, we have to treat all parties with respect, whether
they are holding a legacy allocation or one more recent.  To the
extent that the Internet community in the ARIN region wishes to
be more flexible with the LRSA, it is relatively easy to change
it accordingly.  To the extent that the community wishes to see
more reclamation efforts towards underutilized allocations, that
too can be accomplished.  While there are risks associated with
any action, ARIN exists to perform this administration on behalf
of the community and will do so diligently.

However, it is very important for us to remember that: 1) The
community must achieve rough consensus in these matters before
ARIN can act, and 2) We're only provided the opportunity to
address these questions because of the assumption that we're
capable of doing it in a fair and open manner.  We fail to do
so at our own peril.

/John

Disclaimer:
The views above are entirely my own, and written without
consideration by ARIN Board, staff, or counsel. I am the
Chairman of the ARIN Board of Trustees and have been so
since ARIN's formation.