[arin-ppml] Revised Policy Proposal 2007-14

[Owen DeLong]

Some last minute changes to address concerns raised by staff and legal.

These changes do not change the intent of the policy.


Changes include:
	Paragraph 3 replaced with language proposed by staff
	Paragraph 8 replaced with language proposed by counsel

I apologize for the last minute nature of these changes, however,
the staff, counsel, and the authors have been working diligently
over the last several days to address these issues as a result of
the information in the recent staff/legal assessments posted to the
list.

Thanks,

Owen

Policy statement:

Add the following to the NRPM:

Resource Review

1. ARIN may review the current usage of any resources issued by ARIN  
to an organization. The organization shall furnish whatever records  
are necessary to perform this review.

2. ARIN may conduct such reviews:

a. when any new resource is requested,
b. whenever ARIN has cause to believe that the resources had  
originally been obtained fraudulently, or
c. at any other time without cause unless a prior review has been  
completed in the preceding 24 months.

3. At the conclusion of a review in which ARIN has solicited  
information from the resource holder,  ARIN shall communicate to the  
resource holder that the review has been concluded and what, if any,  
further actions are required of said resource holder.

4. Organizations shown to be substantially out of compliance with  
current ARIN policy shall return resources as needed to bring them  
into (or reasonably close to) compliance.

4a. The extent to which an organization may remain out of compliance  
shall be based on the best judgment of the ARIN staff and shall  
balance the organizations utilization rate, available address pool,  
and other factors as appropriate so as to avoid forcing returns which  
will result in near-term additional requests or unnecessary route de- 
aggregation.

4b. To the extent possible, entire blocks should be returned. Partial  
address blocks shall be returned in such a way that the portion  
retained will comprise a single aggregate block.

5. If the organization does not voluntarily return resources as  
required, ARIN may revoke any resources issued by ARIN as required to  
bring the organization into overall compliance. ARIN shall follow the  
same guidelines for revocation that are required for voluntary return  
in the previous paragraph.

6. Except in cases of fraud, an organization shall be given a minimum  
of six months to effect a return. ARIN shall negotiate a longer term  
with the organization if ARIN believes the organization is working in  
good faith to substantially restore compliance and has a valid need  
for additional time to renumber out of the affected blocks.

7. ARIN shall continue to maintain the resource(s) while their return  
or revocation is pending, except no new maintenance fees shall be  
assessed for the resource(s).

8. This policy does not create any additional authority for ARIN to  
revoke legacy address space. However, the utilization of legacy  
resources shall be considered during a review to assess overall  
compliance.

9. In considering compliance with policies which allow a timeframe  
(such as a requirement to assign some number of prefixes within 5  
years) failure to comply cannot be measured until after the timeframe  
specified in the applicable policy has elapsed. Blocks subject to such  
a policy shall be assumed in compliance with that policy until such  
time as the specified time since issuance has elapsed.



Delete NRPM sections 4.1.2, 4.1.3, 4.1.4

Remove the sentence "In extreme cases, existing allocations may be  
affected." from NRPM section 4.2.3.1.

Rationale:

ARIN feels that current policy does not give them the power to review  
or reclaim resources except in cases of fraud, despite this being  
mentioned in the Registration Services Agreement. This policy proposal  
provides clear policy authority to do so, guidelines for how and under  
what conditions it shall be done, and a guarantee of a (minimum) six- 
month grace period so that the current user shall have time to  
renumber out of any resources to be reclaimed.

The nature of the "review" is to be of the same form as is currently  
done when an organization requests new resources, i.e. the  
documentation required and standards should be the same.

The intent of paragraph 2c is to prevent ARIN from doing more than one  
without-cause review in a 24 month period.

The renumbering period does not affect any "hold" period that ARIN may  
apply after return or revocation of resources is complete.

The deleted sections/text would be redundant with the adoption of this  
proposal.

Timetable for implementation: Immediate