[arin-ppml] ARIN releases new version of the Legacy Registration

[John Santos]

On Mon, 8 Sep 2008, Howard, W. Lee wrote:

> Sorry, the length of this message kind of got away from me.  I'm
> trying to put many thoughts into a single message, rather than
> spew messages into PPML all day.
> 
> > -----Original Message-----
> > From: arin-ppml-bounces at arin.net 
> > [mailto:arin-ppml-bounces at arin.net] On Behalf Of Cort Buffington
> > Sent: Sunday, September 07, 2008 10:04 AM
> > To: arin ppml
> > Subject: Re: [arin-ppml] ARIN releases new version of the 
> > Legacy Registration
> > 
> > When I read Eric's post, which is outstanding by the way, I 
> > recall what my fears were when I read the first LRSA offered 
> > to me (I have not had time to read the new one yet). The way 
> > things were worded make me feel kind of like this:
> > 
> > "So this looks pretty good, except all of the language 
> > protecting ARIN's ability to arbitrarily change the agreement 
> > in any way at any time."
> 
> Two things in the LRSA might mitigate that concern:
> 1.  Section 7 says you agree to be bound by community-developed
> policies, unless they contradict the LRSA (e.g., section 10b).
> 2.  You always have the option to stay on your current LRSA or
> accept a new one: section 15(m)
> 
> > And the first one did pretty much read that way. It's going 
> > to take a long, long time to regain my trust. Interestingly 
> > enough, I trusted ARIN before the one-sided contract and 
> > extortive sounding tactics of the original LRSA. Whether 
> > intended or not, that's the way it came across to me.
> 
> Let's talk about what we agree on.  While not universal, there's
> rough consensus around these points:
> * Legacy holders have a slightly different status than modern 
> holders
> * ARIN is the organization providing rDNS, WHOIS, and other
> services that are useful to the community, in this region
> * Legacy holders should pay some nominal maintenance fee, to pay
> for maintenance of those services, and as an annual check that 
> the legacy holder still exists and is using the numbers
> * Legacy holders who are using the space should not have to 
> give up the space (unless required by a force greater than 
> community consensus).  Conversely, legacy holders who are not
> using the space should make that space available for 
> reassignment; those with partial utilization should be 
> encouraged, but not forced, to release what they can.
> * ARIN must abide by laws, government regulations, court 
> rulings, and contracts.
> * People and organizations holding address space must abide by
> laws, government regulations, court rulings and contracts.
> 
> Right?
> 
> 
> Under the new LRSA, the contract would be terminated, but the 
> resources would remain with the legacy holder, under the 
> following circumstances:
> 
> 1. 14(c) the legacy holder terminates for cause, or 
> 2. 15(k) ARIN is unable to provide service due to force majeure.
> 
> Fair so far?
> 
> 
> The only major point of contention is whether a legacy holder
> should ever be required to release their resources to ARIN.  As
> I read the LRSA, the contract would be terminated and ARIN
> would stop providing service (i.e., revoke) under the following 
> circumstances:
> 
> 1.  4(c) Legacy holder does not provide "information, assistance,
> and cooperation that ARIN requests in provision of the Services."
> ARIN may simply refuse additional resources instead.
> 2.  4(d)(i) Legacy holder disrupts or interferes with ARIN's 
> services, 
> 3. 4(d)(ii) Legacy holder "violate(s) any applicable laws, 
> statutes or regulations, as established by a definitive ruling 
> of a court or government agency;"

This is the only clause that I have any problems with, at least
so far.

Maybe the word "applicable" covers this, though IANAL, so I
worry!

First there are is the issue of jurisdiction, i.e. who decides
that the holder should lose their IPs?  The court?  The ARIN
staff?  How does ARIN discover that the situation has arisen?
Do courts routinely notify ARIN of such situations, or does
someone have to complain?

Second is the issue of scope.  I don't think I should lose my
IP addresses because my company failed to shovel its front walk
within 12 hours of a snow storm!  In fact, I would have problems
with this for virtually any criminal activity that wasn't
internet-related.  Sure, if someone was spoofing other peoples
IP addresses or injecting bogus routes or actively trying to
crack competitor's networks, but what about something like
tax fraud or OSHA violations?

Third is I don't think ARIN should become an instrument of
state suppression of freedom of speach, press, or association.
For example, I don't think ARIN should be in a position of
aiding the US Govt in prosecuting the New York Times, the
Washington Post, or the Boston Globe for publishing the
Pentagon Papers.  (I think they were all ultimately forced
to pay a fine and desist from further publication, until the
whole case became moot, but under these rules, would they
have lost their internet access?)  If ARIN were ordered
by a court to revoke the allocations, I don't see it would
have any choice, but I don't think it should be doing this
on its own initiative.

(A more current example would be if Amnesty International
was to publish secretly-obtained interviews with Gitmo
prisoners, and the US Govt went after it.)

Perhaps "applicable" covers all these areas, or maybe there
implicitly has to be a court order, with due process, all
possibility of appeals exhausted, etc.


> 4. 4(d)(iii) Legacy holder "assist(s) any third party in engaging 
> in any activity prohibited by this Legacy Agreement."

Assuming all protections that apply to the previous section
also apply here, this would be okay.  Otherwise it is the
possibility of an end-run around 4(d)(ii).


> 5.  6(b)(ii) Legacy holder falls more than a year overdue on 
> maintenance fees (which are substantially capped).  ARIN may stop
> providing Services without revocation, and in any case must allow
> an additional year for the holder to make good before reassigning
> the numbers.
> 6. 5(a) - (c) Legacy holder misuses ARIN's database
> 7.  14(b)(ii) Breach of contract that remains uncured for 30 days
> 8.  14(a) Legacy holder decides to terminate the contract for 
> convenience.  Note that ARIN cannot terminate for convenience in
> LRSA 2.0.
> 
> Please let me know if I've missed or mistated any scenarios; it's 
> entirely possible and not intentional.  I'm just reading along 
> like everyone else.
> 
> 
> Now, I understand that some people believe they have an
> inviolable right to maintain their resources under all 
> circumstances.  I believe that if a legacy holder violates the
> trust of the community, the community ought to have recourse.
> The community founded ARIN, to operate the registry and reverse
> DNS, and to facilitate community development of policies for
> stewardship of numbers, and to do what is needed to support 
> that mission.  It seems to me that the termination clauses are 
> trying to protect ARIN's ability to serve the community and 
> fulfill its mission.
> 
> I think ARIN has come pretty far with this new LRSA, trying to
> protect both legacy holders and the rest of the community.  I 
> appreciate the participation on this list by so many people 
> responsible for legacy address space, when many of the 
> policies developed will not ultimately affect you.  I 
> acknowledge the concession many of you have made, in 
> willingness to support ARIN financially.  I respect the 
> contributions legacy holders have made to the development and growth of
> the Internet.  I hope you can see the Legacy RSA, 
> which was designed to offer greater assurance to the legacy
> holder than the conventional RSA, as a tool for protecting the 
> community's broader interest.
> 
> I must be clear, that I do not represent ARIN any more than 
> any other community member when it comes to the LRSA.  I hope
> that everyone with questions about the LRSA will call the 
> Registration Services Help Desk at +1.703.227. 0660 or send 
> email to hostmaster at arin.net, or with specific legal questions, 
> contact ARIN General Counsel, Steve Ryan, at sryan at mwe.com. 
> 
> 
> Lee
> 

-- 
John Santos
Evans Griffiths & Hart, Inc.
781-861-0670 ext 539