[arin-ppml] Draft Policy 2009-1: Transfer Policy - Staff Assessment

[Member Services]

Draft Policy 2009-1
Title: Transfer Policy
Date Submitted: 24 March 2009
Date of Assessment: 21 April 2009


ARIN Staff Assessment

The assessment of this draft policy includes comments from ARIN staff
and the ARIN General Counsel. It contains analysis of procedural, legal,
and resource concerns regarding the implementation of this draft policy
as it is currently stated. Any changes to the language may necessitate
further analysis by staff and Counsel.

I. Draft Policy

Available below and at:
https://www.arin.net/policy/proposals/2009_1.html

II. Summary

ARIN staff understands that this policy provides a new definition in
NRPM for the term organization, modifies the structure of the Transfer
policy (NRPM 8), adds a new condition to the Transfer policy that allows
an authorized resource holder to transfer number resources via ARIN to a
recipient who can justify the resource(s) under a current ARIN policy,
and changes the criteria established by 2008-6 to include: opens
transfers to all number resources (IPv4, IPv6 and ASNs), removes the
sunset clause, and requires that the resource holder and recipient be
within the ARIN region.

III. Comments

A. ARIN Staff

1. In section 2.8, the term organization is defined as one “parent”
organization be responsible for all of its associated companies’ or
subsidiaries’ interactions with ARIN. Today ARIN allows companies and
their subsidiaries to open multiple accounts in order to accommodate
their network needs, completely independent of their organization/legal
structure. If this definition is applied exactly as written, it could
affect many policies in NRPM that contain the term organization and
could also affect ARIN’s customers ability to manage their networks
independently.
2. In Section 8.2, the word “affecting” should be changed back to
“effecting”.
3. In Section 8.3, we recommend changing "by any authorized resource
holder" to "by the authorized resource holder," for additional clarity.
4. Section 8.3 states that the recipient must “demonstrate the need for
such resources in the exact amount which they can justify under current
ARIN policies.” (This criterion was initially defined in 2008-6 and was
carried over into 2009-1). Current ARIN policies do not allow the
issuance of /23s and /24s with the exception of the micro-allocation
policy. As written, this policy would exclude /23s and /24s from being
transferred.

B. ARIN General Counsel

The core of 2009-1 is an NRPM friendly restatement of the policy sent to
the Board by the AC. It contains several language changes suggested by
counsel and others from Board members. The proposed policy significantly
reduces legal risks, fees and expenses for ARIN. Facts available
indicate a nascent black market in number resource transfers has begun,
transfers are being made in contravention of ARIN policy, and these
would continue to expand in number and importance absent immediate
implementation of a policy like 2009-1. By providing a clear transfer
policy, consistent with RFC 2008 and RFC 2050, 2009-1 will also result
in the appropriate and useful transfer of unused or under utilized IPV4
number resources to organizations who need them. Therefore, it may
provide a critical cushion of time for recipients of resources who
utilize the policy in the period when exhaustion of new IPV4 resources
is becoming imminent or is occurring. This is consistent with ARIN's
mission with regard to fair allocation. The new policy also provides a
substantial beneficial reason for legacy holders to sign LRSAs, which,
in turn, will provide important benefits to ARIN, the law enforcement
community, and Internet community.

One aspect of 2009-1 is materially different from 2008-6 – specifically
the three year sunset provision in 2008-6 has not been included. Counsel
did not ask for this change, but believes it is useful from a legal
perspective. The deletion of the sunset provision means a mandatory
review of the policy does not have to be undertaken at a single fixed
point in time chosen now. I believe this policy is likely to be
reconsidered and amended several times before the three year sunset
provision is reached, assuming it is adopted. This three year sunset
provision was not tied to a specific rationale, such as the date of
expected exhaustion of RIR issuance of IPV4 space, or a year after that
date. The stability of a transfer policy without such a predetermined
sunset provision is legally preferable, absent a compelling and
particular reason why the sunset date chosen is important. The sunset
provision did not further any legal objective. Since this policy, if
completed , can be amended or repealed at any point, and sunset
provisions have not been routinely utilized to require reevaluation of
controversial ARIN policies, the absence of a sunset provision is
legally preferable.' Counsel has no position on the definition of
organization.

IV. Resource Impact – Moderate

The resource impact of implementing this policy is viewed as minimal. It
is estimated that this policy may require up to 90 days to implement
following ratification by the ARIN Board of Trustees. It may require the
following:

• Guidelines Changes
• Staff training
• All internal registration procedures to be rewritten in order to
accommodate the new definition of organization.

Regards,

Member Services
American Registry for Internet Numbers (ARIN)


##*##


> Draft Policy 2009-1
> Transfer Policy
>
> Originator: ARIN Board of Trustees (using the Emergency PDP provision in
> the ARIN Policy Development Process)
>
> Date: 24 March 2009
>
> Policy statement:
>
> Insert into the ARIN Number Resource Policy Manual as follows:
>
> Add Section 2.8:
>
> “Organization. An Organization is one or more legal entities under
> common control or ownership.”
>
> Replace Section 8 as follows:
>
> 8. Transfers
>
> 8.1. Principles
> Number resources are non-transferable and are not assignable to any
> other organization unless ARIN has expressly and in writing approved a
> request for transfer. ARIN is tasked with making prudent decisions on
> whether to approve the transfer of number resources.
>
> It should be understood that number resources are not "sold" under ARIN
> administration. Rather, number resources are assigned to an organization
> for its exclusive use for the purpose stated in the request, provided
> the terms of the Registration Services Agreement continue to be met and
> the stated purpose for the number resources remains the same. Number
> resources are administered and assigned according to ARIN's published
> policies.
>
> Number resources are issued, based on justified need, to organizations,
> not to individuals representing those organizations. Thus, if a company
> goes out of business, regardless of the reason, the point of contact
> (POC) listed for the number resource does not have the authority to
> sell, transfer, assign, or give the number resource to any other person
> or organization. The POC must notify ARIN if a business fails so the
> assigned number resources can be returned to the available pool of
> number resources if a transfer is not requested and justified.
>
> 8.2. Mergers and Acquisitions
> ARIN will consider requests for the transfer of number resources in the
> case of mergers and acquisitions upon receipt of evidence that the new
> entity has acquired the assets which had, as of the date of the
> acquisition or proposed reorganization, justified the current entity's
> use of the number resource. Examples of assets that justify use of the
> number resource include, but are not limited to:
>
> • Existing customer base
> • Qualified hardware inventory
> • Specific software requirements.
>
> In evaluating a request for transfer, ARIN may require the requesting
> organization to provide any of the following documents, as applicable,
> plus any other documents deemed appropriate:
>
> • An authenticated copy of the instrument(s) affecting the transfer of
> assets, e.g., bill of sale, certificate of merger, contract, deed, or
> court decree.
> • A detailed inventory of all assets utilized by the requesting party in
> maintaining and using the number resource.
> • A list of the requesting party's customers using the number resource.
>
> If further justification is required, the requesting party may be asked
> to provide any of the following, or other supporting documentation, as
> applicable:
>
> • A general listing of the assets or components acquired
> • A specific description of acquisitions, including:
>
> o Type and quantity of equipment
> o Customer base
>
> • A description of how number resources are being utilized
> • Network engineering plans, including:
>
> o Host counts
> o Subnet masking
> o Network diagrams
> o Reassignments to customers
>
> 8.3 Transfers to Specified Recipients
> Number resources may be released, in whole or in part, to ARIN for
> transfer to another specified organizational recipient, by any
> authorized resource holder within the ARIN region. Such transferred
> number resources may only be received by organizations that are within
> the ARIN region and can demonstrate the need for such resources in the
> exact amount which they can justify under current ARIN policies.
>
> #####
>
> Notes:
>
> Most of the existing Section 8 is left unchanged. List of changes:
>
> 2.8 New.
> 8.1 Changes from “Transfers” to “Principles.”
> 8.2 Changes from “Transfer Requirements” to “Mergers and Acquisitions.”
> 8.2 The word “only” is removed.
> 8.3 Merged up into 8.2.
> 8.3 Edited version of the adopted 2008-6.
>
>