[arin-ppml] IPv4 Transfer Policy Change to Keep Whois Accurate

[Owen DeLong]

On May 11, 2011, at 7:31 PM, John Curran wrote:

> On May 11, 2011, at 6:37 PM, Owen DeLong wrote:
> 
>> There is no reason that ARIN, upon conducting a section 12 review and finding that the original holder was
>> no longer using the resources and/or was defunct could not reclaim those resources, so, the recipient in that
>> case is taking a rather large risk. I do not believe ARIN will view the asset sale agreement as legitimizing
>> the transfer and the community developed policies support reclamation of resources from defunct legacy
>> holders. ARIN has reclaimed such resources in the past, though I do not know if they have reclaimed them
>> from organizations who believe they were able to "purchase" them as part of some form of asset transfer.
> 
> We have not done so to date (as far as I am aware, and I would
> have very likely have been made aware of any action to do so)
> 
I realize this. I believe the community would like to see that change.

> We have reclaimed in cases where parties have asserted that 
> they have the right to use specific resources due to merger
> or acquisition, could not produce any paperwork, and then the 
> original address holder turned out to be defunct or denied 
> that any transfer was intended.  These cases almost always 
> involve recipient parties that then quickly disappear rather 
> than further pursue the matter, and similar indications of 
> hijack attempts.
> 
The difference between this and what I describe above is subtle at
best.

> While I recognize that ARIN could theoretically reclaim
> address space from a defunct legacy address holder where 
> the successor organization simply does not wish to update
> their records per M&A transfers (NRPM 8.2), that course 
> of action appears to me to be more punitive than actually
> advancing the mission of the organization.  The record
> keeping subsequent to an merger/acquisition often does 
> not get cleaned up for several years subsequent to the
> actual event, and first we would need to set a realistic
> community shared expectation regarding how much time is 
> to be allowed for record updating, and the appropriate
> intermediate steps along the path between "please come
> in and update your records" and "we have reclaimed the
> number resources that you thought were assigned to you"
> 
I disagree. I have no problem with ARIN extending an offer
to complete an 8.2 transfer and sign a current standard RSA
substantially similar to that any organization receiving new
resources would sign, if ARIN believes they are a legitimate
8.2 successor in interest.

I have no problem with ARIN extending an offer to complete
an 8.3 transfer and sign a current standard RSA substantially
identical to that any organization receiving new resources would
sign, if ARIN believes the transfer meets the requirements
outlined in section 8.3.

However, if an organization refuses to update whois and/or
refuses to sign the standard RSA and they are not the
original resource holder, then I fail to see how ARIN can
consider the space anything other than hijacked and I believe
that in the interests of keeping whois consistent and following
the policies set by the community for the management of
the whois database, the original registration pointing to
the defunct organization should be removed and the addresses
should be placed back into the free pool for allocation to
another organization in compliance with policy.

This is not punitive, it is merely intended to avoid allowing
those operating outside of policy to retain resources in a
manner contrary to the policies set by the community.

As I have said before, I do not support punitive approaches
to legitimate legacy holders. However, I do not believe that
legacy resources are arbitrarily transferable without restriction
and I see no reason ARIN should recognize such transfers
unless the community specifically expresses a desire to do
so through policy. As it currently stands, the community has
expressed a fairly clear desire not to allow such arbitrary
transfers without needs justification.

> By no means is this an encouragement for folks post-merger 
> to skip updating their records at ARIN, but simply pointing 
> out that we would need to have some compelling community 
> guidance before changing the existing practices in this area.  

You are talking about mergers, whereas I was responding to
a message where Mike had described sales of address space
completely outside of policy and without involving sale of the
underlying infrastructure.

> We are seeing more 8.2 updates as a result of folks realizing 
> the importance of their number resources, and some as a result 
> of interest in performing transfers, and this is definitely 
> a step in the right direction for improving registry accuracy.
> Creating a potential risk that ARIN would decide instead to
> reclaim resources from part M&A activity would more likely
> to inhibit rather than encourage updates.
> 
That is not what I was advocating.

However, I do think that other than the original legacy holder,
nobody should be allowed to retain their registration without
signing a current standard RSA as described above.

Owen