[arin-ppml] ARIN-prop-150 Reclamation Hold

[Owen DeLong]

On May 13, 2011, at 11:00 AM, Matthew Kaufman wrote:

> On 5/13/2011 10:50 AM, Owen DeLong wrote:
>> On May 13, 2011, at 8:48 AM, Matthew Kaufman wrote:
>> 
>>> On 5/13/2011 8:38 AM, William Herrin wrote:
>>>> On Fri, May 13, 2011 at 9:49 AM, ARIN<info at arin.net>   wrote:
>>>>> ARIN-prop-150 Reclamation Hold
>>>>> Proposal Originator: Matthew Kaufman
>>>>> 
>>>>> Add a new section to the NRPM:
>>>>> "All resources reclaimed by ARIN shall not be returned to the free pool
>>>>> or otherwise reassigned to any entity than the original registrant for a
>>>>> period of 36 months."
>>>> LIRs are prevented from implementing this sort of policy since such
>>>> reserved addresses do not count towards their utilization. What
>>>> problems are solved by implementing this policy at an RIR level but
>>>> requiring LIRs to not implement the same?
>>> LIRs have direct circuit-level (or equivalent) relationships with the address users. RIRs do not.
>>> 
>> Not necessarily true. As was pointed out in the opposition to my prop. 139
>> there are several instances of LIRs without circuit-level relationships.
> 
> Yes, but even in those cases the agreements are much more specific.
> 
I find your omniscience about the nature of all of the various agreements out there
to be most interesting (and unlikely).

>>> It would be very unusual for someone to have provider-assigned space and no ongoing contact or billing relationship with the provider, whereas legacy space in ARIN's database is exactly like that.
>>> 
>> I can point to more than 100,000 users without a billing relationship that
>> have address assignments from at least one provider, so, I don't think
>> that is as unusual as you claim. Some of these users have just over 18
>> quintillion addresses, while others have 66,537 times that much or
>> even more.
> 
> And do the terms of service they agreed to allow their provider to reclaim the address space from them immediately and give it to someone else? If so, fine. But that's not what legacy holders agreed to when they received their allocations.
> 

I'm actually not sure. I would have to review our ToS.

Legacy holders agreed that their assignments were for a specific purpose
and that they should return those addresses when that purpose ended.
They also agreed that the addresses were not transferable other than
through merger/acquisition of the underlying infrastructure and addresses
together (as in acquiring the intended purpose in its entirety).

The unfortunate problem is that these were implied agreements among what
at the time was a cooperative and friendly community that operated largely
on handshakes without the formality of contracts or even real documentation
for the most part. It was a very different era in the internet and the current
state of affairs had not yet been envisioned or considered, so, we ended up
unprepared for it.

Frankly, ARIN does not reclaim address space "immediately" even today.
The spend time investigating and they attempt to reach the registered PoCs.
If those PoCs are responsive, ARIN spends considerable time working with
them to see if there is any identifiable way for them to keep the resources
within the ARIN policies. Only after that does a reclamation or revocation
begin.

Even then, reclaimed or revoked addresses enter a minimum 6-month
hold-down after they are reclaimed or revoked.

>>>> 
>>>>> This provides sufficient time for the resources to go unused
>>>>> prior to reassignment and/or to be re-justified by the original
>>>>> registrant, or returned to the proper holder in the case of hijackings.
>>>> This could be solved with a much weaker requirement: "ARIN shall not
>>>> reallocate recovered address space while its status is under dispute
>>>> by a prior registrant."
>>> How can the prior registrant initiate a dispute in time if they weren't aware of a hijacking and subsequent immediate reclaimation?
>>> 
>> Arguably if they were not aware, then, they were not "using" their
>> resources.
> 
> They could very well be "using" their resources for exactly the sorts of things that were permitted when they received their space... like using them internally for a network that is not directly connected to the Internet at this time.
> 

That is actually still permitted. However, frankly, it's a corner case at best and is dealt with in the next paragraph:

>> However, if they have followed policy and kept their
>> POCs up to date, the POCs would have been notified well
>> before the "immediate" reclamation which usually takes at least
>> 6 months.
> 
> If their POCs hadn't been changed without them knowing that. Or lost due to a DNS lapse that was exploited by the hijacker. Etc, etc.
> 

When you change a PoC, the original PoC is notified, so, if their PoC data was valid at the time it was changed, they know.
It would take a 3-day or longer DNS lapse for that to be the case.

Another safeguard that could be employed, of course, would be to sign the LRSA. Then, at the very least you would notice
when you stopped receiving a bill every year.

I'm sorry, but, if you have resources and you don't periodically monitor the state
of their contact information, then, you are not being a responsible resource holder
and I have a very limited amount of sympathy for you.

I certainly don't have enough sympathy to keep resources out of circulation for
three years waiting for you to miraculously and suddenly start paying attention.

Owen

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.arin.net/pipermail/arin-ppml/attachments/20110513/1b3ae822/attachment.htm>