[arin-ppml] IPv4 Transfer Policy Change to Keep Whois Accurate

[Tom Vest]

On May 15, 2011, at 2:13 PM, Mike Burns wrote:

> Hi Tom,
> 
> I don't think we will have to rely on "moments of controlled disclosure" you describe, involving NDA-covered private network information to the local registrar, simply to have accurate contact information.
> Why?
> Because proper registration is going to be the effective proof of ownership.
> As the value of control of  IP assets becomes more widely known, and higher, in the face of free pool exhaust, those who control these rights will be motivated by their desire to publicy record their rights in a registry.

That outcome may be "guaranteed" by some theory about the connection between property and incentives, but it is not well supported by any facts that anyone might plausibly regard as relevant to this case. One counterexample is provided by the case of HM Land Registry that I already mentioned. There's hasn't been any "free land" in the UK since the Enclosures, and I doubt anyone would dispute that UK land has appreciated in value -- or that squatters are a risk -- and yet those facts alone haven't been sufficient to motivate a substantial share of UK landowners to participate in a (before 2009) 100% free registry with no barriers to entry. 

> When addresses are free, conflict over their control is limited, and proof of ownership much less important.

Really? Would anyone on nsp-sec care to chime in to respond to the claim that conflicts over the "control of IP addresses" haven't been much of problem over the last two decades?

For the purposes of both this particular claim, and *your own proposal*, the alleged primary concern is "whois accuracy,"  and the alleged (secondary) contributor to that end is ownership by those who are unable or unwilling to undergo a nee/capability test. Let's stick to your own proposal, because debating philosophy will not be productive.

> When conflict rises, along with value, and there is no tangible "certificate of control", getting the authoritative registry recognition is more important.
> I believe John Curran referenced an increase in the processing of old 8.2 Transfers, cleaning up old mergers, which I take to be an indication of the motivation I am describing here.
> 
> Therefore,  x: (NOT current RSA signatories + NOT willing/able to undergo a need/capability test + ARE certain to self-maintain the quality of their own whois information at historically unprecedented  high levels in perpetuity) is the population I intended to reach with this proposal.

Even if I believed that you're right on this point, my original analysis stands. Your goal is create a positive incentive for some unknown minority segment of unregistered future transfer seekers to abide by registration policies,  at the cost of changing a key element of those policies that contributes to the preservation of whois data accuracy across every other segment of existing and future address users. 

But you and I both know that the the sort of property purists that you have used to illustrate the merits of this policy are also very likely to be privacy purists too. So while they may be only too eager to register, their whois entries are likely to consist of nothing more than "Address Owner Inc." plus "thisprefixcouldbeyours$$$@anonymous.com). As first-time registrants who have never had, and would never expect to have any "nontrivial" interaction with the RIR, any information that they'd be likely to share would carefully tuned to maximize their own private advantage with no other considerations whatsoever. 

> They will have every incentive to keep their information registred correctly, if only to increase its resale value.

Okay, on that narrow point we agree: aspiring speculators and address flippers are more likely to register, albeit in the manner described above. But the stronger that incentive is, the more likely it is that the addresses in question are kept out of "real production" anyway (the fastest flipper gets the worm!), or alternately that the content of their 100% accurate registrations have no actual value for operational coordination purposes. 

Outside of address flippers, many prospective address buyers may wish to register with ARIN, but many may not. Of all the reasons that they might prefer registration over non-registration, or vice versa, the burden of a needs/capability test will almost certainly rank pretty low on that list for most. And for the overwhelming majority for whom this is more than a marginal concern, removing the need/capability test is not going to tip the scales in favor of meaningful registration.  

> You call them Saints. I call them normal humans who want some evidence of their valuable control rights.

I guess someone should call the Prime Minister and warn him about the millions of abnormal humans that have been roaming the Brisitsh countryside for the last few centuries. 

Seriously, most of the normal humans that I encounter aren't driven by a monomaniacal fixation on establishing and reaffirming evidence of their valuable control rights every moment of every day. Sometimes they forget things, sometimes they get overwhelmed with more immediate demands. I find that many normal humans can rationalize failures to prioritize the reaffirmation of their precious control rights almost indefinitely if they can get away with it -- especially if the act of reaffirming those rights entails waiting in line, filling out forms, being questioned about sensitive personal matters by strangers whose interests and incentives are suspect, or generally spending even the smallest time or effort doing anything outside of what they would classify as "work" or "fun." It's just human nature -- at least among the normal humans that I know. 

> All your groups, x,y,and z will likely keep their registration more updated than they have historically as the value of their holdings becomes clearer to all.

Could you please cite something other than theory that supports this expectation? 

> If I have a new business plan that I am pitching to investors, and if my projected growth plan includes a need for increasing IPv4 addresses over the next 24 months, what do I say to the investor who asks how I will get those addresses and what they will cost?

First thing I'd do is redirect them with an offer to put them into some fine ocreanfront property in Kansas -- because if they're going to fund your IPv4-dependent growth plan, they'll probably bankroll anything.

> If I could purchase 24 months supply on the transfer market now, but would have to keep ARIN in the dark, and know that I could get the addresses routed by submitting the purchase document to my network provider,  why wouldn't I do that, and isn't it clear that Whois accuracy will suffer?
> Is this situation so unworldly that it can't be envisioned?
> The sole limitation to getting this transaction registered is the ARIN needs test for transfers.
> 
> I think it's really quite a stretch to think the needs requirement increases registration accuracy, as you imply.

You are at liberty to doubt. I'm not. 

> Remember, if ARIN is doing a needs analysis for somebody, it's because they have already been contacted in reference to the desire to have ARIN book a transfer, right? So if they have already done that, why does the needs requirement enchance contact information accuracy?
> I don't see the logic there.

Please refer to my previous message for a fuller accounting of the various beneficial effects of the need/capability requirement; those other benefits would still apply even for aspiring new address flippers who have been completely open and forthcoming with respect to their whois-related information. 

Regards, 

Tom
 
>  Regards,
> Mike
> 
> 
> 
> ----- Original Message ----- From: "Tom Vest" <tvest at eyeconomics.com>
> To: "Mike Burns" <mike at nationwideinc.com>
> Cc: "Owen DeLong" <owen at delong.com>; <arin-ppml at arin.net>; "Paul Vixie" <vixie at vix.com>
> Sent: Sunday, May 15, 2011 11:34 AM
> Subject: Re: [arin-ppml] IPv4 Transfer Policy Change to Keep Whois Accurate
> 
> 
> 
> On May 12, 2011, at 1:26 PM, Mike Burns wrote:
> 
>> Hi Owen,
>>> 
>>>> I still don't see the connection between my proposal to drop needs requirements for transfers and the participation rate of DNS whois or the UK land office.
>>>> I may be missing something obvious, though.
>>> 
>> 
>>> I believe he is arguing that if you turn address policy into a free-for-all (as in your proposal), like
>>> DNS, it will decrease, rather than increase whois accuracy. I hadn't thought of this consequence, but,
>>> now that Tom and Paul have brought it up, it does make sense.
>> 
>> 
>> I am still missing the connection between removing needs requirements for transfers and having that decrease whois accuracy.
>> If you can connect the dots, you will go a long way in convincing me that my proposal is flawed.
> 
> Hi Mike,
> 
> Again, apologies for the delayed response. I tried to clarify the connection in my message of May 13, 2011 12:04:39 PM EDT (specifically, @ bullet points 3 and esp. 4). But that was a long message that also covered several other reasons why the so-called "needs" (which IMO should be "capability") requirement is important which are completely independent of its relevance to whois accuracy, and perhaps I wasn't clear enough on the specific one that interests you.
> 
> Basically, the need/capability test facilitates the ongoing maintenance/preservation of whois accuracy because it assures that each subsequent allocation/assignment (and in the future, each transfer transaction) will trigger the same kind of "moment of controlled disclosure" that occurs when a new entity joins an RIR and/or requests an initial allocation. As a group, network operators -- and esp. growing ones --  undergo the sort of internal changes (e.g., reorgs, relocations, new sites, new non-M&A commercial partnerships, et al.) that can trigger changes in their external contact details fairly frequently. For all sorts of reasons that are mostly banal (oversights, procrastination, impatience with "bureaucracy," miscommunication, someone else's job, thought they were already informed, etc.), the RIRs don't always "get the memo" at the time when such changes occur -- or even afterward, during subsequent "casual" interactions. Absent other countervailing factors, such changes would cause the overall quality of registration data to degrade progressively over time, with the more dynamic/faster growing networks typically leading the way down.
> 
> What prevents (or at least substantially mitigates) this progressive decay is the policy-mandated needs/capability test requirement. That requirement assures that each subsequent interaction between registrants and the RIR that could materially alter the distribution of IP number resources *will not* be "casual" in the above sense, but rather will (typically) involve some presentation of documents which illustrate the existence and size of the new addressing requirements. The review of such materials -- which frequently include invoices for new network-related assets or similar documents that show buyer address and other contact info -- provides a formal opportunity for RIR and registrant representatives to make sure that they're on the same page with respect to all current contact information.
> 
> So, to put this explicitly in the context of your proposal:
> 
> The exhaustion of the unallocated IPv4 pool is not going to reduce the frequency with which address registrants undergo the sort of internal changes that can make some or all of their current whois contact details outdated -- if anything it might make those changes happen more frequently. Thus, in order for whois data quality to be preserved going forward at (at least) current accuracy levels, the current practice of making each subsequent address-related transaction subject to a mandatory needs/capability capability review must continue.
> 
> In order for your proposal to have *any chance at all* of causing a net improvement in whois data quality, the number of future Pv4 transfer seekers that are
> 
> x: (NOT current RSA signatories + NOT willing/able to undergo a need/capability test + ARE certain to self-maintain the quality of their own whois information at historically unprecedented  high levels in perpetuity)
> 
> ...would have to exceed the sum of other kinds of future address seekers, including those who are:
> 
> y: (NOT current RSA signatories + ARE willing/able to undergo a need/capability test + NOT certain to self-maintain the quality of their own whois information at historically unprecedented high levels in perpetuity)
> 
> z: (ARE current RSA signatories + (n/a) + NOT certain to self-maintain the quality of their own whois information at historically unprecedented high levels in perpetuity)
> 
> Logically, the universe of potential future address seekers is complete characterized by (x + y + z) as described above, plus two other groups that, hypothetically, wouldn't be affected either way by your proposal:
> 
> Incorrigibles: (NOT signatories + NOT willing + NOT self-maintaining)
> 
> Saints: (ARE signatories + (n/a)+ ARE self-maintaining)
> 
> [Note: I say "hypothetically" above because I actually believe that the adoption of this policy would undermine an existing community "norm" of whois participation that currently contributes to "irrationally" high data quality across current registrants -- and as a result your policy would cause average levels of whois "self-maintenance" to decline across all groups. But that possibility is not factored into this analysis]
> 
> Assuming that "saints" and "incorrigibles" would be equally represented across both current ARIN members/RSA signatories and future address seekers (and excluding any possible "normative" affects), your proposal would only be net positive at the point where ((non-Saint, non-Incorrigible x)) exceeds (non-Saint, non-Incorrigible (y+z)). Given the size of the current ARIN membership, the only way this pans out in your favor if 90%+ of current members and 90%+ of future address seekers actually fall into the "Saint" or "Incorrigible" category.
> 
> But of course, this assumption would also mean that your policy (and all policies, more-or-less) are almost complete irrelevant.
> 
> Happily, I believe that  those demographic assumption are grossly inconsistent with both RIR administrative experience and with the documented record of RIR community-policy interactions over the last 20 years.
> 
> Hence, I am opposed.
> 
> TV
> 
> 
>>>> My whole goal is to increase accuracy in Whois, and I am not relying on any financial or price mechanism for that increase.
>>> 
>> 
>>> And now there is evidence that your proposal would likely have the opposite effect.
>> 
>> What evidence?
>> 
>>>> I have not argued that pricing will increase registration, I have argued that pricing will ensure productive use.
>>> 
>> 
>>> Which also remains in dispute and unproven.
>>> Owen
>> 
>> Hence the word argued.
>> 
>> 
>> Regards,
>> Mike
>