[arin-ppml] IPv4 Transfer Policy Change to Keep Whois Accurate

[Mike Burns]

Hi Tom, responses inline.

>That outcome may be "guaranteed" by some theory about the connection 
>between property and incentives, but it is not well supported by any facts 
>that anyone >might plausibly regard as relevant to this case. One 
>counterexample is provided by the case of HM Land Registry that I already 
>mentioned. There's hasn't been >any "free land" in the UK since the 
>Enclosures, and I doubt anyone would dispute that UK land has appreciated 
>in value -- or that squatters are a risk -- and yet >those facts alone 
>haven't been sufficient to motivate a substantial share of UK landowners to 
>participate in a (before 2009) 100% free registry with no barriers to 
> >entry.

My evidence is John Curran saying there has been an uptick in 8.2 transfer 
requests that reflect old transfers. Pretty direct evidence, isn't it?
Maybe since this is ARIN, an example familiar to Americans may be a more 
effective analogy than the HM Land Registry?

>> When addresses are free, conflict over their control is limited, and 
>> proof of ownership much less important.

>Really? Would anyone on nsp-sec care to chime in to respond to the claim 
>that conflicts over the "control of IP addresses" haven't been much of 
>problem over the >last two decades?

My point was that whatever conflict there has been will increase 
post-exhaust. And please don't change my language. I said limited, not 
"haven't been much of a problem over the last two decades." Conflict has 
been limited, compared to pre-exhaust,  by the low replacement cost, and the 
lack of resale value.


>For the purposes of both this particular claim, and *your own proposal*, 
>the alleged primary concern is "whois accuracy,"  and the alleged 
>(secondary) contributor >to that end is ownership by those who are unable 
>or unwilling to undergo a nee/capability test. Let's stick to your own 
>proposal, because debating philosophy will >not be productive.

Tom, you have led the discussion astray twice now, with a deviation to 
private DNS registries, and now an argument over how likely people will be 
to register their addresses post-exhaust.

Neither of these issues is related to my proposal to lift needs on 8.3 
transfers, let us please stick to that.
I have given clear and multiple examples of transactions which have 
incentives for buyers and sellers to engage, but which would fail the needs 
analysis.
You have provided no information that I can find which connects the needs 
requirement to better accuracy.
Do you have any evidence of that to counter the claims I make about natural 
transactions between buyers and sellers which does not meet the needs 
requirement, but which buyers and sellers would voluntarily want to engage 
in, and the likelihood they will do the deal "off the books"?


>> When conflict rises, along with value, and there is no tangible 
>> "certificate of control", getting the authoritative registry recognition 
>> is more important.
>> I believe John Curran referenced an increase in the processing of old 8.2 
>> Transfers, cleaning up old mergers, which I take to be an indication of 
>> the motivation I am describing here.
>
>> Therefore,  x: (NOT current RSA signatories + NOT willing/able to undergo 
>> a need/capability test + ARE certain to self-maintain the quality of 
>> their own whois >>nformation at historically unprecedented  high levels 
>> in perpetuity) is the population I intended to reach with this proposal.

>Even if I believed that you're right on this point, my original analysis 
>stands.

You're analysis is flawed from get-go because it involved the incentive for 
others to register, who could pass the needs requirement. There is no 
argument that those people will participate and Whois accuracy will be 
maintained at least at current levels. My proposal is specifically designed 
to extend the range of transactions for which ARIN will be contacted to 
update WHois registration.

>Your goal is create a positive incentive for some unknown minority segment 
>of unregistered future transfer seekers to abide by registration policies, 
>at the cost of changing a key element of those policies that contributes to 
>the preservation of whois data accuracy across every other segment of 
>existing and future address users.

How does dropping the needs requirement for transfer of IPv4 address space 
change the "preservation of whois data accuracy across every other segment 
of existing and future addess holders"? You assert this without any support 
that I can discern.
How does dropping 8.3 needs requirements change whois data accuracy for 
existing RSA holders who don't wish to sell?
Existing RSA holders who do wish to sell?
IPv6 holders?
There are three segments of existing address users, how is their Whois 
accuracy degraded by my proposal?


>But you and I both know that the the sort of property purists that you have 
>used to illustrate the merits of this policy are also very likely to be 
>privacy purists too. >>So while they may be only too eager to register, 
>their whois entries are likely to consist of nothing more than "Address 
>Owner Inc." plus >thisprefixcouldbeyours$$$@anonymous.com). As first-time 
>registrants who have never had, and would never expect to have any 
>"nontrivial" interaction with the >RR, any information that they'd be 
>likely to share would carefully tuned to maximize their own private 
>advantage with no other considerations whatsoever.

Tom, are you calling the guy pitching the 24 month plan to investors a 
"property purist"? Is that supposed to be a perjorative?
Now they are "only too eager to register", where in your last post, they 
would have had to have been Saints?
And if they register with false information, it hinders the resale value of 
the addresses, and the debases the very reason why they would be so eager.
Their private advantage is aligned with whois accuracy, as they want 
acknowledgement of their valuable control rights, and Whois is the trust 
authority whose registration provides evidence of their ownership.
This is the same reason hijacking addresses would be more difficult, because 
the owners would be more diligent in maintaining control over valuable 
assets than they currently have been, as has been noticed by another poster 
here.

>> They will have every incentive to keep their information registred 
>> correctly, if only to increase its resale value.

>Okay, on that narrow point we agree: aspiring speculators and address 
>flippers are more likely to register, albeit in the manner described above.
>But the stronger that incentive is, the more likely it is that the 
>addresses in question are kept out of "real production" anyway (the fastest 
>flipper gets the worm!), or >alternately that the content of their 100% 
>accurate registrations have no actual value for operational coordination 
>purposes.

So you acknowledge that certain buyers will want to register, but would be 
precluded by the needs requirement. Thank you.

>Outside of address flippers, many prospective address buyers may wish to 
>register with ARIN, but many may not. Of all the reasons that they might 
>prefer >registration over non-registration, or vice versa, the burden of a 
>needs/capability test will almost certainly rank pretty low on that list 
>for most. And for the >overwhelming majority for whom this is more than a 
>marginal concern, removing the need/capability test is not going to tip the 
>scales in favor of meaningful >registration.

I wouldn't consider the 24-month business pitchers I gave as an example to 
be "address flippers" and I note your frequent use of what you consider to 
be perjorative descriptions which I think is an effort to appeal to emotion 
more than logic in youir argument.
I don't think registration is going to be a "marginal concern" when 
addresses have substantial resale value. On the contrary, and again I refer 
to John mentioning the uptick in 8.2 transfers which occured some time in 
the past as evidence for the increased value associated with correct 
registration.
Care to directly address the example of the sage investor seeing a flaw in 
the business plan being pitched to him which requires more addresses than 
the current ARIN needs requirement allows? With my proposal, there is no 
such flaw, the plan gets approved, and people get put to work. Without my 
proposal, the FUD factor about a basic requirment's future availability 
overrides, the deal is canceled, the jobs do not get created. Or, the sage 
investor is told that a purchase can be made, but can not be registered in 
Whois. There is uncertainty here, too, for an investor, and for whois 
accuracy.

>> You call them Saints. I call them normal humans who want some evidence of 
>> their valuable control rights.

>I guess someone should call the Prime Minister and warn him about the 
>millions of abnormal humans that have been roaming the Brisitsh countryside 
>for the last >few centuries.

Tom, you are astray again. My proposal does not depend on increasing whois 
accuracy for existing allocations, and is not related that, as much as you 
keep returning us to the UK Land Office. My proposal seeks to identify 
transactions which would naturally occur which would not meet the current 
needs requrement and would thus have a disincentive towards registration.

>Seriously, most of the normal humans that I encounter aren't driven by a 
>monomaniacal fixation on establishing and reaffirming evidence of their 
>valuable control >rights every moment of every day. Sometimes they forget 
>things, sometimes they get overwhelmed with more immediate demands. I find 
>that many normal humans >can rationalize failures to prioritize the 
>reaffirmation of their precious control rights almost indefinitely if they 
>can get away with it -- especially if the act of >reaffirming those rights 
>entails waiting in line, filling out forms, being questioned about 
>sensitive personal matters by strangers whose interests and incentives are 
> >suspect, or generally spending even the smallest time or effort doing 
>anything outside of what they would classify as "work" or "fun." It's just 
>human nature -- at >least among the normal humans that I know.

Tom, really, did I mention a monomanical fixation which grasps owners every 
moment of the day?
Remember how we got here, it was you adducing that the needs requirement 
*helps* to maintain whois accuracy during the contact with the RIR doing the 
needs analysis. I merely pointed out that all else being equal vis a vis 
registrations, that the increase in perceived value of the holdings would 
create an incentive towards proper registration, and what's more, that any 
RIR doing a needs analysis has already been contacted by the tranferee, thus 
is already in the moment of contact.


>> All your groups, x,y,and z will likely keep their registration more 
>> updated than they have historically as the value of their holdings 
>> becomes clearer to all.

>Could you please cite something other than theory that supports this 
>expectation?

I cite common sense. Where there is no other evidence for control, and where 
control is valuable, the registry which provides the evidence for the 
ownership of control will become more accurate as the incentive for the 
address holder is plain. Call it philosophy, I think every reader of these 
sentences understands the incentive I mention and the likely effects of that 
incentive on their action to maintain accurate data. But again, Tom, this is 
a sideline issue to dropping needs requirements for transfers, and only a 
counter argument to your claim that maintaining an extra transaction cost 
will somehow drive registration.

>> If I have a new business plan that I am pitching to investors, and if my 
>> projected growth plan includes a need for increasing IPv4 addresses over 
>> the next 24 >>months, what do I say to the investor who asks how I will 
>> get those addresses and what they will cost?

>First thing I'd do is redirect them with an offer to put them into some 
>fine ocreanfront property in Kansas -- because if they're going to fund 
>your IPv4-dependent >growth plan, they'll probably bankroll anything.

It's your right to believe in IPv6 transition in two years, or in two weeks. 
I would tell any investor that if they think anybody is going to be turning 
off IPv4 in favor of IPv6 only in 24 months, they are being naive, but those 
are the kinds of risks investors take.

> Remember, if ARIN is doing a needs analysis for somebody, it's because 
> they have already been contacted in reference to the desire to have ARIN 
> book a transfer, right? So if they have already done that, why does the 
> needs requirement enchance contact information accuracy?
> I don't see the logic there.

>Please refer to my previous message for a fuller accounting of the various 
>beneficial effects of the need/capability requirement; those other benefits 
>would still apply >even for aspiring new address flippers who have been 
>completely open and forthcoming with respect to their whois-related 
>information.

I have reread it, is is full, but you only make two points.
1. There is a moment of contact at the point of needs analysis which 
provides opportunity to get valid whois information.
and
2. The needs requirement makes the contact less "casual" and therefore more 
accurate.

I have refuted those two points by indicating that the whole purpose of 
contact with the RIR is to update the contact information, in a needs-free 
transfer.
Readers are advised to review Tom's post in full below to see if I have 
described it correctly.

Regards,

Mike

>  Regards,
> Mike
>
>
>
> ----- Original Message ----- From: "Tom Vest" <tvest at eyeconomics.com>
> To: "Mike Burns" <mike at nationwideinc.com>
> Cc: "Owen DeLong" <owen at delong.com>; <arin-ppml at arin.net>; "Paul Vixie" 
> <vixie at vix.com>
> Sent: Sunday, May 15, 2011 11:34 AM
> Subject: Re: [arin-ppml] IPv4 Transfer Policy Change to Keep Whois 
> Accurate
>
>
>
> On May 12, 2011, at 1:26 PM, Mike Burns wrote:
>
>> Hi Owen,
>>>
>>>> I still don't see the connection between my proposal to drop needs 
>>>> requirements for transfers and the participation rate of DNS whois or 
>>>> the UK land office.
>>>> I may be missing something obvious, though.
>>>
>>
>>> I believe he is arguing that if you turn address policy into a 
>>> free-for-all (as in your proposal), like
>>> DNS, it will decrease, rather than increase whois accuracy. I hadn't 
>>> thought of this consequence, but,
>>> now that Tom and Paul have brought it up, it does make sense.
>>
>>
>> I am still missing the connection between removing needs requirements for 
>> transfers and having that decrease whois accuracy.
>> If you can connect the dots, you will go a long way in convincing me that 
>> my proposal is flawed.
>
> Hi Mike,
>
> Again, apologies for the delayed response. I tried to clarify the 
> connection in my message of May 13, 2011 12:04:39 PM EDT (specifically, @ 
> bullet points 3 and esp. 4). But that was a long message that also covered 
> several other reasons why the so-called "needs" (which IMO should be 
> "capability") requirement is important which are completely independent of 
> its relevance to whois accuracy, and perhaps I wasn't clear enough on the 
> specific one that interests you.
>
> Basically, the need/capability test facilitates the ongoing 
> maintenance/preservation of whois accuracy because it assures that each 
> subsequent allocation/assignment (and in the future, each transfer 
> transaction) will trigger the same kind of "moment of controlled 
> disclosure" that occurs when a new entity joins an RIR and/or requests an 
> initial allocation. As a group, network operators -- and esp. growing 
> ones --  undergo the sort of internal changes (e.g., reorgs, relocations, 
> new sites, new non-M&A commercial partnerships, et al.) that can trigger 
> changes in their external contact details fairly frequently. For all sorts 
> of reasons that are mostly banal (oversights, procrastination, impatience 
> with "bureaucracy," miscommunication, someone else's job, thought they 
> were already informed, etc.), the RIRs don't always "get the memo" at the 
> time when such changes occur -- or even afterward, during subsequent 
> "casual" interactions. Absent other countervailing factors, such changes 
> would cause the overall quality of registration data to degrade 
> progressively over time, with the more dynamic/faster growing networks 
> typically leading the way down.
>
> What prevents (or at least substantially mitigates) this progressive decay 
> is the policy-mandated needs/capability test requirement. That requirement 
> assures that each subsequent interaction between registrants and the RIR 
> that could materially alter the distribution of IP number resources *will 
> not* be "casual" in the above sense, but rather will (typically) involve 
> some presentation of documents which illustrate the existence and size of 
> the new addressing requirements. The review of such materials -- which 
> frequently include invoices for new network-related assets or similar 
> documents that show buyer address and other contact info -- provides a 
> formal opportunity for RIR and registrant representatives to make sure 
> that they're on the same page with respect to all current contact 
> information.
>
> So, to put this explicitly in the context of your proposal:
>
> The exhaustion of the unallocated IPv4 pool is not going to reduce the 
> frequency with which address registrants undergo the sort of internal 
> changes that can make some or all of their current whois contact details 
> outdated -- if anything it might make those changes happen more 
> frequently. Thus, in order for whois data quality to be preserved going 
> forward at (at least) current accuracy levels, the current practice of 
> making each subsequent address-related transaction subject to a mandatory 
> needs/capability capability review must continue.
>
> In order for your proposal to have *any chance at all* of causing a net 
> improvement in whois data quality, the number of future Pv4 transfer 
> seekers that are
>
> x: (NOT current RSA signatories + NOT willing/able to undergo a 
> need/capability test + ARE certain to self-maintain the quality of their 
> own whois information at historically unprecedented  high levels in 
> perpetuity)
>
> ...would have to exceed the sum of other kinds of future address seekers, 
> including those who are:
>
> y: (NOT current RSA signatories + ARE willing/able to undergo a 
> need/capability test + NOT certain to self-maintain the quality of their 
> own whois information at historically unprecedented high levels in 
> perpetuity)
>
> z: (ARE current RSA signatories + (n/a) + NOT certain to self-maintain the 
> quality of their own whois information at historically unprecedented high 
> levels in perpetuity)
>
> Logically, the universe of potential future address seekers is complete 
> characterized by (x + y + z) as described above, plus two other groups 
> that, hypothetically, wouldn't be affected either way by your proposal:
>
> Incorrigibles: (NOT signatories + NOT willing + NOT self-maintaining)
>
> Saints: (ARE signatories + (n/a)+ ARE self-maintaining)
>
> [Note: I say "hypothetically" above because I actually believe that the 
> adoption of this policy would undermine an existing community "norm" of 
> whois participation that currently contributes to "irrationally" high data 
> quality across current registrants -- and as a result your policy would 
> cause average levels of whois "self-maintenance" to decline across all 
> groups. But that possibility is not factored into this analysis]
>
> Assuming that "saints" and "incorrigibles" would be equally represented 
> across both current ARIN members/RSA signatories and future address 
> seekers (and excluding any possible "normative" affects), your proposal 
> would only be net positive at the point where ((non-Saint, 
> non-Incorrigible x)) exceeds (non-Saint, non-Incorrigible (y+z)). Given 
> the size of the current ARIN membership, the only way this pans out in 
> your favor if 90%+ of current members and 90%+ of future address seekers 
> actually fall into the "Saint" or "Incorrigible" category.
>
> But of course, this assumption would also mean that your policy (and all 
> policies, more-or-less) are almost complete irrelevant.
>
> Happily, I believe that  those demographic assumption are grossly 
> inconsistent with both RIR administrative experience and with the 
> documented record of RIR community-policy interactions over the last 20 
> years.
>
> Hence, I am opposed.
>
> TV
>
>
>>>> My whole goal is to increase accuracy in Whois, and I am not relying on 
>>>> any financial or price mechanism for that increase.
>>>
>>
>>> And now there is evidence that your proposal would likely have the 
>>> opposite effect.
>>
>> What evidence?
>>
>>>> I have not argued that pricing will increase registration, I have 
>>>> argued that pricing will ensure productive use.
>>>
>>
>>> Which also remains in dispute and unproven.
>>> Owen
>>
>> Hence the word argued.
>>
>>
>> Regards,
>> Mike
>