[arin-ppml] IPv4 Transfer Policy Change to Keep Whois Accurate

[Tom Vest]

On May 19, 2011, at 10:59 AM, Mike Burns wrote:

> Hi Owen,
> 
>> You also left off:
> 
>> 4. It might actually reduce whois accuracy rather than increase it.
> 
> Why does anybody think that removing the needs requirement for transfers would degrade whois accuracy?
> The only support for that contention was the idea that because the needs requirement involved some extra informational flow, the contact information would be more accurate.
> I argue that registration will become more and more important, and John Curran indicated there was an uptick in 8.2 Transfers for old M&A activity, which I held to be an indication that holders of addresses find registration valuable, and likely more so as the addresses increase in monetary value.
> People will naturally want their ownership rights established in whatever venue is appropriate, and for ip address holdings, that venue is Whois.
> I don't think the argument that my proposal will reduce Whois accuracy holds water, is there anybody who wants to continue to make that charge?

Hi Mike, 

Can you provide us with a comparable measure of the number of old address holders who have not responded to opportunity afforded by the 8.2 change?
If possible, please break down the number into two groups -- those who are on the fence and holding out fin hopes of additional blandishments and concessions, and those whose philosophical or commercial priorities preclude registration regardless of the side payments. 

> 5. Markets without additional controls inevitably lead to manipulation and dysfunction
>> which requires later regulation to correct. These later corrections are rarely (if ever)
>> effective at making the original victims of the manipulations and dysfunction whole.
> 
> First, this is  your opinion only, second, I already alluded to speculators and hoarders, and your number 5 is merely a restatement.
> 
> 
>>> As far as 2, this danger seems to be manageable, and there haven't been too many objections related to this lately. I have argued that the stewards of the APNIC region, led by Geoff Huston, considered this problem when deciding whether to have needs requirements on transfers, and decided the benefits to >>Whois accuracy outweighed the potential disaggregation problems. This cost is borne most by network operators, who presumably can make decisions on minimum block size which will allow them to run profitably. Those decisions will likely shape the transfer market, so nobody expects there to be much >>value in a /32 netblock, because network operators find this size unprofitable to route today. This ability of network operators provides a constraint on disaggregation in the transfer market.
>> 
> 
>> People haven't been repeating what they already said. That does not mean that it is not still a factor, merely that we didn't
>> think we needed to repeat ourselves on a topic already covered.
> 
>> In what way do you believe this danger would be manageable and/or managed under the proposed policy?
> 
> Primarily, I associate my decision with Geoff Huston's decision at APNIC.
> Geoff is one of the world's top experts on BGP, I think it fair to say, and yet he viewed the danger to Whois accuracy in maintaining needs as outweighing the danger of disaggregation.
> Secondarily, I believe that private network operators are the ultimate decisionmakers here. If they won't route a netblock, the value of the netblock is reduced significantly.

Having enjoyed the extremely lopsided privilege of discussing broadly related matters with Geoff semi-regularly between the years 2000~2009, I wholeheartedly agree that he is one of the world's foremost experts on BGP. However, with all due respect to the man, Geoff's views about the relative merits of market-based vs. RIR-style need/capability-based number resource allocation were formed *before* BGP was widely deployed [1]. To my knowledge, the first concrete expression of those views took place in mid-1994, as documented for example in the recently published 20-year retrospective on AARNET and the early days of the Internet in Australia [2]. The second concrete expression of those views AFAIK is RFC 1744 (December 1994), which I (completely subjectively) interpret as a somewhat bitter personal reflection on the results of the first experience [3]. 

Regardless of whether or not that interpretation is valid, contemporaneous Australian press accounts indicate that AARNet's acquisition by Telstra was announced on January 7 1997 and implemented on July 1, and that Geoff had assumed the title of Telstra Internet's Technical Manager on or around the same time. After that he continued to advocate the same position, e.g., in the context of the IETF "Pricing for Internet Addresses and Routing Advertisements" (piara) BoF.

So while Geoff's world-class expertise in BGP is unquestionable, his seemingly consistent preference for market-based vs. need/capability-based resource management must be based on something else.

Besides, wasn't it you who just recently rejected (my) suggestion that observations based on the historical experience(s) of other registries could provide insight on the merits of your proposal? Or did you really mean that historical observations that seem to flatter your argument are relevant, but observations that raise doubts are not? 

TV

[1] The gradual diffusion of BGP during this period is recorded in some detail in the IETF's old "Internet Monthly Report" series (1991-1998): ftp://ftp.rfc-editor.org/in-notes/museum/imr/.
Additional good sources on both the state of EGP/BGP(x) deployment and concurrent thoughts about addressing management include the IETF meeting minutes for the area.operations, area.routing, bgpdepl, tacit, ale, cidrd, idr, and piara BoFs/working groups.

[2] Described here: http://www.aarnet.edu.au/News/2009/11/26/AARNet-salutes-20th-anniversary-of-the-Internet-in-Australia.aspx
The episode in question is detailed in Chapter 4, p. 48 -- which is available online at
http://www.aarnet.edu.au/library/AARNet_20YearBook_Chapter4

[3] http://tools.ietf.org/html/rfc1744

> Your belief that the ability of network operators will place a constraint on disaggregation in the transfer market
>> presumes a number of facts not in evidence. Namely that:
>> + There is some direct correlation between what people will buy and what they can get routed.
> 
> What kind of evidence would satisfy you? The absence of recorded /32 transactions?
> Just use common sense, and put yourself in the position of a buyer.
> 
>> + There is some correlation between what engineers can profitably route and what sales people
>> will actually sell.
> 
> There is a correlation, because if the sales people continue to sell unprofitably, the company will go out of business.
> 
>> + The feedback mechanism on these factors is fast enough that the market can keep pace with
>> the effect the market is having on them.
> 
> To keep the market moving at its quickest pace,  lower transactional costs like the artificial needs analysis.
> Surely having that requirement will slow transactional pace as well as drive transactions off the books.
> 
>> + There actually is a feedback mechanism by which the market and disaggregation will regulate
>> each other to some livable equilibrium.
> 
> The feedback mechanism is price. The network operators will effectively set the floor for size.
> The price will reflect the netblock's routability.
> 
>> In order to believe that this is not an issue, I think you would have to demonstrate that each of those
>> assertions has at least a reasonable chance of being correct.
> 
>>> And as far as 3, I have argued that speculators provide a value to free markets, that most attempts to corner markets fail, that supply uncertainty and IPv6 deployment provide a poor environment for speculators. But inasmuch as this forum is populated by technical types who are making decisions here based >>on their understanding of, and philosophy of, economics, I have decided to take David Farmer's advice and add an anti-speculator, anti-hoarder protection in the form of a limit of a /12 equivalent for needs-free transfers per 12 month period. If more transfers than that are desired, the recipient will have to  >>demonstrate need.
> 
>> Actually many attempts to corner markets in the case of a truly finite market with players that have effectively unlimited
>> resources _AND_ motivations other than direct profit from the value of the market commodity succeed.
> 
> Could I get some examples from the many you allude to?
> 
>> While attempts to corner relatively large, and especially dynamically elastic markets (such as finished goods) by relatively small (value
>> of player as compared to overall value of market) players are, in fact, doomed, that is not an accurate description
>> of the likely IPv4 address market.
> 
> I have already pointed out the obvious risk that CGN has for anybody who tries to corner the market.
> There is also the very obvious risk that IPv6 will finally take off.
> And when there is an alternative, the very action of the cornerers drives the market to that alternative, posing additional risks to these speculators.
> As to the smallness of the market, we are in fact talking about a trillion dollar network running on a pool of 3.8 billion address units worth at least $40 billion right now.
> An international commodities market consisting of fungible, valuable, and transportable assets is in the offing.
> The supply source of unknown depth and availabilty, although we know the total upper bound of the market.
> And of course, no evidence of this activity that  you can point to in the nascent APNIC marketplace as evidenced by tradeipv4.com.
> 
>> 
>>> As a whole, then, my policy seeks to recognize that there are transfer transactions which provide incentives for buyers and sellers of addresses but which transactions may not meed the needs requirements which ARIN mandates for transfers.
> 
>> There are thefts of automobiles which meet the needs of car thieves and the resellers who purchase the stolen
>> cars from them. That does not make the legalization of car theft attractive.
> 
> Geez, maybe you should have used kidnappers of children and the child-sex rings who purchase them!
> You obviously have an emotional view that transfers of addresses are akin to theft from the rightful owner, ARIN.
> In that I think you act more as king than steward.
> At least in terms of legacy space, the holders of address rights *predate* ARIN, and yet in your mind, if they transfer them without telling ARIN, they are thieves and hijackers.
> 
> 
>>> The question is whether removing the needs basis benefits the ARIN community as a whole, not just the individual participants in any particular
>>> transaction. ARIN does not need to make policy to the benefit of individual participants in a transaction.
>>> Our role as stewards is to make policy to the benefit of the community as a whole. Individual participants in a
>>> transaction are quite capable of looking out for their own immediate interests without involving ARIN policy.
> 
> My rationale is the stewardship of Whois, which benefits the entire Internet community.
> 
>>> Additionally, I pointed out that network operators, in my experience, will route addresses whose Whois record does not reflect that the network operator's customer is the registrant. The network operator, in my experience, will normally check to make sure that nobody else is advertising the addresses, and >>will solicit from the customer some documentary evidence that the customer has the right to the route the addresses, and then the network operator will route the addresses.
>> 
> 
>> This is not my general experience. Most reputable operators will refuse to route addresses unless they have
>> some reason to believe that the customer asking them to route them has some legitimate registration of those
>> resources.
> 
> The legitimate reason is the documentary evidence of transfer in the form of a merger, acquisition, asset sale, or Letter of Agency.
> 
>> Sure, there are ISPs that specialize in routing hijacked space to the benefit of snowshoe spammers
>> and the like, but, they are relatively rare and tend to get de-peered over time.
> 
> And how is a company with a three-year planning window like a snowshoe spammer or hijacker?
> These companies cannot pass the ARIN needs requirements, and would be incentivized to purchase enough addresses on the transfer market.
> The seller is incentivized by the money the buyer will pay.
> The network operator is incentivized by the money the buyer will pay him, and is satisfied by documentary evidence of the transfer that the buyer has the right to route.
> The net result is Whois inaccuracy (and the fact that the buyer will have no RSA with ARIN).
> 
> 
>> I agree that ARIN should get more aggressive about removing registrations for addresses which are no longer
>> being held by the original resource holder or its legitimate successor through some form of section 8 transfer.
>> ARIN should then reissue those available resources to organizations with documented need in a timely manner.
> 
> This is your stick to my carrot. And wielding that stick can get very expensive for ARIN through legal costs.
> And as far as legacy addresses go, ARIN can spend through the nose on lawyers, but my reading of MS/Nortel and the Plzack declaration in the Kremen case leads me to believe that would be money ARIN would waste.
> 
> 
>>> The net effect of these types of transactions is a lack of trust in the Whois table as an accurate source to check for authoritative routing rights. My proposal seeks to reduce the harm to Whois accuracy by extending the range of allowable transactions, providing additional incentive to have transfers reflected >>accurately by ARIN's updating of Whois to reflect the transfer.
>> 
> 
>> There is no evidence whatsoever that this newfound range provides any incentive whatsoever for those
>> transactions to be registered.
> 
> Owen, you said a couple of paragraphs ago that network operators would check registration when asked by a customer to route addresses.
> I agree that is the first place they would go, and that is one of the incentives for address transferees to seek registration.
> The other is the fact that this is really the only public venue for the registration of ownership rights, and I believe registration increases the resale value of the addresses.
> I point again to MS/Nortel and the luckiness that MS had a need exactly equal to a previously negotiated sale with Nortel.
> Had that need not matched precisely with the addresses allocated to Nortel's acquisitions 20 years ago, what would have happened?
> I think we all know what would have happened, and that is that Microsoft would soon be routing those addresses, and Whois would still list Nortel, or even some Nortel acquistion, as the registrant.
> This was the spur for my proposal. Had the needs requirement not been in place, the transaction could have flowed through 8.3, and the natural incentives towards registration would have caused Whois to accurately reflect Microsoft as the new registrant.
> In addition to this public transaction, I offered some other potential transactions which would also fail the needs test, among which is a buyer with a 2  year planning horizon.
> I will continue to use this example, as recent proposals to extend the needs window attest to the belief among some that having a 2  year planning window does not put you in the same league as spammers, speculators, and hijackers.
> 
>> Yes, it might actually remove some small amount of disincentive, but, I believe
>> it would be better for ARIN to provide incentive for accurate whois through a more active audit and
>> reclamation process as that would also better serve the community by reducing the probability of hijacked
>> space being invisibly routed as well as making some abandoned resources available to the ARIN community
>> for reuse.
> 
> Again with the stick. How successfully as this stick been weilded in the past?
> 
> 
>>> As we move into a trading world, which will happen whether or not my proposal passes, conflicts over address control are likely to increase, and the value of trust in Whois as the routing authority will also increase. Rather than sit back and watch Whois decay, I urge ARIN stewards to consider making these >>changes to foster accuracy in Whois.
>> 
> 
>> There is no proof these changes will foster accuracy in Whois.
> 
>> Owen
> 
> There is proof that transfers have occurred that have not been reflected in Whois. John mentioned the current 8.2 requests to reflect old mergers and acquisitions.
> So we know that transfers have occurred among the non-reprobate which are not reflected in Whois.
> I  have pointed out that there is a major change afoot, the development of an ip address transfer market.
> So looking in the past for proof, or really looking anywhere for proof of results of a change which has not occurred yet, is specious.
> 
> Regards,
> Mike
> 
> 
> 
> 
> 
> _______________________________________________
> PPML
> You are receiving this message because you are subscribed to
> the ARIN Public Policy Mailing List (ARIN-PPML at arin.net).
> Unsubscribe or manage your mailing list subscription at:
> http://lists.arin.net/mailman/listinfo/arin-ppml
> Please contact info at arin.net if you experience any issues.