[arin-ppml] Proposed Revision to the ARIN Policy Development Process

[John Curran]

On Oct 10, 2011, at 9:19 AM, Owen DeLong wrote:

Overall, I think the changes are good. However, I have made several notes inline below where I think things could be improved. Many of these are nits, but, there are also some substantial changes.

Owen

... To accomplish this goal, the PDP charges the
community-elected ARIN Advisory Council (AC) as the primary policy
development body with appropriate checks and balances on its performance
in that role.



This is a little bit of a nit, but, unless the BoT has chosen to modify the election process for the AC such that we are elected by the community, I believe that should read member-elected rather than community-elected.

Nit noted.  :-)

Part I of this document provides the underlying goals for the Policy
Development Process (including its purpose, scope, principles, and
criteria for policy changes) and Part II details the specific Policy
Development Process used for development of changes to Internet number
resource policy.  Part III details the processes for petitioning
specific aspects of the Policy Development Process.


Another nit, the inconsistencies in the numbering are confusing. This paragraph, for example, uses roman numerals (I, II, III), but, the actual document text while the document is numbered with spelled-out numbers (Part one, Part two, Part three) with subsections numbered with arabic numerals with no precursor (e.g. 2. Definitions vs. I.2 Definitions). The numbering should at least be made consistent for each level of hierarchy. Ideally, the numbers would also be made hierarchical (e.g. I.2 Definitions)  and/or consistent indentation added to clarify hierarchy.

Agreed.

2.      Definitions

Internet Number Resources
Internet number resources consist of Internet Protocol version 4 (IPv4)
address space, Internet Protocol version 6 (IPv6) address space, and
Autonomous System (AS) numbers.


Although this is an unlikely scenario, it is possible that other protocol versions could be deployed while ARIN is still managing number resource policy. I think a more generic definition would be appropriate here, such as:

Internet number resources are those sets of numeric identifiers for which ARIN provides registration services. At the time of writing, these included Internet Protocol Addresses (regardless of version) and Autonomous System (AS) numbers.

An interesting (if somewhat academic) point.  I'm thinking that we'd have plenty of
time to update the PDP if an even newer version of the Internet Protocol were to
begin to appear, but point taken.

Policy Proposal
An idea for a policy that is submitted to the policy development
process.  ARIN staff work with idea proposers to insure clarity of the
policy proposals, and the ARIN Advisory Council confirms the policy
proposal is in scope (per Section 3) of the Policy Development Process.

Draft Policy
A policy proposal that is under active consideration by the Advisory
Council.  A draft policy results from a policy proposal being accepted
by the Advisory Council for further development. The Advisory Council
accepts additional policy proposals when the AC Chair determines that
the Advisory Council has sufficient available resources to undertake
additional development work.



This is a significant change in terminology and removes a useful distinction in policy status from the AC's toolkit. Currently, once we place a proposal on our document, we work on the proposal until we feel that they are ready for adoption discussion at a meeting, then, we make them draft policies. Proposals and draft policies live in separate numbering spaces. I think altering the definition in this manner will create confusion without benefit.

Well, since you've opened the topic:  The original intent of Policy Proposal versus Draft
Policy was more akin to the process in the IETF, in that Draft was meant to reflect a
higher degree of maturity.  With respect to the current PDP, Draft Policies are supposed
to be those "technically sound and useful draft policies that, if adopted, will make a
positive contribution to the Number Resource Policy Manual."

The AC has recently been bringing nearly all policy proposals to the public policy
meeting, even when there is no consensus with the AC (or consensus to the contrary)
regarding the technically sound and useful nature of the policy proposal.

My preference would be that the community knows that a policy proposal is actually
being actively proposed for adoption by the AC, but actual practice has departed
from this direction.  "Ready for adoption discussion" <> "Determined to be sound
and useful by the AC".   This needs to be discussed by the community in detail.


Adopted Policy
A policy that has been adopted by the ARIN Board of Trustees.  Adopted
policies are incorporated into the Network Resource Policy Manual (NRPM)



I believe the better term here is "Number Resource Policy Manual". I can't tell whether this was a deliberate rename or just a typo.

Typo - it will be corrected.

Sometimes there are non-policy aspects of the desirable implementation of a policy proposal. In an ideal world, a mechanism would exist for making such submissions to the ACSP  and tying that ACSP to the Proposal and expressing the desired level of interdependence (a depends on b, b depends on a, neither should be activated independent of the other).

Agreed.  The staff works hard to explain how it will go about implementation, and
welcomes feedback on the staff and legal reviews to make sure that they are correct.  I
have even asked if an implementation process outline matches policy intent on occasion.

I'd prefer to keep this information together, even if it means adding an "implementation
considerations" section the policy proposal template.

3.2.     Relevant and applicable within the ARIN region
Policies developed through the PDP are community self-regulatory
statements that govern ARIN’s actions in the management of Internet
number resources. Policy statements must be applicable to some portion
of the community or number resources managed within the ARIN region, and
proposals to change policy must address a clearly defined and existing
problem with number resource policy in the region.



I recommend replacing "and existing problem" with "improvement". I think it is possible to make improvements to policy that are not necessarily a response to existing problems, per se.

Agreed.

Note that the policy development process for global policies follows a
similar process within each RIR region with the additional process of
ratification by the Internet Corporation for Assigned Names and Numbers
(ICANN).  The global policy development process is separately documented
and facilitated by the Address Supporting Organization Address Council
(ASO AC).



Actually, the global policy development process requires each RIR to pass the policy through their respective Policy Development Processes. As such, changing the AIRN PDP changes the Global PDP within the ARIN region as well. They are one in the same since the ARIN (and other RIR's) PDP(s) are incorporated by reference in the global PDP.

Correct - this reference to the global policy development process will recurse back to
here with respect to the ARIN portion of the process....  (and proving termination of
that recursion is definitely left as a exercise for the reader. ;-)

...All policy statements must be clear,
complete, and concise, and any criteria that are defined in policy must
be simple and obtainable. Policies must be unambiguous and not subject
to varying degrees of interpretation.



s/obtainable/attainable/ ?

Agreed.

4.2.     Technically Sound
Policies for Internet number resources management must be evaluated for
soundness against three overarching technical requirements:
conservation, aggregation and registration.  More specifically, policies
for managing Internet number resources must:
•       Support both conservation and efficient utilization of Internet number
resources to the extent feasible. Policy should maximize number resource
availability while respecting the significant cost to the Internet
community resulting from number resource depletion.
•       Support the aggregation of Internet number resources in a hierarchical
manner to the extent feasible.  Policy should permit the routing
scalability that is necessary for continued Internet growth.  (Note that
neither ARIN, nor its policies, can guarantee routability of any
particular Internet number resource as that is dependent on the actions
of the individual Internet operators.)
•       Support the unique registration of Internet number resources.  Policy
should prevent to the extent feasible any duplicate use of Internet
number resources that would disrupt Internet communications.
The ARIN AC considers these requirements in assessing changes to policy
and only recommends those policies that achieve a technically sound
balance of these requirements.  The ARIN AC documents its technical
assessment for consideration by the community.



I believe that this last criteria (uniqueness) should be first and foremost. The other two were important for IPv4 and remain useful considerations in IPv6, but, uniqueness truly is job one.

Agreed.

4.3.     Supported by the Community
Changes to policy must be shown to have a strong level of support in the
community in order to be adopted. The determination of support is most
commonly done after discussion of the draft policy at the Public Policy
Meeting (PPM) or via online poll after discussion on the Public Policy
Mailing List (PPML).

A strong level of community support for a policy change does not mean
unanimous; it may be supported by only a subset of the community, as
long as the policy change enjoys substantially more support than
opposition in the community active in the discussion.  Furthermore, any
specific concerns expressed by a significant portion of the community
must have been explicitly considered by the ARIN AC in their assessment
of the policy change.



This paragraph concerns me. It could be construed, for example, to indicate that in moving a draft policy to recommended status, the AC must specifically note and explain each issue raised by any vocal minority in opposition to said draft policy. This could prove to be an avenue for DOS attacks against the AC.

It is an important principle of deliberatively bodies that all parties get to express
their viewpoints. It is not possible to for anyone to discern if their particular view
(even if less popular) was given consideration by the AC unless it is documented.

Recognizing the potential for DoS attacks and similar, perhaps "material" or
"substantial" rather than "specific" would make sure that such decisions were
well documented without creating an unreasonable obligation on the AC?

5.2.     Developed by Open & Transparent Processes
Changes to policy must be developed via open and transparent processes
that provide for participation by all.  Policies must be considered be
in open, publicly accessible forum as part of the adoption process.
Policy discussions in the ARIN region are conducted on the Public Policy
Mail List (PPML) and in the Public Policy Meeting (PPM). There are no
qualifications for participation other than following the specified
rules of decorum necessary for constructive discussion. Anyone
interesting in participating in the process may subscribe to the PPML
and anyone interested may attend a PPM in person or via remote
participation methods.



...must be considered be in open... (Second "be" should be removed)

It shall be be removed.

...Anyone interesting in participating... (s/interesting/interested/)

Got it.   We do have some interesting participation, but that's not the
intent of the text - the PPML is open to all interested.

All aspects of the PDP are documented and publicly available via the
ARIN website. The PPML is archived. The proceedings of each PPM are
published. All policies are documented in the Number Resource Policy
Manual (NRPM). All draft policies are cross referenced to the original
policy proposal, the archives of the PPML, all related PPM proceedings,
and the minutes of the appropriate Advisory Council and the ARIN Board
of Trustees meetings. The procedures that are developed to implement the
policy are documented, publicly available, and followed by the ARIN staff.


PART TWO – THE POLICY DEVELOPMENT PROCESS
This section provides the details of the ARIN Policy Development
Process. All references to “days” are business days unless otherwise
specified.



The term business days is not defined elsewhere in the PDP. Different organizations have different definitions of business days. I believe the ARIN definition is Monday through Friday exclusive of U.S. Federal holidays, but, I suggest that whatever definition ARIN follows should be made part of the PDP document if we are to use business days here.

Agreed that the definition should be explicit, although this may need to be on the
website rather than embedded in the PDP.

1. The Policy Proposal
Policy proposals may be submitted to the ARIN Policy Development process
by anyone in the global Internet community except for members of the
ARIN Board of Trustees or the ARIN staff. Policy proposals may be
submitted any time by completing the online policy proposal form on the
ARIN web site or by sending text copy of the form to policy at arin.net<mailto:policy at arin.net>.
ARIN staff will work with the originator as described below to prepare
the policy proposal and make it available for consideration by the
Advisory Council.



...sending text copy... (sending a plain text copy...)

This isn't just a nit. First, there's the grammatical issue, which is a nit. However, also note the addition of the word plain. It could be argued that a PDF, Pages, RTF, or other file format containing the text is a "text copy" of the form.

Is your intent that ARIN reject such policy proposals even if staff is able to decode?

Upon receipt of a policy proposal form, the ARIN staff will work with
the proposal originator by providing feedback within 10 days regarding
the clarity and understanding of the proposal text. The merits of the
policy proposal itself are not evaluated at this time; the purpose of
this step is to insure that the proposal text will be clear and
understandable to the ARIN staff and community, and to receive any staff
comments regarding potential scope considerations of the policy proposal.

The proposal originator may revise (or not) the proposal text based on
the feedback received, and when the originator indicates satisfaction
with the proposal text, the ARIN staff assigns it a policy proposal
number, posts the policy proposal to the public web site, and notifies
the Advisory Council of a new policy proposal available for initial
evaluation.



Is it intentional to remove the posting of the proposal by the staff to PPML in this process?

No; it will be made explicit rather than implied via "posts to the public web site."

2. Policy Proposal Initial Evaluation
The Advisory Council (AC) performs an initial evaluation of each policy
proposal in a timely manner to determine if the proposal is within scope
of the Policy Development Process.  This will include consideration of
comments received from staff regarding potential scope considerations of
the policy proposal.  Policy proposals which are determined by the
Advisory Council to be out of scope or clearly without merit may be
rejected at this point, and the Advisory Council announces the rejection
of a policy proposal along with an explanation of its reasoning to the PPML.

The Advisory Council maintains a docket of draft policies under active
development. Any policy proposals that are not rejected upon initial
evaluation shall become draft policies on its docket. The AC Chair may
defer initial evaluation of all new policy proposals if the Chair
determines that there are insufficient resources available for
additional policy development work.



Could it be desirable to add a safety valve here where the AC can also make such a deferral by some supermajority (2/3rds of voting members present, for example)?

Or provide for removal of a non-confidence Chair? (as that safety value presumes
a Chair which is running seriously contrary to the intentions of the overall body)

3. Draft Policy Discussion and Development
The Advisory Council is responsible for the development of draft
policies on its docket to meet ARIN’s principles of Internet number
resource policy (as described in Part One of the PDP, Section 4). During
this effort, the Advisory Council participates in and encourages the
discussion of the draft policies on the PPML, notes the merits and
concerns raised, and then based on its understanding of the relevant
issues, the Advisory Council may take various actions including
abandoning, revising or combining the draft policy with other draft
policies.



It is also possible we may want to split a draft policy into multiple draft policies. This should, IMHO, either be stated above, or, s/including/including, but not limited to,/

Agreed.

The Advisory Council announces any actions taken on draft policies along
with an explanation of its reasoning to the PPML.  The explanation
should show a full consideration of the issues leading to the action..
The Advisory Council (AC) may have specific AC members or members of the
community (including the proposal originator) collaborate in the
consideration of the discussion and preparation of actions for the
Advisory Council, but only the Advisory Council may revise, combine, or
abandon a draft policy.



Shouldn't recommend be part of that list of actions only the AC can take as well?

It wasn't included here,  for clarity it's addressed below.  We can include it in the list
for completeness.

The Advisory Council may submit a draft policy for a combined staff and
legal review (and should do so after significant changes to a draft
policy). This review will be completed within 10 days. Upon receipt of
the staff and legal review comments, the Advisory Council examines the
comments to ensure their understanding and resolve any issues that may
have been raised. This may cause the Advisory Council to revise, combine
or abandon the draft policy.



Suggest replacing the last two sentences:
...Upon receipt of the staff and legal review comments, the AC examines comments to ensure their understanding and takes appropriate action(s) to resolve any issues that may have been raised.

Agreed.

4. Community Discussion at Public Policy Meeting
The Advisory Council presents reports on the status of all the draft
policies on its docket at each public policy meeting (PPM).  The list of
draft policies is set 20 days in advance of the PPM, and no action to
add, merge or abandon draft policies may be made after that point (In
order to provide for flexibility but insure discussion of a single draft
policy version at the PPM, minor revisions to draft policy text may be
made by the Advisory Council up until 10 days prior to the public policy
meeting.)

The AC Chair designates a list of Draft Policies for discussion and
these are specifically listed in the Draft PPM agenda.  In each Draft
Policy presentation, members of the Advisory Council will present the
arguments for and against adoption of the Draft Policy (petitioned items
at the PPM are handled per PDP Section III: Petition Process) The
Advisory Council participates in the discussion of the draft policies at
the PPM, and notes merits and concerns raised in the discussion.
Within the 30 days following the Public Policy Meeting, the Advisory
Council reviews all draft policies and, taking into account the
discussion at the public policy meeting, decides the appropriate next
action for each one.. Draft policies that are not abandoned remain on
the Advisory Council’s docket for further development.



1. I do not believe that the AC Chair alone should determine which policies the
AC brings to the meeting.

The reference of the AC Chair allows this to be done without requiring a vote of the
AC for each policy to be discussed at the PPM, i.e. based on discussion of the AC
and the consensus reached.   However, if an explicit vote is to bring each to the PPM
for discussion is desired, it can be put back in.


2. The AC should take into account not only the discussion at the public policy
meeting, but, also the discussions on PPML and other input received from the
community.

Agreed.

These two issues require a substantial rewrite of II.4 in its entirety and I don't have proposed text at this time, though I will endeavor to develop such upon request.

I suggest holding for additional comments on this from the community, but it is your call.


5. Advisory Council Consensus on Recommended Draft Policy
If the Advisory Council completes its work on a draft policy and
believes that the draft policy meets ARIN’s principles of Internet
number resource policy, it may recommend the draft policy to the
community.  Upon recommendation, the recommended draft policy text and a
current staff and legal review are published on the PPML for community
discussion.

6. Community Support on Recommended Draft Policy
The Advisory Council seeks community support for its recommended draft
policies, and this support may be ascertained by a show of hands at the
public policy meeting or an online poll of the community after 10 days
prior notice provided to PPML.



Does this mean PPML is told of the poll 10 days before the poll opens, in which case, how long does the poll remain open, or, does it mean that a notice opening the poll is posted to PPML 10 days prior to the poll closing?

We have no worked out the mechanisms, but want to allow such polls to be an option
for the AC to have available.

I would suggest that this is an area where 14 consecutive 24 hour periods would be a more useful construct than 10 days (which in this context means 10 business days).

Worth considering.

The Advisory Council should carefully weigh the community support shown
for each of the recommended draft policies.  Clear community opposition
is a strong indication that policy abandonment should be considered. A
low level of overall support without opposition for a recommend draft
policy suggests further discussion of the merits of the draft policy or
abandonment. A clear split in the community support suggests that the
Advisory Council should revise the draft policy to accommodate the
concerns raised or further explain its consideration of the matter.



This level of micromanagement of how the AC interprets community input on a policy seems ill advised at best.

Given the above paragraph, I can envision ways to claim that the AC violated the above for almost any outcome from almost any discussion other than one with overwhelming support or opposition among the entire community. Given the increasingly nuanced nature of proposal discussions over the last couple of years and that there is no reason to believe said trend will reverse itself, I believe that incorporating the above language into the PDP is asking for trouble.


I believe this is in here specifically at the request of the AC on how to interpret the
"support" from the community shown for a given proposal.  There were several such
requests over the last two years regarding "how much support is enough" and this was
the best proposed text that the team was able to achieve.


7. Last Call
The Advisory Council selects recommended draft policies that have the
support of the community and sends these policies to a last call for
review and discussion by the community on the PPML. The last call period
will be for a minimum of 10 days. The Advisory Council may decide that
certain draft policies require a longer last call period of review (such
as those that were revised based on comments received during the public
policy meeting). If the Advisory Council sends a draft policy different
than the recommended draft policy, then the Advisory Council will
provide an explanation for all changes to the text.



I can't decipher this after 4 readings.

Before sending policies to the Board for adoption, they go to last call.  If the text is
different than the last version the community saw, explain why.

Within 30 days of the end of last call the Advisory Council will review
the result of last call discussion, and will determine readiness for
consideration by the Board of Trustees.  The Advisory Council may
forward a draft policy directly to the Board of Trustees only if minor,
non-substantive changes were made as a result of last call discussion.
Any other changes require that the recommended policy be sent again to
last call, or held on the docket as a draft policy for further
development.  The AC can also decide to abandon a draft policy at this
point.

The results of the Advisory Council's decisions, and the reasons for
them, are announced to the PPML. The Advisory Council forwards the
recommended draft policies to the Board of Trustees for adoption.



The use of the term recommended draft policies here seems ambiguous and, unless I misunderstand the use of the same term above, would mandate forwarding things to the board that may have been abandoned in the previous paragraph.

I believe that a sentence needs to be inserted that states that "any recommended
policies shall reviewed after last call, to confirm that they are still recommended"
and then "Policies still recommended after this review are sent to the Board... "


11.2  Policy Suspension
If, after a policy has been adopted, the Board receives credible
information that a policy is flawed in such a way that it may cause
significant problems if it continues to be followed, the Board of
Trustees may suspend the policy and request a recommendation from the
Advisory Council on how to proceed. The recommendation of the Advisory
Council will be published for discussion on the PPML for a period of at
least 10 days. The Board of Trustees will review the Advisory Council's
recommendation and the PPML discussion. If suspended, the policy will be
presented at the next scheduled public policy meeting in accordance with
the procedures outlined in this document.



This seems somewhat backwards to me. I believe that the issue should be discussed on PPML followed by the AC making a recommendation, rather than the AC making a recommendation to be discussed on PPML then returned to the board without further involvement of the AC.

The AC certainly has that as a option... i.e. discuss the problem on PPML first,
then make a recommendation.  Perhaps that text could be expanded to not imply
otherwise.

PART THREE – PDP PETITION PROCESS
This section provides the details of the petitions within the Policy
Development Process.  Petitions can be made at points where decisions
are made in the policy process.  Points where petitions are available
are depicted on the main PDP flow diagram in Appendix A.  All days in
the process below are business days unless otherwise specified.



We are evaluating this without the benefit of the diagram referenced above as appendix A was not attached to this document.

Correct.

1. Petition Principles

1.1     Available to the community
Any member of the community may initiate a Petition if they are
dissatisfied with a specific action taken by the ARIN Advisory Council
(AC) regarding any policy proposal or draft policy.  The petitioner does
not have to be located in the ARIN region or associated with an
organization that is a Member of ARIN; any party (including a policy
proposal originator) with interest in policy development matters within
the ARIN region may initiate a petition.

Notwithstanding the above, ARIN Staff and ARIN Board members may not
initiate or be counted in support of petitions as these individuals
already have a formally defined role in the Policy Development Process.



I am glad to see that this was modified so as not to exclude the AC members from participating in petitions.

There are some interesting aspects both in favor and against such a
constraint.  In the end, it was felt that unless absolutely necessary,
it should not be a constraint.


2. Valid Petitions
Petitions may be made regarding policy proposals or draft policies as
described below.

2.1.  Petition against Abandonment or Rejection due to out of scope
The Advisory Council’s decision to abandon a policy proposal or draft
policy may be petitioned.



"...due to out of scope" should be removed. It is one of several reasons covered in the text below, not the only reason covered.

Also agreed... it is not necessary to include in this context.

Owen - Thanks for that thorough and excellent review of the proposed
revised PDP; it certainly will help the final product, and hopefully help
get discussion going on some of the more philosophical issues raised
by the proposed changes.

Thanks!
/John

John Curran
President and CEO
ARIN



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.arin.net/pipermail/arin-ppml/attachments/20111010/c440dc61/attachment.htm>