[arin-ppml] [arin-announce] ARIN-prop-174 Policies Apply to All Resources in the Registry

[John Curran]

On Jun 21, 2012, at 3:41 PM, Steven Ryerse wrote:

> I have only been a full-fledged member of this community for a couple of months.  This is the first post I have ever made to this community forum.  It has been very interesting reading all of the email generated by this community on various subjects.  I am not sure what all of the "rules" are that have been set up before me, but if one does not already exist, I would ask that one be set up that states that all submissions be of a clear constructive nature and be in a constructive format - and provide the reason(s) why a member advocates a particular position or change plus the benefit to all.  Certainly some submissions do exactly this but some do not and the ones that do not are mostly a waste of everyone's time for anyone who cares to follow this community.
> 
> I am also one of those rebellious "Legacy" Internet Address holders as I got a /24 for myself on 3/14/1994.  At that time I routinely got Class C Internet addresses assigned for my clients.  I'm guessing that over the years there have been probably tens of thousands of emails concerning "Legacy" IP Block holders and blocks submitted in this community.  I don't expect that my little email will change much but I'll throw my two cents in and see if anybody is interested.

Steven - 

Your input is quite welcome; thank you for taking the time to write up 
your thoughts.
 
> I have always thought that my little Class C address block had value even in the years I was not using it.  I parked it at an ISP I know to hold it and they used it for their purposes when I wasn't using it.  I know it actually does have value because I have had several offers to buy it - all of which I turned down.  I'm guessing the value will go up as IPv4 block are further restricted by ARIN policy or a real shortage.  I consider it an asset because I could make a phone call today and get a check for it.  I still have all of the documentation from 1994 from the InterNIC including the application they faxed me and my submission letter and the letter they mailed me via USPS confirming my assignment of my Class C.  I pulled them all out today and read them all.  The application was 3 pages long and the letter they sent me back was a half of a page.  Nowhere in that documentation does it say that I don't own this block and nowhere does it say I can't transfer it at will under my terms.  In fact it does not mention anywhere that there is any other legal agreement of any kind that was part of the transaction of getting the block assigned to me.  Therefore I read this in the broadest possible way and feel I can do anything reasonable with it if I choose to including sell it if I want.  This is an unforeseen benefit of being an early Internet adopter and I feel I did my part albeit small to help the Internet grow.

That perspective is similar to those that have been expressed by some
others who received early assignments, and indeed, there were thousands
who each helped in their own way with growing the early Internet.  In
fact, I count myself in the that category (but do not hold any number
resources for obvious reasons :-)

> So here we are in 2012.  I decided to build a data center providing Internet services to my customers.  I called my friend up at the ISP and told him I needed my block back and installed a Metro-E line and am now using my block to service customers.  I made the business decision that I needed to provide my customers with full BGP redundancy and got onto ARIN's web site and forked over the money to get my ASN number and was assigned one after I proved I needed it.  I also decided that the time had come to offer my customers IPv6 and I made the business decision to fork over the money to get my IPv6 /32 block so I could do that.  (I am surprised to see that the number of IPv6 blocks ARIN sells each month is only about 40 - guess I am an early adopter again or maybe they are too expensive.)

We issue IPv6 address blocks to those who request them and qualify...
(I'm not sure "sell" is the appropriate phrasing but do understand
your point)

> It is my opinion that that the cost for the ASN number was reasonable and that the cost for the IPv6 was quite high for a company of my size.  I know the IPv6 prices have been somewhat reduced to entice folks to switch from IPv4 but my opinion is still my opinion that they are too high.  Lowering the cost even more might increase IPv6 utilization faster.  I'm guessing the AT&T's of the world and all the other folks who have Class A addresses might not find it so high because of their deep pockets - but I did.

Acknowledged; we have tried to make IPv6 fees comparable to IPv4 fees 
but there is more work to be done here (and it still may be significant 
increase when compared to those with just IPv4 legacy space in any case)

> I didn't bother to read the legalese that came along with both of these purchases as it doesn't really matter if I agree with them or not.  I can't change them (as I'm too small to have any clout) and the only way I could get an ASN number and an IPv6 block from ARIN was to accept their legalese and pay their fee.  It is possible that the ASN number purchase put my "Legacy" block under agreement with ARIN but since I didn't read the legalese I don't really know.  I don't actually care that much if it did but if I had my druthers I would prefer to keep my little Class C in legacy status  - especially if it is free to do so.

The financial benefit is clear, although the registration fee under an LRSA 
is rather modest as well ($100/yr).  Since we have to maintain the registry 
(including Whois, reverse DNS, bulk Whois, etc.), it seemed only fair that 
legacy IPv4 holders help pay something towards maintaining these systems.

> I've been told that ARIN has sent out numerous letters/emails to "Legacy" holders trying to convince us to sign an agreement with ARIN.  Oddly I've never received one even though my email address that IS listed with my Class C has never changed and still works.  Like any sales offer, if I received a request from ARIN I would read it and make a business decision and either do it or not based on what I think the best decision is for me.

I believe we sent one via postal mail and email to each address block holder;
this is an open research item which I will report back on PPML shortly.

> Note that I tried to make a change in the company name for my block (as I changed our company name from Eclipse Computer to Eclipse Networks) and figured I'd go ahead and see if ARIN would do it.  They refused unless I provided them a bunch of documentation which I tried to do but gave up.  Maybe their requests were 100% reasonable and maybe they were protecting me by requiring me to provide them stuff, but, nowhere on my paperwork from the InterNIC does it say I need to get approval from ARIN and conform to their policies to make that change.  For that matter, it doesn't even say I need to abide by the policies of the InterNIC either which is odd.  ARIN currently has a monopoly on the IP number database for North America so if I want to be listed I am essentially forced to go thru them for both new stuff (like I just did) and old stuff which predated them.  I'm not saying that is good or bad as I could easily make an argument for both.

We've developed processes over time which quite cautious with respect to
changes; this is protection against potential hijacking of address blocks
by nefarious parties (think bulk unsolicited emailers and botnet builders)
I recognize that it can be a burden, but the alternative is high risk of 
parties losing their address space to clever corporate impersonators...

> When I read all of the email going thru this community - I see very clearly that most folks are doing just that - making business decisions on what they think is best for themselves or their customers.  I think doing this is part of human nature and I don't expect humans to do anything different unless they see some other good in it for them.  What is very clear in the short time I have been reading submissions in this community is that there will never be a consensus on what to do with the "Legacy" holders unless the "Legacy" holders are ALL part of the process - something that is probably not possible.  I have no way to tell when a comment made to this community is coming from a legacy holder or not - or a hybrid like me.

It's very difficult to get _everyone_ involved in the process, whether 
everybody means legacy or ARIN-issued, service provider or end-user, or
corporate vs educational vs government.  In the case of discussing the
address space issued long in the past, it's particularly difficult since
there was a different culture and expectations in the early days versus
the business conditions of today.

> It appears to make some folks in this community VERY unhappy that they/we won't all conform and agree to be under an ARIN agreement and pay the corresponding fees.  Based on what I've seen in these community emails, I gather that some of those large Fortune 500 Legacy holders have chosen not to subject their very large IP blocks to ARINs authority by signing an agreement with ARIN.  Assuming they got the same or similar documentation from the InterNIC (or whatever/whoever preceded them) that I did - then I don't see any legal reason they must because the documentation and the assignment letter don't mention any legal framework that these block number assignments fall under and don't address this issue at all.   I'm not an attorney but I'm pretty sure that that makes the "Legacy" holders subject only to whatever is written in the application and assignment letter plus whatever applicable laws might apply to such an assignment.  Congress does have the power to pass a law overriding this and dictating how this all should be done but I'm guessing those large "Legacy" holders that have deep pockets also have the political clout and lobbyists to make that difficult for ARIN to achieve - not to mention the other countries ARIN serves.  Also it is quite possible that if ARIN's "community" decided to implement a significant policy that the large legacy holders severely don't like at all, like to refuse to list a large block that is sold outside of ARINs control, then they could gang up on ARIN  and pool there already considerable resources and probably win (one way or another) - giving ARIN a huge black eye and thus causing ARIN to be viewed as not fully legitimate.  I learned a long time ago that if elephants are tap dancing in your direction it is probably a good idea to get out of their way.  I'm guessing (to pick 3 random companies for illustration purposes)  that Sprint, Ford, and GE could replicate the ARIN database function separately within a month or so and that they have enough clout and friendly CEO's of other fortune 500 companies with IP blocks to create a competing registry which would be taken seriously by the rest of the Internet world because the rest of the world wants to do business with them too.  In the real world these CEO's vacation together and their wives are best friends.  To ignore the power of fortune 500 CEOs (and their wives) collectively is foolhardy.

Full agreement, but at present the major difference of view seems to 
be between the service provider community and some of those who hold
legacy space; both of these are significant communities and ARIN finds
itself in the middle.

> Each interested party has their own agenda.  If I'm John Curran (and the board of directors) and I'm responsible to manage and administrate the ARIN organization then I would prefer all block holder be under a common agreement as that makes my job much easier and less costly to do and I would probably work towards that end.  (That is what I see is happening.)  If I'm a big "Legacy" block holder then I want to keep my costs down and free IP addresses are less costly than ones I have to pay for and unless ARIN can provide me something that offsets my costs with them and possibly makes me money - I'm not really interested in signing up with ARIN since I don't legally have to.  Their Legal issues are probably greatly reduced if they don't sign an agreement also.  If I'm a small "legacy" block holder (which I am), I definitely want to keep my costs down since I don't have deep pockets and free IP addresses are definitely better than paying for them.  If I'm someone who has one or more ASN number and publishes my managed addresses directly on the Internet then I want to make sure whatever process is used by others to obtain their IP addresses doesn't screw me and my customers up from utilizing the Internet.  Finally if I'm and end user I just want the Internet to work properly as fast and cheaply as possible.

Everyone who has an legacy address block has the materially the 
same capabilities as they had prior to ARIN's inception - as you
have discovered, you can make use of your block, update contact 
info, list your reverse nameservers, etc. There is an open question 
as to what policies applied to legacy address space at the time of 
issuance, particularly given ambiguity of the issuance documentation 
but the existence of RFCs for the registry system containing policy.

If you want to monetize your address space without the constraint
of any policies applying, then this is a particularly problematic
situation. The fact that there is no clear contract with ARIN is
actually a two-edged sword, in that ARIN has no obligations to a
legacy resource holder other than those implied from fulfilling 
the mission.  This mission explicitly includes providing the 
community with a voice in setting the policies on how number 
resources in the region are managed.

Note that ARIN enforces the community-developed policies because the 
registry is not just a service, but a shared activity of the Internet 
community which affects everyone.  For example, the policies by which 
IPv4 addresses may be transferred have potential for significant routing 
implications as well as market accessibility questions for smaller 
organizations.

I actually don't know what transfer policies are best overall; that 
is a matter for the community to discuss and decide.  Where ARIN does
not get a choice is in whether we enforce such policies on all of 
the address blocks in the registry; we were founded to support the 
development of these policies for management of the Internet space
in the region and must use them when managing the registry.

> I would also add that John Curran has the fiduciary responsibility of being the ARIN CEO and surely has been advised may times by the board of directors and legal counsel on the direction they are going.  When he participates in this forum his fiduciary duty is to further the ARIN mission and follow guidelines laid out by his board, his legal advisors and then this community.  It is obvious to me that there are just some things he cannot or should not say in this written community as a sharp attorney somewhere will pick it up and potentially use it for their own purposes which may be at odds with ARRINs state mission.  To that end I doubt he would come out and say definitively something like "ARIN has no legal right to manage the IP blocks that legacy holders have" - even if that is what he and his board and his legal advisors have concluded.  Obviously most of the members of this community are not privy to what is said in private behind closed doors.  I would also add that reading between the lines it appears that ARIN is striving to keep the peace with Legacy holders and provide them at least some service and that of course is positive for all - but I would add that an even more positive relationship is possible and desirable.

ARIN has provided service to legacy registrations without charge since
its inception, and actually done quite a bit to make sure that existing
address holders have trouble-free use of their address blocks just as 
they did before ARIN's inception.  Yes, formal agreements are helpful 
as is the nominal $100 maintenance fee, but that is not required of any 
legacy holder who wants to just continue to use their address space.

> Based on the fact that everyone involved will want to continue making the business decisions they decide is best for themselves concerning these "Legacy" blocks, I think it is prudent for ARIN to make the best of a difficult situation.  The problem will slowly fix itself as IPv6 is adopted under ARIN agreements but I'm guessing that is ten years or so before IPv4 isn't needed much anymore.  In the meantime, deciding to fight all of the "Legacy" holders isn't a winning proposition especially with the deep pockets and political clout out there - and the lack of a clearly enforceable agreement that has been successfully scrutinized by the courts.  I see some folks advocating strongly in this community to reign in "legacy" holders - but no amount of Policies put in place by ARIN will ever solve this issue and it is futile for ARIN to create policies that a large percentage of the Internet "legacy" holders will just ignore.

While you may not realize it, the conflict is actually being set into 
motion from the other direction; i.e. ARIN has been always been applying 
the community-developed policies to all entries in the registry, but now
with the depletion of IPv4, folks have realized that ARIN's mission may 
reduce the monetization of their number resources depending on the 
particular transfer policies that are adopted.

> I would propose that instead of fighting the "Legacy" holders, why doesn't ARIN just join them.  I don't know what the costs are for ARIN to conduct their mission and I don't know if the revenue they get now pays all of their bills or not.

The current fees cover the expenses, although there are valid questions 
of equity when some of those benefiting do not pay and therefore everyone
else pays more.

> I'm sure ARIN knows by now pretty much all of the issues that are keeping the "Legacy" holders from signing up.  Change the agreement that ARIN asks "Legacy" holders to sign and remove ALL of the obstacles and objections of the legacy holders.  Let the addresses be kept by them for free if they want, and let them transfer them if they want to for free or for a nominal administration charge, and remove all the reasons why they won't sign up now.  

That's an excellent idea, and we've actually revised the LRSA three times
trying to get closer to that goal.  Legacy holders without signing anything,
but under an LRSA get a clear set of rights and services for a nominal annual
maintenance fee.  We have hundreds of signatories including all categories of
legacy holders - <https://www.arin.net/knowledge/statistics/legacy.html>

About the only thing that ARIN hasn't done is said "Community-developed policies 
do not apply to your legacy resources", and again, it's because it is directly 
contrary to our founding and mission.  This is the fundamental difference in
perspective, and it is a non-trivial issue to resolve.  

In the meantime, the best we can hope for is that reasonable policies are set
that treat all resource holders with dignity, equity, and respect.  There has
been a trend towards increasing transfer-friendly policies, and that much is
encouraging.

> Make them ARIN's friends and let them be a significant part of and add their voices and expertise to this community.  I'll bet if reasonable optional fees were instituted, many would go ahead and pay them at least once.  As long as ARIN's expenses are met ongoing, and everybody is included - everybody wins.

I'm not sure the fees have ever been the issue, since they have been set to
$100/year under the LRSA. The concept that the address blocks are subject to
the policies of the registry on an ongoing basis is a significant concern for
many legacy holders, no matter how benevolent those policies may be nor the 
ability to participate in their formation.

> All of the "legacy" holders were early adopters and helped in their own way to build and pay for the building of the Internet.  This is their compensation for that and therefore this is also fair to the folks who signed up with ARIN later on after the Internet was firmly established.  Then as IPv4 winds down and IPv6 winds up this problem just goes away and ARIN now has a lot more friends and a lot less adversaries.   I'm guessing I'm not the first to advocate doing this but in only two months being a member of this community, it is very obvious that this is the only solution that can ever work.

I also hope that legacy-friendly fees and policies help keep the community 
together, but that might not be enough if the desired outcome by some is a 
"policy free zone" for their number resources.

> One last thing.  I'm guessing as folks read this their first inclination will be to pick this submission apart.  Most likely I am wrong about certain things I've written and I'm sure there are folks who would be happy to pick it apart point by point and point that out.  If that happens then the overall point of this submission has been missed!  It is OK if I'm wrong in places and it is OK if I have opinions different than other members of this community.  The one place I am not wrong though is my point in the last paragraph that it would be better to join forces with the Legacy holders than fight them and possibly lose - because if fighting them is chosen then someday very soon a court will make this decision for ARIN and this community - and very rarely does a court make everyone happy.   Now I will go back to my real job of helping customers utilizing the Internet that I helped build in a small way.  Hope I followed my own request for these submissions to be constructive.  :-)

Steven - I hope you don't take my comments as "picking apart" but more as an 
attempt to share perspective just as you've done in your excellent posting.   

Thanks again for taking the time to send your thoughts on this important topic!
/John

John Curran
President and CEO
ARIN