[arin-ppml] Recommended Draft Policy ARIN-2014-1: Out of Region Use

[John Curran]

On Dec 24, 2014, at 2:26 PM, William Herrin <bill at herrin.us> wrote:
> 
> I'm don't think there is such a change but there are a few things that
> jump out at me as being particularly offensive.
> 
> 1. This issue is not a concern for ARIN number resources overall. Now
> and for the foreseeable future it frankly only matters for IPv4
> addresses. Crafting a one-size-fits-all policy here needlessly
> complicates the matter. No one here cares whether AS numbers or IPv6
> addresses are used out-region and burning one single staff minute
> analyzing the acceptability of such is a waste. Worse, crafting the
> policy to act reasonably with the other number resources corrupts its
> ability to deal correctly with the IPv4 situation.
> 
> 2. I disagree with spinning it as an existing policy flaw. There's a
> ARIN -implementation- flaw here. Classically and consistent with the
> spirit of ICP2, the RIRs allow minor outregion use of addresses that's
> incidental to an in-region operation. And you know what? You haven't
> been the slightest bit shy about deciding that external documents like
> ICP2 and RFC2050 constrain ARIN activity in other matters like the /10
> for large scale NAT. I don't know how ARIN got itself twisted up where
> it couldn't find the limits of "minor" and "incidental" but trying to
> override that with rigid policy requirements is going to be
> problematic.

To be clear, I was not stating that the draft policy addresses addresses
a policy flaw; I was asking for your thoughts about potential mitigation 
steps (if any) for your perceived concerns should the community decide 
the draft policy should be adopted because they perceive it to address
some flaw.

With respect to incidental out-of-region usage, you are incorrect in that
we presently do allow such incidental usage, but the resources that are 
requested must be based upon demand within the region.  This point has been 
explained several times, including in the ARIN 31 Policy Experience Report 
<https://www.arin.net/participate/meetings/reports/ARIN_31/PDF/monday/nobile_policy.pdf>

> 3. Registry shopping is a bad bad bad idea. It defeats and is directly
> contrary to the whole ICP2 spirit of LOCAL self-governance. As
> written, this policy doesn't discourage region shopping, it codifies
> it. RIPE policies gotcha down? No sweat, we'll buy a cage in Ashburn
> Equinix and use that as a jumping board to shop ARIN instead. As long
> as you're big enough to afford that cage and the servers inside, this
> policy removes all limits.

As noted in the referenced Policy Experience Report, some RIR shopping
is likely occurring today, and current policy text is less than clear 
in this area.  ARIN staff reported on this to the community, and there 
has been a range of potential policy changes suggested as a result; some
of these disallowed out of region use and some explicitly allowed it.

> 4. Limiting the registrants to folks making a notional use of IP
> addresses or a single AS number somewhere inside the ARIN region just
> makes it worse. There's already a fairness gulf between shops large
> enough to employ a dedicated number resource group and those who must
> rely on consultants and luck to find a path through the registries'
> arcane rules. The 1AS/22/44 rule poses no real obstacle to a
> multinational grabbing addresses where convenient but it sows even
> more challenge and confusion for a smaller shop.

Thank you for expressing your views on the proposed draft policy; it 
would best for advocates of the policy change to address your concerns.

Absent any policy change, we will continue to implement the current policy
as noted in the policy experience report.  You should suggest alternative
policy text in this area if neither the current policy implementation nor 
the recommended draft policy meets your needs.

Thanks (and Happy Holidays!)
/John

John Curran
President and CEO
ARIN