[arin-ppml] Draft Policy ARIN-2014-9: Resolve Conflict Between RSA and 8.2 Utilization Requirements

[John Curran]

On Mar 21, 2014, at 4:48 AM, David Huberman <David.Huberman at microsoft.com> wrote:

> Think about that for a moment please:  legitimate M&A activity occurred, but Whois never
> got updated.  That's a failure of the system. Why does it fail? 

Excellent question.

> The common scenario is straight forward:
> 
> 	1. Company A buys company B.
> 	2. Company A submits a transfer request to ARIN to have the IP address and AS number
> 	registrations reflect that Company A is now the registrant.
> 	3. ARIN starts asking questions about the utilization of the number resources.
> 	4. Company A walks away from the transfer and never returns.
> 
> Step 3 is the consistent problem.  In many cases, Company A never even submits the transfer
> request because they are scared off by step 3.   In some cases, it's because they don't KNOW
> how the IP addresses are being used.  In some cases, some IP addresses are used, and others
> are not, and they think that if ARIN finds that out, they are going to take the addresses away.

The potential reasons you cite for companies being "scared off" are:

  - They don't know how their IP addresses are being used
  - They think that if ARIN finds out some are unused, ARIN will take them away.

> ...
> One of the concessions made over time was language in the RSA documents which 
> removed that concern; it prohibits ARIN from forcibly taking away space when the
> signer is in compliance with the other terms and conditions of the contract.

That is correct; the specific language in both the RSA and LRSA is as follows:

   RSA - 
"6. REVIEW OF HOLDER’S NUMBER RESOURCES
Whenever a transfer or additional IP address space is requested by Holder, ARIN may review Holder’s utilization of previously allocated or assigned number resources and other Services received from ARIN to determine if Holder is complying with the Service Terms. Except as set forth in this Agreement, (i) ARIN will take no action to reduce the Services currently provided for Included Number Resources due to lack of utilization by the Holder, and (ii) ARIN has no right to revoke any Included Number Resources under this Agreement due to lack of utilization by Holder. However, ARIN may refuse to permit transfers or additional allocations of number resources to Holder if Holder’s Included Number Resources are not utilized in accordance with Policy."

LRSA - 
"7. REVIEW OF LEGACY HOLDER’S NUMBER RESOURCES
Whenever a transfer or additional IP address space is requested by Legacy Holder, ARIN may review Legacy Holder’s utilization of previously allocated or assigned number resources and other Services received from ARIN to determine if Legacy Holder is complying with the Service Terms. Except as set forth in this Legacy Agreement, (i) ARIN will take no action to reduce the Services currently provided for Included Number Resources due to lack of utilization by the Legacy Holder, and (ii) ARIN has no right to revoke any Included Number Resources under this Legacy Agreement due to lack of utilization by Legacy Holder. However, ARIN may refuse to permit transfers to Legacy Holder or additional allocations of number resources if Legacy Holder’s Included Number Resources are not utilized in accordance with Policy."

Note that the RSA and LRSA are materially the same in terms and conditions at this 
point (except for the applicable fee schedule) and both provide that ARIN may review
utilization of number resources but that ARIN disclaims a right of revocation due to 
lack of utilization. (There is a viable transfer market as well as the option to return
number resources, both of these provide fine alternatives for achieving the targeted
utilization.)

Note that reclamation remains an options with resources _not_ under an agreement; 
if parties want to have a clear statement of rights with respect to their legacy 
number resources, then entry into an LRSA provides them that.

Parties who have their resources under an RSA or LRSA cannot have their resources 
revoked for lack of utilization, although ARIN does ask about their utilization 
during NRPM 8.2 transfer; in cases of significant lack of utilization we will also
note the option of voluntary return as well as the ability to transfer via NRPM 
8.3/8.4 i.e. the other options under NRPM 8.2 language, specifically -
 
 "ARIN will work with the resource holder(s) to return, aggregate, transfer, 
  or reclaim resources as needed to restore compliance via the processes 
  outlined in current ARIN policy."

I do not know if asking parties (that are undergoing NRPM 8.2 transfer) to know 
their number resource utilization serves a useful purpose to the community, but 
that is the primary role of NRPM 8.2.  Note that it may also serve as a deterrent 
(although hard to prove) in some cases to M & A transactions purely for purposes 
of obtaining IP space, since ARIN will seek to understand the utilization of the 
combined entity and may not agree to allow the transfer per community policy 
(and parties that endeavor to work around such requirements via fraudulent 
representations to ARIN can have the number resources reclaimed per NRPM 12) 

> This new language, however, directly conflicts with the plain language of the NRPM 8.2
> paragraph that this policy proposal seeks to remove.

Note that the policy proposal seeks to remove the entire section of NRPM 8.2 
regarding utilization, when only conflict is with respect to the appearance of 
the word "reclaim" in the policy text when dealing with number resources which 
are under registration services agreement.

The intent of NRPM 8.2, however, is quite clear - parties merging with other 
parties will have a discussion with ARIN about the number resources utilization
of the combined entity.

> From a business standpoint -- from the standpoint of actually running the registry of
> ARIN -- the paragraph I propose to be removed is NON-OPERATIONAL.  It cannot
> be enforced under the terms of the RSA.

The language is actually quite operational - as you note, it results in a 
dialogue with the party about the number resources of the combined entity. 

One may attribute NRPM 8.2 transfers not being completed to this requirement,
but it is equally due to lack of understanding or misinformation of the RSA/LRSA 
agreements, whereby parties are "scared off" from completion of the transfer 
processes.  As David notes, the fear of reclamation for legitimate requestors
is unfounded (even if hyped by some in the community for their own purposes.)

It worth considering the benefits provided by reviewing the party's utilization 
of number resources, when compared against the resulting disincentive to completion
of transfers (due to uncertainty); in the end, this is a policy tradeoff that the 
community needs to decide on and ARIN will process 8.2 transfers accordingly.

Thanks!
/John

John Curran
President and CEO
ARIN