[arin-ppml] Draft Policy ARIN-2014-20: Transfer Policy Slow Start and Simplified Needs Verification

[David Huberman]

First, a direct reply to Jason, who wrote:
>So we wanted some requirement to prevent someone 
>from spinning up Orgs just to get space with no intention of using it.

I don't like writing policy which tries to outsmart scammers.  Scammers represent a fraction of a percent of ARIN transactions. We should write policy that makes good technical sense for the 99%. Also, this is 8.3 transfers - space bought on a market, and recognized in ARIN's Whois.   In my experience no matter how section 8 is written, bad actors will buy the space they want to do bad things with, use it, and dump it - with or without allowances to update ARIN's Whois.

Second, a comment about 2014-20:  how do these common scenarios work in the proposed policy:

Scenario 1: 
ABC Trucking Company (an end-user) has 29 /24s of space from ISP.  ABC is going to disco from that ISP, and is going to buy space on the market to renumber into and grow.  Based on their 2 year projections, they've decided to buy a /16 on the market.  Do they qualify to transfer the entire /16 under 2014-20?

Scenario 2:
XYZ Cloud Hosting Company (also an end-user, but could argue to be an ISP if it wanted) has a /20 from ARIN.  They want to buy a /15 that's available on the market for cheap, because they hope that's what they'll use in 2 years, and the price of the /15 is right.  Do they qualify for an 8.3 transfer under 2014-20 as an EU and/or as an ISP?

Scenario 3:
XXLarge ARIN company has 1 million IP addresses from ARIN.  They buy the exclusive first rights to a /8 worth of address space in the open market.  Under 2014-20, how much space can they transfer into ARIN on day 1, and how much space has to sit in the old company's name?

Thanks for indulging me.  I'm trying to understand how 2014-20 will act in what I think are real-world scenarios,
/david