[arin-ppml] Draft Policy ARIN-2014-1: Out of Region Use - revised

[ARIN]

Draft Policy ARIN-2014-1
Out of Region Use

ARIN-2014-15 has been revised.

Draft Policy ARIN-2014-1 is below and can be found at:
https://www.arin.net/policy/proposals/2014_1.html

We are also attaching a staff assessment.

Regards,

Communications and Member Services
American Registry for Internet Numbers (ARIN)


## * ##


Draft Policy ARIN-2014-1
Out of Region Use

Date: 2 Aug 2014

Problem statement:

Current policy neither clearly forbids nor clearly permits out or region 
use of ARIN registered resources. This has created confusion and 
controversy within the ARIN community for some time. Earlier work on 
this issue has explored several options to restrict or otherwise limit 
out of region use. None of these options have gained consensus within 
the community. The next logical option is to discuss a proposal that 
clearly permits out of region use without limits, beyond those already 
existing in policy.

Permitting out of region use, however, poses issues that have to be 
addressed by policy and adjustments to operational practice. Out of 
region use needs a clear definition and any operational practices based 
on that definition must not be unnecessarily burdensome. It is 
significantly more difficult and costly for ARIN Staff to independently 
verify the justification and utilization of resources that are 
reassigned or otherwise used outside of the ARIN service region. There 
needs to be recognition of this difference in policy and associated 
operational practices, especially the cost differential when there is 
more than an incidental amount of out of region use.


Policy statement:

Create new Section X:

ARIN registered resources may be used outside the ARIN service region 
and such use is valid justification for new or additional resources. A 
resource is considered to be used outside the region if it exclusively 
serves a user, customer or technical ≠infrastructure location outside 
the ARIN service region.

The services and facilities used to justify the need for ARIN resources 
that will be used out of region should not also be used to justify 
resource requests from another RIR. When a request for resources from 
ARIN is justified by need located within another RIR’s service region 
and is more than the equivalent of a /22 for IPv4, a /36 for IPv6, or 
two (2) ASNs, the requesting organization will also report to ARIN the 
utilization status of all resources of the same type held with any other 
RIR that are used or are available for use within the requested service 
region. The organization will also supply any additional supporting 
documentation requested by ARIN regarding the need for the reported 
resources. The report must demonstrate that all resources currently 
available for use within the requested service region are efficiently 
utilized based on applicable ARIN policy.

Draft Policy ARIN-2014-1: Out of Region Use

ARIN STAFF ASSESSMENT

Date of Assessment: 5 September 2014


1. Summary (Staff Understanding)

Staff Understanding:

This policy would allow ARIN to issue space in response to a request for 
number resources to be used out of region, provided that the 
organization does not use (or has not used) the same justification to 
obtain resources from another RIR and that all resources used or 
available for use in that region (whether issued by ARIN or another RIR) 
meet applicable ARIN policy requirements.

Specifically:

Organizations may request number resources from ARIN for use outside of 
the ARIN region. Organizations cannot use the same justification/need to 
request resources from more than 1 RIR.
Organizations must report utilization of all same-type resources when 
requesting address space greater than an IPv4 /22, IPv6 /36 and/or 2 
ASNs for out of region use.
When requesting number resources from ARIN for out of region use greater 
than the thresholds above, organizations will report utilization of 
number resources are presently in use in that region or underutilized 
and hence available for use in that region, even if registered in 
another region.
Utilization must meet current ARIN number policy, even for resources 
used in another region.

2. Comments

A. ARIN Staff Comments

The policy text states "a resource is considered to be used outside the 
region if it exclusively serves a user, customer, or technical 
infrastructure located outside the ARIN service region". It's unclear 
whether a "resource" is defined as an entire registration (e.g. a /16 
used solely outside the ARIN region) or a portion of a registration 
(e.g. a /20 from a /16 used solely outside the ARIN region). Without 
further clarification, ARIN would consider a contiguous portion of a 
resource exclusively serving entities outside the ARIN region to be 
“outside the region”

Staff would implement the policy as follows:
Staff would continue to require that all organizations requesting space 
from ARIN would need to have a legal presence within the ARIN region.
Staff would require that all documentation and correspondence be done in 
English.
Absent clarification, staff would implement this policy with the 
assumption that it applies to any portion of a registration used 
exclusively outside the ARIN region. As an example, if a /20 is 
requested based on justified need for a /21 to be used at an Amsterdam 
PoP and a /21 to be used at an Ashburn PoP, it would be considered a /21 
used outside the ARIN region.
Organizations will be asked to identify in which region(s) the requested 
resources will be used.
The organization's eligibility would be evaluated based on use of their 
ARIN-region space, their use of same-type resources registered with the 
RIR in which the resources are being requested, and their use of 
same-type resources used or available for use within that region that 
are registered with any other RIR.
If the organization will be using more than a /22 of IPv4, a /36 of 
IPv6, or two AS numbers outside the ARIN region, ARIN will ask the 
organization to provide a list of all same-type resources in currently 
in use within those regions (including space from all RIRs) or available 
for use, and corresponding utilization data for those resources with the 
same level of detail as would be requested for in-region usage.
This policy adds a new requirement that staff review utilization outside 
of the ARIN region, which will likely require more time and effort on 
the part of the analyst, and could delay the review and processing of 
requests of this type as well as other request types that ARIN currently 
handles.
Per NRPM 8.3, this policy could be used to justify receipt of a transfer 
from another address block holder, if the recipient intended to use the 
resulting block out of region.
It is not clear how ARIN can deter organizations from justifying 
additional resources from another RIR based on the same need recently 
used for receipt of resources from ARIN.
The policy states “When a request for resources from ARIN is justified 
by need located within another RIR’s service region and is more than 
the equivalent of a /22 for IPv4, a /36 for IPv6, or two (2) ASNs, the 
requesting organization will also report to ARIN the utilization status 
of all resources of the same type held with any other RIR that are used 
or are available for use within the requested service region.” Since 
number resources obtained from any RIR “are available for use” 
globally, ARIN will ask for utilization status for all underutilized 
number resources held by the requesting organization from all RIRs. If 
this is not the intent, the policy language should be clarified as 
appropriate.
A new section would be added to NRPM, 2.17 Out of Region Use

B. ARIN General Counsel - Legal Assessment

Counsel has significant and material legal concerns about this policy. 
Counsel recognizes and supports the issuance of resources to entities in 
the ARIN region that need number resources that will be used in both 
this region and in the remainder of the world. ARIN currently issues 
resources for these needs based on a needs based allocation methodology.

However, this proposed policy removes the requirement that there be any 
meaningful need for those resources in the ARIN service region, and 
allows all of the need to be outside the ARIN service region. This 
creates new legal challenges for ARIN which are identified below:

First, ARIN is governed by ICANN ICP-2, which calls for establishment of 
a single RIR to serve each region. It further notes that multiple RIRs 
serving in single region is likely to lead to difficulty for 
co-ordination and co-operation between the RIRs as well as confusion for 
the community within the region. The implication of that governance 
structure is that each RIR can and should serve its service region. This 
policy would allow entities with no real connection to the ARIN’s 
service region to obtain, for example, increasingly scarce IPv4 
resources from ARIN and related registry services. This policy would 
result in ARIN effectively providing registry services to other regions, 
and thus appears on its face to be inconsistent with ICP-2. ARIN has 
obligations to follow the global policy in ICP2, or seek changes in it.

Second, if the policy were adopted, ARIN could arguably become subject 
to the jurisdiction and laws passed by governments outside our service 
region. This may lead to ARIN being a litigant in courts of nations 
outside its service region and subject to their requirements and 
judgments. ARIN will need to accept greater legal expenditures and 
risks, as well as potentially larger costs in order to take this greater 
scope into consideration in ARIN’s registry activities on an ongoing 
basis.

Third, the policy fails to recognize that ARIN is not likely to able to 
perform the function contemplated in the policy with certain countries, 
and related public or private entities. See as examples under US law: 
Cuba, Iran and North Korea. The policy could benefit from a specific 
carve out that ARIN may meet its obligations under the laws of 
governments in its service region, even if such requests would otherwise 
comply with ARIN policy. For those who assert that this requirement to 
conform to law is implicit and does not need to be stated in policy, it 
is important the community is under notice of this limit. This issue has 
not been an issue for ARIN prior to this proposed policy.

Fourth, ARIN may be subject to significantly greater political oversight 
by national governments in its service region that will wish to evaluate 
why ARIN alone of the 5 RIR’s is assuming a duty to service all of 
the world’s community. It may be argued by governments in ARIN’s 
region that this is a potential breach of ARIN’s fiduciary obligations 
to its own region, and to examine whether it is consistent with ARIN’s 
non-profit status and other corporate documents.


3. Resource Impact

This policy would have significant resource impact from an 
implementation aspect. It is estimated that implementation would occur 
within 5 months after ratification by the ARIN Board of Trustees. The 
following would be needed in order to implement:

· Updated guidelines and internal procedures

· Staff training

· Engineering efforts to handle out of region business rules may be 
substantial.


4. Proposal/Draft Policy Text Assessed

Draft Policy ARIN-2014-1 Out of Region Use

Date: 2 Aug 2014

Problem statement:

Current policy neither clearly forbids nor clearly permits out or region 
use of ARIN registered resources. This has created confusion and 
controversy within the ARIN community for some time. Earlier work on 
this issue has explored several options to restrict or otherwise limit 
out of region use. None of these options have gained consensus within 
the community. The next logical option is to discuss a proposal that 
clearly permits out of region use without limits, beyond those already 
existing in policy.

Permitting out of region use, however, poses issues that have to be 
addressed by policy and adjustments to operational practice. Out of 
region use needs a clear definition and any operational practices based 
on that definition must not be unnecessarily burdensome. It is 
significantly more difficult and costly for ARIN Staff to independently 
verify the justification and utilization of resources that are 
reassigned or otherwise used outside of the ARIN service region. There 
needs to be recognition of this difference in policy and associated 
operational practices, especially the cost differential when there is 
more than an incidental amount of out of region use.


Policy statement:

Create new Section X:

ARIN registered resources may be used outside the ARIN service region 
and such use is valid justification for new or additional resources. A 
resource is considered to be used outside the region if it exclusively 
serves a user, customer or technical ≠infrastructure location outside 
the ARIN service region.

The services and facilities used to justify the need for ARIN resources 
that will be used out of region should not also be used to justify 
resource requests from another RIR. When a request for resources from 
ARIN is justified by need located within another RIR’s service region 
and is more than the equivalent of a /22 for IPv4, a /36 for IPv6, or 
two (2) ASNs, the requesting organization will also report to ARIN the 
utilization status of all resources of the same type held with any other 
RIR that are used or are available for use within the requested service 
region. The organization will also supply any additional supporting 
documentation requested by ARIN regarding the need for the reported 
resources. The report must demonstrate that all resources currently 
available for use within the requested service region are efficiently 
utilized based on applicable ARIN policy.