[arin-ppml] ARIN-PPML 2015-2

Tue Jun 2 11:48:07 EDT 2015

First a diversion:

I continue to hear RFC2050 used to buttress the continuance of needs testing
today.

It should be obvious to anybody that *in the presence of a free pool* that
without needs testing transfers, you effectively remove needs testing
altogether.

Otherwise someone could get addresses, transfer them away to a needless
entity, and repeat the process to drain  the pool. A non-starter, obviously.

So of course we needed to needs-test transfers then, but the argument today
is in the context of a drained free pool, and so the logic behind RFC2050's
testing of transfers is likewise draining away.

Onto this discussion:

What is happening in this discussion is, in my mind, the tail wagging the
dog.

It's as if your local property registrar in your county has determined that
when you buy a property, you are really buying the listing at the
registrar's office.

Instead of the fact that you are buying real property and the registrar is
merely registering your ownership, not providing your rights to it. Just
because IP addresses are not tangible, like real property, doesn't mean they
only exist as database entries in a registrar's list. Especially as we have
demonstrated that that list is not dispositive insofar as being able to
utilize or transfer rights to utilize the addresses. We all know that ARIN
is not the routing police.

What David and other are saying is that your rights are to an exclusive set
of numbers to be used on the Internet, not to a registry listing. And as
proof of that position, they point to the fact that address rights are
transferred very effectively without regards to the ARIN registry. There is
no denying this. Legacy sellers legally sell their rights for money, buyers
pay money and then use the addresses as they wish, and ARIN's registry has
nothing to say.

ARIN has played typical historical role of the over-reaching steward who
comes to feel the resources being stewarded belong to the steward and not
the king. 

So the answer to John's question of what is being transferred?  The
exclusive right to use a block of numbers on the Internet, deriving from a
continuous chain-of-custody of rights granted legally by the US Department
of Commerce. For legacy holders, anyway. For non-legacy holders, their
rights derive from the RSA with ARIN, and ARIN's rights derive from their
MoU with the US Department of Commerce. 

Imagine a thought experiment. I have a pool of 100 mutually exclusive
numbers of which one is a lotto winner. I can sell each number to a buyer
without a registry but with a contract. If I sell the same number to two
individuals, those individuals can take legal actions based on the contract
that assures exclusivity. So there are legal rights to numbers conferred via
the contract that do not have anything to do with a registry. I might use a
registry to keep track of things, but that is secondary to the legal rights
contractually conferred.

Imagine a though experiment. I received an allocation from Jon Postel,
acting under the authority of the US Department of Commerce. I have an email
from him with the block numbers I was assigned. I use the addresses for five
years but then find that they were not properly recorded by Mr. Postel, or
were incorrectly transferred to a subsequent registrar like ARIN.  Can't I
take the original email (the contract here) to a judge and demand that the
registry be changed to match my email?  Or, since the rights are "provided"
by ARIN, wouldn't I be out of luck, since the rights are to a registry
entry, and the entry doesn't match my email? In other words, which is
primary, a contract granting me exclusive use of numbers on the Internet, or
ARIN's control of their registry system?

A registrar records property rights, it doesn't create them.

Regards,

Mike Burns

From: arin-ppml-bounces at arin.net [mailto:arin-ppml-bounces at arin.net] On
Behalf Of John Curran
Sent: Tuesday, June 02, 2015 10:36 AM
To: David Conrad
Cc: arin-ppml at arin.net
Subject: Re: [arin-ppml] ARIN-PPML 2015-2

On Jun 2, 2015, at 9:04 AM, David Conrad <drc at virtualized.org
<mailto:drc at virtualized.org> > wrote: 

John,

On Jun 1, 2015, at 4:48 PM, John Curran <jcurran at arin.net
<mailto:jcurran at arin.net> > wrote:

 Your confusion is likely over what represents "correct attribution" - if
ARIN does not

 operate the registry according to the policies set by those who use it,

In your view, who uses "the registry"?

Do network operators, anti-abuse community members, law enforcement,
consumer protection agencies, etc., make "use" of "the registry"?

All of the above parties (and all of them can participate in 

defining the registry policy)

One can argue that the ARIN community shouldn't have policies that inhibit
transfers

One could, but I am not. I don't care if "the ARIN community" comes up with
a policy defining the sky to be green.  There are numerous mechanisms by
which the ARIN community can enforce policy such as a prohibition against
(particular) transfers: refuse to delegate reverse DNS, refuse to update the
ARIN routing registry, imbed notifications of policy violations in
registration records, call the out-of-policy transferees names, etc. None of
these defeat the very reason for the existence of the registry. Refusing to
update the registration database does.

David -  you seem to think that there's some "thing" transferred  

other than rights to the registry entry itself; ie ARIN is "refusing 

to update the registration database", as if it were a registration 

of some independent item - an automobile, for example.   What 

exactly are the IP address blocks if not the registry entry that 

was created when same is assigned? 

It is necessary to address this if you are to claim of any accuracy 

resulting from ARIN following community policy.

 but I don't think you're actually advocating that ARIN ignore community
policy in the

 operation of the registry?

The "community" that makes use of the registry is larger than "ARIN".

If the subset of the community that participates in the definition of ARIN
policy decided to create a policy that effectively destroyed the
registration database, yes, I would definitely advocate ARIN, the corporate
entity (or, more specifically, the ARIN board), ignore that policy. I
believe the board would actually have a fiduciary responsibility to do so.

I believe failure to maintain an accurate registration database (defined to
be one that matches actual reality, not one that corresponds to what an
infinitesimal subset of the Internet community thinks might be a good idea
on any particular day) is a violation of the trust Jon Postel and the
Internet community as a whole has placed upon ARIN when ARIN was granted the
monopoly for registry services for the ARIN service region.

Again, this assertion is based on your interesting interpretation

that ARIN should update the register contrary to policy.

With respect to Jon and the time of ARIN's formation, it is fairly

clear that the current policies regarding need-based transfer

would align quite well with his expectations, especially since the

transfer policy at the time, as stated in RFC 2050, was such:

"7. The transfer of IP addresses from one party to another must be approved
by the regional registries. The party trying to obtain the IP address must
meet the same criteria as if they were requesting an IP address directly
from the IR."

Could you please clarify if that is what you are suggesting?

That ARIN abide by RFC 7020, section 2.3 and section 7.

Done.  You have yet to explain how and what is actual transferred

that differs from the rights to the entry in the IP registry.  If there is

something else transferred (and thus discrepancy if the registry is

not updated), please elucidate.   If indeed the IP address block is

one and the same with the rights to entry in the registry, there is 

no inconsistency at all.

One more time:

Historically, the point of the registry database was to facilitate
management

of the network, e.g., a place you could look up registration information

when you wanted to contact the entity associated with the source address.

In the post IPv4 free pool world, what's the point of the American
_Registry_

for Internet Numbers again?

Your continued attempts to dodge this question is getting depressing.

The actual use of the registry has to obtain the place where you 

_start_ such a process, noting that ISP's/LIRs delegate blocks 

to organizations, and that the real world has things like LOA's

that are often used, etc.

None of this has changed - you still start the process with the 

registry, and need to pursue to find the operational contact you 

seek.  ARIN following its community policy doesn't change this

in the least, and you probably are aware of this reality existed

long before any transfer market.

Thanks!

/John

John Curran

President and CEO

ARIN

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.arin.net/pipermail/arin-ppml/attachments/20150602/090b7be8/attachment.htm>