[arin-ppml] ARIN-PPML 2015-2

[John Curran]

On Jun 2, 2015, at 1:12 PM, David Conrad <drc at virtualized.org> wrote:
> 
> John,
> 
>>> Do network operators, anti-abuse community members, law enforcement, consumer protection agencies, etc., make "use" of "the registry"?
>> All of the above parties
> 
> Do you think any of these communities believe it is in their or the Internet's best interests to give anyone who transfers addresses outside of ARIN policy a pass on having the registration information associated with those addresses be accurate?

Interesting question.  For the moment, I’ll presume that by “accurate” you mean whether the
party operationally using the address block matches the address holder.

If the answer is “no” (they object to an different operational party), then how do they cope with
the existing customer delegation, Letter of Agency (LOA) and leasing situations today?   Are
these communities unable to deal with such, or expect that ISPs not accept such?  How do
they intend to prevent such a practice?

These communities understand that the address holder is the start of the process; it is not at
all uncommon that some other party (e.g. an affiliate, a customer, etc.) is actually operationally
using the address block.  If there is a different expectation, then they had best engage with the
ISP regarding a very wide range of practices (of which address transfers are only one mismatch)

> you seem to think that there's some "thing" transferred
>> other than rights to the registry entry itself;
> 
> Bored with the word games.  Once again:
> 
>>>> Historically, the point of the registry database was to facilitate management
>>>> of the network, e.g., a place you could look up registration information
>>>> when you wanted to contact the entity associated with the source address.
> 
> By refusing to accept changed registration information, even in cases where the change is mutually agreeable among the two parties, ARIN policies are directly damaging the registry database.

David - It’s not a word game; it very much has to do with being precise about what actual
rights are involved.  This is extremely important, particularly if address holders want to have
meaningful legal recourse.  It is fairly straightforward to explain how an Internet identifier
registry is operated as a cooperative activity on behalf of the community, under policies set
by that community, and that parties issued address blocks are associated with specific
entries and have specific rights to those entries as provided by registry policy.  No hand
waving and no magic sauce involved.

You have yet to identify what exactly what a buyer is obtaining _other that these rights
to the entry in the registry as provided by registry policy_, and your inability to do so is
central to the issue.

We have hundreds of address transfers taking place which indicate that the rights to the
address block entry are transferred to the recipient; what other rights do you feel folks are
purchasing aside from those associated with address block entry and where do those
rights originate?  You assert that cases where the registry policy isn’t followed  (and the
registry not updated to reflect the buyer) result in “registry inaccuracy”, in that the buyer
received something but they are not listed on IP address block entry in the registry.
One must ask then what exactly did the buyer actually receive in this case, and why
isn’t this a case of outright fraud on behalf of the seller, given that the registry policies
are public and preclude transfer of the rights to the IP address block in the registry?

Note that ARIN is presently issuing IPv4 address space, and we provide very clear
language noting what these recipients are receiving for rights to the address block;
your formulation implies that there’s something else (in addition to these rights to the
registry entry) when an IP address block is being issued - what exactly is it?  It is
clearly very important for that to be known to all of the RIRs so that we can inform new
recipients of what exactly that right is and provide them appropriate documentation of it.
We are also issuing IPv6 address blocks to parties every month, how should we explain
your "je ne sais quoi”  rights that you believe they get along with the much more legally
clear rights to the IP address block entry in the registry?

> I do not believe this is good stewardship and believe it is a violation of the trust the community (not just ARIN participants) has placed in ARIN.  This isn't about whether transfers should or shouldn't be allowed, this is about REGISTRY ACCURACY.  Playing legalistic word games by redefining what the registry is might make your lawyers and wannabe lawyers happy, but it does not help the Internet community.

I’m not sure that capitals particularly add anything…  The registry is accurate if
operated in accordance with the registry policy.

Note that for some Internet identifier registries, it is quite possible that there are no
transfers possible…  how does the IANA handle the listed contact wishing to sell a
MIME media-type entry?   Once I obtain one, can I transfer it to anyone who needs
the unique value?  If the IANA fails to process it, noting absence of policy allowing
such, does the registry become “inaccurate" because I just let another company
use it and note that the IANA isn’t keeping up?  How the IANA would handle such
a case might provide a rather informative example regarding "registry accuracy"...

>>> That ARIN abide by RFC 7020, section 2.3 and section 7.
>> Done.
> 
> Are you seriously arguing that pretending a transfer didn't occur because it doesn't conform to ARIN's "Policy of the Day" means ARIN is abiding by the requirement to "provide accurate registration information of those allocations in order to meet a variety of operational requirements.”?

Registries have policy which specify their contents.  If the contents don’t match that
result, then indeed there is a serious REGISTRY ACCURACY problem.

>> The actual use of the registry has to obtain the place where you
>> _start_ such a process,
> 
> And what happens when the _start_ of the process is intentionally made inaccurate?

It’s quite accurate, and the address holder should be able to tell you if someone else is
operationally making use of the space.  As noted above, it’s a fairly common occurrence
(e.g. customer delegations)

Thanks!
/John

John Curran
President and CEO
ARIN



-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 842 bytes
Desc: Message signed with OpenPGP using GPGMail
URL: <https://lists.arin.net/pipermail/arin-ppml/attachments/20150602/5b7a00e9/attachment.sig>