[arin-ppml] Draft Policy ARIN-2015-5: Out of region use - revised

[Scott Leibrand]

On Thu, Sep 10, 2015 at 2:40 PM, Martin Hannigan <hannigan at gmail.com> wrote:

>
> I use my addresses globally and will continue to do so as needed.  I've
> never needed a policy to tell me I can or can't.
>
> Why can't ARIN just confirm that they're a business and be done with it?
> Isn't this what we pay them for?
>

ARIN staff has indicated that a policy like this one is required for them
to stop interpreting ICP-2 as requiring in-region use of addresses.  In
other words, you may not have needed a policy to use your addresses
globally, but ARIN has indicated they do need a policy for others to do so.


> GOTO 10
>
> Not in favor.
>

Do you have any arguments against the proposal?  "I've never needed a
policy to tell me I can use my addresses globally" doesn't seem sufficient
to me as reason to oppose it, particularly since others have not been able
to do so.

-Scott


> On Wed, Sep 9, 2015 at 9:38 AM, ARIN <info at arin.net> wrote:
>
>> ARIN-2015-5 has been revised.
>>
>> You are encouraged to discuss the merits and your concerns of Draft
>> Policy 2015-5 on the Public Policy Mailing List.
>>
>> The AC will evaluate the discussion in order to assess the conformance
>> of this draft policy with ARIN's Principles of Internet Number Resource
>> Policy as stated in the PDP. Specifically, these principles are:
>>
>>    * Enabling Fair and Impartial Number Resource Administration
>>    * Technically Sound
>>    * Supported by the Community
>>
>> ARIN-2015-5 is below and can be found at:
>> https://www.arin.net/policy/proposals/2015_5.html
>>
>> Regards,
>>
>> Communications and Member Services
>> American Registry for Internet Numbers (ARIN)
>>
>>
>> ## * ##
>>
>>
>> Draft Policy ARIN-2015-5
>> Out of region use
>>
>> Date: 9 September 2015
>>
>> Problem statement:
>>
>> Current policy neither clearly forbids nor clearly permits out of region
>> use of ARIN registered resources. This has created confusion and
>> controversy within the ARIN community for some time. Earlier work on this
>> issue has explored several options to restrict or otherwise limit out of
>> region use. None of these options have gained consensus within the
>> community. The next logical option is a proposal that clearly permits out
>> of region use while addressing the key concerns expressed about unlimited
>> openness to out of region use and enables ARIN staff to implement the
>> policy efficiently.
>>
>> Policy statement:
>>
>> Create new Section X: ARIN registered resources may be used outside the
>> ARIN service region.
>>
>> Out of region use of ARIN registered resources are valid justification
>> for additional number resources, provided that the applicant has a real and
>> substantial connection with the ARIN region which applicant must prove (as
>> described below) and is using the same type of resources (with a delegation
>> lineage back to an ARIN allocation or assignment) within the ARIN service
>> region as follows:
>>
>> * IPv4: At least a /22 used in region
>> * IPv6: At least a /44 used in region
>> * ASN: At least one ASN present on one or more peering sessions and/or
>> routers within the region.
>>
>> A real and substantial connection shall be defined as carrying on
>> business in the ARIN region in a meaningful manner, whether for or not for
>> profit. The determination as to whether an entity is carrying on business
>> in the ARIN region in a meaningful manner shall be made by ARIN. Simply
>> being incorporated in the ARIN region shall not be sufficient, on its own,
>> to prove that an entity is carrying on business in the ARIN region in a
>> meaningful manner. Methods that entities may consider using, including
>> cumulatively, to prove that they are carrying on business in the ARIN
>> region in a meaningful manner include:
>> * Demonstrating a physical presence in the ARIN region through a bricks
>> and mortar location that is actually used for the purposes of conducting
>> business in the ARIN region in a meaningful manner. That is to say, the
>> location is not merely a registered office that serves no other business
>> purpose.
>> * Demonstrating that the entity has staff in the ARIN region. The greater
>> the number of staff, the stronger this connecting factor is.
>> * Demonstrating that the entity holds assets in the ARIN region. The
>> greater the asset value, the stronger this connecting factor is.
>> * Demonstrating that the entity provides services to or solicits sales
>> from residents of the ARIN region.
>> * Demonstrating that the entity holds annual meetings in the ARIN region.
>> * Demonstrating that the entity raises investment capital from investors
>> in the ARIN region.
>> * Demonstrating that the entity has a registered office in the ARIN
>> region, although this factor on its own shall not be sufficient.
>> * Any other method that the entity considers appropriate.
>> The weight accorded to any of the above-noted factors, if any, shall be
>> determined solely by ARIN.
>>
>> The services and facilities used to justify the need for ARIN resources
>> that will be used out of region cannot also be used to justify resource
>> requests from another RIR. When a request for resources from ARIN is
>> justified by need located within another RIR's service region, an officer
>> of the application must attest that the same services and facilities have
>> not been used as the basis for a resource request in the other region(s).
>> ARIN reserves the right to request a listing of all the applicant's number
>> holdings in the region(s) of proposed use, but this should happen only when
>> there are significant reasons to suspect duplicate requests.
>>
>> Comments:
>>
>> a) Timetable for implementation: Various iterations of this policy have
>> been presented and debated by ARIN for well over a year now. Given the
>> amount of time that has already been spent on developing a policy, ideally,
>> this policy would be implemented as soon as possible.
>> b) Explanation of draft policy: The draft policy addresses both the
>> problem statement as well as the concerns raised at ARIN 35 by participants
>> as well as ARIN counsel.
>> Firstly, the draft policy addresses the concerns of ARIN counsel as well
>> as some of the participants at ARIN 35 by ensuring that anyone requesting
>> numbered resources from ARIN has a real and substantial connection with the
>> ARIN region. This should go a long way to addressing concerns about fraud,
>> legal liability, and interference with the jurisdiction of other RIRs.
>> In addition, by placing the burden of proof for demonstrating a real and
>> substantial connection with the ARIN region on the applicant, the amount of
>> work required of ARIN staff to apply the policy will be reduced.
>> The factors noted above are suggestions that an entity may use to
>> demonstrate to ARIN that it is carrying on business in the ARIN region in a
>> meaningful manner. These factors are all indicative, some more than others,
>> that an entity has a real and substantial connection to the ARIN region
>> through the carrying on of business in the ARIN region in a meaningful
>> manner. Not all of the factors will apply in a given case and proving a
>> single factor may not be enough to satisfy ARIN that an entity is carrying
>> on business in the region in a meaningful manner. The list of factors is
>> meant to be quite broad, including an open-ended factor, in order to
>> capture the diversity of businesses that operate in the ARIN region and
>> that may justifiably require numbered resources from ARIN. This approach is
>> very similar to the practical method that courts typically apply to assess
>> whether parties have a sufficient connection to a jurisdiction so as to
>> require them to submit themselves to the courts of that jurisdiction.
>>
>> This draft policy is a substantial improvement over the previous version
>> of ARIN-2014-1 in terms of reducing the overall risk to the community by
>> requiring a real and substantial connection between an entity requesting
>> resources and the ARIN region.
>>
>> #####
>>
>> ARIN STAFF & LEGAL ASSESSMENT
>>
>> Draft Policy ARIN-2015-5
>> OUT OF REGION USE
>> https://www.arin.net/policy/proposals/2015_5.html
>>
>> Date of Assessment: 18 August 2015
>>
>> ___
>> 1. Summary (Staff Understanding)
>>
>> This proposal would allow an organization to receive Internet number
>> resources from ARIN for use out of region as long as the applicant is
>> currently using at least the equivalent of a /22 of IPv4, /44 of IPv6, or 1
>> ASN within the ARIN service region, respectively. In addition, the
>> applicant must have a real and substantial connection with the ARIN region,
>> which the applicant shall be responsible for proving.
>>
>> ___
>> 2. Comments
>>
>> A. ARIN Staff Comments
>>
>> This policy would increase the complexity of ARIN staff review work in
>> request cases that fit the profile of this policy. There would in an
>> increase in the vetting and utilization verification work currently
>> conducted by ARIN staff.
>>
>> There are conflicting instructions to ARIN staff in this policy text.
>> Specifically, the text says, "The determination as to whether an entity is
>> carrying on business in the ARIN region in a meaningful manner shall be
>> made by ARIN." Then at the end of the examples given, the text states, "Any
>> other method that the entity considers appropriate." This implies that ARIN
>> staff may have to accept anything presented by an organization as a method
>> of proving a "real and substantial connection with the ARIN region."
>>
>> It is not clear if the utilized /22, /44 or AS Number are required to
>> have been issued by ARIN or is it allowable to be from another RIR.
>>
>> This policy would be placed in the NRPM as section 9, "Out of Region Use".
>>
>> B. ARIN General Counsel – Legal Assessment
>>
>> If the policy is enacted it will require ARIN staff to work with counsel
>> with some attendant increase in costs in the first year to manage
>> implementation. The policy is consistent with standard legal principles
>> routinely utilized in the ARIN region. The policy creates no material legal
>> risks.
>>
>> ___
>> 3. Resource Impact
>> This policy could have a major resource impact from an implementation
>> aspect. It is estimated that implementation would occur within 12 months
>> after ratification by the ARIN Board of Trustees. The following would be
>> needed in order to implement:
>>
>> * Updated guidelines and internal procedures
>> * Staff training
>> * Engineering: Engineering efforts to handle out of region business rules
>> may besubstantial as our system only supports ascii now. If there is a need
>> for unicode character sets, then there is a substantial amount of work
>> required to upgrade the DB and applications to support unicode.
>> Additionally, we would need to discuss how to display unicode characters in
>> port 43 whois. There may be additional tools needed by RSD staff to measure
>> in region/out of region use.
>>
>> ___
>> 4. Proposal / Draft Policy Text Assessed
>>
>> Draft Policy ARIN-2015-5
>>
>> Date: 23 June 2015
>>
>> Problem statement:
>> Current policy neither clearly forbids nor clearly permits out or region
>> use of ARIN registered resources. This has created confusion and
>> controversy within the ARIN community for some time. Earlier work on this
>> issue has explored several options to restrict or otherwise limit out of
>> region use. None of these options have gained consensus within the
>> community. The next logical option is a proposal that clearly permits out
>> of region use while addressing the key concerns expressed about unlimited
>> openness to out of region use and enables ARIN staff to implement the
>> policy efficiently.
>>
>> Policy statement:
>> Create new Section X:
>> ARIN registered resources may be used outside the ARIN service region.
>> Out of region use of IPv4, IPv6, or ASNs are valid justification for
>> additional number resources if the applicant is currently using at least
>> the equivalent of a /22 of IPv4, /44 of IPv6, or 1 ASN within the ARIN
>> service region, respectively. In addition, the applicant must have a real
>> and substantial connection with the ARIN region, which the applicant shall
>> be responsible for proving.
>> A real and substantial connection shall be defined as carrying on
>> business in the ARIN region in a meaningful manner, whether for or not for
>> profit. The determination as to whether an entity is carrying on business
>> in the ARIN region in a meaningful manner shall be made by ARIN. Simply
>> being incorporated in the ARIN region shall not be sufficient, on its own,
>> to prove that an entity is carrying on business in the ARIN region in a
>> meaningful manner. Methods that entities may consider using, including
>> cumulatively, to prove that they are carrying on business in the ARIN
>> region in a meaningful manner include:
>> * Demonstrating a physical presence in the ARIN region through a bricks
>> and mortar location that is actually used for the purposes of conducting
>> business in the ARIN region in a meaningful manner. That is to say, the
>> location is not merely a registered office that serves no other business
>> purpose.
>> * Demonstrating that the entity has staff in the ARIN region. The greater
>> the number of staff, the stronger this connecting factor is.
>> * Demonstrating that the entity holds assets in the ARIN region. The
>> greater the asset value, the stronger this connecting factor is.
>> * Demonstrating that the entity provides services to or solicits sales
>> from residents of the ARIN region.
>> * Demonstrating that the entity holds annual meetings in the ARIN region.
>> * Demonstrating that the entity raises investment capital from investors
>> in the ARIN region.
>> * Demonstrating that the entity has a registered office in the ARIN
>> region, although this factor on its own shall not be sufficient.
>> * Any other method that the entity considers appropriate.
>> The services and facilities used to justify the need for ARIN resources
>> that will be used out of region cannot also be used to justify resource
>> requests from another RIR. When a request for resources from ARIN is
>> justified by need located within another RIR's service region, the officer
>> of the applicant must attest that the same services and facilities have not
>> been used as the basis for a resource request in the other region(s). ARIN
>> reserves the right to request a listing of all the applicant's number
>> holdings in the region(s) of proposed use, but this should happen only when
>> there are significant reasons to suspect duplicate requests.
>>
>> Comments:
>> a) Timetable for implementation: Various iterations of this policy have
>> been presented and debated by ARIN for well over a year now. Given the
>> amount of time that has already been spent on developing a policy, ideally,
>> this policy would be implemented as soon as possible.
>> b) Explanation of draft policy: The draft policy addresses both the
>> problem statement as well as the concerns raised at ARIN 35 by participants
>> as well as ARIN counsel.
>> Firstly, the draft policy addresses the concerns of ARIN counsel as well
>> as some of the participants at ARIN 35 by ensuring that anyone requesting
>> numbered resources from ARIN has a real and substantial connection with the
>> ARIN region. This should go a long way to addressing concerns about fraud,
>> legal liability, and interference with the jurisdiction of other RIRs.
>> In addition, by placing the burden of proof for demonstrating a real and
>> substantial connection with the ARIN region on the applicant, the amount of
>> work required of ARIN staff to apply the policy will be reduced.
>> The factors noted above are suggestions that an entity may use to
>> demonstrate to ARIN that it is carrying on business in the ARIN region in a
>> meaningful manner. These factors are all indicative, some more than others,
>> that an entity has a real and substantial connection to the ARIN region
>> through the carrying on of business in the ARIN region in a meaningful
>> manner. Not all of the factors will apply in a given case and proving a
>> single factor may not be enough to satisfy ARIN that an entity is carrying
>> on business in the region in a meaningful manner. The list of factors is
>> meant to be quite broad, including an open-ended factor, in order to
>> capture the diversity of businesses that operate in the ARIN region and
>> that may justifiably require numbered resources from ARIN. This approach is
>> very similar to the practical method that courts typically apply to assess
>> whether parties have a sufficient connection to a jurisdiction so as to
>> require them to submit themselves to the courts of that jurisdiction.
>> This draft policy is a substantial improvement over the previous version
>> of ARIN-2014-1 in terms of reducing the overall risk to the community by
>> requiring a real and substantial connection between an entity requesting
>> resources and the ARIN region.
>> _______________________________________________
>> PPML
>> You are receiving this message because you are subscribed to
>> the ARIN Public Policy Mailing List (ARIN-PPML at arin.net).
>> Unsubscribe or manage your mailing list subscription at:
>> http://lists.arin.net/mailman/listinfo/arin-ppml
>> Please contact info at arin.net if you experience any issues.
>
>
>
> _______________________________________________
> PPML
> You are receiving this message because you are subscribed to
> the ARIN Public Policy Mailing List (ARIN-PPML at arin.net).
> Unsubscribe or manage your mailing list subscription at:
> http://lists.arin.net/mailman/listinfo/arin-ppml
> Please contact info at arin.net if you experience any issues.
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.arin.net/pipermail/arin-ppml/attachments/20150910/43fe3f97/attachment.htm>