[arin-ppml] Draft Policy ARIN-2019-2: Waiting List Block Size Restriction

[Tom Fantacone]

Hi Bill,

At 06:35 PM 2/28/2019, William Herrin wrote:
>On Tue, Feb 26, 2019 at 9:49 AM ARIN <info at arin.net> wrote:
> > A significant percentage of organizations that receive blocks
> > from the waiting list subsequently issue these blocks to other
> > organizations via 8.3 or 8.4 transfers shortly after the one year
> > waiting period required before engaging in such outbound transfers.
>
>I'm shocked to learn that people are playing arbitrage with the
>transfer process. Oh wait, no I'm not. I may have even expressed my
>expectation that we'd see this sort of behavior back when we debated
>the transfer policies. If I had the time, I might dig out my old
>emails just so I could say I told you so.

While we have a problem with the waiting list 
that we’re trying to address here, I think it's 
important to point out that the transfer market 
as a whole has proven an excellent vehicle for 
moving number resources from those who no longer 
need them to those who do.  This “gaming of the 
system” is restricted to a subset of the waiting 
list, and the number of blocks issued on the 
waiting list is less than 10% of the blocks 
transferred in the ARIN region during the same 
time period.  (682 blocks have been issued via 
the waiting list, and a quick look at ARIN’s 
transfer stats indicates roughly 8,000 blocks 
transferred in the same time frame since 2015 if 
I’m reading it correctly).  If we look at the 
ratio in terms of total address space, I suspect 
the waiting list comprises an even smaller 
percentage, though I can’t readily find those figures.

Furthermore, even within the waiting list, the 
problem appears with only a small percentage of 
recipients (25 re-transfers out of 682 total), 
although this does impact a high percentage of 
the waiting list block space since the abusers 
are almost entirely doing this with larger blocks.

The point is that while “The problem statement is 
pretty damning
” (quoting Kevin Blumberg), the 
sky is not falling due to the transfer 
markets.  It’s damning within the small subset of 
re-transfers of blocks received off the waiting list.

> > the organization will be provided the option to be placed on
> > a waiting list of pre-qualified recipients, listing both the block size
> > qualified for or a /22, whichever is smaller, and the smallest block
> > size acceptable, not to exceed a /22.
>
>I fail to see how this solves the problem. For $20k a pop, I can clear
>a tidy profit on a year, a shell company and some paperwork. Sure I'd
>rather get $200k a pop but the change doesn't make the effort
>unattractive. I really just need to create more shell companies.
>
>This approach is reactive. Oh, the fraud is mostly on the big blocks
>so stop that. Oh, now the fraud is on the smaller blocks, what do we
>do? Don't react. Get ahead of the problem. That's what you do.

Yes, it’s possible there is abuse with the small 
blocks off the waiting list as well, but so far 
we aren’t seeing it (only 3% of smaller blocks 
have been re-transferred vs. 42% of the larger 
blocks).  Now, perhaps if we restrict the waiting 
list block size to a /22 these bad actors will 
start playing the same game with /22s, but we 
don’t have any evidence that will occur.

Others have pointed out issues of abuse in RIPE 
where LIRs are spun up to grab /22s from the 
final /8, but the 2 environments are 
different.  First, there is no justification 
requirement in RIPE.  Form a corp, have a 
presence in the RIPE region, and you get a /22 
whether you can justify it or not.  That may not 
exactly be a noble action in support of the 
spirit of the RIPE community, but for the most 
part, it is policy-compliant.  In ARIN, you have 
to justify your need and sign an affidavit 
affirming your justification which makes willful 
misrepresentation fraudulent.   That’s a much 
higher disincentive to go through for a /22 than 
in RIPE, where basically it’s just frowned 
upon.  And per John Curran’s remarks, ARIN has 
revoked address space when investigating why some 
of these actors are selling their waiting list 
space shortly after receiving it.  So these 
gamers could risk an audit of their full address 
holdings in order to con ARIN out of a /22.  The 
“abuse” in RIPE regarding the final /8 is also 
heavily concentrated in a few member nations and, 
suffice it to say, those same nations are not ARIN members.

Regards,

Tom