[arin-ppml] Change of Use and ARIN (was: Re: AFRINIC And The Stability Of The Internet Number Registry System)

[John Curran]

On 5 Sep 2021, at 2:06 AM, William Herrin <bill at herrin.us> wrote:
> 
> On Sat, Sep 4, 2021 at 1:32 PM John Curran <jcurran at arin.net> wrote:
>> As such, your statement "A prohibition on leasing addresses is not
>> enforceable.” looks to be far more definitive than might be the case.
> 
> Hi John,
> 
> I defy you to write such a proposal that isn't 10 minutes work and
> negligible expense for an address lessor to circumvent. I've tried and
> come up empty.

<chuckle> Alas, drafting proposals to change ARIN number resource policy is task for the community and specifically precluded from me – but I take your point that crafting such a policy would take significant effort. 

> Consider some of the permutations on the lease of "IP addresses and
> network infrastructure."
> 
> 1. /24 address space and right to announce with BGP. No network.
> 
> 2. /24 address space and right to announce with BGP. Dialup modem in
> Kansas will accept BGP announcement. Customer buys primary transit
> elsewhere.
> 
> 3. /24 address space and right to announce with BGP. Linux virtual
> machine running FRRouting under Customer's control in ISP datacenter
> with some bandwidth. Customer buys primary transit elsewhere.
> 
> 4. /24 address space and right to announce with BGP. Gigabit port on
> ISP switch VLANed to router with a BGP session dedicated to customer
> at ISP datacenter. Burstable bandwidth from zero mbps. Up to customer
> to buy telco lines to connect to it. Customer buys primary transit
> elsewhere.
> 
> 5. /24 address space and right to announce with BGP. T1 link for
> customer. Customer buys other (primary) transit elsewhere.
> 
> 6. /24 address space and right to announce with BGP. Primary gigabit
> link. Customer buys a secondary elsewhere.
> 
> 
> The first 4 of these are functionally the same for someone whose
> -intent- is to lease addresses without significantly investing in
> network infrastructure. And how does ARIN determine the 5th is
> actually a different situation than the 4th?
> 
> Perhaps you take a different vector. The ISP can be non-primary
> transit for no more than 5% of its address space. Or 10%. Or 25%.
> Whatever percentage it takes to stop the modem/virtual/empty port
> model without also banning Amazon.
> 
> Where would a policy draw the line between "this is an ISP" and "this
> is someone leasing addresses?" And who do you destroy as a result,
> since once you have the rule you can't make arbitrary and capricious
> exceptions when someone reasonable comes along and says, "surely you
> didn't mean me!"

As it turns out, we already handle situations like this as ARIN customers who receive number resources make certain representations about their need/intended utilization for the resources.  There are occasions where we have to go back and review the actual deployment of the addresses – and that can become a rather detailed process for folks who don’t have any alignment between their claimed intended usage and apparent reality. 

>> ARIN does not actually operate as an automaton
> 
> Yes, I know. And you know that when the line is drawn too fine you get
> into legal trouble, so ARIN errs on the side of granting requests for
> which there's a reasonable argument that they comply with policy.

Indeed, and we also tend to give the benefit of the doubt during a review if there appears to be good faith effort to honor their reason for issuance.  However,  we also have those that obscure/dodge/ignore our requests for information because it can be rather challenging to fabricate the layers of consistent material necessary and so they instead delay as much as possible to maximize revenue prior to revocation.    You suggest that ARIN couldn’t have a policy that precluded leasing of addresses on the basis of the difficulty of verification, but the we already do this today on occasion since leasing of address space doesn’t qualify as the "technical need for them in support of operational networks."

Again, it’s likely more important that the community come to a view on whether there is an actual problem with current number resource policy in the ARIN region, and if so, then whether the benefit obtained from solving it is worth the resulting administrative work put on ARIN and each & every number resource holder.

Thanks,
/John

John Curran
President and CEO
American Registry for Internet Numbers