[arin-ppml] Draft Policy ARIN-2025-4: Resource Issuance to Natural Persons

[Tyler O'Meara]

Hi John,

Thanks for the reply. I fully acknowledge that the ARIN Board of Trustees have a
fiduciary duty (and corresponding oversight) to the organization. This is why
the Board of Trustees has final ratification authority in the PDP, after all. My
concern is only that the ACSP is a much less rigorous process (for a reason, as
you mentioned), that is largely (in my opinion, at least) not suited for changes
to Internet Number Policy.

Also my example of excluding IP lessors was meant as if we excluded them
entirely from the NRPM, i.e. removing them from ARIN's customer base entirely.
Based on the arguments that have been given, such a change could be argued as
out of scope due to changing ARIN's customer base.

I'm glad to hear this will continue in the PDP (subject to community support, of
course), as I think that is the most appropriate avenue to discuss this change.

For what it's worth, I am sympathetic to the argument that this change may not
be worthwhile from an organizational/legal/financial perspective, though I do
think it's very worthwhile from a strictly policy/technical perspective. 

Thanks,
Tyler

On Wed, 2025-06-04 at 02:42 +0000, John Curran wrote:
> Hello Tyler!
> 
> I’ll respond inline for clarity… 
> 
> > On Jun 3, 2025, at 9:17 PM, Tyler O'Meara <arin at tyleromeara.com> wrote:
> > 
> > 
> > 
> > Hi John,
> > 
> > Thanks (to both you and all the ARIN staff) for working to get the reviews
> > done.
> > For a change like this, they're obviously crucial to an informed discussion
> > here
> > on the PPML.
> > 
> > The staff suggest using the ACSP to propose this (overarching) change, but
> > the
> > ACSP doesn't have the authority to change the NRPM, which (to my reading)
> > would
> > be necessary in order to support natural persons. This would imply a
> > circular
> > dependency, where the PDP is insufficient for this change because it "would
> > redefine that scope of ARIN’s customer base", but the ACSP is insufficient
> > because it lacks the power to actually change the NRPM.
> 
> 
> The reason for ARIN staff suggesting use of the ACSP process is that the
> policy change being proposed has a large service component and a relatively
> modest policy element (the policy element being making clear which existing
> policy in NRPM would apply to natural persons).
> 
> If the policy proposal had been abandoned, and a suggestion submitted to the
> ACSP process, then the suggestion would have gone to the arin-consult mailing
> list for discussion to weigh if there is community interest. With that
> completed, staff would have written up the results, along with an initial
> assessment of the issues involved, and briefed the ARIN Board of Trustees on
> the community interest and high-level assessment of work involved and known
> costs & implications for the organization.
> 
> While routine changes to ARIN’s services are decisions made by myself (i.e.
> staff) under the oversight of the ARIN Board – this particular change would
> require direct Board involvement in the decision at the very outset due to the
> organizational implications. This is not particularly unusual, as the Board
> has been involved in decisions on many significant changes to ARIN’s service
> profile in the past, such as ARIN Online, Authenticated IRR, and our RPKI
> services. 
> 
> With interest from the community on the suggestion and the go-ahead from the
> Board, we would have invested time to fully flesh out the organizational
> impacts, get Board approval on the result, and then informed the ARIN AC of
> the need for policy change to support “natural persons.”
> 
> These sort of proposals that have both service and policy aspects can indeed
> be handled via either route, but it’s important to recognize that a policy
> change, even if adopted, doesn’t automatically change the scope of services
> offered by ARIN - such decisions occur under the purview of the ARIN Board of
> Trustees. 
> 
> 
> 
> > 
> > 
> > Separately, I disagree with the assertion that this change is out of scope
> > for
> > the PDP due to Section 2.2.2.3. No part of this proposal defines "the
> > specific
> > processes by which the Policy Proposal will be implemented by ARIN staff"
> > nor
> > does it "define or establish services offered by ARIN". It also trivially
> > doesn't have any impact on fees, but I'm doubting ARIN is asserting
> > otherwise.
> > The review suggests that this change is out of scope for the PDP because "it
> > would redefine that scope of ARIN’s customer base", but that is neither a
> > specific process nor specifying which services ARIN must provide.
> 
> 
> 
> 
> The proposed change directs ARIN to provide services to parties (natural
> persons) presently not served. That’s very much in line with “define or
> establish services offered by ARIN,” and the ARIN AC would have been within
> reason to abandon it on that basis if they had wished to do so. As they did
> not, the policy process will continue (to the extent the community wishes),
> and the specific policy changes that are necessary to provide number resources
> and related services to natural persons may indeed emerge from this process if
> the policy goes to fruition.
> 
> > 
> > 
> > If we accept that a change which redefines the scope of ARIN's customer base
> > is
> > out of scope for the PDP, this would imply that _any_ change to the NRPM
> > which
> > either expands or decreases eligibility for resources (and therefore,
> > eligibility to be an ARIN customer) would be out of scope for the PDP. Would
> > a
> > change to the NRPM which prohibits the allocation of resources to IP lessors
> > also be out of scope? It clearly "redefine(s) the scope of ARIN's customer
> > base"
> > by excluding IP lessors, so the same argument would apply as here.
> 
> 
> Incorrect – if ARIN defines a policy that provides special criteria or
> allocations for exchange points, hosting companies, or critical
> infrastructure, then customers in those categories end up with changes to how
> they obtain IP address space (i.e., the criteria to be met, allocation sizes,
> etc.) but we’re still providing them the same registration services to the
> same entities in the same region.
> 
> However, if a policy proposal was submitted that proposed that ARIN should
> provide number resources and related registry services to some set of entities
> who exist entirely outside of the ARIN service region, then indeed such a
> policy proposal would be trying to “direct the services offered by ARIN” to an
> entirely new community with significant organizational implications, and
> likely be abandoned as out of scope.
> 
> Similarly, using your example, ARIN presently provides number resources and
> related services to organizations who primarily assign IP addresses to the
> users of the network services that they provide, whether ISP or end-user
> networking entities. If there were a policy proposal to provide number
> resources and related registry services to entities not for their use for the
> provision of connectivity services by that entity, then indeed such a proposal
> would represent a significant change to whom ARIN provides services to, and
> could easily be deemed out of scope for the policy process.
> 
> (Note that there’s a very sound reason for the limitation of the policy
> development process – specifically noting that some changes to ARIN’s services
> can have very significant and long-lasting implications for the organization
> that need to be carefully considered by parties that hold fiduciary duty to
> the organization, i.e., the member-elected ARIN Trustees.)
> 
> In the case of this particular draft policy, there are both number resource
> policy changes necessary and service changes necessary, so the present course
> of doing the policy change first is not entirely unreasonable. The ARIN
> Trustees are on the ppml mailing list and will obviously be kept informed by
> staff as the organizational implications of the change become clearer.
> 
> 
> 
> > 
> > 
> > Accordingly, I firmly believe that this Draft Policy is in scope for the
> > PDP,
> > and given the near universal support it has received thus far, the AC should
> > continue to work on improving the text. The Legal analysis (although
> > somewhat
> > contradictory with the staff review[1]) was very helpful, but in light of
> > the
> > uncertainty of the final text at this stage, was also lacking in specifics.
> > I
> > think that more detail (which can naturally only be provided once the policy
> > has
> > been fleshed out more) will be necessary for the ARIN community to determine
> > if
> > the tradeoffs for more inclusivity vs the legal and operational complixities
> > are
> > worth it.
> > 
> > In light of the issues raised by the Legal analysis, I revoke my support for
> > this policy and instead think we should work to improve the text and work to
> > gain greater clarity as to the costs of this policy.
> 
> As noted in the staff and legal analysis –
> 
> > Implementable as Written?: No. The redefinition of Organization in a manner
> > contrary to both the common usage of the term and existing usage in NRPM
> > does not provide adequate clarity regarding how natural persons requesting
> > number resources are to be treated in policy going forward. The draft policy
> > includes a comment to the effect that Sections 4.2, 5.1, and 6.5 shall be
> > interpreted to allow use by natural persons, but there are many other usages
> > of term Organization in the NRPM thus leaving numerous policy sections (3,
> > 4.10, 8.2, 8.3, 9, etc.) whose applicability to natural persons would be
> > left indeterminate by the draft policy text. In addition, the
> > legal/regulatory analysis necessary to more fully determine implications of
> > the draft policy – if adopted – will also be considered by external parties
> > (e.g. legal/financial/insurance/tax advisors, governmental
> > authorities/regulators) for whom the term “Organization” will lack
> > sufficient clarity and risk misinterpretation if the term recast as proposed
> > to incorporate natural persons. Staff recommends that the draft policy be
> > expanded to more clearly define the portions of existing number resource
> > policy that would or would not be applicable to natural persons, if adopted.
> 
> 
> Given that the full assessment of the organizational implications may
> materially change based on the policies that natural persons are subject to,
> it is not unreasonable to continue to refine the policy language – so long as
> there remains sufficient community interest to continue to do so. 
> 
> Thanks,
> /John
> 
> 
> 
> John Curran
> President and CEO
> American Registry for Internet Numbers
> 
>