<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><br><div><div>On Nov 5, 2010, at 9:25 AM, Stephen Sprunk wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div>On 05 Nov 2010 01:56, Owen DeLong wrote:<br><blockquote type="cite">On Nov 4, 2010, at 9:06 PM, Stephen Sprunk wrote:<br></blockquote><blockquote type="cite"><blockquote type="cite">On 02 Nov 2010 22:30, Ted Mittelstaedt wrote:<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><blockquote type="cite">I think that this is because ultimately the goal isn't to take<br></blockquote></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><blockquote type="cite">legacy resources away that are IN USE.<br></blockquote></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">IMHO, that depends on the degree of non-compliance. I've worked with dozens of orgs with legacy space, and not a single one of them could even come close to justifying their space _that was in use_.<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">However, I don't see any point in targeting orgs using their space inefficiently until we've dealt with all the ones (and I really do mean every last one that can be found) not using their space _at all_.<br></blockquote></blockquote><blockquote type="cite">IMHO, targeting legacy holders for non-compliance with today's ARIN policies is dubious at best.<br></blockquote><br>I understand there are differences of opinion here; more on that below.<br><br><blockquote type="cite">I agree we should seek to actively reclaim abandoned resources (resources where the ORG no longer exists). I think we should possibly reach out and request that ORGs no longer using their legacy resources voluntarily return them.<br></blockquote><br>I think we all agree on this much, which is why it seems a rather<br>obvious first step. Once this is underway, we can debate what (if<br>anything) can/should be done about the other group.<br><br><blockquote type="cite"><blockquote type="cite"><blockquote type="cite">Ultimately the goal should be to take legacy resources away that are either being hoarded, or are abandoned.<br></blockquote></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">"Hoarded" is a loaded term, and it's difficult to prove someone's doing it. "Justified" is easily determined, though, since we _already_ have dozens of pages of policy describing exactly what that means.<br></blockquote></blockquote><blockquote type="cite">What we don't have is any form of agreement by the legacy holders that the ARIN definition of justified applies to them.<br></blockquote><br>OTOH, absent an LRSA, there is no formal agreement that it doesn't.<br><br></div></blockquote>Uh, generally it's pretty hard to claim that a contract is binding on an opt-out basis.</div><div><br></div><div>I can't just make up a contract and then say you are subject to it's terms just</div><div>because you don't have a contract that says otherwise.</div><div><br><blockquote type="cite"><div><blockquote type="cite">Non-signatories to the LRSA are, thus, in an uncertain area. Signatories of the LRSA are clearly protected from current and future ARIN policies in this regard.<br></blockquote><br>Yes, that's an excellent carrot for folks to sign the LRSA. We disagree<br>only about the stick.<br><br>I don't like using sticks, but eventually we're going to run out of<br>folks that are interested in the carrot.<br><br></div></blockquote>So? I really don't see the problem with leaving them alone to do their</div><div>own thing. I'd rather see them join the community, but, I simply don't</div><div>see any valid argument for attempting to do so by force.</div><div><br></div><div><blockquote type="cite"><div><blockquote type="cite"><blockquote type="cite"><blockquote type="cite">Rubbish. If ARIN takes over an abandoned Legacy resource then since<br></blockquote></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><blockquote type="cite">it is abandoned, the original org that had it cannot suffer damages,<br></blockquote></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><blockquote type="cite">and since it hasn't suffered damages, it has no standing to sue in<br></blockquote></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><blockquote type="cite">court.<br></blockquote></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><blockquote type="cite"><br></blockquote></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><blockquote type="cite">The problem is that since the original Legacy holder did NOT ever<br></blockquote></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><blockquote type="cite">sign an agreement with ARIN then ARIN has no contractual<br></blockquote></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><blockquote type="cite">justification to take over an abandoned Legacy assignment even if<br></blockquote></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><blockquote type="cite">they know it's unused,<br></blockquote></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">AFAICT, if the registrant does not have a contract (i.e. RSA or LRSA) with ARIN for registry services, ARIN has no obligation to continue providing them, especially for free. There are many who feel ARIN has a _moral_ obligation to do so, but that's not a matter for the courts.<br></blockquote></blockquote><blockquote type="cite">I agree that ARIN has a moral obligation to legacy holders.<br></blockquote><br>I agree ARIN has some sort of moral obligation to provide services, but<br>that is in direct conflict with ARIN's charter to act as steward for the<br>entire community.<br><br></div></blockquote>Not really.</div><div><br><blockquote type="cite"><div>I was willing to accept granting special privileges to _all_ legacy<br>holders prior to the LRSA being made available; now that it is, though,<br>I'm reluctant to accept continuing to grant those same special<br>privileges to those who do not sign.<br><br></div></blockquote>First, I don't agree with your use of the term "special privileges".</div><div><br></div><div>Second, I really don't think legacy holders are a major problem and</div><div>I don't see the point in pursuing them with pitchforks and torches</div><div>just because they choose not to join the ARIN community.</div><div><br></div><div><br><blockquote type="cite"><div><blockquote type="cite">I am uncertain about what legal obligations ARIN has to legacy holders.<br></blockquote><br>We've been told in the past we should make policy we think is "right"<br>for the community and let ARIN's counsel inform us if there are legal<br>problems with our proposals.<br><br>Counsel rarely participates in policy discussions prior to a formal<br>proposal being on the table, so a bit of armchair lawyering is probably<br>unavoidable, but it shouldn't dominate the discussion.<br><br></div></blockquote>I hardly think a single sentence dominates a discussion.</div><div><br><blockquote type="cite"><div><blockquote type="cite">I think that involuntary reclamation of legacy resources or "termination of services" to legacy holders is contrary to ARIN's best interests.<br></blockquote><br>I disagree.<br><br></div></blockquote>And you are free to do so.</div><div><br></div><div>Care to back that up with what ARIN possibly gains by doing so other than</div><div>litigation expenses?</div><div><br></div><div><blockquote type="cite"><div><blockquote type="cite">I think that going beyond "termination of services" to the step of placing resources back into the free pool and issuing them to other organizations would be outright counter-productive for all concerned (except in the case of clear abandonment).<br></blockquote><br>It depends on the legal explanation of exactly what it is ARIN does. At<br>the end of the day, the "resources" that ARIN "issues" to registrants<br>are merely entries in WHOIS and rDNS. ARIN cannot actually issue<br>numbers to (or take them away from) registrants because numbers<br>themselves cannot be owned, leased, etc.<br><br></div></blockquote>Yep.</div><div><br><blockquote type="cite"><div>I do not see a significant difference between removing a non-paying<br>registrant's entries from WHOIS/rDNS and replacing them with a paying<br>registrant's entries that happen to have the same or similar numbers. <br>And, frankly, if we don't do the latter, what's the point in the<br>former? Marking a bunch of space as "permanently unavailable"<br>accomplishes little.<br><br></div></blockquote>It makes it easy to filter it out so it doesn't get hijacked.</div><div><br></div><div>Besides who said anything about permanently unavailable. The</div><div>space is either held by an organization or it isn't. If we can't find</div><div>the organization, we record that fact and make it visible. Eventually,</div><div>either we find out for sure that the organization is defunct, or, we</div><div>find out that they do still exist. In the former case, resources can</div><div>be reclaimed. In the latter case, they cannot.</div><div><br></div><div>I'm just saying we shouldn't reclaim resources until we are certain</div><div>that the organization no longer exists.</div><div><br><blockquote type="cite"><div><blockquote type="cite"><blockquote type="cite"><blockquote type="cite">because so far the community has not given ARIN permission to do this via policy in the NRPM.<br></blockquote></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">That all depends on how one interprets NRPM 12.8.<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">IMHO, ARIN _already_ had the power to apply policy to legacy space or revoke it entirely, and therefore NRPM 12 actually _limits_ how ARIN may do so, as it does for non-legacy resources.<br></blockquote></blockquote><blockquote type="cite">Where did this power come from? For non-legacy holders, it comes from<br></blockquote><blockquote type="cite">the RSA which is a binding contract between the resource holder and ARIN<br></blockquote><blockquote type="cite">which entitles ARIN to revoke resources according to the NRPM.<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">There is no document anywhere that I know of which gives ARIN any such authority to revoke legacy resources based on current ARIN policy where it differs from the policies in effect under which the legacy resources were issued.<br></blockquote><br>I forget the original Latin, but there's a famous legal principle that<br>"what is not illegal must be legal".<br><br></div></blockquote>It is illegal to enforce terms of a contract against a non-signatory.</div><div><br><blockquote type="cite"><div>ARIN can add or remove any WHOIS/rDNS entry it wishes unless restricted<br>by policy or by a contract, i.e. an RSA or LRSA. IOW, since non-LRSA<br>legacy holders have no contract restricting what ARIN does, they have no<br>(legal) standing to complain if ARIN decides to stop providing them<br>unpaid, uncontracted registry services--just like a homeless person has<br>no (legal) standing to complain if a shelter decides to stop giving them<br>free meals. That's purely a moral issue.<br><br></div></blockquote>That's an interesting theory, but, I doubt that as the successor registry to</div><div>registries that granted the registrations to organizations on very different</div><div>terms with no contract stating that the terms could be subsequently changed</div><div>without agreement, ARIN would actually have as good a standing as you</div><div>claim in that situation.</div><div><br><blockquote type="cite"><div><blockquote type="cite"><blockquote type="cite">Wrong. ARIN would need to follow the procedure in NRPM 12, which<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">governs _all_ reclamation activities.<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">However, if all the POCs are unresponsive, then presumably they will<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">not respond with justification as required in 12.1, they will not<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">voluntarily return the resource(s) as required in 12.4, and<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">eventually ARIN can revoke the resource(s) under 12.5.<br></blockquote></blockquote><blockquote type="cite">Presumably the later stages of POC validation would include the notices<br></blockquote><blockquote type="cite">required under 12.1 such that by the time the POCs were marked invalid,<br></blockquote><blockquote type="cite">we would have at least completed the 12.4 waiting period as well, thus<br></blockquote><blockquote type="cite">making 12.5 effective pretty much as described above.<br></blockquote><br>That would be convenient.<br><br></div></blockquote>I like to presume that staff is reasonably intelligent and generally tries to</div><div>be efficient. So far, that does seem to be the case.</div><div><br><blockquote type="cite"><div><blockquote type="cite"><blockquote type="cite">One can address most of those by having other processes that add to the same list of resources to be reviewed. For instance, one might consider a resource not appearing in the DFZ to be a sign of probable non-compliance which triggers a review. Or resources which have not been updated in the last N years. Or not having valid rDNS servers. If the review concludes they're valid, the registrant has 24 months before they have to worry about being hassled again.<br></blockquote></blockquote><blockquote type="cite">There are specific policies allowing for non-connected networks and always have been. Why would the fact that a resource does not appear in one particular view (or even several views) of the DFZ be considered a sign of probable non-compliance? As to update cycle, some organizations<br></blockquote><blockquote type="cite">are actually extremely stable. ... When did maintaining valid rDNS become a requirement even for a non-legacy holder? I can't find that requirement anywhere in the NRPM.<br></blockquote><br>Those are merely possible reasons to put someone into the review queue. <br>If it turns out their use is justified (or close to it), no action will<br>be taken against them and they're exempt from another without-cause<br>review for 24 months.<br><br>This is _precisely_ why I put that clause in 2007-14: to clarify that<br>ARIN could review resources that _appeared_ to be unjustified without<br>needing a priori proof of such. The remainder of 2007-14 is there to<br>make sure that, when ARIN makes use of this power, the registrant is<br>protected. I believe that ARIN has _always_ had this power, but the<br>response to an ACSP suggestion of mine indicated that ARIN was<br>uncomfortable wielding that power without explicit policy supporting it.<br><br></div></blockquote>I'm saying that going after all or even some random number of</div><div>resources on that basis is a dubious set of selection criteria at</div><div>best and seems rather arbitrary to me.</div><div><br><blockquote type="cite"><div><blockquote type="cite">What value of N would you propose? 5? 10? 15?<br></blockquote><br>I would propose N=15 to start with, reducing over time as this<br>particular method ran out of folks to review. I don't think it'd be<br>wise to go below N=5.<br><font class="Apple-style-span" color="#000000"><font class="Apple-style-span" color="#144FAE"><br></font></font></div></blockquote><blockquote type="cite"><div><blockquote type="cite"><blockquote type="cite">Yes, a sufficiently cagey registrant may be able to avoid all of our heuristics, but most won't even try to. It's reasonable to lose a battle to a skilled and dedicated opponent; it's absolutely indefensible to surrender a battle when your opponent doesn't even show up, which is where we are right now. Let's fix the latter problem before we worry about the former.<br></blockquote></blockquote><blockquote type="cite">When did this shift from stewardship to seeking battles with legacy<br></blockquote><blockquote type="cite">holders? That certainly was not my intent in NRPM 12.<br></blockquote><br>It's a metaphor.<br><br></div></blockquote>It doesn't sound like one. It sounds like an attempt to go after legacy</div><div>holders just because they didn't sign the LRSA. I don't think that's</div><div>right.</div><div><br><blockquote type="cite"><div><blockquote type="cite"><blockquote type="cite">I don't think that "mining" IPv4 blocks for reclamation will have any<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">meaningful effect on runout, but I still think it's worthwhile for<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">several other reasons.<br></blockquote></blockquote><blockquote type="cite">I understand the "other reasons" for reclamation of abandoned resources.<br></blockquote><blockquote type="cite">They're a good target for abuse.<br></blockquote><br>Agreed, and IMHO that's a good enough reason by itself.<br><br></div></blockquote>I agree... in the case of abandoned resources. I don't agree if there</div><div>is any indication that the resources are not abandoned.</div><div><br><blockquote type="cite"><div><blockquote type="cite">What reasons do you have for actively seeking to reclaim legacy resources that are not abandoned ... ?<br></blockquote><br>Primarily, it is the moral obligation we have to the _entire community_<br>to act as stewards in an impartial manner, and IMHO that overrides any<br>moral obligation we have to individual registrants--particularly ones<br>that refuse to participate in the community or take advantage of the<br>(exceedingly generous, IMHO) terms that the LRSA offers.<br><br></div></blockquote>I think that mis-characterizes the situation. Legacy holders received</div><div>their resources under a different set of terms from predecessor registries.</div><div>ARIN, if it doesn't want to be the successor registry and wants to</div><div>terminate its services to legacy holders is welcome to do so. In that</div><div>case, ARIN should identify a successor registry to transfer the stewardship</div><div>of those resources to.</div><div><br></div><div>If ARIN wants to be the successor registry (which I think is generally</div><div>good for the community), then, ARIN should live up to the terms under</div><div>which the legacy resources were granted and should continue to provide</div><div>the services as agreed by the predecessor registry.</div><div><br></div><div>This theory that ARIN is somehow entitled as the successor registry</div><div>to retroactively change the terms under which legacy resources</div><div>were issued without the consent of the recipients really strikes me</div><div>as being quite odd.</div><div><br><blockquote type="cite"><div>Also, I am concerned about the complaints (and potential legal action)<br>ARIN will face if we start actively reclaiming non-legacy resources but<br>do not attempt to reclaim (non-LRSA) legacy resources. Worse, showing<br>irresponsibility here may justify attempts by others to impose<br>governmental (i.e. ITU) interference or end community-based governance<br>entirely.<br><br></div></blockquote>I think it's pretty easy to show that those resources were issued by</div><div>predecessor registries under different terms and conditions.</div><div><br></div><div>Owen</div><div><br></div></body></html>