<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Based on the discussion at the PPC in Atlanta (link below), the
following changes are proposed.<br>
<br>
<a class="moz-txt-link-freetext" href="https://www.arin.net/participate/meetings/reports/ppc_nanog60/webcast/2014-1.mov">https://www.arin.net/participate/meetings/reports/ppc_nanog60/webcast/2014-1.mov</a>
<br>
<br>
There is a summary of the changes and a red-lined version of the
policy text with new and deleted text highlighted following the
complete Draft Policy. <br>
<br>
----<br>
<br>
Draft Policy ARIN-2014-1<br>
Out of Region Use<br>
<br>
Date: 28 March 2014<br>
<br>
Problem statement:<br>
<br>
Current policy neither clearly forbids nor clearly permits out or
region use of ARIN registered resources. This has created confusion
and controversy within the ARIN community for some time. Earlier
work on this issue has explored several options to restrict or
otherwise limit out of region use. None of these options have gained
consensus within the community. The next logical option is to
discuss a proposal that clearly permits out of region use without
limits, beyond those already existing in policy.<br>
<br>
Permitting out of region use, however, poses issues that have to be
addressed by policy and adjustments to operational practice. Out of
region use needs a clear definition and any operational practices
based on that definition must not be unnecessarily burdensome. It is
significantly more difficult and costly for ARIN Staff to
independently verify the justification and utilization of resources
that are reassigned or otherwise used outside of the ARIN service
region. There needs to be recognition of this difference in policy
and associated operational practices, especially the cost
differential when there is more than an incidental amount of out of
region use.<br>
<br>
Policy statement:<br>
<br>
Create new Section X;<br>
<br>
X. Out of Region Use<br>
<br>
ARIN registered resources may be used outside the ARIN service
region and such use is valid justification for new or additional
resources. Resources are considered to be used outside the region if
the user or customer service address or the technical infrastructure
address, such as the point of presence (POP), data center, or other
similar location, are outside the ARIN service region.<br>
<br>
There is a general presumption that requesting resources from ARIN
for use within another RIR’s service region duplicates any resources
held by the organization with that other RIR. Therefore, the
organization should, not hold any resources with the other RIR, or
demonstrate that all such resources held are utilized based on ARIN
policy requirements, or provide an operational justification
clarifying how the resources from ARIN will not duplicate any
underutilized resources held with the other RIR.<br>
<br>
Only the utilization rate of ARIN registered resources or immediate
need may be use to determine a valid request size beyond the
applicable minimum allocation size. The utilization rate of
resources received from another RIR is not applicable in determining
a valid request size.<br>
<br>
X.1 Verification of Out of Region Use<br>
<br>
The utilization of all ARIN registered resources must be verified
when evaluating a request for additional resources or during a
resource review, including any resources used outside the ARIN
service region. All ARIN registered resources used outside the
region must be verified to no less than an equivalent standard as
resources used within the ARIN region. To this end ARIN, in its sole
discretion, may engage independent external entities to assist it in
the verification of information related to any resources used
outside the region.<br>
<br>
X.2 Reporting Resources Held with other RIRs<br>
<br>
Except to the extent that incidental use, multi-instance use, or the
critical infrastructure criteria described below apply, when out of
region need is used to justify a request for resources from ARIN;
The requesting organization will also report to ARIN the utilization
status, based on applicable ARIN policy, of all resources it holds
with the RIRs who’s service regions the need justifying a request to
ARIN is within, and any additional supporting documentation
requested by ARIN regarding these reported resource.<br>
<br>
X.3 Incidental Use<br>
<br>
Out of region use of ARIN registered resources by an organization
that totals less than an equivalent of a /20 of IPv4, a /36 of IPv6,
and two (2) ASNs within each of the other RIR’s service regions are
considered incidental use and as such are accounted for as if used
within the ARIN service region.<br>
<br>
X.4 Multi-Instance Use<br>
<br>
Any resources used simultaneously in multiple locations, such as an
anycast prefix or ASN, are considered as used within the ARIN
service region, provided at least one instance is located within the
region, regardless of how many other instances are located outside
the region.<br>
<br>
X.5 Critical Infrastructure<br>
<br>
Resources justified through ARIN critical infrastructure policies
are accounted for as if used within the ARIN service region,
regardless of their actual location of use.<br>
<br>
Comments:<br>
a. Timetable for implementation: Immediate<br>
<br>
b. Anything else<br>
<br>
Current policy is ambiguous on the issue of out of region use of
ARIN registered resources. The only guidance on the issue in current
policy is in Section 2.2, that defines the term RIR; “... The
primary role of RIRs is to manage and distribute public Internet
address space within their respective regions.” Some in the
community believe this means out of region use should be at least
limited or restricted while others believe this is only intended to
focus efforts within the region and not define where resources may
be used.<br>
<br>
Several other policy proposals have explored restricting or
otherwise limiting out of region use. None of these proposals gained
consensus within the ARIN community. During the latest of these
proposals, ARIN-2013-6, several standards were explored, a majority
of use within region, a plurality of use within region, and some
discussion of a minimum of 20 percent use within region. It was felt
that each of these standards would interfered, to one extent or
another, with the legitimate operations of multi- or trans-regional
networks.<br>
<br>
Section 2.2 tells us, the primary purpose of the RIRs are to manage
and distribute resources within their regions. None the less, there
have always been networks that don’t neatly fit within the regions
created by the RIR system. These legitimate trans-regional networks
are operated by international businesses or global service
providers, many of which are based within the ARIN region. Prior to
IPv4 run-out, many of these trans-regional networks requested
resources from ARIN for use both inside or outside the region, as
long as the requests were justified by need.<br>
<br>
As a result of IPv4 run-out, many in the community want to restrict
out of region use to prevent ARIN resources from going to networks
without a real technical presence in the ARIN region. However, any
attempt to limit or restrict such out of region use inevitably will
affect these legitimate trans-regional networks. Further, even the
most restrictive regional use requirements will not significantly
prolong the availability of IPv4 resources within the ARIN region.
Therefore, attempting to restrict or limit out of region use of
resources, even if it were for IPv4 only, is ineffective,
inefficient, and overly burdensome to important elements of the
global Internet.<br>
<br>
The major concept behind this proposal is to allow out of region use
without any limits, other than those already in policy, but bring an
economic and reporting factors to play on the issue. It requires
ARIN to verify out of region use of ARIN registered resources to no
less than an equivalent standard as in region use, and enables ARIN
to engage external entities to assist in this verification. It is
expected ARIN will have agreements with all such external entities
to ensure the confidentiality of all supporting documentation is
preserved.<br>
<br>
ARIN engaging external entities to assist in verification of out of
region use is mostly an ARIN business issue, and not primarily a
policy issue. However, today there is a general assumption that such
verification for in region use is done almost exclusively in house
at ARIN. Making this issue clear in policy follows a principle of
least surprise, as the use of such external entities is likely to be
frequently necessary to verify out of region use, especially in
parts of the world where English is not the primary language. Or put
another way, use of an external entity when verifying out of region
use is more likely to be the rule rather than an exception.<br>
<br>
When resources are requested for out of region use an organization
also needs to report the utilization status of all resources it
holds with the RIRs for the regions that the requested need is
within. This is to ensure there are not underutilized resources
held with another RIR that would contradict the justified need for
resources from ARIN.<br>
<br>
There are additional expenses and complexity involved in verifying
out of region use, as a result of language and logistical barriers
that the regionality of the RIR system was originally conceived to
mitigate.<br>
In addition, evaluating the reported information about resources
held with other RIRs, needed to ensure ARIN resources are not
duplicating resources held with outer RIRs, increase staff's burden
related to out of region use. Furthermore, section 2.2 is clear that
providing resources for out of region use is, at best, only a
secondary role for ARIN. As a result, out of region use should not
significantly burden the primary role of providing resources for use
within the region. These factors justify a recommendation to the
Board of Trusties to create a separate fee structure for out of
region use, creating the aforementioned economic factor.<br>
<br>
This economic factor and the recommendation for a separate fee
structure, are again mostly ARIN business issues, and not part of
policy in general. However, this is one of those instances where
policies and fees are intertwined.<br>
<br>
It seems reasonable that this economic factor should be applied only
to those that make substantial use of ARIN registered resources
outside the region, and not to those that primarily use resources
within the region. This proposal defines incidental out of region
use, to ensure that trivial, insignificant or otherwise incidental
use are exempt from the discussed economic factor, the reporting of
resources help with other RIRs as well, and are accounted for as if
used within the region.<br>
<br>
Some amount of out of region use should be considered normal even
for a network primarily based within the ARIN region. For example,
numbering a global backbone that provides global access necessary
for in region customers. Also, the other RIRs have minimum
requirements to justify an initial allocation or assignment, similar
to ARIN. These and other examples and issues, justify allowing some
minimal amount of out of region use to be accounted for as if it
were in region use. The currently proposed policy statement, X.3,
defines incidental use in terms of an absolute thresholds for each
type of resource.<br>
<br>
Another option would be a percentage based threshold, say 20%.
However, a percentage based threshold has the disadvantage that even
a minimal change in usage can cause the ratio between in region and
out of region use to change, potentially causing an oscillation
around this threshold. This creates significant uncertainty for
organizations as to if the discussed economic factor will apply to
them, or not. Where as once an absolute threshold has been crossed
by a significant amount, it is highly unlikely that any additional
changes in usage will cause an oscillation around the threshold,
providing much more certainty for most organizations.<br>
<br>
Additionally, the proposal deals with a couple special cases in X.4
and X.5. Due to the relatively small resource impact and high
importance to overall Internet stability; resources for critical
infrastructure are accounted for as if used within the region.
Anycast prefixes, and other resources used simultaneously in
multiple locations, are considered as used outside the region only
when they are exclusively used outside the region. Or put another
way, as long as at least one instance is located within the region,
they are considered used within the region, regardless of how many
other instances are located outside the region. Both of these
special cases have an overall positive impact on the Internet and
should not be discouraged in anyway by this policy, lumping them in
with general out of region use could be a disservice to the Internet
and unnecessarily burdensome.<br>
<br>
The intent of allowing an operational justification to clarify how
resources received from ARIN will not duplicate any underutilized
resources held with another RIR is to account for situations like;
It may be necessary to use resources from another RIR to meet legal
or regulatory requirements, or prevailing operational expectations,
in some economies around the world. In such cases it is justified to
also receive minimal resources from another RIR for use only in
those economies. And using resources received from ARIN for the rest
of a global network.<br>
<br>
In summary, this proposal ensures that global organizations or
global service providers base within the ARIN region may receive
resources to operate their global network solely from ARIN, if they
wish to do so. As long as the utilization of the out of region
resources are verified to no less than an equivalent standard as in
region resources and any additional reporting requirements are also
meet. This is particularly important for IPv6; requiring
organizations get IPv6 resources from multiple RIRs, or even making
it appear that they should, will result in additional unique
non-aggregatable prefixes within the IPv6 route table, rather than
minimizing them, which one of the policy objectives for IPv6.<br>
<br>
Finally, a separate but somewhat related issue; regardless of where
ARIN registered resources are used, inside or outside of the ARIN
service region, organizations must first qualify to receive
resources from ARIN. ARIN’s current operational practice is that an
organization must be formed within the ARIN service region in order
to qualify to receive any resources from ARIN. The issue of who
should be eligible to receive resources was commingled with out of
region use in ARIN-2013-6. It was felt these issues should be
considered separately. Therefore, the issue of who should be
eligible to receive resources is purposefully not dealt with by this
proposal, and if any changes are necessary there should be separate
policy proposals to deal with this issue independently.<br>
<br>
----<br>
<br>
Summary of Changes;<br>
<br>
- Clarified out of region use is valid justification for both <b>new</b>
or additional resources.<br>
<br>
- Eliminated "user or customer billing address" from definition for
out of region use, and change the items left to sentence from,
instead of list form.<br>
<br>
- Added that there is a general presumption that requesting
resources from ARIN for use within another RIR’s service region
duplicates any resources held by the organization with that other
RIR.<br>
<br>
- Made it clear that only the utilization rate of ARIN resources or
immediate need are used to determine the valid request size.<br>
<br>
- New sections X.2 "Reporting Resources Held with other RIRs," this
new section is intended to have organizations report the utilization
of their resources, based on ARIN Policy, for the other RIRs where
they are requesting ARIN resources for. Except to the extent
incidental use, multi-instance use, or critical infrastructure
clauses apply.<br>
<br>
- Changed incidental use to be on a per other RIR region basis to
simplify the determination of if the Reporting Resources Held with
other RIRs applies.<br>
<br>
- Changed multi-instance use to use "at least one instance is
located within the region" language. <br>
<br>
- Updated the comments section to account for the above changes.<br>
<br>
---- <br>
<br>
<p class="MsoNormal">Here is an annotated version of the policy text<br>
<u><span style="color:#3366FF"><br>
Deleted Text</span></u><br>
<span style="color:red">New Text</span><br>
Retained Text</p>
<p class="MsoNormal">X. Out of Region Use<br>
<br>
ARIN registered resources may be used outside the ARIN service
region and such use is valid justification for
<span style="color:red">new or</span> additional resources.
Resources are considered to be used outside the region if
<u><span style="color:#3366FF">any of the following are located
outside the region. A. The user or customer billing address B.</span></u>
the user or customer service address
<span style="color:red">or</span> <u><span style="color:#3366FF">C.</span></u>
the technical infrastructure address, such as the point of
presence (POP), data center, or other similar location<span
style="color:red">, are outside the ARIN service region.</span><br>
<br>
<span style="color:red">There is a general presumption that
requesting resources from ARIN for use within another RIR’s
service region duplicates any resources held by the organization
with that other RIR. Therefore, the organization should, not
hold any resources with the other RIR, or demonstrate that all
such resources held are utilized based on ARIN policy
requirements, or provide an operational justification clarifying
how the resources from ARIN will not duplicate any underutilized
resources held with the other RIR.<br>
<br>
Only the utilization rate of ARIN registered resources or
immediate need may be use to determine a valid request size
beyond the applicable minimum allocation size. The utilization
rate of resources received from another RIR is not applicable in
determining a valid request size.</span><br>
<br>
X.1 Verification of Out of Region Use<br>
<br>
The utilization of all ARIN registered resources must be verified
when evaluating a request for additional resources or during a
resource review, including any resources used outside the ARIN
service region. All ARIN registered resources used outside the
region must be verified to no less than an equivalent standard as
resources used within the ARIN region. To this end ARIN, in its
sole discretion, may engage independent external entities to
assist it in the verification of information related to any
resources used outside the region.<br>
<br>
<span style="color:red">X.2 Reporting Resources Held with other
RIRs<br>
<br>
Except to the extent that incidental use, multi-instance use, or
the critical infrastructure criteria described below apply, when
out of region need is used to justify a request for resources
from ARIN; The requesting organization will also report to ARIN
the utilization status, based on applicable ARIN policy, of all
resources it holds with the RIRs who’s service regions the need
justifying a request to ARIN is within, and any additional
supporting documentation requested by ARIN regarding these
reported resource.<br>
</span><br>
X.<u><span style="color:#3366FF">2</span></u><span
style="color:red">3</span> Incidental Use<br>
<br>
Out of region use of ARIN registered resources by an organization
that totals less than an equivalent of a /20 of IPv4, a /36 of
IPv6, and
<span style="color:red">two (2)</span> <u><span
style="color:#3366FF">10 </span></u>ASNs
<span style="color:red">within each of the other RIR’s service
regions</span> are considered incidental use and as such are
accounted for as if used within the ARIN service region.<br>
<br>
X.4 Multi-Instance Use<br>
<br>
Any resources used simultaneously in multiple locations, such as
an anycast prefix or ASN, are
<u><span style="color:#3366FF">accounted for as used outside the
region, only if they are exclusively used outside the region.</span></u><span
style="color:red">considered as used within the ARIN service
region, provided at least one instance is located within the
region, regardless of how many other instances are located
outside the region.<br>
</span><br>
X.<u><span style="color:#3366FF">3</span></u><span
style="color:red">5</span> Critical Infrastructure<br>
<br>
Resources justified through ARIN critical infrastructure policies
are accounted for as if used within the ARIN service region,
regardless of their actual location of use.
<o:p></o:p></p>
<br>
<br>
<pre class="moz-signature" cols="72">--
================================================
David Farmer Email: <a class="moz-txt-link-abbreviated" href="mailto:farmer@umn.edu">farmer@umn.edu</a>
Office of Information Technology
University of Minnesota
2218 University Ave SE Phone: 1-612-626-0815
Minneapolis, MN 55414-3029 Cell: 1-612-812-9952
================================================ </pre>
</body>
</html>