<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#1F497D">Dan:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">I would have to challenge you to show me specific language that constitutes a “personal attack.” I don’t think you can. I don’t think the conversation can get much better than the contribution I made. It was
well-researched, well reasoned, and more than an opinion. If you don’t agree with it, let’s hear some real argumentation or facts.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Huberman’s response is a good example of where the conversation is going based on what I said. I encourage you to join the conversation in a constructive way.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">--MM<o:p></o:p></span></p>
<p class="MsoNormal"><a name="_MailEndCompose"><span style="color:#1F497D"><o:p> </o:p></span></a></p>
<div style="border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt">
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> Alexander, Daniel [mailto:Daniel_Alexander@Cable.Comcast.com]
<br>
<b>Sent:</b> Sunday, April 12, 2015 7:31 PM<br>
<b>To:</b> Milton L Mueller; arin-ppml@arin.net<br>
<b>Subject:</b> Re: [arin-ppml] Response to the ARIN counsel's assessment of 2014-1 (Out of region use)<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">Milton,<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">Everything you state below is your opinion, just as what counsel states is an opinion. As is my opinion that your reply approaches the line of personal attacks, which is a specifically prohibited
activity on this list. As the Shepherd of this proposal it is good to call out the other side of an argument, but whether one side is wrong is not your call to make.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">It has also been pointed out that it is not appropriate to reference particular companies since you cannot speak authoritatively for them, or the details they operate under. <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">Let's have a better conversation on Tuesday when this proposal is discussed at the meeting.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">Dan Alexander<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">AC Chair<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black"><o:p> </o:p></span></p>
</div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="color:black">From: </span></b><span style="color:black">Milton L Mueller <</span><a href="mailto:mueller@syr.edu">mueller@syr.edu</a><span style="color:black">><br>
<b>Date: </b>Sunday, April 12, 2015 at 1:53 PM<br>
<b>To: </b>"</span><a href="mailto:arin-ppml@arin.net">arin-ppml@arin.net</a><span style="color:black">" <</span><a href="mailto:arin-ppml@arin.net">arin-ppml@arin.net</a><span style="color:black">><br>
<b>Subject: </b>[arin-ppml] Response to the ARIN counsel's assessment of 2014-1 (Out of region use)<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black"><o:p> </o:p></span></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="color:black">At ARIN 35 we will be discussing the fate of a proposal to formally allow out of region use of number resources. Attendees can review the text of the policy alongside a staff and legal assessment of it here:
<o:p></o:p></span></p>
<p class="MsoNormal"><a href="https://www.arin.net/policy/proposals/2014_1.html">https://www.arin.net/policy/proposals/2014_1.html</a><span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">The following is my response to the legal assessment of the proposed out of region use policy by ARIN's Counsel. It is clear that Counsel opposes this policy but I am not sure we are getting an unbiased assessment
of its true implications. In the spirit of open dialogue about policies that are supposed to be developed bottom up by the community, I offer this rejoinder:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">Counsel states:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">"ARIN is governed by ICANN ICP-2, which calls for establishment of a single RIR to serve each region."<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">Regional exclusivity is one of the more interesting and far-ranging issues raised by 2014-1. We need to have a clear and honest discussion of it. Counsel is claiming that ICP-2 requires all usage of numbers to
be bound to exclusive RIR service regions But this claim has no basis in either ICP-2 itself nor in operational practice.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">- The title of ICP-2 is "Criteria for Establishment of New Regional Internet Registries;" in other words it is about the establishment of NEW RIRs, not about the general model of number governance<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">- Even assuming that service regions shouldn’t overlap, ICP-2 does not articulate or establish a policy regarding use of number resources outside of a RIR’s service region.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">- ICP-2 is not a law, and thus raises no legal issues;
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> - ICP-2 is not even a global policy, as its development and adoption by the ICANN board antedates the global policy development process
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> - It is routine for LIRs with transnational operations to rely on one RIR for most of their address resources rather than joining multiple registries in each of the service regions. Far from leading to "difficulty
for co-ordination and co-operation" and "confusion for the community within the region," such practices make coordination easier and reduce confusion and overhead.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">In this regard, let me quote a Feb 25, 2015 statement on PPML by Tony Hain:
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">"Back up and figure out what problem is being solved. The primary reason RIR's became possessive about their territory was "absurd protection of their precious IPv4 allocations". Rewind to the pre-RIR timeframe,
and allocations were global, and use was global. The RIRs were brought in to simplify the process, not fragment it. ... Are we trying to protect the RIR's claimed autonomy over geography, or simplify the process of distribution for a global resource? If it
is the latter as it started out to be, the definition of "out of region" is off-planet. If it is the former, why do people continue to fight against NIR's? If you want absolute autonomy, you need somebody capable of protecting your defined geography, and that
usually becomes police or military. Make up your collective mind about your stated objective and make policy fit that. As far as I know the stated objective is to facilitate allocations of a global resource, so trying to restrict what the recipient does with
it would appear to be out of scope."<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">As Hain suggests, the regional nature of RIRs was intended to facilitate resource distribution, not fragment it; the real reason for assertions of territorial exclusivity is IPv4 scarcity and uneven runout among
the RIRs. But 2014-1 probably will not be implemented until ARIN's free pool is gone.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">Counsel asserts:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">"This policy would allow entities with no real connection to the ARIN's service region to obtain, for example, increasingly scarce IPv4 resources"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">“No real connection” = a major exaggeration. The current policy requires recipients of ARIN resources to be organizations with an existing customer relationship & agreement with ARIN and be "currently using at
least the equivalent of a /22 of IPv4, /44 of IPv6, or 1 ASN within the ARIN service region, respectively." Some connection to the ARIN region is required.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">Counsel asserts: <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">"...if the policy were adopted, ARIN could arguably become subject to the jurisdiction and laws passed by governments outside our service region. This may lead to ARIN being a litigant in courts of nations outside
its service region and subject to their requirements and judgments. ARIN will need to accept greater legal expenditures and risks, as well as potentially larger costs in order to take this greater scope into consideration in ARIN's registry activities on an
ongoing basis."<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">Questionable. As long as ARIN permits its number resources to be used outside of the region, as it currently does, the same risk exists regardless of whether 2014-1 passes or not. Note that even ARIN’s Counsel
states that he supports allowing network operators headquartered in ARIN's region to make use of ARIN-registered resources out of the North American region. Such cases would pose the same jurisdictional risks, if indeed those risks are significant. Thus it
is unclear how 2014-1 changes anything in this regard. Note also that a RIPE policy in place for the past 2 and a half years has not led to any such problems.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">RIPE-NCC is currently allocating /22s from the 185.0.0.0/8 block without needs assessment and have given out hundreds since 2012. The receipant of the /22 is required to become a RIPE NCC member, but the recipient
can be based anywhere. Over a dozen US companies not based in the RIPE region have availed themselves of this policy. Here are a few examples, with links to the Whois:
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">US 185.46.120.0 01/31/2014 IHNetworks, LLC
</span><a href="https://apps.db.ripe.net/search/lookup.html?source=ripe&key=ORG-ILI4-RIPE&type=organisation">https://apps.db.ripe.net/search/lookup.html?source=ripe&key=ORG-ILI4-RIPE&type=organisation</a><span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">US 185.47.84.0 02/10/2014 KVH Industries, Inc
</span><a href="https://apps.db.ripe.net/search/lookup.html?source=ripe&key=ORG-KII1-RIPE&type=organisation">https://apps.db.ripe.net/search/lookup.html?source=ripe&key=ORG-KII1-RIPE&type=organisation</a><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">US 185.51.4.0 03/20/2014 Latisys-Denver, LLC
</span><a href="https://apps.db.ripe.net/search/lookup.html?source=ripe&key=ORG-LL159-RIPE&type=organisation">https://apps.db.ripe.net/search/lookup.html?source=ripe&key=ORG-LL159-RIPE&type=organisation</a><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">US 185.52.0.0 03/27/2014 RamNode LLC
</span><a href="https://apps.db.ripe.net/search/lookup.html?source=ripe&key=ORG-RL171-RIPE&type=organisation">https://apps.db.ripe.net/search/lookup.html?source=ripe&key=ORG-RL171-RIPE&type=organisation</a><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">US 185.52.136.0 04/01/2014 Peak Web LLC
</span><a href="https://apps.db.ripe.net/search/lookup.html?source=ripe&key=ORG-PWL4-RIPE&type=organisation">https://apps.db.ripe.net/search/lookup.html?source=ripe&key=ORG-PWL4-RIPE&type=organisation</a><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">I believe in evidence-based policy. In many respects, RIPE-NCC is permitting out of region membership and out of region use. Can Counsel identify any of the purported problems taking place because of RIPE’s openness
to members from other regions? Has RIPE been a litigant in the US or has a national government threatened it with "political oversight" because of these actions?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">Counsel asserts:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">"[T]he policy fails to recognize that ARIN is not likely to able to perform the function contemplated in the policy with certain countries," such as Cuba, Iran and North Korea.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">ARIN is barred from doing business with those countries with or without this policy. Any applicant for resources from those countries could simply be denied.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">Counsel asserts:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">"ARIN may be subject to significantly greater political oversight by national governments in its service region that will wish to evaluate why ARIN alone of the 5 RIRs is assuming a duty to service all of the world's
community. It may be argued by governments in ARIN's region that this is a potential breach of ARIN's fiduciary obligations to its own region, and to examine whether it is consistent with ARIN's non-profit status and other corporate documents."<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">Incomplete, factually wrong in part, and speculative. It is incomplete because Counsel provides no legal reason why allowing out of region use would threaten ARIN's nonprofit status. Factually wrong because ARIN
is not alone - note the RIPE-NCC case above. The argument about government reaction is speculative and non-legal. Essentially the claim is that governments (not the number resource-using community) won't like this policy and will punish ARIN for passing it
by asserting some unspecified kind of "political oversight." Based on context I can think of only one government that would be in a position to assert "political oversight" over ARIN, and that is the U.S. government. Yet the US is firmly committed to private
sector-led, multistakeholder internet governance. There is no legislation proposing to regulate ARIN on the horizon and no major private sector stakeholder lobbying group demanding it.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">I think, therefore, that Counsel has it exactly backwards: if we reject this policy solely because of fear of the US government, ARIN and its board will be breaching their fiduciary obligations to pass number resource
policies that are fair and impartial, technically sound, and supported by the community.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">Counsel asserts: <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">"the policy will lead to an increase in fraudulent applications from out of region requestors, and issuance of resources to those who fraudulently file, since ARIN is not as well positioned to successfully discover
such fraud by out of region requestors."<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">This is a legitimate concern. But I see no reason why staff cannot deny resources to entities that cannot produce adequate evidence for their claims. Other tweaks to be policy could be conceived that might address
this issue, bearing in mind that two previous attempts to define thresholds were not acceptable to the community. Further, the incentive for most fraudulent applications comes from IPv4 scarcity, which has a very limited time horizon.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">Conclusion<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">The choice is clear: are IP numbers a global resource to be allocated and assigned on the basis of technical efficiency, or are RIRs here to fragment the number distribution process into mutually exclusive territories?
Will this policy be adopted or not based on its merit and community support, or on vague threats about governmental repercussions? I look forward to seeing you at ARIN 35 to further air these issues.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">Milton L Mueller<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">ARIN Advisory Council member but speaking only for myself<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">Laura J. and L. Douglas Meredith Professor<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">Syracuse University School of Information Studies<o:p></o:p></span></p>
<p class="MsoNormal"><a href="http://faculty.ischool.syr.edu/mueller/">http://faculty.ischool.syr.edu/mueller/</a><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">Internet Governance Project<o:p></o:p></span></p>
<p class="MsoNormal"><a href="http://internetgovernance.org/">http://internetgovernance.org</a><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
</div>
</div>
</div>
</div>
</body>
</html>