Policy Proposal 2008-2 - Staff Assessment

[Member Services]

Policy Proposal 2008-2
Title:  IPv4 Transfer Policy (authors ARIN AC)
Revised:  18 September 2008	
Revised Assessment:  8 October 2008

ARIN Staff Assessment

The assessment of this proposal includes comments from ARIN staff and
the ARIN General Counsel. It contains analysis of procedural, legal, and
resource concerns regarding the implementation of this policy proposal
as it is currently stated. Any changes to the language of the proposal
may necessitate further analysis by staff and Counsel.

I.      Proposal

Policy Proposal is available below and at:
http://www.arin.net/policy/proposals/2008_2.html

II.      Proposal Summary

ARIN staff understands that this proposal introduces a new set of
criteria to justify transfers of IPv4 address space. Specifically, the
existing Transfer Policy sections are consolidated from three sections
to two (8.1 and 8.2) and a new section 8.3 is added that defines
criteria for “Simple Transfers”, which allow an organization with excess
IPv4 addresses to transfer those addresses to an organization with a
need for additional IPv4 addresses, and creates a listing service to
bring the two parties together.

III.     Issues and Concerns

A.      ARIN Staff Comments:

1.	The second paragraph of 8.1 states that “number resources are
assigned to an organization for its exclusive use for the purpose stated
in the request, provided the terms of the Registration Services
Agreement continue to be met”.  Not all number resources involved in a
transfer are covered under an ARIN RSA.  If this is the intent of this
policy, it should be explicitly stated.

2.	In addition, “the stated purpose” for the original allocation may be
difficult for an organization to provide given the requester may not be
the original holder of the number resources.

3.	The newly proposed title for section 8.2 “Transfers as an Artifact of
Change in Resource Holder Ownership” is overly complex and may be
difficult for readers to discern what this section pertains to which may
result in them bypassing this section altogether.

4.	 In addition, this title refers to “resource holder ownership” – this
directly conflicts with the existing transfer policy text and the RSA
which both state that number resources are not “owned”.  Staff suggests
that the existing title for this section “Transfer Requirements” be
retained for clarity and consistency.

5.	 The newly proposed title for section 8.2 .1 “Documentation
Requirement for Transfers as an Artifact of Change in Resource Holder
Ownership” is overly complex and may be difficult for readers to discern
what this section pertains to, which may result in them bypassing this
section altogether.

6.	 In addition, the title refers to “resource holder ownership” - this
directly conflicts with the existing transfer policy text and the RSA
which state that number resources are not “owned”.  Staff suggests that
the existing title for this section “Document Requirements” be retained
for clarity and consistency.

7.	In section 8.3.3 the statement “The IPv4 block must currently be
registered for use within the ARIN service area” is unclear and should
be further defined by the author so that staff has a clear understanding
of how to apply this criteria.

8.	This policy proposal addresses the same subject matter as 2008-2.
They both specify requirements that Transferor and address space be
recognized by ARIN, Transferee demonstrate need and Transferee sign an
RSA. Additionally, they both include provisions on deaggregation,
minimum prefix size and directory services. They differ  in that this
policy is not limited in duration and it does provide criteria on
matters such as facilitating and establishing eligibility for the transfer.



B.    ARIN General Counsel

Counsel believes passage of 2008-2 is better for ARIN than continuing
its current policy that is highly restrictive in the right of parties to
transfer number resources.

Notes:

This policy is a major departure from existing ARIN policy which has
generally prohibited transfers except in specific, limited
circumstances. We therefore address the overall intent of the policy
from a legal perspective.

No matter what transfer policy ARIN implements, it seems likely that
there will be more disputes, and hence more legal risk, once ARIN can no
longer satisfy requests for v4 resources.  But if ARIN continues its
existing community created policy to prohibit most transfers, counsel
anticipates that widespread transfers in conflict with ARIN’s current
policy would nonetheless occur -- imposing significant future legal
costs including the costs of investigation, revocation, arbitration, and
litigation.  A more permissive transfer policy would likely relieve ARIN
of legal risks and costs.  We therefore seek to balance risks created by
the community’s adoption of the proposed policy compared to the risks of
retaining the current policy.

By creating a well understood set of rules for transfer of v4 resources,
the transfer of which are currently prohibited, the policy arguably
advances competition.

The final wording of any transfer policy will have to be carefully
reviewed to ensure it supports to the bedrock legal theory of the
Internet community that numbers are not "owned."  In particular, ARIN
must be able to demonstrate that what is being transferred is the right
to make beneficial use of number resources consistent with applicable
policy, but not ownership. We currently have no concerns in this regard
about the language of this proposal.  The current draft of 2008-2 is
sufficiently “built out” to provide guidance on many issues.


IV. Resource Impact – High

The resource impact of implementing this policy is high. Barring any
unforeseen resource requirements, this policy could be implemented in
excess of 180 days from the date of the ratification of the policy by
the ARIN Board of Trustees.  It will require the following:
· Significant staff training, particularly in relation to maintaining a
listing service
· A new template
· Updates to guidelines
· New hardware may be required
· A new set of processes and procedures regarding pre-qualification,
certification, transfer and the listing service will need to be
developed and all corresponding software/ tools will need to be developed.
· A system for maintaining a log of all “simple” transfers will need to
be developed
· The mechanism and access restrictions for the listing service will
need to be developed.

Regards,

Member Services
American Registry for Internet Numbers (ARIN)


#####


Policy Proposal 2008-2
IPv4 Transfer Policy Proposal

Author: ARIN Advisory Council

Proposal Version: 1.4

Date: 18 September 2008

Proposal type: modify

Policy term: permanent

Policy statement:

Modify the current NRPM section 8 as follows --

8. Transfers

[8.1. Transfers – retain as is]

[8.2 – remove the word “only”, and retitle to “Transfers as an Artifact
of Change in Resource Holder Ownership”]

[Renumber existing 8.3 to 8.2.1 and retitle to “Documentation
Requirements for Transfers as an Artifact of Change in Resource Holder
Ownership”]

[Add the following new section:]

8.3. Simple Transfer of IPv4 Addresses

In light of the pending exhaustion of the IANA IPv4 free pool, ARIN will
also process IPv4 address transfer requests subject to the following
conditions. These conditions apply only to Simple IPv4 transfers, not to
transfers performed according to section 8.2.

8.3.1 Conditions on the transferor (the organization providing addresses
for transfer):

• The transferor has no outstanding balances with ARIN.

• The transferor has not received any IPv4 allocations or assignments
from ARIN (through ordinary allocations or assignments, or through this
Simple Transfer policy) within the preceding 12 months.

• If the transferor elects to retain a portion of a block pursuant to
8.3.6, rather than transferring an entire block, the transferor must
sign (or have previously signed) a RSA or LRSA covering the retained
portion.

8.3.2 Conditions on the transferee (the organization receiving the
transferred addresses):

• The transferee intends to use the transferred IPv4 addresses within
the ARIN service area.

• The transferee has no outstanding balances with ARIN.

• The transferee’s need is confirmed by ARIN, according to current ARIN
policies.

• The transferee signs (or has previously signed) an RSA covering the
IPv4 addresses transferred.

• The transferee may request and receive a contiguous CIDR block large
enough to provide a 12 month supply of IPv4 addresses.

• The transferee may only receive one IPv4 address transfer through this
Simple Transfer process every 6 months.

8.3.3 Conditions on the IPv4 address block to be transferred:

• The IPv4 block must comply with applicable ARIN allocation
requirements, including minimum allocation size. However, an IPv4
allocation or assignment of /24 or larger, but smaller than the current
minimum allocation size, may be transferred as a whole resource (but may
not be subdivided).

• The IPv4 block must currently be registered for use within the ARIN
service area.

• There must be no dispute as to the status of the IPv4 block or
regarding the allocation or assignment of such block to the transferor.

8.3.4 [Section omitted]

8.3.5 Pre-qualification

• An interested transferee must seek pre-qualification from ARIN to
confirm its eligibility to receive a transfer (including satisfaction of
need according to current ARIN policies) before making any solicitation
for transfer. Upon pre-qualification, ARIN will provide the transferee
with documentation of the pre-qualification, including the size (CIDR
prefix length) of the largest IPv4 address block the transferee is
eligible to receive, and the expiration date of the pre-qualification.

• An interested transferor may seek pre-qualification from ARIN to
confirm its eligibility to offer a transfer before offering IPv4 address
resources for transfer. Upon pre-qualification, ARIN will provide the
transferor with documentation of the pre-qualification, including the
network block and the expiration date of the pre-qualification.

8.3.6 De-aggregation when Permitted by ARIN

ARIN may allow transferors to subdivide network blocks. ARIN will
attempt to ensure an adequate supply of small blocks while minimizing
de-aggregation.

8.3.7. Safe Harbor

The fact that an IPv4 address holder is making IPv4 addresses available
for transfer, pursuant to this policy, does not, in and of itself,
indicate that the address holder lacks the need required for an
allocation under ARIN policy.

8.3.8. Organizations under Common Ownership or Control

If an IPv4 transferor or transferee is under common ownership or control
with any other organization that holds one or more IPv4 blocks, the IPv4
transfer request must report all such organizations under common
ownership or control. When evaluating compliance with IPv4 Simple
Transfer conditions, ARIN may consider a transfer request in light of
requests from other organizations under common ownership or control.

8.3.9. Record-keeping and Publication

ARIN will develop and operate a listing service to assist interested
transferors and transferees by providing them a centralized location to
post information about IPv4 blocks available from pre-qualified
transferors and IPv4 blocks needed by pre-qualified transferees.

Participation in the listing service is voluntary.

After completion of a transfer, ARIN will update the registration and
WHOIS records pertaining to the IPv4 block. ARIN will also publish a log
of all transfers, including block, transferor, transferee, and date.


Rationale:

The ARIN Board of Trustees asked the Advisory Council to consider a set
of questions around the depletion of the free pool of IPv4 addresses,
the transition to IPv6 for Internet address needs in the future, and
ARIN's possible role in easing the transition.

Over the course of the year, the Advisory Council has worked to solicit
input from all parts of the policy-making community, through the ARIN
XXI public policy meeting, the Public Policy Mailing List (PPML), sector
meetings, and a poll of PPML subscribers. As a result of the input
received, this policy has been simplified considerably, removing or
modifying text and restrictions deemed unnecessary, while preserving
those aspects that seem to be supported by consensus.

This policy proposal would create a transfer mechanism for IPv4 number
resources between those who have excess resources and those who have a
need, thereby allowing ARIN to continue to serve its mission after IANA
free pool exhaustion. This proposal would also set conditions on such
transfers intended to preserve as much as possible the existing policy
related to efficient, needs-based resource issuance, and would leverage
ARIN's control systems, audit trails, and recognized position as a
trusted agent to avoid speculation and hoarding and diminish the
likelihood and extent of an uncontrolled 'black market' where the risk
and potential for fraud is immeasurably higher.

Many of the transfer conditions are self-explanatory, but some worth
highlighting are that:

• To discourage speculation, a waiting period (proposed at 12 months) is
required before a recipient of space can transfer it to another
organization.

• Transferees must qualify for IPv4 space (just as they do today when
getting it from ARIN) before they can receive address space by transfer,
or solicit space on a listing service.

• To discourage unnecessarily rapid growth of routing tables, an
allocation or assignment may not be arbitrarily deaggregated. To ensure
an adequate supply of small blocks while minimizing deaggregation, ARIN
may allow transferors to subdivide network blocks. A suggested starting
point is to allow transferors to subdivide an IPv4 block into up to four
smaller blocks on CIDR bit-boundaries, provided each resulting block
satisfies the minimum allocation size.

• A transferee may receive one transfer every 6 months, and may receive
at least 12 months worth of space, so they’ll be incented to transfer a
block appropriately sized for their needs, which will further discourage
deaggregation and keep smaller blocks available for smaller organizations.

The proposal would also have ARIN develop and operate a listing service
to facilitate transfers and provide an authoritative central source of
information on space available and requested for transfer. It would not
prohibit private party transactions, but would encourage potential
transferors and transferees be pre-qualified first, so that neither
party will encounter any surprises when they ask ARIN to process the
transfer.


Timetable for implementation: immediately upon ratification by the Board
of Trustees