Draft Policy ARIN-2015-5: Out of region use - revised

[ARIN]

ARIN-2015-5 has been revised.

ARIN staff provided a staff and legal assessment to the ARIN Advisory 
Council (AC) on 18 August. The AC revised the policy text, staff revised 
their assessment, and then the AC made some editorial changes to the 
policy text (which were suggested by staff).

You are encouraged to discuss the merits and your concerns of Draft
Policy 2015-5 on the Public Policy Mailing List.

The AC will evaluate the discussion in order to assess the conformance
of this draft policy with ARIN's Principles of Internet Number Resource
Policy as stated in the PDP. Specifically, these principles are:

    * Enabling Fair and Impartial Number Resource Administration
    * Technically Sound
    * Supported by the Community

ARIN-2015-5 is below and can be found at:
https://www.arin.net/policy/proposals/2015_5.html

Regards,

Communications and Member Services
American Registry for Internet Numbers (ARIN)


## * ##


Draft Policy ARIN-2015-5
Out of region use

Date: 17 September 2015

Problem statement:

Current policy neither clearly forbids nor clearly permits out of region 
use of ARIN registered resources. This has created confusion and 
controversy within the ARIN community for some time. Earlier work on 
this issue has explored several options to restrict or otherwise limit 
out of region use or loosen controls and totally authorize such use. 
None of these options have gained consensus within the community. The 
next logical option is a proposal that clearly permits out of region use 
while addressing the key concerns expressed about unlimited openness to 
out of region use and enables ARIN staff to implement the policy 
efficiently.

Policy statement:

Create new Section X:

ARIN registered resources may be used outside the ARIN service region. 
Out of region use of ARIN registered resources are valid justification 
for additional number resources, provided that the applicant has a real 
and substantial connection with the ARIN region which applicant must 
prove (as described below) and is using the same type of resources (with 
a delegation lineage back to an ARIN allocation or assignment) within 
the ARIN service region as follows:

* IPv4: At least a /22 used in region
* IPv6: At least a /44 used in region
* ASN: At least one ASN present on one or more peering sessions and/or 
routers within the region.

A real and substantial connection shall be defined as carrying on 
business in the ARIN region in a meaningful manner.  The determination 
as to whether an entity is carrying on business in the ARIN region in a 
meaningful manner shall be made by ARIN. Simply being incorporated in 
the ARIN region shall not be sufficient, on its own, to prove that an 
entity is carrying on business in the ARIN region in a meaningful 
manner. Methods that entities may consider using, including 
cumulatively, to prove that they are carrying on business in the ARIN 
region in a meaningful manner include:
* Demonstrating a physical presence in the ARIN region through a bricks 
and mortar location that is actually used for the purposes of conducting 
business in the ARIN region in a meaningful manner. That is to say, the 
location is not merely a registered office that serves no other business 
purpose.
* Demonstrating that the entity has staff in the ARIN region. The 
greater the number of staff, the stronger this connecting factor is.
* Demonstrating that the entity holds assets in the ARIN region. The 
greater the asset value, the stronger this connecting factor is.
* Demonstrating that the entity provides services to and solicits sales 
from residents of the ARIN region.
* Demonstrating that the entity holds periodic meetings in the ARIN region.
* Demonstrating that the entity raises investment capital from investors 
in the ARIN region.
* Demonstrating that the entity has a registered corporation in the ARIN 
region, although this factor on its own shall not be sufficient.
* Other fact based criterion that the entity considers appropriate and 
submits for ARIN's review.
The weight accorded to any of the above-noted factors, if any, shall be 
determined solely by ARIN.

The services and facilities used to justify the need for ARIN resources 
that will be used out of region cannot also be used to justify resource 
requests from another RIR. When a request for resources from ARIN is 
justified by need located within another RIR's service region, an 
officer of the application must attest that the same services and 
facilities have not been used as the basis for a resource request in the 
other region(s). ARIN reserves the right to obtain from the applicant a 
listing of all the applicant's number holdings in the region(s) of 
proposed use, when there are factual reasons to support the request.

Comments:

a) Timetable for implementation: Various iterations of this policy have 
been presented and debated by ARIN for well over a year now. Given the 
amount of time that has already been spent on developing a policy, 
ideally, this policy would be implemented as soon as possible.
b) Explanation of draft policy: The draft policy addresses both the 
problem statement as well as the concerns raised at ARIN 35 by 
participants as well as ARIN counsel.
Firstly, the draft policy addresses the concerns of ARIN counsel as well 
as some of the participants at ARIN 35 by ensuring that anyone 
requesting numbered resources from ARIN has a real and substantial 
connection with the ARIN region. This should go a long way to addressing 
concerns about fraud, legal liability, and interference with the 
jurisdiction of other RIRs.
In addition, by placing the burden of proof for demonstrating a real and 
substantial connection with the ARIN region on the applicant, the amount 
of work required of ARIN staff to apply the policy will be reduced.
The factors noted above are suggestions that an entity may use to 
demonstrate to ARIN that it is carrying on business in the ARIN region 
in a meaningful manner. These factors are all indicative, some more than 
others, that an entity has a real and substantial connection to the ARIN 
region through the carrying on of business in the ARIN region in a 
meaningful manner. Not all of the factors will apply in a given case and 
proving a single factor may not be enough to satisfy ARIN that an entity 
is carrying on business in the region in a meaningful manner. The list 
of factors is meant to be quite broad, including an open-ended factor, 
in order to capture the diversity of businesses that operate in the ARIN 
region and that may justifiably require numbered resources from ARIN. 
This approach is very similar to the practical method that courts 
typically apply to assess whether parties have a sufficient connection 
to a jurisdiction so as to require them to submit themselves to the 
courts of that jurisdiction.

This draft policy is a substantial improvement over the previous version 
of ARIN-2014-1 in terms of reducing the overall risk to the community by 
requiring a real and substantial connection between an entity requesting 
resources and the ARIN region.

#####

ARIN STAFF & LEGAL ASSESSMENT
Draft Policy ARIN-2015-5
OUT OF REGION USE

Date of Assessment: 17 September 2015

___
1. Summary (Staff Understanding)

This proposal would allow an organization to receive Internet number 
resources from ARIN for use out of region as long as the applicant is 
currently using at least the equivalent of a /22 of IPv4, /44 of IPv6, 
or 1 ASN within the ARIN service region, respectively. In addition, the 
applicant must have a real and substantial connection with the ARIN 
region, which the applicant shall be responsible for proving.

___
2. Comments

A. ARIN Staff Comments

This policy would increase the complexity of ARIN staff review work in 
request cases that fit the profile of this policy. There would in an 
increase in the vetting and utilization verification work currently 
conducted by ARIN staff.

This policy would be placed in the NRPM as section 9, "Out of Region Use".

B. ARIN General Counsel – Legal Assessment

If the policy is enacted it will require ARIN staff to work with counsel 
with some attendant increase in costs in the first year to manage 
implementation. The policy is consistent with standard legal principles 
routinely utilized in the ARIN region. The policy creates no material 
legal risks.

___
3. Resource Impact

 From a request review standpoint, implementation of this policy would 
require additional review steps for Internet number resource requests. 
It could have future staffing implications based on the amount of 
additional work the policy could present. It is estimated that 
implementation could occur within 3 months after ratification by the 
ARIN Board of Trustees. The following would be needed in order to implement:

* Updated guidelines and internal procedures
* Staff training

Implementation of this policy may allow for registrations in the ARIN 
database that require unicode character sets. From an engineering 
standpoint, implementation of this policy could have a major resource 
impact. It is estimated that implementation would occur within 12 
months, instead of the 3 months cited above, after ratification by the 
ARIN Board of Trustees if ARIN is required to support unicode character 
sets. The following would be needed in order to implement:

* Engineering: Engineering efforts to handle out of region business 
rules may be substantial as our system only supports ascii now. If there 
is a need for unicode character sets, then there is a substantial amount 
of work required to upgrade the DB and applications to support unicode. 
Additionally, we would need to discuss how to display unicode characters 
in port 43 whois.

___
4. Proposal / Draft Policy Text Assessed

Draft Policy ARIN-2015-5 (September 9, 2015, version)

Problem statement:

Current policy neither clearly forbids nor clearly permits out of region 
use of ARIN registered resources. This has created confusion and 
controversy within the ARIN community for some time. Earlier work on 
this issue has explored several options to restrict or otherwise limit 
out of region use. None of these options have gained consensus within 
the community. The next logical option is a proposal that clearly 
permits out of region use while addressing the key concerns expressed 
about unlimited openness to out of region use and enables ARIN staff to 
implement the policy efficiently.

Policy statement:

Create new Section X:

ARIN registered resources may be used outside the ARIN service region. 
Out of region use of ARIN registered resources are valid justification 
for additional number resources, provided that the applicant has a real 
and substantial connection with the ARIN region which applicant must 
prove (as described below) and is using the same type of resources (with 
a delegation lineage back to an ARIN allocation or assignment) within 
the ARIN service region as follows:

* IPv4: At least a /22 used in region
* IPv6: At least a /44 used in region
* ASN: At least one ASN present on one or more peering sessions and/or 
routers within the region.

A real and substantial connection shall be defined as carrying on 
business in the ARIN region in a meaningful manner, whether for or not 
for profit. The determination as to whether an entity is carrying on 
business in the ARIN region in a meaningful manner shall be made by 
ARIN. Simply being incorporated in the ARIN region shall not be 
sufficient, on its own, to prove that an entity is carrying on business 
in the ARIN region in a meaningful manner. Methods that entities may 
consider using, including cumulatively, to prove that they are carrying 
on business in the ARIN region in a meaningful manner include:
* Demonstrating a physical presence in the ARIN region through a bricks 
and mortar location that is actually used for the purposes of conducting 
business in the ARIN region in a meaningful manner. That is to say, the 
location is not merely a registered office that serves no other business 
purpose.
* Demonstrating that the entity has staff in the ARIN region. The 
greater the number of staff, the stronger this connecting factor is.
* Demonstrating that the entity holds assets in the ARIN region. The 
greater the asset value, the stronger this connecting factor is.
* Demonstrating that the entity provides services to or solicits sales 
from residents of the ARIN region.
* Demonstrating that the entity holds annual meetings in the ARIN region.
* Demonstrating that the entity raises investment capital from investors 
in the ARIN region.
* Demonstrating that the entity has a registered office in the ARIN 
region, although this factor on its own shall not be sufficient.
* Any other method that the entity considers appropriate.
The weight accorded to any of the above-noted factors, if any, shall be 
determined solely by ARIN.

The services and facilities used to justify the need for ARIN resources 
that will be used out of region cannot also be used to justify resource 
requests from another RIR. When a request for resources from ARIN is 
justified by need located within another RIR's service region, an 
officer of the application must attest that the same services and 
facilities have not been used as the basis for a resource request in the 
other region(s). ARIN reserves the right to request a listing of all the 
applicant's number holdings in the region(s) of proposed use, but this 
should happen only when there are significant reasons to suspect 
duplicate requests.



On 9/9/15 9:38 AM, ARIN wrote:
> ARIN-2015-5 has been revised.
>
> You are encouraged to discuss the merits and your concerns of Draft
> Policy 2015-5 on the Public Policy Mailing List.
>
> The AC will evaluate the discussion in order to assess the conformance
> of this draft policy with ARIN's Principles of Internet Number Resource
> Policy as stated in the PDP. Specifically, these principles are:
>
>     * Enabling Fair and Impartial Number Resource Administration
>     * Technically Sound
>     * Supported by the Community
>
> ARIN-2015-5 is below and can be found at:
> https://www.arin.net/policy/proposals/2015_5.html
>
> Regards,
>
> Communications and Member Services
> American Registry for Internet Numbers (ARIN)
>
>
> ## * ##
>
>
> Draft Policy ARIN-2015-5
> Out of region use
>
> Date: 9 September 2015
>
> Problem statement:
>
> Current policy neither clearly forbids nor clearly permits out of region
> use of ARIN registered resources. This has created confusion and
> controversy within the ARIN community for some time. Earlier work on
> this issue has explored several options to restrict or otherwise limit
> out of region use. None of these options have gained consensus within
> the community. The next logical option is a proposal that clearly
> permits out of region use while addressing the key concerns expressed
> about unlimited openness to out of region use and enables ARIN staff to
> implement the policy efficiently.
>
> Policy statement:
>
> Create new Section X: ARIN registered resources may be used outside the
> ARIN service region.
>
> Out of region use of ARIN registered resources are valid justification
> for additional number resources, provided that the applicant has a real
> and substantial connection with the ARIN region which applicant must
> prove (as described below) and is using the same type of resources (with
> a delegation lineage back to an ARIN allocation or assignment) within
> the ARIN service region as follows:
>
> * IPv4: At least a /22 used in region
> * IPv6: At least a /44 used in region
> * ASN: At least one ASN present on one or more peering sessions and/or
> routers within the region.
>
> A real and substantial connection shall be defined as carrying on
> business in the ARIN region in a meaningful manner, whether for or not
> for profit. The determination as to whether an entity is carrying on
> business in the ARIN region in a meaningful manner shall be made by
> ARIN. Simply being incorporated in the ARIN region shall not be
> sufficient, on its own, to prove that an entity is carrying on business
> in the ARIN region in a meaningful manner. Methods that entities may
> consider using, including cumulatively, to prove that they are carrying
> on business in the ARIN region in a meaningful manner include:
> * Demonstrating a physical presence in the ARIN region through a bricks
> and mortar location that is actually used for the purposes of conducting
> business in the ARIN region in a meaningful manner. That is to say, the
> location is not merely a registered office that serves no other business
> purpose.
> * Demonstrating that the entity has staff in the ARIN region. The
> greater the number of staff, the stronger this connecting factor is.
> * Demonstrating that the entity holds assets in the ARIN region. The
> greater the asset value, the stronger this connecting factor is.
> * Demonstrating that the entity provides services to or solicits sales
> from residents of the ARIN region.
> * Demonstrating that the entity holds annual meetings in the ARIN region.
> * Demonstrating that the entity raises investment capital from investors
> in the ARIN region.
> * Demonstrating that the entity has a registered office in the ARIN
> region, although this factor on its own shall not be sufficient.
> * Any other method that the entity considers appropriate.
> The weight accorded to any of the above-noted factors, if any, shall be
> determined solely by ARIN.
>
> The services and facilities used to justify the need for ARIN resources
> that will be used out of region cannot also be used to justify resource
> requests from another RIR. When a request for resources from ARIN is
> justified by need located within another RIR's service region, an
> officer of the application must attest that the same services and
> facilities have not been used as the basis for a resource request in the
> other region(s). ARIN reserves the right to request a listing of all the
> applicant's number holdings in the region(s) of proposed use, but this
> should happen only when there are significant reasons to suspect
> duplicate requests.
>
> Comments:
>
> a) Timetable for implementation: Various iterations of this policy have
> been presented and debated by ARIN for well over a year now. Given the
> amount of time that has already been spent on developing a policy,
> ideally, this policy would be implemented as soon as possible.
> b) Explanation of draft policy: The draft policy addresses both the
> problem statement as well as the concerns raised at ARIN 35 by
> participants as well as ARIN counsel.
> Firstly, the draft policy addresses the concerns of ARIN counsel as well
> as some of the participants at ARIN 35 by ensuring that anyone
> requesting numbered resources from ARIN has a real and substantial
> connection with the ARIN region. This should go a long way to addressing
> concerns about fraud, legal liability, and interference with the
> jurisdiction of other RIRs.
> In addition, by placing the burden of proof for demonstrating a real and
> substantial connection with the ARIN region on the applicant, the amount
> of work required of ARIN staff to apply the policy will be reduced.
> The factors noted above are suggestions that an entity may use to
> demonstrate to ARIN that it is carrying on business in the ARIN region
> in a meaningful manner. These factors are all indicative, some more than
> others, that an entity has a real and substantial connection to the ARIN
> region through the carrying on of business in the ARIN region in a
> meaningful manner. Not all of the factors will apply in a given case and
> proving a single factor may not be enough to satisfy ARIN that an entity
> is carrying on business in the region in a meaningful manner. The list
> of factors is meant to be quite broad, including an open-ended factor,
> in order to capture the diversity of businesses that operate in the ARIN
> region and that may justifiably require numbered resources from ARIN.
> This approach is very similar to the practical method that courts
> typically apply to assess whether parties have a sufficient connection
> to a jurisdiction so as to require them to submit themselves to the
> courts of that jurisdiction.
>
> This draft policy is a substantial improvement over the previous version
> of ARIN-2014-1 in terms of reducing the overall risk to the community by
> requiring a real and substantial connection between an entity requesting
> resources and the ARIN region.
>
> #####
>
> ARIN STAFF & LEGAL ASSESSMENT
>
> Draft Policy ARIN-2015-5
> OUT OF REGION USE
> https://www.arin.net/policy/proposals/2015_5.html
>
> Date of Assessment: 18 August 2015
>
> ___
> 1. Summary (Staff Understanding)
>
> This proposal would allow an organization to receive Internet number
> resources from ARIN for use out of region as long as the applicant is
> currently using at least the equivalent of a /22 of IPv4, /44 of IPv6,
> or 1 ASN within the ARIN service region, respectively. In addition, the
> applicant must have a real and substantial connection with the ARIN
> region, which the applicant shall be responsible for proving.
>
> ___
> 2. Comments
>
> A. ARIN Staff Comments
>
> This policy would increase the complexity of ARIN staff review work in
> request cases that fit the profile of this policy. There would in an
> increase in the vetting and utilization verification work currently
> conducted by ARIN staff.
>
> There are conflicting instructions to ARIN staff in this policy text.
> Specifically, the text says, "The determination as to whether an entity
> is carrying on business in the ARIN region in a meaningful manner shall
> be made by ARIN." Then at the end of the examples given, the text
> states, "Any other method that the entity considers appropriate." This
> implies that ARIN staff may have to accept anything presented by an
> organization as a method of proving a "real and substantial connection
> with the ARIN region."
>
> It is not clear if the utilized /22, /44 or AS Number are required to
> have been issued by ARIN or is it allowable to be from another RIR.
>
> This policy would be placed in the NRPM as section 9, "Out of Region Use".
>
> B. ARIN General Counsel – Legal Assessment
>
> If the policy is enacted it will require ARIN staff to work with counsel
> with some attendant increase in costs in the first year to manage
> implementation. The policy is consistent with standard legal principles
> routinely utilized in the ARIN region. The policy creates no material
> legal risks.
>
> ___
> 3. Resource Impact
> This policy could have a major resource impact from an implementation
> aspect. It is estimated that implementation would occur within 12 months
> after ratification by the ARIN Board of Trustees. The following would be
> needed in order to implement:
>
> * Updated guidelines and internal procedures
> * Staff training
> * Engineering: Engineering efforts to handle out of region business
> rules may besubstantial as our system only supports ascii now. If there
> is a need for unicode character sets, then there is a substantial amount
> of work required to upgrade the DB and applications to support unicode.
> Additionally, we would need to discuss how to display unicode characters
> in port 43 whois. There may be additional tools needed by RSD staff to
> measure in region/out of region use.
>
> ___
> 4. Proposal / Draft Policy Text Assessed
>
> Draft Policy ARIN-2015-5
>
> Date: 23 June 2015
>
> Problem statement:
> Current policy neither clearly forbids nor clearly permits out or region
> use of ARIN registered resources. This has created confusion and
> controversy within the ARIN community for some time. Earlier work on
> this issue has explored several options to restrict or otherwise limit
> out of region use. None of these options have gained consensus within
> the community. The next logical option is a proposal that clearly
> permits out of region use while addressing the key concerns expressed
> about unlimited openness to out of region use and enables ARIN staff to
> implement the policy efficiently.
>
> Policy statement:
> Create new Section X:
> ARIN registered resources may be used outside the ARIN service region.
> Out of region use of IPv4, IPv6, or ASNs are valid justification for
> additional number resources if the applicant is currently using at least
> the equivalent of a /22 of IPv4, /44 of IPv6, or 1 ASN within the ARIN
> service region, respectively. In addition, the applicant must have a
> real and substantial connection with the ARIN region, which the
> applicant shall be responsible for proving.
> A real and substantial connection shall be defined as carrying on
> business in the ARIN region in a meaningful manner, whether for or not
> for profit. The determination as to whether an entity is carrying on
> business in the ARIN region in a meaningful manner shall be made by
> ARIN. Simply being incorporated in the ARIN region shall not be
> sufficient, on its own, to prove that an entity is carrying on business
> in the ARIN region in a meaningful manner. Methods that entities may
> consider using, including cumulatively, to prove that they are carrying
> on business in the ARIN region in a meaningful manner include:
> * Demonstrating a physical presence in the ARIN region through a bricks
> and mortar location that is actually used for the purposes of conducting
> business in the ARIN region in a meaningful manner. That is to say, the
> location is not merely a registered office that serves no other business
> purpose.
> * Demonstrating that the entity has staff in the ARIN region. The
> greater the number of staff, the stronger this connecting factor is.
> * Demonstrating that the entity holds assets in the ARIN region. The
> greater the asset value, the stronger this connecting factor is.
> * Demonstrating that the entity provides services to or solicits sales
> from residents of the ARIN region.
> * Demonstrating that the entity holds annual meetings in the ARIN region.
> * Demonstrating that the entity raises investment capital from investors
> in the ARIN region.
> * Demonstrating that the entity has a registered office in the ARIN
> region, although this factor on its own shall not be sufficient.
> * Any other method that the entity considers appropriate.
> The services and facilities used to justify the need for ARIN resources
> that will be used out of region cannot also be used to justify resource
> requests from another RIR. When a request for resources from ARIN is
> justified by need located within another RIR's service region, the
> officer of the applicant must attest that the same services and
> facilities have not been used as the basis for a resource request in the
> other region(s). ARIN reserves the right to request a listing of all the
> applicant's number holdings in the region(s) of proposed use, but this
> should happen only when there are significant reasons to suspect
> duplicate requests.
>
> Comments:
> a) Timetable for implementation: Various iterations of this policy have
> been presented and debated by ARIN for well over a year now. Given the
> amount of time that has already been spent on developing a policy,
> ideally, this policy would be implemented as soon as possible.
> b) Explanation of draft policy: The draft policy addresses both the
> problem statement as well as the concerns raised at ARIN 35 by
> participants as well as ARIN counsel.
> Firstly, the draft policy addresses the concerns of ARIN counsel as well
> as some of the participants at ARIN 35 by ensuring that anyone
> requesting numbered resources from ARIN has a real and substantial
> connection with the ARIN region. This should go a long way to addressing
> concerns about fraud, legal liability, and interference with the
> jurisdiction of other RIRs.
> In addition, by placing the burden of proof for demonstrating a real and
> substantial connection with the ARIN region on the applicant, the amount
> of work required of ARIN staff to apply the policy will be reduced.
> The factors noted above are suggestions that an entity may use to
> demonstrate to ARIN that it is carrying on business in the ARIN region
> in a meaningful manner. These factors are all indicative, some more than
> others, that an entity has a real and substantial connection to the ARIN
> region through the carrying on of business in the ARIN region in a
> meaningful manner. Not all of the factors will apply in a given case and
> proving a single factor may not be enough to satisfy ARIN that an entity
> is carrying on business in the region in a meaningful manner. The list
> of factors is meant to be quite broad, including an open-ended factor,
> in order to capture the diversity of businesses that operate in the ARIN
> region and that may justifiably require numbered resources from ARIN.
> This approach is very similar to the practical method that courts
> typically apply to assess whether parties have a sufficient connection
> to a jurisdiction so as to require them to submit themselves to the
> courts of that jurisdiction.
> This draft policy is a substantial improvement over the previous version
> of ARIN-2014-1 in terms of reducing the overall risk to the community by
> requiring a real and substantial connection between an entity requesting
> resources and the ARIN region.