Draft Policy ARIN-2014-14: Needs Attestation for some IPv4 Transfers [Archived]

OUT OF DATE?

Here in the Vault, information is published in its final form and then not changed or updated. As a result, some content, specifically links to other pages and other references, may be out-of-date or no longer available.

Status: Abandoned

Tracking Information

Discussion Tracking

Mailing List:

Formal introduction on PPML on 16 May 2014

Origin - ARIN-prop-204

Draft Policy - 16 May 2014

Staff assessment - 29 September 2014

Revised - 24 February 2015

Abandoned by the AC - 27 April 2015

Public Policy Mailing List

ARIN Public Policy Meeting:

ARIN PPC at NANOG 61

ARIN PPC at NANOG 62

ARIN 34
ARIN PPC at NANOG 63

ARIN 35

ARIN Advisory Council:

AC Shepherds:
John Springer, Andrew Dul

ARIN Board of Trustees:

Revisions:

Implementation:

Draft Policy ARIN-2014-14
Needs Attestation for some IPv4 Transfers

Date: 24 Feb 2015

Problem Statement:

The process of ’needs testing’ or ’needs basis’ allocation has evolved
over the history of the Internet registry system. The earliest number
resource policy required that an operator intend to use the number
resources on an operational Internet Protocol network before the
resource would be registered to an organization. Organizations were
assigned either a Class A, B, or C block roughly depending on the
organization’s size. With the implementation of CIDR, additional ’needs
testing’ was done to right size allocations to fit organizations. These
testing requirements continued to evolve under various organizations
prior to the RIRs inception and then later formally under the RIR’s
policy development process.

In the 2000s, ARIN began a systematic “trust but verify” process for
IPv4 requests. This was necessary due to both IPv4 address registration
hijackings in ARIN Whois and the accelerated amount of systematic fraud
being perpetrated on ARIN.

As IPv4 exhaustion occurred, some RIRs have reconsidered the necessity
of some of the needs testing requirements and implemented policies
which reduced the requirements on organizations to show need or
utilization for some transfer transactions with the RIR.

The cost of performing a needs assessment and auditing of this
information vs. the public benefit of restricting allocations to
specifically qualified organizations has been noted by some
organizations to be out of alignment. The ability to predict future use
toward a 24-month utilization rate can also be challenging for some
organizations and relies on projections and estimates rather than
verifiable facts. Thus, the current needs testing requirements may be
more than is necessary and desirable for small transfers. This policy
seeks to reduce the complexity of transfers by removing the utilization
needs testing requirement and replacing it with a needs attestation by
a corporate officer.

Additionally, other requirements are placed around the ’needs
attestation only’ requirement to reduce the Number Resource Community’s
concern that this type of policy could be abused for speculation or
hording. Furthermore, the policy includes a sunset clause to limit the
total number of transfers under this policy proposal. This sunset is
intended to force the community to reexamine the success or failure of
the practices contained in this policy proposal.

Policy statement:

Section 8.3

Replace the ‘Conditions on recipient of the transfer’ with
the following conditions.

Conditions on recipient of the transfer:

The organization must sign an RSA.

The resources transferred will be subject to current ARIN policies.

In addition, the recipient must meet one of the following requirements
sets:

The organization must demonstrate the need for up to a 24-month
supply of IP address resources under current ARIN policies.

1.The organization, its parent(s), or subsidiary organizations, must
not have received IPv4 address resources, via transfer, within the past 12
months.

2.An officer of the organization must attest that the IPv4 address
block is needed for and will be used on an operational network.

3.The maximum transfer size is /20.

4.Fewer than 5,000 needs attestation transfers have occurred.

Section 8.4

Replace the ‘Conditions on recipient of the transfer’ with
the following conditions.

Conditions on recipient of the transfer:

The conditions on a recipient outside of the ARIN region will be
defined by the policies of the receiving RIR.

Recipients within the ARIN region will be subject to current ARIN
policies and sign an RSA for the resources being received.

The minimum transfer size is a /24.

In addition, the recipient must meet one of the following requirements
sets:

The organization must demonstrate the need for up to a 24-month
supply of IP address resources under current ARIN policies.

1.The organization, its parent(s), or subsidiary organizations, must
not have received IPv4 address resources, via transfer, within the past 12 months.

2.An officer of the organization must attest that the IPv4 address
block is needed for and will be used on an operational network.

3.The maximum transfer size is /20.

4.Fewer than 5,000 needs attestation transfers have occurred.

Comments:

Timetable for implementation: Immediate

#####

Earlier version

Draft Policy ARIN-2014-14
Removing Needs Test from Small IPv4 Transfers

Date: 16 May 2014

Problem Statement:

ARIN staff, faced with a surge in near-exhaust allocations and subsequent transfer requests and a requirement for team review of these, is spending scarce staff time on needs testing of small transfers. This proposal seeks to decrease overall ARIN processing time through elimination of that needs test.

Policy statement:

Change the language in NRPM 8.3 after Conditions on the recipient of the transfer: from “The recipient must demonstrate the need for up to a 24-month supply of IP address resources under current ARIN policies and sign an RSA.” to “For transfers larger than a /16 equivalent or for recipients who have completed a needs-free transfer in the prior year, the recipient must demonstrate the need for up to a 24-month supply of IP address resources under current ARIN policies and sign an RSA.”

Change the language in the third bullet point in NRPM 8.4 after Conditions on the recipient of the transfer: from “Recipients within the ARIN region must demonstrate the need for up to a 24-month supply of IPv4 address space.” to “For transfers larger than a /16 equivalent or for recipients who have completed a needs-free transfer in the prior year, recipients in the ARIN region must demonstrate the need for up to a 24-month supply of IP address resources under current ARIN policies and sign an RSA.”

Comments:

Needs testing has been maintained for transfers largely because the community wishes to ensure protection against hoarding and speculation in the IPv4 market. This proposal seeks a middle ground between the elimination of needs tests for transfers altogether, and the continuance of needs tests for every transfer. This should help ARIN staff to reduce transfer processing time, since most transfers have been smaller than /16.

Timetable for implementation: Immediate

ARIN STAFF ASSESSMENT
Date of Assessment: 22 Sept 2104
Policy Proposal : 2014-14 “Removing Needs Test from Small IPv4 Transfers”

Summary (Staff Understanding)

This policy would make the following changes to the recipient of 8.3 and 8.4 transfers:

An organization must demonstrate the need for a 24-month supply of IPv4 addresses only if the transfer is more than a /16 equivalent OR the recipient has received IPv4 addresses via an 8.3 transfer without needs assessment within the past 12 months.

Comments

A. ARIN Staff Comments

Thus far, ~85% of completed 8.3 transfers have been of a /16 or less.
- Needs based assessment would be removed from the majority of 8.3 transfers with this policy
- This policy has the potential to significantly lessen the amount of time it takes an analyst to process these types of 8.3 transfers when requested by organizations already established with ARIN
This policy could be implemented as written

B. ARIN General Counsel - Legal Assessment

I examined the proposed amendments to Policies 2014-14 and 2014-20 together, because both are ostensibly intended to solve the same problem: difficulties experienced by new entrants and smaller entities that may be unable to obtain addresses they need due to current policy limits at time when ISP IPV4 issuance to such downstream entities may be limited. Counsel believes that 2014-14 presents significantly less legal concern than 2014-20. Policy 2014-14 creates greater efficiency by removing a showing of need, and allowing a transfer of a /16 or smaller bloc. Exceptions to needs based review can be justified because the smaller size of the blocs does not provide a significant vehicle to ‘game’, ‘hoard’, or ‘speculate’ sizable IP resource blocks of size. The exception would address approximately 85% of 8.3 transfers, and thus be efficient for administration.

Policy proposal 2014-20 as described would permit new end users to obtain a /24 maximum assignment and new ISPs to obtain a new /21 maximum assignment without needs-based assessments. These proposed exceptions to needs based review, like similar but different provisions in 2014-14, do not provide a significant vehicle to ‘game’, ‘hoard’, or ‘speculate’ for IP resource blocks of significant size. Those aspect of 2014-20 raise no meaningful legal issue. However, the 2014-20 proposal does cause some legal concern in its treatment of large volume resource holders. It would permit an existing end user or ISP to “receive via transfer as much space as they currently hold in total without any need assessment, OR a 24-month supply based on their monthly utilization rate.” This exemption from the needs-based assessment provides a very significant exemption that benefits the largest resource holders the most, when that is not the articulated problem to be solved. Although both proposals are intended to solve a problem of access for new entrants and small entities, this aspect of the proposed language in policy 2014-20 has the unfortunate side effect of increasing inequality, as the largest resource holders in the ARIN region currently hold the majority of all number resources, and exempting them from the needs requirement up to the amount they already hold permits such entities the right to obtain large quantities of additional resources without any evaluation of needs.
(Rather than creating such a broad exemption that essentially reduces the needs-based requirement to a shadow, it would be more rational to remove the needs requirement altogether, if the community believes that is the appropriate case than approving this broad exemption proposal. Counsel takes no position on the need to either retain or repeal the needs based requirement, as this issue is not before us in this policy).

Resource Impact

This policy would have minimal resource impact from an implementation aspect. It is estimated that implementation would occur within 3 months after ratification by the ARIN Board of Trustees. The following would be needed in order to implement:
· Updated guidelines and internal procedures
· Staff training

Proposal/Draft Policy Text Assessed
Draft Policy ARIN-2014-14
Removing Needs Test from Small IPv4 Transfers
Date: 16 May 2014
Problem Statement:
ARIN staff, faced with a surge in near-exhaust allocations and subsequent transfer requests and a requirement for team review of these, is spending scarce staff time on needs testing of small transfers. This proposal seeks to decrease overall ARIN processing time through elimination of that needs test.

Policy statement:
Change the language in NRPM 8.3 after Conditions on the recipient of the transfer: from “The recipient must demonstrate the need for up to a 24-month supply of IP address resources under current ARIN policies and sign an RSA.” to “For transfers larger than a /16 equivalent or for recipients who have completed a needs-free transfer in the prior year, the recipient must demonstrate the need for up to a 24-month supply of IP address resources under current ARIN policies and sign an RSA.”
Change the language in the third bullet point in NRPM 8.4 after Conditions on the recipient of the transfer: from “Recipients within the ARIN region must demonstrate the need for up to a 24-month supply of IPv4 address space.” to “For transfers larger than a /16 equivalent or for recipients who have completed a needs-free transfer in the prior year, recipients in the ARIN region must demonstrate the need for up to a 24-month supply of IP address resources under current ARIN policies and sign an RSA.”

Comments:
Needs testing has been maintained for transfers largely because the community wishes to ensure protection against hoarding and speculation in the IPv4 market. This proposal seeks a middle ground between the elimination of needs tests for transfers altogether, and the continuance of needs tests for every transfer. This should help ARIN staff to reduce transfer processing time, since most transfers have been smaller than /16.

Timetable for implementation: Immediate