2014-1 Previous Version [Archived]

OUT OF DATE?

Here in the Vault, information is published in its final form and then not changed or updated. As a result, some content, specifically links to other pages and other references, may be out-of-date or no longer available.

View the current policy proposal text.

The following version was archived on 21 October 2014.

Draft Policy ARIN-2014-1
Out of Region Use

Date: 2 Aug 2014

Problem statement:

Current policy neither clearly forbids nor clearly permits out or region use of ARIN registered resources. This has created confusion and controversy within the ARIN community for some time. Earlier work on this issue has explored several options to restrict or otherwise limit out of region use. None of these options have gained consensus within the community. The next logical option is to discuss a proposal that clearly permits out of region use without limits, beyond those already existing in policy.

Permitting out of region use, however, poses issues that have to be addressed by policy and adjustments to operational practice. Out of region use needs a clear definition and any operational practices based on that definition must not be unnecessarily burdensome. It is significantly more difficult and costly for ARIN Staff to independently verify the justification and utilization of resources that are reassigned or otherwise used outside of the ARIN service region. There needs to be recognition of this difference in policy and associated operational practices, especially the cost differential when there is more than an incidental amount of out of region use.

Policy statement:

Create new Section X:

ARIN registered resources may be used outside the ARIN service region and such use is valid justification for new or additional resources. A resource is considered to be used outside the region if it exclusively serves a user, customer or technical ≠infrastructure location outside the ARIN service region.

The services and facilities used to justify the need for ARIN resources that will be used out of region should not also be used to justify resource requests from another RIR. When a request for resources from ARIN is justified by need located within another RIR’s service region and is more than the equivalent of a /22 for IPv4, a /36 for IPv6, or two (2) ASNs, the requesting organization will also report to ARIN the utilization status of all resources of the same type held with any other RIR that are used or are available for use within the requested service region. The organization will also supply any additional supporting documentation requested by ARIN regarding the need for the reported resources. The report must demonstrate that all resources currently available for use within the requested service region are efficiently utilized based on applicable ARIN policy.

Draft Policy ARIN-2014-1: Out of Region Use

ARIN STAFF ASSESSMENT

Date of Assessment: 5 September 2014

Summary (Staff Understanding)

Staff Understanding:

This policy would allow ARIN to issue space in response to a request for number resources to be used out of region, provided that the organization does not use (or has not used) the same justification to obtain resources from another RIR and that all resources used or available for use in that region (whether issued by ARIN or another RIR) meet applicable ARIN policy requirements.

Specifically:

Organizations may request number resources from ARIN for use outside of the ARIN region. Organizations cannot use the same justification/need to request resources from more than 1 RIR.
Organizations must report utilization of all same-type resources when requesting address space greater than an IPv4 /22, IPv6 /36 and/or 2 ASNs for out of region use.
When requesting number resources from ARIN for out of region use greater than the thresholds above, organizations will report utilization of number resources are presently in use in that region or underutilized and hence available for use in that region, even if registered in another region.
Utilization must meet current ARIN number policy, even for resources used in another region.

Comments

A. ARIN Staff Comments

The policy text states “a resource is considered to be used outside the region if it exclusively serves a user, customer, or technical infrastructure located outside the ARIN service region”. It’s unclear whether a “resource” is defined as an entire registration (e.g. a /16 used solely outside the ARIN region) or a portion of a registration (e.g. a /20 from a /16 used solely outside the ARIN region). Without further clarification, ARIN would consider a contiguous portion of a resource exclusively serving entities outside the ARIN region to be “outside the region”

Staff would implement the policy as follows:
Staff would continue to require that all organizations requesting space from ARIN would need to have a legal presence within the ARIN region.
Staff would require that all documentation and correspondence be done in English.
Absent clarification, staff would implement this policy with the assumption that it applies to any portion of a registration used exclusively outside the ARIN region. As an example, if a /20 is requested based on justified need for a /21 to be used at an Amsterdam PoP and a /21 to be used at an Ashburn PoP, it would be considered a /21 used outside the ARIN region.
Organizations will be asked to identify in which region(s) the requested resources will be used.
The organization’s eligibility would be evaluated based on use of their ARIN-region space, their use of same-type resources registered with the RIR in which the resources are being requested, and their use of same-type resources used or available for use within that region that are registered with any other RIR.
If the organization will be using more than a /22 of IPv4, a /36 of IPv6, or two AS numbers outside the ARIN region, ARIN will ask the organization to provide a list of all same-type resources in currently in use within those regions (including space from all RIRs) or available for use, and corresponding utilization data for those resources with the same level of detail as would be requested for in-region usage.
This policy adds a new requirement that staff review utilization outside of the ARIN region, which will likely require more time and effort on the part of the analyst, and could delay the review and processing of requests of this type as well as other request types that ARIN currently handles.
Per NRPM 8.3, this policy could be used to justify receipt of a transfer from another address block holder, if the recipient intended to use the resulting block out of region.
It is not clear how ARIN can deter organizations from justifying additional resources from another RIR based on the same need recently used for receipt of resources from ARIN.
The policy states “When a request for resources from ARIN is justified by need located within another RIR’s service region and is more than the equivalent of a /22 for IPv4, a /36 for IPv6, or two (2) ASNs, the requesting organization will also report to ARIN the utilization status of all resources of the same type held with any other RIR that are used or are available for use within the requested service region.” Since number resources obtained from any RIR “are available for use” globally, ARIN will ask for utilization status for all underutilized number resources held by the requesting organization from all RIRs. If this is not the intent, the policy language should be clarified as appropriate.
A new section would be added to NRPM, 2.17 Out of Region Use

B. ARIN General Counsel - Legal Assessment

Counsel has significant and material legal concerns about this policy. Counsel recognizes and supports the issuance of resources to entities in the ARIN region that need number resources that will be used in both this region and in the remainder of the world. ARIN currently issues resources for these needs based on a needs based allocation methodology.

However, this proposed policy removes the requirement that there be any meaningful need for those resources in the ARIN service region, and allows all of the need to be outside the ARIN service region. This creates new legal challenges for ARIN which are identified below:

First, ARIN is governed by ICANN ICP-2, which calls for establishment of a single RIR to serve each region. It further notes that multiple RIRs serving in single region is likely to lead to difficulty for co-ordination and co-operation between the RIRs as well as confusion for the community within the region. The implication of that governance structure is that each RIR can and should serve its service region. This policy would allow entities with no real connection to the ARIN’s service region to obtain, for example, increasingly scarce IPv4 resources from ARIN and related registry services. This policy would result in ARIN effectively providing registry services to other regions, and thus appears on its face to be inconsistent with ICP-2. ARIN has obligations to follow the global policy in ICP2, or seek changes in it.

Second, if the policy were adopted, ARIN could arguably become subject to the jurisdiction and laws passed by governments outside our service region. This may lead to ARIN being a litigant in courts of nations outside its service region and subject to their requirements and judgments. ARIN will need to accept greater legal expenditures and risks, as well as potentially larger costs in order to take this greater scope into consideration in ARIN’s registry activities on an ongoing basis.

Third, the policy fails to recognize that ARIN is not likely to able to perform the function contemplated in the policy with certain countries, and related public or private entities. See as examples under US law: Cuba, Iran and North Korea. The policy could benefit from a specific carve out that ARIN may meet its obligations under the laws of governments in its service region, even if such requests would otherwise comply with ARIN policy. For those who assert that this requirement to conform to law is implicit and does not need to be stated in policy, it is important the community is under notice of this limit. This issue has not been an issue for ARIN prior to this proposed policy.

Fourth, ARIN may be subject to significantly greater political oversight by national governments in its service region that will wish to evaluate why ARIN alone of the 5 RIR’s is assuming a duty to service all of the world’s community. It may be argued by governments in ARIN’s region that this is a potential breach of ARIN’s fiduciary obligations to its own region, and to examine whether it is consistent with ARIN’s non-profit status and other corporate documents.

Resource Impact

This policy would have significant resource impact from an implementation aspect. It is estimated that implementation would occur within 5 months after ratification by the ARIN Board of Trustees. The following would be needed in order to implement:

· Updated guidelines and internal procedures

· Staff training

· Engineering efforts to handle out of region business rules may be substantial.

Proposal/Draft Policy Text Assessed

Draft Policy ARIN-2014-1 Out of Region Use

Date: 2 Aug 2014

Problem statement:

Policy statement:

Create new Section X:

old version

Draft Policy ARIN-2014-1
Out of Region Use

Date: 28 March 2014

Problem statement:

Policy statement:

Create new Section X;

X. Out of Region Use

ARIN registered resources may be used outside the ARIN service region and such use is valid justification for new or additional resources. Resources are considered to be used outside the region if the user or customer service address or the technical infrastructure address, such as the point of presence (POP), data center, or other similar location, are outside the ARIN service region.

There is a general presumption that requesting resources from ARIN for use within another RIR’s service region duplicates any resources held by the organization with that other RIR. Therefore, the organization should, not hold any resources with the other RIR, or demonstrate that all such resources held are utilized based on ARIN policy requirements, or provide an operational justification clarifying how the resources from ARIN will not duplicate any underutilized resources held with the other RIR.

Only the utilization rate of ARIN registered resources or immediate need may be use to determine a valid request size beyond the applicable minimum allocation size. The utilization rate of resources received from another RIR is not applicable in determining a valid request size.

X.1 Verification of Out of Region Use

The utilization of all ARIN registered resources must be verified when evaluating a request for additional resources or during a resource review, including any resources used outside the ARIN service region. All ARIN registered resources used outside the region must be verified to no less than an equivalent standard as resources used within the ARIN region. To this end ARIN, in its sole discretion, may engage independent external entities to assist it in the verification of information related to any resources used outside the region.

X.2 Reporting Resources Held with other RIRs

Except to the extent that incidental use, multi-instance use, or the critical infrastructure criteria described below apply, when out of region need is used to justify a request for resources from ARIN; The requesting organization will also report to ARIN the utilization status, based on applicable ARIN policy, of all resources it holds with the RIRs who’s service regions the need justifying a request to ARIN is within, and any additional supporting documentation requested by ARIN regarding these reported resource.

X.3 Incidental Use

Out of region use of ARIN registered resources by an organization that totals less than an equivalent of a /20 of IPv4, a /36 of IPv6, and two (2) ASNs within each of the other RIR’s service regions are considered incidental use and as such are accounted for as if used within the ARIN service region.

X.4 Multi-Instance Use

Any resources used simultaneously in multiple locations, such as an anycast prefix or ASN, are considered as used within the ARIN service region, provided at least one instance is located within the region, regardless of how many other instances are located outside the region.

X.5 Critical Infrastructure

Resources justified through ARIN critical infrastructure policies are accounted for as if used within the ARIN service region, regardless of their actual location of use.

Comments:

a. Timetable for implementation: Immediate

b. Anything else

Current policy is ambiguous on the issue of out of region use of ARIN registered resources. The only guidance on the issue in current policy is in Section 2.2, that defines the term RIR; “… The primary role of RIRs is to manage and distribute public Internet address space within their respective regions.” Some in the community believe this means out of region use should be at least limited or restricted while others believe this is only intended to focus efforts within the region and not define where resources may be used.

Several other policy proposals have explored restricting or otherwise limiting out of region use. None of these proposals gained consensus within the ARIN community. During the latest of these proposals, ARIN-2013-6, several standards were explored, a majority of use within region, a plurality of use within region, and some discussion of a minimum of 20 percent use within region. It was felt that each of these standards would interfered, to one extent or another, with the legitimate operations of multi- or trans-regional networks.

Section 2.2 tells us, the primary purpose of the RIRs are to manage and distribute resources within their regions. None the less, there have always been networks that don’t neatly fit within the regions created by the RIR system. These legitimate trans-regional networks are operated by international businesses or global service providers, many of which are based within the ARIN region. Prior to IPv4 run-out, many of these trans-regional networks requested resources from ARIN for use both inside or outside the region, as long as the requests were justified by need.

As a result of IPv4 run-out, many in the community want to restrict out of region use to prevent ARIN resources from going to networks without a real technical presence in the ARIN region. However, any attempt to limit or restrict such out of region use inevitably will affect these legitimate trans-regional networks. Further, even the most restrictive regional use requirements will not significantly prolong the availability of IPv4 resources within the ARIN region. Therefore, attempting to restrict or limit out of region use of resources, even if it were for IPv4 only, is ineffective, inefficient, and overly burdensome to important elements of the global Internet.

The major concept behind this proposal is to allow out of region use without any limits, other than those already in policy, but bring an economic and reporting factors to play on the issue. It requires ARIN to verify out of region use of ARIN registered resources to no less than an equivalent standard as in region use, and enables ARIN to engage external entities to assist in this verification. It is expected ARIN will have agreements with all such external entities to ensure the confidentiality of all supporting documentation is preserved.

ARIN engaging external entities to assist in verification of out of region use is mostly an ARIN business issue, and not primarily a policy issue. However, today there is a general assumption that such verification for in region use is done almost exclusively in house at ARIN. Making this issue clear in policy follows a principle of least surprise, as the use of such external entities is likely to be frequently necessary to verify out of region use, especially in parts of the world where English is not the primary language. Or put another way, use of an external entity when verifying out of region use is more likely to be the rule rather than an exception.

When resources are requested for out of region use an organization also needs to report the utilization status of all resources it holds with the RIRs for the regions that the requested need is within. This is to ensure there are not underutilized resources held with another RIR that would contradict the justified need for resources from ARIN.

In addition, evaluating the reported information about resources held with other RIRs, needed to ensure ARIN resources are not duplicating resources held with outer RIRs, increase staff’s burden related to out of region use. Furthermore, section 2.2 is clear that providing resources for out of region use is, at best, only a secondary role for ARIN. As a result, out of region use should not significantly burden the primary role of providing resources for use within the region. These factors justify a recommendation to the Board of Trusties to create a separate fee structure for out of region use, creating the aforementioned economic factor.

This economic factor and the recommendation for a separate fee structure, are again mostly ARIN business issues, and not part of policy in general. However, this is one of those instances where policies and fees are intertwined.

It seems reasonable that this economic factor should be applied only to those that make substantial use of ARIN registered resources outside the region, and not to those that primarily use resources within the region. This proposal defines incidental out of region use, to ensure that trivial, insignificant or otherwise incidental use are exempt from the discussed economic factor, the reporting of resources help with other RIRs as well, and are accounted for as if used within the region.

Some amount of out of region use should be considered normal even for a network primarily based within the ARIN region. For example, numbering a global backbone that provides global access necessary for in region customers. Also, the other RIRs have minimum requirements to justify an initial allocation or assignment, similar to ARIN. These and other examples and issues, justify allowing some minimal amount of out of region use to be accounted for as if it were in region use. The currently proposed policy statement, X.3, defines incidental use in terms of an absolute thresholds for each type of resource.

Another option would be a percentage based threshold, say 20%. However, a percentage based threshold has the disadvantage that even a minimal change in usage can cause the ratio between in region and out of region use to change, potentially causing an oscillation around this threshold. This creates significant uncertainty for organizations as to if the discussed economic factor will apply to them, or not. Where as once an absolute threshold has been crossed by a significant amount, it is highly unlikely that any additional changes in usage will cause an oscillation around the threshold, providing much more certainty for most organizations.

Additionally, the proposal deals with a couple special cases in X.4 and X.5. Due to the relatively small resource impact and high importance to overall Internet stability; resources for critical infrastructure are accounted for as if used within the region. Anycast prefixes, and other resources used simultaneously in multiple locations, are considered as used outside the region only when they are exclusively used outside the region. Or put another way, as long as at least one instance is located within the region, they are considered used within the region, regardless of how many other instances are located outside the region. Both of these special cases have an overall positive impact on the Internet and should not be discouraged in anyway by this policy, lumping them in with general out of region use could be a disservice to the Internet and unnecessarily burdensome.

The intent of allowing an operational justification to clarify how resources received from ARIN will not duplicate any underutilized resources held with another RIR is to account for situations like; It may be necessary to use resources from another RIR to meet legal or regulatory requirements, or prevailing operational expectations, in some economies around the world. In such cases it is justified to also receive minimal resources from another RIR for use only in those economies. And using resources received from ARIN for the rest of a global network.

In summary, this proposal ensures that global organizations or global service providers base within the ARIN region may receive resources to operate their global network solely from ARIN, if they wish to do so. As long as the utilization of the out of region resources are verified to no less than an equivalent standard as in region resources and any additional reporting requirements are also meet. This is particularly important for IPv6; requiring organizations get IPv6 resources from multiple RIRs, or even making it appear that they should, will result in additional unique non-aggregatable prefixes within the IPv6 route table, rather than minimizing them, which one of the policy objectives for IPv6.

Finally, a separate but somewhat related issue; regardless of where ARIN registered resources are used, inside or outside of the ARIN service region, organizations must first qualify to receive resources from ARIN. ARIN’s current operational practice is that an organization must be formed within the ARIN service region in order to qualify to receive any resources from ARIN. The issue of who should be eligible to receive resources was commingled with out of region use in ARIN-2013-6. It was felt these issues should be considered separately. Therefore, the issue of who should be eligible to receive resources is purposefully not dealt with by this proposal, and if any changes are necessary there should be separate policy proposals to deal with this issue independently.

Summary of Changes;

Clarified out of region use is valid justification for both new or additional resources.
Eliminated “user or customer billing address” from definition for out of region use, and change the items left to sentence from, instead of list form.
Added that there is a general presumption that requesting resources from ARIN for use within another RIR’s service region duplicates any resources held by the organization with that other RIR.
Made it clear that only the utilization rate of ARIN resources or immediate need are used to determine the valid request size.
New sections X.2 “Reporting Resources Held with other RIRs,” this new section is intended to have organizations report the utilization of their resources, based on ARIN Policy, for the other RIRs where they are requesting ARIN resources for. Except to the extent incidental use, multi-instance use, or critical infrastructure clauses apply.
Changed incidental use to be on a per other RIR region basis to simplify the determination of if the Reporting Resources Held with other RIRs applies.
Changed multi-instance use to use “at least one instance is located within the region” language.
Updated the comments section to account for the above changes.

Here is an annotated version of the policy text

Deleted Text

New Text

Retained Text

X. Out of Region Use

ARIN registered resources may be used outside the ARIN service region and such use is valid justification for new or additional resources. Resources are considered to be used outside the region if any of the following are located outside the region. A. The user or customer billing address B. the user or customer service address or C. the technical infrastructure address, such as the point of presence (POP), data center, or other similar location, are outside the ARIN service region.

X.1 Verification of Out of Region Use

X.2 Reporting Resources Held with other RIRs

X.23 Incidental Use

Out of region use of ARIN registered resources by an organization that totals less than an equivalent of a /20 of IPv4, a /36 of IPv6, and two (2) 10 ASNs within each of the other RIR’s service regions are considered incidental use and as such are accounted for as if used within the ARIN service region.

X.4 Multi-Instance Use

Any resources used simultaneously in multiple locations, such as an anycast prefix or ASN, are accounted for as used outside the region, only if they are exclusively used outside the region.considered as used within the ARIN service region, provided at least one instance is located within the region, regardless of how many other instances are located outside the region.

X.35 Critical Infrastructure

Resources justified through ARIN critical infrastructure policies are accounted for as if used within the ARIN service region, regardless of their actual location of use.

The following version was archived on 28 March 2014.

Draft Policy ARIN-2014-1
Out of Region Use

Date: 29 January 2014

Problem statement:

Current policy neither clearly forbids nor clearly permits out of region use of ARIN registered resources. This has created confusion and controversy within the ARIN community for some time. Earlier work on this issue has explored several options to restrict or otherwise limit out of region use. None of these options have gained consensus within the community. The next logical option is to discuss a proposal that clearly permits out of region use without limits, beyond those already existing in policy.

Policy statement:

Create new Section X;

X. Out of Region Use

ARIN registered resources may be used outside the ARIN service region and such use is valid justification for additional resources. Resources are considered to be used outside the region if any of the following are located outside the region.

A. The user or customer billing address
B. The user or customer service address
C. The technical infrastructure address, such as the point of presence (POP), data center, or other similar location

X.1 Verification of Out of Region Use

The utilization of ARIN registered resources must be verified when evaluating a request for additional resources or during a resource review, including any resources used outside the ARIN service region. Resources used outside the region must be verified to no less than an equivalent standard as resources used within the region. To this end ARIN, in its sole discretion, may engage independent external entities to assist it in the verification of information related to any resources used outside the region.

X.2 Incidental Use

Out of region use of ARIN registered resources by an organization that totals less than an equivalent of a /20 of IPv4, a /36 of IPv6, and 10 ASNs are considered incidental use and as such are accounted for as if used within the ARIN service region.

X.3 Critical Infrastructure

Resources justified through critical infrastructure policies are accounted for as if used within the ARIN service region, regardless of their actual location of use.

X.4 Multi-Instance Use

Any resources used simultaneously in multiple locations, such as an anycast prefix or ASN, are accounted for as used outside the region, only if they are exclusively used outside the region.

Comments:
a. Timetable for implementation: Immediate

b. Anything else

Section 2.2 tells us, the primary purpose of the RIRs are to manage and distribute resources within their regions. None the less, there have always been networks that don’t neatly fit within the regions created by the RIR system. These legitimate trans-regional networks are operated by international businesses or global service providers, many of which are based within the ARIN region. Prior to IPv4 run-out, these trans-regional networks requested resources from ARIN for use both inside or outside the region, as long as the requests were justified by need.

The major concept behind this proposal is to allow out of region use without any limits, other than those already in policy, but bring an economic factor to play on the issue. It requires ARIN to verify out of region use to no less than an equivalent standard as in region use, and enables ARIN to engage external entities to assist in this verification. It is expected ARIN will have agreements with all such external entities to ensure the confidentiality of all supporting documentation is preserved.

There are additional expenses and complexity involved in verifying out of region use, as a result of language and logistical barriers that the regionality of the RIR system was originally conceived to mitigate. In addition, section 2.2 is clear that providing resources for out of region use is, at best, only a secondary role for ARIN. As a result, out of region use should not significantly burden the primary role of providing resources for use within the region. These factors justify a recommendation to the Board of Trusties to create a separate fee structure for out of region use, creating the aforementioned economic factor.

It seems reasonable that this economic factor should be applied only to those that make substantial use of ARIN registered resources outside the region, and not to those that primarily use resources within the region. This proposal defines incidental out of region use, to ensure that trivial, insignificant or otherwise incidental use are exempt from the discussed economic factor, and are accounted for as if used within the region.

Some amount of out of region use should be considered normal even for a network primarily based within the ARIN region. For example, numbering a global backbone that provides global access necessary for in region customers. Also, the other RIRs have minimum requirements to justify an initial allocation or assignment, similar to ARIN. These and other examples and issues, justify allowing some minimal amount of out of region use to be accounted for as if it were in region use. The currently proposed policy statement, X.2, defines incidental use in terms of an absolute thresholds for each type of resource.

Additionally, the proposal deals with a couple special cases in X.3 and X.4. Due to the relatively small resource impact and high importance to overall Internet stability; resources for critical infrastructure are also exempt from the discussed economic factors, and are accounted for as if used within the region. Anycast prefixes, and other resources used simultaneously in multiple locations, are considered as used outside the region only when they are exclusively used outside the region. Or put another way, as long as at least one instance is located within the region, they are considered used within the region, regardless of how many other instances are located outside the region. Both of these special cases have an overall positive impact on the Internet and should not be discouraged in anyway by this policy, lumping them in with general out of region use could be a disservice to the Internet and unnecessarily burdensome.

In summary, this proposal ensures that global organizations or global service providers base within the ARIN region may receive resources to operate their global network solely from ARIN, if they wish to do so. As long as the utilization of the out of region resources are verified to no less than an equivalent standard as in region resources. This is particularly important for IPv6; requiring organizations get IPv6 resources from multiple RIRs, or even making it appear that they should, will result in additional unique non-aggregatable prefixes within the IPv6 route table, rather than minimizing them, which one of the policy objectives for IPv6.