Draft Policy ARIN-2019-2: Waiting List Block Size Restriction [Archived]

Status : Abandoned

Staff and Legal Review: 29 April 2019

Advisory Council Shepherds : Alison Wood, Andrew Dul

Join the Public Policy Mailing List

History:

• Proposal - ARIN-prop-261 - 8 February 2019
• Draft Policy - 26 February 2019
• Abandoned - 25 June 2019

ARIN Advisory Council Meetings:

• 25 January 2019
• 21 February 2019
• 21 March 2019
• 10 April 2019
• 16 May 2019
• 20 June 2019

Presented at:

• ARIN 43

Latest Version: 26 February 2019

Problem Statement:

A substantial amount of misuse of the waiting list is suspected by ARIN staff. A significant percentage of organizations that receive blocks from the waiting list subsequently issue these blocks to other organizations via 8.3 or 8.4 transfers shortly after the one year waiting period required before engaging in such outbound transfers. Most of these cases involve larger-sized blocks, and many involve organizations that already have large IPv4 holdings. Some organizations engage in this practice multiple times, rejoining the waiting list shortly after transferring out blocks previously received on the waiting list. There are even cases of multiple startup organizations requesting approval to be placed on the waiting list where these organizations’ requests can all be tracked originating from the same IP address. While it is possible that some of these cases are legitimate, and while it is difficult for ARIN to prove fraud in most individual cases, the large number of cases like these indicates a high likelihood that there is significant misuse of the waiting list. Specifically, some organizations are likely being dishonest in projecting their need for IPv4 space with the intent of receiving blocks off the waiting list so that they can sell them one year after receiving them. In the case of multiple startups, some organizations that receive blocks on the waiting list subsequently perform a 8.2 merger/acquisition, allowing them to sell the blocks even before the one year waiting period.

The problem is serious enough that the ARIN Board of Trustees has suspended issuance of number resources while a solution to this problem is found, and it is unfair to organizations with legitimate need on the waiting list that they are being crowded out and delayed by those looking to game the system.

Policy Statement:

Actual Text:

4.1.8. Unmet requests

In the event that ARIN does not have a contiguous block of addresses of sufficient size to fulfill a qualified request, ARIN will provide the requesting organization with the option to specify the smallest block size they’d be willing to accept, equal to or larger than the applicable minimum size specified elsewhere in ARIN policy. If such a smaller block is available, ARIN will fulfill the request with the largest single block available that fulfills the request. If no such block is available, the organization will be provided the option to be placed on a waiting list of pre-qualified recipients, listing both the block size qualified for and the smallest block size acceptable.

New Text:

4.1.8. Unmet requests

In the event that ARIN does not have a contiguous block of addresses of sufficient size to fulfill a qualified request, ARIN will provide the requesting organization with the option to specify the smallest block size they’d be willing to accept, equal to or larger than the applicable minimum size specified elsewhere in ARIN policy. If such a smaller block is available, ARIN will fulfill the request with the largest single block available that fulfills the request. If no such block is available, the organization will be provided the option to be placed on a waiting list of pre-qualified recipients, listing both the block size qualified for or a /22, whichever is smaller, and the smallest block size acceptable, not to exceed a /22.

Comments:

Timeframe for Implementation: Immediate

Anything Else: By limiting the maximum block size for waiting list recipients to a /22, the financial incentive to misuse the waiting list to receive blocks with the intent to sell them will be drastically reduced. The majority of waiting list requests are for smaller block sizes, and these requests will be more readily met as the abusers will no longer be crowding out the legitimate organizations with need. The original intent of the waiting list to help smaller organizations and new entrants will be realized. RIPE, APNIC and LACNIC do not have waiting lists, but they each have an emergency pool geared toward new recipients with a /22 limit which has largely curtailed abuse. Organizations that genuinely qualify for larger blocks can still obtain these in the marketplace through 8.3 transfers.

##########

ARIN STAFF & LEGAL ASSESSMENT

Summary (Staff Understanding)

Draft Policy 2019-02: Waiting List Block Size Restriction places a restriction of /22 on the maximum size IPv4 address block that can be obtained through distribution from the ARIN waitlist. RSD interprets this to mean that the maximum block size an organization can receive from the ARIN waitlist is a /22 even if they qualify for a larger block. Organizations qualifying for a /22 or larger will still have the option to select a minimum size block of /23 or /24. Organizations qualifying for a /23 will be allowed to select a /23 as their maximum and a /24 as their minimum and if an organization qualifies for a /24 maximum a /24 will also be their minimum.

Comments

ARIN Staff Comments

• Draft Policy 2019-02: Waiting List Block Size Restriction could be more precise in its wording to ensure that staff’s understanding is correct. If staff’s understanding is correct then the Advisory Council should consider rewriting the first paragraph of 4.1.8 to be very clear and concise that the maximum size block that can be distributed from the waitlist is a /22 and that the qualifying organization can select the minimum size they are willing to accept subject to ARIN’s minimum size specified in policy. The way it is currently proposed is ambiguous and lends itself to be misinterpreted by the community. It should also be noted that it is unclear if paragraph 2 of 4.1.8 is meant to be retained or deleted.

• In order to avoid confusion it is recommended that the policy contain words to describe how ARIN staff should handle organizations currently on the waitlist. Will this new policy be retroactive to all requests, to requests from a certain date forward or only requests approved after the new policy is implemented. Without any guidance in the policy ARIN staff would apply all aspects of the new policy language to all future distributions from the waitlist, even to those already on the waitlist.

• Restriction of the maximum size block an organization can receive from the waitlist will increase the number of organizations able obtain resources from the ARIN waitlist; however, it will limit the number of IPv4 addresses a single organization can receive at a given time.

• It is suggested that the problem statement be reworded to avoid inflammatory remarks.

• This policy could be implemented as written but it should be reworked to avoid confusion and provide clarity as suggested above.

ARIN General Counsel – Legal Assessment

The proposal requires legal analysis. Counsel strongly supports any policy that will reduce and limit the size of the block issued from the waiting list. That is the core of this policy‘s language. It is likely adoption of such a limit will reduce but not do away with fraudulent applications, such as those being made under the pre–suspension policy which allowed for allocation of larger number resource blocks. However, the proposal as drafted has language that is potentially confusing. It could create the mistaken impression that larger blocks must still be issued. A policy that simply states that no applicant can obtain a direct distribution from ARIN larger than a set prefix size [/22 or /24] is preferable.

Resource Impact

Implementation of this policy would have a moderate resource impact. It is estimated that this policy could be implemented 90 days after ratification by the ARIN Board of Trustees.

• RSD will need to update guidelines and internal procedures
• CMSD will need to update documentation on website, all associated printed materials and published reference materials
• Moderate engineering effort to update algorithms used in managing the waitlist (especially testing) and update ticket workflow in ARIN Online.

Proposal/Draft Policy Text Assessed

Latest Version: 26 February 2019

Problem Statement:

A substantial amount of misuse of the waiting list is suspected by ARIN staff. A significant percentage of organizations that receive blocks from the waiting list subsequently issue these blocks to other organizations via 8.3 or 8.4 transfers shortly after the one year waiting period required before engaging in such outbound transfers. Most of these cases involve larger-sized blocks, and many involve organizations that already have large IPv4 holdings. Some organizations engage in this practice multiple times, rejoining the waiting list shortly after transferring out blocks previously received on the waiting list. There are even cases of multiple startup organizations requesting approval to be placed on the waiting list where these organizations’ requests can all be tracked originating from the same IP address. While it is possible that some of these cases are legitimate, and while it is difficult for ARIN to prove fraud in most individual cases, the large number of cases like these indicates a high likelihood that there is significant misuse of the waiting list. Specifically, some organizations are likely being dishonest in projecting their need for IPv4 space with the intent of receiving blocks off the waiting list so that they can sell them one year after receiving them. In the case of multiple startups, some organizations that receive blocks on the waiting list subsequently perform a 8.2 merger/acquisition, allowing them to sell the blocks even before the one year waiting period.

The problem is serious enough that the ARIN Board of Trustees has suspended issuance of number resources while a solution to this problem is found, and it is unfair to organizations with legitimate need on the waiting list that they are being crowded out and delayed by those looking to game the system.

Policy Statement:

Actual Text:

4.1.8. Unmet requests

In the event that ARIN does not have a contiguous block of addresses of sufficient size to fulfill a qualified request, ARIN will provide the requesting organization with the option to specify the smallest block size they’d be willing to accept, equal to or larger than the applicable minimum size specified elsewhere in ARIN policy. If such a smaller block is available, ARIN will fulfill the request with the largest single block available that fulfills the request. If no such block is available, the organization will be provided the option to be placed on a waiting list of pre-qualified recipients, listing both the block size qualified for and the smallest block size acceptable.

New Text:

4.1.8. Unmet requests

In the event that ARIN does not have a contiguous block of addresses of sufficient size to fulfill a qualified request, ARIN will provide the requesting organization with the option to specify the smallest block size they’d be willing to accept, equal to or larger than the applicable minimum size specified elsewhere in ARIN policy. If such a smaller block is available, ARIN will fulfill the request with the largest single block available that fulfills the request. If no such block is available, the organization will be provided the option to be placed on a waiting list of pre-qualified recipients, listing both the block size qualified for or a /22, whichever is smaller, and the smallest block size acceptable, not to exceed a /22.

Comments:

Timeframe for Implementation: Immediate

Anything Else: By limiting the maximum block size for waiting list recipients to a /22, the financial incentive to misuse the waiting list to receive blocks with the intent to sell them will be drastically reduced. The majority of waiting list requests are for smaller block sizes, and these requests will be more readily met as the abusers will no longer be crowding out the legitimate organizations with need. The original intent of the waiting list to help smaller organizations and new entrants will be realized. RIPE, APNIC and LACNIC do not have waiting lists, but they each have an emergency pool geared toward new recipients with a /22 limit which has largely curtailed abuse. Organizations that genuinely qualify for larger blocks can still obtain these in the marketplace through 8.3 transfers.