ARIN's registry and transfer policies can help bridge the gap from IPv4 to IPv6

But the market must provide for greater trading transparency and security

ARINs registry and transfer policies can help bridge the gap from IPv4 to IPv6
Credit: ARIN

The American Registry for Internet Numbers (ARIN) is, for all practical purposes, out of numbers. Until IPv6 displaces IPv4 as the dominant protocol over the coming decade, IP network operators will have to depend on the IPv4 market to obtain their IP addresses.

For the market to handle the expected trading volume and more firmly establish itself as an effective means of globally re-distributing unused IP numbers, it must provide for greater trading transparency and security. ARIN and its registry are central to both. A more accurate registry would reliably establish the rightful holders of IP address blocks, allowing buyers to act more confidently, drive out registry scamming, and reduce the time and effort necessary to set aside unmarketable blocks.

Regarding registry accuracy, buyers of IP number blocks rely on ARIN’s registry to confirm the legitimacy of the seller. Sellers and their advisors look to the registry to help assess the marketability of the address space they plan to sell. However, the registry contains missing and outdated information. Many address blocks are registered to entities that no longer exist because they have been merged into, or acquired by, other organizations, but the successor organizations have not updated their registration records.

Other blocks are truly abandoned -- with no surviving entity around to claim them. To compound the problem, some registrants enter into arrangements that either temporarily or permanently give a third party the right to use their numbers without submitting to ARIN’s transfer processes, resulting in registry records that mask the identity of the organization that actually controls the numbers.

Millions of IPv4 numbers are impacted by these faulty records. As a consequence, ARIN’s registry cannot, in many cases, be relied upon as the definitive single source for establishing the rightful holders of IPv4 address space.

Targeted changes in ARIN’s policies would promote greater registry accuracy by reducing incentives for entities holding IP numbers to circumvent or avoid ARIN’s registry. A more accurate registry would not only enable the market to effectively and efficiently move IPv4 numbers into the hands of those organizations most in need, it would also provide better data for network operators, law enforcement, researchers and others who depend on ARIN’s registry records to identify the real parties in control of specific IP address space.

Here is what is needed:

* Simplifying merger and acquisitions transfers: To update the registry to reflect a change in control of a block arising from a corporate merger or acquisition, the acquiring entity must show ARIN the acquirer obtained the network or IT assets used by the original registrant in accordance with ARIN’s policies (ARIN does not recognize IPv4 numbers as assets that can be separately bought and sold). ARIN then assesses all of the acquiring entity’s IPv4 number blocks to determine whether its combined number holdings post- acquisition are “justified” under ARIN policies. If not, then ARIN “will work with the resource holder(s) as needed to return or transfer resources as needed to restore compliance . . . .”

If ARIN grants approval, the acquiring entity must sign ARIN’s Registration Service Agreement (RSA) before ARIN will update the registry records. The RSA is a non-negotiable contract that favors ARIN. Because the RSA contractually deprives the registrant of rights that it otherwise may have under applicable law (e.g., registrants must waive all property interests in their IP numbers) and grants ARIN rights to revoke the registered numbers, entering into the RSA is particularly problematic for holders of “legacy” numbers (i.e., those numbers acquired prior to the formation of ARIN in 1997) who are not subject to an existing contract with ARIN.

For entities deciding whether to record their M&A activities in the registry, the risks of doing so outweigh the benefits. ARIN would substantially shift this calculus and promote greater registry accuracy by modifying its merger and acquisition policy to (a) eliminate any needs assessment, and (b) replace the RSA requirement with a clear expectation that the rights and remedies that applied to the original registrant will continue to apply to the successor entity.

* Discouraging Grey Market Transactions. ARIN’s registration transfer policies helped to enable the IPv4 market, but also created unintended adverse consequences as the market has expanded. When ARIN adopted its registration transfer policy in 2009, it adapted the same needs-based requirement ARIN applied to free pool allocations. Prior to IPv4 exhaustion, when it was possible to game the free pool and acquire additional address space in the market, there were good reasons to link the transfer policies to the principles governing free-pool allocations. Now that the free pool is depleted and the market is the only way to re-distribute IPv4 numbers, ARIN transfer policies should focus on the needs of the marketplace.

ARIN’s current transfer policies require the buyer to prove it will use the purchased address space within 24 months and that it is using all of its pre-existing IP address space efficiently. When a buyer fails to meet either of these two conditions, ARIN will either reject the transfer request or only register a portion of the IP address space actually purchased. Unless the agreement between the buyer and seller contemplated this outcome, a buyer can be left in limbo – without the ability to recoup the money it paid the seller or an effective means to secure its purchase and update the registry to show it now controls the entire purchased block.

To avoid this outcome, some market participants prefer to purchase IP numbers completely (or partially) outside of ARIN’s justified need scrutiny. Several workarounds are gathering steam, including leases or perpetual use rights assignments, and options that grant buyers the exclusive right or obligation to then register tranches of IP address space over time. In each case, the original registrant continues to appear listed in the registry for some or all of the conveyed address space even though the buyer is really in control.

Most buyers and sellers would, ideally, prefer to record their IPv4 trades in ARIN’s registry. It is the only public database that identifies organizations in control of the IP address space in North America. Eliminating needs justification as a pre-condition to recording market trades will bring many transactions out of the shadows.

Bigger questions raised

An accurate registry is central to maturing the transfer market, but more structural changes are also necessary. Today, ISPs and carriers enter into agreements to determine when to accept or reject route announcements. However, organizations that depend on upstream ISPs to carry their traffic have no clear path to stop conflicting IP address announcements.

As inter- and intra-regional trading volumes increase, the potential for conflicting announcements, and regionally distinct routing of the same IP address, will rise considerably. It also is likely that the escalating value of IPv4 numbers will stimulate legal disputes by parties competing for control over the same asset, or seeking to protect their assets against theft or other unauthorized use.

Currently there is no formal or centralized means for a purchaser of IPv4 numbers to enforce its exclusive rights over an IP number block. A globally accepted dispute resolution process created and administered by the Internet community through its existing governance institutions (such as ICANN) would protect a purchaser’s exclusive rights over an IP number block and provide greater security to market participants.

Without an Internet community-developed formal dispute process, the courts will increasingly be called upon to resolve conflicts. A conclusive judicial ruling or statute defining IP numbers as property under the law would allow parties to use the existing court system to navigate the commercial and legal controversies that are sure to arise. The question of whether IP addresses qualify as property is unsettled and thorny. However, ample common law precedent in the United States supports conferring property rights to IPv4 numbers.

The depletion of ARIN’s IPv4 free pool, along with the slow and steady pace of IPv6 adoption and the transfer market’s explosive growth, means that many Internet access, wireless service, cloud computing and content distribution network providersare already relying on the IPv4 trading market to secure the Internet number resources they need. Improved registry accuracy and a reliable dispute resolution framework will help the secondary market bridge the gap between IPv4 exhaustion and widespread IPv6 adoption.

Avenue4 specializes in brokering successful deals between sellers and buyers in the IPv4 marketplace by cultivating the transactions most likely to reach closure and structuring creative arrangements.

This story, "ARIN's registry and transfer policies can help bridge the gap from IPv4 to IPv6" was originally published by Network World.

Shop Tech Products at Amazon