ARIN IP6 policy for those with legacy IP4 Space

>> If we just eliminated the RIRs and agreements governing terms of acces=
s
>> to v6 allocations, IF later, we find a problem with the process and
>> start to run out of space, we end up in the same situation. Suddenly =
we
>> have to form these organizations again, and institute new allocation
>> policies for new allocations, but again lack any recourse for all thos=
e
>> people that "greedily" ate up as much space as they could.
>=20
> Then guard against _that_, which is a real problem.

That /is/ the RIRs' function now. ARIN policy is not immutable.
Proposals to change it are welcomed. I see no reason that we have to
throw ARIN out of this picture in order to solve your perceived problem
of too much regulation and overhead.

The problem, as I've heard it, is that ARIN's fees are steep in order to
pay for various costs. Since there isn't the economy of scale of hundreds
of millions of domain names, and instead you just have ... what? Probably
less than a hundred thousand objects that are revenue-generating? If you
charge $1/yr for each registered object, that means your organizational
budget is sufficient for one full time person, maybe two. At $100/yr, you
have enough funding for some office space, some gear, and a small staff.

So when you run into expensive stuff, like litigation, the best course of
action is to avoid it unless you absolutely can't.

Further, if you've suffered mission creep and are funding other things
such as IPv6 educational outreach, that's going to run up your costs as
well.

An established entity like ARIN typically has a very rough time going on
any sort of diet. Further, companies typically do not segregate their
"products" well: if IPv4 policy enforcement runs into legal wrangling
and lawsuits, ARIN as a whole gets sued, and it is tempting to spread
the resulting expenses over all their products. Segregation into two
(or more!) entities is a trivial way to fix that, though it also brings
about other challenges.

>> I think there's a continued need to keep an organization in charge of
>> accounting for the space to whom we as resource holders are accountabl=
e
>> and whom is also accountable to us. Later on, when we realize we've
>> gone wrong somewhere (and it will happen) and need to make changes to
>> policy, there is a process by which we can do it where all the parties=

>> involved already have an established relationship.
>=20
> That sets off my radar detector a bit. If you're justifying the need=20
> for current policies with that statement, I'd have to disagree... the
> desire to potentially make changes in the future is not itself a=20
> compelling reason to have strongly worded agreements. Even in v4land,
> we've actually determined that one of the few relatively serious=20
> reasons we'd like to reclaim space (depletion) is probably impractical.=

>=20
> With that in mind, claims that there needs to be thorough accounting
> kind of comes off like "trust us, we're in charge, we know what we need=

> but we can't really explain it aside from invoking the boogeyman."

ARIN doesn't so simply say "trust us, we're in charge." Every dealing
I've ever had with the organization has encouraged me to participate in
the policy making process in some regard. Ideally policy should
appropriately reflect how the regional users of IP resources feel things
should be managed and hand down terms for allocation to match.

The intention is for the accountability to go in both directions, from
resource holders to the RIR and from the RIR to the community. If you
don't think that's working for ARIN, I'm sure ARIN can be fixed.

I have my doubts, based on a ~decade of observation. I don't think ARIN
is deliberately evil, but I think there are some bits that'd be hard to
fix.

... JG

I have my doubts, based on a ~decade of observation. I don't think ARIN
is deliberately evil, but I think there are some bits that'd be hard to
fix.

I believe that anything at ARIN which the community at large and the membership
can come to consensus is broken will be relatively easy to fix.

Perhaps the true issue is that what you see as broken is perceived as "working
as intended" by much of the community and membership?

Owen

The problem, as I've heard it, is that ARIN's fees are steep in order to
pay for various costs. Since there isn't the economy of scale of hundreds
of millions of domain names, and instead you just have ... what? Probably
less than a hundred thousand objects that are revenue-generating? If you
charge $1/yr for each registered object, that means your organizational
budget is sufficient for one full time person, maybe two. At $100/yr, you
have enough funding for some office space, some gear, and a small staff.

Joe - Your financial breakdown is heading the right direction, but let
help out with some more information (FYI - ARIN's 2009 Budget is available
at https://www.arin.net/about/corporate/planning/, and the 2010 one
should be there sometime next week.)

ARIN runs about a $15M annual operating expense. As you noted below, it
can be hard to separate into distinct "products', and in fact, in some
cases it is not appropriate to separate since one function (e.g. support
for public policy development) might actually be a prerequisite for another
(i.e.new address allocations). I am actually working to get more service-
oriented cost information going forward, but this is non-trivial to make
happen.

In terms of fees, we have about 3500 ISPs (whose registration subscription
service fees cover the bulk of ARIN's expenses, i.e. an average of several
thousand dollars per ISP per year) In other fees, we have over 1000 end-user
organization and presently about 800 legacy RSA holders which pay $100/year
for maintenance. This doesn't really cover much expense, and that is quite
appropriate since handling registration services requests (and the supporting
public policy process) does dominant the expenses of ARIN, at least today.

The question is how that evolves over time, particularly if the level of
registration services requests in an post-IPv6 world is very modest. At
that point, ARIN's expenses will be predominantly registry systems support,
and whatever public policy process the community wishes us to maintain.
These costs will need to be predominantly covered by the maintenance fees,
and will support the objects in the database, which includes the resource
records of 3500 ISPs, 1000+ enduser organizations, the signed LRSA holders,
and estimated 15000 legacy resource holders who have not signed an LRSA...
At the end of the day, the Board of Trustees will determine the best fee
schedule to provide for cost-recovery of whatever functions are needed for
the mission at that time.

So when you run into expensive stuff, like litigation, the best course of
action is to avoid it unless you absolutely can't.

Correct.

Further, if you've suffered mission creep and are funding other things
such as IPv6 educational outreach, that's going to run up your costs as
well.

Presently, IPv6 outreach is not considered "mission creep", as it has
been an overwhelming request of the community both online and in the
public policy meetings.

An established entity like ARIN typically has a very rough time going on
any sort of diet. Further, companies typically do not segregate their
"products" well: if IPv4 policy enforcement runs into legal wrangling
and lawsuits, ARIN as a whole gets sued, and it is tempting to spread
the resulting expenses over all their products. Segregation into two
(or more!) entities is a trivial way to fix that, though it also brings
about other challenges.

Absolutely correct. I think it is possible to understand those costs
better, but in some cases they can't be put into separate organizations
without some changes to structural assumptions about ARIN's mission.

I have my doubts, based on a ~decade of observation. I don't think ARIN
is deliberately evil, but I think there are some bits that'd be hard to
fix.

Joe - If you want to improve ARIN policy, jump right in. If you want to
propose policy for the sake of changing the nature of the organization,
that's also fine, if you contact me I'll assist in providing estimates of
cost savings and structural changes that can result from your proposals.
At the end of the day, it will be the community's discussion of your
proposal, and the AC & Boards consideration of the discussion which will
decide the matter.

/John

John Curran
President and CEO
ARIN