Thursday, July 01, 2004 Subject: Who controls the assignment of IP address, and under what terms? ------------------------------------------------------------------------- This matter is an extremely important policy issue. It is our opinion that there is a virtual policy vacuum to address this issue. For those of you that been watching this matter, the litigation that NAC is involved in with the plaintiff is a simple contract dispute with many facts that are in dispute, and is irrelevant to the greater issues that are at stake. We are not looking to have a popularity contest with NAC vs. the plaintiff. Put us aside. This issue is much bigger then NAC. These are complex and technical matters that should not be decided in a court. These matters can not be decided overnight. These matters require significant input from the network operators. ARIN should solicit the network operators to comment (through meeting, mailing lists, RFC, etc.) on these issues and form a consensus as to a proper set of policies to regulate these matters. ------------------------------------------------------------------------- The matters at stake are as follows: 1. Who is in control of IP address assignment: Do we want the assignment and transfer of IP addresses to be determined by ARIN or by the Judiciary (court system)? 2. Rights of the assigned: What rights does the ISP (or other assignee) have to control the use of IP addresses that are assigned to them by ARIN? When (and under what limitations) can the ISP assign, and revoke IP addresses? If a customer does not like the way an ISP assigns its IP addresses, can the customer appeal to ARIN to intervene, or does the ISP have the final say in the assignment of its own IP addresses? 3. Forcible transfer of IP address: Under what circumstances should a customer have a right to have the temporary or permanent usage of the IP addresses that are assigned to their ISP after they have left the ISP and are no longer doing business with them? a. If temporary transfer is to be allowed, what limitations should be placed on the temporary usage, or should we just let each court decide what it thinks is fair for each case? b. If temporary transfer is granted, does the ISP have a right to appeal? c. What is the time period allowed for the forcible temporary transfer of IP addresses to remain in the customer's "custody"? Is it as long as the customer says they need the space? How long is too long? d. Are there limitations as to the minimum quantity of the IP addresses that can be forcibly temporarily transferred? What if a dial-up customer has a single static IP address that they want to take with them, should that be allowed? What about a single co-lo customer with 100 IP addresses? Where do you draw the line? Who draws the line; the ISP, the court, ARIN, or anyone who wants to? 4. Abuse of the usage of the IP addresses: If an ISP is forced by ARIN or a court to allow the usage of their assigned IP addresses, how does it handle the policing of DMCA violations, SPAM, hacking and other abuse complaints? The ISP would have absolutely no leverage to make the customer comply with any TOS, AUP, criminal or civil laws. Do we think it is a good idea to have a situation where a spammer can have their service disconnected by their ISP and the spammer can simply go to the court to bring their IP addresses with them? 5. Liability and Cost: If the ISP loses control of their assigned IP addresses (but they are still assigned to the ISP), then not only can the ISP not control them, but they would still be forced to receive and process each abuse complaint, and still carry all legal liability for any actions taken by the customer that is using their IP addresses. Who is going to compensate the ISP for providing this service? Who is going to indemnify and protect the ISP from legal action from third parties that are harmed by the actions of the customer that is just "using" the IP addresses? a. What happens if the ISP is sued because the customer has DMCA violations that they refuse to correct? Who pays for the legal defense of the ISP to explain to the plaintiff that "although the IP addresses are assigned to the ISP, they really have no control over their own IP address space"? Does anyone think that the company that is suing you because of the DMCA violation understands or cares about your problems of who really owns the IP addresses? 6. Damage to ISP's network: If the customer makes a mistake in their routing configuration and causes damage to the ISPs network, who is going to compensate the ISP for the damage, and who is going to force the customer to stop causing the damage? Is there going to be a test of routing knowledge for every customer that wants to take their IP addresses with them? a. What happens if an ISP has their IP addresses blackholed because a customer is abusing (SPAM, hacking, whatever) the IP addresses that they have taken with them? How does the ISP defend themselves? How do they get off the RBL? How does the ISP make that customer stop? b. What happens when the customer's routing mistakes cause a denial of service to your other customers. How do you make them stop, how do you order other networks not to listen to their announcements when they have court (or ARIN) permission to announce your IP addresses? c. Who compensates the ISP if part or their entire IP address range is "polluted" by abuse from the customer? Will ARIN swap out the "polluted" IP addresses with the ISP for new clean IP addresses? Will ARIN withhold the assignment of new IP addresses because the "polluted" ones are not being sufficiently utilized once they are returned to the ISP? 7. Damage to Internet routing: The whole system of non-portable IP address space was done to protect the integrity of the routing and switching of the Internet. The current infrastructure in use throughout the Internet is not capable of supporting an environment where current non-portable CIDR blocks of IP address space can be broken up and distributed as many smaller blocks or individual IP addresses. If this were to be allowed by ARIN or ordered by the courts it could result in a routing breakdown of the entire Internet. For all of the above reasons I think that if these things are not decided very carefully it will have major repercussions for the entire industry. All network operators and other concerned parties must speak out in a very clear voice to ARIN and to the court. A copy of this document may also be found at: www.nac.net/ipaddresscontrol.pdf I thank everyone for their time and attention to this matter. Sincerely, Blake Ellman President Net Access Corporation ---------------------- Net Access Corporation 1719 Route 10 East Parsippany, N.J. 07054 973-590-5000 www.nac.net ---------------------- - BE161 -