Does ARIN have the right to approve all IPv4 address sales?

A U.S. bankruptcy court in Delaware recently approved Nortel’s sale of 666,624 IPv4 addresses to Microsoft for $7.5 million. Despite this precedent, a debate is raging in Internet policy circles about how sales of IPv4 addresses — particularly the largest blocks of IPv4 address space issued before the Internet became popular — will proceed in the future.

DETAILS: Need IPv4 addresses? Get ’em here

On one side of the debate is the American Registry for Internet Numbers (ARIN), the regional Internet registry for North America, which is trying to assert authority over all IPv4 address transfers in the region.

Arguing against ARIN’s right to approve all IPv4 address sales in the region are lawyers, entrepreneurs and other experts who say that some IPv4 address holders have the right to sell their IPv4 addresses to whomever they choose without prior approval from ARIN.

The crux of the issue is whether legacy IPv4 address holders — particularly those that received large blocks of IPv4 address space before ARIN was founded in 1997 and never entered into a legal agreement with ARIN — must seek ARIN’s approval to sell their IPv4 address space.

Nortel was a legacy IPv4 address space holder that never signed a contract with ARIN and didn’t seek ARIN’s approval to sell its unused address space to the highest bidder. However, the buyer of Nortel’s address space, Microsoft, ended up signing a contract with ARIN after the deal was struck.

The bankruptcy court’s approval of the Nortel/Microsoft deal is viewed by many as the beginning of a vibrant market for legacy IPv4 address space.

Charles Lee, president of Addrex, a startup that was the sole dealmaker for the Nortel/Microsoft sale, says the judge’s ruling in the Nortel case has clear implications for future sales.

“We believe that the recognition of a legacy number block holder’s exclusive rights to use, transfer and sell these assets is a watershed moment,” Lee says. “It means that the pejorative term ‘black market’ is a thing of the past, and the creation of an open, legitimate secondary market for the sale of number blocks, under a legal framework, is now undisputed.”

However, the Nortel/Microsoft deal didn’t follow ARIN’s stated IPv4 address transfer policy to the letter, so many observers are questioning how future trades will occur.

IPv4 sales are “not cut and dried. The Nortel/Microsoft deal was the beginning of a process by which we will work this out,” says Professor Milton Mueller of the School of Information Studies at Syracuse University and a committee member of the Internet Governance Project.

Mueller adds that ARIN’s “part in the Nortel/Microsoft deal was an improvisation, and it deviated from what they expected to happen … ARIN learned about this deal just the same way that you and I did … and then they scrambled to the bankruptcy court. Suddenly the sale agreement was amended and had all this stuff about ARIN in it.”

Marc Lindsey, a partner with Washington, D.C., law firm Levine, Blaszak, Block & Boothby, says the issue of whether legacy IPv4 address holders like Nortel own “intangible property rights” hasn’t been decided by the courts. But he adds that the Nortel bankruptcy judge’s ruling “declaring that Nortel possessed the exclusive right to use and transfer its legacy numbers comes pretty close.”

The issue of intangible property rights “is an interesting legal question and as a practical matter in the marketplace will have a big impact on value” of IPv4 address blocks, Lindsey says.

Legacy address holders — including IBM, General Electric, Xerox and MIT — received large blocks of IPv4 address space, some as big as 16.7 million addresses, before ARIN was founded. Most legacy address space holders are U.S. companies, universities and government agencies.

BY THE NUMBERS: The evolution of the Internet

The majority of legacy address holders have not signed Legacy Registration Services Agreements (LRSAs) with ARIN, despite pressure from ARIN over the past few years for them to do so. LRSAs are less stringent than the typical contracts network operators sign with ARIN, which are called RSAs for Registration Services Agreements.

John Curran, president and CEO of ARIN, says more than 500 legacy IPv4 address holders have signed LRSAs with ARIN, but that an estimated 10,000 to 20,000 have not.

Lindsey says legacy IPv4 address holders haven’t signed LRSAs because “there is not a value proposition for them.”

Mueller points out that Nortel’s sale of IPv4 addresses to Microsoft did not follow ARIN’s stated policies about how IPv4 trades are supposed to occur, starting with the fact that Nortel hadn’t signed an LRSA.

“According to ARIN’s policy, the seller comes to them and signs an LRSA, and then ARIN confirms they are the legitimate owner of the address block. … Then the buying party is supposed to sign a standard RSA. This buyer is also supposed to go through a formal needs assessment by ARIN. Nothing like that happened in this case,” Mueller says. “Nortel completely refused to sign any contract with ARIN, and Microsoft signed an LRSA, not an RSA.”

Mueller guesses that Microsoft signed an LRSA under pressure from ARIN because “it doesn’t cost them a lot. It weakens their rights a tiny bit, but it keeps ARIN happy and it keeps the registry whois database intact. I bet they wanted to appear that they are not total renegades.”

Lawyers say the Nortel/Microsoft deal demonstrates that legacy IPv4 address sellers that haven’t signed an LRSA or RSA don’t need ARIN’s approval to sell their IPv4 address space. But they say Microsoft’s decision to sign an LRSA makes it unclear whether buyers of legacy IPv4 address space must agree to ARIN’s terms.

“What’s not clear from this is what would happen if a legacy IPv4 number buyer decides not to voluntarily agree to enter into an RSA or LRSA with ARIN,” Lindsey says. “In my view, applying the reasoning in the [bankruptcy judge’s] order, a buyer would obtain all of the exclusive rights of the seller free of any of ARIN’s policies. ARIN could not assert authority over those numbers to revoke or reassign them, but ARIN could refuse to update its records, including the whois database.”

Curran says ARIN won’t update the IPv4 address entries in its whois database when a trade occurs that isn’t in compliance with its transfer policies. He points out that more than 10 IPv4 address sales have followed ARIN’s policies in the past month, even though the Nortel/Microsoft deal has gotten all of the press.

“We have had more than 10 other transfers happen, and all of them have been where the seller has come to us with the buyer,” Curran says, adding that all of these transfers have happened in the last month. “The precedent is in the other direction. All of those [address blocks] were transferred in compliance with our requirements.”

The reason some legacy IPv4 address sellers don’t want to follow ARIN’s transfer policies is that ARIN requires buyers to demonstrate “need” for IPv4 address space just as they would for a regular IPv4 address allocation. Critics see this as an unnecessary condition on the sale.

“I’ve been warning the [regional Internet registries] that they need to set up a very open market exchange system, and the overriding policy goal was to make sure people that had addresses and wanted to get rid of them could do so easily and quickly, and people who wanted addresses could be able to get them straightforwardly,” Mueller says, adding that he has “never been a big fan of the needs assessment.”

Curran argues that ARIN’s needs assessment for IPv4 address allocations is valuable because it takes into account past allocations, historical rates of network growth and other important data. He says ARIN processes hundreds of requests per month and on occasion rejects a request because need hasn’t been demonstrated.

However, Curran says that ARIN has had “no abandoned transfers” because of a buyer’s failure to pass the needs assessment. Curran reiterates that ARIN supports legacy IPv4 address sales because “if we can get underutilized IPv4 address blocks into use, that gives people breathing room for the transition to IPv6.”

One issue that everyone agrees upon is that legacy IPv4 address sales are going to continue to be a hot topic for the foreseeable future.

IPv4 trading “is going to be important for a long time because of the flaws in the dual-stack migration policy,” Mueller says. “You don’t save any IPv4 addresses until 94% of the world networks are on IPv6. At the rate people are going to IPv6, we’re not going to be anywhere near that point for 10 or 20 years. We’re going to be needing a lot of IPv4 addresses.”