Every device connected to the global Internet needs a numeric identifier, an "Internet Protocol" address, or simply "IP address." The Internet's continued growth presents a challenge: most IP addresses have already been assigned to networks and organizations, leaving few left for newcomers and growth. In this context, some networks seek to sell the addresses they previously received - sales which can usefully transfer resources to the networks that most need them, but with certain risks that must be handled with appropriate care. As advisors and counsel to the American Registry for Internet Numbers (ARIN), which assigns and manages these numbers in most of North America, we seek to clarify the circumstances in which such transfers are permitted and to set out the legal, contractual, and policy basis for applicable restrictions.
ARIN's Role and Responsibility for IP Numbers
ARIN is the non-profit corporation that oversees the allocation of Internet Protocol numbers and performs other services related to the operation of the Internet in the North American service region, including the United States, Canada, and certain Caribbean islands. ARIN has served in this capacity since 1998, and in many aspects is similar to, but different from, the Internet Corporation for Assigned Names and Numbers (ICANN), which provides overall global coordination for the domain names and numbers used in the Internet.
ARIN carries out duties assigned to it and handed off to it by the U.S. government - duties that had previously been performed by the government. In particular, effective December 1, 1997, the National Science Foundation (NSF) approved the "transfer [of] responsibility for the IP Number assignment . . . to ARIN." NSF recognized that the formation of ARIN, as an industry self-governance body, was necessary to "give the users of IP numbers (mostly Internet service providers, corporations and other large institutions) a voice in the policies by which they are managed and allocated within the North American region." (See NSF Press Release, June 24, 1997.)
ARIN's authority is also recognized through ICANN's contracts with the U.S. government and in turn through ARIN's agreements with ICANN. ICANN's relationship with the U.S. government is presented in part in ICANN's Memorandum of Understanding with the Department of Commerce, November 25, 1998, and various amendments thereto. ARIN's contract with ICANN is embodied in ARIN's assent to the Memorandum of Understanding between ICANN and the Address Supporting Organization (October 29, 2004).
To carry out its obligation of coordinating IP number resource policy in its service region, ARIN follows a rigorous, open policy process. Interested ARIN members and the public, including government agencies, can submit policies for consideration by the ARIN community. Policies are discussed both online and via periodic in-person meetings, and policies are only enacted when they enjoy a consensus among ARIN members. This is exactly the type of multi-stakeholder industry self-coordination which U.S. government policy has sought for Internet resources.
The Importance of IP Address Uniqueness
The Internet Protocol standard requires that each device connected to a network have a unique IP addresses not used by any other device on the network. Organizations may configure their equipment with any IP addresses they wish, just as they may label folders in their file cabinet with any names they choose, and as long as uniqueness is maintained, the system works. But global uniqueness is required when communicating with the Internet at large, as most networks seek to do. Specifically, if a network attempted to connect to the Internet using IP addresses already in use by another network, both networks would find their communications unreliable.
The U.S. government established the Internet Registry System to issue unique IP addresses for Internet research, for facilitating Internet connectivity, and for private use. The Internet Assigned Numbers Authority (IANA) assigns large address blocks to the five Regional Internet Registries (RIR), of which ARIN is one. To assure that each address is assigned only once, IANA carefully assures that each RIR receives distinct address blocks. In turn, each RIR also carefully manages its assigned IP address blocks in its portion of the registry, making individual entries assigning ranges of IP addresses to particular networks as requested. Specifically, when the RIR issues an IP address blocks to a network, the RIR labels the entry in the RIR's registry to indicate the organization's name and related contact information. In short, an "IP address block," as the term is commonly used with respect to globally unique Internet addresses, is defined by and inseparable from its uniqueness in the Internet Registry System.
Uniqueness, as assured by the Internet Registry System, is the crux of the value and importance of IP addressing. From one perspective, IP addresses are just numbers; anyone can pick a number, and configure it into their computer to use it. Completely private networks can and do make use of any IP addresses that they wish. But when it comes to communications with the global Internet, the Internet Registry System provides the required coordination - encapsulating and assuring the right of each participating network to uniquely use assigned IP address blocks free from conflict with others participating in the Internet Registry System.
ARIN's IP Address Transfer Policy
As the four billion Internet Protocol Version 4 Numbers (IPv4) began to run low, ARIN members discussed mechanisms to permit voluntary reallocation of IPv4 addresses to networks that most need them. The ARIN policy process culminated in a consensus on a flexible market-based transfer policy that allows a network to receive the definitive right to IP numbers in the registry, subject to a handful of lightweight restrictions: Under current ARIN policy, the recipient must sign a registration services agreement (RSA) for the addresses it receives, and the recipient must demonstrate "need" for those addresses, consistent with the same standards applied to all other ARIN address allocations. ARIN does not require disclosure of the compensation paid between the parties nor does ARIN share in the compensation.
These reasonable restrictions are appropriate to formalize parties' relationships and to maintain longstanding policy principles. An RSA contract is a basic formalization of rights and responsibilities. ARIN has always required RSAs in its transactions with networks, both to protect ARIN's interests and to clarify networks' rights vis-à-vis ARIN. This process is well-established: more than 3,500 ISPs and network operators have signed more than 11,000 RSAs to date.
Meanwhile, the ARIN community has concluded that demonstrating need is appropriate to assure that networks obtain only the addresses they genuinely require. With IPv4 numbers running low, it would be shortsighted for a network to be permitted to obtain more than it needs - and the networks in the ARIN region therefore have created policies that currently do not allow organizations to take more than they genuinely need. Some networks might wish to obtain a long-term or even indefinite supply of IP numbers, but current community policies intentionally disfavor such tactics: the ARIN community consensus is that networks should be moving to IPv6, the next generation Internet numbering system. Indeed, decades of policies from ARIN and predecessors have limited networks to the addresses they demonstrably need, whether during issuance or when being transferred from one network to another. This requirement should surprise no one.
Services for Networks that Flout ARIN Community Policies
From time to time, critics of current IP resource allocation policies encourage ISPs and network operators to ignore ARIN policy, asserting they have an unfettered right to "sell" addresses in any way they see fit. For example, in a November 2012 article in Business Law Today, one commentator suggested that IP address holders can "freely alienate their number assets" - selling to anyone they like. We emphatically disagree.
We first note the policy consequences of allowing addresses to be transferred without restriction. For example, limitless rights to "sell" such numbers would permit them to be "sold" to spammers - who constantly need new addresses as their existing IP address blocks develop bad reputations and become blocked by network operators. Limitless sales would also help those who "phish" and engage in identity theft, activities that similarly damage address reputation. Moreover, limitless sales would permit speculators, who don't use the numbers, to buy up numbers and create artificial scarcity. Putting aside the selfishness of such an approach and the real harm it presents to the Internet, it risks forfeiting the valuable benefits that ARIN provides.
Networks' requests of ARIN also provide ample basis for ARIN's restrictions on transfers. Whether requesting new assignments or transferring addresses from another party, a legitimate network is likely to want multiple services from ARIN: WHOIS to list that network as the authorized and exclusive user of the specified numbers in the Internet Registry System; DNS reverse lookup to confirm the domain names associated with various numbers; and, in the future, perhaps resource certification to cryptographically affirm the network's association with those numbers. To date, ARIN has provided these services to all networks in its service region - networks that signed RSAs as they obtained addresses directly from ARIN, early recipients that signed legacy RSAs (LRSAs) to formalize their relationship with ARIN, and also early recipients of IP numbers who that have not signed LRSAs. ARIN intends to voluntarily continue to provide these services to recipients that comply with ARIN policy. But if a network deliberately flouts ARIN policy, it cannot in the next breath demand that ARIN provide it with services, presumably for free. There is no legal or equitable obligation for ARIN to provide services to those who deliberately choose not to follow ARIN policies. To the contrary, ARIN members expect ARIN to withhold services from networks that intentionally and flagrantly violate ARIN policy; that would be a valid exercise of the ARIN policy process, and it should come as no great surprise to networks that ignore the requirements established by the ARIN community through its open policy process.
For addresses associated with RSA or LRSA contract between ARIN and the address holder, the applicability of ARIN's policies is particularly clear-cut: the contract requires such compliance. Separately, critics occasionally raise questions about addresses allocated by ARIN's government predecessors, without the formality of the RSA contracts. Specifically, some have suggested that those early address allocations yield special rights that include the right to transfer addresses without restriction. Here too, we disagree. The following sections present authority for the applicability of restrictions, duly established by ARIN's community and public processes, to early addresses allocations.
Rights and Obligations of Early IP Number Recipients
Early IP number recipients always understood, or should have understood, that their participation in an interconnected network would necessarily entail compliance with reasonable network policies set by the group, including policies yet to be devised. These requirements have flowed through nearly two decades of subsequent U.S. government policy. For example, when the National Science Foundation (NSF) in 1993 passed responsibility for IP addresses management to contractor Network Solutions (NSI), the NSF's Statement of Work required compliance with certain technical specifications called RFCs that are periodically issued by the Internet Engineering Task Force (IETF). Specifically, the Statement of Work required compliance with RFC 1174 which called for following both existing practice in management of IP addresses as well as "documentation to be issued as RFCs" - indicating that new rules and requirements in the management of IP addresses would arise from time to time. (The Statement of Work instructed: "Awardee shall provide registration services in accordance with the provisions of RFC 1174.") RFC 1174 in turn required the IANA and the Internet regional registries to meet and produce documentation of the operational procedures and requirements to be used in operation of the registry system ("documentation to be issued as RFCs," emphasis added).
Just as RFC 1174 contemplated, subsequent IETF documents further formalized the obligations of recipients of IP numbers. For example, RFC 2050 (which was issued in November 1996 before ARIN's formation) in Section 3.1 specifically notes the prospect of reclaiming addresses if the recipient's need no longer exists. Then Section 4.7 adds that transfers of existing assignments from one party to another may occur only with registry permission, and further provides that "the party trying to obtain the IP address must meet the same criteria as if they were requesting an IP address from the Internet Registry." These rules were prepared exactly as anticipated by the use of the future tense in RFC 1174 ("documentation to be issued," emphasis added), as combined output of the regional registries and the IANA.
In short, recipients of address space under the NSF cooperative agreement were definitely subject to policies developed by the Internet technical community, including policies established after addresses had been allocated.
As the successor in management of the IP addresses in the region, ARIN inherited responsibility for coordinating and implementing these policies. It would have been easy at the handoff for NSF to restrict ARIN's duties with respect to the management of previously-issued number resources. But the contemporaneous documents reveal no reference to such a limitation, and in fact active statements to the contrary.
Importantly, the creation of ARIN included explicit affirmation of the scope of ARIN's authority as to early IP numbers. For example, the NSF's June 24, 1997, press release celebrates the fact that "creation of ARIN will give the users of IP numbers . . . a voice in the policies by which they are managed and allocated within the North American region" (emphasis added). The antecedent for "they" is "IP numbers," and notice the lack of restriction or qualifier on that term; the sentence offers no suggestion that only a subset of North American IP numbers (such as numbers to be issued in the future) are subject to management by IP number users via the ARIN process. Thus, the only reasonable interpretation of this contemporaneous NSF statement is that ARIN has authority to set policy for the IP numbers previously issued by the U.S. government or contractors acting for the U.S. government. Furthermore, verb tense confirms the scope of ARIN's responsibility: As of the time of the press release, no IP numbers had yet been allocated by ARIN, but the press release nonetheless instructs that the ARIN process will set the policies by which IP numbers in the region "are managed" (emphasis added) - meaning the policies will apply to the numbers already allocated by ARIN's predecessors in the region. Any contrary interpretation would undermine the NSF's stated intent to enable self-governance of IP addresses by the users in the region.
U.S. Government Policy for Early IP Numbers
Some critics seek support in a recent private letter sent by Mr. Larry Rudolph, the general counsel of the NSF, regarding his views as to the supposed rights of early recipients of IP numbers. But Rudolph's letter was written more than some 14 years after the end of NSF's role in policy oversight of IP numbers. Rather, since 1999, the White House Office of Science and Technology Policy (OSTP) and the Department of Commerce's (DOC) National Telecommunications and Information Administration (NTIA), have overseen the U.S. government's interests in Internet infrastructure. If an advisory opinion were needed to clarify the U.S. government's view of rights in early IP numbers, one would expect that opinion to come from OSTP, DOC, or the Office of Legal Policy at the Department of Justice - but not from NSF. Indeed, in a follow-up letter, Mr. Rudolph himself acknowledged that his prior "observations" were not a "legal or policy position on behalf of the U.S. Government."
Rudolf's letter was almost immediately repudiated by the subsequent statement of USG IP address policy by the NTIA. Shortly after Rudolph's letter began to publicly circulate, NTIA Administrator Lawrence Strickling posted NTIA's reaffirmation of ARIN's role and responsibility in managing the IP address registry in accordance with the policies developed by community in the region. Specifically, the NTIA statement explained: "The American Registry for Internet Numbers (ARIN) is the RIR for Canada, many Caribbean and North Atlantic islands, and the United States. The USG participates in the development of and is supportive of the policies, processes, and procedures agreed upon by the Internet technical community through ARIN." In our view, NTIA's statement is more persuasive, both through its substance (including its explicit reliance on a decade of U.S. government policy) and its source (the agency with current responsibility for these matters).
Protections for Early Address Recipients
Since ARIN processes may permissibly alter policy as to IP numbers issued before ARIN's creation, one might reasonably ask what protects early IP number recipients against arbitrary or otherwise-improper action by ARIN. The answers are several. For one, ARIN must operate in accordance with its articles of incorporation and bylaws which - duly established during ARIN's formation and reviewed by the U.S. government at that time - require reasonable, non-discriminatory treatment grounded in proper technical justification. Furthermore, ARIN must act in accordance with its own procedures, including changes to policy based on community consensus as grounded in the history and tradition of the Internet technical standards process. These protections amply protect early IP number recipients.
ARIN's good faith stewardship of its responsibilities is demonstrated by its generous treatment of pre-ARIN IP number recipients. For the past 15 years, ARIN has provided no-charge WHOIS, reverse DNS, and other services to early IP number recipients. ARIN has offered (but never required) that early IP number recipients sign a Legacy Registry Services Agreement that formalizes the parties' relationship. Current ARIN policies allow early IP number recipients to sell their exclusive right to use IP numbers to others, realizing significant financial gain (potentially a windfall in some cases, since those recipients did not pay the U.S. government for rights to those resources and the effort necessary to free up underutilized IP addresses could be quite modest.) ARIN imposes minimal restrictions on such transfers. In short, early IP number recipients have every reason to be thankful for the services and policies ARIN has put in place.
U.S. and Canadian Bankruptcy Courts' View of ARIN's Authority
A growing number of IP transfers have occurred to date, including some publicized transactions from bankrupt estates. To ARIN's knowledge, in each and every instance sellers have agreed to follow ARIN policy and have in fact followed ARIN policy.
Despite bankruptcy proceedings recognizing ARIN's role, some critics argue that ARIN policies rules do not bind sellers of IP numbers issued before ARIN began operation. Some even argue that a transfer from Nortel's bankrupt estate to Microsoft supports this view, but that case actually stands for exactly the opposite proposition. In bankruptcy proceedings, the U.S. Nortel estate no longer needed IP numbers it had received years earlier, so it sought to sell those numbers to Microsoft. As initially proposed, the sale sought recognition of the IP addresses as property and did not recognize ARIN's inherent role with respect to IP address management. ARIN intervened in the bankruptcy sale. ARIN had the clear support of the Canadian government and other third parties. See Industry Canada's April 13, 2011, filing in the Nortel Networks bankruptcy (In re Nortel Networks Inc. et al., D. Del. Case No. 09-10138 (KG), docket #5253):
This submission is in support of ARIN's interventions related to the legal underpinnings of the current governance structure of Internet numbers . . . and to bring to your attention substantive governmental and policy concerns that arise from the sale of Internet numbers in the manner and on the terms suggested in the Debtor's Motion. . . Their use in accordance with the policies adopted by ICANN, ARIN and the regional registries provides essential assurances respecting the ultimate identity and accountability of Internet users.
Microsoft and the Nortel estate ultimately agreed to modify the transaction consistent with ARIN's right to review and approve the transaction following ARIN's established policy. Specifically, in Nortel docket #5315, the parties modified the transfer agreement as a transfer of rights and interests in the address blocks, and called for a RSA contract between ARIN and Microsoft. After ARIN's investigation confirmed Microsoft's need for the numbers and found that the transfer complied with established policy, ARIN assented and permitted the transfer to proceed. The bankruptcy trustee and bankruptcy judge assented to this arrangement, and Microsoft - a sophisticated multinational corporation - saw that complying with ARIN's policies added value to its intended transaction. In short, Nortel offers only a precedent for following ARIN's policies, not ignoring them.
In myriad transactions after Nortel-Microsoft, bankruptcy courts systematically recognized ARIN's role as the registry in the region and required sellers to comply with ARIN policy. For example, the court in In re Borders Group, Inc., 11-10614 (Bankr. S.D.N.Y.) stated:
Notwithstanding anything herein to the contrary, . . . (i) the [Internet Address] Sale, . . . is conditioned upon ARIN's consent including any terms and/or conditions established by ARIN's transfer policies or any other policies, guidelines, or regulations developed by ARIN and published on its website, as may be amended and supplemented from time to time (collectively, "ARIN's Policies"), (ii) the transfer of the Debtors' interests in the Internet Addresses to the Purchaser is subject to ARIN's Policies, (iii) the Debtors and the Purchaser are required to comply with ARIN's Policies before any transfer of the Debtors' rights in the Internet Addresses may be effectuated; [. . . ]
Indeed, the court specifically indicated that ARIN need not change its policies in any way:
(iv) ARIN is not required to take any action in violation of ARIN's Policies in connection with or as a consequence of this Order, the [Internet Address] Sale, or the Agreements, nor shall ARIN be required to apply a different standard to the transfer of the Internet Addresses than it does to the transfer of non-legacy Internet Protocol numbers. Nothing in this Order is intended, nor shall be construed, as exempting the Debtors and Purchaser from complying with the ARIN Policies.
Orders in similar cases are in accord. See e.g. In re Teknowledge Corporation; 10-60457 (Bankr. N.D. Cal.) and Global NAPS, Inc. v. Verizon New England, Inc.; 02-12489, 05-10079 (D. Mass.), both permitting sales of IP numbers in bankruptcy proceedings only to the extent compliant with ARIN policy.
Validity of ARIN RSA and LRSA Contracts
ARIN has long formalized its rights and obligations to networks via standard Registration Service Agreements (RSA) contracts laying out rights in IP Numbers. These documents are easily available for public review.
One ARIN critic argues that RSAs are "nothing more than illusory contracts" because, he says, "ARIN, as apparent promisor, makes no binding commitment at all and . . . retain[s] an unlimited right to determine the nature or extent of its performance." The plain language of the RSAs says otherwise. For example, RSA Section 2 grants a network the exclusive right to be the registrant of a given set of numbers, to use those numbers in the registry, and to transfer those numbers. Certainly these rights are encumbered by community policy, but this is to be expected because developing and managing IP address policy is a fundamental principle of ARIN's very existence as part of the global Internet Registry system. A network signing an RSA receives valuable rights, including a commitment from ARIN to associate the number resources with that organization alone, and subject only to the exceptions provided in the RSA - ample consideration to support a valid and enforceable contract.
Looking Forward
IPv4 numbers are indeed in short supply. The question at hand is what to do about it. Some of ARIN's critics envision a future where the networks that received addresses early can sell them to the highest bidder, whether a legitimate network, a spammer, a person engaging in online fraud, or someone stockpiling addresses for future sale. Such a theory recognizes no societal needs or Internet community constraints whatever. In contrast, ARIN's current policies allow transfers with only limited restrictions to prevent the worst abuses and provide additional value to the resources. Some early networks probably will sell their rights to underutilized addresses, even reaping windfall profits, and ARIN policies allow them to do so consistent with the community's rules. But networks' right to make these transfers is nonetheless constrained, including by the agreements networks have accepted in receiving these and other addresses, as well as by applicable law and by longstanding U.S. government policy. That is as it should be. During this transition to the more capacious numbering system of IPv6, the top priority is, and should be, keeping the Internet running smoothly - assuring that the remaining IPv4 addresses are available to those who need them, and managing all number resources in the registry in accordance with the policies.