1

        conference.apnic.net/37/program#session/66948

                                ************

        >>Dean Pemberton: This is the IP leasing BOF.

            I wanted just to go through a bit of

            a scene setting, then throw it open and

            try and get some feedback from you guys

            about what IP address leasing means, what

            the policy implications might be, whether

            this is a big deal at all and we'll see

            where we go.

                I have had a request that if you do

            want to ask questions, that you come to

            one of the mics.  I promise to put this

            one back on the stand.  There will be

            another one I can grab from where, and

            just state your name and affiliation.

                We do have people watching remotely,

            so Sunny is going to throw in any

            questions that we have on the chatroom

            and we'll go from there.

                The concept of IP address leasing

            isn't new.  One could say it has been the

            primary model for ISP sub-delegation to

            their customers for ages.  But in that,

            there's some assumption that there is
                                                                                        2

            some level of operational control

            retained by the ISP.

                There is an expectation that the

            registry data reflects an operational

            hierarchy that makes it possible for

            people to look up parent blocks and then

            use that information to resolve

            operational issues for a lower block.

                This model and those assumptions may

            no longer be valid, if we start looking

            at IP address leasing outside of an ISP

            network operational sense.

                Addresses could now be leased out

            with no operational servers or control

            attached to them and how, if at all,

            should the registry reflect that reality

            while it maintains its important role in

            facilitating operational troubleshooting.

                Policy wise, should leases be allowed

            to accumulate address space using leasing

            demands as some sort of demonstrated need

            when they get or transfer more addresses

            into or out of the region?  Is being an

            IP leasing hoarder a common stated need

            for doing transfers?
                                                                                        3

                These are some of the questions that

            I want to get from you guys.

                I really want to throw this open.

            I want to find out, is IP address leasing

            actually a thing?  Is it different than

            what we do today?  Is it the same as what

            we do today, it's just a different -- I'm

            getting "mm-hmm", so we have opinions

            already.  That's awesome.

                After we work out whether this is

            actually a thing, how does it affect the

            policy framework that we currently have?

            Does it just slot right in?  It's a new

            thing, but do our existing policies cover

            it just fine?  Are there new policies

            that there needs to be?

                Let's also look at this expectation

            of operational control.  If I give an ISP

            a large delegation and they sub-delegate

            small parts of that, I can always call

            them if there's something up with them.

                I also want to go through and look at

            this concept of demonstrated need.  We

            have transfer policies which are needs

            based.  Does me having a business where
                                                                                        4

            I lease out IP addresses, is that the

            same need as me having a business where

            I allocate them out to end customers that

            are going to use them?  I don't have

            a horse in this race.  But the questions

            need to be asked.

                The first one of those: is IP address

            leasing actually a new thing or is it

            just a new name for the same thing we

            have always been doing?

                There's the mic.  I'll put this one

            back.  Let's go.

        <<Chris Grundemann: Hello, Chris Grundemann.

            No affiliation at the moment.

                I think address leasing is obviously

            a thing.  I think if you look at it, at

            least from the United States perspective,

            most residential broadband providers will

            charge a fee for static addresses, kind

            of thing.  At that point, once you are

            paying directly for addresses, it's part

            of the service.  It's kind of a thing,

            right?  But I think that what you're

            talking about is kind of a stair step of

            what is address leasing and where do you
                                                                                        5

            draw that line and call it address

            leasing versus part of an existing

            service?

                If I'm providing you connectivity

            service and I provide addresses as part

            of that, I would contend that that is

            probably a form of address leasing, in

            some way.  You may not pay extra for the

            addresses, but the addresses are an

            add-on to the service.  Because I could

            provide you an empty pipe without

            addresses -- you bring your own ASN, your

            own addresses.

                When I provide you addresses, it's

            now part of a service.  It's something

            additional, where I'm now giving you

            addresses.

                Again, it's probably not charge

            extra, but something is going on there

            with addresses.

        >>Dean Pemberton: Or it's rolled into what

            I'm paying for something else.

        <<Chris Grundemann: Right.  It's got to be

            covered somewhere.  The interesting thing

            then becomes when you take away the
                                                                                        6

            connectivity, obviously.  So that's when

            you would obviously call it address

            leasing, but there is a step in between

            where I provide you addresses and then

            maybe I give you an LOA and you route

            those addresses out of someone else's AS,

            so we're in that three-phase process --

            where do you lose?  Is it just the

            connectivity that you lose?  Because

            there's times where maybe you're using me

            as a back-up, but I have given you an ...

            you're using my address through some

            other ASN.  You know, where does that --

        >>Dean Pemberton: I'm seeing a gray area.  So

            it's like this, this is definitely one of

            these and this is definitely one of

            those, but there's a smear in the middle.

        >>Geoff Huston (APNIC): Geoff Huston, old

            fart with a memory, who currently works

            for APNIC.

                The memory is important here, because

            let's sort of look at what it used to be

            against what it is.  The mantra 25 years

            ago was that addresses are not property.

            If you have no need for them, hand
                                                                                        7

            them back.

                The concept with leasing is: I have

            no need for them, but someone does.  So

            I'm going to let them have a temporary

            use for it.

                What's going on here?  Why aren't we

            just endlessly saying the same old

            mantra: "Addresses are not property, they

            have no value, if you have no need for

            them, hand them back."  What's changed?

                Obviously, what's changed is that you

            could have this same discussion in v6 and

            the answer really comes, "I'll just go to

            the registry and get my own block,"

            because in v6, the assumption is there is

            no scarcity pressure.  You don't have

            that option inside the v4 address space.

                When you start talking about leasing,

            what you're really talking about is

            a distribution function inside scarcity.

                No matter how you cut it, scarcity

            imposes value on a common resource.

            Because there's more demand than there is

            supply, so price becomes one of the means

            of equilibrating at some point all that
                                                                                        8

            demand against the supply, because the

            supply is a lot smaller.

                So leasing is one of those areas

            where I wish to maintain some residual

            right of access to this valued resource,

            but also wish to obtain a capital flow by

            allowing someone to exploit it in the

            interim.

                What's really going on is they are

            pseudoing the role of registry -- I'm not

            handing it back, but I'm allowing someone

            else to use it, but I'm replacing

            registry terms and conditions with mine.

                You could make all kinds of value

            judgments about whether you like this or

            not, and folk would, but they are

            independent judgments by independent

            players.  Right?

                From the perspective of APNIC, the

            registry, I would advance the view that

            the registry's real interest is

            maintaining the registry as an accurate

            representation of the current

            distribution of resources for the common

            benefit of all.  If there is no common
                                                                                        9

            benefit in registry, let's shut up and go

            home, but there is a common benefit in

            registry.

                Uniqueness of use and identification

            of the user is of value.

                So I have scarcity and behaviours

            that come as a natural byproduct of

            scarcity, because where there is not

            scarcity, you go, "If there is need, come

            to us, we'll give you what you want.  You

            don't need to create artificial terms and

            conditions from someone else."

                But in this particular area of

            activity, there is an issue.  One, we can

            just deny it.  "This shall not happen",

            you know, and try and hold back that tide

            or we can understand what the demands of

            the users of this registry wish from

            registry and try and look at this from

            a registry-centric perspective, because

            as far as I can tells, if you guys want

            to lease, it's none of my business

            per se.  I don't want to be a party.  I'm

            not sure many folk want to be a party to

            private arrangements per se, but it's
                                                                                       10

            trying to understand where registry sits.

                I thought that's what your

            conversation is about, right?

        >>Dean Pemberton: Yes.  I mean -- yes.  So is

            this the same thing we have always done?

            What you're saying is no, because now we

            have a lot -- now we have scarcity, so it

            has value, so people have a position now

            where I don't want to give it back,

            because it's kind of worth something, so

            I kind of want -- I want to be able to

            give it out and then when that

            arrangement is finished, I want to be

            able to get it back and give it out

            again --

        >>Geoff Huston (APNIC): Because I'm not

            willing to relinquish my long-term

            rights, but that's a behavior -- and

            I stress again, that behavior is brought

            about by an artificial constraint from

            outside.  We have run out of address,

            demand is high.

        >>Dean Pemberton: We have a bit of

            a different thing and one of the

            questions -- so I'll write this down.
                                                                                       11

            What does the registry need to provide

            which is different in this kind of

            mechanism than they have always been

            doing?

        >>Geoff Huston (APNIC): Love the question.

        >>Izumi Okutani (JPNIC): We are also, like,

            a registry within Japan, so exactly the

            same concern as Geoff who has commented,

            making sure we can register who is the

            existing user.

                Regarding how would this leasing

            affect the policy, what we feel is that

            I think it's very similar to transfer,

            but the only difference is that after

            some leasing term, the original holder of

            all the lease would want to have the

            address back.  They would probably want

            to have some kind of guarantee, so one of

            the options that we can maybe consider is

            just keep the transfer policy as it is

            and then make the arrangement, let the

            arrangement of leaser and lessee --

            I don't know what you call them --

            between themselves, so they can do the

            transfer request back or maybe the second
                                                                                       12

            option, like, make temporary transfer, we

            call it and after maybe certain period,

            ensures that the resource will be

            re-transferred to the original holder.

                In our case, we didn't want to call

            it leasing and we want to keep the term

            transfer and the reason for that is that

            we want to make sure who is responsible

            for address space at that stage and

            calling it leasing really confuses

            people.

                Is it the person who is receiving the

            lease or is it the person who is leasing

            the address space?  We want to be pretty

            clear on this.  I think --

        >>Dean Pemberton: Whereas with the transfer,

            it's clearly the person receiving.

        >>Izumi Okutani (JPNIC): Yes, right.  So

            that's kind of our preference and we

            would certainly be interested to hear

            what the others feel about it.

        >>Dean Pemberton: Thank you.  From that,

            I get that there's certainly a place

            where we could look at this leasing

            consent and think of it like
                                                                                       13

            a mini-transfer or a special kind of

            transfer.  So that there's no such thing

            as leasing, but there's the special

            transfer that might be time based and it

            gets transferred to that person with an

            expectation that it gets transferred

            back later.

        <<Chris Grundemann: To expound a little bit

            on what I said earlier, in the context of

            those comments, I think that we have that

            mechanism, right?  It's SWIP-ing.  My

            point was that ISPs have done this

            forever.  They have taken addresses in

            and given them out to their customers.

            The reason for that was to facilitate

            using the service, right?

                So if I'm an ISP and you don't have

            your own addresses, I want to sell you

            internet service, I have to provide

            addresses as well.

        >>Paul Wilson (Apnic) (APNIC) (APNIC): Chris,

            we don't SWIP.  Would you like to explain

            that?

        <<Chris Grundemann: Good point.  In the ARIN

            region -- SWIP-ing, I'm using it as
                                                                                       14

            a general term, but basically

            reassigning.

                The RIR assigns space or allocates

            space to, in this case, LIRs or NIRs here

            and then down to LIRs, which are ISPs,

            who then assign that space to customers.

                The SWIP is the function of updating

            the database, updating the registry of

            who is actually using the addresses.

                So there is an end user that is using

            addresses and then there is an allocation

            above that of the ISP and then

            potentially an allocation above that to

            the nation or whatever.

                There is this process of stepping

            down and saying, "Okay, this big chunk

            went to the ISP and this smaller chunk

            went to an end user."  My point was if

            you remove the connectivity, you can

            still have that same function of we

            handed a big chunk to a service provider

            and service provider then can maintain

            those addresses, but then also update the

            registry to say who is actually using

            them.
                                                                                       15

        >>Dean Pemberton: Is there an expectation on

            the service provider who got the original

            allocation to somehow still be in control

            enough of them for emergency response --

            you know, do they have some sort of

            custodianship or is it, "They're gone.

            That guy."

        <<Chris Grundemann: I think that's correct.

            I think that depends on the situation.

            I think there is an expectation in most

            cases that there is some level of

            responsibility for the addresses of that

            provider.

                I think one of the bigger things,

            especially in the context of talking

            about whether or not connectivity is part

            of that arrangement is hierarchial

            routing and address aggregation.

                That was my point: I think the big

            issue here is in the address aggregation

            aspect, if you're not providing

            connectivity but you do provide

            addresses, there is no possibility of

            address aggregation.  There is no

            possibility without aggregation.
                                                                                       16

                But that's why I said there is that

            middle step, where if I provide addresses

            to someone as an ISP, who I'm also

            providing connectivity to, but I allow

            them to announce those addresses through

            a second provider, then they're no longer

            being aggregated anyway.  I think that's

            that kind of continuum of: what's

            important here?  Is it address

            aggregation or just registry integrity?

        >>Dean Pemberton: To an extent, I think

            there's always some importance, but over

            the last couple of years, with the

            transfer policies and IP run-out, we have

            certainly said what we think the relative

            importance of those is.

        >>Andy Linton (NSRC): Chris raised this issue

            of the SWIP-ing.  But in MyAPNIC, there

            is a perfectly straightforward way for

            you to go in and make an assignment like

            this a public entry.

                Right now, someone who has an address

            block can go into MyAPNIC and say,

            "I have assigned these to someone."  So

            there is a step there that's actually
                                                                                       17

            given us that ability, taking into

            account all Chris' comments about whether

            it's been routed or not or de-aggregated.

        >>Dean Pemberton: I'm hearing a whole lot of

            people saying that this doesn't look like

            a different thing than we have today.  So

            just has anyone got the opposite opinion,

            that this is radically different and

            a new thing and landed from Mars?  Or

            whatever you wanted to say.

        >>Masato Yamanishi: This is Masato from

            SoftBank, but I'm speaking for myself.

                I think leasing is different from

            transfer address, in two points.

                First of all, it's quite similar with

            Chris's point, but in transfer case, we

            can expect both of original holder and

            also receiver RIR account holder, RIRs or

            NIRs.  But in leasing case, I think we

            cannot expect at least for lessor, lessor

            may not be account holder, like how can

            I say, typical enterprise customer, like

            that.

                Second point is I'm not sure we can

            expect same minimum size as transfer,
                                                                                       18

            because in leasing case, maybe they

            expect more smaller size, like /27,

            like that.

        >>Dean Pemberton: Yes, good point.  I mean,

            today, there's some sort of arrangement

            between a holder of addresses and at

            least the person who gave them to them,

            but in some cases and at least with

            transfers, there's a relationship with

            the RIR.  But in the kind of leasing

            arrangement, the RIR wouldn't necessarily

            have a one-to-one relationship with the

            end person.

        >>David Huberman: Hi, David Huberman,

            representing Microsoft Corporation,

            speaking entirely for myself.

                The leasing that's actually happening

            on the global Internet today that I have

            seen first hand is very different than

            anything the RIRs I think have tackled or

            even looked at or analyzed over the last

            20 years.

                What's interesting about it to me is

            it's in my opinion a reaction to some of

            the failures of the RIRs to properly
                                                                                       19

            account for changes in the business

            climate of their customers, of the

            community, of the membership.

                A lot of companies today are leasing

            IP addresses from registrants, from

            holders of registrations, in APNIC,

            especially registrations of holders in

            CNNIC.

                They are leasing without ever

            engaging the RIR system.  And they do it

            for a number of reasons.  Some of it is

            privacy, we don't need our name out

            there, it's not important; some of it is

            I'm seeing new generations of engineers

            who don't really care about Whois so

            much.  Whois provides -- they don't think

            about Whois, but the registries provide

            reverse DNS and as long as my contract

            with XYZ company says, "You will maintain

            my reverse", so it works, and that

            company which has a relationship or is

            a registrant, in an RIR or an NIR, does,

            in fact, hold up their end of the deal,

            then I don't care about the RIRs and

            I don't care about Whois and if anyone
                                                                                       20

            needs to reach me, all they need to do is

            look at the AS that's announcing the

            prefix, go into peering DB or whatever

            and come find me.

                So one more point I wanted to make,

            the first is it's very real and it's

            happening today and it's actually

            happening in very large buckets.  I don't

            see leasing of /24s from small companies.

            I'm seeing leasing of /12s and /11s

            and /10s.

                The other thing is, it's a lot

            because of the bureaucracy of the RIRs

            and the policy development process.

            There is an argument to be made --

            whether you agree with it or not -- that

            the needs-based justification does not

            meet the business reality of 2014.

                As Geoff and Izumi says, there is

            a significant scarcity in the registry.

            Of course, we turn to the market.  But as

            we move over to the market, then we say,

            wait a minute, I'm literally buying

            something now.  It is now property.  No

            matter what the RIRs want to say, no
                                                                                       21

            matter what policy wants to say, it is

            property.  I have a contract and

            consideration is paid to prove that.

                So now it says, "Wait a minute, this

            organization, that I know nothing about

            or I care nothing about, is saying I have

            to justify this to a disinterested third

            party?  No, thank you.

                So one of the things that I think we

            want to think about as a community is how

            can we serve our customers better

            post-exhaustion so that we don't become

            completely irrelevant?

        >>Dean Pemberton: Cool.  Thank you for the

            awesome segue into my next point, which

            is: do we need policy change?

        >>Paul Wilson (APNIC): You asked before,

            Dean, whether leasing and conventional

            transfers were the same.  I don't think

            we can answer that without actually

            asking what we mean.  If they're the

            same, they are, and if they're not, then

            they're not.

        >>Dean Pemberton: Okay.

        >>Paul Wilson (APNIC): In the case of
                                                                                       22

            transfers, what we do under APNIC policy

            is that we receive a request from the

            recipient, who has to justify under our

            policies, has to justify their need for

            that request in exact will the same way

            as they used to for normal allocation

            pre-exhaustion.

                If they satisfy the needs

            demonstrated requirement, then they get

            what's called a pre-approval to receive

            a transfer, which is exactly the same as

            we used to do, except instead of address

            space, they get something which says, you

            can get this address space and we'll

            register it for you if you achieve that

            within the next 12 months.

                So if leasing was done in the same

            way, in literally the same way, then it

            would mean that the recipient who wants

            to use the addresses would come and

            demonstrate their need.  They probably

            also have to be a member of APNIC, if we

            were doing it in the same way, but I'm

            not sure that that's what people are

            suggesting or assuming when leasing is
                                                                                       23

            being discussed.

                Sometimes leasing is definitely seen

            as something that is entirely independent

            of the registry, so the person holding

            the addresses should be able to just lend

            them out to a friend and do that without

            reference to the registry.

                Of course, that may happen.  It could

            happen.  We may not be able to stop that.

            That's black market, so let's say that's

            out of the realm of possibility.

                If we're instead considering the case

            that Geoff mentioned, which is that we

            want to keep the registry accurate in

            terms of who is registering the space,

            then a lessee, the person receiving the

            address space, would need to -- I always

            get those mixed up.

        >>Dean Pemberton: Yes, same here.

        >>Paul Wilson (APNIC): The person receiving

            the address space -- Craig can tell us

            the difference.

        >>Craig Ng (APNIC): Lessee.

        >>Paul Wilson (APNIC): The lessee is the

            recipient.  The lessor is the one giving
                                                                                       24

            the lease.

        >>Paul Wilson (APNIC): Okay.  So if we were

            going to be doing it in accordance with

            the need for registry accuracy, then the

            registry needs to be involved.

                Now, if we at APNIC were to start

            recognizing leases and registering those

            leases, then they would look like

            transfers and I would suggest that if we

            were doing that without a demonstrated

            need requirement, then our policy system

            would become inconsistent with the needs

            based requirement that ARIN expects in

            order to transfer addresses

            inter-regionally.

                If we were to implement a leasing

            system that involved registration and we

            did not have a needs-based system, then,

            yes, I think we would be not operating

            a needs-based policy system and we would

            probably soon find ourselves unable to --

            under the current system, we would find

            ourselves unable to receive more

            transfers from the ARIN region.

                I think pragmatically, let's
                                                                                       25

            recognize that and talk a bit more

            specifically about what we mean when we

            are talking about leases, because I think

            if there's policy recognition that's

            needed, then those factors need to be

            included as well.

        >>Geoff Huston (APNIC): Geoff Huston, lessee.

        >>Dean Pemberton: Which one is that again?

        >>Geoff Huston (APNIC): Of my car, which is

            kind of interesting, because in some

            ways, you see what's going on is there's

            someone else who is the owner of that

            object and I pay them for full and

            untrammeled rights to use it for the

            duration of the lease.

                It looks like my car almost

            completely, but there is a relationship

            between the car titles office and the

            owner of the car that goes when I consult

            them, the leasing company owns my car and

            that's who is responsible, but when

            I manage to go just slightly too fast,

            down this open road very late at night,

            as far as the constabulary is concerned,

            that was my car and it's my problem.
                                                                                       26

            I park it somewhere, it's my car and it's

            my problem.

                Part of this issue in the registry,

            when we talk about leasing and when folk

            talk you can sublease already and it's

            just like an ISP assignment, that's not

            like my car.

                In my car, I have full use against

            sort of my peers and everyone else.  This

            is my address for most purposes.  The

            only difference is someone else, that

            leasing company, has that little

            ownership tag.

                In the registry, we always thought

            there was one relationship, the

            beneficial user, and of course with

            scarcity, we now start talking about

            owner and it's all the one thing.

                In leasing, what is trying to happen

            is we're trying to split those roles, the

            same as the roles have been split for my

            car.  One way is, as the lessee, I get to

            write on the car title, "I'm Geoff.  They

            own it, but I'm the current lessee."  So

            my interests are there in the title.  I'm
                                                                                       27

            not the owner, but I'm the current

            lessee.

                To my peers and the constabulary, it

            is my car -- damn it -- and I'm liable

            for it for that period.

                So that was sort of where I was

            thinking, when I see folk going, "It

            already happens and it's just fine",

            I think there is a difference there in

            the expectation of the lessee; at least

            as a car owner there certainly is.

        >>Dean Pemberton: Thank you, Geoff.

                I mean, there is a lot of analogies

            here.  Mortgagees and titles and that

            sort of stuff, you know, the bank has an

            interest there, the mortgagee has an

            interest there.  Yes, there's plenty of

            analogies, it's just whether which

            ones fit.

        >>Craig Ng (APNIC): Craig Ng, general counsel

            at APNIC.

                I want to talk about a similar thing

            as well, but I think kind of from a title

            point of view, I see APNIC's registry as

            a land registry system.
                                                                                       28

                In most countries that we live in, we

            recognize the system where the priority

            rests with the order of registration.

            When you are a lessee of a shopping

            centre like this, for example, you have

            every right that is given to you

            contractually by the lessor.

                The lessor derives the right from the

            land registry system.  You get

            a secondary right that is provided to you

            under contract, which means that your

            right is secondary to the first right of

            the registered holder.  If the registered

            holder goes and registers the land to

            a mortgagee later on, and your lease is

            not registered and something happens to

            the mortgage, then you get kicked out

            without any recourse.

                The same as this registry system, you

            rely on the original registration staying

            intact, complying with policies, and that

            nothing happens to it.

                So a registration system that could

            potentially be put in place is to have

            that order of priority to say that your
                                                                                       29

            rights are recognized and what those

            rights are, which is secondary to the

            primary right, to protect your existence.

                So that's one of the things I see.

        >>Dean Pemberton: Okay.  What you have just

            sparked off in my head with the primary

            right/secondary right and if the primary

            right holder takes out a mortgage and

            then can't fulfil it, then the secondary

            right holder gets kicked out, we have

            some policies about how we allocate

            address space.  One of them is needs

            based.

                So as a primary registrant, I have to

            kind of have a need for this address

            space and people have already said that.

            If my need for this address space is to

            pimp it out to other people that might

            have the need, is that violating the

            primary thing?  All of a sudden, I get

            kicked out and the address -- you know.

        >>Craig Ng (APNIC): I'll defer to my

            colleagues on that.  But a good example

            would be that the primary holder, so the

            registered holder of that resources goes
                                                                                       30

            into liquidation, so you get your right

            from the liquidator.

                So under our membership agreement, as

            soon as it goes into liquidation, your

            resources are -- we have the right to

            revoke it, with no question.

                If you get your contractual right

            from a company that is now in

            liquidation, doesn't matter what the

            liquidator promises you, you have a right

            to sue them for some damages, but that's

            not to be a lot of use if there's not

            enough addresses to go around.

                So the question about registered

            right is that if it's registered under

            Australian law and I think under the laws

            of many countries, then your right sits

            on top of any other rights that comes

            later on.

                So that really is a point I want to

            make, that registration might give you

            an -- depending on the policy

            discussions, if I lease a house for

            20 years, I don't have to register it

            under most countries' registry system.
                                                                                       31

            I have the ability to register it as

            a choice to give me further protection

            than an unregistered lease which in many

            cases has no effect, has no value, to

            someone who takes it without notice.

            That's all I want to say.

        <<Chris Grundemann: I want to comment.  There

            is a lot of talk about, like, what you

            just said that if my primary need is to

            hand the addresses out to others, I think

            that as long as the people you're handing

            them out to need them -- again, ISPs

            already do this today.  I can go to APNIC

            or ARIN or anyone who has addresses and

            any RIR that has addresses and say, "I'm

            turning up 5,000 new customers.  They're

            are all small businesses and I need to

            give them all a /24, so they can do BGP,

            so I need those addresses."

        >>Dean Pemberton: Okay.  Stop.  Yes, you are

            right.  They do that today.

                There's clearly a market need for

            these, clearly.  Should I be able to come

            to APNIC under the current needs based

            policy and say I have a need for a /8?
                                                                                       32

            Clearly I can find enough people out

            there that have a need for a /8.  I have

            a business that is going to lease out

            these /8s.  I clearly have a need for it.

                Should that be the same need as if

            I was going to be the traditional ISP?

            They might be the same; they might not,

            but I'm interested in your point of view.

        <<Chris Grundemann: I think that's exactly

            the nail I was trying to hit there, is

            that there needs to be a different

            measure, because today -- I don't know

            the APNIC policy as well as I know ARIN

            policy.

                For example, in ARIN policy, there

            was a cable policy that was cable

            Internet service, residential Internet.

            Basically, a brand new cable provider

            comes online.  Again, how do they decide

            how many addresses they need?  The way it

            is determined is by homes passed.  There

            is majors here with physical connectivity

            where you can tie the scale of the

            network to the representative addresses

            needed.
                                                                                       33

                Then once you build out, like for

            mobile providers, a lot of times you have

            to come back and say, "I have just turned

            up 10,000 subscribers in the last six

            months, so I can extrapolate that I'm

            probably going to turn up 10,000 in the

            next six months.  In that case, you have

            a reason to come back.

                Potentially, in a world where you

            have this address service provider, who

            doesn't provide connectivity but is only

            providing addresses, they could do

            this -- you know, you could look at

            a contractual basis, where I have

            contracts with X number of customers who

            have justified need for actual

            operational use of the addresses.  You

            could have a system that works that way.

        >>Dean Pemberton: You could.

        <<Chris Grundemann: In that system, I think

            there's some really interesting things

            that happened.

                For example, maybe equipment vendor X

            decides that they would like to be able

            to provide addresses along with their CGN
                                                                                       34

            equipment in a service contract.  So

            there's some things there that need to be

            looked at to see whether you want to

            allow them or not.  But I don't think you

            have to get rid of needs basis to do this

            and I don't think it has to be that much

            different than reassignments today.

        >>Dean Pemberton: Thank you.

        <<David Conrad: David Conrad, representing

            myself, which is my company, but

            whatever.

                So a couple of points.  One, a lot of

            this discussion seems a little odd to me,

            because we're talking about address

            space, like there is plenty of it out

            there that can be obtained by these evil

            broker type folks, which as far as I'm

            aware, isn't actually the case.  The free

            pool is empty and the address space is

            currently available, is what I termed in

            the past "allocated but unused".

                There's no particular incentive for

            the organizations that have that address

            space to do anything with it other than

            sit on it, in some ideal world, it would
                                                                                       35

            be nice if they gave it back, but the

            registries are not in a position to

            revoke that address space, because how do

            you demonstrate it's actually being used

            or not?

                So some of the discussion seems

            a little odd to me, simply because we're

            talking about a resource that has already

            essentially been consumed and there are

            entities out there who want to improve

            the efficiency of that consumed address

            space and we're arguing that they

            shouldn't be allowed because of the fact

            that they're not following rules that

            were created in a regime in which there

            was plenty of address space.

                The other thing that absolutely

            drives me crazy, is that -- just one,

            I only have one thing -- is that the

            original basis for the creation of the

            registry system was in order to

            accurately track the utilization of the

            resources, be it for ports or protocols

            or for OIDs, it was also true for

            addresses, and the registry system was
                                                                                       36

            not created to be a regulator.  It's

            a cooperative body that is aiming to

            provide a service to the Internet service

            providers of the world.

                One of the things I learned long ago

            in this region, there was a block of

            address space allocated for the use of

            Shownets by APNIC and we had a show

            I think actually here in Malaysia, that

            Telekom Malaysia was actually providing

            service for.  The show went, we moved on,

            needed to use that address space for

            another show, this time in Hong Kong.

                So went to the ISPs in Hong Kong and

            said, "Please route this /16."  The ISPs

            said, "We can't; it's already been routed

            by Telekom Malaysia."

                So we contacted Telekom Malaysia and

            said, "Hey, you know, APNIC here.  It's

            our address space.  Stop announcing it,

            so that we can have Hong Kong Telecom

            announce it."

                And they said, "No, we can't.  We

            have a contract with the conference

            provider and that contract takes
                                                                                       37

            precedence, because they're paying us,

            over anything that might benefit APNIC,

            who we don't really have a relationship

            with in this context."

        >>Dean Pemberton: It was a squatter.

        <<David Conrad:   Exactly.

                They were technically a squatter, but

            realistically, they're driving the show

            here.  They're the ISPs.  They're the

            ones who win.

        >>Dean Pemberton: Good point.

        >>Paul Wilson (APNIC): I'm not here to defend

            needs based or otherwise, but just to

            make some observations about what it

            seems to mean, particularly in the

            context of interregional transfers.

                So a needs-based system doesn't mean

            that if you have any old need at all, you

            can get address space.  Someone who came

            along to an APNIC Hostmaster and wanted

            to number their cats and dogs because

            they just wanted numbers, wouldn't get --

        >>Dean Pemberton: Crazy old cat lady.

        >>Paul Wilson (APNIC): It's a perfectly good

            need, of course, but they wouldn't
                                                                                       38

            get it.

                Even if they came along and said,

            "I've got an ISP idea.  I'm going to give

            a /24 to every customer as part of my

            sales pitch," that wouldn't be a need

            that would satisfy our rather analytical

            Hostmasters.

                So I think just someone having a need

            is obviously not enough, and so we did

            ask the question, when someone came along

            to us and said, "I have a need because

            I want to set up a leasing business, so

            I want to get some address space so I can

            lease it to other people."

                That need wasn't on the books either.

            That's only actually one case in which we

            have been asked about leasing, but we

            wouldn't be giving it to someone on that

            basis.

                Unless, perhaps, we had some policy

            that said, "Yes, that will be allowable",

            and within that policy, it might also

            still require that the ultimate users

            have their need assessed.  I don't know.

            There would be different ways to tackle
                                                                                       39

            it, but a need is not the same as another

            need; and let's just sort of be clear

            about this.

                This is about working out what needs

            we will recognize and so that the poor

            old Hostmasters back in APNIC have

            something that they can work with.

                One thing about this session that is

            a bit surprising is that there don't seem

            to be any of our friendly brokers here.

            Brokers aren't evil in the APNIC region.

                Okay.  We'll be hearing from you.

        >>Dean Pemberton: I'm hoping that --

        >>Andy Linton (NSRC): I just want to say,

            brokers aren't evil in the APNIC region

            at all.  We have a broker agreement in

            which brokers who we will sort of list

            and refer people to, actually sign the

            APNIC membership agreement, which brings

            them into the fold, in terms of

            obligations to comply with policies and

            so on.  We have six, I think, who have

            signed that -- eight now who have signed

            that agreement and we see them as people

            who can help our policies work.
                                                                                       40

        >>Dean Pemberton: Absolutely.

        >>Paul Wilson (APNIC): So if everyone is

            working in good faith, that's seems to be

            fine.  The reason I mention brokers is

            because we have been asked I think many

            times by brokers whether as part of what

            they're doing, they can do leasing

            arrangements and we have been asked often

            enough that we would like to be able to

            give them better answers than, no, but if

            the conclusion is that no is the answer,

            then we'll keep doing that.

                I know this isn't a policy discussion

            as such, but I had expected, actually,

            that this session would have one or two

            brokers who are interested in leasing and

            who would be interested to state the case

            and maybe as a prelude to a policy

            proposal.

        >>Dean Pemberton: Yes.  Certainly Skeeve was

            very vocal on list about this being

            streamed, so if I don't get at least one

            question from Skeeve, I'm going to be

            a little bit miffed.

                Hi, Skeeve.  Ask your question.
                                                                                       41

        >>David Huberman: I have a question for Paul,

            something we have talked a little bit

            about and you have just addressed.  Let's

            say David's company comes and submits

            a transfer request and I would like to

            become the registrant of a /10 currently

            held by telecom something or another.  My

            reason is because I want to lease it out

            to others.

                I'm doing this under the transfer

            policy, because as David very clearly

            points out, I certainly can't get it from

            APNIC.

                Approved or no under the current

            policy regime?

        >>Paul Wilson (APNIC): No.  The need that our

            Hostmasters are looking for in processing

            a transfer request is the same need they

            would have been looking for for someone

            who was after a /10 in the first place,

            prior to exhaustion.

                If you have a grand network and you

            really have a /10 need, then you are

            going to get a pre-approval for a /10 and

            you can go out and transfer one and it
                                                                                       42

            would be registered, because you got that

            approval.  But if you have a need that

            wouldn't have qualified for the /10, the

            hostees are not going to give you

            a pre-approval for a /10.  That's just

            the way they are told to do their work.

        >>Dean Pemberton: Correct me if I'm wrong --

            and we have enough policy people in the

            room that you are going to correct me

            pretty quickly.

                If you transfer addresses away from

            yourself, you're not eligible for any

            more allocations or any more transfers

            towards you?

                Am I smoking something?

        >>Sanjaya (APNIC): Well, yes.  As

            I understand it, there's a period that

            you cannot receive.  There's one year.

        >>Dean Pemberton: One lease per year from

            this leasing company.

        >>Sanjaya (APNIC): During the transfer

            policy.

        >>Dean Pemberton: Any more?  We kind of heard

            a little bit -- Paul was saying that

            there are some differences between this
                                                                                       43

            and transfers.

                A lot of our existing policy talks

            about transfers.  We have heard from

            Geoff that we really do need to keep the

            sanctity of the registry in mind.

                We have also heard that leasing is --

            not only is it going on now, but it's

            absolutely a thing that there is an

            expectation that the activity itself will

            continue.  What would the policies

            look like?

                From anyone, IP brokers, you know,

            what does the policy need to do, in order

            to make this better, safer, easier?

        >>David Huberman: The problem with that

            question, I think, starts with what Paul

            discussed with the dangers to the APNIC

            community of realistically tackling these

            questions without severing our ability to

            conduct inter-RIR transfers with

            a different registry which isn't

            tackling this.

        >>Dean Pemberton: Yet, because they will.

        >>David Huberman: Yeah.  Not to beat a dead

            horse or anything, but it calls into
                                                                                       44

            question the justification of the

            registry system, as it stands today.

                Because as David very clearly

            noted -- and he was there, he's that

            old -- the registries weren't created to

            be regulators, they were created to be

            the notebook.

                So it's a fascinating question.

            I don't know that it has good answers,

            easy answers, I really hope the community

            can talk and someone very, very much

            smarter than I can come up with a good

            answer, because I think the policies are

            holding the APNIC -- this community back,

            our community back very badly.

        >>Dean Pemberton: In what way?  How?

        >>David Huberman: Because I, as Microsoft

            Corporation, running a very, very large

            network, cannot easily get the addresses

            I need under the current policy regimes.

            There are artificial -- I don't want to

            say "artificial" -- there are explicit

            requirements for needs basis that I'm

            subject to in one RIR that hold me back

            because operationally, I don't really
                                                                                       45

            work that way, because every quarter, is

            its own year, you know what I mean?

        >>Dean Pemberton: No, I didn't hear that.

        >>David Huberman: Every quarter, every fiscal

            quarter is its own year.  I need a lot of

            addresses to deploy a lot of capacity and

            my ability to express that in

            mathematical terms that conform with

            policies of another registry, that won't

            be named but rhymes with "barren", is not

            possible.

                I loved it when the APNIC community

            said, "Look, these are assets and we're

            going to buy and sell them and we're

            going to do away with this silliness,

            because there's no addresses left from

            the registry, so let the market work."

                But we had to take that back because

            it wasn't practical to work with ARIN

            community which had a large source of

            unallocated addresses.

                That's the case today.  There's

            1.4 /8s available in ARIN.  You can go

            and get them right now.

        >>Dean Pemberton: Basically, it was
                                                                                       46

            a question of: what did you want, your

            principles or your addresses?

        >>David Huberman: Yes.  It's a difficult

            question, because we're held back by our

            beholdenness to other registries which

            have space.

                And we're not able to make policy

            that takes into effect the operational

            and market realities of 2014.  I hope

            someone has a good answer.

        <<Chris Grundemann: That's interesting.

            I had a point and it's more slightly

            based on those comments.  The thing I was

            going to say was I think that before you

            start deciding on what policy should look

            like to allow or disallow leasing, you

            need to decide whether or not there is an

            actual need for leasing that isn't met

            currently.

                What I mean by that is if an ISP is

            able to transfer addresses to themselves

            from someone else who has addresses and

            then give those addresses to their

            customers, is there a need for an address

            provider to provide addresses to those
                                                                                       47

            same customers?

                If the mechanisms are the same,

            either one has to go get the addresses

            from someone who currently has them,

            transfer them into their organization and

            then reassign them to customers --

            whether those customers get connectivity

            or not is really the only question there.

                So if someone who is providing

            connectivity can provide the addresses

            through the current mechanisms, is there

            a need to add this second party, this

            third party that could be an address

            provider solely?

                It sounded like David was kind of

            saying, "Yes, there is a need there."

            But at the same time, what I heard him

            saying was that he wants to remove the

            needs test, not necessarily remove or

            allow leasing.

        >>Dean Pemberton: I think in my mind, there

            could be a need there, because near the

            end of abundance and the start of

            exhaustion, we were operating hand to

            mouth, so the person you get your
                                                                                       48

            connectivity from doesn't have a bag,

            doesn't have enough addresses that you

            want, so the distribution of connectivity

            and free address space is doesn't overlap

            any more.  It used to, because if you

            needed more addresses from your

            connectivity provider, if they didn't

            have some, they came to the registry,

            some more came down, so address need and

            connectivity overlapped very well.

                Now the density and distribution

            doesn't.

        <<Chris Grundemann: I guess my point is that

            I don't know that discontinuity has

            happened.  Before, a service provider

            could get addresses for free from an RIR

            and hand them down for free to their

            customers.

                Now an ISP has to go to the transfer

            market to get addresses.  So they pay for

            addresses and then they may or may not

            pass that cost along.  They are obviously

            going to pass it along somehow.  They may

            or may not directly charge for those

            addresses.
                                                                                       49

                If you were to introduce an address

            service provider I'm calling them, this

            lessor, they would have to go through the

            same process.  The only difference is

            they don't have to have a physical

            infrastructure, so maybe they may have

            some flexibility there somehow, based on

            that.  Other than that, there's not

            a whole lot of difference there.  So I'm

            wondering whether the need for

            a no-connection lessor is really there.

            I don't know.

        >>Amy Potter (Hilco Streambank): Hi, Amy

            Potter, your evil broker.

                So at least once a month, maybe twice

            a month, I have people coming to me

            looking to lease something smaller than

            a 24, because they weren't able to get

            that space from their ISP.  We don't do

            that because there's not enough money in

            that small of a transaction for us,

            especially with all sorts of different

            things.

                I mean, just to respond to Chris'

            enquiry, yes, there are people out there
                                                                                       50

            that can't get the space they want from

            their ISP.

        >>Dean Pemberton: Thank you.

        <<David Conrad: I actually have a question

            that probably Paul will need to answer.

                I'm a little confused as to the --

            I understand the history, but just the

            understanding rationale.  There was

            a time when APNIC had a policy that was,

            shall we say, more lease oriented

            friendly and then there was a change and

            it appears that change was driven by ARIN

            requirements, is that a reasonable

            interpretation?

                Okay.  It involved the issue

            associated with inter-RIR transfers,

            right?

        >>Paul Wilson (APNIC): Yes.

        <<David Conrad: We are now in a world within

            say, I don't know, say six months, Geoff

            can probably give a more estimation, but

            within six months, ARINs will go into

            their equivalent of a /8.

                Whatever, the same concept.

                So what exactly does inter-RIR
                                                                                       51

            transfer mean in this context?

                If Jeff Schiller had a psychotic

            break and decided that MIT no longer

            needed an entire /8 and was willing to

            start leasing that out, but decided to

            use APNIC as their registry of record,

            how would that impact ARIN's -- I mean,

            I don't understand what an inter-RIR

            transfer actually is, I guess.

        >>Paul Wilson (APNIC): We don't have leasing

            at the moment, so if he wants to try and

            lease it out, I don't know what that

            means.  But a transfer is a transfer of

            registration and an inter-RIR transfer is

            one that happens between one RIR, where

            the registration was held, and the one

            RIR, where the registration will be held.

                I don't think it changes according to

            what status ARIN is in, not the way the

            policy is expressed or the way it could

            actually works.  Nothing changes, as far

            as we're concerned.

        <<David Conrad: So Jeff Schiller, network

            manager at MIT, decides he no longer

            needs, I don't know, a 12 out of a /8.
                                                                                       52

        >>Paul Wilson (APNIC): Right.  That would be

            good.

        <<David Conrad: And there is someone in the

            APNIC region who he makes an arrangement

            with regarding that 12.  The registration

            information, the Whois data associated

            with that would reside where exactly once

            that transfer is done?

        >>Paul Wilson (APNIC): If a transfer

            happened, that /12 was transferred from

            ARIN to APNIC in an inter-RIR transfer?

        <<David Conrad: No.  I'm saying Jeff Schiller

            has a /12 and he wants to register it and

            he goes to APNIC and says, "18, whatever,

            has now been assigned by me to China

            Telecom."  What would happen?

        >>Paul Wilson (APNIC): Sounds like a transfer

            to me.  Sounds like we would seek China

            Telecom's demonstration that they

            qualify, they can demonstrate the need

            for that transfer and if they do, then it

            would happen according to inter-RIR

            transfer policies.  They would end up

            being a registration in the APNIC

            registry for that block.
                                                                                       53

                Sanjay, am I missing something?

            I often do.

        >>Sanjaya (APNIC): There's another

            interpretation to that, actually.  Jeff

            can create, can SWIP, can make a /12 SWIP

            in ARIN's database and it would work

            just fine.

        <<David Conrad: I guess my question is: what

            if Jeff doesn't want to deal with ARIN,

            doesn't want to have any relationship

            whatsoever with ARIN?

        >>Dean Pemberton: Geoff is basically saying

            that because he's a legacy holder and he

            doesn't have -- Geoff is going to the

            mic.  I'll shut up.

        >>Geoff Huston (APNIC): We keep on saying

            Jeff Schiller and MIT.  Let's ignore

            that, because it isn't Jeff and it isn't

            MIT, blah, blah, blah.

                There is a pool of legacy holders,

            particularly in ARIN, who have not

            entered into any agreement with ARIN.

            Even though there have been attempts

            through various agreements to sign them

            in, they don't have a relationship.
                                                                                       54

                I think what David was postulating is

            that if one of these holders of these

            resources wishes to perform some kind of

            leasing -- let's just use the word

            "leasing" -- with a party here in this

            region and they want to appear in

            a registry as the primary operational

            contact, in other words, the other reason

            why people think the registry is useful.

            So these lessees want to actually say,

            "I'm the person you contact operationally

            about this address."

                The issue is: how does this happen

            when the original owner has no

            relationship with ARIN and does not want

            one?  So ARIN SWIP isn't an answer.  Here

            is this kind of legacy floating thing and

            there's a desire by many folk, if

            I paraphrase David correctly, to see that

            block in a registry.

                Right?  So there's this operational

            requirement, it would be good if, and

            there seems to be a bunch of policy that

            goes, geez, that's an amazing question,

            I wonder what the answer is.
                                                                                       55

        >>Paul Wilson (APNIC): I was going to give an

            easy answer, which is that the guy comes

            to APNIC and says, "Please register

            this."  The APNIC staff say, "Under what

            policy?"  He tries to explain.  We cannot

            answer.  We say, "You better make

            a policy proposal and explain to the

            community what you're trying to do,

            because we don't seem to be able to

            help you."

        >>Geoff Huston: Let me state my role here, as

            merely the interpreter of David.

        >>Paul Wilson (APNIC): I was talking to Jeff

            Schiller, actually.

        >>Wendy Zhao: Wendy Zhao, I'm with CNNIC,

            also I'm with APNIC.  I'm not wearing any

            hat, but I want to express something.

                First of all, for leasing, I'm not in

            favour or against this.

                To look at the two way, for leasing,

            actually, is a requirement or needs from

            the commercial respect, because at this

            stage, IPv6 hasn't been happening as we

            expected and we have lots of content

            providers don't have anything to do
                                                                                       56

            with IPv6.

                If someone wants IPv4 for their

            clients, they have to pay huge amount of

            money to buy the IPv4 blocks, but they

            don't know how long the IPv4 network

            last, so that could be quite a risk

            for them.

                In terms of buying them, they just

            rent them from someone, from the lessor,

            that will bring down their risk from the

            commercial wise.

                But to look at the other way is I'm

            kind of worrying about the Internet

            abusing, because as the ccTLD, CNNIC is

            the ccTLD of .cn, we have the obligation

            to deal with phishing.

                Let's say these things.  Someone,

            some bad guy, create tonnes of domain

            names to do phishing.  So what they do is

            they constantly need to change the domain

            name, so even know we got report from

            a user or from a company saying someone

            is create a fake website to phish my

            client and gain benefit.  So we go to the

            website, we identify that is a phishing
                                                                                       57

            website and we turn it down.

                But they constantly change the name,

            so even though we turn one name down,

            they change to another.  At this point,

            the real evil bad guy is IP address.

                I just check with some of the

            colleagues from here saying the operators

            normally don't deal with blocking IP

            address and we will taking longer time.

            But presumably, if we do some of the

            operators do, if they got report saying,

            this is bad guy, what they do is

            phishing, so they take IP address down.

                What the lessee can do is they only

            rent IP block, small part of IP block,

            /24, for only 10 days or five days.  So

            what they do is they constantly change

            the domain name and if the good domain

            name was taken down, they just change to

            another one.  But if someone take off

            their IP address, they change another IP

            address to create the fake phishing

            website.

                So that could be downside of the

            leasing policy.
                                                                                       58

                What I'm saying is, if we want to

            create a policy about leasing, we want to

            think both ways, especially we don't want

            the Internet to be getting even worse,

            even though we are trying to get better.

        >>Dean Pemberton: Thank you.  I mean, this

            goes back to something Geoff and I were

            saying years ago.

                Geoff asked at NZNOG, way back, he

            mused what the future sale price of a /24

            would be.  I quipped back that I wondered

            what the hourly leasing price of one was

            going to be.  I wish I had kept my

            mouth shut.

        >>Adam Gosling: I have a question from the

            Jabber.  Would it be possible that lease

            has a limit in duration and as such, does

            not need approval, but when the lease

            goes for longer than that time limit,

            normal approval by APNIC is needed?

        >>Dean Pemberton: Anyone want to comment on

            that?  I don't think it would be under

            current policy, but there would be

            a policy proposal.

        <<David Conrad: With regards to the previous
                                                                                       59

            comment, I guess one of the questions

            that always pops up is if you disallow

            a behaviour by policy, whether that

            actually causes the behaviour not to

            exist or whether it just becomes a hidden

            behaviour.

                So the advantage, one potential

            advantage of recording leasing even in

            situations where it is being done in

            a rapid fashion, to make life easier for

            miscreants and less easy for people

            trying to stop miscreants, is that you

            would actually have the registration

            information to try to track down said

            miscreants.  If you do not record that

            information, it is possible, of course,

            that the behaviour will stop.

                But I suspect, particularly given how

            profitable some of the miscreant

            behaviours actually are, that might end

            up being that you simply reduce the

            chances that you'll be able to track down

            the bad person doing whatever badness

            that they are doing.

        >>Dean Pemberton: One of the common threads
                                                                                       60

            that I'm hearing here is that we should

            be doing everything we can to make sure

            that there is an entry in a registry.

            Whether it looks the same as it does

            today, we should make sure that we know

            who the end user is.

                Whatever it looks like to get to

            there, there's a policy.  But that we

            should be doing everything we can to make

            sure that we know who's actually using

            the addresses for all sorts of the

            reasons that Wendy and David and others

            have mentioned.

        <<Chris Grundemann: I want to raise a point

            again that another piece of this, besides

            just the entry in the registry, is

            routing aggregation.  When I asked why

            would you need to lease, one answer was

            that there are folks that may want

            smaller than /24 blocks and they are not

            able to get them from their ISP and they

            would like to find them somewhere else.

                But if I lease you less than a /24,

            currently it's probably fairly useless to

            you if I'm not also providing you
                                                                                       61

            connectivity and routing aggregation

            service.  So that's interesting.

                Again, other than folks who may have

            addresses and aren't able to connect to

            the folks who want the addresses, they

            want to be able to lease their addresses

            out obviously, but on the demand side, is

            there an actual demand for nonconnection

            address leasing?  I still don't see that

            demand.

        >>Dean Pemberton: I had assumed that the

            people that wanted to come and get a /25

            didn't actually know what they were

            asking, in which case I have a 10-dot

            address that they can have.

        >>Geoff Huston (APNIC): Geoff Huston,

            old fart.

                There was this view that there was

            a thing that was scarce a long time ago

            and it was routing slots and we created

            address policies and really worked hard

            to try and make sure the routing table

            didn't explode in our face.

                What actually happened was of course

            that silicon grew at an amazing rate and
                                                                                       62

            the routing table didn't and it's kind of

            hard to think today that we have

            a routing problem.  In fact, there is

            none.

                In some ways, that whole issue of the

            tie-in has less of a relative importance

            than it used to, but that exposes

            something slightly different.

                When I look at the evolution of

            domain name registry, I see an evolution

            where the registry facilities map the

            folk who are listed requirements.  I can

            now buy privacy.  I can buy all kinds of

            things that weren't in the domain name

            registry of 1989.  They have evolved to

            meet the needs of the community that use

            the registry.

                One way of thinking about registry is

            policy enforcement tool and that's a kind

            of interesting view, but you're always

            going to test the acceptance of that

            registry because you're actually testing

            the acceptance of policies and you may

            not want to really test that.

                Because if folk walk away, you have
                                                                                       63

            a problem.

                The other way of doing this is trying

            to understand the folk who use the

            registry, as distinct from the folk who

            run it, what do they need today?  What

            are their requirements from registry?  In

            some ways, I'm not the right person to

            ask insofar as I'm part of the crew

            that's running it for some broader

            community of use.

                Shouldn't we be mindful of that

            evolving need of the users of that

            registry?  If leasing is part of the way

            addresses work, that's fine.  If folk

            wish to see the beneficial user of that

            address in a registry, maybe that's the

            real issue here, that they want to see

            that relationship expressed in terms of

            today.

                It's that tension between thinking

            the registry can enforce actions in the

            broader industry versus the registry is

            merely a servant of that industry and has

            to reflect current needs is part of the

            tensions we are seeing here.
                                                                                       64

                I think this is a really productive

            debate and a productive conversation,

            because hopefully it allows us who work

            on one side of this, the provisioning

            side, to understand what needs are as

            they evolve and that's the sensitivity

            I think that's helpful.

        >>Dean Pemberton: I mean, we have already

            heard from Amy that she has people

            approaching her wanting these sorts of

            things.  I was doing some work with

            a customer recently who is working to set

            up a large network that will need more

            than ...  They are writing the cost of it

            on the bottom line.  They have to buy so

            many routers, so many firewalls, so many

            of this, so many addresses.  It's just

            become the cost of doing business.

                Summing up, we have 20 minutes, but

            I see we have stemmed the flow of people

            running for the mic.

                So I had these three questions.

            I had, is this the same thing we have

            always done?  And what I'm hearing is no,

            that this isn't the same thing we have
                                                                                       65

            always done.  It doesn't look like an ISP

            doing an allocation to a customer.  It

            doesn't really look like a transfer

            either.  Paul made some really good

            points that if it's going to be

            a transfer thing, that the needs base

            might need to be thought about.

                There were some other points about

            this is just the same sort of thing, but

            there's some more needs based stuff

            there.

                I think we need to do some more

            thinking and clarification.

                Paul had a really good point as well,

            leasing, what does that mean?  We don't

            actually have a concept of what that

            means yet.  Maybe it's the right word,

            maybe it's the wrong word, but I think we

            have identified that there's another

            thing.  There's an activity that's either

            going on to a larger extent or wants to

            go on, but that it needs a definition

            around it.

                But I think ignoring the fact that

            it's existing at all is probably not the
                                                                                       66

            right thing to do.

                My second point was do we need policy

            change?  I'm hearing possibly, but

            somewhat around the fringes maybe, and

            I think it's going to happen organically.

            People are going to run up against not

            being able to do something and then we'll

            start to see proposals.  I wasn't

            necessarily hearing anything which said

            I need to put in a proposal to do

            this now.

                There was that kind of tension around

            we had this sort of policy framework,

            then we had to change it back, because

            ARIN isn't at the same place in the

            exhaustion timeline that we are.

                Then I had a question about is there

            a needs-based thing with leasing?  We

            talked a bit about that and almost

            uncategorically the answer was leasing is

            not the same need as other needs that

            Hostmasters put at a much higher level.

            There have been examples of people coming

            and saying I have a need for this because

            I want to lease it out and those people
                                                                                       67

            were not given that space.

                It doesn't have the same level

            of need.

        >>Adam Gosling: It's a comment from the same

            person, who was Olivia, regarding the

            need/demand for leasing, a company

            prefers to pay a regular monthly fee

            rather than buying expensive resources

            upfront.  From my point of view, we have

            some spare IPs, so I'm willing to make

            money by offering them for lease, but I'm

            not sure I will not need them back in

            three years from now, so I prefer to keep

            the ownership on them.

        >>Dean Pemberton: Absolutely.  We also had

            that point made earlier on that you're

            not quite sure what the future is going

            to hold, so the speaker here is saying,

            "We're not quite sure whether we are

            going to need them back."  Wendy was

            saying, we are not quite sure we are

            going to need them in a year, so maybe

            I need them now for some transition, or

            for carrier grade NAT, but in this

            perfect world, where IPv6 takes over
                                                                                       68

            everything, maybe I don't want them,

            maybe I don't want to buy them and pay

            the forever price.  Maybe I just want to

            pay the next little bit price.

                So, yeah, there's certainly some

            interesting things there.

                Did anyone have any other points, any

            other thoughts?  Has my summing up jogged

            anyone?

        <<Chris Grundemann: I just wanted to kind of

            zoom in on a little bit in your sum up

            there.  Throughout the conversation,

            I think there has been a little bit of

            conflation between leasing and needs

            testing.  I don't see that -- they're not

            the same thing to me.  I think that

            leasing -- whatever we call it, so

            temporary assignments of addresses, could

            or could not be held up to a needs test.

            You could potentially pass a policy that

            says leasing is okay, as long as the end

            user needs the addresses, has the need.

                So then again that need passes

            through, just like it does for an ISP

            today.  You could also contrarily say
                                                                                       69

            leasing is okay and you don't have to pay

            a needs test.  You could do either one.

            So I don't think that leasing and needs

            testing are tied together in any

            particular way.

                You could also remove needs testing

            altogether and still deny leases.

        >>Dean Pemberton: You could, yes.

        <<Chris Grundemann: I think they're

            completely separate issues in my mind and

            I think that there's been some conflation

            here.

        >>Dean Pemberton: Again that comes back to

            needing better definitions and better

            clarity around things.  Good point.

        >>David Huberman: I actually disagree

            a little bit, I think.

        >>Dean Pemberton: Awesome.

        >>David Huberman: Yeah, fight, cage match to

            the death.

        >>Dean Pemberton: Up on the stage.

        >>David Huberman: Leasing sounds to me like

            two things.  When I walked in here, I was

            entirely sure what leasing was; it was

            the movement of IP addresses from one
                                                                                       70

            company to another outside the registry

            system.  That's what I walked in here

            thinking.  You think that.

                People, I see, lease IP addresses

            today, they get these tranches of IP

            addresses from these large holders,

            from Jeff.

                You have lots of IP addresses.  You

            have millions.  You're IP.

                They get all these IP addresses and

            they lease them and it's not time boxed.

            It's not about, I'm going to do it, as

            Olivia talked about, for a year or two or

            three, because Olivia is like, I don't

            want to sell them to you, but I might

            need them back.

                I walked in here, from my experience,

            saying, "I'm going to do it because I can

            spend $100 million, lease a /9 and

            I don't have to deal with anything else.

            It's mine."

                To Craig's point, I'm actually giving

            them financial motivation to never go

            into default with the registry.  I'm

            going to pay you $100 million and if you
                                                                                       71

            can't keep -- if that's not motivation

            enough for you to stay not in default,

            well, you know ...

                But then, what I learned today was

            leasing is also something else.  Leasing

            is also about short term and I didn't

            know that.  That's very interesting.

                That's definitely something that if

            it's existing today, if it's happening

            today or if there's a desire for that,

            I think that's definitely something

            policy can accommodate and can

            accommodate quite easily, without

            interfering with inter-RIR transfers.

        >>Dean Pemberton: My nightmare scenario was

            carrier grade NATs, which is a plug for

            my session tomorrow morning --

        >>David Huberman: You are going to bring that

            up now?

        >>Dean Pemberton: Yes.  If I have a need on

            my carrier grade NAT during the busy

            times of the day, a whole lot of

            addresses at the front and during the not

            busy times of the day, less addresses at

            the front, why would I pay to own the
                                                                                       72

            addresses when I didn't need them?  Why

            wouldn't I just lease them for the hours

            that I needed them?  Yes, now it's real.

            Get to the mic.

        >>Geoff Huston (APNIC): Dean, do what

            you want.

        >>Dean Pemberton: I will.

        >>Geoff Huston (APNIC): And everyone else

            does too.  The question is not whether

            leasing is good, bad or anything else or

            whether it is feasible or not.  That's

            not for us.  In this room in this

            context, the question that I think is

            really germane here is: how should it

            best be reflected in registry?  I'm not

            making a judgment of, if we do this,

            leasing will or will not happen and

            somehow we're the gating function as to

            whether leasing and addresses happens.

            I don't believe we have that ability.

                Our arms aren't long enough to

            straddle that problem or that issue or

            that opportunity.

                That happens of its own momentum and

            it's own requirement and if you lease by
                                                                                       73

            the microsecond in your CGN and you have

            that much faith in routing, Dean, put

            your money where your mouth is, mate.

                Because I think --

        >>Dean Pemberton: Someone will build me one.

        >>Geoff Huston (APNIC): But that's

            a different question to the question

            I think is really relevant here: what is

            the best way to reflect that kind of

            relationship with the addresses in

            registry?  We have gone through some of

            these issues of SWIP, we have gone

            through some of these issues of counter

            title or current beneficial owner, do you

            annotate the registry listing?  And it's

            those kinds of questions that I think

            should be phrased not as what's best for

            registry, but what's best for users of

            the registry.  What do they want to see

            when they look it up?  What works for

            everyone else?

        >>Dean Pemberton: What are some ideas about

            that?  What will it look like?  What does

            it need to look like?  What does it not

            need to look like?
                                                                                       74

        >>Geoff Huston (APNIC): Folk want to see in

            operators who's currently responsible for

            that address.

        >>Dean Pemberton: What does "responsible"

            mean?

        >>Geoff Huston (APNIC): The person you call

            when they're doing weird things.  The

            contact point, the abuse point, all of

            that contact information that we try hard

            to make sure are currently maintained,

            because folk want to use them.  IP

            addresses from your AS are giving me

            hell.  Who do you call?  Ghostbusters or

            what's in registry?

        >>Dean Pemberton: As long as the person is

            being irresponsible with them, I don't

            need to change the registry.  Because if

            I'm the last responsible party and I'm

            only leasing to irresponsible --

        >>Geoff Huston (APNIC): I could ring you up

            once an hour to say, "Great job, Dean,

            keep it up," but you would get annoyed

            with me.  You only want to hear from me

            when something is going wrong with

            addresses where you have an operational
                                                                                       75

            responsibility or accountability.  The

            registry is a good place to do that.

            Folk use the registry for that.

                But I'm not one of these folk who use

            it.  All the rest of these are.

        >>Dean Pemberton: Now we have a mic

            full again.

        <<Chris Grundemann: There's another piece of

            this, as far as registry data and what

            it's used for.  I think Geoff points out

            that the main use is -- maybe not the

            main, but the primary use, I think the

            more often use is operators trying to

            contact operators to say, "Something bad

            is going on with your IPs.  Take care

            of it."

                In that case, you can debate where

            that point of responsibility should land.

            In some cases the ISP should be the one

            answering the phone and the end user

            should not.  Because the end user may not

            know what's actually going on; their

            consultant is out that day.

                There is another side of this, which

            is the responsibility from a legal aspect
                                                                                       76

            of who's actually using the address

            because if the registry information is

            three hops up because that's the

            technically responsible person, and I'm

            a law enforcement officer and I contact

            that ISP and I need to go through

            whatever legal process to be able to

            contact them and ask for information and

            they give me the next one down and then

            I go through another process legally to

            get information on who they handed that

            address to and so on and so forth and it

            delays that response.  Whereas if there's

            a registry that says, "This is the

            technical contact and this is who is

            actually using the address," then when

            I'm looking at it from a legal

            perspective or a perspective of I really

            need to contact the user and it doesn't

            matter who's technically responsible --

            there's two pieces of information you

            need.  You need technical responsibility,

            the abuse contact, but you also need to

            know who's using the address.

        >>Dean Pemberton: That's a good point.
                                                                                       77

        >>Craig Ng (APNIC): I can't believe I'm

            agreeing so much with Geoff today.

            I think breaking records.

                I have an interest in registry being

            accurate.  So I suppose the question

            I have is for you: assuming that leasing

            is accepted as a way of doing things,

            whether there is a place in the registry

            to record the leasing arrangement?  And

            the second follow on question is: what

            are the benefits to that registration?

            What are the incentives if you register?

                In the land context that I gave

            before, registration gave you priority as

            against subsequent claims or other

            unregistered claims.  Really, what is the

            incentive for registration?

        >>Dean Pemberton: That's a good point,

            because some of the benefit to APNIC

            membership now is the registration.

                What if I could get my APNIC

            registration from someone else at

            a cheaper price?  Why would I still need

            to pay my APNIC membership?

        >>Izumi Okutani (JPNIC): I also echo about
                                                                                       78

            the idea of making sure we have the

            accurate registration of who is

            responsible for that space, it's

            important.

                But this argument about allowing --

            is it called SWIP?  Reassignment.

                If we make it the same, then I tend

            to get a little bit confused about if the

            person who's leasing, who's renting the

            address space, further makes customer

            assignment, then that really makes it so

            who is really going to be responsible,

            because it could be very possible that

            you run ISP and running out of address

            space.  But you weren't able to find

            somebody who is able to receive or who is

            able to transfer and sell you the address

            space.

                As Wendy pointed out, you might not

            want to make the business decision to buy

            or pay a large amount, so you want to

            see, let's see how things go for the next

            three years.  Then you want to make

            further assignment to your customers,

            then that really complicates things.
                                                                                       79

                It really probably goes back to my

            original point, that it's important that

            we get things registered on who is

            responsible, but I really don't want to

            make it called leasing and so make sure

            the ISP who has exchanged the leasing

            contract is the one who's registered as

            the recipient of the space and then do

            further assignment or whatever manner to

            make the clear-cut responsibilities.

        >>Dean Pemberton: Yes, subleasing.

        <<David Conrad: Another way that it might be

            interesting to view this particular

            problem with regards to database, Whois

            Database accurate registration database

            accuracy, is in the context of the users

            of the database and what they want that

            data for.

                So if you make the assumption that

            the registration database is a tool to

            enforce policy, that means that you're

            implicitly assuming that everyone agrees

            with that policy.  Since there's no other

            way to get information about whether or

            not the data is accurate or inaccurate,
                                                                                       80

            the only data that's by definition in the

            database is accurate and does not

            necessarily reflect reality, reality is

            what you perceive it to be.

                One way of potentially addressing

            that would be to tag particular entries

            as within policy or without of policy.

            For those members of the community who

            agree, who believe the policy is

            appropriate and do not want to do

            business with people who violate that

            policy, they could, through the glories

            of RPKI or some other technology, SDN or

            make up anything you want there --

        >>Dean Pemberton: That hurts, man.  Come on.

        <<David Conrad: Could filter out the prefixes

            that are tagged as being outside of the

            policy, but would give those who believe

            that the data should reflect reality, the

            ability to make use of the data.

        >>Dean Pemberton: Potentially, the registry

            could be the sum total of everything we

            know, but there could be a little

            endorsed by APNIC policy flag on that as

            well.  That's an interesting point.
                                                                                       81

                Have we anything else from remote?

                No?  Okay.

                Anyone want to have a final stab at

            the mic before we call it?  I think it

            has been really useful.  We certainly do

            need to look at some more definitions

            around this.  Just short-term versus

            long-term and the fact that it's both.

            Interesting.

                All right, if everyone is finished,

            I think that was really useful.  Thank

            you very much for your time.  Thanks for

            coming along.  Thanks for being so

            animated and contributing.

        APPLAUSE