Battle begins over IP address WHOIS data

A few days ago ICANN quietly posted this letter from David Holtzman of Depository Inc. to ICANN CEO Rod Beckstrom. The letter, dated January 27, has gone almost totally unnoticed, but it is important. It means the first warning shots have been fired in a prospective litigation duel between ARIN, which is the IP address registry for North America, and a company positioning itself to compete with ARIN in the provision of certain IP address-related services.

ARIN is refusing to allow a new company to get bulk access to its Whois records. What is at stake here is the control of IP address Whois data – or more precisely, whether ARIN owns this data and can withhold it from other organizations in order to maintain exclusive control over certain services.

ARIN does allow organizations to get bulk access to its Whois data. Its policy for distributing the data says that it is for operational or research purposes and cannot be used for “advertising, direct marketing, market research or similar purposes.” Depository Inc. submitted a Bulk Whois Data Request Form to ARIN on November 30, 2010. Two weeks later, ARIN sent a short email denying the request, claiming that Depository's attempt to mirror ARIN's Whois database was inconsistent with its acceptable use policy. On December 17, Despository Inc. replied and challenged ARIN's interpretation of its policy. ARIN replied with a longer letter saying that “creation of a duplicative registry does not facilitate internet operations…” and claimed that it “is not authorized” to provide Depository with bulk access.

Depository Inc. is now accusing ARIN of anti-competitive behavior and is asking ICANN to intervene. It wants ICANN to withhold all IP address allocations from ARIN in order to pressure it to provide the bulk access. It also copied the U.S. Commerce Department and the Antitrust Division of the U.S. Department of Justice. It is clear from other writings from Depository's CEO that Depository Inc. views ARIN and other RIRs as “registries” analogous to domain name registries, and believe that the registry and registrar functions can be split apart in order to foster competition in “post-allocation IP address registration services.” Thus, the ARIN-Depository showdown is reminiscent of the clash between the old domain name
monopoly Network Solutions, Inc. (NSI) and the companies trying to
become competing “registrars” back when domain name registration
services were a vertically integrated monopoly of NSI.

My judgment is that ARIN's refusal to supply this data is intended to discourage what it calls “duplicative” services, and that it is concern about the change in IP address industry structure, not any violation of the AUP, that motivates their denial. It is unclear yet how much of a threat, if any, Depository, Inc.'s prospective competition wold pose to ARIN's – and other RIRs – business model. But it is a discussion we will need to start having.


6 comments

  1. Anonymous

    Milton –
    There is indeed a very important discussion that needs to occur regarding this matter. I note that ARIN was formed during the same period that for-profit DNS registry/registrar framework was being developed. This was no coincidence; the operator community wanted the continuity of the not-for-profit IP registry system with its community developed policy & management rather the uncertainty associated with the emerging commercial DNS registry system. ARIN, along with the two other Regional Internet Registries (RIR) at the time (RIPE NCC and APNIC) have not only fulfilled this address management role, but have worked together to encourage and help form additional RIRs in LACNIC and AfriNIC as soon as the community in those regions expressed the desire and ability to support these operations.
    Today, the Regional Internet Registry system is supported by more than 10,000 member organizations globally, and collectively (via the NRO) the RIR system serves the function of the Address Support Organization in ICANN's Bylaws. The parameters of the RIR System, including the requirement for open and transparent policy making, are well-described in the ICP-2 global policy (http://www.icann.org/en/icp/icp-2.htm) which was adopted by the community in every region as well as by the ICANN Board. While other structures for the Internet number resource registry system are possible, it is important that the same global community have a chance to fully participate in the discussion of any proposed changes.
    In the meantime, the Regional Internet Registry system will continue provide global management of IP address space with a focus on conservation, accuracy, and aggregation, as these properties are necessary for Internet growth and stability. ARIN doesn't recognize a “commercial IP number registry” because the community doesn't recognize such, and hence a special dispensation for access to ARIN's WHOIS database would be inappropriate. If the structure of the Internet number resource registry system should change with the support of the global operator community, then ARIN will make appropriate arrangements as necessary since ARIN is focused on the accomplishment of its mission for the community, and not any particular business model.
    The change actually being proposed (that of commercial IP number registries) is beyond that of a single region, and interconnected nature of the Internet only emphasizes the need for worldwide open and transparent dialogue if we're indeed running the Internet via democratic participatory principles.
    /John
    John Curran
    President and CEO
    ARIN

  2. Anonymous

    John – I am confused by the use of the term “community”, would you please define this?
    Peter Thimmesch
    Chairman
    Depository, Inc.

  3. Anonymous

    Mr. Curran,
    I welcome your call for a constructive debate, to that end here is my contribution:
    At the outset, we must properly frame the issue in its rightful context. Although the overarching question presented is: “Can ARIN deny a Bulk Whois Data Request made pursuant to ARIN's AUP by an entity that seeks to use it for internet operational purposes?”, I submit there are several underlying issues that are subsumed by the larger point.
    First, the question must be asked: Is there a legal difference between the transferability of non-trademarked domain names and the transferability of IP addresses? Richard Jimmerson, an ARIN representative, answered: “No Comment” when I posed the question a few weeks back, I suspect the real answer is that there is little, if any, difference between these two concepts. Your response to Dr. Mueller's original post seems to distinguish the DNS registry/registrar framework and the IP registry system based on the “uncertainty associated with” the then-emerging DNS registry system. There is much evidence to support the assertion that from both a legal and technical standpoint the DNS registry system is well-established. Legally, of course, domain name case law is voluminous and the statutory framework here (US) and abroad provides the requisite 'certainty' to which both registrant, registrars and third parties can look to when trying to ascertain their rights and responsibilities in arm's length dealings. Technically, the myriad DNS assignments and transfers of domain names that occur everyday provide further concrete proof that no 'uncertainty' can be said to exist in the DNS registry system. Consequently, if the original rationale/impetus for treating the DNS registry/registrar framework differently than the IP registry framework was 'the need to avoid the uncertainty associated with the emerging commercial DNS registry system' – with said uncertainty being removed – the rationale no longer applies.
    Second, RIRs such as ARIN have developed policies such as the Bulk Whois Data Request AUP through the oft-cited 'open and transparent' policy making mechanism. Depository's request for bulk Whois data has as an intended use “directory mirroring”, arguably an “internet operational” purpose, within the bounds of the AUP policy approved by the 'community.' ARIN, however, disagrees.
    By disagreeing, ARIN usurps the fiduciary role it purports to have with respect to said 'community' because ARIN is acting as judge and jury in interpreting the language of the AUP (let alone its other policies). A community must have not only a voice in enacting policy, but in interpreting and applying such policy, and ARIN quashes that voice by denying Depository's access to the bulk whois data. This is especially so because Depository represents at least part of the same community ARIN claims to represent (i.e. operator community). Because at least part of said community has signed contracts with Depository for services, ARIN's denial of access to the bulk whois is in effect a denial of part of the operator community's wishes. Thus, it is easy to see that at least part of the 'global community' which makes up the RIR's so-called constituency is in disagreement with ARIN's interpretation of the AUP, because their contract with Depository is signed in consideration of the services Depository is to provide – services which cannot be provided unless bulk whois access is granted.
    Given the foregoing, it is hard to make the claim that “the community doesn't recognize a commercial IP number registry.” Such a chimerical 'community' cannot be yielded as the proverbial 'stick' – conjured up to beat back the advances of competing or novel enterprises. I submit that the 'structure of the Internet number resources registry system' *has* changed, with support of at least part of the global operator community – those who have a contractual relationship with Depository. Yet ARIN has not made 'appropriate arrangements' to align with the demands of at least part of the Internet operators it is bound to assist.
    Until it does so, ARIN risks defending an untenable position: The needs and desires of part of a community must be overlooked and must yield to the inertial views of those who wield power and authority. That is precisely what our system of laws is designed to prevent.
    Ernie Rubi

  4. Anonymous

    Mr. Rubi –
    A wonderful monologue, but ignores the fact that there are existing forums in regions as as well as ICANN itself in which a proposal for changes to the framework of the Internet registry system should first be discussed. To the extent that “it is time” for the Internet number resource registry system to evolve, then there should be international discussion of the new framework, including appropriate mechanisms for involvement of all under multistakeholder principles. I would look forward to seeing such a proposal and hearing its merits compared to the present system, as I expect many others would as well.
    At present, however, the Internet community has an established framework for the Internet number registry system, and it is well-defined by the ICANN global policy ICP-2. It includes not-for-profit regional registries with non-overlapping service regions. Whether this necessarily the best model for the future is certainly subject to debate, but let's actually see a proposal for the alternative and have that debated via open and transparent processes.
    /John
    John Curran
    President and CEO
    ARIN

  5. Anonymous

    While many arguments, at high and low levels, can and do swirl, as we see in the above comments – when we look with some perspective, I believe one issue overarches, to inform the policy making: that is the issue of community, and the role of profit-making business within it (where 'business' is often framed as “competition”).
    While 'business,' and so competition, have a role, that role is subsumed within the larger gathering of all the humans involved – the community. Is that observation so elementary as to be empty? Not when it becomes clear that some functions of the community are _overturned_ and crippled by introducing competition. Some functions – such as, for instance, a single root record resolvable worldwide – require consensus across the entire body politic. Competition, in the case, would be a 'fool's errand.'
    Western, and especially libertarian ideology, have trouble with this proposition. So do all those who would like one more place to make a buck. But the reality is that human beings are most quintessentially social animals. They operate _only_ within a social context.
    It is the nature of the bully to try and take advantage – and of those exercising natural greed, with a profit motive, to ignore the social imperatives as they would try to lever the 'natural monopoly' function of some community requirements.
    Instead of deifying competition – our Asian counterparts are already showing the West that a more complex understanding will prevail against simple-minded 'competition' as a guiding totem – we need instead to understand the social context more completely.
    In the case in hand, the RIRs have understood, to a fare-thee-well, the responsibilities that burden a true 'public service.' They have operated with a profound understanding of community, writ large. Clearly, they are capable of evolution, when indicated – that, after all, is the truest test of a community's sound behavior, that is, the ability to change as indicated.
    But evolution does not mean destroying the community service, when that continues to require a single point of consensus. Most decidedly, that does not include genuflecting to those who may prefer to try and make a new dime on the community coat tails and at its expense.
    David Allen