Getting “Feisty?” ARIN claims ownership of IP address registration data

The Whois database shows which organizations have been assigned which Internet address blocks. Maintaining that registration data is the Regional Internet Registries’ most important function. For many years, ARIN has made all of its Whois data available in “bulk” form for “Internet operational or technical research purposes.” Now, suddenly, without any bottom-up policy change, ARIN has unilaterally changed the terms of the Bulk Whois contract. As they said in a July 11 email to current users of bulk Whois,

 …a new Bulk Whois Terms of Use (ToU) agreement that replaces the existing Acceptable Use Policy (AUP). …In order to retain your access to the Bulk Whois service, ARIN kindly requests that you sign and submit the new ToU and return it to ARIN within 30 days of receiving this email.

The new ToU can be found here. In those new terms of use, ARIN requires users to

…acknowledge and agree that ARIN has been and shall continue to be the sole and exclusive owner of: (i) the Bulk Whois Database; (ii) the Bulk Whois Data…

This sudden claim of ownership is doubly ironic. First, ARIN’s staff and board have insisted repeatedly that users of IP addresses have no property rights in the address assets their networks depend on. But apparently, it is OK for ARIN to claim ownership of the data that users submit to them as part of their IP address registrations. Second, the change was made unilaterally by ARIN staff and without any policy making process. Given ARIN’s claim that its decisions are all legitimated by “the community” and its bottom up policy development process, this change is interesting. Note that only 9 years ago, ARIN did hold an open policy making process on Whois Acceptable Use and Bulk Access. So apparently, what was a policy issue in 2003 is no longer a policy issue.

Why is this happening? The hidden agenda is apparent to anyone following the debates on ARIN’s public policy mailing list (PPML). ARIN has been trying to discourage or even punish legacy holders from selling or transferring address resources outside of its own controlled system, as Microsoft and Nortel did last year. Because ARIN has no contractual authority over legacy holders, the only form of influence or power it has is the Whois database. By unilaterally asserting property rights over the Whois database, ARIN probably hopes to bolster its attempt to shut out market transactions that go outside its own transfer mechanisms.

Critics of the new terms of service say that ARIN cannot have a copyright in the Whois database. They cite the precedent-setting U.S. Supreme Court decision  Feist Publications v. Rural Telephone Service, 499 U.S. 340 (1991), in which a telephone company tried to assert ownership of the information in a telephone directory. The Supreme Court told the company that you cannot copyright facts, and that directory listings were facts. Legal critics also protest ARIN’s use of a contract to unilaterally change the applicable law.

It is likely that this event is related to ARIN’s denial of bulk access rights to address brokerage and potential competitor Depository, Inc. Depository appealed that decision to ICANN. And yet, neither ICANN nor the U.S. Commerce Department have given any indication that they even understand what these issues are about and how high the stakes are, much less know what to do about them.