"According to ARIN's policy, the seller comes to them and signs an LRSA, and then ARIN confirms they are the legitimate owner of the address block. ... Then the buying party is supposed to sign a standard RSA. This buyer is also supposed to go through a formal needs assessment by ARIN. Nothing like that happened in this case," Mueller says. "Nortel completely refused to sign any contract with ARIN, and Microsoft signed an LRSA, not an RSA."
Mueller guesses that Microsoft signed an LRSA under pressure from ARIN because "it doesn't cost them a lot. It weakens their rights a tiny bit, but it keeps ARIN happy and it keeps the registry whois database intact. I bet they wanted to appear that they are not total renegades.''
Lawyers say the Nortel/Microsoft deal demonstrates that legacy IPv4 address sellers that haven't signed an LRSA or RSA don't need ARIN's approval to sell their IPv4 address space. But they say Microsoft's decision to sign an LRSA makes it unclear whether buyers of legacy IPv4 address space must agree to ARIN's terms.
"What's not clear from this is what would happen if a legacy IPv4 number buyer decides not to voluntarily agree to enter into an RSA or LRSA with ARIN," Lindsey says. "In my view, applying the reasoning in the [bankruptcy judge's] order, a buyer would obtain all of the exclusive rights of the seller free of any of ARIN's policies. ARIN could not assert authority over those numbers to revoke or reassign them, but ARIN could refuse to update its records, including the whois database.''
Curran says ARIN won't update the IPv4 address entries in its whois database when a trade occurs that isn't in compliance with its transfer policies. He points out that more than 10 IPv4 address sales have followed ARIN's policies in the past month, even though the Nortel/Microsoft deal has gotten all of the press.
"We have had more than 10 other transfers happen, and all of them have been where the seller has come to us with the buyer," Curran says, adding that all of these transfers have happened in the last month. "The precedent is in the other direction. All of those [address blocks] were transferred in compliance with our requirements."
The reason some legacy IPv4 address sellers don't want to follow ARIN's transfer policies is that ARIN requires buyers to demonstrate "need" for IPv4 address space just as they would for a regular IPv4 address allocation. Critics see this as an unnecessary condition on the sale.
"I've been warning the [regional Internet registries] that they need to set up a very open market exchange system, and the overriding policy goal was to make sure people that had addresses and wanted to get rid of them could do so easily and quickly, and people who wanted addresses could be able to get them straightforwardly," Mueller says, adding that he has "never been a big fan of the needs assessment."