It's a fundamental concept in network communications: A message has at least one sender and one receiver. On the Internet, in order for web browsers everywhere to find a user's desired content, something more than an URL is needed: a globally unique identifier called an "IPv4 number" that maps the domain name to the hosting web server. Each website, smart phone, DSL router, and tablet must be assigned one of these numbers in order to reach other devices or content on the Internet. When an IPv4 number (or "number") is assigned to a particular device it becomes an "IPv4 address" (think millions of "Internet homes" sprouting up every second on the web as each device powers on). Crucially, however, only a little over four billion IPv4 numbers are available in the communications protocol (TCP/IP). This means that at any given point in time only four billion simultaneous IPv4 addresses can be routed on the Internet. With today's multiplicity of Internet-connected devices per person, that number is clearly not enough. While the Internet is theoretically limited in size by its four billion-address threshold, its actual growth, appears to have no end in sight.
Naturally, the question emerges: How have users, past and present, obtained these numbers? Certainly, users like you and me obtain these numbers from our Internet service providers (ISPs: i.e., Comcast, our enterprise networks, etc.). The question is better understood from the ISP or enterprise perspective: How do network access providers obtain their IPv4 number distributions?
In the early days of the Internet, universities, corporations, and ISPs were given large sets of numbers by the National Science Foundation or its agents, without restrictions or contractual agreements. ("Hey, Bell Labs, here are 16 million numbers for you to try our new toy we're calling 'NSFnet.'") These early IPv4 numbers are now referred to as "legacy IPv4 numbers" and those who hold them are known as "legacy holders."
Today, however, the process is much more formal. ISPs obtain their numbers from five globally-separated "regional Internet registries" (RIRs) by entering into contractual agreements concerning a certain number range called a "block." RIRs were formed starting in the mid-1990s and today serve as the main source of IPv4 number blocks while also maintaining directory databases somewhat similar to the root domain name servers, ensuring that no IPv4 number is assigned twice. In other words, the core responsibility of RIRs is to process requests from ISPs for IPv4 numbers and to ensure the global-uniqueness of assigned IPv4 numbers through the operation of the RIR number registries. In North America, the registry performing this task is the American Registry for Internet Numbers (ARIN), incorporated in Virginia as a business league in 1997. The other four include LACNIC (Central and South America), AfriNIC (Africa), RIPE (Europe), and APNIC (Asia-Pacific). ISPs having received their IPv4 numbers from RIRs are referred to as "non-legacy holders."
A close analysis of the legacy and non-legacy holder dichotomy reveals an unsettled and widely divergent legal landscape with respects to the rights of these actors over their IPv4 numbers. Two key questions serve to frame the inquiry. First, what legal rights do early (legacy) holders have in their numbers (the answer affects approximately 1.9 billion numbers or 44 percent of the total IPv4 number scope)? Second, what legal rights, if any, do RIRs have over the numbers themselves and where do RIRs base their authority to assign IPv4 numbers to those that request them?
Further compounding the complexity of issue is the urgent reality confronting ISPs the world over: The supply of available IPv4 numbers has been exhausted. RIRs have announced that, in light of current demand, they have only a few months' worth of unallocated IPv4 numbers. This raises the very real scenario that in a short time anyone seeking to connect to today's Internet will be unable to do so. Network engineers and international telecommunications standards committees have been forecasting this IPv4 exhaustion doomsday for well over a decade. Extensive work has gone to cement next generation technologies such as "IPv6," which will greatly expand the size of the available number inventory. Unfortunately, at last count, less than 1 percent of all Internet traffic worldwide is IPv6. Indeed, many of today's devices - especially those running older hardware and software - are incompatible with IPv6. Bridging IPv4 and IPv6-enabled communications requires a great deal of engineering effort, and this translates into a greater financial burden in the form of hardware and human capital expenditure for those attempting to bridge the number gap.
Consider the following scenario: With a set of legacy IPv4 numbers larger than it currently needs and motivated by a market created due to IPv4 scarcity, Enterprise A elects to lease or sell its IPv4 numbers directly to Enterprise B, a corporation that foresees significant growth in its global network footprint. This marketplace interaction is difficult (if not impossible) today, given the restrictive covenants and policy positions of the various RIRs. Instead of a normal process whereby a seller and buyer engage in private negotiations and thereby define the terms of an IPv4 sale and subsequent agreement, RIRs have sought to place restraints on transfers of non-legacy, and even legacy, IPv4 numbers, insisting on being officious intermeddlers in the business affairs of private and public entities alike. In fact, the RIRs themselves have no legal claim of right over legacy IPv4 numbers, and the restrictive framework that now exists will undoubtedly erode, eventually to disappear. Indeed, the current unworkable RIR policies and registration contracts belie the marked potential for the monetization of IPv4 numbers (both legacy and non-legacy) and the next form of generation of intellectual property assets.
The Nortel Sale - A New Paradigm
In a recent blow to the current RIR policies, Nortel Networks, whose U.S. subsidiary was incorporated in Delaware, filed a voluntary bankruptcy petition in the United States Bankruptcy Court for the District of Delaware under Chapter 11 of the U.S. Bankruptcy Code. Nortel made the decision to treat its IPv4 numbers as an asset and listed them for sale.
Indeed, in late 2010, Nortel began actively marketing its legacy IPv4 numbers. Interest in the IPv4 number assets was strong, with more than 80 potential purchasers identified and seven bids officially submitted for either all or part of the legacy IPv4 number blocks offered for sale. Pursuant to its fiduciary duty as debtor-in-possession, Nortel selected the "highest and best offer for the assets," an offer submitted by Microsoft Corp., with subsequent negotiations resulting in a final agreement to sell all of Nortel's legacy IPv4 numbers. The purchase agreement called for the sale of 666,624 numbers for $7.5 million, a price of $11.25 per number.
After the bankruptcy court ratified the agreement, however, ARIN sought to intervene and submitted "informal comments" to the buyer, Microsoft, which resulted in an amended and restated asset sale agreement between Microsoft and Nortel. Nortel submitted the amended agreement to the bankruptcy court, implicitly calling on the court to decide whether the IPv4 numbers constituted assets capable of being alienated in the same manner as tangible or other intangible assets are disposed of during bankruptcy proceedings. The court ratified the sale.
In the resulting order, the court recognized Nortel's property interest in its legacy numbers. The court held that Nortel had an exclusive right to use the legacy numbers. The court also explicitly sanctioned Nortel's exclusive right to transfer its exclusive right to use the numbers. In recognizing Nortel's exclusive right to use legacy IPv4 numbers, the court implicitly found that Nortel had the exclusive right to possess the numbers themselves. Consequently, Nortel could exclude others from possession and use of the same legacy IPv4 numbers. In other words, the court found Nortel possessed the customary "bundle of rights" commonly associated with the ownership of tangible or intangible property.
The court's opinion (In Re: Nortel Networks, Inc. et al., D. Del., Case No. 09-101138 (KG)) constitutes an important first step towards the full recognition of a legacy holder's property rights in their IPv4 numbers. After In re Nortel, legacy holders can likely succeed in making the case that they, like Nortel, have the exclusive right to transfer their right to use legacy IPv4 numbers. This is effectively the legacy holder's legal right to dispose of its property (the IPv4 numbers) by transfer or sale. By finding that Nortel had all of the rights appurtenant to property ownership in its legacy IPv4 numbers, the court paved the way for future bankruptcy debtors to treat IPv4 numbers as assets that can be offered for sale.
A Deterrent to Marketplace Interaction
Today, ISPs cannot provide Internet access to their downstream customers (i.e., home DSL users) without first themselves accessing the RIR's registries. (For a more in-depth discussion of antitrust issues in the context of RIRs see Rubi, Ernesto M., "The IPv4 Number Crisis: The Question of Property Rights in Legacy and Non-Legacy IPv4 Numbers," 39 AIPLA Q.J. 477 (Fall 2011)). To comply with the various technical imperatives of network routing, including global uniqueness of each IPv4 number advertised, each ISP must check that the numbers received from their network neighbors do in fact belong to the network (AS number) from where they are being received. To do this, they turn to the RIR's registries. However, being listed on the RIR's registries is not free and accessing the registry's listings has many strings attached.
RIRs require ISPs seeking non-legacy numbers to execute a Registration Services Agreements (RSAs). Only when this agreement is signed do RIRs issue the IPv4 numbers to the registrant from their respective "unallocated number pool" and proceed to register the numbers in its registry. Likewise, RIRs will steer legacy holders into a Legacy Registration Services Agreements (LRSA). The key, however, is that both LRSAs and RSAs are contracts containing clauses purporting to extinguish any property rights (and therefore limit the use and transferability) of legacy and non-legacy IPv4 numbers alike.
LRSAs purport to reaffirm the RIR's control over legacy numbers obtained and used by the registrant prior to the RIR's own existence. Further, LRSAs purport to extinguish a priori unencumbered legacy IPv4 numbers' property rights. They do so through the incantation a "No Property Rights" clause, ostensibly forcing legacy holders to give up claims to title and other interests in exchange for registration services from RIRs. To be sure, the identical "No Property Rights" clause is found on both the LRSA and RSA. North American legacy holders, faced with ARIN's LRSA, are presented (and expected to accept, without revision) the following provision:
Legacy Holder acknowledges and agrees that: (a) the number resources are not property (real, personal, or intellectual) of Legacy Holder; (b) Legacy Holder does not and will not have or acquire any property rights in or to any number resources for any reason, including but not limited to, by virtue of this Legacy Agreement or the prior issuance of any number resources to it or any access or use thereof by Legacy Holder; (c) Legacy Holder will not attempt, directly or indirectly, to obtain or assert any patent, trademark, service mark, copyright, or any other form of intellectual, proprietary, or property rights in any number resources in the United States or any other country; and (d) Legacy Holder will transfer or receive number resources in accordance with the Policies.
See www.arin.net/resources/agreements/legacy_rsa.pdf. The impact of agreeing to such a broad limitation is potentially catastrophic in the face of today's IPv4 number scarcity, the potential property rights legacy and non-legacy holders alike hold in their numbers, and the dearth of authority on the issue of just what legal rights RIRs have, if any, over both types of IPv4 numbers. It is clear that both legacy and non-legacy holders forego their IPv4 number property rights at their own risk.
To be sure, ARIN's LRSA and RSA remain untested in court. However, even a cursory analysis of both RSAs and LRSAs reveals that they are vulnerable to attack under multiple contract theories, including the likely contention that both are nothing more than illusory contracts. Indeed, ARIN's (and the RIR's) apparent promises have qualifications and limitations so strong (and reserve such wide discretion) that they negate the promises contained in the contract itself. See Restatement (Second) of Contracts §77. ARIN, as apparent promisor, makes no binding commitment at all. In short, through the RSA and LRSA, RIRs retain an unlimited right to determine the nature or extent of its performance.
Crucially, in the case of non-legacy holders, the RIRs reserve the right to revoke IPv4 number allocations and registration services, but make no mention of providing prior notice. For example, if ARIN determines (and it's unclear how the determination takes place) that a registrant's numbers are not being used in compliance with the terms of the RSA or LRSA, then ARIN reserves the right to revoke and reclaim the numbers from use. (Just how ARIN would "revoke" IPv4 numbers remains to be seen). RIRs also retain the option of discontinuing their performance at their complete discretion. Thus, taken to their logical conclusion, these RSA and LRSA clauses would afford RIRs the private law right to revoke a block of IPv4 numbers and extinguish the Internet presence of private and public actors alike (not even Apple or the U.S. Department of Defense would be immune), for a petty failure to pay the RIR the "yearly renewal fee" of a few hundred dollars.
A Post-RSA/LRSA World
A recent development lends weight to the proposition that the RIR's authority and that of the RSA and LRSA contract is eroding. In a letter dated August 30, 2012, Lawrence Rudolph, general counsel for the National Science Foundation (NSF), formally addressed a request by a private enterprise for guidance concerning its rights to a block of legacy IPv4 numbers. (A PDF version of the letter is available at http://bit.ly/TP8SaA). The request was directed at the NSF, given its stewardship of IPv4 numbers at the very early stages of the Internet. While declining to directly provide legal advice to the private entity, Mr. Rudolph succinctly described the early stages of IPv4 number allocations, painting a picture of the pre-RIR landscape that reveals the recognition by U.S. government entities that IPv4 numbers are "a thing of value." ("NSF transferred 'a thing of value' to the awardee . . . and that awardee in turn gave it to you.")
Importantly, the NSF's letter confronts the latent concern of legacy IPv4 number holders that RIRs, such as ARIN, may be able to "unilaterally reclaim" early number allocations (legacy blocks) and unequivocally rules out such a scenario. In doing so, Mr. Rudolph casts serious doubt on ARIN's authority to issue or enter into RSAs and LRSAs by explicitly stating: "The NSF has never had a cooperative agreement, or any other agreement, with ARIN or any other similarly situated entity." In what is a crystal clear "emperor has no clothes" moment, Mr. Rudolph states: "In short, NSF does not believe that ARIN, or for that matter any other organization [RIRs] could retroactively affect property and rights distributed to you (or any other recipient) by awardee NSI under its Cooperative Agreement with the [NSF]." To be sure, the NSF's letter is not binding legal precedent but it clearly lends support and the U.S. government's imprimatur to the emerging trend that property rights exist in IPv4 numbers ("they are a thing of value"), and casts doubt on the RIR's ability to be the self-appointed arbiters of all things IPv4 - in fact, careful readers will no doubt interpret the letter as an invitation to probe the RIR's legal authority to require RSAs and LRSAs and as a challenge to the monopolization of the IPv4 number allocation and registration function.
Indeed, recognizing property interests in IPv4 numbers and discarding the cumbersome and restrictive RSA and LRSA model would help nascent global enterprises and emerging economies gain a foothold in the ever-growing Internet arena while creating a global marketplace for IPv4 numbers where the monetization of these assets would be possible. The open exchange of legacy and non-legacy IPv4 numbers would allow developing nations and their Facebook-thirsty netizens a viable path to bridge the digital divide. By providing underserved new entrants with enough IPv4 numbers to connect to the current Internet while the necessary investments for IPv6 deployments are worked out, IPv4 markets can promote uninterrupted economic growth. The alternative - curtailing IPv4 number transfers - would provide post-exhaustion IPv6-only entrants access to no more than 2 percent of today's Internet, while forcing them to adopt untested and newer (more expensive) hardware and software. The advantage of an open exchange of IPv4 numbers also goes beyond the financial implications of such transactions, and extends to a basic benefit of Internet connectivity: The emergence of a social and business fabric of innovation and advancement.
The recognition of IPv4 number ownership is inevitable and beneficial. RIRs should not be allowed by their members, or non-members, to stifle competition or delay this inescapable reality. In re Nortel, the Microsoft/Nortel multi-million dollar transaction, and the recent NSF general counsel's opinion letter suggest that legal, business, and government interests are aligned in recognizing IPv4 numbers as property and classifying them as outright assets. In the coming post-exhaustion world there will be an unquestionable need to produce new entrants to the Internet landscape. The best solution is to allow IPv4 number holders to freely alienate their number assets. It is time to call these "holders" by the correct title - "owners." Ownership will also likely lead to a more robust global network by promoting the stability of the worldwide Internet, creating incentives for owners of IPv4 numbers to closely monitor and regulate global routing advertisements, and preventing today's frequent address hijackings. As we move forward, large Internet stakeholders such as ISPs, enterprises, and universities will surely recognize their IPv4 numbers as assets. Given the inescapable size limitation on the current IPv4 Internet and the slow adoption of next generation technologies such as IPv6, the conclusion is evident: IPv4 numbers must be free from their static bounds. The world.com depends on it.