Are your IP assets truly yours? Understanding control gaps in RIR allocations

Imagine that your company has paid for an IPv4 block and built services around it. Customers connect to those addresses, engineers maintain the routes and partners have approved them in their security systems. Yet a different organisation maintains the registration record that other organisations consult. What, exactly, does your company control?

The question becomes easier when you separate three things: the commercial agreement for the addresses, the records describing their use and the network that carries the traffic. They interact, but none is a substitute for the other two.

Start with the service people depend on

An IPv4 address helps other systems find a service. An address block is a group of those addresses. Once customers put them into firewalls, monitoring tools or application settings, changing them can require work far beyond the company that operates the network.

Suppose a hosting company moves a customer's service to another provider. Copying the application may be straightforward. Preserving the address, updating routing arrangements and helping the customer's partners recognise the change are separate jobs. A completed purchase does not perform those jobs automatically.

This is why control should be tested through a real change: can the business keep serving people when a supplier changes, a record is disputed or the person managing the account leaves?

The recordkeeper and the operator do different work

A Regional Internet Registry, or RIR, maintains records for Internet number resources. A network operator builds and runs the systems that use them. A registry entry does not build a data centre, connect a customer or maintain an application.

Registration nevertheless matters because other organisations use records when checking an address block's history and the parties responsible for it. That reliance gives the recordkeeper practical influence. The question is how far that influence should extend.

Our position in Note 72 is clear: keeping a shared record must never become ownership of the activity it describes or power over its participants. Records should make relationships verifiable. The people building the network must remain in control of their work.

We stand for coordination that serves participants. A coordinator should earn their trust through useful work, not permanent dependence.

A routing check answers a narrower question

Consider a route-origin authorisation, commonly called a ROA. It connects an address prefix with an autonomous system number, the identifier of the network authorised to originate that route. Other networks can use it when checking a route announcement.

The IETF's origin-validation specification defines Valid, Invalid and NotFound results and leaves routing policy to the receiving network. This check does not decide who owns a business, settle a commercial dispute or validate every part of a route's path.

A conflicting authorisation can affect how networks treat an announcement, depending on their policies. That makes authorisation records important to continuity. It does not turn them into an unlimited judgement about whether a company is entitled to exist.

Find the points at which someone else can interrupt continuity

Take one block your business uses and follow it through the operation. Who maintains its registration contacts? Who can change its routing authorisations? Which upstream networks carry it? Who has the evidence needed to resolve an inconsistency? Who will answer when a customer cannot connect?

The answers may involve several organisations. Put the responsibilities together rather than assuming that a purchase agreement covers them all. Keep the resource history, working contacts and change procedures usable by the people who actually maintain the service.

In Note 66, we put continuity at the centre of the transaction. A transfer can close on a particular day; keeping the resource useful remains the job the next morning and every day after it.

Make the administrator replaceable

We want coordination that preserves uniqueness and verifiable history while making the administrator replaceable. Participants should be able to check the facts and keep using their resources when the coordinator changes. Their operations belong at the centre of the system.

The work is concrete: carry the evidence forward, maintain interoperability and keep services running through the change. That is how freedom to choose a coordinator becomes meaningful in practice.

Trace the dependencies that shape your business, then insist on continuity through change. We believe the Internet grows stronger when coordination serves its participants. Read Lu Heng's proposed rights for uniqueness coordination.