Summary

  • On 18 September 2026, ARIN’s Board voted 10–0 to approve the Registry Control Plane project and authorize the CEO to contract for it within a $5 million limit, requiring a drawdown from long-term reserves.
  • The project follows a December 2025 error in which a /24 and its ROA were removed from the original holder’s records. The Board had earlier commissioned an audit against ten future-facing criteria, but the reviewed public minutes do not disclose those criteria or a result-by-result acceptance test.

Five million dollars is a clear number. A corrected registry is a harder thing to count. ARIN’s trustees have authorized up to the first; the public record should now make the second testable.

The 18 September Board minutes record a 10–0 vote to approve the Registry Control Plane project and direct the CEO to contract for its fulfillment with a $5 million limit. The resolution says it will require a drawdown from long-term reserves. Staff described an 18-month schedule, and the CEO explained why an October start needed a full-period authorization rather than monthly decisions. The motion authorizes a ceiling. It does not report a signed price, a withdrawal or work completed.

The reason for urgency is not hypothetical. ARIN’s December 2025 incident report describes a /24 incorrectly removed from its original customer and reissued to another during a 4.10 allocation. The original registration and ROA were deleted; the inaccurate state lasted about seven days until the customer reported it. ARIN did not receive a technical impact statement from that customer. The error still shows why a registry’s internal business rules matter: one mistaken change can carry through registration and routing-security records before anyone outside notices.

In the draft minutes of 18 August, staff said an external auditor had checked the current system against ten future-facing criteria set by the Board, marking each pass or fail. Trustees asked for milestones, deliverables and regular reporting. Staff proposed a later audit after the redesign. The public minutes do not list the ten criteria or their baseline outcomes. A reader can therefore follow the authorization but cannot yet follow a criterion from failed control, through paid work, to an independently checked improvement.

The money has other jobs. At ARIN 58, the treasurer’s official financial report recap put investments at $38.5 million as of August 2026, against a $26.0 million target operating reserve. It also reported a $0.5 million year-to-date operating deficit and a plan to cover interim annual deficits from investments while aiming for balance by 2030, including yearly Registration Services Plan price rises of up to 5%. August’s balance is a snapshot before September’s authorization, not a record of project spending. It shows why a reserve-funded project needs a result the members can inspect: the same pool supports continuity, deficits and strategic repair.

ARIN’s choice of delivery model also has consequences. The September minutes say Chris Tacit questioned the narrower vendor field created by requiring on-site staff. The CEO answered that registry-error risk and integration with existing developers required that arrangement. It may buy tighter coordination. It also makes the project’s value depend on what the integrated team can demonstrate, rather than on the comforting appearance of engineers in the same room.

The test should begin with the failure ARIN itself described. Can a single authoritative business-rule layer prevent a resource from being reissued while its holder record and ROA say otherwise? Can a high-risk change produce a durable before-and-after receipt, independent approval and a fast rollback? The ARIN 57 transcript records CEO John Curran identifying multiple systems acting directly on the database without common rules in one place. Those are useful acceptance questions drawn from ARIN’s own diagnosis, not a claim about the final design.

A project report can announce code shipped, milestones met and invoices within the cap. A registry-control report must go further: publish a versioned set of tests, the baseline result for each, the remediation, the retest and the remaining exceptions. ARIN need not expose sensitive security details to show that the same risks were measured twice. The public criteria crosswalk, contract and disbursement figures would change the present assessment.

The Board has made the capital decision. It now needs a receipt for the control decision. A reserve is saved for days when continuity matters; spending it on the ledger makes sense when the ledger demonstrably becomes harder to corrupt and easier to restore.