Summary

  • Land title registration, deeds recording and private title insurance are different institutions. Treating them as one analogy conceals who verifies history, what the public register proves, who absorbs residual loss and which law supplies the remedy.
  • The strongest transferable lessons are a durable chain of changes, authenticated authority, visible priority, bounded dispute states, additive correction and compensation when reliance on an inaccurate record causes measurable loss.
  • The analogy fails at the subject matter. Land is a rivalrous physical parcel located within one sovereign legal order; an IPv4 prefix is a globally unique numerical range whose registered holder, route origin, service location, RPKI authority and operational user can be different parties.
  • The analogy also fails at the institution. HM Land Registry's authority and indemnity arise from legislation and public finance. An RIR service region is an administrative arrangement, not a jurisdiction that gives the registry territorial title over address use.
  • The right design is title assurance without title mythology: preserve history, publish precise status, verify authority, separate registration from routing, compensate attributable record error, support portability and leave commercial use to operators and applicable law.

Begin by separating three institutions that are often collapsed

"Title system" can refer to several different arrangements. A deeds-recording office receives and indexes instruments. Its archive helps a searcher reconstruct a chain, but recording an instrument does not necessarily make every assertion in it conclusive. A title-registration system gives the register a stronger legal effect. The state defines what registration does, which interests bind despite omission, how priority works, when a mistaken entry can be altered and who bears loss when correction cannot restore everyone to the position they expected.

Title insurance is different again. A policy allocates defined residual risks between an insurer and the insured. In the United States, the Consumer Financial Protection Bureau distinguishes a lender's policy, which protects the lender's interest, from an owner's policy, which protects the owner's equity. The insurer is not simply the public recording office under another name. It searches, underwrites, excludes, prices and promises payment according to a contract.

This distinction matters before anyone compares these institutions with an RIR. A transfer-history archive resembles one part of a deeds system. A registry statement that one organisation is currently recognised resembles one feature of title registration. A promise to compensate a buyer for a specified defect resembles insurance. None automatically entails the others.

Loose analogy lets advocates choose whichever feature is convenient. A registry may invoke the authority of a state title register when defending its record, then invoke the narrow liability of a private information service when the record is wrong. A broker may describe diligence as title insurance even though no regulated insurer has accepted a defined loss. A buyer may treat a public registration as a guarantee of routing or legal ownership that the record never supplied.

The disciplined question is not whether IPv4 is "like land." It is which institution performs which assurance function, under which authority, for which risk.

The English register shows what statutory assurance actually requires

England and Wales provides a useful modern comparator because its current framework is anchored in the Land Registration Act 2002. Section 58 gives registration a powerful legal effect: if a person is entered as proprietor of a legal estate, the estate is deemed vested in that person even if it would not otherwise be vested. That effect does not arise from the persuasiveness of a database. Parliament created it and surrounded it with rules on priority, alteration, possession, objections, adjudication and indemnity.

The same legislation refuses the fantasy of an infallible record. Schedule 4 permits alteration to correct mistakes, bring the register up to date and remove certain entries. Rectification - correction that prejudicially affects a registered proprietor's title - receives special treatment. A proprietor in possession has protection unless consent, fraud or lack of proper care, or injustice changes the balance. Schedule 8 then creates a right to indemnity for specified losses caused by rectification or register mistakes.

HM Land Registry's current rectification and indemnity guide makes the allocation visible. A person may be compensated even when the agency did not cause the mistake and even when nobody was at fault. Fraud and lack of proper care by the claimant can defeat or reduce recovery. Courts remain available when entitlement or amount cannot be agreed. Rights of recourse allow the public guarantor to pursue a responsible party in defined circumstances.

This is assurance as an institutional package. The register's legal effect, the limits on correction, the compensation fund, the court and the public authority fit together. Removing any one element changes the meaning of the rest.

The package is not cheap rhetoric. HM Land Registry's 2024-25 annual report describes more than 27 million titles covering over 89 percent of the land area of England and Wales. It recorded GBP 6 million allocated against roughly 750 indemnity claims during that year. Assurance has an accountable fiscal surface. The institution estimates future claims, records payments and stands behind error with public money.

An RIR that borrows the register's authority without identifying an equivalent legal basis, correction balance and loss-bearing mechanism has borrowed only the prestige.

The first useful lesson is a history that survives the current entry

Land transactions are path-dependent. A current proprietor may derive title through a sale, gift, inheritance, merger, court order, insolvency disposition or correction. The immediate name on the register matters, but the documents and events that explain how it arrived matter when authority is challenged. Serious assurance therefore preserves enough history to reconstruct the legally relevant changes without forcing every later user to depend on staff memory.

IPv4 registration needs the same discipline. Old address space may have passed through corporate renaming, merger, liquidation, public-sector reorganisation, acquisition of a network business or a market transfer. The organisation that originally received an allocation may no longer exist. A technical contact may still possess credentials after corporate signing authority moved elsewhere. A group company may operate the network while another entity remains registered. A broker may possess transaction papers but no right to instruct the registry.

ARIN's current transfer guidance illustrates why chain evidence matters. For merger and acquisition requests it asks for instruments such as asset purchase agreements, merger documents, court orders or public filings. Where several transactions connect the old and new organisations, it requires documentation for each. The guide expressly describes the result as a clear audit trail showing the chain of registration.

That is the part of the land analogy worth keeping. Each material state change should have a predecessor, successor, effective time, authority basis and preserved evidence reference. A correction should add an event explaining why the prior state was superseded rather than silently rewriting the past. A transfer should identify whether it was an arm's-length transaction, a corporate-continuity change or a legally compelled disposition because those routes answer different authority questions.

History does not turn the registry into a court. It makes the registry's own recognition intelligible. If a private ownership dispute exceeds its competence, the record can show the last verified state, the existence and scope of a challenge, and the legally competent decision that eventually resolves it. The registry need not decide every right in order to stop erasing the path by which its own record changed.

History also needs an explicit evidential limit. A chain can show that the registry accepted a succession document without proving that every asset passed under the underlying transaction. It can show that an authorised account submitted a request without proving that the account holder had board authority to sell. It can show continuous routing without proving continuous corporate identity. Each link should therefore record the proposition actually verified: legal-name continuity, acquisition of a network business, court-directed disposition, holder consent, or completion under a specified transfer rule.

That discipline prevents a common confidence failure. When one old file contains weak evidence, institutions often compensate by making a stronger current declaration. The declaration does not cure the missing link; it hides it. A better record exposes the gap, states what later evidence supports, and lets a buyer or tribunal decide whether the remaining uncertainty matters. Clean chains should receive the benefit of their documentation, while incomplete chains should not be condemned by an unexplained adverse label.

History is therefore not a ceremonial list of former names. It is a set of bounded reasons for institutional recognition. The more valuable and portable the resource becomes, the more important it is that those reasons can be inspected without pretending that the recorder created the underlying commercial right.

The second useful lesson is correction joined to compensation

Any critical register will make mistakes. A forged instruction may pass. A valid instruction may be applied to the wrong range. A predecessor may be misidentified. A transfer may be recorded twice, omitted or reversed. The design question is not how to promise zero error. It is how to correct error without making reliance irrational.

Land registration offers a mature answer: correction and compensation are complements. Sometimes the record can be restored. Sometimes restoring one party creates loss for another who relied on the register. Sometimes the mistake remains because the law protects a registered proprietor in possession. Indemnity prevents every conflict from becoming a choice between preserving the register and abandoning the innocent loser.

IPv4 record error can create a different but equally real loss profile. A mistaken change may prevent a transfer from completing, impair a financing arrangement, move RPKI control, disrupt reverse DNS, confuse abuse contacts, trigger route filtering or force emergency legal and engineering work. It may reduce the market value of a block even if traffic continues. It may expose a seller to complaints after operational responsibility has moved. It may leave a buyer with payment released but no recognised registration.

An RIR should not insure every consequence of Internet use. Route acceptance depends on independent networks. Reputation lists, geolocation services, upstream filters and customer contracts sit outside the registry's control. But the institution should not use those external dependencies to avoid responsibility for the part it does control.

A bounded compensation rule would ask four questions. Was the recognised registration state wrong or changed through a procedurally defective registry act? Did a party reasonably rely on the relevant registry statement? Did that error cause a measurable loss within a published class? Did the claimant's fraud, credential failure or lack of proper care cause or enlarge the loss? These questions mirror the useful structure of land indemnity without pretending the losses are identical.

Control and liability should move together. A registry that insists its approval is decisive cannot describe its errors as informational trivia. A registry that wants minimal liability should reduce discretionary control and publish narrow, verifiable statements.

Even land registers do not prove everything about land

The comparison becomes more accurate when land registration's own limits are acknowledged. HM Land Registry's title plans usually show general boundaries, not the exact legal line. Its public guidance warns that red edging cannot be treated as identifying an exact boundary or ownership of a boundary feature. Interests can bind despite not appearing in the register. A mistake in a deed is not automatically a mistake in the register if the register accurately reflected the deed that was submitted.

These qualifications matter because the mythology of title is often stronger than the law. The public register is authoritative for specified propositions. It is not an omniscient description of every physical fact, private agreement, equitable claim or boundary measurement.

IPv4 records need the same bounded language. A record can state the organisation currently recognised for registration services, the prefix, status, predecessor event, service relationship, public contacts, transfer restriction and dispute notation. It can state whether RPKI service is available through the registry and whether a reverse-DNS delegation has been recorded. It should not silently expand those statements into a guarantee of legal ownership, worldwide route acceptance, customer location, reputation cleanliness, business authority or freedom from every third-party claim.

The lesson is therefore not "make the IPv4 register conclusive." It is "make each public statement precise enough that people know what they may rely on." Confidence comes from a strong boundary around the assertion as much as from the assertion itself.

The analogy first fails because land is territorial in a way IP use is not

A parcel is physically located. A national or subnational legal order can describe it, tax it, regulate it, adjudicate possession and enforce a judgment against parties and land within its jurisdiction. The registrar's map is tied to surveyed geography. The legislation's authority follows the state's public law.

An IPv4 prefix has no comparable situs in its technical operation. Its numerical range is globally unique, but packets addressed to it can be served from facilities in many countries. A holder can change upstream providers without moving the record. Anycast can announce the same prefix from multiple locations so traffic reaches different sites. A company incorporated in one country may contract with customers in another, host equipment in several more and receive registry services from an institution incorporated elsewhere.

RIRs have service regions. RFC 7020 describes five RIRs operating in continent-sized geopolitical regions because the registration function was distributed to regional bodies. That administrative history does not turn a service boundary into the location of the number resource. The same RFC notes that LIRs spanning multiple regions can have relationships with multiple RIRs. Its central technical concern is globally unique numbers, not territorial parcels.

The difference invalidates a common move in registry rhetoric. If land lies in England, English land law and its registry have an intelligible territorial connection. If an address block was originally issued through one RIR, it does not follow that all later use, value or transfer belongs permanently to that region. Origin in an administrative hierarchy is not territorial attachment.

Regional service may remain useful for language, time zones, institutional familiarity and distributed administration. It may support a manageable division of responsibilities. It does not make address capital regional soil. Any rule that restricts movement must justify itself through registration integrity or another legitimate competence, not through the unexamined metaphor that the addresses are land located inside the region.

A route is not possession, occupation or beneficial use

Land law can give physical possession a powerful role. Possession is observable, continuous in a spatial sense and capable of excluding others. The Land Registration Act's rectification balance pays special attention to the registered proprietor in possession because correction can remove a person from a home, field or business site they physically occupy.

Routing does not create the same relationship. BGP distributes routes through UPDATE messages. A route can be advertised, replaced or withdrawn. Each network applies its own selection and import policy. The origin seen in one observation system is evidence of a routing act, not conclusive proof that the originator acquired the registration right or that every network accepted the route.

Legitimate routing can also involve several actors. A customer may authorize an upstream or DDoS-mitigation provider to originate a prefix. A lessor may remain registered while a lessee operates services. A corporate group may centralize network announcements in one entity while another holds contracts. Anycast deliberately produces simultaneous origin from distributed sites. More-specific routes can temporarily direct part of a larger registered range differently.

Calling routing "possession" hides these distinctions. It may reward a hijacker for observable use. It may punish a holder that keeps a reserve unannounced. It may treat a service provider as owner. It may convert an operational delegation into a legal disposition that the parties never intended.

RFC 7020 supplies the decisive boundary. Whether addresses are announced and how they are advertised are operational considerations outside the Internet Numbers Registry System. The registry record and routing state should inform each other during fraud review and transfer diligence, but one cannot be substituted for the other.

Land possession helps law decide claims about a physical estate. Route observation helps operators understand reachability. They are not equivalent facts.

The prefix boundary is exact while its operational surface is fluid

The land comparison fails in an unexpected direction as well. A registered land plan can preserve deliberate uncertainty around a general boundary. An IPv4 prefix has an exact mathematical extent. A slash length identifies the binary range without a hedge, fence or survey tolerance. Two valid allocations should not assign the same address simultaneously to different parties in the same registry view.

That precision makes uniqueness easier to state and harder to preserve across fragmented records. A larger prefix contains many more-specific prefixes. A transfer may split a block. A route may announce only part. An RPKI authorization can permit an origin for a specified prefix length. Reverse DNS follows delegation boundaries that may need coordination. The exact numerical range is stable even while the operational treatment of its components changes.

Land systems are usually parcel-centric. They can subdivide or combine parcels through legally defined acts and maps. Address systems need an equally explicit parent-child history when ranges split or aggregate. A transferred more-specific should not appear as an unrelated new thing. The parent event, extracted range, residual range and effective time should remain linked so later users can understand why the current records add up.

This is another useful lesson corrected for the subject matter. The register should preserve exact resource topology and event history. It should not infer the current operational use of every address from the holder entry. A precise prefix boundary does not produce a precise map of services, customers or routes.

The legal source of registrar authority cannot be copied by metaphor

HM Land Registry is a non-ministerial government department administering a statutory system. Its decisions are embedded in public legislation. Disputes can reach a tribunal or court. Parliament defines the estate, the effect of registration and the indemnity. Public accounts reveal the financial consequence of the state-backed guarantee.

RIRs are not land departments for five continents. They have different legal forms, constituting documents, contracts, community processes and national homes. Their records have substantial operational and economic influence because networks, counterparties and security systems rely on them. That influence deserves rigorous accountability. It does not become public-law sovereignty merely because the resource is important.

This institutional difference cuts both ways. Critics should not demand that an RIR resolve every transnational ownership dispute as though it were a court with universal jurisdiction. RIRs should not impose territorial capital controls as though their service regions were states. Governments should not treat an address record as domestic land that can be nationalized by declaration. Operators should not treat private coordination as immunity from applicable law.

Authority must be attributed act by act. A corporation can bind itself through authorized representatives. A court can issue an order within its jurisdiction. A registry can maintain and correct the registration state under its agreement and published rules. A network can choose route policy. A security certification service can issue or revoke entities within its trust structure. No metaphor merges these competencies.

The land analogy is safest when it asks how a high-reliance record should be maintained. It becomes dangerous when it answers who is sovereign.

RPKI is not a digital title deed

RPKI can make the land analogy appear technologically complete: a cryptographic certificate seems like an official deed and a Route Origin Authorization seems like proof of authorized use. The standards reject that interpretation.

RFC 6480 explains that resource certificates attest to an allocation by the certificate issuer and support authorization, but do not attest to the identity of the subject. RFC 9255 makes the boundary sharper: RPKI credentials must not be used to authenticate real-world documents or transactions. Possession of access to the relevant certification service does not prove that the user is a corporate officer authorized to sell an address block.

RPKI is still important to assurance. A transfer that changes the recognised holder may require planned certificate issuance, revocation or ROA changes. A mismatch between registry and RPKI state can create risk. A buyer should know who can create or remove routing authorizations at each stage. The transition should avoid leaving the seller with effective security control after the buyer becomes registered.

But RPKI answers a bounded routing-authorization question. It does not establish private-law ownership, consideration, authority of a board, creditor priority or the absence of fraud. A valid ROA also does not force every network to accept the route. Relying parties validate data; operators decide how validation states affect local routing.

Treating RPKI as a title deed would therefore repeat the central error: a strong statement within one system becomes a universal statement outside it. The better design aligns the registration event with RPKI custody while preserving the difference between them.

The title-insurance label can conceal who actually bears loss

Insurance is not a synonym for confidence. It is a promise by an identified risk bearer to pay for a defined covered loss, subject to exclusions, limits, premiums, claims handling and solvency. If no entity has accepted that obligation, calling diligence "insurance-like" can mislead the party that needs protection most.

Private IPv4 transactions already create fragments of assurance. Sellers give warranties. Buyers conduct chain research. Brokers supply market knowledge. Escrow agents condition payment. Counsel issue opinions. Registries confirm a transfer. Each reduces a different risk. None necessarily pays if the recognised record is later reversed through registry error.

A literal title-insurance market could emerge, but it would need honest boundaries. Does the policy cover only authority defects in the historical chain? Does it cover registry refusal after closing? Does it cover legal costs, loss of market value or service interruption? Does it exclude route hijacks, sanctions changes, reputation listings and customer loss? What event triggers payment? Which law governs? Can the insurer pursue the responsible party?

Without answers, the analogy transfers trust without transferring risk. It may even strengthen the gatekeeper. An insurer could make coverage conditional on one registry's discretionary approval, thereby converting institutional uncertainty into a compulsory private toll. A registry could sell assurance over risks created by its own opaque decisions. Neither outcome follows from the useful land lesson.

The first priority should be primary institutional discipline: accurate records, verified authority, published status, corrections and registry-error liability. Insurance can cover residual risks after those duties are clear. It should not become a substitute for them.

Global use changes what compensation should cover

Land indemnity is often valued by reference to the lost estate, interest or charge and related costs. The loss is tied to a located asset whose market and legal environment can be identified. IPv4 error can propagate through a more distributed dependency chain.

Suppose a registry mistakenly records a transfer to the wrong company. The direct record error is simple. The consequences may include a suspended customer deployment, RPKI changes, rejected route filters, emergency letters to upstreams, reverse-DNS interruption, contractual claims, financing default or a forced replacement purchase. Some consequences are foreseeable and attributable. Others depend on independent choices and could become unlimited.

A credible compensation regime should define concentric bands. The first covers reasonable costs of correcting the registry's own record and restoring associated services it directly controls. The second covers documented transaction and financing losses that were reasonably foreseeable when the registry accepted the request. The third covers operational interruption only where a causal link to the erroneous registry act is demonstrated and mitigation was reasonable. Speculative future profit and unrelated reputation loss may need exclusion or a negotiated higher-assurance service.

Caps can be legitimate if they are transparent and proportionate to control. A low-cost record service cannot insure the Internet. But a cap should not be so low that the registry internalizes none of the risk created by a power to block, reverse or misdirect a high-value transfer. Different service levels may support different fees and assurance limits, provided a basic correction duty remains universal.

Contributory responsibility also belongs in the design. A holder that shares credentials, ignores a known compromise or supplies false corporate documents should not shift the whole loss. A registry that ignores contradictory evidence should not shift the whole loss to the user. A conveyancer-style identity standard, independent audit and published recourse rule can allocate responsibility without moral theatre.

Disputes should be recorded with narrower precision than a land caveat metaphor

Land registers use notices, restrictions and other entries to show interests or prevent disposition unless conditions are met. IPv4 records need comparable dispute visibility, but not every complaint should freeze a global network asset.

A dispute entry should identify its scope and effect. Is the challenge to corporate authority, historical succession, payment, operational use, a sub-range, a transfer instruction or the registry's procedure? Is there a court order, a voluntary lock, an internal review or merely an allegation? Which changes are paused? Which existing services continue? What evidence or decision ends the restraint?

This precision protects both claimants and operators. A credible forgery claim may justify pausing a transfer while preserving the last verified route-security and reverse-DNS state. A private payment dispute may belong between buyer and seller without changing the public record. A claim concerning one extracted range should not immobilize an unrelated portfolio. A court order should be represented according to its actual terms and jurisdiction, not expanded through institutional caution.

The land analogy is helpful here because visible caution is better than hidden discretion. It fails if the registry treats a caveat as ownership of the asset or assumes that every restraint should interrupt use. Land can remain physically occupied while title is disputed; networks also need continuity while claims are decided. The record should preserve the stable state unless a competent act requires a change.

Every dispute event should later close visibly. The outcome may confirm the current state, correct it, record a settlement or note that a claim expired. An unexplained warning that persists indefinitely creates a permanent discount and can become punishment without adjudication.

Portability, not territorial permanence, is the corrective principle

Land cannot move to a different national register while remaining the same land. That fact is so obvious that it often enters the IPv4 analogy unnoticed. A parcel stays under the law of its location. An address prefix has no equivalent physical attachment to an RIR service region.

This is where the analogy most directly misleads institutional design. If the first registry relationship is treated like the land's situs, transfer to another registration service looks impossible or illegitimate. The initial administrator becomes permanent because the metaphor made the resource immovable.

For number resources, portability is compatible with uniqueness if the old and new services coordinate one current state. The resource does not duplicate; its recognised registration service changes. The event must be authenticated, sequenced and reconciled so no two active records claim priority. History must travel with the resource. Open disputes and lawful restraints must not disappear. RPKI and reverse-DNS dependencies need controlled handover.

The Number Resource Society's public charter describes accurate registration, global unity and operator autonomy as central aims of a membership and advocacy organisation. Those are advocacy claims rather than proof that NRS operates a registry or that a complete portable service already exists. Their constructive implication is that an alternative should be judged by whether it can preserve one coherent history while allowing exit from a failing or unsuitable recorder.

Portability corrects the land analogy without discarding assurance. A strong chain becomes more important when a record can move. Common evidence standards become more important when several services must rely on one another. Compensation and audit become more important when responsibility crosses an institutional boundary.

The lesson is not that every holder should move. It is that administrative origin should not become territorial destiny.

A corrected assurance model has seven layers

The first layer is exact resource identity. Every event names the prefix and any parent or child ranges affected. Splits and combinations preserve mathematical continuity.

The second is authority evidence. The instructing party must be connected to the registered organisation or legally competent successor. Corporate authority, credential control and operational contact are treated as separate facts. A valid portal login is not presumed to be a power of disposition.

The third is event history. Allocation, succession, transfer, correction, service move, restriction and release receive durable timestamps and predecessor links. Sensitive documents can remain protected while their verification and legal category are recorded.

The fourth is bounded status. The public record says what the registration service recognises and what it does not certify. Current holder, service provider, transfer state, dispute state and relevant technical-service status use a consistent vocabulary.

The fifth is operational separation. Routing, RPKI, reverse DNS, IRR records, geolocation and reputation are shown as adjacent systems, not collapsed into title. Transition duties can be coordinated without claiming that one record controls every system.

The sixth is correction and remedy. Errors receive additive correction, reasons, notice, independent review and compensation for defined loss. Fraud recovery exists, but an allegation alone does not silently erase a final state.

The seventh is portability and reconciliation. A qualified receiving service can obtain the evidence needed to continue the record. The former service loses the ability to present itself as current after completion. Common audit tests detect duplication or gaps.

None of these layers requires a registry to own the prefix, regulate the holder's business model or police customer geography. Together they create stronger assurance than a broad title label because each reliance claim has a responsible institution.

The model should be tested against four hard cases

The first case is a forged transfer followed by rapid routing changes. The system should preserve the instruction, identity evidence, authentication events and state changes; pause further disposition; keep the last safe operational state where possible; obtain independent review; correct additively; and compensate an innocent party for covered registry error. Routing evidence is probative but does not decide title.

The second is a corporate succession with incomplete historical documents. The system should reconstruct each link, distinguish a change of name from an asset sale, publish a bounded pending state and identify the missing proof. It should not demand commercial terms irrelevant to authority. If the gap cannot be resolved, the uncertainty remains visible rather than being converted into staff folklore.

The third is an RIR failure during a pending inter-regional transfer. A complete history and portable evidence package should allow a receiving service or continuity arrangement to determine the last accepted state. The failing corporation's survival is not allowed to become a condition of the resource's continued registration. Reconciliation prevents duplicate completion.

The fourth is a court order affecting one party in a multi-country service chain. The registry records the issuing court, affected party, resource scope, operative terms and actions taken under applicable law. Other services make attributable legal decisions in their own jurisdictions. No one describes the order as global land law merely because the prefix is globally unique.

These cases reveal whether assurance is real. A decorative history page and a broad disclaimer will not survive them. Neither will a theory that gives one private institution unlimited discretion because somebody once compared its register with land.

Performance measures should expose both error and overreach

A serious assurance system should publish more than completed-transfer totals. It should report the age and disposition of correction requests, the number and scope of dispute holds, the reasons transfers fail, the incidence of later correction, and the time required to restore registry-controlled technical services after error.

Compensation data should show claims received, accepted, rejected, paid and pending, with values aggregated to protect confidentiality. Categories should distinguish registry error, fraudulent instruction, authority defect and external operational loss. Regress against responsible parties should be disclosed in aggregate. The point is not to advertise perfection but to let users see how the institution absorbs mistakes.

Portability needs reconciliation measures: conflicting current records, stale predecessor records, evidence-transfer failures and time to final service handover. Routing continuity can be observed separately, with the explicit warning that route acceptance remains an operator decision.

Overreach needs measures too. How often did a broad hold affect resources outside the documented dispute? How many requests sought information unrelated to identity, authority, uniqueness or a legal restraint? How often did a service-region rule block a transaction that posed no duplicate-registration risk? How much loss arose from delay rather than fraud prevention?

Land registries are accountable because their legal effects and public costs can be examined. IPv4 registries should not borrow the word assurance while keeping the incidence of their own decisions invisible.

Conclusion: keep the chain and the remedy, discard the territory

Land registration offers two powerful disciplines to the IPv4 world. The first is temporal: a valuable current record should be supported by a history of authenticated changes that survives staff turnover, corporate succession and institutional failure. The second is remedial: correction must be joined to a credible allocation of loss, or users cannot rationally rely on the record when mistakes occur.

The analogy also teaches humility. Even a statutory land register makes bounded statements. General boundaries may remain general. Some interests sit outside the visible entry. Courts decide questions the registrar cannot. Indemnity exists because authoritative systems remain fallible.

Beyond those lessons, the comparison breaks. Land is physical, territorially located and governed by a sovereign legal order. IPv4 addresses are globally unique numerical resources used through changing contractual and technical arrangements. Routing is dynamic. Operational control can be delegated. Several sites can originate the same prefix. Registration, RPKI, reverse DNS, route acceptance, reputation and private-law rights do not collapse into one title.

The institutional difference is just as important. HM Land Registry's guarantee is a creature of legislation, adjudication and public finance. An RIR service region is not a country, and the registry is not the sovereign owner of the addresses first administered there. Its legitimacy comes from performing a bounded coordination function accurately, accountably and in a way that preserves the global Internet.

A corrected analogy therefore produces a thinner and stronger registry. It keeps exact resource identity, chain evidence, visible status, reasoned correction, compensation and review. It adds portability because an address has no physical situs that requires permanent attachment to one recorder. It coordinates adjacent services without claiming to control routing or commercial use.

Title assurance is valuable when it tells a buyer, operator, lender or court exactly what the registry knows, what it has verified, what remains disputed and who pays if the record is wrong. Title mythology is dangerous when it turns a regional database into territory and institutional reliance into ownership.

The Internet needs the first. It should reject the second.

Sources