ARIN 37 Members Meeting Transcript - Wednesday, 20 April 2016 [Archived]

Note: This transcript may contain errors due to errors in transcription or in formatting it for posting. Therefore, the material is presented only to assist you, and is not an authoritative representation of discussion at the meeting.

Opening Announcements

John Curran: Good morning, everybody. If everybody would please come in and be seated, we’ll get started. I’d like to welcome everyone back to ARIN 37 in Jamaica. Let’s start out with a big hand for our sponsors, network sponsor C&W and Google for webcast.

(Applause.)

John Curran: Lovely. Okay. Rules and reminders, if you approach the microphone, please state your name, speak clearly. There’s a poor person trying to transcribe this, please, please speak clearly and slowly. It would help us all.

That goes particularly for me. So also be respectful of each other. There are courtesies in the program. Refer to them if you have any questions. But we’re busy here – we’re here to discuss ideas, not people.

And so it’s good to be respectful. We’re trying to make progressive – we’re trying to make progress without getting personal. And it’s just how we want to behave as an organization.

Okay. Today’s agenda. We have a Fee and Services Update. We have ARIN reports from the various departments. We have the Advisory Council report. We have an ARIN Financial report from the Treasurer. We have the Board of Trustees report from the Chairman of the Board, and we have an Open Microphone session.

So at the head table we have all the right people. Vint Cerf, our Chairman; Paul Andersen, Vice chair; we have Bill Sandiford, member of the Board; Aaron Hughes, member of the Board; Tim Denton, member of the Board. And at the end we have Daniel Alexander, who is our Jabber scribe.

(Applause.)

John Curran: Amazingly I might be able to do it with my eyes closed. You look at the face, and it just doesn’t work.

Fees and Services Update (and ARIN Services WG)

John Curran: We’re going to start right in. First presentation is the Fees and Services Update. I’ll be giving that.

We have a new fee schedule. It’s online. There’s a tool ARIN Online where you can look at your fees calculated under the new fee schedule. There’s an FAQ of information about it. Major benefits. It effectively addressed all the IPv4 resource categories down so parties who go and obtain IPv6 resources, if they obtain the typical amount, they’ll no longer have to end up changing service category and thus paying more, eliminating the IPv6 penalty.

And the other thing is we allow end users now to pay for the registry services by opting for Registration Services plan, just like ISPs are all enrolled in. Thus they pay on their total resource holdings rather than number of records. They also get the benefit of ARIN membership.

If you happen to have a large number of resource records, this might make sense. Doesn’t make sense for everyone. But, again, it’s optional. It’s something you can do if that’s something that appeals to you.

Let’s see. ARIN Services Working Group. So the ARIN Services Working Group assists me in considering changes to ARIN services. Standing committee is tasked with facilitating discussion with the community and developing recommendations in a timely manner.

So we’re going to have a – we have a working group. Aaron Hughes is chair. Paul Andersen is also from the Board of Trustees on it. The Board last night appointed the volunteers to the committee from the list of volunteers – Martin Hannigan, David Huberman, Sean Kennedy, Dmitry Kohmanyuk, and Matt Peterson. This is the group that will be the Services Working Group. When we’re working on suggestions or proposals from the community that are a little more complicated and we want to make sure we’re heading in the right direction, the Services Working Group is where I’ll be turning to help develop things.

So let’s talk about some of the things it might be doing. We will have a publicly visible Mailing List so they can conduct discussions and work on deliverables.

Initial work items. Two that we’ve talked about. One is the ARIN Services document. Right now we have a lot of information about what services you get spread on the website in a bunch of places.

There’s no definitive document like we have a definitive Number Resource Policy Manual. There’s no definitive document that says here are the services that ARIN provides as an ARIN registry. Here’s what we provide to each organization.

And we think we need that. So we’re going to work with a Services Working Group, because that’s a drafting, editing, reediting, drafting kind of job, to work on that, and then hopefully that will give you a better reference for services received.

There’s one I’ve been holding on to. I haven’t talked much about it. Leslie actually is the expert on this. So about a year and a half ago we had some people point out to us that registry – we have contact CKN-23. And CKN-23 is contact unknown. Shows up in a number of resource records.

Over the course of about ten years, we did some changes to how the registry was structured. The original registry had no organization field. Effectively it was a flat table of networks. We added organization records. We linked organizations and networks. We’ve added an abuse contact.

In the history of these changes, in trying to make sure that we did not end up with people hijacking records, we did a number of transformations in the database.

We’ve looked at these, and it’s possible that we were overambitious. So we’re going to sit down with the Services Working Group and work through some of those items and talk about what could be done. It might be desirable to try to make unknown contacts more known based on historical data.

And this has also come up, by the way, of course, for transfers. People who do transfers, first thing we have to do is vet the organization. And there are people saying I was the valid contact. I don’t seem to be now. Why is that? That may be some of us being overly aggressive in how we did transformations in adding the organization records.

It’s something rather than ARIN saying, oh, well, we’ll just fix this and you can live with the result, we’re going to go with the Services Working Group and go: Is this an issue? Here’s some possible ways of changing it, work on a proposal to them and then come back to the community and talk about it.

We’ll take on other items as suggestions come in or as raised by the working group through the chair, I’ll work with ARIN, and we’ll figure out what else the group has to do.

But those two items are probably quite large on their own. So don’t be surprised if the rest of the working group queue is going to be somewhat in flux.

That’s all I have actually on fees and services. And at this point I’ll open the microphone for questions on either. Fees and services. New fee schedule. Services Working Group. Suggestion process.

There will be an Open Microphone session later, so it’s not your last chance. But I want to make sure everyone’s happy before I move on.

I knew I’d get someone up there.

David Farmer: David Farmer, University of Minnesota. When the new fee schedule came out, I looked at it and, as probably most people did, looked at what it meant to me. Looked good to me. The points brought up yesterday in light of looking at what it might mean to some other folks, particularly at the top end, particularly some of the consequences of that and most definitely of the timing of such, for someone to throw a multi-digit multiplier on to my fees without like at least an 18-months’ window would really cause me problems.

John Curran: I can say the Board of Trustees directed the staff last night to look at what options exist for phasing in parts of the fee schedule at the top end, because it’s a very significant change. Multiples of what they were paying before. No decision has been made, but we’re going to see what can be done not to change the fee schedule but to change the implementation process to provide a timely consideration of it. Does that answer your question?

David Farmer: Yes. And a little bit of maybe double thinking the top end as well but focus on the timing.

John Curran: Thank you.

Kevin Blumberg: Kevin Blumberg, The Wire, ARIN AC. Just going on to the fee schedule. It looks great. Really happy about it. I can’t comment on the extra, extra, extra large sizes. I’m not that big, personally.

But one of the table topic concerns when it came to v6 and small organizations was that for many organizations, especially ISPs, there’s no negative to having v6 in policy – in the fee schedule. But if you are an end-user and you would like to continue to be an end-user, you are paying up front for a new v6 block.

I don’t think the concern was the yearly maintenance fee of that additional block, but the upfront cost of having that additional block. And I would suggest to the body before me that possibly continuing with a fee waiver to increase – to continue that would be a good idea.

John Curran: Actually, I’ll bet you, Jason, you’d like to respond to that.

Jason Schiller: Jason Schiller, Google, ASO AC. I just want to have a clarifying before there is a response to that. If an end user decides to have the registration services fee schedule, then there’s no upfront cost; is that correct?

John Curran: If the upfront cost is the number on the Registration Services plan. So an end-user can come in –

Jason Schiller: They fall into a bucket, and if they’re already in a bucket, they’re already paying, so there’s no upfront cost.

John Curran: They could end up in a small service category.

Kevin Blumberg: Correct. But even then it’s still more than what it would be if it was just the two blocks, the v4 and the v6 block. Or in another case it would be more than if it was just a v6 block because they’re not actually even doing a v4 block with ARIN. So they were going just to get their v6 block would it not be cheaper to just have that?

John Curran: I’m not going to quibble on your math, but write down that example and send it to me. Because I’m having trouble thinking about that.

The end users generally fall in really, really small categories. So let’s write it down and we’ll work on it. Any other questions? Thank you very much.

(Applause.)

ARIN Reports: Communications and Member Services

John Curran: At this time we’ll move on to ARIN departmental reports. First is Communications and Member Services, the person responsible for this meeting, Susan Hamlin.

Susan Hamlin: Thank you, John. Good morning, everyone. I’m going to talk a little bit today about some changes dealing with membership and voting and give you a brief look at some of the content upgrades, deliverables that this department has put out over the past six months and talk a little bit about ARIN outreach.

So the Communication and Member Services department is a staff of 11. We’ve had quite a few changes since our last meeting. Up at the top, Sean Hopkins, currently our Communications and Technical editor, is going to move into the Policy Analyst position around the 9th of May. I’m missing the bottom of the slide, but most of you know Einar Bohlin, who has been ARIN’s Policy Analyst for over a decade, has moved into a new position, Government Affairs and Public Policy Analyst, reporting to Cathy Handley.

John Curran: If I could ask the community for a moment. Einar Bohlin has done – amongst other things – an enormous amount of support for the policy process over the years and the Advisory Council and these meetings. And I’d like to congratulate him on his new role in Public Affairs.

So a round of applause for Einar.

(Applause.)

Susan Hamlin: We have an additional meeting planner. Most of the CMSD staff are here. With us as always: Jason; Kim; Hollis; Sean; Mary, in the back, meeting planner; Wendy Leedy, our second meeting – Wendy, our member engagement coordinator is also here, and many of you hopefully have had a chance to meet her. She’s welcoming new members. She runs the Fellowship program, and she’ll be running the elections.

We also have Jennifer Bly who’s just back from maternity leave last week. She handles social media, and we’re very happy to have her back. She’s running social media from home this week.

Kim Kelly is new on our staff. Communications writer. And we have Melissa Goodwin, our second meeting planner, who is back in Chantilly and has been helping everyone with housing and other issues while you’ve been here on site.

ARIN membership. We’re a little over 5,300 ARIN members currently. We average about 30 new members a month. We’ll talk about membership. So 99.9 percent of ARIN members are Internet service providers. They are automatic members. When an organization receives its first direct allocation of v4/v6, they automatically become a member.

We also have what’s been called traditionally paid membership. An organization with a direct assignment of addresses or holding ASNs from ARIN may optionally choose to become an ARIN member and pay an annual fee.

So with the new fee schedule coming on board 1 July, we have made an additional optional way for an organization to become a member, and that’s by adopting a Registration Services plan. So we’re sending out information. And for some organizations, this way will be a cheaper way to become an ARIN member. So you might want to look into it.

If you have any questions about this, you can reach out to Member Services. You can reach out to Financial Services. There’s a fee calculator available where you can plug in and see which option may be better for you.

Also elections is a big part of what Communication and Member Services covers. The basic tenets of elections hasn’t changed. Each ARIN member organization has one vote or one ballot to fill out through one voting contact.

Last year, we terminated the use of designated member representatives and changed our terminology to make it clearer to call it voting contact.

We also are in the process, and this year begins the first time where each voting contact will need to log in to ARIN Online to access their ballot.

So we have an outreach campaign going. We have some cleanup to do. Shortly after this meeting you’ll be hearing from Wendy about the status of your organization’s voting contact.

What it requires, basically, is for each voting contact to have a Web user account, and we’ll be using that Web user email in all correspondence during the elections. And all voters this year will need to log into ARIN Online.

So, for instance, last year 75 percent of all eligible voters had Web user accounts and accessed the ballot through ARIN Online. The other 25 percent were sent an email with a direct URL. And we will no longer be doing that.

So any questions?

Jason Schiller: Jason Schiller, Google, ASO AC. So if I am an eligible voter and I don’t have a Web user account, will I, while the election is under progress at the ARIN meeting, be able to get help and create an account and be able to vote, or will there be a deadline for which the Web user account has to be created prior to the election is started?

Susan Hamlin: There will be a deadline. It’s the deadline for voter eligibility, which is 60 days out, I believe. And we’ll be hopefully overcommunicating to everyone about that deadline. And you’ll have to be on record with an account at that point.

Jason Schiller: Thank you.

Susan Hamlin: Some of the fun parts we do in CMSD is working to streamline information on the website to make sure things are current and to bring on board information about new services and deliverables.

I picked just a few of the what we call baby bills that have been on the homepage of the website recently to talk about areas where we’ve worked with internal subject matter experts, whether it be Leslie dealing with validating point of contacts, with Registration Services department in trying to streamline information about addresses, about transfers, and also taking a look at how first-time users come to ARIN and how to make that information clearer and more process oriented to help them get their resources.

We do a lot of work. It’s a continuing process, and we’re making progress as we comb through the website.

Some of the things coming next. We’re working with Registration Services on the requesting resources section, on a transfer decision tree to help people determine which type of transfer they need and make it clearer, direct them. And also the TeamARIN website, micro site is going to get a new redesign.

I’m just curious, how many of you all have ever been on the TeamARIN site? Excellent. I see a lot of potential guest bloggers out there. So that’s encouraging.

And when we get through some of this content, our next goal is to look at the homepage, the redesign. There are a lot of competing priorities. As you know, we add more and more. So we’re really going to take a look, do some research and testing about what’s needed and how we can improve the navigation.

Part of our project long term toward moving to a more responsive website is to help with how we function in putting information on the website. We are in the process, and Jason has been leading this, to move most of the historical information, which is pages and pages, into a separate component. So when we have something to push out new at the website, it doesn’t have to go through all of these thousands and thousands of pages.

It will look seamless to you all when you’re on the website and you’re looking for minutes of Board meetings. You just click on a page, and it will take you to a section with a little bit better design and it will be more responsive. So we look forward to your feedback once we put that out.

Also, we recently published the annual report, and we have a new welcome to ARIN video. It’s about three minutes. It’s a highlight. Takes folks through our tools, what we do, and it has some directional points to the website to help you find things through navigation.

We also have a YouTube library that I think was mentioned earlier that helps folks navigate their resources, setting up ORGs, setting up points of contact. And we will continue to develop those types of videos.

Most of you know ARIN does a lot of outreach. Many of you, especially members of the Advisory Council and Board, we call on you from time to time to join us on the road. I’m not going to go through the list of things we do. ARIN on the Road continues to be very popular. And we are joining NANOG again for an ARIN + NANOG on the Road this year.

We support Internet governance forums throughout. We still go to various trade shows carrying our v6 message.

And we are also supporting lots of groups in the Caribbean, Canada. If you all are involved in an organization and you attend a meeting where you think it would be great to have ARIN come on board, fall along with the program before or after, or there’s an opportunity for ARIN to contribute somehow, we would really like to hear from you all. We have our thoughts and ideas, but there are always new opportunities. And we would like to bring the ARIN message to as diverse communities as possible.

Our Get6 campaign continues. We’ve been doing outreach on v6 for over a decade. We’ve changed up our message now and we’re really broadening it, taking it to audiences with a message of please enable your websites over v6, helping to drive more content and drive demand. We have a public relations firm, Stanton Communications, who is working with us.

I would recommend you take a look at the v6 pages on the wiki. If your organization is – deploy v6, has a story, we have a Forward Thinkers page. We’d love to add you there.

And also on the IPv6 wiki, we have a list of IPv6 hosters, DNS providers. We have about 40 organizations. And within the last six weeks or so we added an opportunity for IPv6 consultant and trainers to add their information. And I think there are just under 30 organizations. Gives you an opportunity to contract in what areas you service. So I recommend if you’re looking for that kind of support to check out the wiki or to add your name on there.

This is a call for input and support from you all. We have an expanded Fellowship Program. The Board changed the numbers of possible fellows, and I’m happy to say we have a full complement of 15 fellows at this meeting. I hope you have an opportunity to interact with them.

What that means is we are in need of additional folks to mentor these fellows. Traditionally it’s been a job assigned to the Advisory Council. There are a total of 15 AC members, and lots of them have other obligations here.

So we did put a call for mentors on the registration form. And thank you to those in the community – the Board, ARIN staff – who had been mentoring Fellows at this meeting. But I also would encourage you for future meetings, when you see that on the registration form, to please check it off. The Fellows find it a valuable opportunity to have someone that they’re comfortable asking questions to. And I’m a mentor for the first time, and I think it’s a great experience.

Also, locations for ARIN on the Road. We travel throughout the region. If you’re in an area where ARIN hasn’t been you think bringing a show there, please reach out to us.

And John already put in a good plug. We travel for the ARIN Public Policy Members Meetings to locations throughout the region. But the first determining factor is an area where we have a network sponsor. So we are looking to go to Miami in 2018 April and are putting the call out for a network sponsor. So if anyone is interested, reach out.

One quick note. We do have a new email, [email protected]. We continue to service [email protected], but we created [email protected], which Wendy is using, to welcome new members, and we’ll be using that through most of the elections communications.

So, happy to take questions.

Cathy Aronson: Cathy Aronson, ARIN AC. This is probably not your department, but since you talked about elections, I can’t help myself. Two things, one, I feel that we need to start looking at the number of Board candidates that we put forward for a given election.

And, two, I think we need to be more clear what the criteria that the NomCom uses to select such candidates, because if we need varying expertise on the Board, then that should be something that’s used, in addition to maybe we could try to have a more diverse slate of candidates for the Board and the AC going forward from the different regions and also maybe a woman on the Board perhaps. Just a thought.

Anyway, thank you.

John Curran: Does anyone want to respond to that from the Board?

Vint Cerf: I will. Thank you. That’s a topic that came up in the Board Governance Committee meeting.

So actually let me – now that I’m taking this opportunity, let me invite all of you to provide us with ideas along the lines of improving diversity and geographical coverage, expertise and the like.

Cathy, you ran away from the microphone before I could ask you about number of candidates. Did you mean you wanted more candidates and more diverse candidates?

Paul Andersen: You’re referring to the charter limitation?

Cathy Aronson: Right. So the Board, my understanding is that there has to be one more candidate than there are spots.

Vint Cerf: We try for two.

Cathy Aronson: Right. But there can only be two more candidates than there are spots. Is that correct?

Vint Cerf: No. Twice as many candidates as there are –

Cathy Aronson: That would be two more, right, because there’s only two board members at a time. If there are two incumbents, that gives two additional people a chance to run. And I don’t think that that’s enough in my opinion.

Vint Cerf: Yeah. Thank you.

Cathy Aronson: I might be alone on that, but –

Paul Andersen: But on your other comment on the criteria, I would love any feedback that you or others have on – the charter is on the website, and all the materials are sent to the NonCom, so if there’s suggestions on criteria, I’d love to hear it offline.

John Curran: This is not quite Susan’s presentation. We do have an open mic at the end. But if we want to do brief comments on this matter. Go ahead, Owen.

Owen DeLong: Owen DeLong. I agree with Cathy. Two more than the incumbents is not enough.

Andrew Dul: Andrew Dul. I’m not sure I agree with Cathy because what happens is those who are less well known, their votes get diluted amongst themselves, and then the incumbents become at the top of the pile. I’ve seen that in other organizations. I’m not sure I know the answer.

John Curran: I’d ask to this take this discussion on open mic. Comments on Susan’s presentation? Or comments on Susan’s presentation; otherwise, take it to open mic. Sir. Thank you. Thank you, Jason. Sorry.

(Applause.)

ARIN Reports: Engineering

John Curran: We’re going to move around. The next presentation is Mark Kosters doing the engineering report.

Mark Kosters: Thank you, John. Let’s go ahead and get right into the engineering report here. So over the last year engineering has done a lot of hiring. I’m happy to say we’ve filled our open positions actually towards the end of the year.

Actually going through this process of trying to hire the number of people we did over the last year is actually fairly hard in the DC area because you have so many different places that are interesting to work. So it took us a while to actually find qualified candidates who are willing to work for us. So we finally filled it up I think in November of last year.

We are converting a – currently a contracting slot into two entry-level full-time employees. So if you know of any people that are graduating from college that want to have a cool engineering job, please send them my way.

Challenges that we have upcoming is we’re going to move, and actually that’s first and foremost on engineering’s mind: How are we going to make this move happen, how are we going to make it seamless.

The other thing we have is just issues dealing with our current office space. So this past winter, I don’t know how the rest of you all thought about it, but it was pretty challenging especially with the number of people who are getting sick with the flu.

In fact, we even had to quarantine one of the offices. So there was Lysol put all throughout and everything else and we told those people to go home for a while until the sickness, it just went away. It’s mainly because they’re working in such close quarters.

So here’s our staffing summary. You can see the number of people that we have in each department. We have two openings again for entry-level software test engineer and also for developer.

Here are our accomplishments since ARIN 36. These are just sort of like the big ones. So we’ve done transfers. That’s all online now for you guys to go ahead and do everything. No longer need a template. You can make that happen.

The upcoming fee schedule, when that’s announced, or deployed, we’re ready to go with automation that we had to deal with it. And we’ve done some UI work. Have any of you all noticed some changes have been made to ARIN Online lately? No?

We’ll go through some of this. One of the things we’ve realized is that people find it maybe not as intuitive as it ought to be. So we hired this UX person to help us figure out what we needed to do.

And we also need to make this UI change because of SWIP-EZ. But the Web is actually going to be very useful in allowing people who have one or two reassignments need to be done at a time actually using ARIN Online to make those changes.

But to do that, we had to make some navigational changes. And to make that happen, we actually deployed a number of usability tests. Maybe some of you have been called.

We’ve looked at volunteers at ARIN on the Road and sat down with them and looked at options, which ones they liked and which ones were intuitive for them.

We’re going to be doing some remote testing fairly soon, and have been testing various aspects of the ARIN Online application.

Finally, if you want to help or if you think that the ARIN Online application is not very intuitive, send mail to [email protected], and we’ll get you part of the usability tests.

So here’s the preview of what it is, the first part. When you log into ARIN Online, right now you get a static page. We’re creating a more sort of dynamic page that has a little bit more color to it and allows you to see in a little bit better detail of what’s going on.

In fact, I have a screen here so you can see a little bit better. What you will have here is the typical alerts, whether or not you have invoices coming due or past due, the associations you have. And some of the stuff may change because it’s not been deployed yet. But you can see a summary of your inventory with ARIN.

The other thing that you’ll see on this is that we are actually using collapsible menus. And for – in this particular case, they clicked on tickets and messages. You can see that two things popped up underneath that, tickets and the message center. So that way you can have an easier way of actually navigating ARIN Online.

Here is the first part of SWIP-EZ that’s coming out. You can see now that we’re starting to put reassignment information coming, and this will be out this summer. So you can start doing more and more of this stuff online.

Again, one of the things that you’ll be able to do is instead of having a wall of text trying to explain these things, as you go through each of the data field elements, because there’s a lot of acronyms used within ARIN, there’s a little info button that you can push if you wanted to so you could see what that information, what that element is, in case you had any sort of questions.

So let’s move on to operational achievements. Well, one of the things we put in this past year is the DDoS mitigation service on a couple of our public-facing sites. Public facing are services like Whois, IRR, and DNS. And we also put it on a provisioning site. That’s where ARIN Online is. That’s where you send your mail and that sort of thing.

And this is a great thing to do, but sadly we’ve had to use it. We’ve had to use it three times. So and this has been fairly commonplace. We were talking about this at the IETF about a week ago where not only we’ve been attacked but the root servers have been attacked as well.

Some of the attacks that they’ve seen have just been absolutely huge. Ours have been fairly moderate sized, and we’ll go into that in a little bit.

The other thing that we’re doing within ARIN is that we’ve had a security audit. And we’re following a lot of the practices that they’ve given as recommendations and doing a better job in terms of catching interesting traffic and making sure that our networks remain secure.

So let’s go back to the DOS attacks. So this person, it was three weeks out of five. It always started on a Friday afternoon. And actually one of the operations manager, Pete, was always out of the office when this happened.

(Laughter.)

Mark Kosters: Pete? He has no idea.

But typically it went on throughout the day. It was a fairly determined attacker. We started DDoS mitigation plan. What we do in that case is we have a bunch of peers. We drop down all our peers except the one that has the DDoS mitigation service end and we start scrubbing the traffic.

And we’re looking as well at the DDoS mitigation vendor, seeing what traffic is coming through and stopping them as they change the attacks. These guys are fairly good at sort of twisting the knob in a different way to see if they can get through in filling your pipes again.

They always ended at 1:00 in the morning. So Pete must have got tired. They only attacked our provisioning networks. They didn’t go after our public-facing networks at all. So it’s fine. And there was – like I said, there was multiple waves, and out of those waves, 70 gigabytes was the largest attack we had.

Now we’re going to go through some stats. We’ll go through it fairly fast. You can see ARIN Online. We have lots and lots of users in our system now, which is great.

A number of users have logged in once and are done. A few more have gone more than once. And you can see that there’s a number of power users, more than – have logged in more than 16 times.

Vint Cerf: (Inaudible.)

Mark Kosters: These are the DDoS attacks. The logins are the DDoS attacks. We can only support one login at a time.

Here you see the Reg-RWS transactions. What this is is a comparison of the red, which is the RESTful templates – RESTful transactions for reassignments that come in versus the blue, which are templates.

And you can see that they’re both kind of leveling off. I’m not exactly sure what that means because it’s an aggregate number. But they’re starting to slow down a little bit in terms of reassignments. Both on templates and RESTful transactions.

DNSSEC. We are just – we are riding with the horses here in terms of we’re doing just as well as VeriSign is in terms of populating common net with DNSSEC records. They have less than a percentage secured as well. We have a number of organizations who are playing with this, but, again, the penetration rate for DNSSEC is small. Not only for ARIN but also for TLD delegations as well.

RPKI usage, again, it’s sort of small growth. One of the things I’ll note here is up/down delegated. You can see that we had zero participants for a while. We went up to one, then went to two, and then went back to one. And that one has really said, hey, look, I want to play in the system, so we say you’re delegated, but they’ve never done the next step saying, okay, here is basically – I want you to go ahead and sign all my resources and get that taken care of. They have never taken that second step. So they’re in the system but they’re not in RPKI in total. So up/down or delegated is just hard.

Here you can see RWhois queries per second. What’s interesting on this, the red is Port 43, the traditional Whois service. The RESTful service is the blue. And you can see there’s a blip that occurred last year in October and has since sort of regained itself. And a large part of that is people using this system, we find out the use may be abuse. So we tamp it down, and they find different ways. Again we tamp it down. So that’s something that we continually are watching over now.

Whois via v6 it oscillates, all over the place. Up to 20 percent and down to 5 percent, where we’re at right now. Typically it probably should be around 10. But this is all based on users and how much they use the system. If someone queries our Whois system a lot – our directory services system, rather, a lot over v4, then that’s going to widely change the numbers.

RDAP. This is a really exciting protocol that actually we’re not the only ones using this, but ICANN is using it as well. ICANN has a problem with internationalized domain names in that the way of doing directory services before, there was no way for people to be able to use things in their own native text, their own native script. They can use ASCII and that was it. That’s all Whois actually supports.

So Andy Newton, who is the brainchild behind this, actually sat down with me, with ICANN people, and said, hey, look, we need to figure this out, and we have an idea, and let’s go ahead and make this happen.

This has since become an IETF standard. It’s working through the ICANN process now for all the registrars and registries who support this.

You can see we’re starting to see some significant growth within ARIN as well as part of our RDAP service.

IRR, we’re going to go into this now, typically it’s about a 5 to 10 percent increase. Every time we have a meeting, it grows by a little bit. Correspondingly, same things with Route and Route6 objects and with InetNums and Inet6Num objects as well. Just a steady growth going on with IRR.

One thing I will mention about the IRR. Here you can see the organizations. I’ll get back to what I was going to mention about in a minute. You can see the number of organizations. There’s a number of power organizations that are in our system using the IRR.

There’s a – a number of organizations have latched on to our service, mainly DDoS mitigation vendors for backup routes, to go ahead and put them in the IRR. So that’s one thing that we – as we look forward to changing the IRR system over this coming year the rest of the year.

One of the things, we need to accommodate for those people because they need to do this. DDoS is getting to be the thing of the day, and its backup routes are becoming a necessary requirement for DDoS mitigation to occur.

Here’s what we’re working through 2016 on until the next meeting.

We’re moving, and one of the things that we’re doing as part of the move is we’re changing our network so we can have a more segmented network so that we have better security controls in place. Right now it’s not as good as we’d really like it to be. We’re rolling out SWIP-EZ of which you’ve got just a teaser on the UI improvements. We’re working at various ACSPs of which you’ll see some of that stuff coming out fairly shortly. We are working on making our systems even more redundant than they are today. There are things that are fine on the backside but we just want to make it even more robust than what we have now.

Of course, we have a fairly significant technical backlog that we’re working through. And this goes from moving from old, old version of Java to actually doing some operating system configuration management with Puppet so whenever we roll out a new system, it’s consistent with the way the old system was and that there’s no configuration gotchas to improve monitoring and logging.

This is how we’re capturing all these sort of offending actors that know the threshold we have on Whois and how far they can go and what they can make it happen under the limit, and we’re actually seeing this by improved logging now.

So I am done. Any questions?

Vint Cerf: I have two. The first one has to do with accessibility. Are you paying attention to that with ARIN Online?

John Curran: So we currently – our website is usable with accessibility aids, and it’s been something that Mr. Bradner reminded us of this for many years that it’s an important thing. One of the things we’re looking at with our redesign is trying to figure out how to make it more accessible.

As it turns out – and use the accessibility aids better.

As it turns out, some of that’s becoming easier, because as you design a website that works on a variety of low-bandwidth and low-capability mobile devices, you pick up a lot of the aids for that. So we’re hoping to make sure we can go from a fair job today to an excellent job with the rollout of new content management.

Vint Cerf: That’s a good answer. Do you mind if I ask one more question? You mentioned Java 6 and Java 8. I understand that some people are worried that Java has security problems or maybe it’s the virtual machines they run on.

Is that of concern to you?

Mark Kosters: Yes. Java 6 is out of support now. And it’s just one of those things that we want to get to. But we also want to provide community new enhancements. And a part of those enhancements is making sure you keep up with the old. And we really need to start paying some attention to the old. So you don’t see the changes, but we need to make those changes happen.

Scott Leibrand: Question from online from Sandy Murphy of Parsons. She asks: Are the DDoS mitigation backup route registrations done as proxy registrations on behalf of their customers? If so, do you have a way to ensure the proxy registration is valid?

Mark Kosters: So a large part of the IRR, frankly, is built on trust, in terms of making sure that those people who are putting those routes know what they’re doing. There’s not frankly a lot of validation that goes on there. And, yes, they’re done by third party. They are proxy registrations.

John Curran: Back microphone.

Rob Seastrom: Rob Seastrom, Time Warner Cable. Vint beat me on the first part of the question which involved accessibility. I work with a blind guy, which has made me a little bit more sensitive to that sort of thing.

But it’s not just adaptive devices. It’s things like color choices so you don’t typically trip up people who are colorblind. And stuff. There’s a whole bunch of things. And, in fact, your tax dollars at work, there is a set of guidelines from the government called Section 508.

I would highly recommend an actual formal audit to make sure you’re doing as well as you think you are.

John Curran: We actually did that. So, as I said, Mr. Bradner reminded us of Section 508. I’ve worked with federal IT systems and quite aware of the requirements.

We actually did a full 508 audit about six years ago. But the website’s changed over that period of time. Now that we’re going to do a content management push, we’re now going to incorporate the requirements necessary to do that.

Generally it’s not as challenging as long as you realize that you have to be able to fall back gracefully in all circumstances. And it’s not hard to do if you pay attention, but it doesn’t happen automatically by any means.

Rob Seastrom: Exactly. Which is why I was recommending the audit: To make sure you’re actually checking your work. Thank you.

John Curran: Next microphone.

Kevin Blumberg: Kevin Blumberg, The Wire, ARIN AC. To clarify Vint’s second question with regards to Java, were you recommending the abolition of using Java as a security nightmare, or just from the upgrade from 6 to 8?

Vint Cerf: I wasn’t recommending anything. I was asking the question to find out whether the perceived security issue was, A, known and, B, what was the plan for dealing with it. At Google we, frankly, are not too excited about having Java and we’re on JavaScript instead.

Kevin Blumberg: It was not only going from one version to the other but even the use of that period.

Mark Kosters: So one of the things – just to make sure we’re all on the same page. There’s like Java applets you can actually run on your machine. This is different than that.

The enterprise system application is on the back side that have their security controls. And from an end user, you really don’t know it’s Java unless it blurts out and some sort of error message comes through and it looks sort of ugly. Which, frankly, we don’t want you to know about.

So in that sense Java is secure from the perspective of it’s not going to impact customers in a poor way. And actually we feel pretty confident that we have fairly good security controls on the back side.

The big thing is if there’s anything that’s zero days, it could be zero days on anything, essentially, in the OSs, or, frankly, there’s some bug that since this is no longer supported that comes out, we’re kind of stuck. So we just need to move on.

Kevin Blumberg: Okay. So the two questions I had, or one was a statement. The first is I appreciate you telling us about DDoS’s. I don’t need to be barraged with it. I.e., if you’re taking care of it, I don’t actually want to know. In fact, it’s probably better that we don’t know the severity or whatever.

But I get a lot of emails from a lot of companies telling me about a lot of problems they’re having that are being fixed and/or being worked on, and it doesn’t really impact me.

That being said, if there’s a Mailing List for active issues for ARIN that people want to subscribe to, by all means. Maintenance windows are a different story. They are scheduled well in advance. Everybody knows and they are 100 percent service or they can be service impacting to organizations.

But every email I’ve seen on the DDoS says we were hit. We’ve already mitigated it before this email went out, so therefore the email really is letting you know about something in the past. That doesn’t help me, and it just actually annoys me because I don’t need that info.

John Curran: The challenge we have is that a number of people send emails saying are you down right now or were you down 20 minutes ago.

So we actually have a high demand for people who are coming to us saying I’d like to see a posting when you know you were down so when I’m debugging something that happened two hours ago, I can tell the people who work for me they were down. That’s why that information wasn’t available.

Kevin Blumberg: That’s what I understand. That’s what a website is for. They can come and see what’s happened, and you can do a log there. But having a hundred people ask you for something versus telling 10,000 people something happened…

John Curran: Okay.

Kevin Blumberg: The second part was in regards to your maintenance. And I want to reiterate this. I’ve brought it up in the past.

A generic maintenance notification that your services are going to be down and that your services are going to be back up is useful from a time and date point of view. But doesn’t give me any confidence as to what’s happened.

A change log at the end of it, if you are actually making changes – we have just updated this feature. We have just done this so that I know if something breaks, “oh, it might be because you made a change” would really help me. And, like I said, just knowing the time and date is not very useful.

Mark Kosters: Just to make sure I have this right. Because we usually say that maintenance is completed and then the following Monday the new features are announced. So you would like to see those features announced when we say we’re back up. Is that it?

Kevin Blumberg: When you originally send it out, it would be wonderful for you to say the anticipated changes are – the maintenance is completed and these were the anticipated changes that we’re working on so that people remember and then on Monday we can say we backed out of this and did this, that’s fine. But at least people know actually what’s going on before and act.

John Curran: Rear microphone.

Stephen Middleton: Stephen Middleton, Verizon Communications. Mark, a lot of good information up there. Thank you very much.

I didn’t see much about IRR. Do you have anything in development coming down the pipe that you could share with us?

John Curran: So that’s actually mine. Mark is in the unfortunate circumstance that we need to tell him what we want, and that’s actually – I should have had that on the Services Working Group, because that’s been queued.

We’ve asked a couple times the community to tell us do you want to invest wholesale in IRR, do you want us to potentially cease working, have some other approach, how much energy do you want and what level of effort?

We actually need a cohesive recommendation. So that’s actually – I’m very glad you mentioned that because this morning I was wracking my brain trying to remember. That’s one I absolutely need the Services Working Group to come up with a comprehensive recommendation.

We know some maintenance improvements we need to do. But that’s to keep the current system running. What we really need is we really need a work list from you folks how much do you want to put in here. Because we could – we have varying comments in the community about how much level of effort should be put into IRR, and it’s unclear, until we have a comprehensive answer, whether it’s worth doing that investment.

Stephen Middleton: Thank you very much.

Mark Kosters: Thank you.

John Curran: Any other questions for Mark?

Jason Schiller: Jason Schiller, Google, ASO AC. Probably not a question for Mark but a follow-on to the previous discussion. How does the community provide input to the Services Working Group? Is that email that is publicly viewable, also publicly postable?

John Curran: I actually was very sly. Let’s use that word. I didn’t elaborate the details of the mechanics of how the working group would work because I think it’s fair to meet with them first.

Unfortunately, while we appointed them last night, many of them aren’t here, so we couldn’t have a kickoff meeting. I’d like to sit down with the working group, understand what they want for dynamics, and then they can communicate how to work.

The input to what goes on their work list will be what comes in through the suggestions process that I think needs a more clear or more community-considered method. But in terms of how they interface, how often they share documents, whether they work internally, I could try to tell you how I think they should work, but then it would be my group and not their group. So I’m going to let them meet and talk about their dynamics and have them tell you.

John Curran: Thank you very much.

(Applause.)

ARIN Reports: Global Registry Knowledge

John Curran: We continue on with the presentations from the departments. The next presentation is going to be Leslie Nobile who will give the Global Registry Knowledge Presentation.

Leslie Nobile: Good morning, everyone. This should be fairly quick. I’m a department of one, so I only have five slides. I’m doing a lot of work, though. Just to put it out there.

My title is Senior Director of Global Registry Knowledge. And it’s not very clear what that actually means. So I’ll tell you just a little bit about what this role involves.

So as John mentioned, we’re five Regional Internet Registries, but we actually run one global registry. So that is sort of my focus.

I’m looking at data accuracy, quality, and integrity across the global registry system and will be developing and overseeing an ongoing program to assess this data quality.

And the follow-up to that will be providing strategic and tactical advice to the CEO regarding improvements to ARIN’s own internal registry systems.

Just a quick overview of my work. This is sort of all the components of what I’ll be doing. The top one is the projects. I select three to four projects each year that I focus on, and they’re aimed at examining the integrity of the global registry system.

So I will make – I will research, document and analyze and make recommendations for ARIN’s process improvements. And once the project itself gets into Nate’s hands, for the most part, to get on to the strategic plan, I will then follow up, do some follow-up project management to make sure that the project and my recommendations and our recommendations go forward.

I represent ARIN in discussions registry data quality globally. I do a lot of external relations and a lot of public speaking, and I’m asked to talk about this in various places. So some really interesting people, just recently Interpol contacted me and Europol contacted me. It’s not just within ARIN that we’re talking about this.

I am to develop and maintain educational materials that identify commonality and differences in registry accuracy processes, practices. And I do act as ARIN’s liaison to the global law enforcement community on issues concerning data accuracy and cyber crime.

I’m working with Bobby Flaim – recently we have decided to revive the ARIN Government Working Group. So we had our first meeting in DC at Steve’s lovely office a few weeks ago. We had over 20 people in attendance. It’s law enforcement and regulators, and it was really interesting.

It’s a lot of information sharing and education for the most part. And from that meeting I received a couple of invitations to go speak at individual organizations to talk about some of this, the work that we’re doing. Additionally in this area, we have something called the Public Safety Working Group, and that is part of the Governmental Advisory Committee at ICANN, the GAC, and that consists of law enforcement and regulators. They’re very interested in working with the five RIRs, the NRO, on Whois accuracy practices, with the ultimate goal of putting together a globally coordinated policy across all five RIRs that addresses Whois accuracy.

And then I participate and support ARIN’s outreach efforts. I do lots of backup presentations and speaking and ARIN on the Roads and NANOG on the Roads and lots of stuff like that.

Real quickly, just to look at the 2015 projects that I did, we mentioned a few of them. So review, analyze, and recommend process improvements within ARIN. The first one was CKN-23. Very complicated. This one, yay, you lucky Services Working Group people get to review this one. I did the whole history, all the issues and the recommendations. So they’ll take that from there, and we’ll see what happens.

You’ve heard about our POC validation enhancements. That was a big project, and most of those are going forward now or have been implemented already.

I was asked to talk about legacy assignment practices in each of the RIRs. That was one of my global projects. And I’ve worked with all four of my colleagues at the other RIRs to document how they define legacy and what services essentially they offer to their legacy customers.

So that is actually a document I would hope to be made public on the NRO website at some point, because it is all public information and it would go a long way towards transparency.

Then I wrote some coordination procedures for the five RIRs that we could use during inter-RIR transfers and upon receipt of new IANA IPv4 blocks. There’s a lot of coordination that has to happen, particularly in the DNS area. So that has been written and circulated amongst my colleagues, and I’m hoping to get some feedback from them.

So my 2016 projects. These are some of the things I’ll be working on in addition to the sort of day-to-day stuff. But the top one is my big one. This is sort of my main purpose in life. It’s all about Whois accuracy practices and requirements across the global registry system.

I’m working closely with my RIR colleagues. I’ve been to two of their offices already and spent a couple of days going over all of their Whois accuracy practices – how does data get into the database, how do they maintain data, what are they doing.

You heard Andrew from RIPE talk about ARC, Assisted Registry Check. These are things I’ll be examining in this paper, and then I’ll make recommendations for improvements to ARIN’s own internal vetting and data maintenance processes based on that, and this document will be shared amongst the five RIRs.

I am going to research and analyze IPv6 – ARIN’s own IPv6 reassignment policy for compliance and any implications. You know with IPv4 the requirement is you have to SWIP, put all your reassignments into the database in order to get more space. There’s the same requirement in IPv6 except that no one is coming back for additional IPv6 address space. So we’re not really examining whether they’re putting their reassignments in.

I did a quick check and there are thousands of IPv6 assignments in the database, which is great. I don’t have data right now, but I will. So we’re going to look at what the percentages are, whether people are actually complying with this policy, and, if not, what can we do about them.

And one of the reasons behind this is law enforcement has really been very concerned that they’re not going to be able to see and find the person that they are looking for if there’s no reassignment information being put in the database.

I’ll do more work in the inter-RIR transfer processes. There’s a few more aspects we need to examine, including RPKI implications. The Engineering Coordination Group has been working on that, but I’d like to add it to this document. Additionally, there’s a couple more RIRs that are going to have inter-RIR transfer policies, so I’d like to make sure everyone is accounted for in that document.

And finally I am going to do a little more work on ARIN’s POC validation process. This is more from a policy compliance perspective. We’ve already got the enhancements going and hope that we get some better responses and data.

But the policy says that after 60 days ARIN’s staff will – if ARIN staff determines that a POC is permanently unavailable or just doesn’t exist, they’ll mark their record as not validated.

And actually ARIN staff has not really been able to do that part of it fully. We don’t have the resources to go search down POCs who may or may not be available. I’ll look at that to see if there’s anything we can do from a policy perspective.

And that’s all I have. Are there any questions?

John Curran: Questions for Leslie?

Louie Lee: Louie Lee, Google Fiber – I almost said my previous employer – and chair of the ASO Address Council.

The last slide, the projects. For your Whois accuracy practices and requirements, I suspect you’re going to see the term “accuracy” interpreted slightly differently across the different regions. Say, for instance, RIPE, if their Whois database also has an RIR attached, they may claim there’s an operational accuracy in that there’s an IRR entry which may be a valid or not valid claim. I’m not going to put any judgment on that. But you may also want to define what you see as accuracy and maybe even address what others might think as accuracy.

Leslie Nobile: That’s a really good point. I will do that for sure. Thank you.

Andrew Dul: Andrew Dul, ARIN AC. Two points. One about inter-RIR transfer process. Yesterday there was discussion that APNIC and RIPE are going to start doing ASN transfers. When that came up in this region, there was discussion that there are technical issues that we have to deal with with regard to that. Is that on your list here, or is that something else?

John Curran: Back when we said there were technical issues, we said if we want to do an ASN transfer, it’s not automatic. We have to do work to make it happen. It’s not to say we can’t overcome that work, but we would need policy to direct that it’s necessary to do.

Andrew Dul: Is that between RIPE and APNIC, or is this issue being swept under the rug? I guess that’s the other question.

Leslie Nobile: There’s someone from APNIC behind you maybe he has something to say.

Adam Gosling: Adam Gosling from APNIC. I did promise – I think it was yesterday – that I would look into how many transfers we’ve had. Since the policy was implemented, we’ve had 70 ASN transfers. None of which were interregional transfers. So we actually haven’t tried it yet.

John Curran: Work to be done. Not insurmountable.

Leslie Nobile: Andrew, if you have suggestions or want to send me an email reminder, I’ll address that.

Andrew Dul: Last was people talked about transfer data reporting requirements to be similar between regions. Is that something on your plate that you’re coordinating with other RIRs?

Leslie Nobile: Yes we’re working with RIRs. In fact, the Registration Services Coordination Group and Engineering Coordination Group will be meeting, and we’re going to discuss consolidated transfer statistics. So the RS managers, they’re going to give the operational input to the ECG, and they’ll make it happen.

We’re going to tell them what’s important to show for the transfer data, and they’re going to make it happen in similar format. So, yes, that is absolutely on the plate.

Andrew Dul: Thanks.

Leslie Nobile: Okay.

Vint Cerf: So, Leslie, you mentioned accuracy, but I was also listening for the word “access.”

During my time at ICANN, there was enormous debate over who should have access to what portions of Whois database and under what conditions. Law enforcement wanted more people who are concerned about privacy, wanted less.

I wondered whether that is an issue arising for you either here in the US, or now that you’re dealing with potentially international law enforcement organizations that could be an issue as well more broadly.

John Curran: So I can actually jump on that one. While Leslie’s work doesn’t directly pertain to that, there’s an active project right now to discuss RDAP and RDAP, the protocol work going on between the RIRs and IETF and some of the registries, the name registries, looking at the RDAP protocol RDAP provides for controlled access to resources including different visibility views if desired.

John Curran: Did you want to respond on that?

David Farmer: David Farmer, University of Minnesota. I interpreted Vint’s question slightly differently. You answered sort of technical control of access. I thought he was asking a practice question, is there any difference in the RIRs on practice of what’s accessible under what conditions.

Vint Cerf: That’s a friendly amendment. I’ll accept that.

John Curran: Friendly amendment. Okay. So, anyway, that’s not part of Leslie’s work right now to assess that. But we’ll talk about whether or not we should add that. Question in the back.

Gary Campbell: Gary Campbell, government of Jamaica. Leslie, you mentioned that a part of your work is to assess the registry data quality. Can you just speak to some of the metrics that you use to do so?

Leslie Nobile: Right now it’s really specifically focused on the projects that I’ve mentioned. So it’s bits and pieces and components that we’re working on, but there’s not one overall system that I’m working on at this point.

The closest I’m coming is the Whois accuracy practices and requirements, and that really involves documenting all of the work that each of the RIRs do in order to maintain their accurate data.

Do you want to help me maybe with metrics? I’m not sure what –

John Curran: In terms of metrics for accuracy?

Vint Cerf: How accurate or inaccurate – sorry. Okay. So one question would be is if you’re going through and doing any kind of validation of the entries in the database, does anybody keep track of how many times the entries turned out not to be accurate? That’s a metric of 25 percent of the time these things turn out not to be accurate and require help.

I don’t know. It’s just an example.

John Curran: So presently what we’re trying to do is we’re looking at the processes and procedures that the RIRs are using and how they’re different, how we’re using terms like “accuracy” and how that might be different between the regions.

Leslie is not doing audits. So she’s not in the situation of here’s the records before, here’s the records after, and 33 percent were inaccurate. We’re trying to figure out how we’re using the terminology different between the regions.

In terms of assessing accuracy, I don’t know. Right now the closest would be when RIPE does its assisted review they may have metrics of before-and-after state. I know they have metrics regarding records changed.

We don’t presently have the equivalent of an assisted review project. So we don’t have the ISP before we dealt with them and the ISP after and the difference in records.

If we do such a project, yeah, I believe that would be a good metric to have. But it’s very difficult to develop metrics regarding accuracy, because, by definition, in the RIR we’re looking only at the final result. When someone updates it, it could have been accurate before, and it can be accurate now, it’s just the data changed. We don’t know it was a change because it was inaccurate.

Any other questions for Leslie?

Leslie Nobile: Thanks for your attention.

John Curran: Thank you.

(Applause.)

ARIN Reports: Financial Services

John Curran: Next up we’ll have Val Winkelman come up and do the Financial Services Report.

Val Winkelman: Good morning, everyone. This is the staff for the finance department. Tammy Rowe is the accounting supervisor, and she has four account reps beneath her: Tanya Gomez, Amy Sanchez, Amaris Wang, and Lindsay Norman is our newest addition to the staff. And Tammy and Amaris have been at the Registration desk since Saturday. I hope you’ve been by to see them.

We have an accounting software upgrade this year due to support ending for our version of the software. The upgrade changed the look and feel of our current software. So there was a training period for the accounting staff and SI staff.

Once the upgrade was completed, there was a testing period to ensure not only that the software performed for the accounting group but that it interacted with ARIN Online without any problems.

The financial audit was performed this year as it is every year. The audit report has been reviewed by the Audit Committee and has been forwarded to the ARIN Board of Trustees for acceptance. The completed IRS Form 990 has been reviewed by the Audit Committee and forwarded to the Board of Trustees before filing.

ARIN receives several types of payments. We get checks, credit cards, and electronic methods, which is wires, ACHs. As you can see, the monetary value of the checks we receive exceeds the credit cards for transactions but the credit cards are actually growing in the amount that we are receiving.

This is a chart of the invoicing structure. The blue is the number of invoices that we send out, and the green represents the dollar amount. The majority of invoices sent out are the payment by resource – by resource – sorry – by payment by resource, but the larger dollar amount is from the Registration Services plan.

And here’s another slide that shows the bulk of our revenue comes from the Registration Services plan followed by paying for resource invoices.

And this is just another look that shows a little over 75 percent of the revenue is from the Registration Services plan. Questions?

Vint Cerf: You’re not considering accepting Bitcoin, I hope.

John Curran: We have not had demand for it yet.

Jason Schiller: Jason Schiller, Google. Can you go back to Slide 6, please. I’d like to say I thoroughly appreciate all the enhancements we’ve gotten with the systems and the dealing with requests on the consultation services. I think the surge has been working. And you should continue to surge. And if that means my fees have to go up, I’d be happy to pay them.

Kevin Blumberg: Kevin Blumberg, The Wire, ARIN AC. I know at least in the Canadian region the past 12 to 18 months has been very rough against the US dollar. And while I understand that ARIN is a US corporation, the members are in many regions that are highly volatile against the US dollar, and I’m just wondering if there’s any potential solutions or suggestions that could be done to especially I think help regions not only in Canada but in the Caribbean to help offset some of the risk with the dollar.

John Curran: That’s an interesting issue. I think we need to think about it. And if you have particular suggestions, I’d be open to talking to the staff and the Board about them.

I have one suggestion. We’ll take your prepayment in advance whenever you want to. So when the rates are favorable, feel free to pay. If you have something more precise, bring it to us.

Kevin Blumberg: On your website it specifically says you will not take or you will not do invoices for services beyond the 12-month mark. So it’s not like somebody can prepay for three or four years if the markets are favorable.

John Curran: Would that be something that you would definitely need?

Kevin Blumberg: It would be on the lower end of acceptable. I’d like to see something to help at least some of the smaller countries that deal with this problem.

John Curran: Okay. So think about specific suggestions and find me. Beyond prepayment, we can work with the prepayment. It does tie our flexibility because payment accepted is payment accepted for services.

So it renders our inability to change our fees, which I don’t like tying the hands of the community. But we’re happy to work on that if that’s what you desire. If you have specific other suggestions that would help, let me know.

Front and center.

Owen DeLong: Owen DeLong, Akamai, ARIN AC. I like the idea of the prepayment. Most of the other mechanisms of risk mitigation that I can think of basically amount to a zero-sum gain. So the only way you can remove risk from party A is to absorb it by party B.

And I’m not in favor of ARIN transferring the currency risk from the people paying the invoices to ARIN.

John Curran: Understood. Okay. Any other questions for Val? Yes, rear microphone.

Gary Campbell: Gary Campbell, government of Jamaica. The Audit Committee having reviewed the audited statements that are now with the Board, two questions: One, how long will the Board take to review them? And, secondly, once reviewed, will they be made open to the public domain, or will they remain closed?

John Curran: I’m not sure I heard those. Did you?

Paul Andersen: I think he asked whether the financial statements, once audited, will be published.

John Curran: Yes. They’re put on the website. The Board only approved them last night. So it will take a moment to get them out there.

Any others for Val? Thank you, Val.

(Applause.)

ARIN Reports: Human Resources and Administration

John Curran: Moving right along, the next report is Erin Alligood who will give our human resources and administration report.

Erin Alligood: Good morning, everyone. I’m Erin Alligood, Director of Administration at ARIN. I’d like to start my presentation by outlining our team’s responsibilities at ARIN.

As you can see here, we keep ourselves very busy. Most of these items are HR related. However, the administration piece of our department does have a far reach to include items such as office security, travel administration, and facilities management.

Some of the items that I’ll touch on today in my presentation are related to talent acquisition and retention, compensation management, professional learning and development, and office and facilities management.

But first I’d like to introduce my team. Some of you may already know Thérèse Colosi, who has been part of our team for 15 years as our executive assistant. Therese supports our executive team and Board and Advisory Council on administrative and travel needs.

Next we have Sara Ba, who’s our administrative coordinator. Sarah’s here today working the projector. Say hello, Sarah. Sarah also secures our employee travel and acts as our facilities coordinator and also provides HR support such as benefits administration.

Denise Alston is our receptionist, so she’s the first person to greet you as you come into the ARIN office. Denise does a great job at distributing our mail, ordering office supplies and keeps the front part of our office running.

So moving to some of our updates and recent projects. Since my last presentation in San Francisco, we continue to on-board all of our new hires. I’ll get to our employee statistics in a moment. But we were busy in 2015, as Mark mentioned in his report. We on-boarded a total of 24 new hires in 2015, which is pretty significant for ARIN.

We also conducted mandatory harassment prevention training as well as diversity training for all of our managers and employees. An outside trainer was brought in, and she did a great job reiterating ARIN’s policies both on harassment and diversity.

In order to maintain our strong employee retention, we conducted a salary survey. This helps us to stay competitive in the Washington, D.C. job market and ensures that our employees are compensated both within the range of our demographics and our employees’ specific roles at ARIN.

And, lastly, our team has been extremely busy in planning for our office move, which Mark mentioned as well, and that was approved in October of 2015.

So I wanted to take a little bit of time to talk about our move. During the process of seeking Board approval, the management team did extensive research that included cost comparisons and financial projections of what it would cost to move versus stay in our current office. And based on what we found and what we were able to negotiate in terms of the lease, the Board approved the move. The lease was signed in December of 2015, and is highly flexible and allows us more room for growth. So Mark’s team doesn’t have to be crammed in rooms and quarantined.

Even better, the cost per square footage is at a reduced rate and includes an increase of property management services and oversight, which is a huge plus for our team since that falls under our realm. We’re projected to move in August of this year.

Overall, it’s good news for ARIN and its employees. Most importantly, the move will enhance our current employees’ work environment and at the same time it will have minimal disruption to the services that we provide to you as our community.

Moving to our employee statistics, we currently have 80 employees. As I stated earlier, of the 80 employees, 24 of those were new hires in 2015. And we did have one new hire this year in 2016.

Similar to my last report, I’d like to point out that over half of these new hires were employee referrals. This is a sign from our perspective that we work in a very healthy organization and have a strong company culture. I also think that this reiterates why our employee retention remains high and strong at over 95 percent.

I wanted to do something different this year, change things up. Given that we have such a remarkable employee tenure, our average tenure is five years. I wanted to recognize our employees who have met or will meet a ten year or more anniversary at ARIN. But first I’d like to recognize two of our longest-standing employees – Cathy Clements in Registration Services and Michael O’Neill in Engineering. Both Cathy and Michael have been with ARIN for over 18 years.

(Applause.)

Erin Alligood: The other 15 year or anniversaries or more, as I call your name, please stand: Therese, Susan Hamlin, Richard Jimmerson, Leslie Nobile, Tammy Rowe. In the back at registration. She’s coming up. And Ming Yan. Let’s give them a round of applause.

(Applause.)

Erin Alligood: So finally we have our ten year or more anniversaries. Again, please stand as I call your name if you’re here. Einar, you’re getting recognized a lot today.

Einar Bohlin, Jason Byrne, Nate Davis, Tanya Gomez, Doreen Marraffa, and Mike Pappano. He might be working at Registration Services desk. Matt Rowley, Amy Sanchez. Amaris, who is also at the registration desk. Val Winkelman. And Jon Worley.

That’s a pretty impressive list, I have to say. So thank you for your service at ARIN.

Here’s a usual graphic that I show during my presentations. As you can see here, half of our employees have been with ARIN for five years or more, but similar to my last report it’s nice to see we have a healthy pipeline of new talent at ARIN.

So what’s our plan for the rest of 2016? We currently have three open positions to fill. So we will be actively recruiting for those positions.

We will also be conducting a 401(k) bid analysis later this year, and this will include an analysis of a potential new 401(k) administrator and compliance vendor. We’ve had the same 401(k) vendor for some time now.

It’s best practice to re-evaluate this every few years so that as trustees of the plan we ensure that we’re adhering to our fiduciary responsibilities. And for your reference, the current trustees of the 401(k) plan are Nate Davis, Val Winkelman and myself.

We’re also planning to conduct management and leadership training with our managers. We have a lot of new managers at ARIN, and it’s important that we provide this type of training to our employees so we can further enhance our management and leadership skills and at the same time address succession planning at ARIN.

And then we will continue to plan for our office move to its completion in August. And hopefully enjoy our new office for the rest of 2016.

And that’s all I have. Thank you. Does anybody have any questions?

John Curran: Any questions for Erin? Thank you.

(Applause.)

ARIN Reports: Registration Services

John Curran: Next up Richard Jimmerson to give the Registration Services report.

Richard Jimmerson: Thank you, John. My name is Richard Jimmerson. I’m going to give the Registrations Services report today. I’ll move quickly through the slides. I’m the last up before the break. And I’m happy to answer any questions during the break you might have, however.

Our core functions of the Registration Services department of course are reviewing IPv4 requests, IPv6 requests and autonomous system number requests. And also one of our new areas of increased volume is change of authority type services. These are organization recoveries, point of contact recoveries, and including transfers in the STLS service.

Of course we do database records maintenance on a daily basis for customers and we provide customer support on a daily basis at Ask ARIN seven days a week and at [email protected]. We have support functions inside the department that you can see on the screen. The things you would expect were the SME often on some of the content that’s going on the website and when the engineers are putting together services for the customers they’re often interfacing with the Registration Services Department to see how that might best work.

Organizations served by ARIN. The organizations that we serve on an annual basis here inside the organization, there are – 14.3 percent are ISP subscriber members. There are 5,319 of those. But we also have non-member customers. There are 15,170 of those. Those are organizations who pay fees to the ARIN organization on an annual basis. They pay per resource and that don’t have a subscription plan with ARIN right now. A lot of those are end user organizations.

The other 44.8 percent of the organizations are legacy organizations that may not as frequently interact with ARIN on an annual basis, but I can assure you that the others do and we have a lot of interaction with them throughout the year.

IPv4 Registration Services agreement coverage is always interesting to the community. So we continue to provide that here. And what you’ll see is this is a snapshot as of 6 April 2016. We’ve got just over 6,500,000 /24s in the database in the IPv4 space.

45.1 percent is covered under standard Registration Services Agreement. 9.1 percent is covered under a Legacy Registration Services Agreement. And 45.8 percent is not covered under an agreement currently, and that’s, of course, mostly the legacy resource space that we have in the database.

Now, we’ve provided that snapshot of information several times over the past couple of years. I’ve only been able to collect the data where we’ve covered that snapshot. We did it twice in 2012 and twice in 2015 and again as we were entering April here.

And you can see over time with the red line this is the resource that has not been covered under a Registration Services Agreement, the percentage over those years, and the blue line is standard and Legacy Registration Services Agreement combined.

So you can see back towards the middle to end of 2012 we actually crossed a line where we went from the majority of the address space not being covered under an agreement to it moving to being covered under an agreement.

And today we’ve got over a 54 percent of the resources in the database IPv4 covered by Registration Services agreement, and that’s going to continue to change over time as organizations who are receiving IPv4 address space during the transfer process are often having that sourced from resources that are considered legacy today and actually received by the new organization they signed a Registration Services Agreement. So this will continue to change.

IPv4 requests over the last year, you can see that the request traffic went down to coincide with the waiting list being initiated. And also IPv4 depletion happening in the September timeframe. We’re at about a third sustained request traffic for against the free pool that we had at peak last year. And those requests continue to come in, but they’re all destined for the waiting list for unmet requests.

Here’s the waiting list growth. The waiting list started back around the June timeframe when we ran out of the larger prefixes first and organizations were qualifying for those and opting to go on to the waiting list instead of taking the smaller prefix. And then after depletion in September, you can see that the waiting list growth has shot up significantly.

Today we are just under 350 tickets on the waiting list. Each organization can only have one ticket on the waiting list. And that grows continually.

There’s very little chance, unless something significant happens with the return to the ARIN organization of IPv4 address space that organizations entering the waiting list today have a chance of getting anything off of it in the next couple of years.

Unless they’re coming on with a /24 perhaps and we get some of those back and they may be satisfied.

8.3 transfers. These are the transfers to specified recipients inside the ARIN region. You can see that that started to go up right around the time of depletion in September of last year. It seems that community made good transition from requesting against the free pool to requesting against transfers.

And with each of those transfers, of course, for the inside the region 8.3 specified recipients, we have two tickets. One ticket comes from the source organization that’s supplying the addresses and the other ticket comes from the organization receiving the resources.

The 8.3 recipient tickets that we review are very much the same as the IPv4 resource requests that we have done over the years but now instead of looking at a three-month need assessment we’re doing a 24-month need assessment for those organizations.

Inter-RIR transfers, these are the 8.4 transfers. Most of the 8.4 transfers have been sourced from inside the ARIN region and gone out to either RIPE NCC or APNIC.

However, we have received a small amount in. But you can see that this is all over the place. It really depends on the situation if people want to go cross-region. But the majority of our traffic has been in 8.3 transfers.

I will note that we received a record number of IPv4 transfer requests in March of this year. And I fully expect that the stats that you see for April for completed transfer requests are going to put us way above where we were even earlier this year.

And this continues to rise at a rapid rate. IPv6 request traffic has not shot up the way that you thought it would around the time of depletion. There was a short little spike as we were making the announcements going towards depletion right there in September, but they’ve kind of leveled out.

You can say if you look in March of last year to February of this year that it’s gone up a little bit. But it’s not as much as we expected that it would. But we continue to review those requests, of course.

We always get asked. You’ve seen this now for the third time how many of our members actually have IPv6 in addition to IPv4. It’s nearing 50 percent. By this time next year we expect that it will have gone over 50 percent of the membership.

Request activity changes. This is one of my last slides here. We have seen in the IPv4 requests arena that of course we’re seeing decreased requests against the free pool for wait list tickets. But we’re seeing an increase in preapproval requests for transfer needs assessments and also for 8.3 recipient tickets.

In the v6 requests it’s been steady. Change of authority request. Of course, that is increasing as we all expected. You’re seeing many more 8.2 merger and acquisition requests. Many more 8.3 specified recipient requests and in a very big way.

We don’t normally present the statistic, but I think we’re going to start doing that. We’re seeing more organization recovery requests than we ever have in the history of ARIN. When an organization loses its control of the record by allowing it to sit stale for a long time when they come back in to interact with it, and most of this is legacy resources, they have to recover the organization.

And the work that the staff has to do for an organization recovery looks an awful lot like the work we do for 8.2 transfers. All of the legal vetting that we do also applies to the organization recoveries because that is a hijacking vector, and we’re very careful in doing those and they’re very work intensive. And that traffic has picked up significantly. We expect that volume to continue to increase over the next year.

Telephone help desk 7 a.m. to 7 p.m. Eastern Time. Get about 700 calls per month. Most common topics point of contact validation. Monthly we’re sending out point of contact validations. Over the course of the year, we send out to every point of contact a validation message. It’s obviously effective if you want to use the amount of contacts that we’re receiving in Registration Services as a measure. People are very interested in it and they come in and they update their point of contact information.

Ticket status, ARIN Online use and transfer-related questions dominate. I do want to thank the Registration Services team. Want to mention them all by name. We have our transfer services manager, Cathy Clements; resource services manager, Lisa Liedel; technical services manager, Jon Worley; we have two senior resource analysts, Eddie Diego and Mike Pappano, and you can see both of them in the back of the room at the Help Desk; we have resource analyst Misuk, is also here with us today at the Help Desk. Doreen Marraffa, James Ricewick, Jonathan Roberts, Shawn Sullivan. And our newest employee in the ARIN Registration Services Department is our paralegal by the name of Suzanne Rogers. Of course, we’re changing the profile a little bit of the staff that we’re bringing into the Registration Services Department as we review more and more legal documentation on a daily basis inside the team.

We love serving you at the Registration Services Department, we thank you, and we look forward to seeing you again on the telephone next week.

And in the back of the room, if you have any questions for us, thank you very much.

(Applause.)

John Curran: We have time for brief questions. Go ahead.

Owen DeLong: If you can go back to the slide where you were showing the different RSA – it’s a ways back. Sorry.

Richard Jimmerson: That one?

Owen DeLong: No, maybe the one before that.

Richard Jimmerson: This is the RSA one.

Owen DeLong: Go back one more.

Richard Jimmerson: You want the organizations served by ARIN?

Owen DeLong: The legacy organizations, is that legacy nonLRSA or is that legacy LRSA and nonLRSA?

Richard Jimmerson: Those are legacy organizations who – so nonmember customers or organizations who pay fees to ARIN on an annual basis per resource. ISP subscriber members, they pay a services plan fee to ARIN every year, and the legacy organizations who are organizations in our database who have resources that pay no fees at all.

Owen DeLong: So strictly nonLRSA.

Richard Jimmerson: Right.

Owen DeLong: On the waiting list, could it be possible to have it listed in not just entries but numbers of 24?

Richard Jimmerson: We can run a total on that.

Scott Leibrand: Comment from – or question from Jabber. From Sandy Murphy, Parsons: Great presentation. You’re feeding the info junkies of the group. With regard to the graph of covered by agreement and not covered, I do not see the covered category accelerating even with depletion. Looks like it will take a whole lot of years before there’s a significant preponderance of agreement-covered IPv4 address space. Is that correct?

John Curran: I’ll take that one. If you look at it, yeah, it does appear that it will take some time. It’s definitely happening. It’s a relatively new development in terms of the pickup we’ve seen.

The question is will it get down to zero? Well, at some point IPv4 may not become all that interesting and so that may change it as well. I would say at this rate we’re probably tending towards 30 percent or 20 percent coverage at the point in time when no one cares.

Scott Leibrand: She made one other comment which is: The news about IPv4 and IPv4 holders is encouraging for what ARIN is doing to make that happen. Take credit.

John Curran: Thank you. I am going to close the queues because we have a break. One final question back there.

Kevin Blumberg: Very quickly. Kevin Blumberg. In regards to the unmet waiting list, while we have policies, there’s also staff procedure. Organizations that sell music tickets, et cetera, cut off their queue at a certain point and say it’s full.

Just a suggestion that when you have 300 people and you’re estimating yours, before any of those people could be serviced, saying the queue is full and when it depletes below a certain level we will look at reopening it might be better than just permanently tacking on to the end of it.

John Curran: I fully agree with what you just said. But the act of telling people our waiting list is full is not something I would take without community guidance. I would recommend a little short email from the AC at what level you think I start telling you that.

Kevin Blumberg: Like I said, I don’t think this is a policy issue. Now, if you’re suggesting maybe an ACSP community discussion –

John Curran: Let’s start a discussion. Propose the level at which we say no in the ACSP and we’ll get a discussion on ARIN Consult.

John Curran: Thank you, Richard, for your presentation.

(Applause.)

John Curran: I mean, in 2030 everybody on the waiting list will get IP addresses. They can have IPXs and other addresses, SMA addresses even.

We’ll go into the refreshment break, and we’ll cut it short to stay on schedule. We’ll all be back here promptly at eleven o’clock for the ARIN Advisory Council report. Go. You have 17 minutes. That’s a long time.

(Break.)

Advisory Council Report

John Curran: The next thing we have is Advisory Council report. That will be Dan Alexander, the AC chair, who is presenting. I turn it over to you.

Dan Alexander: Hello again. This should be a little easier for me. Yesterday when I was doing the simplification presentation, I had my laptop up here because I had notes on it as well, and I think I got to about Slide 2 or 3 before I realized I wasn’t advancing your presentation, because I was working this one. Apparently sometimes I can’t walk and chew gum.

So this one is about the Advisory Council, and there’s 15 of us. And you’ve met a lot of them in the last few days. And they’ve actually been getting a lot of really good feedback on these proposals to help us develop into good policy, which is exactly why we’re here.

And that’s what the Advisory Council’s really about. Because we’re here to facilitate the Policy Development Process. So we work with the authors, develop draft policies, gather input from the community and get them into what’s called a recommended state where we have to determine whether or not they’re fair and impartial, technically sound, and supported by the community.

When we do that, we can recommend it as a last call review, where we’re essentially saying this is good for – a good policy, we’re going to propose it to the Board of Trustees. Everybody has their last say, voice any concerns. And after that we review everything, and if it’s a good idea, we recommend it to the Board of Trustees for adoption.

So far this year we’ve advanced two proposals to the Board. We’ve abandoned one. The reason we did that was primarily because it was duplicate effort or a different approach to the same problem of 2015-5. We also have one new draft which we discussed yesterday regarding Section 4.10, and we held a PPC at NANOG in San Diego in February.

One of the things we also look at is Richard gave a Policy Experience Report. And that’s an opportunity for staff to provide feedback back to the Advisory Council about things that they’re observing on their end.

And one of the things – there were three items that Richard provided in his experience report back in October, and we had taken a look at them.

One of them was the issue of issuing prefixes longer than a /24. It was actually discussed at several points in here. We tried to deal with it in a proposal last year, but that was abandoned because we just couldn’t gain consensus. So the discussions continue but we haven’t gotten really around an idea as to how to fix it.

There’s also a concern voiced around address block swapping. I shouldn’t say a concern. It was a situation where ISPs exchange markets and how there’s – how staff currently processes these requests and they’re asking for verification whether the community felt it was a good idea or not, and there’s really no objections to how that’s currently being handled. And so staff should continue with their work.

One other item that was discussed back in October was the return language in Section 8.2. The AC was discussing this for a while, and we actually were working on a possible policy proposal, but when we stopped and looked at the fact that it really wasn’t a substantial change to the existing policy, we actually asked staff to initiate an editorial change.

And what that is, it’s slightly different from the full Policy Development Process where if we’re not actually changing policy, simply making an editorial update, ARIN puts out the suggestion for a 30-day review to gain feedback, and then the Advisory Council reviews any feedback and makes their recommendation to the Board of Trustees.

Currently, as Scott noted yesterday, that consultation is currently open and it runs through the 23rd. So if anybody has any thoughts on this matter, definitely, please, we would appreciate your thoughts.

Another thing we’ve been spending some time on is the format of the PPCs. So for newcomers, and even – it’s been an interesting topic that even I had to learn a few things on.

You’re at a Public Policy and Members Meeting here. This is the full-blown meeting where you see all the department reports and we also talk about policy.

Well, the smaller part of this meeting where we’re actually talking about policies is what’s called a Public Policy Consultation. A little meeting within the meeting. When the policy development process was revised a while ago, the AC gained the ability to detach this PPC section of the meeting out of the larger format.

So if we needed to discuss urgent policies or things we needed input from, we had the ability to take that PPC to other venues. One of the things we started doing a while ago is having these PPC sessions at NANOG meetings.

Point I wanted to clarify, there’s been a number of discussions regarding the PPCs, and we’ve been working quite a bit with NANOG and they’ve been a great help because the Advisory Council’s actually started working directly with NANOG and their program committee on coordinating these.

And we had one in February, which was actually we got really good feedback, because while it is a Public Policy Consultation, we don’t have to take everything to one of these sessions.

And that was one of the results of the NANOG conversations that we had where when we have a really large docket, a lot of the people attending NANOGs didn’t want to spend hours and hours reviewing everything, because some of our proposals don’t necessarily directly relate to the NANOG community.

So one of the things we did in February was we only took a subset, basically the recommended proposals that we really wanted to address at the time to that session, and we actually got a lot of good feedback from them that that was successful.

But the one point to make regarding these PPCs is whether they’re held at a NANOG session or whether they’re held here. They’re essentially the same thing.

So the Advisory Council can do or advance or abandon any proposal regardless of which of those two venues they’re presented in.

There was a little confusion around, well, because it’s at NANOG should certain proposals be advanced. The whole point of having them is so the Advisory Council can do the work they need and get these proposals moved forward if they need to.

So the one other thing I wanted to mention about this is that based on the current docket and the NANOG audience, we actually have decided that we’re not going to have a PPC session at the upcoming NANOG in June. So that’s just hoping to provide a little feedback so people can plan accordingly.

We’re really just kind of trying to look to use the right tool for the right job, and it seems to be working pretty well right now.

As you saw the other eye chart yesterday, the other topics we’ve been looking at is the policy manual as a whole and how we can simplify it and how it needs to evolve over time. And that is going to be a lot of work and take some time. But we are definitely up for it.

And, as always, I thank you all for letting us serve and I’d be happy to answer any questions.

John Curran: Microphones are open. Anyone want to ask Dan anything?

Okay. Thank you, Dan.

(Applause.)

ARIN Financial Report

John Curran: Okay. Let’s see. Next up we have the ARIN Financial Report from ARIN’s Treasurer, Bill Sandiford.

Bill Sandiford: Hello, everyone. So just a brief update on the Finance Committee and the activities. We continue to adjust our investments consistent with the investment policy statement and made some minor changes to investments and some small and large cap funds.

As of the end of the March, the investment balance was shy of $31.7 million. We’ve been working with the fee schedule, with the implementation of the new fee schedule coming up in a couple of months. We’ve been working away at the 2016-2017 budget and also dealing with the 2015 financial results. As John said earlier, those were approved last night. And preparation of the IRS 990 form preparation.

In terms of the actual results versus our budget, this chart shows some of the highlights from the 2015 financials, the actual results versus what was budgeted and those amounts.

There’s a few particular columns that have some variances, which I’ll speak to you on the next slides. The variances mainly were a result of some budgeting for additional staff at the beginning of the year as well as office space. For those of you that may not know, ARIN is undertaking to change its office location this year, and there were some implications to the actual results as a result of that.

The Engineering department came under budget due to a slower ramp-up of staff at the beginning of the year, and took most of the year to complete the project that affected that number.

And we had a little bit of an increase in legal expense, mainly driven by what’s happening over at ICANN with the IANA governance changes, et cetera, as well as some of the lease negotiations resulting around the new office space facility.

As at the end of the year, the slide explains our current reserves, particularly with respect to the legal defense reserve fund, the operating reserve, and the long-term reserve funds.

You can see here this slide shows how the reserves have been growing over time, and you can see that from 2014 to 2015 there was a small growth but not as much as we’d seen in some other years.

In terms of going forward, the slide shows us where we’re at in terms of the going forward budget year as compared to last year’s actuals. So you can see that we’re going to be doing some catch-up in the salaries and employment area. There’s some variances there.

Again, I have another slide explaining those in a minute. I’ll just give you a second to take a look at these couple slides so you can see the numbers that are involved.

You can see the additional rent and occupancy variance there. That’s the result of a buyout that’s currently happening with our current lease trying to pursue subletting the current space to fulfill the lease, but for a short period of time we will be responsible for multiple spaces.

The increases of the staffing and benefits line is the result of the staff additions that are expected over the coming year and also includes a potential increase in the salary of the man to my left.

Also the NRO expenses are a little higher this year due to the change in the way that the expenses of the NRO chair was allocated, and that’s now shared amongst all the RIRs.

With that, I’ll open the floor to questions.

John Curran: Any questions on the financial report?

David Huberman: I just wanted to say that over the many years ARIN has taken a lot of vocal criticism for its travel budget line item, and to my hazy memory it appears in real dollars this number is considerably down over the last couple of years. And I just want to applaud John and the Board for listening to the criticisms of cutting down on some of the excessive travel that ARIN previously may have done.

Bill Sandiford: As you can see, I’ve actually backed it up to the actual results. We were $453,000 below the budgeted number for 2015.

John Curran: In terms of actual travel practices, I’ll note the Board of Trustees has worked hard to make sure that it has good coverage for external meetings, but prudently reviews the travel. And that’s meant that we have good coverage but we’re not overattending.

Likewise, we managed to focus the AC. We have excellent coverage from the AC on remote events. But we don’t have anything excessive there either. We’ve managed to spend less. We think we’re actually getting more value for the travel out of it.

I do appreciate the praise.

Vint Cerf: Just one other observation, and that is that both Paul and I review the planned Board travel, and we’re concerned about wear and tear on the board members. So we’ve actually been controlling, to some extent, how much travel is allocated to each Board member, and we’re particularly concerned about John.

So even though saving money is absolutely the right thing, saving people’s sanity and lives seems to be more important.

John Curran: Rear microphone.

Kevin Blumberg: Kevin Blumberg, The Wire, ARIN AC. Question: Is the revenue and the budget basically neutral to one another and any additional has been through investments and things like that, or is –

John Curran: Is the revenue – ask that question –

Kevin Blumberg: The revenue that you get through membership, through whatever other fees that you pay out – or make each year, is that neutral? Does that even out against what your expenses are?

John Curran: If you look at 2015, slide results to budget, which is the one that’s up, this year we actually ended up being significantly lower than planned on salaries and budget. Ended up with total expenses $1.9 million under budget.

And the challenges that our revenues are much closer to budget. So we actually – even though this year we actually intended to be drawing down reserves even more, you actually saw a slight increase that we had in 2015 to reserves.

We do plan generally to be revenue expense neutral. The problem that we have year over year is that the investment expense is estimated and we often have come in higher.

So even though we plan revenues and expenses to match, we’ve been accumulating to the reserves. This year we intended to draw down those reserves by about $2 million, and we failed.

So it’s not a bad problem to have. But we have been consistently under expenses compared to revenue.

Kevin Blumberg: As long as the budget and your revenue – I realize a budget is not perfect, but it’s a budget – is the same, I’m very happy with how you’re doing it. You’re not bringing in more money. So that’s wonderful. I’m glad to hear that.

The second question is I noticed the legal defense fund was a pittance in the grand scheme of things. What could be allocated or is the long-term reserve fund available for a large legal defense scenario?

John Curran: All of ARIN’s reserves are available for legal defense if necessary. The legal defense fund is readily available. It’s actually allocated for that purpose, can be drawn down very quickly.

And it’s something that we don’t count as a strategic reserve of the organization. So it’s a very small number, but it’s kept in ready reserve. It doesn’t produce the same returns as the others. So that if for some reason we had to enjoin on a matter very quickly with significant capabilities, we have that available for the purpose.

Vint Cerf: One other point to be made is that depending on the circumstances requiring legal assistance, we might actually wind up with insurance coverage, for example, in addition to whatever we have set aside here.

One of the reasons for having the legal defense reserve in place is that that’s an allocation and expenditure that can be made without Board action, because it’s been set aside precisely for that reason.

Kevin Blumberg: Thank you.

John Curran: Any other questions regarding the financial report?

Claire Craig: Good morning. My name is Claire Craig. I’m from the University of the West Indies in Trinidad and Tobago. My question is around the line item research, Internet research. I was concerned – the other one, this was the – there was one where it was actually allocated quarter of a million dollars. Right. $261,000. And only $67,000 was spent on research. What were you planning to do and why was so little used in the actuals?

John Curran: That’s actually a wonderful question because we actually discussed that at length last night. One of the challenges that ARIN has is that we have a number of folks coming to us for worthy Internet endeavors, and we didn’t really have a formal process for how to handle them.

People come asking for financial support, grants, for things that this community could easily be interested in, but you can’t say yes to all of them. We don’t have a formal program.

The Board’s tasked me with coming up with that program, and we did the first review of one last night, so that we’ll have a formal way of telling folks, if you need financial support for Internet, for grants and research, for educational scientific, educational projects that are worthy, then we’ll have a formal program that we’ll review and budget more completely and in more detail each year.

We’ve had this line item, but I’ve only been the one fulfilling it for things that plainly the community has demanded. Now we’re going to have a way of making sure we fulfill it on a more organized basis. So we should see more in the next month or two.

Claire Craig: This gives me an opportunity to ask this question. We in Trinidad and Tobago are not members of ARIN but we belong to an organization which is a regional organization, the University of the West Indies, where there are territories within the Caribbean that are ARIN members, where Trinidad and Tobago is a member of LACNIC.

Would we therefore, then, be able to – in your policies, we hope – this is more of a comment that we would be able to apply for some of these research grants and support.

Vint Cerf: So let me take this one. It’s Vint from Google. And Chairman. The idea here is that parties who are not necessarily affiliated with ARIN might still come to us asking for support. Many organizations have already done that. But as John has said, we didn’t have a regular process for figuring out whether we should provide support or not.

There will be a process by which people like you or your colleagues – are you pointing to something for some reason? – only to say that Bill had his hand up – thank you, David – there will be a process by which we will receive proposals that are looking for support, the Finance Committee will examine those and the Board will have an opportunity to make a determination whether they will get support or not.

You might fall into a category that could get support.

Bill Woodcock: I was going to make clear that this is not money for ARIN to do research internally. This is all money to support research efforts that are external. None of this is directed specifically to the ARIN region.

So we’re happy to hear research grant request proposals from anyone anywhere, and, as has been mentioned here, we’re just trying to formalize that process so that it will be apples-to-apples comparison between possibly fundable projects in the past because things have come and over the trends, each have been considered individually.

It’s been very difficult for us to budget or know what the opportunity costs of supporting one project might be early in the year if something good comes along later in the year, or if we fail to support something early anticipating more things and then nothing else comes along. So we’re trying to kind of align those and be able to compare them on their merits relative to each other.

John Curran: Just to note, we presently do give contributions and grants to organizations such as CTU and CaribNOG that span the entire Caribbean region. We don’t necessarily distinguish that in terms of determining whether or not something’s a worthwhile endeavor, if that helps. Thank you.

Any other questions for our treasurer or on the ARIN financial report? Thank you, Bill.

(Applause.)

Board of Trustees Report

John Curran: Okay. Our final report is Vint Cerf, the Chairman of the Board of Trustees, will give the Board of Trustees Report.

Vint Cerf: Thank you, John. Good morning, everyone. I can barely read this. Can you actually read that? I can look over here.

So I have three slides. The first one has to do with our responsibilities as fiduciaries for the organization that includes financial responsibility.

So we did review and approve the move and the financials associated with it to new space. And you heard earlier we think it’s a better deal all around and less expensive per square foot.

We also confirmed, as is our responsibility, elections to the Board and to the Advisory Council.

We adopted some changes for travel policies in order to clarify under what circumstances we would support travel for board members and for Advisory Council members.

There is a benefit for the employees which the Board has to approve. 401(k), for those who don’t know, is a retirement plan. We match some of the contributions that the employees make to that retirement plan.

And we adopted, as you now know, and will intend to put into operation in July a new fee schedule. And as you also heard, there may be some mechanisms for implementation that will avoid some of the abruptness of the change in high end especially of that schedule. So there will be some discussion about that.

We approved the draft budget for the coming year.

And the officers of the Board who were elected include myself as chair, Paul Andersen as vice chair, Tim Denton as secretary, Bill Sandiford as treasurer. And I want to alert you to the fact that Paul Andersen and I will switch hats on the 1st of July. I do not intend to run again for Board membership. And so I thought this – the two of us thought this would be a good transition plan where I’ll become the vice Chairman on the 1st of July and Paul will be Chairman, but that means that there will be a transition period when we are both present. So that’s the plan.

We adopted our standing rules for the way in which we conduct our business. And we authorized the treasurer to approve expenses beyond the fiscal year. And that’s important because some of our activities take place beyond the fiscal year but we have to make commitments for facilities and the like. So we preapprove Nate’s ability to make those commitments.

And finally we accepted the ARIN audit report. I’m the Chairman of the Audit Committee. And I just want you to know that this is the cleanest audit I have ever seen in the 40-some-odd years I’ve served in one way or the other on boards.

I want to give credit to John and the rest of the staff in the way which they have conducted business. The auditors had absolutely no issues at all. There were no slops of any kind. This is absolutely as clean as it could possibly be.

So I think you should applaud the ARIN staff for operating it right.

(Applause.)

Vint Cerf: So we actually do some things in addition to the meeting with each other. So we reviewed the election report and we agreed with the recommendations that were made for that process. And then we appointed a bunch of people to various and sundry standing committees.

So we have an Audit, a Finance, Compensation, and Board Governance committee that’s been populated. If you’re interested, you can look on the website to see which members of the Board are participating in those committees.

We also approved the network operating scholarship representative. And that’s John Curran, who has done that for a very long time. And Paul Andersen agreed to be the NRO executive committee observer.

That position is there to protect John as the CEO of ARIN so that there’s someone other than John who is seeing what’s going on during the executive committee meetings so that it’s not just John’s word against everybody else.

We have Paul to observe what goes on as well. We accepted the nominating charter and appointed nominating committee members. Aaron Hughes is the Chairman of the nominating committee. This year I’m a member, and we have Dmitry Kohmanyuk, Carl James, Charles Gucker, Aaron Sawchuk and Nathan Newman as members of the NomCom.

Something that I want to – this came up earlier today. I wanted to remind you we will be posting the sort of characteristics and requirements that we would like to see in parties who are candidates for the advisory committee and for the Board. But it would be super helpful if you would like to share your notions about what those characteristics should be so that we incorporate that into instructions to the NomCom. So please feel to send notes to me or Aaron Hughes on that point.

Let’s see. We also reviewed the fellowship selection committee report and accepted the charter and also appointed a committee. The Chairman is Bill Sandiford from the Board. The AC member is Tina Morris, and general members on that committee are Sean Kennedy and Paul Emmons. And this is another program which I’m very pleased to support because I think that it’s the most valuable way we have of bringing new people into our orbit and getting to know them and getting them to know us.

We also have a Mailing List acceptable use policy committee, which so far as I know in the history of ARIN may not have ever met, but we populated it in case there is a problem on the Mailing List. So I chair that, and we have Amy Potter and Jim Dolan as the two other members.

We reviewed some changes to the bylaws. Mostly to deal with the change process itself, change of bylaws, and sent that to the community for consultation.

So I hope you’ve taken some time to look into that. We looked at community feedback on bylaws consultation, and we adopted the ARIN Policy Development Process and the standards of behavior.

So last slide. With regard to the mission and services, we adopted changes to RPKI, the RPKI Relying Party Agreement to make it easier as you suggested.

We also accepted the ARIN Services Working Group charter, which John has already mentioned to you, and we appointed committees last night, filled out the committee last night at the Board meeting.

With regard to number resource policy actions, these are things that you asked us to do and we have the responsibility to confirm those actions that we adopted, one, two, three, four recommendations of policy changes to our operation on your behalf.

And, finally, with regard to the Internet number registry system and Internet coordination, we discussed at length the IANA stewardship transition activities, which all of you know have taken an inordinately long period of time despite the fact that our part as the Number Resources Organization was done timely, in January – Bill, if I might – 2015, a year ago –

John Curran: We were submitted January – sorry. Go ahead.

Vint Cerf: So we did our job as members of the NRO. But the rest of the folks, especially on the domain name side, took rather longer.

We also appointed initial community members to the IANA Number Services Review Committee, and that includes Louie Lee, Jason Schiller, and the RIR staff member, who’s Nate Davis at ARIN. And finally we approved ARIN’s support of the CCWG proposal for IANA stewardship transition. That is the element that took the extra year or so to get done.

Why does this remind me of the story that says that any project – for any project, especially involving software, the first 90 percent takes 90 percent of the time; the last 10 percent takes the other 90 percent of the time.

So I think that’s my last slide. So I’ll be happy to try to respond to questions. I see Cathy Aronson coming up.

Cathy Aronson: Hi. Cathy Aronson. This isn’t a question. I just wanted to say that I know it’s probably a lot of extra work for you guys on the Board, but I really have enjoyed having you at lunch and at breakfast and not sequestered away in a room. So I want to say I appreciate that.

Vint Cerf: Cathy is a sweetheart. Thank you.

(Applause.)

Vint Cerf: If I had to choose somebody to hang out with at these meetings, Cathy would be one of my first choices. Any other questions?

John Curran: Any other questions?

Vint Cerf: Everybody wants to go to Open Microphone, which is next.

John Curran: Thank you, Vint, for your presentation.

(Applause.)

Open Microphone

John Curran: We’ll start the Open Microphone session early. We might get done early. The sun is supposed to be up for most of the day. You might get some beach time in. Let’s see if we can wrap this up.

John Curran: Starting the ARIN microphone session. Anyone would like to approach on any questions, comments, concerns, issues they might have, something that has not been raised, something they’d like to revisit?

Go ahead, Owen. I’m sorry, go ahead. I was complimenting you. Kevin.

Kevin Blumberg: Just one question. In NRPM we have Section 11 which allows for research assignments and allocations. One of the things it allows for is IPv4 assignments.

With no free pool, how is ARIN able to do that?

John Curran: That’s an excellent question. So at present we probably couldn’t satisfy one of those requests until the next IANA dribble down to us comes. As you remember, the remainder of the space that was in many of the RIRs was all given to the IANA to divide up and allocate evenly. We’re getting allocations every six months.

The last one we got was approximately a /18, I’m going to say, Richard. What was the last we got, /17 or an /18? It satisfied about six requests on the waiting list.

We’ll get another one. If I remember, the dates are March and September. So in September we’ll get another little dribble of IPv4 remnant addresses.

And if we had a research request, we’d need to handle it at that time. We couldn’t until we had the address space.

Bill Woodcock: Perhaps it’s time for a policy change that says that we’re no longer in the business of servicing research requests because – at least in v4 space because it’s not practical to do so anymore.

John Curran: There’s also a question of how much v4 research should we be doing. If you know a member of the Advisory Council, you could suggest the something like that – oh, wait. I see one.

Kevin Blumberg: The bigger part to this is have we had any research requests in the grant scheme of things in the last 24 months?

John Curran: In the last 24 months we have had one or two. I think we have one outstanding right now. We also renew, when people come in with a proposal, they can come in ask for an extension.

So there are a small number. And as you can find on the website, they are worthwhile. But it’s a very, very small number.

Richard, do you know offhand? We have four. Four that we granted over time. So I’m not sure if it’s still valuable to have these. It’s probably a great topic for the AC to consider.

Kevin Blumberg: Thank you.

John Curran: Okay. Microphones remain open. Any other questions or topics anyone would like to raise anything?

New face. Your name?

Jason Schiller: Jason Schiller, Google, ASO AC. I wanted to come back to the topic of diversity.

I noted that the Board made recommendations about diversity needs with respect to candidates for the ARIN AC. But diversity on the ASO AC is also important and it is important to ICANN as well because the ASO AC appoints Seats 9 and 10 to the ICANN Board which also has diversity requirements.

That being said, it would be interesting to have the NomCom publish what sorts of diversity requirements they have, what they’re looking for in terms of diversity with respect to ASO AC candidates. And that’s slightly complicated because we have to not just consider the three ARIN members but all 15 of us which has geographical diversity, cultural diversity, and we do also have some women on the ASO AC as well.

I just wanted to point that out.

Paul Andersen: Let me just quickly – there is, for those that don’t know, the NomCom charter like all Board charters on the website. I was just checking, there is some evaluation criteria the NomCom has used including a paragraph from the Board guidance. As I was saying earlier, we’d love any feedback on it if that could be improved. The ASO AC, maybe you want –

Vint Cerf: I wanted to point out this is a matter for Board Governance Committee to be concerned about. We’ve had some discussions recently on this topic.

That’s the Chairman of the Board Governance Committee over here. So if you have some ideas about how to express these things, that would be helpful. But the second thing that’s really tough is figuring out when you have achieved the objective.

And no matter what I’ve ever tried to do in this space, I’ve only succeeded in saying that over a period of time I’ve managed to get a collection of people of diversity into seats of responsibility.

But usually within any one sitting organization I haven’t succeeded in getting all the diversity – I won’t call them requirements, but desirable diversity properties satisfied in one sitting. And that’s usually hard because of the limited size of each of these groups.

Paul Andersen: The ASO AC hasn’t been on our radar and probably should have – it does have the complications you quite well pointed out. But we definitely have to get that on our radar.

John Curran: If I could add something just to make a little clearer. So presently the NomCom handles the Board and the Advisory Council. And the Board has provided guidance to the NomCom to consider opportunities for diversity in building the slates for the Board and Advisory Council.

Furthermore, the Board received the – as folks may have noticed, we proposed to change the bylaws, had a consultation, there was some discussion, a write-up, a summary of the comments in that consultation, because one of the items in that consultation regarded the possibility of appointing someone to the Board to improve diversity.

Those comments were also with regard to diversity of the Board. Those have been provided to the Board, and the Board Governance Committee is actually mulling over how to improve Board diversity. So we have standing guidance in the NomCom for the AC and Board. We have the Board working on even additional mechanisms for the Board.

And you mentioned the ASO AC, which actually isn’t covered by the NomCom. It is a process the Board sets for how the election process in this region’s done.

We would welcome suggestions on how to improve that process to improve the diversity and in particular consider the ICANN overall Board diversity issue that needs to be done.

It is not – it’s a complicated issue. And if there’s a better way that we can choose the folks from this region, then we definitely want to hear it, because we haven’t looked at that process, I believe, since it’s been set up.

Jason Schiller: Thank you.

Cathy Aronson: Cathy Aronson again. Way too common thing that I’m at the microphone. The other thing that concerns me about the election process is that it’s almost impossible for someone to get elected who hasn’t been to an ARIN meeting.

And I think the Fellowship program is helping with that especially in this region, but there are certain times where you need somebody from the Board that has experience that you might not ever get from a community member out of this region. And the appointment process might help that, but it also might help to have a clearer set of those kinds of diversity requirements that the Board needs as well. I think we do a really good job on the AC. Although having someone from the Caribbean on the AC would be super cool.

But we do have a wide range of experiences and different kinds of providers and that sort of thing on the AC. But there’s requirements that you need in addition to the regular kinds of diversity issues. And I don’t think that that’s easily addressed either.

John Curran: Understood.

Paul Andersen: And I think that’s why we’ve been trying every year to update and give that guidance. The Board, as it charters the NomCom, has a look and sees where there are skills or other size gaps. I’m not saying that’s enough; I’m saying that’s where we’ve started. And we do now have the appointment process, and we’re hoping to try that if necessary.

Cathy Aronson: I also think, though, that that needs to be really communicated to the community during the election process, not just that it’s up on the website and you can find it –

Paul Andersen: Not on – in the middle of a long page.

Cathy Aronson: But also these are the things we’re looking for – take it or leave it as the community because they can do whatever they want when they vote. But still we need to be better communicators of that as well.

Bill Woodcock: On that topic, really quickly, since we’ve had this possibility for quite a while, but it was very constrained previously. We as a Board – I think I speak for all of us when I say we feel like we’re relatively close to either using that or restructuring in such a way that we wouldn’t need to because we would get diversity some other way.

But using that seems like the surest way to actually get the diversity in one step. So I’d be really interested to hear from the people in the room whether in general people would be happy or in general they would be taken aback if in the course of, say, this year the Board added one more person to the Board, not through the election process, but somebody we went and picked.

John Curran: Cathy, did you want to respond?

Cathy Aronson: Yeah, so there are how many of you on the Board, seven? And you’re all similar.

(Laughter.)

Cathy Aronson: So if you were to appoint one more person who was asimilar, I do not think that that would meet your goal. Just my opinion.

Bill Woodcock: That’s the whole point. The question is do people in the room basically feel it would be a good thing for us to appoint somebody, right.

Again, the whole idea of this is to get the person that we need to begin a start down the more diverse path but not through the election process, through the appointment process.

John Curran: Let’s have the microphones are open. Let’s have people comment on that.

Paul Andersen: The microphones have filled up.

John Curran: Let’s take from the rear microphone go ahead.

Gary Campbell: Gary Campbell, government of Jamaica. This question is about the IANA transition. To what extent was ARIN involved in the discussions of the Cross Community Working Group, and are there any important implications for the IANA transition once completed?

John Curran: ARIN was, as the group of five RIRs, appointed a group of liaisons from the community to sit through the Cross Community Working Group discussions. I guess sit through doesn’t phrase it well. To enjoy the fullness of the Cross Community Working Group discussions.

Actually, they did a remarkable job of maintaining hundreds of hours of meetings. I actually also participated, though not a formal liaison. The Cross Community Working Group focused on predominantly ICANN accountability measures.

I’ll note that our reliance in the numbers community is going to be based on contractual measures – an SLA, Service Level Agreement, which is now posted on the NRO website, a Service Level Agreement between the numbers community and ICANN.

So the main goal in looking at the Cross Community Working Group activities was to ensure that the resulting powers that changed ICANN didn’t in some way endanger how we work with them.

And the proposal from the CCWG did not pose any threat, and, as you noted, the ARIN Board reviewed it, all of the RIRs reviewed it, and we decided that it was safe to proceed.

But the fact that the proposal doesn’t pose any problem does not mean the implementation doesn’t. Because the proposal calls for numerous changes. So there’s actually a bylaws drafting team, which is drafting the bylaws to implement the CCWG proposal, which I volunteered for because I liked being on long calls, and I’m also saying at this time we don’t see any risk in the proposed bylaws. Those proposed bylaws implementing the CCWG proposal should be posted in the next week, if I understand the timeline. Helpful? Thank you. Front and center microphone?

Andrew Dul: Andrew Dul. I support the idea of the Board using the appointment powers to add additional diversity to the Board. It may not help all the way, but I think it’s a good first step in indicating that it’s important to the Board and the organization that additional people be brought in to nurture them to a place where they could be readily elected by the membership as a whole.

John Curran: Thank you.

Rear microphone.

Charles Gucker: I’m a huge supporter for diversity. Diversity for the sake of diversity isn’t a prudent use of it. If someone has specific qualities that will aid the Board, I’m fully supportive of that.

There are multiple flavors of diversity, whether from a professional background or sex or race or various different degrees, but there has to be a merit to the individual’s actual use on the Board, otherwise it’s a useless effort.

John Curran: Okay. Thank you.

Vint Cerf: Just one observation on that point. There’s a term called “tokenism,” and you are quite right about that. So I personally would be very concerned that we find people who are qualified to serve on the Board and serve ARIN and you as needed.

John Curran: Front microphone.

John Springer: John Springer, ARIN AC. Do it. Do it quick. Don’t wait until end of the year, after the next election.

With regard to tokenism, I feel very confident I’m totally nearly sure that you’ll be able to find qualified women candidates, Caribbean candidates. Any kind of category you want to devise, there will be qualified people in that category that are ready, willing and able to participate in this process.

John Curran: Thank you. Vint, do you want to respond?

Vint Cerf: I was going to say if you had some names that you would like to share with us, that would be much appreciated.

John Curran: Rear microphone.

Kevin Blumberg: Kevin Blumberg, The Wire, ARIN AC. There’s two aspects to diversity that are important for me. ARIN is an organization with how many member countries? And/or regions?

John Curran: 25 economies involved.

Kevin Blumberg: Three major regions.

John Curran: Three major sectors.

Kevin Blumberg: I don’t see it as regional diversity as a requirement. I see it as regional representation as a requirement. And I sort of separate the diversity aspects with the representation of the members of the regions.

That’s the first aspect. And the second is having been on the NomCom and not giving away the secret sauce of the NomCom having specific guidelines of what the community needs from the people as well as waiting, allowing for waiting, because just saying these are the four things we’re looking for and not weighting the importance of those four things can be very difficult.

The second thing is the NomCom can give out the most diverse group of people, but if the community does not understand the relevance and the importance of doing it and the bulk of the voting is coming from one region, that level of work goes to none.

John Curran: Kevin, can I ask a question? And it’s regarding the Board guidance to the NomCom that we give in the charge to the NomCom, its impanelling. That paragraph has said the Board recognizes need for diversity in certain areas.

You asked for more specific and/or weighting. I guess I was never – I had some trepidation about the Board stating for needs of diversity we would like to have candidates of “this” qualification in the ballot, because I didn’t – do you believe that the community would judge it as unfair for the Board to specify what the election ballot should contain?

Kevin Blumberg: I’m saying that the NomCom, not having tangible requirements, not just a list of requirements, but tangible as in group A, B, C, you need to fit into three points of group A, five points of group B and don’t matter about group C, but weighting even groupings of things. And it doesn’t need to just be diversity, it could be technical. You need to have three technical diversity in this and that is part of a weight. Whatever it may be.

But helping with that because having an amorphous number or amorphous information is not going to help, I think, the NomCom be able to make a decision.

John Curran: Very helpful. Thank you.

Bill Woodcock: On the matter of appointments should we exercise the appointment this year or not.

Kevin Blumberg: Absolutely. Start with something and use that as a way of moving forward.

John Curran: Thank you. Front center mic.

Jason Schiller: Jason Schiller, Google, ASO AC. Absolutely move forward with an appointment, especially if you’re considering a candidate who is Caribbean. I think that having all regions represented is of utmost importance.

Also, a woman on the Board would be a great thing. And channelling Marla Azinger from Frontier, who is messaging me, is saying Bernadette who is both a woman and Caribbean.

John Curran: Thank you, rear microphone.

Margaret Leon: Barbados ICT Professionals Association. I must first say a sincere gratitude for the opportunity to be here to participate in this ARIN conference.

And, secondly, as a Caribbean female, tokenism to me is a misnomer because we see ourselves as competent enough to adequately indicate and contribute to the ARIN environment since we are part of it. We have so far been silent, but we are silent participants. And we at this time are proposing to be more active in the whole process going forward. Thank you.

(Applause.)

John Curran: Thank you. Front and center.

Vint Cerf: I used that word, so I want to at least explain that I did not mean to suggest to anyone that any person put into this position by appointment, for example, was merely token. What I was saying is that we don’t want anyone to be treated that way or to be assumed to be a token representative.

I think and believe, as you do, that there are fully qualified people that we could appoint. And I take it from all of the input so far that we should move posthaste to do that.

(Applause.)

John Curran: Front and center.

Owen DeLong: Owen DeLong, Akamai, ARIN AC. I would like to propose an alternative process that I think could address the regional diversity problem without a lot of upheaval and yet would still allow it to be conducted through an electoral rather than appointment process.

We currently have six elected board members and a seventh who is determined by being the CEO of the organization. It turns out that we currently have an even mix of elected board members between the US and Canada. Three each.

Why not add three more positions to the Board and designate that each year there is one elected Board member from each of the subregions and move forward that way?

John Curran: Understood. I guess not to share the Board’s secrets, but we’ve had discussions of sector-based Board seats that would be the equivalent, Canada, US, and Caribbean, and whether or not we have a certain number allocated.

You get into questions of who can elect such people, is it widespread election and is it based on the qualifications, what does it take to be considered a representative of a region. Is it nationality? Is it work location? Is it residence? The Board is looking at that in addition to the appointment process to solve these problems.

Vint Cerf: The Board Governance Committee is seriously –

Bill Woodcock: As Owen knows, that’s the method used in AFRINIC, and there are many things that AFRINIC is not always happy about in itself.

There are many things that AFRINIC looks to improve, but that thing has always served AFRINIC very well. So that is one of the things that we’re seriously considering, and there are a lot of details to be worked through in implementing something like that.

So we are presently trying to put together a set of concrete proposals for comparison.

John Curran: Rear microphone.

Mary Anne Carter: Hello. Mary Anne Carter, the Canadian Chamber of Commerce. First-time ARIN attendee and a Fellow. I’d like to convey my thanks to ARIN for giving me this opportunity. And while I don’t have a significant number of experience with ARIN, I do have a lot of experience working with boards in terms of diversity. So I just wanted to make a couple of points and recommendation.

It’s discouraging when we talk about diversity that merit always comes up. We never talk about merit when we don’t talk about diversity, just a point to keep in mind.

I don’t think appointing one person to the Board is going to help this issue long term. It may in the short term. And I can’t help but think that does tokenize the process.

My recommendation is – and not fully grasping the whole business model of ARIN – but developing a working group would probably be very useful. It could be between the Board and the Advisory Council. People could put names or think of people that could work on this group to help suggest names to the Board who could run or be selected in the future.

But there is a number – I don’t think you need to reinvent the wheel. There’s a lot of work that’s already been done on this.

And one final cheeky point I want to make. When there are more women on boards, they’re more profitable. So something to keep in mind.

(Applause.)

John Curran: Front and center.

Milton Mueller: Milton Mueller, Georgia Tech. Owen stole my thunder because it seems to me the problem of regional representation is actually not that difficult to solve. The ICANN Board has regional representation slots. Many different boards of representative organizations have to do that.

So I would encourage you to explore options. I can understand how in Africa with an extremely nationally diverse situation that might be a little more complicated than it is here, but I can’t see any problem with having regional slots on the ARIN Board.

The gender diversity is a bit more complicated. And I am personally quite uncomfortable with the Board members selecting somebody out of the blue. If you’re going to do that, ask the community to provide you with lists of people that they would like.

And I also agree with what the person from Canada just said about this one appointment is really not much of a big deal. It’s kind of a short-term thing. You really need to develop processes for dealing with it more systematically. Thank you.

Bill Woodcock: Short term is how we’ve been thinking about it. I think we’ve all been thinking about this as something that we would do once as a part of a jump-starting process on the way to a structural fix.

So the question is more whether you want us to do this once on the way to a structural fix or wait and get the structural fix in place and see whether that works.

John Curran: Rear microphone.

Daledrey Barrow: Hello. Good morning. Daledrey Barrow, the Barbados government. I’m a fellow, and I must say thank you for the opportunity to attend. It’s been a very interesting process watching you all operate for the last three days.

I have a suggestion, which is why don’t ARIN ask for internships towards the AC. Let there be some spare positions where people can come and observe what is going on, the process.

It’s not easy. I’ve been here for three days. There are things I understand, things I don’t. You have the interest, but as a Caribbean person – I’m just saying this from the Caribbean experience – a lot of things are very expensive for us. So probably if you’re able to – even if attend remotely and experience that, then you get the opportunity to really see what’s going on.

Persons within ARIN can see if there’s really an interest from the Caribbean, because – I totally agree, tokenism. I’m a woman. I don’t want you putting me on a Board just because I’m female or black or whatever reason somebody else comes up with.

It has to be the person wanting to be there, that interest from them. So maybe that is something that you can look at. It doesn’t need to be ten internships, but just enough that it will cover all the regions if there is some interest from the particular area.

John Curran: Thank you for that excellent suggestion. We’ll be closing the microphones soon. If you have any comments, anyone who wants to have a question, anything from our host or sponsors, please approach our mics.

Scott Leibrand: Scott Leibrand speaking only for myself. I want to express an unpopular opinion in response to something that was said earlier, but first I need to recognize that ARIN has done a really good job, in my opinion, of outreach to the Caribbean in a number of ways. The fact that we’re having this meeting here is one aspect of that. The fact that there are so many folks from the Caribbean who have been brought here and who are brought to other meetings is also good.

I do like the idea of proceeding with an appointment. I would be fine with having perhaps one Board seat appointed – not appointed, one Board seat open to election only to members of a particular sector. But I really want to caution against using some sort of equal proportionality of saying three US, three Canada, three Caribbean as somehow being the fairest way to divvy up seats.

The reason I say that is you have to look at population. There’s a really large difference in population between those three countries.

So I would caution the Board to make sure that our outreach is proportional and make sure we have representation. But I would caution against trying to go for equality between vastly differing sized economies.

John Curran: Understood. No Board comments. Next in queue.

Bill Woodcock: If anybody wants to say any more about that issue, please do so because I’d like to bring up a different topic.

Jason Schiller: Jason Schiller, Google, ASO AC. I’d like to support the notion of having fixed regional seats if it was limited. For example, if there were three seats – one fixed for the US, one for Canada, one for Caribbean – and then three or more free seats that are elected, as we currently do, I think that would be fine.

Ron da Silva: Those are all great ideas. Another piece to look at, not just representation based on economies but also might be ARIN membership in the first place, how many official memberships exist in each of those geographic areas, and maybe apportion it based on that.

John Curran: I’ll close off the queues with respect to Board compensation and election. Anyone who wants to speak to that. Alan in back.

Alan Barrett: Alan Barrett from AFRINIC. Just for full information, I’m not advocating that you follow this model, but some more about what AFRINIC does. We have divided Africa into six regions. And if you go to the afrinic.net Web page and hover your mouse over About Us and click on Service Region, you’ll see a pretty-colored map showing which countries are in which of those six regions.

Each of those six regions has one elected Board member, and we also have two elected Board members who can come from anywhere in Africa. They’re not restricted to particular regions. And our election schedule specifies that every year certain Board members from particular regions are replaced.

John Curran: Got it. Thank you. I’m going to close off that topic. New topic. Mr. Woodcock.

Bill Woodcock: So with my PCH member hat on rather than my ARIN Board hat on, I wanted to bring something up, which is that we’re getting to a point where I think many or most of us believe that in the future longer prefixes, smaller IPv4 blocks will be used, smaller than /24.

I think there are two main things driving that. One is that there are people who will need 6to4 NAT in the future – new market entrants, for instance, who don’t exist today. New companies will be created that will need some access to legacy v4 resources on the Internet, and without a few v4 addresses for the outside of their 6to4 NAT, there’s no way for them to do that.

The other driving factor is the one that motivates me as somebody who operates the CDN. I think there are a lot of us who are doing CDN-style or cloud-style services who have a fair amount of address space, which we cannot utilize efficiently because there is one service per announced block. And this is an unfortunate intersection of routing policy and IP address policy.

So we have many potential customers coming to us saying can you advertise our ccTLD, for instance, and we say, well, you know, we have like five blocks left. We have to sort of pick and choose at this point. If you bring your own v4 space, we can advertise that. But if you want us to use one of our last few blocks, we have to think pretty carefully about it.

But if we could advertise /25s instead of /24s and expect those could be globally routed, we would be able to serve twice as many customers without asking for any more IPv4 space. If we could advertise /32s and have those be accepted, then we’d be able to serve 256 times as many as we do right now, again, with no additional allocation. Or we could serve 128 times as much and put half of it out there on the market for other people who might need it.

So those two driving factors lead me to think that this is kind of inevitable at some point no matter how distasteful to some people to accept more routes.

If it is the case that it’s inevitable, then the issue is just when. As long as we are sort of deadlocked in an argument about is it evil and will it happen sometime, we can’t ever move forward. Right? We can’t get to something that we can all agree to.

It is the case that ARIN does not deal in routing policy and ARIN does not dictate routing policy to its members or anybody else. However, there are other things that ARIN does not dictate and are not a matter of policy – like, for instance, government’s interest in the Whois – that get discussed in informal ARIN working groups that do not result in ARIN policy but because we are here together and the right people are in the right room at the right time. It’s easy to get people together over lunch or dinner or whatever, to organize efforts.

So the two of us have been talking over the last couple of days about getting a working group on acceptance of longer prefix in the routing table underway.

The idea being that we get the large network operators to collaborate in defining a timeline on which longer prefixes would be accepted and then implement that, completely outside of ARIN policy. But obviously this has to interact a little bit with the capabilities of ARIN’s back-end systems and so forth.

So some of us are trying to organize that. If any of you are interested in participating, please let me know and we’ll get a Mailing List going and so forth.

John Curran: Excellent. Thank you, Bill. Front mic.

Trevor Forrest: Trevor Forrest, Fellow, first-timer. I just wanted to – and I also live here in Jamaica. I wanted to, first of all, thank ARIN for giving me the opportunity to be here. I’d like to thank the ARIN team, my mentor, Owen DeLong. And I’d also like to commend you, John, on your handling of the proceedings.

John Curran: Thank you.

Trevor Forrest: And I look forward to more participation.

As I’ve told some of the colleagues here, it’s been a while since I’ve been able to attend something like this and get back into the weeds of things. It’s not every day that you get a chance to have face time with somebody like Vint. I’m really happy about that.

I want to say congratulations to the team for putting something like this together. It was a real success. I hope to see you guys back here soon. And when I say “here soon,” I mean Jamaica.

John Curran: Very good.

Trevor Forrest: So I think you all deserve a round of applause for the work that you’ve done. Thank you.

(Applause.)

John Curran: Thank you. Speaking of managing this, we are beyond time so I’m closing the queues. Kevin, what have you got?

Kevin Blumberg: Quickly, Kevin Blumberg. In regards to Bill W., and I just think that –

John Curran: Actually refer to Bill W. That’s not a topic here. Thank you.

Kevin Blumberg: What?

John Curran: Talk to Bill W. He asked people –

Kevin Blumberg: This is not – this is actually a question for ARIN. One of the questions that came up – I’m saying Bill reminded me, thank you – was in regards to ARIN allowing for parties to deaggregate their space moving forward and is that something that is allowed by staff in terms of if I have a /22, can I ask ARIN to now turn it into four /24s.

John Curran: At present ARIN’s systems are predicated on /24 blocks as lowest size. So, yes, down to a /24. We – in preparation for unforeseeable realities, we’ll be removing those limits and working on that as one of the tasks this year.

Kevin Blumberg: What I’m asking is does ARIN allow an organization who has a /22 to request it be deaggregated for whatever reason they may have.

John Curran: Deaggregate makes me think of rerouting. If you’re saying take a block and split it into two blocks, I believe the answer is yes. By definition you can form Kevin Blumberg 2, a small LLC, and split yourself in half, and we would end up splitting the block.

Kevin Blumberg: Within the same ORG.

John Curran: I believe we’ve allowed people to split blocks. Let me look to see if we’ve done it. I don’t see a policy reason why we would not. Our general inclination is to accommodate what we can if not prohibited by policy.

Kevin Blumberg: Thank you.

Cecil McCain: Thank you very much, John. Fellow committee members, thank you. I was here on the first day to welcome you all. I want to take the opportunity as a part of the comments to do some closing remarks on behalf of Jamaica.

For many of you it’s been an exciting three or four days and discussing issues and policies of relevance in the ARIN community. ARIN 37 has certainly been an eye-opener for me in particular. And I commend the Board and the leadership of ARIN for its stewardship along with the committee members for their cooperation and their input in making this event a success.

On behalf of the government of Jamaica and the people of Jamaica, we are certainly happy that Jamaica could serve as a host and a backdrop for this event.

As Jamaican and as members of the Caribbean, we’ve been invigorated by this event and looking forward to increasing our participation as a country and as a people in framing and creating the future for the Internet.

In this regard, and in keeping with some of the discussions I heard earlier, it so happens that I’m also proud to announce that someone who works in the Caribbean who is from the Caribbean, Dr. Patrick Anglin, has offered to run for a seat on the ARIN Advisory Council.

John Curran: Very good.

(Applause.)

Cecil McCain: Patrick works in the Office of the Chief Information Technology Office at the University of the West Indies and is not a stranger to the Internet community as he also participates in ICANN.

Patrick, please take a stand and be recognized, please.

John Curran: Hello, Patrick.

Cecil McCain: We hope that he will get the support of the community, and please feel free to make yourselves known to him.

Finally, I thank Cable & Wireless Business. I don’t know if the team is still here. Also Google for working with ARIN to make this event possible. We thank you for your input and ensuring that ARIN 37 was here in Jamaica.

We thank the staff and the management of the Half Moon Hotel for making the accommodations and facilities available to you all and to us all for us to enjoy.

As we depart this meeting, please go out and enjoy our beautiful country, our warm weather, our sunshine, our white sandy beaches, our trees, the taste and flavor of Jamaica, our food and our people. We urge you to return here for business, for vacation, or as an ARIN community for future meetings. Come back to Jamaica. It’s no problem.

(Applause.)

John Curran: Thank you. One final open mic. Go ahead.

Claire Craig: Claire Craig, University of the West Indies, St. Augustine campus. I’d like to echo the comments of Mr. Forrest. As a first-timer, this has been a really enlightening week for me in a number of ways.

First of all, I really do appreciate the way – to see how this meeting was run. And it helped me to put that into perspective for our CaribNOG meetings.

With my other hat on now as CaribNOG, I’d like to take the opportunity to thank ARIN and its membership and the Board for the support that it has given to CaribNOG for us to be able to host our CaribNOG 11 which follows this meeting for the next two and a half days, and we hope to see some of you at our meeting.

Thank you very much again, and I do appreciate being here for these last two days.

John Curran: Thank you.

(Applause.)

Closing Announcements and Adjournment

John Curran: With that, I’ll close the Open Mic session and close ARIN 37. Thank you. We said it once, but we’ll say it again. Thank you to C&W Business and Google.

Do not forget the survey. There’s a survey. Please fill it out. It gives us the feedback that lets us run the meetings you enjoy. We’ll see you as part of ARIN 37. If you can’t be there, we’ll see you remotely. ARIN 37 will be taking place on the road, we have a number of –

Unidentified Speaker: 38.

John Curran: 38. Thank you. We’ll see you at the ARIN on the Road sessions. We do sessions around the country, around Canada, in the region. Feel free to participate. If not, we’ll see you at ARIN 38 in Dallas, Texas, taking place in October.

CaribNOG follows us in this same room at 2:00 PM. Obviously we have to be out of here for them to be here. So we’re finishing up, but, please, if you’re interested in operations in the Caribbean, come down and participate in CaribNOG.

That concludes the presentation. Thank you, everyone.

(Meeting concluded at 12:20 PM.)

Network Sponsor

Webcast Sponsor