Archives

These are unedited transcripts and may contain errors.

NCC Services Working Group
14 May 2014
4 p.m.


CHAIR: So, it's time to start. This is as you all know your favourite Working Group, as usual, it's the NCC Services Working Group, it's more commonly called, the Working Group of love, and before we start, there are some housekeeping issues.

As usual, straight after this will be the AGM, if you haven't picked up your special AGM badge, which I haven't ?? it's in my bag ?? then you have to to do right now to the registration desk. It's also the report by the NCC will be given here rather than the AGM, that's considered part of the AGM but we do it here to save sometime. And as soon as we are done here, you all have to make your way as quick as possible out there, because otherwise Paul Rendek here will be given another 60 slot to talk about Internet governance. We have to clear the room as quick as possible because the RIPE AGM will take place in here, we have to recheck all the badges and the quicker we can do that the quicker the AGM will finish.

Agenda items. Welcome. That's what I'm doing now. All welcome to Warsaw and NCC Services. We have already selected the scribe, these days nicely enough the RIPE NCC has selected the scribes for us and thank you for Laura for doing the scribing. The agenda has been proposed, which we are going through now. We have the hijacking and due diligence presentation, this is somewhat a continuation of discussion in address space this morning.

The RIPE NCC update by Axel, the external relations update by Paul Rendek, then we have a short presentation by Potter about control of entity projects, we have a report from the NCC on the 2007?01 implementation and then I will give a short summary of where we stand with the policies, that's coming out of this Working Group.

And last, we have a publication of sponsoring LIR for Legacy holder, Nick, and then we have an microphone session. With that, to complete the administrative matters, the minutes were sent out sometime ago, I forgot for how long ago. We haven't received zero comments on them. So unless there is any urgent comments right now, I will consider them approved. Minutes are approved.

And that then brings me over to I think Ingrid goes first for the hijacking presentation. Ingrid.

INGRID WIJTE: Good afternoon, I am from registration services and I'll be giving a short update on what we have seen in hijacking of IPv4 space. So, I'll first define what we consider to be hijacking. I'll give some background, I'll discuss a bit of tactics that we see. And how we as RIPE NCC have responded and are responding to those.

So, what do we see as hijacking? We see that as a party that is trying to take control of issued Internet number resources under false pretences so pretending sob somebody that they are not and gaining access to these resources with the goal of reregistering them to themselves or to another organisation that is not aware of how these resources were changed. So, since last year, since we started issuing from the last /8 we have seen a significant increase in the number of hijackings, and we have seen that the target mostly unused or abandoned prefixes, in many cases that are not announced on the Internet, or that have not been updated in a long time. And since September, we have seen over 200 cases, out of which we have managed to resolve 81 and the remainder are still under investigation.

We see that the hijackers are really well prepared, they change according to the changes that we make. And we see that they do a lot of preparations, they resource the history, the changes in the company structure over time, and provide us the paper trails.

We see that they do BGP test announcements to check if these addresses are indeed unused or abandoned.

Expired domain names are reregistered just before we get an e?mail. They copy entire websites, identical pages on almost identical domains which is in the case of google.com is not such a big issue, we know Google, but when we cover 76 countries I believe, so it's a bit more difficult to recognise nice all the names and to make sure that these are indeed the web pages that were supposed to be looking at.

They target ?? after the preparation, three main processes: Database maintainer password recerts, holdership changes, company acquisitions, organisation name changes, and R 2007?01 processes where we seem them posing as resource holders trying to find and LIR and getting their documentation approved.

In these processes we ask for some documentation and we receive many different things, faked IDs, company registration papers, signatures of real people on contracts that have never heard of these documents. Stamps, signatures, notaries, anything we have seen so far.

There is a few reasons why we look closer at some cases. Main situation is that we receive a complaint, an abuse report from the lodge met resource holder that all of a sudden their address space is announced and that makes us research. The experience of the IPRAs that see these requests a lot and they notice that something is just not correct, like, how big is the odd that the CEO, I'm just naming, of Google would sign a transfer agreement. Those are things that catches our attention.

And one case is linked to another. So, we investigate one case, and it takes us to a whole bunch of other prefixes.

What do we do? We check for the history of the companies. We go to the public records, national registries, anything we can find, and we then contact the former and the current resource holders where possible. We contact the people, the names that we find on the documents. We phone them, we send them e?mails and in many cases they have never heard of us, they have never heard of documentation and they are also willing to confirm that in writing. And we also use contact information other than what was provided to us, so we either have it on our record from the original request or we find it online or elsewhere.

And where we find that something is definitely wrong, we revert changes immediately, especially in cases where the legitimate resource holder is present and is complaining. If there is an inch of doubt, we allow time to support the claim to the address space and in the 2007?01 cases, the resources are deregistered when there is no legitimate resource holder present and often through the normal process that we have published, and in the case that we can prove member involvement, we would close the LIR account and deregister the LIR resources. This is really difficult to really prove as it can be merely a case of a member not doing all their due diligence checks, how can we be certain that that's not the case? So far, we have not proactively had to close a member account, but in many cases they stopped responding, didn't pay their bills any more, and that ultimately led to closure. Where appropriate, we would report to authorities and finally, we work with the resource holder to make sure that their resources are protected from then onwards.

A few difficulties that we encounter. While we are performing our checks, in the case of a resource holder complaining, they demand immediate action while we are still putting all the dots together and getting everything checked and convincing, it can be very difficult to find the resource holders, as I mentioned these are older registration in most cases where companies have changed names, things are updated, so it can be very difficult to find them. And we see things happening, like I mentioned the BGP announcement, we see it, but that in itself is not a reason to take action, but we see it, so that's difficult. We catch them, we stop them, we refer them, however it's near to impossible to stop them from trying again. We don't have a blacklist so in case of membership a member can open a new account. If they are not a member, well it's even more difficult, and in effect, there is really no effective penalty but there is potentially a lot to gain. Earlier today we heard some numbers, so it's it can be worth mall apparently.

Following our investigations, we get a few typical responses. We get silence. In Dutch we have a saying that silence is golden or it speaks a thousand words. We don't know. We are a victim of fraud, which could very well be. It's not necessarily that the people that ended up with the resources are actually the people committing the fraud. And worse, we get a lot of denial and anger. Our IPRAs are insulted, they threatened with threats and lawsuits against themselves, not necessarily against the organisation. Will come to the office. And you'll see what happens. We are bound to, we can't say everything but names are spread on mailing list, on fora and we can't really react to that.

We have offered arbitration in many cases but so far people have not taken up on that.

So, we are really trying to continue to maintain the relationship of trust, that's the way we have always operated and that's the way we want to continue and we're trying to find this balance between making sure that we are talking to the right people without being overly difficult or overly careful, and I'll be heading over to Athina in a bit regarding the due diligence that we have, there is been some discussion. But, we really need the support as we're trying to protect the resources of our members and of the End Users.

So that's what we do, and I'll close with what you as End Users can and should be doing and that's making sure that your information is up to date, that your database objects are protected and when you are acquiring resources, make sure that you are talking to an authorised party that is actually authorised to hand over the resources.

And you can contact us us at that e?mail address in case of doubt or questions or ?? and more information is found online and I will take questions at the end, so I'll hand over to Athina.

ATHINA FRAGKOULI: Hello, good evening. I am the legal counsel of the RIPE NCC. And as Ingrid said I'm going to talk to you about the due diligence checks we perform in order to ensure the quality of our registration data.

We had a discussion about this topic in the morning in the Address Policy Working Group. There, I gave a shorter version of this presentation, now I'm going to give a full version of it.

So, we do have ?? we have some technical problems. I can start anyway.

Our due diligence procedure is documented. It's available online and it has been there for quite sometime, since 2012, and is available for anyone to have a look into it:

Here it is. The due diligence procedure. We performed some due diligence checks in order to complete registration and in order to change the registration.

So, we only register resources to those that have a contract with either us, the RIPE NCC, or with a sponsoring LIR. Of course we have to confirm that the signing party really exists, because if they do not exist, the contract is not valid. So, how do we confirm that? If the signing party is an organisation, a legal person, then we ask for registration papers from a national authority to prove their establishment, their existence, if they are a natural persons, individuals, we ask for identification papers, that is IDs, passport or any kind of confirmation issued by a national authority.

Now, after the registration is complete, it can happen that the resource holder wants to change something in the registration, things have changed, names have changed, and so on the so, in that case, we also prefer some due diligence checks. It is very important that the person that submits the question for a change is authorised to do so. So we only accept such submissions from either a registered contract person, an LIR contact, or any other authorised person, that can be a person that is authorised in general to represent the company. It can be a curator, in case of a bankrupt company; it can be a liquidator in case of a company in liquidation. So, if there are doubts about the identity of the person that submits the request for a change, we ask either for identification documents, if there are doubts about their authority, we ask for core decisions, that shows that they have been appointed as a curator, as liquidator and so on.

Also, we need to be sure that the requested change is correct, is valid. So, we ask for the documents that support this change. This can be registration documents again, from a national authority, it can be court decisions, it can be agreements, confirmation, etc.

And we do what we can to make sure our registration data is correct and we avoid any attempts to hijack, but...

KURTIS LINDQVIST: Thank you, Athina. Any questions, this was discussed in the Address Policy this morning, so maybe you are all identified to death by now, but any further questions, comments? No. Okay. Thank you.

(Applause)

I realise that I forgot when we started, I forgot to say who I am. I am the NCC Services Chair, Kurt Lindqvist. We are the chairs of this Working Group.

Next on the agenda then is Axel.

AXEL PAWLIK: Hello, good afternoon. I am Axel Pawlik the Managing Director of the RIPE NCC in case you do not not know me. And I want to give you a quick update of the things that we are doing for you, whether you are a member of the wider community.

Some of the things you probably know already. I think we did a bit of a shout and dance around this one. We have surpassed the 10,000 members recently this year, so that is, I think, quite a nice achievement. You do see if you look very, very closely, that about 2000, early 2000, the curve steepens a little, and we do think that this has something to do with the running out of IPv4 address space, possibly some of you being sent from your upstreams directly to the RIPE NCC to get that famous last /22 directly from us. So, new members there. That's a good thing, we like it.

Some items from the annual report. I am sure most of you have read it, every last single page of it, but those of who you did not receive one because you are a new members and maybe you forgot some things, I'll just recap some of the major things there. Strong growth. As I said, for the first time in the RIPE NCC history more than 1,000 members per year. You'll see also connection here between the new members and the nearly 1,900 IPv4 /22 allocations, so that says that all the new members who came in after the v4 depletion got their /22 but also some existing members already, but that also tells you that by far the majority of our existing members have a little bit left with us, their last /22, if you want to come and take it and put it and use it you are more than welcome, don't forget about that.

Also nearly 1800 IPv6 allocations which is great because that takes the number of members that have IPv6 allocations from us to more than two thirds of our total membership base, which is great, but not great enough because apparently most of you put the stuff on the shelves somewhere, it looks great but it doesn't do anything. So please if you have a v6 allocation from us and have not rolled out the IPv6 services, do so.

We have processed quite a number of PI contracts last year, it's 6,400 per day, that's quite a bit if you look at that. That's the infamous 2010?01 of course and we are not quite done with that. 20% of our members have resources certified, which is great, it signifies some interest in that service. More than 5,000 Atlas probes are active and out there and are being used more than that by now. That's also a great thing. You'll see that service is being recognised as useful and many studies are being done on that.

And the last line, we have ?? we are reorganising our service portfolio a little bit so that all the statistics that we do a banded under the RIPE Stat service. We have seen in 2012 more than 120,000 users there but that really sky rocketed, so that gives us a hint that the bundling, the presentation is probably going in the right direction so we really like that.

Financials. On the operation expenses, lower than the budget, staff numbers, in spite of the increased membership base and a wider services and all that, are steady and that means they are also 3% lower than the budget levels. Reserve levels, the Board says we want to keep about a year's operational expenses in the reserves; that is apparently very difficult to get right because more members come in than we budgeted for so we have more money in the reserve. So, we try hard and think it's around the one year, it's good.

The cost per member, and I'm a little bit proud of that, has been falling against 2012 by 6%. That is quite nice and that's something that I strive to continue to support there. Of course more members help with that, so keep them coming.

Generally, the health of the RIPE NCC, my first priority is that the RIPE NCC remains useful to its members and the wider community, that's the number one priority. Doing that, of course, the place needs to be stable, resilient, secure and all that, so that's the priority as well.

Of course, during this week, you hear quite a lot of updates around the specific services, I go through a couple of high level points here. Database, documentation improved, release processes being discussed, we take our queue from the mailing lists and from the meetings here from you and we try to do as well as we can possibly.

We used to do audits. We have changed that. Basically with IPv4, runout happening, members don't come back to us as regularly, so we say every three years, we want to make sure that we touch every single member and make sure that all the holdings are reflected correctly in the registry. We have more than 10,000 members, by three years, it's quite a lot of members that we have to touch in that way. So, we change the audit into what we call the assisted registry check where basically we send out what we have information on your holdings and ask you to confirm or change so that they are correct again.

So we have started doing this and the feedback is that from the members, is that are contacted in that way, that that is actually seen as quite helpful. Lovely.

Yeah, I have been asked whether I should say something about the internal systems. Yes, I am saying something about that because those are things that you are not seeing directly, but they do contribute to efficiencies, in?house, basically it's old stuff that you are ripping out, rebuilding, making more efficient for our internal use, and indirectly, of course, you benefit from that, you see the efficiency gains overall.

Also, talking about resilience, you know that Amsterdam is under sea level and that maybe with melting away the levels are rising, my personal bedroom is on the third floor, my office on the first floor, but still you never know, so we are making sure that we ferry off some of our servers into far away countries and put them into deep mountains so that they are safe and continue to be of use for you in case.

Also, and that's something that we are very proud of, it took us quite a lot of work and also quite a lot of feedback from you and other people, corporate governance, transparency, we have worked very hard to document all of our processes as arcane and hidden as they used to be maybe, to make excrutiatingly clear what we are doing, why we are doing this and why we are asking you all those pesky questions that you know you have heard before.

So, that is, of course, helpful to ourselves like why are we doing all these things? A bit of a review there. Documentation there for you that you know what we are doing and how this all works together and not unimportantly, for the rest of the world who wonders about those weird RIRs registries and what they are doing, in terms of accountancy, it needs to be clear to everybody what we're doing, how we're doing it and that hopefully it is right. So at this point, I'm happy to say that we feel all our corporate documentation is up to date. But of course as you are evolving as our membership. We are evolving ourselves and things might get out of whack and we try to keep up. But in case you see something that you think might be clearer in documentation, let us know. Please.

Other points of progress. As I say 2007?01 isn't quite done yet. We knew when we started, I think around 2007, 2008, a couple of years ago, that it was going to be a sort of a long tail. Quite a lot of things were relatively easy, organisations easy to contact, they have documented contact points. Others, not so much, and that is where we are now, we have 1800 cases left that we find difficult to contact, but we're working on that. Again, for the sake of a correct registry.

Regional outreach, you have heard about that, that does include, of course, all the Internet governance theme and we'll hear about five minutes from Paul later on, but also it's regional outreach to you our members. You have heard about staff being hired in Moscow and in Dubai, and the local office in Dubai. But this goes further. It goes also into pockets of Europe, south eastern Europe where we have seen relatively low participation from, let's go there, take a team turn up for a day or a day and a half and talk to the local community there and we see that that is very, very popular with the locals, we get a lot of feedback that we wouldn't have gotten otherwise. So we think this is really an important thing that we should be doing.

Training ?? engagement, transparency. I talked about transparency, corporate governance and all that stuff. It is important and we have, again, put quite a lot of effort into making things even clearer for yourselves, for ourselves, for the Board, for the external world, engagement of all sorts of agencies, governments, law enforcement, regulators, anybody.

Training is one of the most important sources of feedback, maybe apart from the membership survey. We meet face?to?face with what is on the slide, more than 2,300 people in 115 courses in more than 30 countries. Our region is very, very big, more than 31 different countries. So, this is something that's always in high demand from you, and also from ourselves, because we see all this feedback face?to?face is much nicer than meeting you via e?mail. So we want to continue this. And maybe increase it within reason.

Resource certification for PI space is now done. Live chat, we have the long long discussion, oh the RIPE NCC stuff is always only available through electronic mail and how boring and how hold fashion /S?D is that, can't we just call them or chat with them? You can. We have started piloting this thing, what it does to service levels and quality, and it does work, so we are slowly care three widening live chat facilities throughout our (carefully) departments.

Like I said, he want to be useful for you. We want to give you tools that are useful. We know that the IPv4 /AOPBL eyes err was very useful, is still very useful for you and there were shouts to do that for v6 as well, of course we do that then.

Access, Stuart, safety, all that is something that we keep an eye on, so two step verification for RIPE NCC access for members is implemented as well.

Of course there are many many areas that still need attention, and that will never go away /OBL, so, the RIPE NCC website is a lovely place, it's very colourful and lots of things to click on, I like that. However, I do find myself being led to Google to find stuff on the RIPE NCC website and that cannot be right. So, yes, we are looking at that for quite sometime already, and we have done some surveys with some people from the community as well, how it should look like and what type of people you are, what you are looking for, so that's being done.

RIPE Atlas, like I said is being seen ASUsful, and of course it's not big enough, it should grow further. However, at some point, the membership money that we want to pour into this needs to well be contained, so costs need to be contained. We have a plan and we'll talk about that further. We have a plan to limit the financial contribution to probe growth throughout the region after ?? after the 10,000 probe is online, we'll get third party funding for growth after that. However, 5,000 is a lovely number. We want more than in terms of probes.

Resource transfer processes, you have heard what was said earlier, we need to find that balance between being pains in the neck and doing a good registry, so, we look at processes that support transfer resources, we want to make it as easy and low threshold for you as possible while maintaining the quality and the correctness and reading out of weirdnesses there.

Statistics: I get hit in the back of the head if I don't say this, by Paul, he loves this, he wants more statistics out there. And we understand you want more statistics out there. Seeing that stats are used by yourselves and by the rest of the world, by governments, regulators, it's important stuff that we are sitting on, so we should make it more accessible. Please do let us know what specific statistics you would like to see from us and we are happy to set them up.

I'm not just saying that because Paul told me to.

Other stuff, I'm sure you have it all in your booklet, you know exactly where you want to be the rest of the day and the rest of the week, we're talking about more details in all of those places at those times. Have a look.

The survey. Like I said this is probably the most important, apart from RIPE meetings, tool to gain widespread feedback from our membership and other stakeholders as well and of course it makes us a little bit proud, I do admit, to get the results back and to get positive feedback on most of the things that we are doing. So that is fine and we love that. But even more important, other things that are not perfect yet and you comment on that you want improved.

So, thank you, first of all, again, to all of you who have contributed to the survey and have filled in the long thing and spent your time for that, thank you, that is very good. We have gone within senior management at the RIPE NCC and looked at all the results and tried to distill the more obvious things and maybe also the not so obvious things that we should be improving and we found there is nearly 50 points that we want to improve. And of course, we document that in terms of transparency, so that you know what we are doing and thinking, it's up there. And those things have been made a priority for my seniors to ensure that we are working on them, that we are improving, and we have done some of that already and others are still ongoing and by the end of the year, I hope that this is all done, plans are in place for all that.

Those are the high level things that we are looking at there. And you see some of the things have been done or are very much in the process. Regional outreach.

Languages, yes, we want to work on more languages as well.

Voting procedures apparently have been improved, thresholds have been lowered, 1,000 ?? more than 1,100 votes have been registered this time around for the GM in a couple of minutes. That is great.

Lots of other things basically, I don't want to go into the details because I'm running out of time here.

Like I said, we distilled the major points from the survey and of course we do present that to the Board, get the board buy?in, maybe spend more money in that direction, or that basically get also direction from the board on what they think is important that we do. Like I said, most of the things are done, or at least are pretty much on the way.

And as usual, we will report the wrap?up report on what we did with the results on the survey as we started many years ago already, we'll do that again before the end of the year so that you know what we took from that and that you are inclined to help us again next time when we ask you.

Finding the balance. I won't talk much about it, you have just heard it from Ingrid and Athina. We don't want to be the bastards who annoy you, sometimes we feel we have to do a little bit of that to ensure that the information we have is correct. So, it's an interesting seesaw that we find ourselves on, but you understand, I think, what we are talking about there.

Growing membership. Yes, so many more members, and more participation from different parts of our service as well. We do send our Board members out to various events around the world and you might have met some of them in places you didn't expect them to turn up, and they are gradually accepting that load. Also they have said it would be great if you could share a little bit more in terms of travel and also skill sets, it would be nice if we had more people from different backgrounds, you know, membership but also maybe financial backgrounds and stuff like that. Different nationalities, different corners of our service region. The beauty of this whole place, of the RIPE NCC, of its membership, the community, is in diversity and we would like to say that not only reflected within the staff, but also within our Board, so, that's the decision to add a couple of seats and of course, you can fill those seats later today.

Spoken languages, agendas genders, I think for the first time we have ladies on the candidates list. It's great to have them on the candidate list but it's great to have them on my Board as well if that happens. So, like I said, more than 1,100 registered votes, which is brilliant from 60 countries. We have more than 60 countries in our service region so we need to work on that a little bit.

The last elections 300 votes were cast so I'm saying, this obviously is your big day to influence the direction of the RIPE NCC and to get your candidates onto the Board. And your vote counts, but really only if you use it. So, instead of saying 1,100 registered votes, I want 1,100 cast votes. So do it, please. What you get for that is your candidate on the Board, they kick my behind to do what you want them to ?? want me to do, or something like that. You get the idea. Generally, we like your guidance, we like your feedback, we like to talk to you, we like to party with you too, which we will do tomorrow again. Use the chance to use your vote.

Any questions you have for me at this point? I'll try my best. Thank you.

CHAIR: Any questions for Axel on the update or any activities he presented on? Okay. Thank you Axel.

(Applause)

KURTIS LINDQVIST: Then next up is Paul Rendek, with an update on the external activities. Paul.

PAUL RENDEK: I'm more paranoid about the time than about the content of my presentation. I have got a two minutes left sign already.

Good afternoon everyone, my name is Paul Rendek and I am the director of external relationses for the RIPE NCC.

It's been a year since I have been at a RIPE Meeting so it's fantastic to be back here and see some of the great familiar faces that are here and some of the new ones as well.

While it has been a year since I have been around here to actually give you any updates about what we are doing, I am sure you got plenty from the wonderful colleagues that I have, but I'd like to give you an idea of what's going on in the external relations area. It is an area with where we've pumped up a bit of resources and we have quite a few new things. And I'm happy to share those with you.

So, taking a look at expanding ourselves in our regional presence. We are very fond, actually mat the RIPE NCC, with any kind of feedback we get from our membership and community, and I take the stakeholder surveys that we do very seriously and they guide us heavily in our ER activities and what we do.

So based out of the stakeholder survey that we did, these are the main points that you see that have come out of the survey that we have concentrated on, and those were more local engagement at meetings, even with our members or at any kind of events where we can be, have a little bit more of a local presence. More engagement with non?EU governments. I think that external relation is a nice mix of working together with the community and members and stakeholders such as Government, law enforcement, intergovernmental organisations.

And also, staff based out of Amsterdam, out of the Amsterdam office, I think that we have started this and I will show you what we're doing there. It's been very interesting and it's been quite successful for us so far, so, we're keeping that moving.

And more non?English language support. We have started some work on that as well. Positions that come from the RIPE NCC that go towards any events or that we work on to support any events that we do are translated into Russian formally but in a Russian that can actually accepted by the Russian Government so that he can see the positions that we have from the RIPE community and the RIPE NCC so we have started this process making sure that we can actually deliver what with need to.

So since 2013, we have added some staff actually in the Middle East, in the Dubai area and also in the Russian speaking region, particularly Moscow, in March of this year we. So basically, the balance here is between technical and some more policy or more public affairs style staff, this is kind of the area of expertise where we have tried to find the balance. So if I show you.

This is currently our ER team. It's a very diverse and an extremely talented group of people that I'm very happy that I can work with, Chris Buckridge, Marco Hogewoning, Sandra Gijzen, Hisham Ibrahim is very recent to us ?? these names are probably quite familar to you ?? Chafic Chaya from Lebanon will also be based in our Dubai office, and Maxim Burtikov ?? every single one of us is here today that you see here, it's the first time the group has come together here in Poland. We have a question mark, the team is not quite yet complete. We have one more that we will add in the Russian speaking area, and that person will be interviewed ?? well, that set of people, the candidates will be interviewed later this month and we'll be making a decision to add that second person in and our team will be complete. So I'm very much looking forward to that.

Very recently in March we had a Dubai office opening. Fantastic. We had a lot of iSTAR organisations supporting us there. We had lots of people were there. We had a wonderful celebration and a nice opening of the office. Our Chairman Nigel Titley, together with Axel cut the ribbon of our door. We had to keep that quite small because the office certainly would have been have been big enough to hold the whole party there but we did transfer it and had a really nice time opening that is office.

The goals of the external relations, we have been pretty busy setting the goals. Taking a look from the survey taking a look at what are coming towards the RIPE NCC to build the goals that we have.

Basically, we have been positioning RIPE NCC as a centre of technical expertise definitely from to the Russia down to Yemen corridor, we have got a lot of activities and we are pretty familiar with what goes on there in the European area so it was time to spend a bit of time there, we have been busy setting ourselves up that way. We have been ensuring that the RIPE NCC and RIPE community and position and input is heard in any of these I G events that you see, that environment is growing, it's quite hard to get your head around everything that's going on, as you probably would have seen from yesterday's I G panel, but we tried to be where we think it's important where we can have as much influence as we can.

We're also trying to get broad support for the community driven bottom up open and inclusive processes that we work under. You hear the word multistakeholder; when I take a look at the word multistakeholder to me that means bottom up and open and inclusive, we have been that from the very start so I'm happy to say that I don't think if we look at the word multistakeholder, that we have too much to learn there. We can always do a lot better and expanding in what that is but I think we have a very firm understanding of what bottom up, open and inclusive means. Of course increasing the trust of all Internet stakeholders throughout our service region and beyond. It's great to work with the membership and the community, but there is a wider environment out there that we need to be part of and we need to make sure that those folks trust us as well, as well and as much as our community and our members do.

So threats to RIPE and RIPE NCC. I think it's important to outline what are some of these threats that we're looking at so then you can see what kind of work we have to do or find tomorrow kind of measurement as to what we're doing in ER.

So if you look at this, failing to engage with all of our members, I think what we have been pushing very hard to make sure we cover all of the 76 countries in our service region as much as we can get around a, I think we had quite a big push with your presence but I think failing to engage with all these members would certainly not be a great service for the RIPE NCC or the community.

The second would be regional needs that the not being accommodated, and I think that, again, here through the survey we saw some of the needs that are coming through the new members, they are different from the old?time members that we have, I think that's also difficult for us to find the balance now because we do have this great growth of members and they are very different, they are coming also from different places, we have got this boom happening from Russia down to Yemen in Internet, so we get a lot of members there, we have a lot of activity going on that's regional, it's not necessarily taking place in one place, so, we need to make sure we can accommodate this as best we can. Another one is the take over, or any kind of change in the bottom up, open and inclusive policy making processes that we have. I have put the example here as the ITU, they would obviously be the big elephant in the room that everyone would recognise, there are other players here too. So I think this is one area we need to make sure we can defend. And of course, governments making poor public policies. I have said this so many times when I have been up here, not only here but in other events. We are not interested in making public policy. We are too busy running the Internet. But I think that with some consultation, we can help governments make better public policy and I think that's great. So, I think that's one of the threats that we see happening and we do see that governments and other stakeholders are having quite a strong set of inputs into what's with the Internet so we want to make sure we are there and we can be as influential as we can.

So, the goals and maybe some of the results coming from the goals. I think engagement, Patrik Falstrom hit it on the head yesterday, when he said how are we actually managing to move forward and change what's happening or get people to subscribe to what we hold so dear in our membership and our community and that's engagement. We keep doing this, we doing this with full force and I think that having done that, we are built better communication and understanding with a lot of governments certainly in the Russian speaking and in the Arab world I think we can definitely feel this. We are responding to a lot of the needs of our regional stakeholders, not only the membership, but of course also intergovernmental organisations that are scattered around our service region.

And I think we have had a real positive response after we have set the Dubai office and hired some of the local staff and of course the Moscow office and I have listed the countries here with I have had formal responses from both Government Ministries and also members in that area, and it's a nice long list of countries here, one of them isn't even in our service region, the Egyptian Government was very pleased to see what they had done in the Middle East, they lay in the AfriNIC and also in the RIPE NCC area that way so it was quite nice to see the Egyptians were supporting a lot of what we were doing there.

The RIPE NCC is also recognised in a respected organisation in this whole Internet governance environment. We can feel this, we are invited to events that normally we probably would never had our foot in the door on. So, it's nice to see that these governments that have meetings in preparation for what they are doing in other events, in other global events, are inviting the RIPE NCC to be there and looking for our expertise and our advice there, so that's brilliant.

And of course the last piece I think that we still need to work on is measurement and reporting. It's very hard to measure the success of something like external relations and publically affairs, what is our footprint? How are we going there? So I'm going to be working together with my team to figure out how we can measure and report effectively to you so that you can see where we're spending this money and whether you think it's effective or not for our membership and our community.

And some recent events. We had a RIPE NCC round table meeting in Brussels in February. We had the meeting in preparation for the ITUWTDC and also talking about the pleny potentiary meeting coming up towards the end of this year, that will be a very big meeting and something that we're all working towards. We can see that the momentum to get us there is starting to take rise and we certainly want to make sure we're influential there.

So we pulled together another round table meeting in Brussels, that was great. We had over 60 public sector attendees at this meeting. It was the biggest round table meeting yet. That's fantastic. We are finally starting to see the governments are coming together, asking us for our opinions, actually before they submit their papers into ITU events. How great is that? It means that we do have that influence there that we can give them the expertise so that they make the right kind of submissions. We have seen that we have got increased interaction with intergovernmental organisations, we are a very popular group inside OECD for instance, also in the Arab league, and we have quite a lot of deliberations with them and they want to do a lot of work with us, in producing papers, even other intergovernmental organisations that want to do trainingings together with us in cooperation, so that's all increasing. So that's wonderful to see.

I think we heard some news about NETmundial, so I actually get this quite short, a cut a lot of this out because there was quite some discussion there. NETmundial was a successful meeting in my opinion, but it was a meeting, I think we did see there was a great document that came out of a multistakeholder approach. That's very positive. But again, you know, you see that there are other meetings that take place in the IG space, and they might not be so successful from a multistakeholder perspective, so, again, sometimes you win, sometimes the win maybe isn't so big.

We had the meeting though in April, as you all had been informed. They have produced a NETmundial multistakeholder statement. For me taking a look at that statement, I need to take a look at that with my team and see what we can actually operation eyes and when we did that quite quickly, we ran through the draft and thought what would we operationalise for RIPE NCC here? We could actually see that we are already doing a lot of that, because it called for this open, inclusive, and bottom?up approach to kind of Internet governance and Internet governance principles and kind of the road map forward. I thought to myself, we're already doing that, so I guess we just need to continue going down the road that we're going and make sure that we can see the success there.

And the last thing is that obviously in there we saw as I mentioned, there was a lot of endorsement for this bottom up, open inclusive processes, which is great, right up our alley.

And the last thing I wanted to talk about here is the NTIA transition, I won't go into detail on that. I think again on the panel, we introduced that yesterday very briefly. There is a whole idea that the US Government oversight of IANA could be removed in September of 2015. Of course, RIPE and the RIPE NCC are key stakeholders of IANA, so we definitely need to be involved in that process and we are very much involved in this process. I think from this meeting, taking place tomorrow, in the Cooperation Working Group, we will have a whole session where the RIPE community can come together and discuss some of the questions I have listed down here, what is IANA oversight? What is that for us? What does it mean and what's the role for the RIPE community here? And how are we going to contribute to this global discussion? I can tell you, RIPE NCC will be the secretarial that will be collecting all of this information, not only from RIPE meetings but every other event where RIPE NCC offerings, whether it be regional RIPE NCC event or an ENOG or a MENOG, we will definitely be there pulling from the community, well, asking the community the same kind of questions, pulling that data and feeding that into the ICANN process. So I'm hoping that we can be a leader as the RIPE community and RIPE NCC in how we are going to get to this transition.

And that's it. Does anyone have any questions for me?

NURANI NIMPUNO: A very quick comment on a very complicated topic. So, one of the big challenges I think with this external relations work is a bit what we discussed yesterday on the Internet governance panel, how do you make sure that what the RIPE NCC does and how you represent the community gets fed back into the community and how can you kind of engage the people with those topics? And I think one very good comment that was made yesterday is that you need to make these issues concrete, so I really liked, for example, your slide showing the threats, and I think that gives a very quick overview, and there is a lot more that goes in there.

I also think it's hard sometimes to summarise these big developments only at meetings by giving a presentation. And I think it would be great if the RIPE NCC could look at finding a little bit more ?? like, more ?? communicating with the community in a more sort of continuous way, and I really, just as examples, I think the ISOC blogs for example work really well, they comment on various areas, policy areas, technology, and they have got different people writing, and for example, the NETmundial, very quickly afterwards, Cathy Brown wrote a blog post and it gave her reflections on what happened at the NETmundial. I really like Yadi Akhov Chair blog as well, it's also one of of those without having to give a full report over developments for the last year, just quick reflections on various things that happen out there in the community, and I think that could be a nice way of making information accessible to the community. And getting people to comment on it as well. Just a thought.

PAUL RENDEK: That's a fantastic suggestion, Nurani, and I appreciate you understand how difficult this is because we are often side by side out there when we are in that I G space and I know you appreciate how difficult this can be to bring forward. One of the things I want to earnings we have definitely as a crew be, and I'm sure everybody in this room that's working for me is noting this down, how we are going to do this. One of the things that we have had a great revelation on is when we looked at the survey, that the respondents there told us you know what RIPE NCC, we love what you are doing in this IG space with ITU and kind of the global area because we can't really get our heads around that but we don't want you to be doing these things locally, right, because we have got great ties and we have got great tentacles as organisations to our local Government so maybe we can help you in this space, so one of the things we did talk about as a team is that we said all right we need to buckle up here because we probably a good grip on what's going on globally but we're probably not providing the information in a great concise manner to our membership and community so that they can run with what they need to run with locally. It's something that we have taken on board. I think that's going to make us ?? I think that's the winning formula, because obviously we have got many more hands on deck. So we have discussed that as a team and I think you will see a lot more of concise material that can be used when you have to go speak to your local governments about the issues that are being hit here. So thank you.

AUDIENCE SPEAKER: I fully support previous comment. And also, as far as I remember, a year ago your meeting at the general outreach, I asked you to publish plans of regional outreach, at least in Russian speaking region, because, okay, you have started there but we have seen only one e?mail and maybe two stands for you and not at this time. It's not too much for one FTE because we will look at the financial reports, so maybe you will publish plans for your regional outreach activities and so on, discuss it maybe with community. So, it's again, it's ?? I repeat my question about publishing plans, regional outreach in specific regions maybe. And maybe there was some meetings which we have not noticed because again one e?mail on it, maybe there was some meeting in governments, and you just haven't published a report on this. Please do this.

PAUL RENDEK: Thank you for that suggestion. I can tell you that at the ENOG that's coming in two weeks time, our Russian ?? will definitely be featuring in telling you exactly what's going on there, so you can expect that firsthand. But you're right we need to be doing that, drip feeding that on the the list to you folks.

AUDIENCE SPEAKER: Maybe again a little suggestion, maybe having blog post and Twitter posts in local languages about activities of RIPE NCC and. We have a Twitter hash tag about this even, maybe we'll see a report from our Russian speaking stuff in a short time. Thanks.

AUDIENCE SPEAKER: Patrik Falstrom. I think that you are doing quite a good outreach work in the various events and fora which are not sort of the RIPE related. What I think you should do much better is to detect what is discussed in those fora, for example, these 30, whatever it is, bullets and main items and public policy items that are identified in the counsel Working Group for example and I'd like to you bring that back to this community because I have seen this week I have seen a couple of presentations where people bring up issues which are overlapping with what those public policy issues are. Because, either their processes will bridge the gap over to us or we have to reform into a multistakeholder process that also takes into the account the interest from the people that work with the public policy and as we heard yesterday at the panel, I do appreciate what Shane said that we should try to change the public policy by normal elections and whatever we have. But in the meantime we need to take up whatever interests they have. So please bring back to the work ?? take the items for example, counsel Working Group and bring them back to the various Working Groups here at RIPE and see what the reactions of various people are.

PAUL RENDEK: Fantastic. You have brought this up on the cooperation group mailing list, which is great Patrik, I know that we have had discussions with the Cooperation Working Group chairs about this, how we could actually feed a little bit more of the topical agenda point into the Cooperation Working Group, so I'm hoping that tomorrow we can discuss that a little bit more.

AUDIENCE SPEAKER: No, not to the Cooperation Working Group. I want the Database Working Group to deal with the private data privacy issues, I want the Address Policy Working Group to work on whatever kind of blocking issues, whatever kind of Working Group, for example, in the DNS Working Group, we discussed the issue in Turkey. I want the Working Group to work with these topics to take these issues, public policy issues seriously.

PAUL RENDEK: Very good point.

CHAIR: Any other questions? No. All right. Thank you Paul.

(Applause)
Next up is Piotr to talk about the ?? reporting of RIPE projects.

PIOTR STRZYZEWSKI: Hello. I want to ask you an open question. Do we need more auditing on the RIPE NCC projects? I was thinking about this presentation for a while, and even that question, which is the title of the presentation, I'm not sure of ?? which is not a good idea to give the presentation, but anyway...

I want to state that RIPE Atlas is just an example here, because I have an experience with that and I want to share that experience, that story with you, and let's start.

So, the story is quite simple. When I was in Rome, you should follow what Romans do when you are in Rome, so I ask for v1 probes because they were giving them out at the meeting and everybody was asking for them, so you know, I am following the Romans. And there was black small v1 probes, very nice, then I go back home, plug it in two different ISSs everything was working like a charm, everything was fine.

Then a few years later in Dublin, I have seen those v3 white probes and, you know, white is the new black, all of you is using the Mac books, or iPhones, they are more white than black. So, I was, you know, thinking, should I or should I not ask for that? So I explained that to the staff member, and they agreed to give me two more probes, v3 probes, and I, as the previous time I went back home, and I put them in myself and unfortunately forgot about them. After a while, there was an invitation letter, confirming that I am having those probes and, but I still forgot about them.

Occasionally, I was looking to the shelf and saying to myself, I have to connect them, but I still not doing so because of number of reasons, you can blame on me. But, I was trying to be curious, nobody is asking me about those two probes. So, at Athens, just a half year later on, I ask for two more probes, just to check if maybe I put wrong e?mail address for the previous registration, whatever. So they were happy enough, they gave me two more probes, the invitation letter came, I was absolutely sure that my e?mail is correctly put in the database, so, everything is fine. And I intentionally this time put them on the shelf. So just to be absolutely clear on PL Nog 12 in March of this year, I asked one of the RIPE members to give me one more probe, and one more time I got an invitation letter, and I put that probe intentionally on the shelf. I have to make a statement here, I have an idea how to connect them. However, however, I am intentionally not doing that. As I said. There was always an invitation letter, I have some copies of them, not all of them but some of them. V1 probes happily was connected from the beginning, so that's fine. One of the v3 probes was connected last November. I was trying to check if that's changed anything and so I asked my friend could you please connect that probe in your network, he has happily done so and everything is fine. And the rest of them ?? the rest of these ones, white, very fine v3 probes, they are laying on my shelf, this picture was taken last Friday.

So, graphs and numbers.

This one was taken yesterday. As you can see, we are having almost 8,000 given out probes, and I cannot read here so I have to read from the big screen. As you can see also, there is over 5,000 probes which are connected. That's good. Very fine. However, as you can see at the bottom, there is slightly about 1,000 of never?seen probes, four of them you have seen at the previous slide. And nobody asked me what the hell I have done with them. Is my dog eat them? Or I took the screwdriver and checked what's inside? Whatever. What the hell I had done with them.

So, the other thing next to this 1,000 never?seen probes is, I don't know if it's correctly visible, this light blue line, written off. Why they have been written off without asking the guys who RIPE NCC says the email addresses, I hope so, have done with the probes. And the other thing, the red one. It's the disconnected probes. It's about right now 2,000 of them and growing. I have no idea if NCC is asking about those or not. I have no idea, because I was not doing such a test. So I have to just note that, that there is about 2,000 of them which are not connected.

So, right now, I want to ask those questions, because they were not asked to me. Does anybody care about what happens with those probes? Those disconnected, those never seen? And if anybody thought about how much money do we spend for such toys? I shouldn't talk about money but I know that one probe it's about €20, 25, so 1,000 probes, €25,000. 2,000 probes, you can count it. And if you go to the budget, there is this numbers are not important, so, we can start asking those questions. And as I said at the beginning, I'm not thinking about blaming anyone. I'm thinking about do we need more auditing? Do we need more control? And I don't even have the idea about these auditing will control or whatever, I was thinking more about frequent reports, maybe one of the Board members directly ?? one of the Board members assigned to the projects and giving reports more frequently. I don't know this is just an open question asked to you the community. Thank you and that's the questions from you now.

CHAIR: Luckily you are all standing at the same microphone.

Peter: Referring to a discussion we had this early morning, in any phase of this process, have you offered the RIPE NCC to send them a copy of your passport?

SPEAKER: No, but they know me, I hope.

ELVIS VELEA: Regarding one of your questions about the probes that disconnect, my wife has the bad habit of turning off everything when we leave for vacation, and so the probes just get ?? well the router, the probe gets disconnected to ?? gets shut down, I am getting emails, your probe is disconnected, hey, do you still like us? Hey... so there are reminders for those that have been connected and have been seen and I don't remember how often, but those do get some attention.

SPEAKER: But this is taken care, however the number is still growing so something is still not working properly.

ELVIS VELEA: Maybe more e?mails should be saying, hey, you don't want it, send it back, send it back by post, something.

AUDIENCE SPEAKER: I am the one who has the answer the questions from the Atlas operation side. So, for the start, thank you for bringing this up because we actually like to get these questions and be able to get a place to answer them publically, so it's a very good practice.

About the probes, I mean, let us start with the whole control process. Let's start with the Board. Actually, if you look at the past three years of the minutes of the Board meetings, every meeting and every minute there is a recurring item about RIPE Atlas, and they actually have a lot of details and they know exactly what's happening there including the probes and distribution. They even went a step further, they have two dedicated people to this project, so, we have Christian, who is also very technical about ?? RIPE Atlas, about the technical details and we have Remco who knows a lot about the financials and we have a lot of discussions I am in direct contact with them. Last Board meeting there was actually quite a long discussion about what we are doing, where we are going; and if you look at the minutes, they asked for some very specific numbers and they gave us some guidance on how to move forward. That's it.

Going inside NCC. So, we ?? when we saw this issue, we see this as a complex problem to solve because we want to take this network off the ground and a network like Atlas it can't work with let's say 10 probes, the usefulness of the network grows exponentially with the number of the probes you have. We decided about 10,000 probes is a good number for covering many useful use?cases, because that will cover, should cover about 8 to 10% of ASs so that would be a good sample for many measurements. So we said, okay, we have that 10,000. That doesn't mean that we say, okay, we just give them out until we reach 10,000 without any control. But we also don't want to be really hard, we can ask for IDs as Peter mentioned, or credit cards or whatever, pay for the probe first before you get it, but because we wanted to get the network off the ground we had to find the balance. In order to get that balance we have tried to, first of all, become more efficient in different aspects, for example the cost of the probes from when we started till now, it's cut by one quarter, so what we pay now is a quarter of when we started to pay when we got our first probe. The cost of the whole logistics, posting, packaging and making sure it gets there, we have got that down, so that's also a lot cheaper. The number of probes which have been lost for any reasons, including you, that has been, from 2011, constantly reduced, almost 4.5%, so we are trying to ?? that's one way of attacking the problem, trying to be more efficient and we are doing that continuously. The other part is also we try to look for financing, so actually last year we had raised about 150k in contributions to help with financing of purchase of the probes and all of that. And then all the distribution channels that we have, yes, we have different rates on that. For example, ambassadors are actually the number of probes which are not connected, the ones that are given out by ambassadors is really low, so they are working well or at least most of them. In average it's really low. The number of the probes that show up when we give them out during the meetings, that's also basically very good. It's an acceptable number. It's about like the ones that don't show up, it's around 15%. And then we have the ones which we post, we send out by post when people fill in the form online. We are also trying, so now we have improved even though the form which accepts, so if you have already applied for the probes and you don't have an online probe, that's the next thing that will deployed next week, you can't even request for a probe until you have all of your previous probes online. So it's a matter of balance. And just to be clear, what will happen after the 10,000 active probes, is we will look for ?? it doesn't mean that we will stop, but we will stop spending members ?? or monies from the RIPE NCC, from the members' funds, to purchase new probes. We will keep ?? we will focus on getting more financial contributions and we will put all of them directly towards purchasing your probes and expanding the network. But RIPE NCC's basically spending money on expanding the network will be focused on just keeping about the line of 10,000 active probes.

So these are different aspects. And yes, again, we are looking ?? there is already a lot of automation on sending out follow?up e?mails. Some cases don't have them because the problem is also very complex, it might look simple but, for example, when a probe leaves RIPE NCC door, we say, okay, it should show up in, let's say, three months. It's not as simple as that because in many cases they are with the ambassadors and they mightn't go to an event, say, in the next six months. So the written off is also a product of that because we have to have a grace period, we have to do followups, automatic followups and then sometimes manual followups. Again, there is an internal balance there as well because for the manual followups we can put, let's say, 1 FD on that but then the money we have to spend on the followup for the number of probes we might collect back, there should be a balance. We are also doing that, but it depends, we try to be selective and we try to find a balance and, as I say, based on the numbers we have improved a lot, and we know it happens, but because we want to take this network off the ground, we saw that okay, by being more efficient, we will try to fill that gap. So that's basically my explanation.

PIOTR STRZYZEWSKI: So, just to short ?? first of all, I want to state that I am very happy about what you are doing, I'm really, I see that there is quite a good job, not only with RIPE Atlas but generally speaking, so, just a statement of and at the beginning you said that I should look at the minutes from the board meetings, and there are records about that and so on. I have done that, and however, I do not find anything of those questions and possible answers to that questions in the annual report. There was a shiny chart, a number of connected probes versus number of users put in that section of annual report about RIPE Atlas and nothing more, nothing less. And I'm pretty much sure that more of us is reading annual report than the minutes from the board meetings. However, I could be be wrong.

AUDIENCE SPEAKER: So you are right about they not being present at the annual report. That's just the way we have communicated things till now, if that needs improvement we can improve that. But what was visible in the annual report was the 10,000, so the goal to get to 10,000. So, yeah we tried to communicate that, and that's basically the underlying message where we are going with this project.

CHAIR: I think Christian was first and then Richard.

AUDIENCE SPEAKER: Christian Kaufman, NCC board. So, as was said with Remco, we are actually looking at the project, we are looking at it since quite a while and it was very obvious that the two graphs are going out and you know, the amount of lost probes, if you want to call it like that, is increasing. We had various discussions about it with the management and tried to find different ways to actually get them back online and actually see what happened and we had actually different initiatives which apparently didn't end up to close the gap so far.

But in a nutshell, we were very aware of it. Another comment to not echo everything we said, as much as I found it amusing to a certain point to see all the probes on your desk and to actually, they are just four out of 2,000 or so, if you had known a little bit ealier that the process is broken at this stage because you collected them over pretty much a year, one?and?a?half years, we could have reacted earlier. The NCC board is not micromanaging. We oversee, so we asked questions, we try to close the gap on specific projects, but we do not go as an auditor through the projects and audit them. That wouldn't work out. If we had known a little bit earlier there was an issue, we probably could have done something earlier.

PIOTR STRZYZEWSKI: That's a good comment, but I have to state that after the first time in Dublin, I just forgot about that, as I said said. Then in Athens I was trying to confirm myself to be confident is there anything broken or not. And between Athens and Warsaw there was nothing, and that one more probe was not planned, it was just, because there was someone from RIPE NCC, so I ?? that was just by the chance, so sorry.

AUDIENCE SPEAKER: I understand your point, but, this is a community spirit project, right, we all rely that the people actually put it online, so if you figure out that something we as a community is not working in that project, as it is funny enough more money, when they should report is and fix it together, because not all the things are really visible to the Board, if something like that happens, then you know, we just can encourage you to tell us. So thanks for telling us.

RICHARD BARNES: I just want to observe that, you know, having some degree of loss is a cost of doing business of creating a large scale probe network like this, and so, the only question here is: Is the loss rate in an acceptable range? There is no possibility of eliminating loss. And I think as Kaveh pointed out, and also Elvis, there is measures that are being taken to control the loss rate and at least in my estimation, I don't think the loss rate has reached a point where it's unacceptable. At this point it's effectively adding 15 or 20% onto the price of a probe. So it's another €5 or so per probe that it's adding in terms of cost. So I think we should keep in mind that some loss rate is inevitable here and keep track of whether the loss rate ?? we should certainly keep track of the loss rate and make sure it doesn't get too big, but I don't think it's gotten too big already.

PIOTR STRZYZEWSKI: Just to comment, this is a €5 per probe. However, if you find in the annual report, this RIPE Atlas is above budget for about this amount of money, which costs this 1,000 lost probes, so ?? I don't know if it's acceptable or not, it's not my role to judge that, I just wanted to point out the possible problem.

CHAIR: After the four people at the microphones, we are going to change the topic and I think it's Janos, Liam and Dmitry and Hans Petter.

AUDIENCE SPEAKER: I think that we can all agree that the Atlas Project is a big success. At the same time, of course, everybody is aware of the fact that not all processes are properly in place yet, and that it could be improved. At the same time, I think we, as a community, should be very careful about what kind of activities we ask the NCC to perform, so this project of finding all the 2,000 inactive Atlas probes and contact all those people and ask them why this hasn't been put online and so on, would be such a burden and would be such a financial impact on the NCC which very much reminds me of the 2007?01 project.

PIOTR STRZYZEWSKI: The main concern of mine was those never seen probes and I don't think that sending even one e?mail is such a cost for the NCC. And none of them were sent at least to me. So, I'm not asking, hey, guys, could you please find those 2,000 probes or 1,000 probes, just send an e?mail, maybe someone forgot just like me, maybe someone lost it and can put an excuse on the web form whatever, that's ?? the web form is not expensive. So, even small feedback from those guys who are having the working e?mails would be appreciated and give us a better results on the project.

And yes, I can agree that the RIPE Atlas is a huge success.

AUDIENCE SPEAKER: We can agree that processes could be improved.

AUDIENCE SPEAKER: Lars Liman from NetNod. I want to focus on the right thing here, because, one, these probes are extremely cheap, that's parts of the entire idea. So I cannot imagine that this was designed without having a kind of an acceptable loss in the project plan. So, the important thing is to look at is the loss bigger or smaller than what the project plan says? I don't know. But it must be there.

The second thing is that we shouldn't underestimate the cost of human intervention here, that cost a lot and that also goes back to you can spend the money either on a new probe or to chase an existing probe, and it's probably cheaper to buy yet another probe and send it out. So... get the numbers right.

AUDIENCE SPEAKER: Dmitry: I saw Daniel trying to comment. Maybe he should do that now.

DANIEL KARRENBERG: If you go to the website that had this graph that was showed this ?? underneath one this shows the relative amount of probes that are not connected, and that relative amount has been constant since almost the beginning of the project. So, while I cannot say that we had an acceptable loss in the project plan, because we had no data to go by, because there is no ?? there was no similar project, at least we have watched it and it's been constant.

AUDIENCE SPEAKER: Dmitry: Well, I will cut my comment shorter. First of all, I would say we have two kinds of probes, I can blame it on Daniel, I would say there are two different values, version 1 and version 3. Second, I would estimate the probe is not a computer, it's expendable item, so I think we should assign a lifetime value, maybe 3 years and we should just track an average lifetime of the device and I assume that every time we hand it out, essentially we're losing money, it's the same cost, we are not amortizing those.

One more thing, I am an ambassador and I feel guilty, I give probes away and people don't plug them in, they plug them in and disappear. I go to those people maybe some SMS notification would work better, I know we do have a phone number. I know SMS costs money.

And one more thing, I guess this is already implemented, the ambassadors have a rating of how many of their probes are not online or not given, so I guess you can declare Ambassador bad and don't give them any more. Likewise, the third time they ask for a probe and don't down, then give that, I guess those little measures can go a long way.

And last time I think the project success is not the cost. The project success is its value and if it's only Geoff Huston who gets the results of that, it's still a success.

KURTIS LINDQVIST: Hans Petter, last up.

HANS PETTER: It's hard to make a last comment after Dmitry there. I wanted to make two remarks. The one is that the tone this morning from ?? was that the RIPE NCC doesn't trust us enough. The tone right now is that the RIPE NCC trusts us too much. I think there is a balance there. The other thing I would like to point to is that we have, indeed, a mechanism or something in place to look after this project. We have a Working Group for that. The Measurements Working Group. So that would also be a place to discuss this in more detail and give input to how that can be improved.

CHAIR: Thank you.

AUDIENCE SPEAKER: Just a final comment, because it's strange that you said you have never received any follow?up for the probes because we have automatic follow?up and we do a manual follow?up. So I will do a follow?up on the communications we have done and I will find out.

PIOTR STRZYZEWSKI: We can deal with that. I am prepared to do that. And I wasn't aware that I will put the stick in the fire. So many comments. Thank you.

CHAIR: Thank you.

(Applause)

This is actually why NCC Services Working Group was created, to have these discussions. So I think that's quite good.

Next up is Andrea, to give an update on the implementation of 2007?01, our favourite policy.

ANDREA CIMA: Good evening, everyone, I am part of the registration services team at the RIPE NCC. And yes, I will give you an update about 2007?01. Now, I have heard the words 2007?01 quite often today, but what is it all about? This policy that has been set in place by you, by the RIPE community, had the aim to ensure that the RIPE NCC can confirm that End Users who receive independent resources exist, that they continue to exist, and that they comply with the policies which are set by the community. Now, you gave us the mandate to not only make sure that all the new resources being issued would be covered by contract, but also the resources that had been issued before the policy has reached consensus.

Now, what was the intent of the policy? First of all, it's to maintain an accurate and current RIPE registry, so, the intent of the policy is to make sure that there is a contact between the RIPE NCC and the organisation using the resources, even though this organisation changes sponsoring LIR and this is also done through the yearly check, the yearly contact point through the small fee that the RIPE NCC charges the sponsoring LIR.

Another point was to make sure that abandoned resources, resources that are not in use any more, are being deregistered, brought back into the pool and issued to organisations that need them.

And this also prospects the resources from hijacking, as seen in the presentation given earlier today by Ingrid.

Now, we started in 2009, actually the policy reached consensus at the end of 2008, quite a long time ago, but we had our tools ready, our software ready, the processes ready at the beginning of 2009, and how did things look like at the time? We are talking about 34,000 resources that had been issued over a period of about 17 years, quite a long time, especially when we talk about the Internet industry, to organisations that were spread over 74 countries, and where documentation, contracts, the language used is all different in each of those countries. And one thing that we were also thinking about is the fact that for sure there were organisations that had no clue who we were, they had no clue about RIPE or RIPE policies, so, we had to take that into consideration as well.

So, what approach did we take? We thought okay let's divide this project into phases. As mentioned before in October 2008 the policy reached consensus. We started Phase 1 in March 2009. Meaning that from March 2009, every independent resource issued by the RIPE NCC was covered by a contract. We started Phase 2 soon after in May 2009 making sure to contact the resource holders via the LIRs, so we would contact the LIRs, we created an interface for them asking, okay, can you please confirm these are your End Users, or can you please confirm that those resources are being used by yourself, so can you please upload the contract for the End Users. Here we started with about 27,000 resources. Phase 3 started in March 2011, and those contained 13,000 resources left over from Phase 2, plus 7,000 resources that were registered with LIRs that over time had closed. And in Phase 3 we started contacting the End Users directly and those were the orphaned End Users that did not have a sponsoring LIR at the moment.

If we look at the total number of resources in Phase 2 and 3, we started with about 40,000. We can see a linear slope over time. We have about 4,000 left to reach the end of this project. We can see that the slope, we have quite a linear progress, a linear slope, and this, however, changed a bit when we were preparing for the exhausting of the regular pool of IPv4 addresses because, of course, all our focus was on that.

We tried also to not impact too much from an economical perspective the membership of this project and by trying to do most of the work with existing staff. Now where do we stand today?

As you can see here, I am quite happy to say that we have about 46 thousand Internet number resources that are covered by contract and they are both AS numbers and PI addresses, should the cleanup of resources not being used any more or for which we did not receive a reply and we returned to the pool about 4,000 Internet number resources, some of them are the AS numbers that we have been talking about this morning in the Address Policy Working Group. About 2,400 cases are still ongoing, we are still working on those, we are in contact with the End Users and working on getting the documentation together, and we still have to contact about 1,800 resources.

Now, whatever our experiences in the Phase 3 of this project? As you can see the first line, you are who? What? Policy? What policy? That's one thing we come across often. We try to call as well the end user if we see the communication via e?mail is a bit difficult and quite often they have no clue who we are, what RIPE is, they do not know what policy is, they just got the resources a long time ago. So at the beginning it's quite difficult to explain to them where this comes from. But, if we look at the number of complaints that we had, we are talking about a handful and we have 46,000 contracts in place. So at the end, they accept the situation, they accept the policy, and they enter into contractual relationship.

One thing as well that we are noticing is that entering into a contractual relationship also brings additional work, of course, of maintaining those contracts. And this is over the time the number of maintenance requests that we received for these independence resources, these are not tickets. These are requests and they can vary from, I would like to change sponsoring LIR to, can you please update my company name for this contract, etc., etc. But we see that we get about 2,000 of those requests per quarter, and the number is increasing, of course, but by this, we actually make sure that the data continues to be updated, and making sure that the process stays a success.

Now, we just got out of the last 1,800, we have 1,000 resources left that we left for the end. Maybe the most difficult ones, in the sense that those resources are not visible in the routing tables, and they lack completely any type of contact details. There is no contact details in the object itself, there is no contact details ?? there is no route object or there is no domain object, there is no object whatsoever which contains a telephone number or an e?mail address. According to the policy, the RIPE NCC will make reasonable attempts to contact the End Users in order to ensure that the contract is in place. But, what to do for those 1,000? What we will do with those resources is to search in our ticket database to see if we have ever been in contact with anyone related to those resources before and we will search on the Internet, we will search for a company website, we will check if this company is still existing in the hope to be able to get in contact with this organisation. And here is a question for you: Should we go any further than that or can this be considered as a reasonable attempt?

Finally, I'd just like to draw some conclusions about where we are today. We believe that the quality of the RIPE registry has been increased by far. Abandoned resources have been deregistered, a number of them have been reissued to organisation that is need them and we have prevented a number of hijackings. And yes, it is working to be able to maintain regular contact with the End Users.

I don't know if you have any questions for me.

CHAIR: Any comments on the reasonable effort of attempting to contact?


RUDIGER VOLK: Looks fine, you didn't say what you would be doing after you think you're done. Nevertheless, looking at the related communications for this project that I have seen, I'm not really fully convinced that you actually do all the things knowing that, for example, you're sending out messages for PI space that was actively routed with proper registered route object pointing to my operational team only in the second or third round of your investigations we got a message and a kind of a last call, and, yes, well, okay, when I asked how could that be, I was told yes, we decided some other party, some other LIR is closer related to the party that is operating this, and so we didn't bother to ask you before the last call. Okay, that worked out nicely, but kind of looking at the communications and actually I think I have three on my desk right now, and I don't remember all the nasty details because I had to start a search into my archives before I went onto the trip. What I have seen is that in many cases, it did not look like the RIPE NCC seriously asked itself how does this look to the other side including the thing that kind of a friendly introduction, we are and this is a friendly explanation of the project we are asking you for, kind of really looking at doing a friendly and complete look at what the other side sees, I think has been missing sometimes, and that can reflect to the okay are we done question.

ANDREA CIMA: Thank you very much for this feedback.

ERIK BAIS: On the thousand resources that you are currently not seeing in the routing table and you have complete lack of contact details, what are the steps, you know, at some point you're going to deregister them or are you going to announce them and see if that triggers any reaction? What's the plan?

ANDREA CIMA: Actually, like Rudiger mentioned, anti?spoofing what we would do as the next step. We would deregister those resources and they would be quarantined. That is what we do with resources that are not used or abandoned.

ERIK BAIS: Although, it may not be the ideal situation for the company who is actually using them internally and not knowing that you're looking for them, would it be an option to announce them in BGP to see what kind of traffic it is pulling or that somebody will actually say, well, my internal network actually is having an issue, are you renouncing my pass?

ANDREA CIMA: That is an option as well. That's why we're standing here and ??

ERIK BAIS: I do understand that might actually have operational issues, but if there is no other way of reaching the customer, you know, that actually might be a last resort.

ANDREA CIMA: Yes.

CHAIR: Thank you. You got one second and Rudiger you got zero, so okay... we're really out of time.

ELVIS: One short thing I would also suggest is after announcing and still not getting anything, looking at RIS or looking at RIPE stats, looking at who announced them in the past, see if those people ?? if from there you could actually maybe see someone other that in the past has announced those resources and that might have some knowledge about these guys.

ANDREA CIMA: One clarification I would like to add is that those resources have not been visible for a long time. But, yes...

CHAIR: Okay. Thank you very much.

(Applause)

I suggest that we take the follow?up discussion to the mailing list because we are really seriously out of time.

And next up on the agenda is actually me again. This is just a short update on the update of where we are with the policies coming out of this Working Group. 2012?07, which is RIPE NCC Services legacy Internet resource holders. We have 4,200 parent blocks and the standard AS numbers held by 2,500 individuals, organisations, and I can't actually see my own slides. And in Q3 of this year, the NCC will start to contact all the Legacy resource holders and ask them if they'd like to establish contractual relationship with the RIPE NCC or offer them the other options as described in the policy.

And 2012?08, the publication of sponsoring LIRs for independent resources. The policy is again that we are going to publish the identifying link between each independent Internet number resource in the RIPE database and a sponsoring organisation, so the link in between. And as a first track from Q 2 of 2014, first step. The registered software has been updated and the supports responding LIR attributes will be set when a new resource is assigned via a sponsoring LIR, transferred from one sponsoring LIR to another or if an LIR signs a new contract with an end user. And in a second phase, the NCC will go and contact all the sponsoring LIRs in batches to have to, inform them that the information is going to be made public.

2013?04 the RPKI for non RIPE NCC members, and this is the policy is to offer RPKI to non RIPE NCC members. And this is to aid the quality of the registration data, and the PI holders are eligible to get ?? if the registry data maps of the public RIPE database.

The LIR portal has been made available to non?members, there is the wizard created, and that you can use to go through these steps, and the NCC is research analysts have helped correct the data that was needed, and the data is ?? the wizard is live and the announcements will be sent next week.

Any questions on any of these policies?

AUDIENCE SPEAKER: First slide ?? previous slide actually. First of of all, I have the impression that this is a restart of 2007?01. But, I would say that for the second track, and I have been talking to a few people, it might take at least a few weeks to maybe months for the LIRs to contact all of these customers all over again and ask them are you still my customer, or you know, this adds a link, a visible link between the LIR and the customer which up until now was only visible for the RIPE NCC. Some LIRs might not want to be linked to some of these customers.

KURTIS LINDQVIST: But they are.

AUDIENCE SPEAKER: They are, but they might not want this to be visible and they might just want this contractual relationship to break once it becomes visible. So, yeah, I don't know, I think for the second track, the LIRs should be given quite sometime to review. I'm not sure what the decision has been, but for End Users, the NCC has been giving them 90 days to find and establish a contractual relationship.



AUDIENCE SPEAKER: That's right. They will use a similar process for End Users, the thing is that we'll start with a trial batch where we will include the LIRs with many independent resources and we talk about over 100 or more, to see how much time it would take. So especially those, we'll talk to them in a case?by?case situation, also over the summer period if we would start, we can imagine that it might take a bit more time. So we'll take it slow to start with and we'll report back at the next RIPE Meeting on our progress.

AUDIENCE SPEAKER: And forth next one. I thought the NCC was only offering services to members?

KURTIS LINDQVIST: This is a policy adopted by the community, right. So sorry.

AUDIENCE SPEAKER: The previous slide please. Just a question regarding the second track, why the NCC should ask the LIRs to publish some information if the NCC already has such information regarding all confirmed resources.

KURTIS LINDQVIST: The point that was they will notify them that the information is being published because they are adding attributes to their objects.

AUDIENCE SPEAKER: Is there any reason to ask them instead of publishing by the NCC?

KURTIS LINDQVIST: I think the point was made in the discussion before was that you want to validate that the contractual relationship is still in effect because it might not be. They might be old data or stale data in the database.

RUDIGER VOLK: And it is intruding on existing contractual relations with potentially might include some NDA.

KURTIS LINDQVIST: And that too.

CHAIR: Okay, with that I am done and then we are going to the last agenda item, or the second to last agenda item which is Nick.

NICK HILLIARD: Hello everyone, Nick Hilliard from INEX, I am going to shoot myself in the foot again, the second time today because I had a chat with Niall O'Reilly about the Legacy Resource Holders, so, the Legacy resource proposal which is now policy specifically excludes all RIPE policy which does not mention it. And anybody who was following NCC Services policy last year will notice that the two proposals 2012?07 and 2012?08 were going through a kind of much the same sort of pace. And in fact reached their finality within a couple of weeks of each other. We did actually notice at the time that there was an issue, that one didn't apply to the other, and it was going to kind of going to be a bit awkward to get them to sort of change to sort of make them apply to each other. We didn't actually do that because that was just going to shoot everyone in the foot and ?? like my poor foot. So, we have a new policy proposal in the works at the moment, Neill and I are ?? will be authoring it and the essence is that the publication of the sponsoring LIR policy is going to apply to Legacy resource holders as well. It's effectively a bug in the Legacy ?? the current Legacy resource policy, this is just a very quick bug fix. So, if anybody has any comments about this, we'd like to hear it, Kurtis is probably going to shoot anybody that goes to the microphone, but...

CHAIR: You'll be submitting this to NCC Services in ??

NICK HILLIARD: It will be submitted to NCC Services real soon now.

CHAIR: Thank you Nick.
Unfortunately, always when we come to this time in the agenda we are way past our finishing time, but this is the microphone where you are allowed to go to the microphone really really briefly and have any questions or statements you might have. And as no one is going, I think we are done, and while Paul Rendek lines up his in?depth review past, current and future Internet governance policies, the rest of you should run for the doors, and we're done.

So, please empty the room so we can continue with the AGM.

LIVE CAPTIONING BY MARY McKEON RMR, CRR, CBC

DOYLE COURT REPORTERS LTD, DUBLIN, IRELAND.

WWW.DCR.IE