These are unedited transcripts and may contain errors.
RIPE NCC servicesWednesday, 16th of October, at 4p.m.:
KURTIS LINDQVIST: Dear friends, colleagues and rest of you, welcome to your old favourite Working Group, the Working Group of love or the NCC Services Working Group as you like to call it. A few things before we start. I am Kurtis Lindqvist, I am the chair together with Bijal Sanghani in the front row and this meeting precedes the GM.
If you haven't picked up your registration pack or registered for the GM, now is a very good time to do so because I had promised Nigel for the first time we are going to try and finish NCC services on time and start the GM on time and I would like you all to help me keep my promise.
The second set of housekeeping is that there is an ASO election on Friday and PC election on Friday that you should all go and vote and information for how to participate is all on the website, so you can all go and do that as well.
Last is that because the GM will be in here, the moment we finish, we would like you all to leave as quick as possible. Not rushing, no panic at the doors but close to it.
Anyway, moving on, then. The agenda for today is first administer matters, the welcome. We have Laura from NCC doing the scribing, thank you, Laura. We have an agenda which I have one addition to. And we have the minutes from RIPE 66 I have posted to the mailing list and zero comments so unless anyone objects now we are going to approve the minutes. Going going, gone.
And then we will move on to the NCC survey results. We had a RIPE NCC outlook by Axel, such date and address, hijacking issues by Andrew and last, almost last we had policy proposal update, we have the open mic row phone session and under any other business we have one item from the Database Working Group, which promise me to be done in two minutes.
So, that is what we are going to do, basically. And with that, I think I am done and I am handing over to Serge and Desiree.
SERGE RADOVCIC: Yes, thanks, Kurtis. Chief communications officer of the RIPE NCC. I am going to be doing a bit of tag team survey with my good Serbian friend here, Desiree. Maybe I can just ask so I get a bit of an idea in the room, how many of you participated in the NCC 2013 survey, please do put your hands up? OK.
So how many of you received annoying e?mails from me asking you to participate but didn't participate in the survey. And you want some information from the survey. You are not getting it. It's one of those what you put in is what you get back deals. Sorry about that.
Now, let me move on a bit. As I just mentioned, when I was here at the RIPE 66 meeting, well when I was there in Dublin in this same Working Group, I was talking, trying to get you guys to get involved in the 2013 survey. We hold these surveys about every two to three years. We find they are a fantastic tool, a way for us to reach out to the far reaches of our entire membership and the community and it's a great way of getting some feedback from these guys. Of course these meetings are a fantastic way of getting feedback, people get to the microphone and talk to us, and that is great. Other people tell us what they think via e?mails, and attach a name to it. Some people prefer to give us information in anonymous manner and that is what these surveys allow us to do and that is why we consider them to be a fantastic tool.
They are not only open to the members; while of course, we see our members as being extremely important, we do value input from the wider community and the survey is open both to members and other interested parties.
What we do before we get the surveys going, is we have a few focus group meetings throughout our region, in fact we had 13 this time around, so what these focus group meetings allow us to do is, one, get in contact with some of our members and members of the community and talk about some of the issues that we feel are relevant and ask them for input on those particular issues, bit of feedback on where they think the NCC is going, has been going and where it should go and also what they think might be included in the survey. The information that comes from those focus groups is fantastic. We don't do them ourselves, I can imagine sometimes you might find it difficult to, some of you definitely don't but some of you might find it difficult to be honest about what you think the NCC is doing and getting up to, and I know that don't count for awful you, some of you may feel more comfortable talking to a more neutral independent person and that is why we have asked both Desiree and John Earls to conduct the surveys and send us back a report of what the focus group and some of the individual interviews were all about. The survey itself is put together by the RIPE NCC. We use the information that we get back from those focus groups, it isn't OII that puts it together, we put it together. But we ask OII to collect the data, so that it's in anonymous format and you can trust that the information that is being given hasn't been tampered with, these guys collect the data once it's closed, they also pass on the raw data to us.
So, talking a little bit about the participation rate. I have to say, all those e?mails worked. We got in contact with a lot of you. The survey that we held a couple of years ago in 2011 I think got total of 11 to 1,200 responses. This time around, we had 3,600, so I was very pleased with those results, as you can see the majority of those were members of the NCC. Obviously, in some cases more than one person from a member organisation filled in the survey. But I think it was quite well represented. There was at least 2000 responses to each the questions, some people skipped some questions, and so on, but we got at a minimum around 2000 responses to each of the questions throughout the survey.
And what was very impressive is how many countries got involved. Towards the end, we did get up dates from OII about which countries hadn't yet participate sod we did go after them. We almost got there, we had 75 of the 76 countries participating, I guess you are all wondering which that country was.
No? Monaco. Monaco is the only country that didn't participate. The Vatican city, every other country did participate except for Monaco. We did open a survey in the middle of summer so they were probably busy doing something else. Kurtis is telling me to hurry up.
As far as responses go, it was pretty much the biggest countries were the biggest respondents. Russia topped the list, they are our biggest member and the rest speaks for itself. Who filled it in? Pretty much the majority was ISPs, it was I think nears but there was a range of other people but I think the most interesting thing here I wanted to show you is we asked particularly the members how long have you been a member of the RIPE NCC for? And as you can see, around 29% of them only joined in the last couple of years, and we had a good range of middle?aged and older members as well so we were quite well represented but it was fantastic to see we were able to reach out and really get the opinions of some of those newer XIPs we wanted to hear about their experience in joining NCC and wanted to know what they were looking for from the NCC itself. I am going to swap Saturdays with Desiree and let her talk about some of the findings from when the OII looked through the results and she is going to give us a bit of a summary. So Desiree.
DESIREE MILOSHEVIC: Thank you, good afternoon, everyone. So, I would say that we were really overwhelmed with the number of responses that we have received this time, so as Serge was saying, it's probably not expected so it's really good news and being overwhelmed with these results well speaks about the willingness of RIPE NCC members to communicate their thoughts to a third party or and say what they think about the organisation. So the overall rating, in order to help you go through the findings of the survey, which you can find on ripe.net survey 2013, bottom line is that people or members of RIPE NCC are happy with the organisation. The rating of 5.76 out of 7 speaks a lot about the ?? of what you think and about the general services that RIPE NCC offers.
This is a different slide on the screen here, which talks about the importance of some of the services that RIPE NCC offers and that is expected, that the RIPE database would come up first on the list. But you can see, also, that other services down at the bottom, like RIPE Atlas, have a higher rating than before, like 5.O2. As I say, to save you going through all the wealth of information that is contained in this report, we have actually dissected it into different parts. So if you go there, I would encourage you all to have a look of what the responses are and again thank you very much for dedicating your time to fill in the responses.
So to take you briefly through some of the most general findings that we have, we actually, if you look at this two graphs here, you will find out that a quality of support that has been received by members from the RIPE NCC staff also talks a lot, 6.07 out of 7. So amazing, congratulations. The way that people can contact services and there have been a lot of suggestions, and I think there is a little bit of room for improvement there, I think people are asking for more phone contact, but, at the same time, they are also asking for the extended live chat and being able to communicate in realtime with RIPE staff.
This theme about providing some support in local languages is a theme that comes up throughout the survey and you will find out more mentioning in different parts of the responses.
So, overall, looking at the set of questions and in order they were asked in a survey, corporate governance, I think what this translates to is that the RIPE NCC is doing the right job. There is, overall, high rating of corporate governance structure, that means that there is an understanding of the Executive Board and what their task is and the management. The comments made in terms of increase of operational transparency probably translates to something we'd like to know more what you are doing or please remove the jargon and tell us what you are doing. And I think there is an ever ?? this is some kind of services, something that one needs to pay more attention as you get more members, especially new members.
The other small comment was to involve membership in the decision?making and I think this is also an area that came up in a survey, asking the staff maybe to communicate better and using the existing tools.
When it comes to the section of the external relations and the Internet governance, it was my surprise that the Internet governance rated very highly on the third ?? came down third from non?members of the ISCs so for those who have answered the surveys but are not current members, after security it rated it third. There is definitely the stand out from the focus group as well as from the survey, there is a lot of suggestions to increase local presence and to increase a regional support.
This is no surprise, requests to push corporate and governments to support the IPv6 deployment. I think some of the bottlenecks that we have discovered is it's not the engineers, it's actually the CTO and CFOs that need to make a more attention of how to go about IPv6 deployment.
So, interesting facts also that became evident is that about two?thirds actually have a plan for deployment but only one?third has a budget for it. So, therefore, there is this further request to help and convince decision?makers to deploy the IPv6.
Some of the other findings that might be interesting is that newcomers suggested it was difficult to understand and update the RIPE database. I think that probably talks to the fact that there is a basic training that every member needs to receive in order to be able to do thatty efficiently so it's not a surprising again, although there were more requests for more documentation and how tos and more FAQs.
The tools and measurements section actually, as I mentioned at the very first slide, improved quite significantly so some of the tools are being used by members and it's also obvious that not all members are interested in the tools, so that rating and some members would be interested more in different services than these ones but there is definitely an overall improvement from 2011 survey in the use, availability and usability of tools and measurements.
Some of the general suggestions were that as mentioned before, there should be perhaps a better communication how to contact the RIPE NCC and, you know, and suggestion that we should think about the diversity of the region and how to investigate that something for you to unpack whether there is a possibility of providing some of the trainings or services in some support and local languages.
Finally, I will just say this: That it's been really ?? you have received a high ratings throughout the survey. It has been maybe not a surprise because this organisation has been running for a long time, and so it was not a big surprise, but it is still really nice to know that all the services and thoughts about your relationship with the RIPE NCC staff and management were highly rated throughout the survey.
What is definitely ?? there is definitely more room to do, and that is that many new members that are joining the RIPE NCC are needing greater awareness of the services, not just basic services like the tools and measurements, and there has been this consistent really request for language support throughout the survey. You will find out in more detail in the survey itself, it's very easy to read and you can look at the graphs and you would probably assume that these requests for regional language support may come up from some of the newer regions that the RIPE NCC is servicing. But actually you will be surprised that they are asking for support in languages such as German, French and Spanish.
I think with that, I will just ?? I am here all week and if anybody has any questions or suggestions I will be more than happy to answer. I will pass you back to Serge to discuss the next steps.
SERGE RADOVCIC: Thanks, Desiree. This is my last slide or last few slides, Kurtis.
So what are the next steps: We have already taken some action both in the focus groups and some of the requests we saw, quick fixes, we have already applied, little things getting more information for the GMs, perhaps reporting more on some of the governance work and those things were no brainers, we have gone ahead and pushed those through. Some of the bigger results we have already started to apply to the activity plan on budget that you are going to see later on shown in the general meeting and we have already published /SAEUPBS month. But other than that, as we did last time in 2011 we are going to take a full list of actions or what we'd like to call investigations because we are not necessarily going to act on every suggestion that was there but the ones that did just keep coming back and we will investigate and have a look at, it ?? does it make sense, is it expensive to apply and make a judgement call on whether we should go through or whether it's a big decision bring it back to the membership and let them help us decide.
As we said, all of these results have been published in the raw data, in summary views and so on. I also went through the 247 pages of raw data I were do you said my own is summary separate to these guys, they did match each other as did a lot of the results of the focus group, so I am aware of the entire content of the survey. I know a few people have asked if they could have a chat with me on the side. I am more than happy to go through any part of the survey in detail here at the meeting or via e?mail or phone call or whatever means you wish to do.
The last thing that is here just as my presentation will be next time and I know Kurtis is going nervous, the survey will be shorter next time. We had a lot to cover, I promise it had would take 20 minutes, I think it took many of you, especially the ones that commented, longer than that, it took me a lot longer than 20 minutes to read through the 247 pages so that just came straight back at me. But the next time we do a survey, and at the moment we are talking about. I think it will probably be in three years rather than two, but that is something we will investigate. But at this stage I'd say and it will be shorter.
Just lastly, we did talk about giving out prizes and this did help us get the 3600 responses, the names were published on the website, just for transparency sake, these are the countries that came from and this is one of the winners, he sent us a photo of him with his iPad there, he was a Swedish guy. This is the URL, it's /survey2013. You can get all the information you want. And if it isn't there, please come and talk to me, and I will take questions if Kurtis will allow me.
KURTIS LINDQVIST: We probably have time for one or two questions for Serge. Anyone?
SERGE RADOVCIC: As I said, I am around all week, I am easily contactable, please do come forward and ask me anything about the survey.
KURTIS LINDQVIST: OK, thank you.
(Applause)
I will take four minutes off Serge's time slot next time. So next up is Axel with the NCC outlook.
AXEL PAWLIK: Good afternoon. I try to make this Working Group as short as I possibly can.
Now, thank you again very much for filling in the survey and giving us lots of data to work on. As you probably know, by now, the RIPE NCC staff during summer every year sits and thinks hard what we should do next year. And build the draft activity plan and budget and all that and that sort of coincided with the Desiree sitting there and cranking out the survey results so I was quite relieved to see that our plans sort of matched with what the survey outcome says we should be doing.
Now, quick outlook, very high level, starting with where are we now? Now, this is one of those Internet graphs up and to the right but up to the right quite significantly lately since the run out more or less since v4 addresses, we have had a great year, lots and lots of new members coming in. We sort of expect that we will bust the 10,000 this year, that sends shivers down my spine, I didn't think it would be like that when I started 14 years ago, I think, the NCC.
So, since January, more than 850 new members. That is great news, but also a little bit scary.
Now, obviously, with that ?? and Serge said earlier that many, many, like nearly 30% of our members are less than two years old, so that is great, there is lots of work for us to be doing in terms of telling them how to interact with us, what is on offer and more than that, it's also a change that we start to perceive in what type of company that is, what are those members doing. When we started it was mostly ISPs, OK, that has changed over time, slowly, but now we see ?? we seem to see more of what we would call the typical enterprise, nobody delivering Internet services to anybody else but just having need for addresses themselves. And if you think about it, it's sort of logical, we saw similar development at APNIC as well after they ran out of v4 addresses.
So, this is very interesting times. Changing membership, lots of new members, keeping up with the demand for services, interaction, outreach, training, languages, everything that we have just heard about, that is something that is quite a challenge for us but it's a good challenge and we are happy to get, try to get better results at the next survey, even.
So, now the point is, and that is one of the highlights for next year and to hear about more about that later on as well, is that we need to do more outreach, we need to talk to all of our members as much as possible but beyond our members to the wider community and sort of the non?technical community as I say, so governments, regulator, law enforcement, to have them understand what we are doing.
I don't want to boast but seeing from the survey, thank God, it looks like we are operationally quite OK so that is good news. On the one hand we shouldn't sit on our laurels, our behinds, but strive to improve even more and seek out pockets of our services where we could do much better. We are doing that. That is always a bit of a balance that we are trying to find and we have seen the recent, over the last couple of months already, the policy discussions saying that you should do as little as possible as RIPE NCC and make life very, very easy for us as members, and we try to do that. On the other hand, there are just as many members and other people also saying your registry, you are doing this registry thing, you are responsible for it, that has to be correct, so do everything you can to keep it correct or maybe it even corrector than it is today. So, those are conflicting goals, of course.
So, IPv4 market development, more security, more focus on security, those things, are high expectations that are high, which is great and I am pleased to say. But also difficult to match. Like I said, we want to do that. So looking at the the high level overview for next year, what are we going to do? Like I said, the registry is important, we are not dropping it, we don't do that any more, no, the ?? the it's more important than ever, many of our members wouldn't have as frequent communications or interactions with us so this is something that is high on our agenda. Tools and measurements we also said the RIPE NCC is more than the regional Internet registry, we do other things as well, and get you lots of tools out there and we do measurements and develop analysis based on that. We want to remain the trusted source of data, of analysis and tools for you.
Further cooperation with others or within ?? our technical community, and beyond that, to get as much value for you, our members, as possible.
You have seen, if you looked at RIPE labs occasionally and in our activity plan we have that as well, laid out, we try to simplify our portfolio a bit as well, like we have seen that in the survey, you do all those things and we didn't even know about that. You asked us questions, we don't know what this is. We want to make this easy and we have started now with saying that everything under ?? everything that is involved with data collection, like we had RIS for instance there, RIPE Atlas, now is bundled under the RIPE Atlas umbrella, so that is now more than just probes and that you knew before.
You want to look at data and data sets, and we have put this together under the RIPE stop label as well or umbrella so make it easier to find sections on the website, for instance, that you can find those things.
Now, diverse membership base, diverse outreach, you have seen that, there is middle eastern outreach, there is Russian area outreach. But also we have started to do south?eastern Europe meetings as well. We found that very helpful in getting us into contact with those members that we don't regularly see at RIPE meetings that frequently. So and looking at it, MANOG in the Middle East is quite suck successful, not to mention ENOG. That is a big group that works very well. That is something that we get lots of support for, so we want to build on that and be even more present locally. Building bridges.
Technical community and other parties beyond our membership and core technical colleagues, that is something that we have found over the last ten years or so, do you remember, there was the Whois and the IGF, things like that that has been very successful in getting the RIPE NCC and the RIPE community out there. So we are recognised, people like to talk to us, they either come to us and of course ?? he gloats in the attention that people recognise the name and the service and they come to us to hear about this, about the community and what we are doing. So that is something that we want to further build on.
Language, I know. We hear that from the survey. For a long time we said, well, that is going to be very difficult to do, not just speak maybe expensive, but how do we do this and what do we do? But we can't ignore that and we don't want to any more. So we have already started to think about this, and obviously with our very diverse staff base from all, not from all countries in our services but many countries, all the regions in our service region, you already know that we have people speaking all sorts of languages and we are more aware or we try to use them in that sense also, to bring them to regional meetings where they speak the local languages and put them on the telephone where that is necessary, of the live chat. We are open to suggestions from you, maybe offers for help also, you can help us. This is early stages, we need to find out how toy efficiently do this and how to safely preserve the quality, for instance, in translations and all that. But some of those things we have already done, you notice that, yes, we want to do more.
Processes:
Yes, this is interesting times. And that is ?? it's good in that sense that it keeps us on our toes. New members, evolving types of members, but also the outside world is very interesting recently, as you might have noticed. The IGF is still there and I will go there and a couple of colleagues but many will go to the next one and it will be very interesting this time around, in the light of recent revelations you see in the news. Those things put us under even more scrutiny, from you, but also from the outside world, so we must ensure that our processes that we are using, all of them, not just around the registry, are transparent, stable, well understood and robust as well. So we want to work on this over the rest of this year and next year as well, to ensure that due diligence is in place everywhere and to look at the registry quality and those things and in that sense I do ask from you, of course, as our members, some understanding that we might be a little bit more pain in the butt than you would really like us to be, but this is with the thought of correct registry and due diligence and processes, that something that we need to do. But of course, finding the balance there is the challenge for us and for you.
So other stuff for next year. You can expect us to do further engagement in the regions and beyond in other communities as well. Transparency we have already started. If you look at the activity plan and budget, there is some more information in there that you requested be put in, we have done that and that is not the end of it; we are trying to do more and thinking of ways to make it all better and more understandable and transparent.
We have so many more new members but you see that we don't have that many more staff, also not planned for next year, so there is some ?? there are some efficiencies and streamlining that we have done already and continue to do this into next year. There are a couple of years where we want to invest some resources to get out the old stuff and get in new stuff and make it easier on you and us as well. Primary purpose: Serving our members and our community and looking beyond that and building bridges to other people as well and helping you by helping other people understanding what you are doing and we are doing, as best as possible.
And to help with the shortness of this Working Group, there is no question slide. That is an oversight. If you have any questions?
KURTIS LINDQVIST: Any questions for Axel on future activities? Is my microphone actually working? OK. Well, thank you, then, Axel.
(Applause)
Next then is Andrew with the operational update from the NCC and some issues of hijacking.
ANDREW DE LA HAYE: And I am the COO at the RIPE NCC responsible for the member services area mainly.
I will go through some operational statistics and then I have two additional items I would like to discuss.
First of all, the ticket volume, just one of the slides people often ask for, so what are you doing, and how are you doing and this is reflecting the registration services. It's still going up and that is contrary to what many people thought it would be after run out. So we see quite a lot of new tickets coming in in all kinds of different areas.
Then the allocation from the last /8, as you know you can take your /22 and this is the graph showing those. We have made a split between ISPs and non?ISPs so the non?traditional members, which is actually quite low. But on average, we have about 125 requests per month.
V6 allocation trend, short quick graph on that one, of course you see the RIPE NCC IPv4 depletion moment last year, around this time, and since then we have seen quite an uptake, one of the remarks: If you come for your last /22 you are also expected to request an IPv6 allocation. Or have one already.
There was a policy proposal a while ago which was about IPv6 allocation extensions, and that made it possible to extend your 32 up to 29, and this is a graph showing what we have seen so far. In the beginning we did see some differences where people were requesting 30s and 31s IPv6, but at this moment, in the last five or six months we see people are requesting the just the highest amount they can get.
Then 2007?01, this is quite a project and has been quite a project. We went through different phases, first contacting or having contact with all the new IP ?? PI holders, then we went into Phase 2, contacting LIRs and there was a huge amount of orphans as we call them and that was Phase Three where we went after those with PI resources that didn't have contract yet and we are at that stage yet, Phase Three. We are facing quite some challenges with those, as we see a lack of familiarity with the RIPE policy and RIPE NCC at all. It's difficult to identify the legitimate resource holder and I will go into that a bit more later on if I talk about the hijackings. And of course we want to ensure continuity of active networks, we just don't want to bring somebody down.
From a number perspective, where are we? In total, we were talking about 35,000 resources, approximately. And we are currently at the stage where we are ?? where we resolved, we have contacts with 27,000. And that means in the grand scheme that we expect this project to be ?? to end somewhere end Q1 maybe beginning Q2 next year which is actually quite an accomplishment looking at the total amount of work which came out of it. One thing I want to note, it doesn't stop with just having this project done, because what we didn't foresee, but which is actually quite normal, is that all those contracts we have need to be maintained as well, and we do see a lot of changes in names, people moving from one LIR to another, sponsoring LIR and that we see about 500 changes per month from that perspective, so that is quite some work.
Yesterday, there was a panel discussion on the transfer market and these are two graphs, Andrei already gave a headsup on the numbers but just two graphs to show where we are. The number of transfers is going up, and we now see about, what is it? 15 to 20 transfers a month or so. The red line is the amount of space and I would urge you to download the slide if you are interested to see the numbers. These are the transfers made under RIPE policy. And under the trends for ?? transfer policy. This is a slide shows mergers and acquisitions which is taken out of the former slide and we don't see an increase there so this is just business as usual. You see Q4 peaks where people tend to do more mergers and acquisitions as they are done not being taken into account in the new billing year.
Abuse report handling. Something we implemented in 2012. We have seen so far 666 reports coming in out of which half of them or so were dealt with by our customer services team and they were dealing with spam and hijacking related cases. We had about 20% policy violations or at least people asked us to look at any policy violation that might have gone on. And we had 33% of incorrect data requests. While zooming in on those two last, the outcome for the incorrect data is that actually in about 80% of the cases there was no incorrect data but there was just a misunderstanding of where the data could be found so we pointed people in the right direction, in 47 cases we did have to ask the resource holder to update their information, which they did and we assisted them in T
From a policy violation perspective, we see slightly difference there. In about half of the cases there was no policy violation. In about 20% of the cases we couldn't determine based on the information provided, whether there was policy violation going on. And in the other areas of 33 cases we did do further inquiry. All in all, a question that often pops up is was there any repper cushion in total of all of the 666 we only had four deregistrations that needed to take place.
Then assisted registry check. We recently sent out an e?mail to Services Working Group on the assisted registry check and I will quickly go lieu what it means.
As we see ?? as we have less contact moments with our members, and as we see in the survey, the quality of the registry is key. We do like to keep a periodic moment where we contact the member and look at their data consistency. The main aim and goal is quality of the registry, to keep it correct, current and consistent. We do it periodically and we have 9,000, almost 10,000 members which means we will not touch upon the LIRs more than twice ?? more than once every two years and probably only once every three years to make it workable and what we also got back from the community was that we did audits in the past and addition.
MR. ALLEN: Ication checks where we checked the data as well but had he found it very cumbersome and heavy weight, we did an effort to reduce the workload from the LIR perspective side.
So what are we doing? We will provide a report, a high level report with our observations and recommendations for your specific LIR. We give an overview of registered information, contact data, for example, and overview of number resource consistency overlaps and point people at the IP analyser. We give an overview of R DNS and route consistency and network reachability through our RIPE Atlas project.
So, after giving those overviews and that report, we get in contact again with the LIR after a while and we assist them where necessary in improving the data and the quality of their data.
And it's also an opportunity for the LIRs to speak to us and to ask any questions about RIPE policy, how to register objects in a proper way in the database or how to use the RIPE NCC toolset.
Last bit, last couple of slides on hijackings:
Due to an end?user report, we discovered that a number of resources were hijacked. So, we did some more investigation and something we found out it was mainly targeting unannounced resources. The hijackers are very aware of our processes and RIPE policy, that was very apparent. And they use actually quite sophisticated approaches, for example they falsify informs, legal documents and circuits copy website, re?register expired domains, so it was very hard for us to find those cases. To give you a bit of an idea on the numbers: We have about 30 cases which we resolved and about 50 cases still under investigation at this stage.
So, what are the steps we are going to take. Because it's a bit of a new area for us, we are updating our processes in an appropriate way, in the sense that we will be reporting illegal activities to authorities. And where members are being involved and we see it coming back more and more, we will go into the close procedure and close the LIR where necessary. Of course there can be a dispute between us and members amongst each other and affected parties can escalate it to RIPE NCC management; and if they are still in dispute then, of course, the arbiter panel is the regular process which can be used to determine how to move forward.
And non?members must go through their sponsoring LIR by the way.
As Axel already mentioned, and Serge as well, it's difficult to find the right balance. We have to do our due diligence and we have to ensure that the data we have and that we talk to the legitimate holder of the resource, which does sometimes look like a big bureaucratic, but we are trying to find the right balance in that sense and it is very hard. But most cases are legitimate cases, and especially if we go into legacy resources and the current proposal that is in the PDP, we need some proof of holdership, so that we can establish the right way forward.
So, all in all, the end user might find us a bit more strict in how we verify and what kind of requirements we have on registering, but we do try to find the right balance.
Now, what can you do? Protect your resources against hijackings by making sure that the RIPE database objects and content information are up?to?date and up to scratch and if needed you can always send an e?mail to look at our website as well where we then will look into the specific case and make sure that we will handle it in a proper way.
And that is the presentation. Any questions?
KURTIS LINDQVIST: Any questions for Andrew? You must all behaving a lot of e?mail to read, that is for sure. I have got a question. In the ticket queue graphs, I noticed that the single fastest growing category was 2007?01. Is that because of a change of contracts or something else?
ANDREW DE LA HAYE: That is because we are spending more time on it at this stage. We really want to finish this project so we put additional resources on the project itself, sending out lots of e?mails which create tickets in our ticket queue.
KURTIS LINDQVIST: Is more people being contacted?
ANDREW DE LA HAYE: Definitely, yes.
AUDIENCE SPEAKER: Carsten Schiefner. I just wonder whether almost all of these hijack attacks have been as sophisticated as you have just lined out or just like half of them or like ?? just getting an idea whether the majority was as sophisticated or whether it was just like an exception from the rule?
ANDREW DE LA HAYE: It's difficult to say, but what we can see is that sometimes it's a very rare case, it's a specific hijack on a specific block. There are also cases, and I don't ?? I can't go into too much detail there where we see a group or an individual trying to hijack multiple ranges from multiple organisations and those are the ones that are most of the time more sophisticated.
KURTIS LINDQVIST: Anything else? OK.
AUDIENCE SPEAKER:
MIKAEL ABRAHAMSSON: What is the definition of a hijack?
ANDREW DE LA HAYE: What is the definition of a hijack. Somebody taking over the resources from a legitimate holder. So changing data, for example, in the database, based on certain ??
MIKAEL ABRAHAMSSON: So is any kind that is not according to the rules or according to current policy or what about say I had this case that was transferred 13 years ago that wasn't done properly and I brought this up on the policy Working Group mailing list, is this a very atypical case or.
ANDREW DE LA HAYE: It is a bit of an atypical case. Of course stuff that happened 30 years ago ?? the thing is, we want to secure, make sure that the legitimate holder stays the legitimate holder and if something happened years and years and years ago, a change in registry or somebody taking over an organisation without having the proper documentation to show that to us, it is very difficult for us to make sure on how to establish the contact, and the contract. But yeah, specific cases are difficult to deal with but we will treat them on a case?by?case basis because it's not that much. Yes, we have 80 cases and some are very clear?cut cases, those cases which are more difficult we treat independently
MIKAEL ABRAHAMSSON: So these kind of cases are rare, there are tens of them ?? in the volume here of tens of thousands or ??
ANDREW DE LA HAYE: The hijack cases I am talking about 80 at this stage.
MIKAEL ABRAHAMSSON: So we are talking single digit number or something like that?
ANDREW DE LA HAYE: I don't get your question.
MIKAEL ABRAHAMSSON: How many of those cases are there, you think, there is a good faith ?? something ?? this was not someone who intentionally did something bad and the original holder, which might by now be a corporation that doesn't exist any more, they have no claim for this space?
ANDREW DE LA HAYE: These cases I am talking about the 80 are really suspicious cases.
MIKAEL ABRAHAMSSON: So my ?? would not be a suspicious case?
ANDREW DE LA HAYE: Correct.
AUDIENCE SPEAKER: In the cases that you observed where the registry data was not modified? ?? was that modified.
ANDREW DE LA HAYE: Yes.
AUDIENCE SPEAKER: Interesting.
KURTIS LINDQVIST: OK. Thank you, Andrew.
(Applause)
So, if you keep going like this we might actually finish on time. Nigel...
Next is the update on the status of the policies that we have in NCC services, we have become very popular for policies, more than before at least. The first policies or the oldest policy proposal is 2012?07 and the status there is version 4 was published with a new impact analysis or updated impact analysis and some rewordings and rewritings and Niall sent them to a list today with more detailed explanation of this. This proposal is in review phase until November 8th, so please read and comment, and as usual also provide feedback, again, whether you are in support or not for the proposal. Anyone have any questions on this?
AUDIENCE SPEAKER: What is it? There is no title.
KURTIS LINDQVIST: That is true, this is the NCC to legacy resource holders. Sorry. I actually think there is a cut and paste error. Randy is walking to the microphone, he is one of the authors.
RANDY BUSH: Randy Bush, IIJ. When we submitted the proposal we did not licence UDUs comic sands.
KURTIS LINDQVIST: Any other questions, comments? No. OK. 2012?08 ??
AUDIENCE SPEAKER: It's a bit more comic reply to Randy, how can Randy prove that he also writes the common sense?
KURTIS LINDQVIST: 2012?08, is ?? you have caught me red?handed now, this is a publication of sponsoring LIR and as per mailed to the mailing list today we at the Working Group shared there was consensus to this and this has moved on to the last call which spurred a little bit of discussion but the process goes on and the last call will end in four weeks from today which I think was 13th of November, if I remember correctly.
So again, please provide comments, feedback to the list or support or other comments regarding this.
Any questions, comments, regarding this proposal?
AUDIENCE SPEAKER: Potentially, will the reference of using the information for abuse tracking be finally removed from the documents?
KURTIS LINDQVIST: Do we have any of the authors willing to ?? nick? That was brought up on the list the other day.
NICK HILLIARD: I don't think the reference to the abuse actually is in the formal proposal, it's the last reason given as the justification for the proposal, but it's not in the proposal itself, so it's not going to be part of the policy, no.
RUEDIGER VOLK: It may still mislead people when they read the stuff if this is the official document that is out there.
NICK HILLIARD: I think it will be buried on the PDP area of the website rather than appearing in the formal document store. So, I don't think it's an issue.
KURTIS LINDQVIST: I mean, the document is also published as last call. OK. Moving on last then, 2013?04 which is the RPKI services to PI holders is approved and will be published this week, I guess, or soon, it was approved today and that is the last of the policies in NCC. So that is the status of the three proposals we have.
We are going really well here. Any other comments, questions, regarding this? Erik is moving forward as the author.
AUDIENCE SPEAKER: I have to correct you here on this one. It was RPKI for non?members.
KURTIS LINDQVIST: Sorry, thank you. I should have put the titles on the slides, shouldn't I?
RUEDIGER VOLK: Well, OK, if that is the topic of the proposal, it will be interesting to see how the RIPE NCC suggests the mechanics of doing the certificates will be because there are some interesting questions that, say, have been raised in the CIDR Working Group and haven't been answered yet by the RIRs, essentially dealing with transfers between RIRs or address blocks.
KURTIS LINDQVIST: True, but the policy still stands but yes, I know Andrew will comment.
ANDREW: From an implementation perspective before this policy came to effect a couple of months ago there was quite a discussion on how something like this should have been implemented at that stage. What we will do is we will rehash that discussion on the mailing list, we will ask for additional feedback on the mailing list and we will probably make sure, or not probably, we will make sure that the implementation reflects the wish of our membership and community.
KURTIS LINDQVIST: When you say rehash, are you going to publish an implementation proposal?
AUDIENCE SPEAKER: Yes, we will.
KURTIS LINDQVIST: Ruediger is nodding for the rest of you. That brings us then to the open microphone part of this, we are really running ahead of time, it's really good. So if the open microphone is for any other comments and feedbacks that the community might have on the NCC services provided or any other comments you have or if you have thought about some question of those 280 pages for Serge or any other question, the microphones are open. I see people walking through the room but I am not sure if they're walking to the microphones.
That leaves us with any other business, and then I know that Wilfried wanted to say something and you can have a bit more than two minutes as I promised you. You can even come here if you want to.
WILFRIED WOEBER: Thank you. And RIPE DB Working Group co?chair for the next two minutes. We are going to have the Working Group meeting tomorrow during the second slot before lunch, starting at 1100 hours local time, and as usual we are going to have report by the RIPE NCC dealing with the operations of the whole machinery, dealing with the development activities going on and a couple of other things which require or which could benefit from discussions within the community. During tomorrow's presentation, there is one item which I think might be of interest to this community, as a RIPE NCC provided service, because during the recent past we had quite a bit of discussion about improving the mechanisms of database software maintenance, new version deployment and there are going to be proposals how to in the future improve the test environment. So if some of you are having programmes, scripts, automated procedures to read data out of the registry and you want to join in, please come to the adjacent room tomorrow morning during the database Working Group session. Thank you.
KURTIS LINDQVIST: Thank you, Wilfried. One thing that might be worth noting is there was ?? in the last services meetup, because we have time left, I can continue talking for a while, in the last meeting in Dublin ?? I guess we were ?? there was a discussion of some proposals by Richard about the documents and tools for these services. And there was a subgroup formed to work on that and they have been doing some work and there is some proposals out of that. I don't know if any of them are actually here. Maybe not. But there is actually some progress in that field and I think we will see more on the list as well, just in case anyone wonders what happened with that.
Last, Serge reminds me to remind you you should vote in the PC elections tomorrow, that is because he wasn't paying attention at the beginning of the meeting ?? Friday, thank you, Serge. The details for the PC elections are on the website, for those of you who hasn't paid attention. So I can all advise you to not listen to the Chairs or Serge and go to the website instead. And also we had ASO elections on Friday which are very important.
AUDIENCE SPEAKER: Elvis. You just asked a question earlier and I don't know if it was answered, whether the ASO elections, if someone is not present on Friday can they vote on Thursday?
KURTIS LINDQVIST: Yes.
AUDIENCE SPEAKER: I don't know if you got an answer for that.
KURTIS LINDQVIST: I asked Fergal who said he is starting taking votes at 8:30, so I can vote before going to the airport, so that solves my problem. I was happy with that answer. I'm not sure if it applies to the rest of you. I am not sure if Fergal is in here. I did ask and he said he was going to talk to Hans ?? I will make sure we get that answer tomorrow morning so we all know how to do it, as I have solved my own problem. And with that, you guys actually have 55 minutes to clear the room, 45 because you will never get out, the sooner the better, otherwise you will never get out of here. That is it. We are done. See you all in Warsaw, and please don't stay too long in the room because we do want to start the GM at 6 o'clock sharp, and they need to set the room up, so I think they want you to leave as quick as possible.
(Applause)
