IGF 2017 - Day 1 - Room XI - OF16 Regional Internet Registries

>> MODERATOR:  Good afternoon, everyone.  I work for one of the five regional Internet registries.  Yeah.  We would just like ‑‑ we're looking ‑‑ we do this most years here at the IGF, primarily it is an opportunity to give people a chance to learn a bit more about what we do, the issues that we're seeing, addressing in the communities, how we're doing that, how the practices work.

We don't have a huge group here today.  I hope that there a few of you that maybe have some questions or some issues that you're actually interested in terms of what we do. 

We have Paul Wilson, the Director General, leading the discussion today with the presentation which covers a lot of different topics, a lot of the different areas that they and their communities have an interest in.

Jump to the next slide there.

This is actually ‑‑ I guess this is the table of contents for the presentation.

As you see, there are a number of quite different topics there.  We thought we would at least start off seeing if there are particular topics that people are interested in or have more interest in.  We want this to be as much of an interactive session as possible.  We may not be so interactive with this number of people, but at the same time it may allow for an informal discussion.

Could I get ‑‑ anyone here have anything in particular that they see that they're very interested in today or would like to learn more about today or discuss?

That's okay.  We can just see who is here, what some of the interests and associations are.  As I said, I'm Chris, originally from Australia, based now in the Amsterdam office.

>> (Audience introductions).

>> PAUL WILSON: As Chris said, I have a bunch of slides here that I can present, but there is a lot of material.  In order to avoid boring everyone with a great deal of content, it would be great to make it more interactive and to find out if there is a particular issue of interest.  We have a couple of additions down there, if you want to introduce yourselves.

>> (Introduction).

>> MODERATOR:  I think we have a slightly more diverse group than I was expecting today.  That's a good thing.

>> (Introduction).

>> MODERATOR:  Based on some of the affiliations, areas, there may be interest certainly from the room in the last few items on this list, the engagement with law enforcement, the accuracy. 

Paul, I'll hand it over to you to guide us through this.

>> PAUL WILSON: We'll give you a huge amount of information about what's going on and what we're doing, and it is mostly oriented towards what's been happening in the last couple of years as the Forums are supposed to be, rather than the full explanation of what's been represented here.  I suppose what I started to say, very interested to know if there are particular topics of interest in the group that's here.

I'll make a start then, talking about what the RIRs are, and this part is mercifully short out of our experiences that we can tend to overdo it when talking about the history of the five different organizations and how we got to be where we are and why we're here and what we do.

In brief, the Regional Internet Registries are the registry organizations that look after IP addresses, IPv4 and 6 addresses, Internet number resources along with autonomous system numbers, and we're responsible for the distribution of those resources to those people and organizations that need them in our respective regions and also public registration, as the registry name suggests, we provide a public registry to identify the holders of the Internet number resources and that registry function is very important, in particular for Internet engineering and troubleshooting purposes.  As you may know, it is the address that's identifying and the source of the packet on the Internet and if you are witnessing any particular problem or issue, normally you'll be able to identify that with a particular source of interest.  The point of the registry is to take that source IP address and find out who has the control over that, very important as sector engineering in these days more and more important for security purposes.

What are the five RIRs?  Today we have ‑‑ these are the five, we are responsible for what was intended to be back when the system was started, the RIRs system launched in the early 1990s and it was established by the Internet engineering task force, a number registry function should be regionalized, but regions would be of approximately complemental scale and that the independent bodies if they formed, they could take responsibility for those particular regions.  As you see on the chart, 1992, it was very soon after that decision I mentioned, it was when the community established and proceeded to take responsibility for the European region generally.  At the time the central registry was located in the United States and it became known as an independent registry and others followed, up until 2002, there was a split in the regions and as of these days we thought for the registries, we have now the AFRINIC recommending industry, those are the five regional registries making up the systems these days.

The five registries are independent of each other, they're all non‑profit membership‑based operations operating in a bottom‑up mode of governance, democratically elected boards of directors like you would expect from the organization, and what we can talk about later is also the governance process at the bottom‑up policy process which also is the issue and we also operate independently and we do work together quite actively on various issues and aspects of the cooperation. 

We have a body with the number resource organization, the NRO.  It is an unincorporated association of the five RIRs established back in 2003.  And the mission is simple, to coordinate where needed the RIRs joint activities and coordination, and it also acts to promote ‑‑ again, what I mentioned before ‑‑ the bottom‑up multistakeholder process development process and the multistakeholder model in general.  They tend to represent that global set of the systems in global forums like the U.N. Forums.

Thirdly an activity of the RIR is to form another acronym, the ICANN system.  Within that, there is a structure of supporting organizations, the addressed supporting organizations, the one that takes responsibility for the numbering issues and the second in the ICANN regional cooperations of names and numbers so one of our activities is to perform that ISO role within ICANN.  If you would like to learn more about the NRO, that's also a jumping off point for a lot of information on the five regional networks and the RIRs.  Let's see, that's the nutshell summary of what the RIRs are here to do, how we coordinate through the NRO.

There is one of our recent, active projects has been the review of the ASO, the supporting organization within the ICANN structure and supporting organization of the ISO, it has a review that happens every five years and so it has been a topic of interest, particularly of people involved in the ICANN structure to understand how the ASO review happens.  The next section is more detailed on how the ASO is performing and what the ASO needs to do within the ICANN structure to fulfill its mission.

Are there any questions on the RIRs?  Any comments that any of the counterparts, my counterparts, Alan, Axel?

Can I ask how many people here have a particular interest in the ICANN and the model of ICANN and the ICANN structure?  ICANN board members?

This is one of three of the supporting organizations of the ICANN structure.  (Audio is very low, difficult to hear).

If there is anyone that spent time in the ICANN world, I think you can find that 99% of what ICANN does is talking names, around the generic names and the new and the management of that process, the number part is a small part of what ICANN does, there is a good reason for that.  The regional registry, essentially they predate ICANN and we have had our own set of policy development processes in the community for many, many years.  While ICANN has three reviewers, we have 5RIRs, they're happening around the world and this is where this will eventually fall in.

(Speakers and audio too low for translation).

>> Can you say something more on the methodology? 

You mentioned face‑to‑face interviews.  This was interviews conducted on the people that were in the organization?

>> The independent ‑‑ the review is conducted independently, and there were a couple of separate individual consultants who traveled over five RIR regions meeting primary stakeholders of the RIRs, members of RIRs and staff and members of the community, and they also attended ICANN meetings and did the same thing.  The results of those interviews were kept anonymous and confidential, but the consultants as independent reviewers were charged with performing analysis and writing a report.  There's a lot more to the report obviously than what's included in the slides.  You can find the details which include the description of the methodologies on the ASO website.

>> PAUL WILSON: We'll move on to the numbers.

This set of slides is in a slightly different format.

Something that's been of great interest in IGF over the years, and also we find outside of the IGF in a lot of different environments and different stakeholders, whether it is governmental, community, industry ‑‑ (speaker audio too low to correctly translate).

>> Better things to do with their resources in developing markets and  proving the competitive ‑‑ the long story short, it is longer than expected, I'm told a couple of years ago that there are generally felt questions raised about whether this would succeed at all, the slide, this shows that things have changed rapidly in recent years, for anyone with doubts about whether or not IPv6 can be or will be deployed, I think that the answers to those questions, they're yes in all cases.  The reasonable thing to change in recent years is because of this chart here, it has shown the depletion ‑‑ going back to 2013, we had a respectable amount available and that's changed very much into 2017, all of the five lines which represent remaining IPv rules have approached the bottom, but we have a total of the 24 million, the 20 million IPv4 addresses remaining.  When they're allocated nothing will be left.  The significance of that it is that the Internet has started to work, it is being deployed and continuing to operate and it will continue to grow further.

Over the last several years, the rapid growth, there's been a rapid growth in the IPv6 takeoffs, a few years ago we had something less than 2% of the deployment, these days we have upwards of 15% deployment across the entire Internet user base, this chart actually refers to the number of users of the Internet who can, who are capable of using the IPv6, so 1 in 7 around the world have the service.

This slide, I had the opportunity to ‑‑ a lot of folks have assumed that Asia, they would be in the lead in IPv6 deployment, that's likely to come in coming years but as the chart has shown, it has been relatively slow until at least some time in 2016 and it started to deploy.

If we average the IPv6 capabilities across countries of the world, at the top is Belgium with 59% of Belgium Internet users, India has very recently launched itself into second place at 51%, followed by Germany, the U.S., Switzerland, Greece,, something that's interesting about this, it is not solely dominated by advanced Internet economies and very much developing economies that have moved forward quite quickly.  The other thing to bear in mind about country averages is the deployment is happening from ‑‑ little is happening from the country level that's supported the IPv6 deployment level but it is the IPs that are contributing to this chart and these figures.

Japan is assumed to be in the lead, Japan these days, we're about 25% deployment.  The U.S. is about 40% deployment over much more graceful growth period.  There's many large providers in the U.S. that are using the IPv6 these days and it is developing steadily over the last few years.

Recently Europe jumped in second place globally, on one mobilized, it launched a massive free access data service that actually attracted what's literally hundreds of millions of subscribers that's an IPv6 purpose.  The blue line, it is representing the growth of that particular service and the orange line is the average, which is now top 50%.  Vietnam, has done fairly well again on the basis of not overall provider but cable Internet service provider.  Uruguay jumped rapidly recently up to the same percentage level exceeding the United States.  Again, just on ‑‑ based on the actions of one ISP providing, not all sources.

Another way to look at the deployment is not at the user capability side but at the volume side, and this is Google that has grown from 20 to 60% in the space of a year.  That's showing that the users have IPv6, they're using that in large numbers.  If you take the 20% of the Google traffic, that's a huge amount of Internet traffic that's flowing on IPv6 resource.

Facebook hit 50% of its volume delivered on IPv6, at least in the U.S.A.  That's a very good example again of the content to content side.

We often get asked about how long the IPv6 deployment will take.  Researchers have done some research into this, looking at technology adoption roughly following something of the Sigmoid curve, it is an elegant curve, you start off slowly, accelerate, and the last part of the growth is towards 100% and it is slow.  If we fit the IPv6 deployment to that curve and we can do that in this case, we're looking at 3, 4 years of rapid growth now, probably a long tale that they'll be in, IPv6 moving on slowly and IPv4 will stay on for another decade too.  That's IPv6.

Any questions on IPv6?

>> The flip side of the coin is the IPv4 transfer situation that's playing out in different ways in different regions.  Is that ‑‑ are we looking at that and how it plays through the deployment of IPv6 and where that's gone?

>> (Audio issue).  Previously for the deployment of new networks it, particularly the governmental level, if the government is aware that their own network services maybe constrained by the lack of the IPv4, there is a lot of interest in how the IPv4 Internet can continue while the transition to IPv6 is underway.  These days, if IPv4, it still is obviously necessary for the Internet to maintain its global interoperability as part of the Internet meeting some mechanism for access from the rest of the IPv4 Internet and when asked where new stocks of IPv4 can come from, there are just a couple of options.  One is that you actually have got for the time being, you have small rations of IPv4 that will go on for a couple more years.  The other option, however, is to look to an open market, which has only been available and operating for the last few years in different parts of the world.  It is now possible to buy the address space in the open market.  In the past there has been a suspected black market in the address space where people actually have undertaken to transfer the use of IPv4 space for one organization to another, probably on a commercial basis.  The trouble of doing that transfer outside of the registry system, the registry is inaccurate so you have an address being used in places or situations where it is no longer tracked by the registry.  The Regional Internet Registries have worked very hard in each region as the stocks have depleted to allow transfers to be registered so if you have the parties that are the destination of the address space, both are willing to come to some arrangement with wanting a transfer and in most cases now, they'll allow that transfer to be registered.  That's the place for all five these days.

Things are translating elsewhere as well.

>> Yes.  And as of this year, AFRINIC is allowing transfers, but only within the AFRINIC region.

>> I would venture that the five Internet registries have ran out of available stock and in accordance with the time process development process the question of transfers were addressed by the registry.  Now the final one of the five with the transfer system, AFRINIC, they have done so.  The other aspect of this is to provide inter‑regional transfers and they're also happening quite rapidly these days between primarily between the North America region where there is traditionally a large amount of historically allocated space between that region and Europe or Asia‑Pacific.  That's the transfer situation at the moment.  The idea of transfers is to continue to make IPv4 address space available to those that need it and to draw it out to provide the incentive for it to be surrendered by those that don't need it and prefer a financial award for making it available.  Yeah, the regional registry is tracking and reporting on the volume and frequencies of the transfers as a part of the report.  That information and reports are available on the website and the reports that we provide.

If I can say, the other thing with IPv6, address transfers and then carrying that out, the other option we have seen, that's probably something to point out, is there an interest in that later in the week, there is actually an IGF workshop on the use and proliferation through which operators are able to use IPv4 to connect to many more people than they have addresses.  That certainly is an interesting discussion where quite recently within enforcement agencies and also in the empowerment parliamentarians, they're asking specific questions on this and what it means.  That's another thing that certainly in our communities, we're affected by and interested in and it is being discussed this week.

>> Maybe it is too early to ask a question about it, but in terms of how it really tends to be the current trend, we're talking about the 30%, the volume in Google, it is around 20% and Facebook, it is about 50%, if continuing this trend, the basics eventually will be the bottom of operations, much bigger than the IPv4.  In the past, in the policy, we tend to be careful about the IPv4 and in the IPv6, will it dominate in the Internet operation?  Do you think it should be modified or changed in the IPv4 policy?  Right now we assume that we control the IPv and we're very careful, but the IPv6, it is really dominant.  Are we able to think about how ‑‑ what data our policy is going to modify again?

>> It is a good question.  It is a leading question. 

What the standard response that you will get from those here, it is not for us as staff of the registry organizations to actually determine what the policies are or should be.  I think what I would like to jump to here is slides about participation in the RIRs, a primary focus of the regular event is to precisely look at how the registries are actually serving the community by actually providing IPv according to policy. 

We have the policies determining how the IP addresses, 4 and 6, and how they are managed and what the RIRs do in providing the allocation registration service is to follow the policies.  We don't invent the policies, or modify the policies at the level of the registry or the organization, policy actions come from the community.

If someone like you who decides ‑‑ and you can be simply an interested member of the community, not with any relationship, membership, financial relationship with the regional Internet registry, but if you decide that you feel that IPv4 policy should now change for a particular reason, you can bring that proposal to any of the RIRs to go up the flagpole and see how many people agree with you.  That's something that happens regularly in each of the five RIRs twice a year, we have open policy meetings within the open community meeting, the conference environment and that's where as the graphic is showing here, we have a policy process which is fit to be open and that anyone can participate, it is transparent, it is fully and publicly documented and it is as we say bottom‑up and it is driven by members of the community in who could.

And who can make proposals into that process and have the proposals discussed and reviewed and hopefully eventually agreed.

We describe it as a cycle that starts with a need for us, the change, the proposal, the consensus on the proposal through the open policy process, implementation, which is something that the RIRs are responsible for, and then an evaluation which is actually in the hands of communities served by the policies and it comes back to possibly the need to change or it to continue to evolve the policies.

As I said, before the RIRs, they follow the policies, we're bound to, we can't do anything to contradict the policies, the policy development process is open and accessible to anyone who is interested.  It is important that each of the five RIRs, bottom‑up, community‑oriented organizations, we have an independent in each region, it is quite possible for different policy decisions to be made of different ‑‑ at different times according to me but there is always a cross utilization and sort of observation from one region or another to see what may be happening and what may be successful in one region or how it may be translated into another.  The interesting thing, in general, the policy development in this is a policy itself so it can be a I adapted as time goes on.

Each of the RIRs ‑‑ as I said, this is an important part of what we do ‑‑ each RIRs has its own set of policy issues, lists, working groups, special interest groups, documentation, so on.  One of the services or activities of the RIRs, one of the activities of the NRO ‑‑ sorry, to actually compare the policy development process of each.  This is an old link in the presentation.

Along with the NRO, similar exercises published, it is a comparative nature, there was a policy ‑‑ the policy provision development of the rollout of the five RIRs, and it may have a multiregional, service provider and they really understand better how the policies in different regions compare to each other.  Something that comes up in the minds of regulators and policy people in the governmental environment, drilling down into how IP addresses are managed around the world and different places and the NROs, the policy comparison metric can help to shed light on those things as well.

I understand we're going here until only 1:15, right?

That leaves a few minutes for the burning questions.

We haven't really addressed anything with the accuracy or the law enforcement agency issues.

>> That's unfortunate.  A few words on that.  Would you like to say a few words on that?

>> I think it would probably be better if you ‑‑ policies of the RIRs determine how we run or operate the services.  The services really can be divided into a number allocation service including transfers and registry services.  Each of the five RIRs have a public registry which shows ‑‑ reports publicly and is available publicly to identify where and how the IP addresses are being used.

One of the increasingly important stakeholders in those registries are the security and law enforcement issues, dealing with crime and so forth.  All of the RIRs I think in their own region involve quite heavily in liaison with education exchange with law enforcement agencies in their respective regions and globally and there is information here about how we do that.  The RIRs are involved ‑‑ we are actually in the incident response chain.  We have an online security, a criminal incident has happened, the IP addresses are an important sort of piece of information.  The RIRs, they are referring cases to law enforcements and answering and complying with subpoenas and court orders and so forth.  That's incident response.

In order for the public safety community in general, in order for them to actually better use and fully and appropriately understand the registry systems and services, we're actually doing a lot of training with that community and outreach policy work with governmental working groups and portals with an interest perhaps with the policy process, achieving changes or requirements in the way of how the services are managed.

Also we cross over into groupings like the ICANN governmental advisory Committee which has a public safety Working Group.  They have the public safety as a catch all for law enforcement but also judicial offices and emergency services and things like that where they're involved with the ICANN services.  An interesting liaison with ICANN is to be able to provide information about the numbering side into ICANN's public safety activities.

We're trying to increase the law enforcement in our pros and in different regions we have had the actor participation from law enforcement agency.  In Italy, policy work, particularly in the ‑‑ leading in the region with the FBI involvement with the meetings and also where a law enforcement community member is with us in the room here, he's working on law enforcement liaison with agencies and also the other three RIRs to some extent as well.  We would be encouraging law enforcement folks to understand the policies, particularly the policies, what it is, what it can do, what it can’t do to engage with the RIRs through the policy process if they have an interest in refining or improving in their eyes how registry services are actually operated.

An area of particular interest these days is really the accuracy of who is gathering and the completeness of who is gathering the registry services, law enforcement and others for the registry.

Current collaboration work, as I mentioned, the up to date accuracy and completeness, it is something that we're working and hearing a lot from law enforcement agents about.

Why it matters, from a public safety perspective, it is really important, the situation is time is of the essence in a lot of interactions we have where the agencies have a quick result to get a quick answer which is mostly for attribution of the activities to real people and we don't want them wasting their time if they don't have to.  That's why it probably matters.

I hope it is clear enough.

>> MODERATOR:  That's a really quick rundown of law enforcement.

I think we have reached the end of our time.  We don't seem to be getting kicked out so if there are any questions or comments that people have, it would be great to hear a little more interaction.  Otherwise, I guess it is just up to me to say thank you all for coming.

I hope it was enlightening and you learned something and if not, there will be a lot of the RIRs people onsite this week and we're friendly people and willing to chat about this and provide more information.  Please approach us if you have any questions that you think of after this or something you would like to cover next time.

Enjoy your day.  Have a good lunch.

Thank you again for coming.