Board of Trustees Meeting Minutes - 29 July 2020 [Archived]

Zoom Conference

Attendees

• Paul Andersen, Chair

• Bill Sandiford, Vice Chair
• Dan Alexander, Trustee
• Nancy Carter, Treasurer

• John Curran, President & CEO
• Peter Harrison, Trustee
• Catherine Middleton, Trustee

ARIN Board Secretary & General Counsel

• Stephen M. Ryan, Esq.

ARIN Staff

• Michael Abejuela, Deputy General Counsel
• Richard Jimmerson, COO
• Brian Kirk, CFO
• Therese Simcox, Sr. E.A., Scribe

1. Welcome & Agenda Review

The Chair called the meeting to order at 9:13 a.m. EDT. The presence of a quorum was noted. The Chair reviewed the agenda with the Board and called for any comments. There were no comments.

2. Consent Agenda

• Approval of the Minutes of 21 May 2020 (Exhibit A)
• Approval of the Minutes of 28 May 2020 (Exhibit B)
• Active Board ACSP List (Exhibit C)

It was moved by John Curran, and seconded by Bill Sandiford, that:

“The ARIN Board of Trustees approves the Consent Agenda, as presented.”

The Chair called for any comments. The Chair stated that any Board-related ACSP received will be brought to the Chair who will determine how it should be resolved. The Board will keep a rolling list of these items and track their progress.

The motion carried with no objections.

3. Treasurer’s Report

The Treasurer provided an overview of the financial statements for the six-month period ending June 30th, including the organization’s financial position, operating results, and cash flows. The organization’s financial position is in very good shape and shows a rebound in the investment portfolio. The variance in revenue is consistent with the first quarter and is not unexpected. The under-budget variance in expenses is due to the change in operations from the pandemic, and is not unexpected.

4. Finance Committee Meeting Update

• RSM Risk Assessment Report & Management Response (Exhibits D, E)

The Treasurer stated that the Finance Committee (FinCom) met on July 22, 2020, and reviewed the Risk Assessment Report with the auditors from RSM. The former Audit Committee had set up what was expected to be a Controls Audit last year, but instead a Risk Assessment Report was delivered. The report highlighted potential risk areas and suggested further work in those areas. RSM also identified recognition of ARIN’s Whistleblower Policy and how it could be managed in terms of being more “independent.” The FinCom requested that management prepare a response on the status of addressing the areas raised which has been provided.

The President thanked the Treasurer for her overview and noted that staff has been working on many of these areas, in part because of previous Board direction. The Chair noted that the Board was comfortable with the staff-level effort as remediation is already underway. If assistance is needed after staff work is complete, then additional work can be considered at that time. The President also stated that staff would welcome a more typical controls audit if the FinCom decides to contract for such.

The Chair requested that an internal survey be done at least once a year to determine the staff’s perceptions on potential risks. The President stated that an employee perception survey can be added into future-year workplans. ARIN conducts annual penetration testing on its systems for weaknesses and patching through a third-party firm. Additionally, the Registration Services Department (RSD) conducts an operational audit every 2 years. The Chair acknowledged the comments, and requested the internal staff survey information for this time next year.

Discussion ensued on conducting security scans during the overhaul on technical debt in order to ensure that new deployments do not create any new security issues. The Chair asked if documentation on security flaws and testing processes could be provided. The President stated that testing is performed annually, but the results are tightly controlled due to security implications. Additional detail on ARIN’s overall security approach could be generated if desired. The Board discussed the question of how it would react to a breach at the organization and the need to have a plan for such an event. The Chair agreed to add this as an action item for the Board to discuss.

The Chair stated that this report produced great feedback, and thanked the FinCom for the presentation.

It was moved by Bill Sandiford, and seconded by Peter Harrison, that:

“The ARIN Board of Trustees, based on the recommendation of the ARIN Finance Committee, and having reviewed the Risk Assessment Report provided by RSM, hereby accepts the report, and notes that staff has provided a satisfactory response regarding the report to the Board.”

The Chair called for any comments. There were no further comments.

The motion carried all in favor, via roll call vote.

5. ARIN 401(k) Trustee Change

(Exhibits F, G, H, I, J)

It is proposed that ARIN’s new CFO replace the Director of Financial Services as a 401(k) Trustee. The COO reviewed the sample documents that will need to be processed for a 401(k) Trustee Change. This was similarly done at the beginning of last year when there was a transition to a new COO and new 401(k) Trustee. Documentation of a successful Board motion accepting the change in Trustee must be provided to ARIN’s 401(k) provider to process this change.

It was moved by Nancy Carter, and seconded by Bill Sandiford, that:

“The ARIN Board of Trustees accepts the 401(k) Trustee Change to replace Valorie Winkelman, Director of Finance, with Brian Kirk, ARIN Chief Financial Officer, effective October 1, 2020.”

The Chair called for any comments. There were no comments.

The motion carried unanimously, via roll call vote.

6. ARIN Operations

• ARIN Q2 Technical Debt Report (Exhibit K)

The COO reviewed the report stating that there have been substantial positive changes during the first and second quarters. A new Operations Manager has been hired who has begun evaluating the report. The Board’s feedback has been incorporated into this report, and work will continue in the 3rd quarter. Intended status is also shown through the end of this calendar year. The COO noted that the in-person RPKI key signing ceremony could not be conducted as previously scheduled due to the pandemic, and was conducted last week. An additional RPKI key signing ceremony will be conducted in August, which will complete the move to the upgraded certificate authority platform. Mr. Alexander recognized the significant amount of staff work and expressed appreciation to the staff’s efforts.

• IRR & RPKI Service Update

The COO reported that response to the new Internet Routing Registry (IRR) has been excellent, and the deployment went very smoothly. He noted that one significant feature for the new IRR system is not yet complete – an API to allow customers to interface via machine automation. Development of the API is underway and is on schedule. Once completed, staff proposes retirement of the prior IRR system to reduce ARIN’s technical debt, as the earlier system is quite dated and burdensome to maintain. The retirement will be done after appropriate community notice and consultation, and the COO noted that the Board has previously expressed its support for this retirement. He noted that ARIN expects thousands of IRR users by year-end, and that number is expected to grow faster once the API is completed. The Chair congratulated the staff on this effort.

Staff was asked if ARIN has a standard service life cycle for management of its services. The President stated that a list of services will be presented to the Board in August, in the form of service inventory and a service product catalog. This will enable a product management approach to ARIN’s services, including how to bundle elements into offers. Staff is building the catalog based on the current service offers and will then use it to discuss potential changes.

The COO confirmed that a webinar is planned in August to present the new IRR to the community, and the public announcement was posted on 28 July. Within 24 hours, ARIN received 111 registrants, and the number is increasing. The Chair thanked staff for the update.

• COVID-19 Operations and Future Plans Update

The COO reported that staff continues to do well in a remote operating environment, with management working with staff that may have challenges.

The Chair asked if a bi-monthly progress report could be produced beginning on September 1st. The President explained that staff is working on: quarterly progress reports, including status of objectives; Board activity metrics, including financial performance; and, key project management reports, such as tech debt. However, quarterly financial reports are not available until approximately 45 days after the quarter ends, as the FinCom needs to review them. After discussion, it was agreed to have quarterly progress reports submitted within 45 days of the end of the quarter for this year, with the CFO, President, and Treasurer to discuss if submitting accruals versus actuals will work for moving to these reports to being submitted in less than 45 days next year.

The Chair requested the report be ready by August 15th, or sooner, for the 2nd quarter. The President acknowledged his request.

7. ARIN Board Governance Working Group (“GWG”) Update

The GWG Chair provided an update on the group’s work. The RFP to hire a firm to perform a governance review and evaluation has closed. Five responses were received that were competitive and of high quality. The Committee chose Baker Tilly to perform the governance review. The GWG will hold its first working session on the afternoon of 29 July. Baker Tilly had requested 22 categories of documents which ARIN’s Deputy General Counsel provided in preparation for the discussions during the working session.

8. ARIN Trustee Skills Matrix Discussion

The Chair reviewed the skills matrix with the Board and the Board’s guidance letter to the Nomination Committee (NomCom) which offered the ability for the NomCom to request a Board self-assessment. A Board self-assessment had then been requested by the Chair of the NomCom. The Board responded to the survey, asking questions of each other.

It was moved by John Curran, and seconded by Catherine Middleton, that:

“The ARIN Board of Trustees approves the Draft ARIN Trustee Skills Matrix, and will provide it to the Chair of the Nomination Committee.”

The Chair called for discussion. It was noted that this was a useful document to aid in understanding skill sets that may be lost when Trustees are not reelected, and where certain skills are lacking. It also provides useful information for candidate slate development. The Chair thanked staff for developing the document, and stated that it would be revisited by the Board in the November-December timeframe.

It was asked if a discussion could take place with regard to the Board’s 360 Review and feedback from that process. The Chair stated it would be added to item 13. Any Other Business.

The motion carried with all in favor and no objections.

The self-assessment document will be sent to the Chair of the NomCom.

9. Ratification of Policies

At their meeting on 16 July, 2020, the ARIN Advisory Council recommended the following policies for adoption by the ARIN Board of Trustees.

A) Recommended Draft Policy ARIN-2019-1: Clarify Section 4 IPv4 Request Requirements (Exhibit L)

The President provided an overview of the policy, stating that the Policy Development Process (PDP) was followed, was well-considered by the community, and was discussed extensively. He noted this policy is easily implemented.

It was moved by John Curran, and seconded by Peter Harrison, that:

“The ARIN Board of Trustees, based on the recommendation of the ARIN Advisory Council, and noting that the ARIN Policy Development Process has been followed, adopts Recommended Draft Policy ARIN-2019-1: Clarify Section 4 IPv4 Request Requirements."

The Chair called for any comments.

The motion carried unanimously, via roll call vote.

B) Recommended Draft Policy ARIN-2019-12: M&A Legal Jurisdiction Exclusion (Exhibit M)

It was moved by Bill Sandiford, and seconded by John Curran, that:

“The ARIN Board of Trustees, based on the recommendation of the ARIN Advisory Council, and noting that the ARIN Policy Development Process has been followed, adopts Recommended Draft Policy ARIN-2019-12: M&A Legal Jurisdiction Exclusion."

The Chair called for any comments. The President provided an overview of this policy, stating that it is very easy to implement and poses no problems. He noted that it exhibits fair and impartial number administration, is supported by the community, and that the PDP was followed.

The motion carried unanimously, via roll call vote.

C) Recommended Draft Policy ARIN-2019-20: Harmonization of Maximum Allocation Requirements under Sections 4.1.8 (ARIN Waitlist) and 4.2.2 (Initial Allocation to ISPs) (Exhibit N)

It was moved by John Curran, and seconded by Peter Harrison, that:

“The ARIN Board of Trustees, based on the recommendation of the ARIN Advisory Council, and noting that the ARIN Policy Development Process has been followed, adopts Recommended Draft Policy ARIN-2019-20: Harmonization of Maximum Allocation Requirements under Sections 4.1.8 (ARIN Waitlist) and 4.2.2 (Initial Allocation to ISPs)."

The Chair called for any comments. The President provided an overview of this policy, stating that the policy is easy to implement and matches current staff practice. The PDP was followed, and it is a fair and equitable administration of number resources. This policy was well-considered and supported by the community.

The motion carried unanimously, via roll call vote.

D) Recommended Draft Policy ARIN-2019-21: Reserved Pool Replenishment (Exhibit O)

It was moved by Dan Alexander, and seconded by John Curran, that:

“The ARIN Board of Trustees, based on the recommendation of the ARIN Advisory Council, and noting that the ARIN Policy Development Process has been followed, adopts Recommended Draft Policy ARIN-2019-21: Reserved Pool Replenishment."

The Chair called for any comments. The President stated that the AC performed excellent, proactive work on this policy and he provided an overview of the policy. He stated that the reserved pools are a higher priority than the waitlist, and that setting them up in advance does not take away resources from the waitlist. The PDP was followed, and the policy is a fair and equitable administration of number resources. The policy was well-received by the community, with strong support shown. The President confirmed that the concerns raised in the staff and legal review were addressed via updated policy language.

The motion carried unanimously, via roll call vote.

E) ARIN-Edit-2020-4: Clarification of Reference to 8.2 in 8.3 (Exhibit P)

It was moved by Dan Alexander, and seconded by John Curran, that:

“The ARIN Board of Trustees, based on the recommendation of the ARIN Advisory Council, and having reviewed the editorial changes made to the ARIN Number Resource Policy Manual with regard to clarifying the reference to 8.2 in 8.3, hereby adopts said changes.”

The Chair called for any comments. The President provided an overview of the change, stating that this is an editorial change which can be adopted by the Board and AC if it does not change the effective registry administration and cleans up the policy text. He confirmed that there is no impact to staff as a result of this change.

The motion carried unanimously, via roll call vote.

10. Strategy Workshop Planning Discussion

The Chair noted that feedback from the Board had been received with regard to the content of the workshop and it will be incorporated. Further feedback will be incorporated at a later date. It was agreed that the Board would hold a virtual workshop in three segments to be held August 24, 26, and 28, in increments of 2.5 hours each with a later session to be planned for September.

It was asked if more of the data for the workshop could be presented in a graphical format to allow visualizing trends. The President responded that trending graphics will be provided where feasible.

11. 2020 ARIN Grant Program Update

The COO provided an update on the 2020 ARIN Grant Program. There is a Grant Program Committee run by staff with one Board member, Peter Harrison, participating, with $60K of funding in the Program. The work of the Grant Program Committee is on schedule, and grant applications have been reviewed. A Grant Program Report indicating recommended funding of grants has been provided to the FinCom for consideration. Peter Harrison stated that the quality of the applications was much improved this year due to more stringent requirements; and, the recommendations are also more stringent due to the requirements.

Discussion ensued on whether the FinCom needed to review the report, in lieu of the Board reviewing it directly. The President stated that he believed that the FinCom’s Charter still includes review of support to outside organizations, but it should have been amended to remove the requirement. The determination was made that the Board as a whole can consider the report directly.

The Chair stated the document should be circulated to the Board’s list for review and, in a few days, a motion can be made as an action taken without meeting, via email.

The Board entered an executive session at this time, with discussion of items 12 and 13.

12. ARIN General Counsel Update

General Counsel provided an attorney-client privileged briefing to the Board on ARIN legal matters.

13. Any Other Business

• Board 360 Review.

The Chair ended the executive session and called to adjourn the meeting.

14. Adjournment

The Chair entertained a motion to adjourn at 11:11 a.m. EDT. The meeting adjourned with no objections.