Meeting of the ARIN Board of Trustees - 30 January 2023

Chantilly, Virginia

Attendees

Bill Sandiford, Chair
Tina Morris, Vice Chair
Bram Abramson, Trustee
Nancy Carter, Treasurer
John Curran, President & CEO
Peter Harrison, Trustee
Hank Kilmer, Trustee
Robert Seastrom, Trustee

ARIN Staff

Michael Abejuela, General Counsel, Secretary
Erin Alligood, Chief Human Resources Officer
Alyssa Arceneaux, Executive Coordinator, Scribe
Einar Bohlin, Vice President, Government Affairs
Richard Jimmerson, Chief Operating Officer
Christian Johnson, Vice President, Information Security
Brian Kirk, Chief Financial Officer
Steve Ryan, Counsel
John Sweeting, Chief Customer Officer

1. Welcome, Agenda and Conflict of Interest Review.

The Chair called the meeting to order at 9:29 a.m. ET. There is a question of items on the agenda being moved around. The presence of a quorum was noted, and the Chair asked if there are any conflicts; none were disclosed.

Approval of the Minutes Exhibit A
Adoption of the ARIN Board Standing Rules. (Exhibit B)
Prepatory work by Governance Committee and ARIN staff on Single Transferrable Vote (STV). (Exhibits C, D, E, F)

It was moved by John Curran, and seconded by Tina Morris, that:

“The ARIN Board of Trustees approves the Consent Agenda, as written and as amended.”

Ms. Carter asked that the Board Standing rules amend language to chair or chairperson throughout.

The President asked that portion C of the consent agenda be removed from the consent agenda and made an agenda item to be discussed further.

The motion carried unanimously, noting one Board member’s absence.

The Chair asked to hold on agenda items 3 and 4 and began with agenda Item 5.

5. Authorization of the Treasurer to Approve Future Commitments.

The CEO noted the motion has changed slightly from previous years, due to some language clean up.

It was moved by John Curran, and seconded by Rob Seastrom, that:

“The ARIN Board of Trustees authorizes the Treasurer to approve expenses beyond the current budget year as long as they are reasonable and consistent with expenses that have typically been included in ARIN’s budget and activity plans.”

The Chair asked for discussion. There was none.

The motion carried, via roll call vote, with one absentee.

The Chair asked to move to agenda item 8.

8. ARIN Policy Ratification

(Exhibits Q, R, S)

At their meeting on December 15, 2022, the ARIN Advisory Council moved forward editorial change to ARIN-edit-2022-10: Editorial Clean-up of NRPM Sections 2.4 and 2.5 to the ARIN Board of Trustees for ratification.

Mr. Abramson joined the meeting at 9:38 am ET.

It was moved by John Curran, and seconded by Bram Abramson, that:

“The ARIN Board of Trustees, based upon the recommendation of the ARIN Advisory Council, and noting that the ARIN Policy Development Process has been followed, ratify ARIN-edit-2022-10: Editorial Clean-up of NRPM Sections 2.4 and 2.5.”

The Chair called for discussion. There was none.

The motion carried, with 7 in favor, 0 against, and 1 abstain, via a roll call vote.

The one member who abstained (Seastrom) stated that he was part of the development process of the policy while on the Advisory Council.

The Chair asked to return to agenda item 3.

3. Election of Officers.

Chair: The President opened nominations for the position of Chair. Tina Morris nominated Bill Sandiford. The President asked Bill Sandiford if he would serve if elected. Bill Sandiford stated he would serve and accepted the nomination. The President called for further nominations. There were none. Bill Sandiford was elected Board Chair by acclamation.
Vice Chair: The President opened nominations for the position of Vice Chair. Bill Sandiford nominated Tina Morris. The President asked Tina Morris if she would serve if elected. Tina Morris stated she would serve and accepted the nomination. The President called for further nominations. There were none. Tina Morris was elected Board Vice Chair by acclamation.
Secretary: The Chair asked the President to explain what the Board has done in the past, specifically with this position. The President noted that the ARIN officer positions do not need to be held by members of the Board of Trustees and that most recently, the General Counsel has been serving in the Secretary position. The President opened nominations for the position of Secretary. Bill Sandiford nominated Michael Abejuela. The President asked Michael Abejuela if he would serve if elected. Michael Abejuela stated he would serve and accepted the nomination. The President called for further nominations. There were none. Michael Abejuela was elected Board Secretary by acclamation.
Treasurer: The Chair opened nominations for the position of Treasurer. Tina Morris nominated Nancy Carter. The President asked Nancy Carter if she would serve if elected. Nancy Carter stated she would serve and accepted the nomination. The President called for further nominations. There were none. Nancy Carter was elected Board Treasurer by acclamation.

4. Non-Disclosure and Conflict of Interest Disclosure Review.

The General Counsel provided an attorney-client privileged briefing and provided materials to the Board. It was noted that each Board member was given the opportunity to review every other Board member’s respective conflict-of-interest declaration and to pose clarification questions as needed.

6. ARIN Board Committee Charters.

The President noted that no motions were needed for compensation committee and mailing list as there were no changes.

Compensation Committee. (No proposed Charter changes.) The Chair welcomed Erin Alligood on behalf of the Board to joining the Board meetings in her new position as Chief Human Resources Officer for ARIN.
Mailing List Acceptable Use Policy Committee. (No proposed Charter changes.)
Finance Committee. (Exhibit G, H) The CFO noted that the committee made a few slight updates in the proposed charter to clarify the responsibilities. The committee also made a small addition to formalize an existing committee process.

It was moved by John Curran, and seconded by Nancy Carter, that:

“The ARIN Board of Trustees accepts the updated Finance Committee Charter, as presented.”

The motion carried unanimously, via roll call vote.
Nominations Committee. (Exhibit I, J, K, L) The President noted the additional material and asked if there should be further discussion now at the Board or move all the material straight to the Governance Committee for its consideration. The Chair suggested that we review the materials and have a discussion. The General Counsel presented the memo reviewing various aspects of the proposed updates.

A discussion ensued on the next steps for the NomCom Committee Charter. It was decided that the General Counsel would make updates to the Charter, and it would be further worked on in the Governance Committee and represented to the Board.
Governance Committee. (Exhibit M, N) The President stated that there was cleanup to the responsibilities portion of the Governance Committee Charter. Mr. Abramson asked about changing the wording in sections 3.1 and 3.2 from ‘may’ to ‘should’, and it was confirmed that ‘may’ was correct.

It was moved by John Curran, and seconded by Bram Abramson, that:

“The ARIN Board of Trustees accepts the updated Governance Committee Charter, as presented.”

The Chair called for discussion. There was none.

The motion carried unanimously.
Risk and Cybersecurity Committee. (Exhibit O, P) The President stated that though the document looks very convoluted, the redline shows the discussion and comments used to clean up the responsibilities section and clarify the scope of the committee.

It was moved by John Curran, and seconded by Bram Abramson, that:

“The ARIN Board of Trustees accepts the updated Risk and Cybersecurity Committee Charter, as presented.”

The Chair called for discussion. There was none.

The motion carried unanimously.

The Board broke for lunch 11:59 am ET. The meeting resumed at 1:02 pm ET.

The Chair asked to begin with agenda item 9.

9. Investment Policy Statement

(Exhibit T, U)

The President and CFO stated that this statement was reviewed by the Finance Committee and slight changes were made with the collaboration of ARIN’s investment consultant. Specifically, definitions were included in the statement along with addressing the responsibilities of the investment consultant and ARIN staff, when making changes to investment classes.

It was moved by Nancy Carter, and seconded by John Curran, that:

“The ARIN Board of Trustees approves the amended ARIN Investment Policy Statement, recommended by the Finance Committee.”

The Chair called for discussion, there was none.

The motion carried unanimously, via roll call vote, with one absentee.

10. 2023 Management Objectives

(Exhibit V)

The President noted that the four main objectives are based on ARIN strategic themes of its mission. He went through each: to provide industry-leading Internet number registry services, to prioritize the advancement of Internet routing security, to protect the multi-stakeholder approach to Internet technical coordination and the Internet number registry system, and to strengthen ARIN’s organization and practices to provide excellent results on a consistent basis.

Within each objective, the President noted that the objectives came from the 2023 activity and budget planning.

18. General Counsel Update.

The General Counsel provided an attorney-client privileged update on legal matters to the Board.

The Chair asked to add consent agenda item C here in the agenda to be discussed.

C) Preparatory work by Governance Committee and ARIN staff on Single Transferrable Vote (STV).

(Exhibits C, D, E, F) The General Counsel discussed this during the General Counsel update, under an attorney-client privileged session.

7. Appointments of Board Members to Standing Committees and Other Roles.

It was moved by Rob Seastrom, and seconded by John Curran, that:

“The ARIN Board of Trustees approves the establishment of their 2023 Committees, appointing the following Board Members, as follows:

Compensation Committee: Bill Sandiford (Chair), Nancy Carter (Treasurer), Tina Morris
ARIN Finance Committee: Nancy Carter (Treasurer/Chair), Tina Morris, Hank Kilmer, Rob Seastrom
ARIN Governance Committee: Bram Abramson (Chair); Nancy Carter, Peter Harrison, Hank Kilmer
ARIN Risk and Cybersecurity Committee: Peter Harrison (Chair); Bram Abramson, Rob Seastrom
ARIN Nominations Committee: Bram Abramson (Chair), Hank Kilmer
Mailing List AUP Committee: Hank Kilmer (Chair)
Election Officer and Vote Counter: Rob Seastrom
NRO EC Observer: Bill Sandiford

There was no further discussion.

The motion carried unanimously.

11. Report on Proxy Voting.

(Exhibit W)

The General Counsel gave a privileged report regarding differences between voting points-of-contact and proxy voting.

12. Report on SOC 2 Audit results and Ongoing 2023 Information Security Activity.

(Exhibit X, Y)

The VP of Information Security reported that ARIN successfully completed the SOC 2 Type 1 Audit for RPKI and gave an overview of the project milestones. The auditor listed no exceptions in the report, which is the best outcome for the certification. SOC 2 Type 2 for RPKI is the next step and ARIN began this process on December 1. The audit cycle will normally be a 12-month period, but for 2023 there will be 10-month period to get ARIN on a schedule that avoids Q4 work and holiday congestion.

The VP of Information Security then reviewed the benefits of going through SOC certification. Moving forward with SOC 2, ARIN is broadening the scope of the Type 2 audit to include the Availability Trust Services Criteria (TSC) along with Security & Confidentiality from the Type 1 audit. ARIN will look to add ARIN Online to the audit starting in October, unless resources must be diverted to support other higher priority efforts such as PCI DSS compliance required due to changing credit card payment processors. For right now, ARIN is reviewing PCI DSS work to determine the level of effort that will be required.

Ms. Carter asked about any of the crossover between the SOC 2 audits and financial audits. She also asked about ARIN sharing the SOC report publicly. Mr. Johnson stated that we intend to post that we are certified on our website but do not intend to post the actual report. He did note that our members/customers will be able to request the report. The CFO stated that the SOC 2 audit information was shared with our financial advisors and while it may eliminate some financial testing, it does not replace it altogether.

Mr. Seastrom asked why ARIN would need to complete the PCI DSS certification. It was explained that while we do not retain credit card information, it does pass through the ARIN systems during credit card approval, so PCI DSS is recommended.

The Chair adjourned the meeting at 4:27 pm ET on Monday, 30 January 2023.

The meeting reconvened at 9:08 am ET on Tuesday, 31 January 2023.

13. Report on Facilitator VIP Program.

(Exhibit Z)

The President asked the CCO to go through a presentation on updating the facilitator program. The goal is to improve the program so that ARIN customers can have faith in a vetted list of facilitators and provide a reliable baseline that would allow for a premier facilitator program in the future. It would also remove the listing service which is very lightly utilized and not reliably updated. This led to a discussion of facilitator assistance during transfers and more generally about whether it would be possible to allow for visibility and ticketing only “facilitator” point of contact block on a number resource.

14. Report on Global IPv4 Routing Table Report.

(Exhibit AA)

The COO noted there had been a previous request to review a routing table report at a Board meeting to determine if there is information in the reporting that has impacts on the business of the registry. The COO presented a recent copy of a routing table report that is frequently reported to operating group lists. There was some description of how information on the report has been used by operators and IP address policy makers in the past.

The President added that the routing table reports are more routing-information specific with useful information for operators and researchers, but that today it has a more limited impact on registry policy and operations. Mr. Kilmer and Mr. Seastrom provided additional information about the historical use of the routing table report data. Mr. Abramson thanked staff for providing information for this item on the agenda and noted no further information is needed at this time.

15. ARIN Travel Qualified Policy.

(Exhibits BB, CC, DD)

The President turned over the presentation to the General Counsel. The General Counsel explained that the Board put into place the travel qualified policy in February 2022 relating back to the COVID pandemic. The General Counsel stated that pandemic and government requirements have lessened and therefore changes are being presented. The new policy focuses more on health concerns and is less pandemic-focused.

Mr. Seastrom asked a question regarding destination-specific vaccinations and adding verbiage to the policy since ARIN does allow for reimbursement of such vaccinations. The Board members all agreed to additional language being added to the presented policy.

It was moved by John Curran, and seconded by Rob Seastrom, that:

“The ARIN Board of Trustees approves the amended changes to the ARIN Travel Qualified Policy.”

There was no further discussion.

The motion passed unanimously.

16. Operational Update.

(Exhibits EE, FF)

The COO reviewed two recent incident reports with the Board – one related to Whois services which led to an outage of about 30 minutes. The outage was immediately reported by ARIN, and staff concentrated on bringing Ashburn back to a good state, then updated DNS, then Seattle and finally the San Jose site. The remediation is that ARIN will no longer do manual reseeding and it will be built into the automation. There is an after-action report that is sent to the outage site. There was a showing of the outage page off the ARIN site.

The second incident report was with regard to high query rates affecting the WHOIS/nrtm services. It is not creating outages at this point, but ARIN is working with the vendor that provides the client, to make some code changes to help with the abundance of queries. These queries are putting some strain on the system. ARIN has not heard of a customer complaint.

Mr. Abramson asked about tying queries to revenue. The President noted that larger organizations tend to do the largest query counts and are already the people paying the most given ARIN’s pricing scheme.

Mr. Harrison noted that with the growing costs for infrastructure, additional service revenue would be a great way to offset those costs. The CFO noted that if there were additional revenue, ARIN would need to make sure it aligns with our mission or it becomes taxable.

17. Establish the 2023 ARIN Board and Committee Meeting Calendars.

(Exhibit GG)

The COO reviewed the Board meeting calendar. The Chair asked that staff recommend cities and dates for the 1 and a half day Board workshop in either late July or August, including leaving the potential for half-day committee meetings or team building events.

The Board stated their interest in getting January Board meetings planned earlier to allow for some shared time with ARIN AC.

19. Open Action Item List.

(Exhibit HH)

The President provided an update on the action item list to the Board. No concerns were raised.

20. Any Other Business.

The Chair asked for any other business. The President had previously stated that he had one item.

Code of Conduct and Enforcement. The President stated that presently if an attendee or volunteer violates ARIN’s code of conduct or standards of behavior at the in-person meeting, that that there is a designated set of ARIN officers who may be approached and will work through an issue. He suggested that ARIN might explore a dedicated, independent ombudsperson be present at ARIN meetings, as this increases comfort in people raising any concerns or issues that might otherwise be missed.
Transfer fee. Ms. Morris asked for an update on the transfer fees that were pushed out the ARIN members earlier in the year. The CCO stated that there have been no complaints or issues with the additional transfer fees.

21. Executive Session.

The Board entered an executive session at 11:10 am ET.

22. Adjournment.

Tina Morris motioned to adjourn; Peter Harrison seconded. The Chair adjourned the meeting at 1:29 pm ET.

Meeting Procedures