Annual Report 2007 [Archived]

ARIN celebrated its 10th anniversary on 22 December 2007, bringing its first decade to a close. As an organization, all our activities flow from the mission statement, and its guidance that we focus our efforts on stewardship of Internet number resources and providing registration, organizational, educational, and policy facilitation services. Moving into our second decade, ARIN will continue to coordinate with the other Regional Internet Registries (RIRs), while working to serve the interests of the ARIN community.

The ARIN community, and indeed the global Internet community, is poised for dramatic operational change. Decades of remarkable growth across the globe have strained the IPv4 resource pool, and as a community we must act in response. The ARIN Board of Trustees passed a resolution on 7 May 2007 advising the Internet community that a migration to the new version of the Internet Protocol, IPv6, will be necessary to allow continued Internet growth. ARIN has been distributing IPv6 since 1999, and has performed technical coordination of both protocol versions without advocating one over the other. However, given the decreasing pool of available IPv4 address space, ARIN advised the Internet community that migration to IPv6 is necessary for any applications that require ongoing availability of contiguous IP address space.

The Board resolution also directed ARIN staff to heighten efforts to assure the veracity of IPv4 resource requests and asked ARIN’s Advisory Council to work with the community on policy changes which would promote migration to IPv6.

The other major concern driven by the upcoming IPv4 shortage involves the possibility of profit-driven speculation in IP addresses. In response, the Board released a statement on 1 August 2007 that assures ARIN will continue to facilitate the policy development process that defines Internet Protocol (IP) address distribution for the region in a way that does not encourage profit-driven speculation. ARIN supports the established open and transparent policy process, facilitating the Internet community’s decisions regarding distribution of these finite community resources. The current resource management mechanism is sufficient to address the upcoming shortage of IPv4 addresses, and continued sober and responsible enforcement will ensure maximum benefit to and protection of the entire Internet community. ARIN is dedicated to well-established principles of Internet governance, universal access, and the stable functionality of the Internet.

I would like to extend my thanks to all who participated in ARIN’s processes, thereby contributing to the successes of 2007. ARIN relies heavily on the participation of community members. If you attended one of our meetings, participated in the Internet number resource policy development process, or voted in the 2007 elections for the ARIN Board of Trustees, Advisory Council, or the Number Resource Organization’s Number Council (NRO NC), you contributed to the success of ARIN as an organization and a community. I would also like to highlight the contributions of my fellow members of the Board of Trustees and those serving on the Advisory Council or on the NRO NC. These are volunteer positions, elected by our membership or community. They receive no monetary compensation for their work with ARIN and are often called on to work long hours in addition to their regular workdays.

ARIN owes its existence to the services it is called to perform for the community, and increased participation provides more opportunities to administer these services to the benefit of the entire community. As we progress in the transition from IPv4 to IPv6 the voice of the community is more important than ever. In 2008, we encourage your participation, as we strive to serve you at the highest possible level.

John Curran

Chairman

ARIN Board of Trustees

For ARIN, and the entire Internet community, 2007 marked a sea change. ARIN’s tenth anniversary has marked the beginning of a new era. I’ve been the President and CEO of ARIN for most of that time, and the growth and maturation of the organization is something that has, I am sure, exceeded most people’s expectations. Credit for this goes to the hardworking staff and the efforts and contributions of our community. It is the growth and innovation of ARIN and the entire community that has brought us to this critical point.

For the greater Internet community, the issues of 2007 revolved around the realization that the hugely successful growth of an Internet based on IPv4 is coming to an end, and future growth will require wide-spread migrations and deployments of IPv6. To that end, as directed by the ARIN Board of Trustees, ARIN’s activities in 2007 included a new emphasis on encouraging this transformation. As part of our core operations of education and outreach, ARIN is raising the awareness of the importance of this transition and making concrete efforts to assist the community by supporting IPv6 in practice.

It would be easy for some to suggest that the need to transition to Internet Protocol version 6 (IPv6) is a sudden development. The reality is, ARIN has been distributing these resources since 1999, and has been actively involved in the dialog on how to make IPv6 fully operational for quite some time. As we have begun to actively encourage the community to transition to IPv6 operation, it is not without careful consideration of the myriad implications of trying to support both IPv4 and IPv6.

So what is ARIN doing to ease the load? The answer is everything we can, just as we have all along. ARIN has continued to support and create forums for discussion of the technical issues associated with IPv6 operation. We host an IPv6 wiki, www.getipv6.info, to facilitate and encourage sharing of experiences and challenges that organizations encounter with IPv6 deployment. At ARIN Public Policy and Member Meetings, we have hosted speakers on IPv6 issues ranging from how to get started to a critical analysis of commercial firewalls.

As a community we need to keep the dialog open as we continue to search for better ways to manage IPv6’s impact on the routing table, as well as facilitate the growth of the Internet as more broadband consumers are brought on line.

For several years, ARIN’s services have been available over IPv6. We currently offer DNS, FTP, Web, and WHOIS services over IPv6 transport. ARIN will continue to meet the need of customers who utilize IPv6 protocols. We encourage you to prepare your technical personnel and networking systems as well.

IPv6 isn’t coming, it is here, and we all need to prepare to function in this new environment.

Raymond A. Plzak

President and CEO

American Registry for Internet Numbers (ARIN)

Policy Actions

Ratified Proposal 2007-4: Changes to IPv6 policy ­ removal of “interim” consideration

Ratified Proposal 2007-7: Creation of Policy for Subsequent End-User IP Requests/Assignments

Ratified Proposal 2007-8: Transfer Policy Clarifications

Ratified Proposal 2007-9: Modernization of ISP Immediate Need Policy

Ratified Proposal 2007-11: Refinement of ISP Initial Allocation Policy

Ratified Proposal 2007-19: IANA Policy for Allocation of ASN Blocks to RIRs

Ratified Proposal 2007-25: IPv6 Policy Housekeeping

Rejected Proposal 2007-1: Reinstatement of PGP Authentication Method

Rejected Proposal 2007-2: Documentation of the Mail-From Authentication Method

Rejected Proposal 2007-3: Documentation of the X.509 Authentication Method

Tasked ARIN staff to work with the Advisory Council to develop proposals to remove non-policy related material from the NRPM

Other Actions

Elected officers: John Curran, Chairman; Scott Bradner, Secretary; Lee Howard, Treasurer

Appointed Scott Bradner and Bill Manning to serve with Lee Howard and Ray Plzak on the Finance Committee

Appointed Scott Bradner, John Curran, and Lee Howard to the Compensation Committee

Selected Bill Manning as the representative to the Postel Network Operator’s Scholarship Selection Committee

Adopted amendments to the ARIN 401K Plan

Worked on the conflict of interest process for Board members and considered anti-takeover provisions.

Discussed ICANN’s “Affirmation of Responsibilities for ICANN’s Private Sector Management Document”

Tasked ARIN staff with ensuring the ARIN website met W3C’s Web Content Accessibility Guidelines (WCAG)

Directed ARIN staff to use cryptographic authentication mechanisms whenever possible on all communications concerning the management of number resources

Passed a resolution on Internet Protocol Numbering Resource Availability

Approved modifications to the ARIN Consultation and Suggestion Process (ACSP)

Created a Membership Committee, to comprise Board members and selected ARIN members, to make recommendations on the nature and privileges of membership.

Approved a multi-year fee waiver structure for IPv6 allocations

Developed a plan to ensure a two-year operating reserve, and discussed ARIN’s compliance given changes to credit card industry standards

Reviewed and accepted the Audit Report of the 2006 financial statements

Discussed outreach efforts regarding v4 depletion and v6 transition

Approved modifications to the ARIN Bylaws

Appointed the Nomination Committee for the ARIN Board of Trustee Election

Adopted a Statement of Continuity of Policy regarding future Internet address policy in the ARIN region

Developed a Legacy Registration Services Agreement

Confirmed the results of the 2007 ARIN Board of Trustees and Advisory Council elections

Accepted the fiscal year 2008 budget

Discussed revisions to the Internet Resource Policy Evaluation Process (IRPEP)

Worked with Counsel to resolve legal matters

AC Policy Actions

The AC recommended that the BoT adopt 12 policy proposals in 2007.

2007-1: Reinstatement of PGP Authentication Method

2007-2: Documentation of the Mail-From Authentication Method

2007-3: Documentation of the X.509 Authentication Method

2007-4: Changes to IPv6 policy - removal of “interim” consideration

2007-7: Creation of Policy for Subsequent End-User IP Requests/Assignments

2007-8: Transfer Policy Clarifications

2007-9: Modernization of ISP Immediate Need Policy

2007-11 Refinement of ISP Initial Allocation Policy

2007-19: IANA Policy for Allocation of ASN Blocks to RIRs

2007-21: PIv6 for legacy holders with RSA and efficient use

2007-22: Expand timeframe of Additional Requests

2007-25: IPv6 Policy Housekeeping

The AC abandoned 6 proposals:

2007-18: Global Policy for the Allocation of the Remaining IPv4 Address Space

2007-12 IPv4 Countdown Policy Proposal

2007-10: End Site Immediate Need Policy

2007-6: IPv4 PI minimum size change

2007-5: Changes to IPv6 policy - removal of “multiple /48” justification

2006-7: Changes to IPv6 initial allocation criteria

The ARIN Board of Trustees remanded 2 proposals to the AC for further consideration:

2007-21: PIv6 for legacy holders with RSA and efficient use

2007-22: Expand timeframe of Additional Requests

Non-policy Highlights:

•AC continued to participate in other Regional Internet Registry meetings

•Engaged in IPv6 multi-homing and Traffic Engineering Best Common Practices effort with Internet Engineering Task Force

•AC shepherds assigned earlier in the process and shepherds worked on proposal reports

Meetings

The Board of Trustees met in person five times in 2007.

6 January ­ Chantilly, VA

23 April ­ San Juan, Puerto Rico (ARIN XIX)

22-23 July ­ Chicago, IL

17 October ­ Albuquerque, NM (ARIN XX)

19 October ­ Albuquerque, NM (ARIN XX)

The Board also met three times via teleconference in 2007. The minutes from all Board meetings are available online at: http://www.arin.net/meetings/minutes/bot/

The ARIN Board of Trustees ratifies Internet number resource policies only after a full public discussion, a recommendation from the ARIN Advisory Council, and expressed consensus in support of the policy among the community. The IRPEP governs the steps necessary to adopt a policy proposal, and is available on ARIN’s website at: http://www.arin.net/policy/irpep.html.

• Subscribe to the Public Policy Mailing List and discuss ideas for new policies and pending proposals. See more at: http://www.arin.net/mailing_lists/.

• Participate in bi-annual Public Policy meetings remotely via meeting webcasts or as attendees. Active policy proposals are presented and discussed at each meeting. Meeting information is available at: http://www.arin.net/meetings/.

• Submit a proposal to create a new policy or revise current policy. Read the IRPEP at: http://www.arin.net/policy/irpep.html and follow the instructions to submit a proposal.

The Policy Proposal Archive (http://www.arin.net/policy/proposals/index.html )

contains the status of current proposals as well as complete information concerning previous policy proposals.

2007 NRPM Updates

Exact details of the changes to the Number Resource Policy Manual (NRPM), including references to specific sections, are included in the Change Log, located in Appendix A of the NRPM and available at: http://www.arin.net/policy/nrpm_changelog.html

Two updated versions of the NRPM were published.

Version 2007.1 came out on 28 March 2007. It incorporated the implementation of the following:

2006-3: Capturing Originations in Templates

Version 2007.2 was published on 22 August 2007. It incorporated the implementation of the following policy proposals:

2005-3: Lame Delegations

2007-4: Changes to IPv6 policy - removal of “interim” consideration

2007-7: Creation of Policy for Subsequent End-User IP Requests/Assignments

2007-8: Transfer Policy Clarifications

2007-9: Modernization of ISP Immediate Need Policy

2007-11: Refinement of ISP Initial Allocation Policy

http://www.arin.net/meetings/minutes/ARIN_XIX/

http://www.arin.net/meetings/minutes/ARIN_XX/

COMMUNITY OUTREACH

ARIN broadened its outreach efforts in 2007, finding new ways to interact with familiar audiences and encompassing new venues and audiences. Outreach activity increased in response to the Board of Trustees resolution alerting the community about IPv4 depletion and the need to consider implementing IPv6. Efforts focused on awareness of IPv4 free pool depletion, IPv6 implementation, and the ARIN policy development process.

ARIN Board and AC members, executives, and staff travelled to fulfill our commitment to outreach, education, and Internet resource stewardship. Our outreach at conferences and other events typically includes a presentation on the main meeting agenda and an ARIN booth in the conference exhibit area. Community outreach falls into four broad categories: regional support, industry events, tradeshows, and Internet governance and registry events.

REGIONAL SUPPORT

Regional outreach is part of our campaign to increase community awareness and participation. Efforts to increase community participation concentrated on the Caribbean Sector of the ARIN region. We held an outreach meeting in February in St. Thomas to build momentum for ARIN XIX in Puerto Rico, and participated in several Caribbean Telecommunications Union sponsored activities throughout the year. In August, ARIN, along with the CTU and LACNIC, signed a declaration of cooperation to promote the effective use of the Internet and Internet-based resources in the Caribbean. ARIN and LACNIC exhibited jointly at the Caribbean Association of National Telecommunication Organization’s (CANTO) 23rd Annual Telecommunications Conference and Trade Exhibition in Barbados.

Regional efforts were not restricted to the Caribbean. ARIN participated in the Great Plains Technology Conference, a Federation of Internet Solution Providers of the Americas (FISPA) event, and visited Industry Canada in Ottawa to enhance regional access and participation.

INDUSTRY EVENTS

ARIN maintains a presence at a number of industry events to stay current on trends and to keep the community up-to-date on pertinent Internet resource issues. At NANOG 39, we debuted a combined registration services help desk and information kiosk. IP analysts answered questions about how to obtain Internet number resources from ARIN and worked with individuals on specific resource request issues. Member Services staff encouraged attendees to participate in ARIN activities and to subscribe and participate on the Public Policy Mailing List. Educational literature and media presentations were also available. Based on the success of the event, we set up a help desk at NANOG 40 in Bellevue, Washington, and will continue to provide this feature at future NANOG meetings. Additionally, ARIN participated in IETF and NDSS meetings.

TRADESHOWS

ARIN participates in tradeshows to reach out to individuals who traditionally don’t take an active role in the ARIN community. It is frequently the only opportunity ARIN has to promote participation and provide information to these audiences.

ARIN was well received in many venues this year, including ISPCON, HostingCon, Video on the Net (VON), and the USENIX Large Installation Systems Administration Conference (LISA). ARIN will continue to explore opportunities to educate industries that will be affected by IPv4 free pool depletion, and that need to prepare for IPv6 implementation.

INTERNET GOVERNANCE and OTHER REGISTRY EVENTS

Interacting with peers at other Regional Internet Registries and taking part in the Internet governance process is key to the continued strength of the ARIN community. ARIN represented its community on the global stage by sending representatives to participate in Internet governance and other registry events.

ARIN Board members and executives play active roles in Internet governance by participating in discussion panels and attending meetings hosted by ICANN and the IGF. ARIN also provided representatives from the Board, Advisory Council and staff to all Regional Internet Registry meetings around the globe. Global participation facilitates cooperative efforts, and allows ARIN’s elected representatives a full perspective on the global implications of our own regionally developed policies.

Function: Provides services, which include facilitating the policy development process, managing association services, membership support, information services, and supporting ARIN outreach activities.

The department added two new positions in 2007, a Communications Writer and Graphic Designer. The Public Affairs Officer position was moved out of MSD to report to the Chief Information Officer.

Much of the Department’s work in 2007 focused on encouraging greater community and member participation in the activities of ARIN. With continued membership growth, just over 10% for the year, staff undertook projects to increase the number and diversity of organizations and individuals who are active in the public policy development process; attend meetings, vote in elections, and participate in discussions on the mailing lists and in the ARIN Consultation and Suggestion Process.

In an effort to increase participation in the policy process, ARIN invited all registered designated member representatives (DMRs), Admin POCs, and Tech POCs to subscribe to the Public Policy Mailing List (PPML), the public forum in which all policy proposals are introduced and discussed. The subscription campaign resulted in an increase in the number of subscribers, as well as new participants posting and contributing to the list discussions. ARIN has automated a process to send PPML subscription invitations to new DMRs, Admin POCs, and Tech POCs as they are registered.

New education tools and services were introduced throughout the year. A new flash based tutorial describing the Internet Resource Policy Evaluation Process, “The ARIN Policy Process: From Ideas of Actions” was unveiled at ARIN XIX in Puerto Rico. To improve accessibility, ARIN reformatted the popular “Querying ARIN’s WHOIS” tutorial in Adobe Flash. Both programs are found at: http://www.arin.net/education/.

“About the ARIN Policy Development Process” was added to a series of concise one-page information sheets available to the community. Originally created as media

backgrounders, these sheets have gained popularity as handouts at community meetings. Other available topics include: IPv4 and IPv6; About IP Addresses; Internet Number Resource Distribution; Regional Internet Registries; and IP

Addresses and Domain Names. Available in English, French, and Spanish, these educational resources are available at http://www.arin.net/media/.

The Membership Handbook, a project initiated in 2006, was completed this year and sent to all organizations via their designated member representative. This comprehensive guide to interacting with ARIN includes an overview of the resource request process, how to subscribe to mailing lists, pay your bills, update contact information, how to participate by attending meetings and voting. Handbooks will continue to be sent to all new members on a quarterly basis.

Elections for the Board of Trustees, Advisory Council, and NRO Number Council were held in the fall, in accordance with the Bylaws and all published guidelines. Member Services facilitated this process and also the two successful policy cycles which center on the biannual Public Policy and Members Meetings.

Projects underway that will continue in 2008 include: work on the web site to make sure it meets current web accessibility compliance standards, a review of the current web navigation and content in conjunction with the web services project, and development of an About ARIN flash presentation for outreach efforts.

Function: Performs hardware, software, and database maintenance, system administration, internal network operations, software development, and hardware acquisition.

The Engineering Department had a number of organizational changes in 2007, beginning with the arrival a new Chief Technology Officer in October. We have reorganized to add a Quality Assurance Department and hired a new Chief Engineer and another Systems Administrator to support new initiatives.

Accomplishments included:

Improvements to Customer-Facing Processes: The department made many changes to improve the customer experience. We implemented Pretty Good Privacy (PGP) to allow contacts to register keys and use these keys to authenticate PGP signed email. Providing PGP allows for secure management of Internet number resources. The department also developed new back-end systems necessary to implement Public Policy Mailing List (PPML) polling and to automate invitations sent to new Points of Contacts that are associated with new Organizations to join the PPML list. We also extended the election system so that eligible voters can conduct a non-election referendum. Other items implemented include: Origin AS within the registration process and WHOIS, improved RSS feeds, and making WHOIS available over IPv6.

Operational Improvements: The operational focus for 2007 was on updating and upgrading infrastructure. In addition to rebuilding and deploying a new secondary DNS structure, we built out an internal authentication framework using LDAP via Active Directory. In conjunction with Financial Services, we participated in a PCI audit and made minor follow-up process changes.

The major goal for 2008 is to support a multi-department effort to improve the ARIN website and provide web services to improve the customer interface options , fielding a Pilot of Resource Certificates that are to be associated with IP addresses and Autonomous systems, and creating more robust external facing services.

Function: Allocates and assigns Internet number resources, maintains IP registry and routing registry directories, administers reverse mapping DNS, and operates the ARIN Registration Services Help Desk.

The Registration Services Department (RSD) continued to provide high quality service to ARIN customers in 2007. Besides the critical tasks of allocating and assigning Internet number resources, operating a telephonic help desk, and maintaining the WHOIS Directory Service, reverse delegation registrations and a Routing Registry Service, RSD was actively involved in several external education and training activities to an ever expanding and diverse community over the course of the year.

RSD participated in several outreach activities, including ISPCON in Orlando, FL, HostingCon in Chicago, IL, and a Caribbean Workshop in St. Thomas. We also offered an ARIN registration helpdesk at all three NANOG meetings, and presented a training session at the Federal Bureau of Investigation Headquarters in Washington D.C.

In keeping with our mission to be good stewards of Internet number resources, we are engaging in resource conservation efforts, and have had great success recycling ASNs. As a result, we have not had to go back to IANA for a block of 2-byte ASNs since March of 2006.

We developed two new publications for the website: a “Quick Guide to Requesting Resources” and a new FAQ, and implemented <seven new policies>.

In 2008, we will continue to improve the customer experience at ARIN by:

• broadening the technical knowledge of staff through internal and external

 training

• improving internal processes

• developing web services

• educating the community about the Legacy RSA

• producing updated relevant registration statistics

Function: Provides ARIN financial services, which include accounts receivable, accounts payable, contracts, budgeting, general accounting activities, and financial reporting.

Actions:

Completed Registration Services Agreements, RSAs, have been scanned into an internal database which allows the Financial Services Department (FSD) to better retrieve and track these contracts. Also, a new Legacy RSA was developed.

FSD initiated a Controls Audit under direction from the Finance Committee of the Board of Trustees. The resulting recommendations are being studied for implementation. There were no material weaknesses in ARIN’s internal financial processes.

Changes:

FSD changed billing due dates to the end of each month. This change should simplify customer’s payment processes, as well as increase the department’s accuracy and efficiency in collections.

ARIN changed its revenue recognition to recognize revenue at the billing instance, which follows GAAP principles. In the past, ARIN only recognized revenue when actual payments were received. This change in procedure was done on the recommendation of our auditors.

ARIN’s investment program continued to earn money to offset ARIN expenses. ARIN takes its fiduciary responsibility seriously and we manage our funds conservatively, but also expect them to grow to ensure the financial stability of the organization.

Ongoing:

The Engineering Department is providing FSD support for ongoing projects. The pending web portal project will allow customers to interface with their billing data. FSD is working closely with Engineering and other ARIN departments on this project.

FSD continues to endeavor to provide the best service possible to ARIN’s membership and to the other departments in the organization. As always, we welcome feedback and suggestions for improvements.

Function: Performs personnel acquisition, employee compensation management, benefits administration, payroll administration, employee training, office management, office security, and travel administration. Administers all aspects of Human Resources for the organization, and works closely with the department heads and President/CEO to ensure that ARIN’s employee practices are in compliance with the law and meet the highest possible standards.

The Human Resources and Administration Department is the backbone for the four other departments at ARIN, providing staff and administrative support to the entire organization. Our success can be measured by the continued productivity in all departments. One major administrative change in 2007 involved changing payroll companies.

We encourage and support staff in the pursuit of advanced training to enable us to better serve our community. Members of the Engineering Department gained further experience and certifications in Oracle DB, DNS & Bind, and Windows Exchange to support new and ongoing projects. In HR/Admin, we have participated in Notary Public training and Coaching certification to broaden support services to the company and employees.

As of 31 December 2007, the ARIN staff had grown to 45 full-time and one part-time employee. There were six new hires for four new positions and two replacements. At year’s end, ARIN was comprised of twenty-two women and twenty-four men. ARIN has a strong, knowledgeable, and tenured employee base. Nineteen employees have been at ARIN for five years or more, and four employees have reached or will soon reach the 10 year mark. The average tenure is just under five years.

We presented the results of our Company Culture Survey to the staff as part of our 10 year Anniversary celebration/ meeting. The management team continues to solicit staff input on how to make ARIN a positive and productive work environment.

Developed by the ARIN Board of Trustees, and available since September 2006, the ARIN Consultation and Suggestion Process (ACSP) was frequently exercised by the Internet community during 2007.

The process components are explained on the ARIN website at the following URL: http://www.arin.net/about_us/corp_docs/acsp.html.

The process itself has been the subject of discussion and revision. A web archive was added in April to provide access to all suggestions and consultations and related mailing list discussions. In August, the ARIN Board of Trustees approved a revision to the ACSP imposing a ten business day deadline for an initial evaluation and response from ARIN’s President. The official response must state the action to be taken or provide a subsequent deadline for an action plan. This document change is noted in the ACSP change log.

The ACSP has proven to be a useful tool, and has helped determine the course of development at ARIN. The consultation and suggestion process provides valuable insight about community concerns and priorities. We have already started making changes, and many ongoing projects and initiatives are in direct response to this community input. The ACSP allows members to shape the daily operations and services at ARIN to better serve the community.