179th Executive Board Meeting Minutes

11-12 December 2024, Amsterdam

Author: Fergal Cunningham
Publication date: 30 December 2024
Status: Draft

Attendees:

Ondřej Filip (OF), Chair
Maria Häll (MH), Member
Raymond Jetten (RJ), Treasurer
Remco van Mook (RvM), Member
Sander Steffann (SS), Member
Harald A. Summa (SU), Member, attending remotely (topics 1-5)
Piotr Strzyżewski (PS), Secretary

Mirjam Kühne (MK), RIPE Chair (topics 1-10)

Daniella Coutinho (DC), Executive Assistant, RIPE NCC (topics 1-11)
Fergal Cunningham (FC), Head of Membership Engagement, RIPE NCC (topics 1-11)
Athina Fragkouli (AF), Chief Legal Officer, RIPE NCC (topics 1-11)
Simon-Jan Haytink (SJH), Chief Finance Officer, RIPE NCC (topics 1-5, 7.4-11)
Hans Petter Holen (HPH), Managing Director, RIPE NCC
Hisham Ibrahim (HI), Chief Community Officer, RIPE NCC, attending remotely (topics 1-10)
Eleonora Petridou (EP), Chief Information Security Officer, RIPE NCC (topics 1-5)
Felipe Victolla Silveira (FVS), Chief Operations Officer, RIPE NCC (topics 1-5, 7.7-8)

Day 1: 11 December 2024

1. Welcome and agenda

The Executive Board Chair, Ondřej Filip, opened the meeting at 12:36 UTC+1 and welcomed everyone.

1.1 Apologies, new agenda points

There were no new agenda points. Harald A. Summa sent his apologies for day two of the meeting.

1.2 Approval of minutes

The minutes from the previous two meetings were approved.

Resolution EB#179-R-01
The RIPE NCC Executive Board approves the minutes of EB#177 and EB#178.

The RIPE NCC Executive Board unanimously adopted the resolution.

1.3 Conflict of interest

It was noted the RIPE Chair would not attend topic 11 on RIPE Chair remuneration. Any other attendee who would like to run for the RIPE Chair position was also asked to leave. No further conflicts of interest were noted.

1.4 Dates of next meetings

The dates for upcoming meetings and training for the Board were reviewed and discussed.

1.5 Conference calendar

The Board discussed the conference calendar and who would attend various member and community meetings.

1.6 Action list review

The RIPE NCC Managing Director, Hans Petter Holen, went through the open actions and the actions that have been closed since the last Board meeting.

There was some discussion on the Board Travel Policy. A resolution will be proposed to approve the Board Travel Policy in agenda point 9.6

2. Report from the RIPE NCC 2024 and Objectives and Key Results Planned for 2025

2.1 Introduction from the MD

Hans Petter gave an overview of how the RIPE NCC performed in relation to its objectives for 2024. He explained that the Executive Team would cover their areas of responsibility.

2.2 Information Security Risk & Compliance

The RIPE NCC’s Chief Information Security Officer, Eleonora Petridou, gave the end-of-year update for 2024 on the Information Security, Risk and Compliance area. She covered significant security incidents during the year, the SOC 2 Type I assurance report received for RPKI, risk reduction achieved through risk and compliance initiatives, detection and mitigation efforts for account takeover attacks, resource constraints impacting security efforts, and the need for risk and compliance tooling and managed services. Eleonora also explained some of the higher risks that exist in each area of the organisation.

A Board member asked if, during the risk revaluations, any ratings were increased. Eleonora explained that none of the risks received an increased rating, but several ratings stayed the same and required updated mitigation plans.

Eleonora gave the timeline for full compliance with ISO 27001, and a Board member asked if we had already engaged an auditor. Eleonora confirmed that EY was engaged. From their work with the SOC 2 Type I assurance, they are familiar with the work of the RIPE NCC and this brings a big efficiency.

A Board member asked about the costs of insurance for security, and Eleonora said costs were not determined yet but an insurance broker would help in this regard. The Board member said they had experience in this area and could provide some insights. Hans Petter said that the value of cyber insurance may be unclear, so there needs to be further analysis on what exactly is required here.

There was a discussion on the cloud posture of the RIPE NCC, which was raised by members on the members-discuss mailing list. Hans Petter noted that a reply was sent that received good feedback and sparked more valuable discussion and insights. Hans Petter noted that we will also develop the RIPE NCC cloud transparency webpage and build the trust website to give further transparency.

A Board member noted that the impact of bulk email failures could be very serious and asked what the mitigation plans were. Hans Petter noted that much work has been done in this area in 2024, and there are plans for further efforts to ensure we can deliver and receive email effectively. There followed a general discussion about email at the RIPE NCC, with Hans Petter explaining the current setup to the Board.

2.3 External Engagement and Community

The RIPE NCC’s Chief Community Officer, Hisham Ibrahim, gave the end-of-year update for the External Engagement and Community area. He covered a 2024 update, objectives and key results for the year, an overview of risks in the area, and some of the objectives that will be in place for 2025. He said he also would publish a RIPE Labs article that covered much of this material.

A Board member asked for details on the number of attendees at local hubs for the RIPE 89 Meeting and the final income. Hisham said he would send these numbers to the Board, and he noted that income for RIPE 89 was not yet finalised due to the fact we are still collecting on some invoices, but it was expected the RIPE 89 Meeting will be at least 100K under budget.

A Board member said he received comments on the organisation of one of the regional meetings from attendees at RIPE 89, and it was suggested by another Board member that specific feedback on meetings could be discussed directly with the Chief Community Officer.

A Board member praised the regional events organised by the RIPE NCC in 2024.

2.4 Registry

Hans Petter gave the end-of-year update for the Registry area. He covered the performance on objectives and key results for the year, an overview of risks in the area, and some of the objectives that will be in place for 2025. He noted the continued high satisfaction scores received in the Registry, and he dived into workload issues, including verification needed to enable or reset 2FA, the impact of the fees being applied to ASNs for 2025, and sanctions and compliance efforts.

There was a question about the ability for sponsoring LIRs to drop End Users before the evaluation is made for invoicing purposes and then add them next year, but Hans Petter said mitigations were in place for this and members who attempted to do this would still be charged the full amount for those resources.

Hans Petter also presented the status of evaluating and implementing the findings from the “Advisory report regarding potential improvements related to the process of the transfers registration of the internet resources” by EY at the end of 2023. A new external review is planned for 2025. Implemented recommendations are being monitored for their success.

A Board member noted that there was a lot of conversion of Provider Independent (PI) to Provider Aggregatable (PA) resources recently, and Hans Petter said the increase in the fees could well be a factor causing this.

2.5 Technology

The RIPE NCC’s Chief Technology Officer, Felipe Victolla Silveira, gave the end-of-year update for the Technology area. He covered the key challenges faced in 2024, performance on objectives and key results for the year, an overview of risks in the area, performance improvements and statistics, cost reduction and data centre downsizing efforts in 2024, vulnerability management, and some of the objectives that will be in place for 2025.

There was a question about the audit logging that is in place for systems access, and Eleonora explained that the authentication logs are in the security tooling and we get real-time information about it.

There was a comment that there needs to be good automation of the cost-control features for cloud services, and Felipe agreed that this was something that would be developed further.

2.6 HR, Facilities and Support

The RIPE NCC’s Chief Human Resources Officer, Carolien Vos, gave the end-of-year update for the HR, Facilities and Support area. She covered the key challenges faced and successes achieved in 2024, performance on objectives and key results for the year, an overview of risks in the area, the implementation of various HR policies, the most recent staff survey results, and some of the objectives that will be in place for 2025.

The section that Carolien covered on gender and diversity sparked a conversation on broader efforts to boost gender diversity in the RIPE community and how this should be considered within the RIPE NCC.

A Board member asked if people in the RIPE NCC were approaching retirement and if there were plans in place for this. Carolien said that this will happen in the coming years and it is already being discussed internally.

There was a question about increased absenteeism, and Carolien said this was being closely monitored. She said there were likely many reasons for this, such as flu season, travel and more. She added that this is already being addressed by having managers talk to staff who are absent regularly to see if there is anything the company can do to help improve matters. While the numbers have increased, they are still below the average in the Netherlands.

Finally, there was a general discussion on efforts to have staff return to the office for a minimum number of days per week.

2.7 Legal

The RIPE NCC’s Chief Legal Officer, Athina Fragkouli, gave the end-of-year update for the Legal area. She explained what the Legal Department does and then covered objectives and key results for 2024, compliance efforts, various pieces of legislation that impact the RIPE NCC, sanctions, and the objectives that will be in place for 2025.

There was a question on whether privacy legislation in other jurisdictions was similar to the GDPR, and Athina noted that the non-EU privacy legislation that have been reviewed were indeed similar to GDPR, with at least one imposing possibly further restrictions.

There was a question about sanctions in relation to Syria in light of developments there, but there is currently no clear answer on what will happen with sanctions relating to Syria.

A Board member asked what the Data Act is about, and Athina explained the Data Act reviews certain aspects of the Database Directive. She said this was not about personal data but about having a balance on accessing data while at the same time protecting the investment of an organisation generating the data.

There followed a general discussion on the right to be forgotten, which mostly relates to the deletion of SSO accounts and how the RIPE NCC manages such requests.

3. Finance

3.1 Finance

The RIPE NCC’s Chief Financial Officer, Simon-Jan Haytink, gave the November 2024 financial update, and he then covered objectives and key results for 2024, the forecast for 2024, returns on investments, risks in the Finance area, and some of the objectives that will be in place for 2025.

There were questions about payments from members in Ultra High-Risk Countries, and Simon-Jan explained that there was no clear outcome in this area, but work is going on to facilitate payments and this will take some time. He said there were risks involved in any potential solution.

A Board member asked about legal requirements in the EU regarding the sending of electronic invoices, and Simon-Jan said he was confident that the third-party software we use would already comply with these requirements.

3.2 Clearing House Reserve

Simon-Jan gave a status update on work to create a document explaining the purpose of the RIPE NCC Clearing House Reserve.

He said that due to other priorities, the document is not yet finalised, but input from the Board was gathered during this meeting.

A Board member noted that having a clearly documented definition of what the RIPE NCC reserves are for and how large they should be needs to be considered during discussions on the RIPE NCC Strategy 2027-2031.

4. Activity Plan and Budget 2025 Approval

HPH explained that there were only some small changes from the draft version to the final version, and the Board said that it was happy with the final document and the work carried out to provide it.

Resolution EB#179-R-02
The RIPE NCC Executive Board approves the RIPE NCC Activity Plan and Budget 2025 and the publication of the document.

The RIPE NCC Executive Board unanimously adopted the resolution.

5. AOB Day 1

There was no other business to discuss on day 1.

Day 2: 12 December 2024

6. RIPE

6.1 RIPE

RIPE Chair Mirjam Kühne gave an update on developments in the RIPE community.

She gave a review of the RIPE 89 Meeting in Prague, noting the excellent collaboration with DNS-OARC that allowed attendees to come to both events. She said there was a lot of good feedback about the logistics, organisation and content in the meeting. She was especially happy with the feedback received from newcomers and younger participants at the newcomer's feedback session. She said the main feedback was that the community is very welcoming and open.

She noted that the Security Working Group was up and running, and that there were a number of new working group co-chairs selected. She also gave an overview of the policy proposals that were discussed at the meeting. She said work would continue to look at the best way to present and publish RIPE policy.

Mirjam then said there were a number of good collaborations with the IETF, and there was an increased number of related presentations at RIPE 89. She said the RIPE Chair Team also had a productive time at the recent IETF Meeting in Dublin.

Mirjam gave the status of planning for the next several RIPE Meetings.

She gave a status update on the formation of the RIPE Nominations Committee, which would select the next RIPE Chair Team. She summarised the progress by saying there were 52 volunteers from which 10 people would be randomly selected to form the committee. The first official meeting would take place in January 2025, when the call for candidates for the RIPE Chair Team would also take place.

Mirjam then talked about the progress of the work to document the relationship between the RIPE community and the RIPE NCC. She said the deadline for comments had passed and useful comments were received. She said the next version of this document would be published in January 2025.

Finally, Mirjam talked about work to review the RIPE Document Store and how she was collecting issues that people had with it and identifying possible improvements.

6.2 Community Projects Fund

Hisham gave an update on the Community Projects Fund (CPF) 2023 and 2024, with an overview of the projects that received funding in these years and the timeline for completing the involvement with the chosen projects from both years. He also noted that the CPF would be postponed for 2025, and he gave the plan for evaluating the CPF. He presented three options for the Board to consider and the Board agreed the relevant team should present those three options for a way forward at the March 2025 Board meeting.

7. Resilience of Joint Internet Number Registry

7.1 Updates to “Criteria for Establishment of New Regional Internet Registries” (ICP-2)

Athina gave an update on the survey for the ICP-2 project and an outline of the plans for the ICP-2 project in 2025. She noted that various stakeholders, including governments, were interested in the progress of this work. There was a general discussion on the ICP-2 project and the Board thanked Athina for her work in this area.

7.2 AFRINIC

Athina gave an update on the situation with AFRINIC, including the work of the official receiver who has been appointed by the Mauritian Commercial Division of the Supreme Court to organise the elections in accordance with AFRINIC’s constitution, and the part ICANN is playing to help AFRINIC through its current situation. The Board noted that it looked forward to seeing a fully functioning AFRINIC with good governance and involvement from the Internet community in Africa.

7.3 Harnessing Community Power

Hans Petter said that there were two open actions from the Accountability Task Force and Mirjam gave a progress update on the work to complete these. These actions are being addressed by the work to document the relationship between the RIPE community and the RIPE NCC and work to make RIPE Documents more consistent.

Hans Petter asked if this could be removed from future agendas with the actions added to the Board list and the Board agreed with this.

7.4 Aligning RIPE NCC's Strategic Objectives with Funding

This topic relates to Board member Remco van Mook’s work to define the RIPE compact with the RIPE NCC and determine if the RIPE NCC is set up adequately to face the challenges that are coming in the years ahead - he published two articles on this on RIPE Labs, the most recent of which covers the current situation.

Hans Petter Holen asked whether this topic should be folded into the strategy work for the next five years. Remco said he received very little feedback in the community, and he wonders if that’s because people approve or because they’re indifferent. He said he needs to get more substantial feedback from the community before deciding on a way forward, and there was a general discussion on how best to achieve this. Remco did agree that all of this work will influence the work that will take place next year on the RIPE NCC’s five-year strategy.

A Board member said the issue might be that the scope is too broad, and there needs to be some structure that people can give tangible feedback on. Hans Petter suggested identifying the matters that need to be solved, and there was agreement that this would be a good way forward.

Remco said he would like the Board and staff and potentially some others to take time to specify the topics to be resolved, if any, because the Board would have more direct knowledge of any issues that might be problematic. It was agreed that listing and categorising these issues would be very helpful, and it was also agreed that this work should take place in the March 2025 Board meeting so it could be brought to the community before the RIPE 90 Meeting. A general discussion followed about the scheduling of the work and how best to facilitate it.

7.5 Charging Scheme Task Force

Ondřej gave an overview of the work of the RIPE NCC Charging Scheme Task Force 2024. He said work was going well and there was a very good discussion on a very wide range of topics. He noted that all the minutes were being published and also that the task force would want to discuss its draft report with the wider membership before it was finalised. He said the task force might complete its work after the March Board meeting, in which case there would be a progress update at the May 2025 GM and presentation of the final report at the October 2025 GM.

7.6 APNIC-NCC Joint Board Meeting

Hans Petter gave an update on the takeaways from the joint APNIC-RIPE NCC Board meeting in November 2023 that were outlined in the EB#172 meeting. He reported that the NRO EC does not take on board the proposal to organise an NRO summit with all of the RIR boards but welcomes specific topics to be discussed. The suggestions for RPKI common work have been handed over to the NRO joint RPKI program, and plans have been made for a joint trust anchor. He also said that no work had been initiated on the topic of “Creating a single distributed registry” which dates back to the 2019 meeting.

7.7 NRO 2025

Hans Petter said that the RIPE NCC will chair the NRO EC and the NRO coordination groups in 2025. He shared his thoughts on what he wanted to achieve in 2025.

Hisham gave a detailed update on the situation with the coordination groups and areas for potential cooperation, as well as existing or dormant projects that need to be cleaned up.

A Board member said that there was the possibility of AFRINIC restoring full governance in 2025, so we need to be prepared for that possibility and include re-onboarding AFRINIC into the full NRO structures as part of the planning.

Hisham gave an update on how the RIPE NCC is currently working with AFRINIC to support them where possible given the constraints that exist.

8. Strategy 2027-2031

Hans Petter outlined the work that would need to take place to get the next five-year strategy in place. There is an 18-month period for this work to be completed, starting with an assessment of the existing strategy and then gathering input from the Board, staff, members and the community. The strategy will need to be approved in May 2026 so that the following year’s Activity Plan and Budget will fit in with the wider strategy.

There was a discussion on whether it would make sense to have three-year strategies rather than five-year strategies, although it was agreed that the longer timeframe made sense given that time is needed to successfully implement a strategy. Hans Petter also floated the idea of having a five-year operational plan and budget for the five-year period to show members that we are fully funded for the period in question.

9. Corporate Governance

9.1 Review RIPE NCC General Meeting Oct 2024

The RIPE NCC’s Head of Membership Engagement, Fergal Cunningham, presented a review of the RIPE NCC General Meeting (GM) that took place in October-November 2024. He said that the meeting ran smoothly, and that the GM Team was by now very familiar with the Assembly Voting platform that was used to carry out the voting at the GMs.

Fergal noted that the presentation from the Charging Scheme Task Force was well received, and this resulted in the majority of the comments received from members at the meeting.

Finally, he informed the Board that an analysis of the GM voting registrations was published on RIPE Labs that gives further insights into who is registered to vote at the GM.

9.2 EB Elections 2025

Fergal presented the timeline for the RIPE NCC Executive Board election process, which he said would start in January 2025 with the call from the Board for volunteers for the Executive Board Code of Conduct Team. The Board was pleased to see that the process would start early in the year to give candidates time to consider standing for election.

Fergal proposed that the dedicated mailing list provided for members to interact with Board candidates, which has been running for the past three years, should be discontinued as it is rarely used and has few subscribers. The Board agreed with this and it was suggested that candidates should feel free to interact on the members-discuss mailing list instead so that more members are aware of who the candidates are and what they stand for.

9.3 Amendment to Management Regulations

Athina shared updates to the document "Management Regulations of the RIPE NCC". This document defines and describes how members of the RIPE NCC Executive Board function, engage and work among themselves The Board appreciated the update and approved the resolution, noting the need for minor alignment amendments to be made.

Resolution EB#179-R-03
The RIPE NCC Executive Board adopts the proposed amendments to the document “Management Regulations of the RIPE NCC”.

The RIPE NCC Executive Board unanimously adopted the resolution.

9.4 Amendments to Privacy Statement

Athina gave an overview of changes to the privacy statement that are necessary in light of the formalisation of the Dubai legal entity.

Resolution EB#179-R-04
The RIPE NCC Executive Board approves the amendments to the document “RIPE NCC Privacy Statement”.

The RIPE NCC Executive Board unanimously adopted the resolution.

Athina explained the updates to the document “Handling Requests for Information, Orders and Investigations from Law Enforcement Agencies” that were necessary as it hadn’t been updated since 2016, and therefore inconsistencies needed to be ironed out. Athina noted that reference needed to be made in the document to the concept of Attachment, and she explained this legal term to the Board.

Resolution EB#179-R-05
The RIPE NCC Executive Board approves the amendments to the document “Handling Requests for Information, Orders and Investigations from Law Enforcement Agencies”.

The RIPE NCC Executive Board unanimously adopted the resolution.

9.6 Update to Board Travel Policy

The Board Travel Policy has been updated based on the discussion at the last Board meeting.

Resolution EB#179-R-06
The RIPE NCC Executive Board adopts the proposed amendments to the document “Board Travel Policy”.

The RIPE NCC Executive Board unanimously adopted the resolution.

9.7 RIPE NCC Middle East FZ-LLC

Carolien presented the status with the set-up of the Dubai legal entity (RIPE NCC Middle East FZ-LLC). She gave the background on the creation of the entity, noting the many challenges and complications involved in this endeavour, and laid out the steps that still need to be taken to complete the project.

She recommended that the focus for the coming period should be on building a stable organisation in Dubai so that further work can be done in the future.

Carolien said that the entity should be fully operational by March 2025, and the goal from then would be to investigate options for extending services provided by the entity and to allow Dubai staff to work in the Netherlands when necessary.

There was a general discussion on the issues of the costs of this project and the value it brings to the RIPE NCC. Hans Petter said that it is difficult to quantify the value of having this legal entity, although he noted that with the ever-changing political situation in our service region, having such an entity would better enable us to adapt to the challenges we will face.

Resolution EB#179-R-07
The RIPE NCC Executive Board resolves to authorise the Managing Director Hans Petter Holen to sign on behalf of the RIPE NCC the Intercompany Agreement between the RIPE NCC and the RIPE NCC Middle East FZ-LLC.

The RIPE NCC Executive Board unanimously adopted the resolution.

10. AOB Day 2

There was no other business to discuss.

11. RIPE Chair Team Remuneration

Mirjam excused herself from this topic and for the rest of the Board meeting.

Carolien gave a presentation on options for proposed employment contracts and remuneration for the RIPE Chair Team, with scenarios for people who are residents of the Netherlands and those outside the Netherlands. She said all options are designed to ensure the independence of the RIPE Chair from the RIPE NCC. She also gave options in terms of the remuneration that would best fit for the RIPE Chair and RIPE Vice Chair roles.

A Board member said the set-up should be as flexible as possible to encourage as broad a spectrum of volunteers as possible. The Board member also said that the remuneration should reflect the very high importance of the role. Carolien noted that the flexibility is limited by EU and Dutch laws and regulations.

Hans Petter gave some insights on the level of work required from the RIPE Chair Team, noting that the current RIPE Chair was working full-time in the role, whereas he did it on a part-time basis next to a full-time job. He said that having someone work full-time on the role without the constraints and potential conflicts of another job was definitely beneficial for the community. He said the requirements of the Vice Chair were less burdensome, although the current Vice Chair was able to devote substantial time due to the fact that he is retired.

There was a question on whether a job description would be needed, and Hans Petter said that there is already a community job description for the RIPE Chair Team roles. He suggested that as the position was the Chair Team for the community, it should be the community that updates that job description if it believes it is necessary to do so.

There was a general discussion on the level of the salary of the RIPE Chair, and Carolien said that the best thing to do was to use an appropriate broadband from the RIPE NCC’s salary matrix. She said that the practice at the RIPE NCC for people living outside the Netherlands was to use a salary indexed to the local country. Carolien also said that the reimbursement of expenses was the same no matter where the RIPE Chair resided. There was general consensus that the salary should accommodate candidates who are highly skilled people with good experience and strong expertise for the role. After some discussion, the Board agreed that for the RIPE Chair a full-time salary of the IXb band and a 20% salary within the VII band for the Vice Chair. The amounts are appropriately indexed to the country of residence as per RIPE NCC policies. The salary bands are published in the 2025 Activity Plan.

Hans Petter said it is in his opinion important for the RIPE NCC and RIPE community to have a full-time chair who is not financially reliant on another party in order to avoid any potential conflicts of interest.

It was agreed that Carolien would work on the principles as discussed and would inform the RIPE Nominating Committee of the outcome in January 2025 ahead of the call for candidates.

Resolution EB#179-R-08
The RIPE NCC Executive Board resolves to make funds available for the period of 2026 to 2031 for the RIPE Chair for a full-time salary within the IXb band and a 20% salary within the VII band for the Vice Chair. The amounts will be indexed to the country of residence as per RIPE NCC policies.

The RIPE NCC Executive Board unanimously adopted the resolution.

12. MD Report, MD Objectives 2024

Hans Petter summarised the performance in relation to the company-wide objectives for 2024 and presented the 2025 objectives in a closed session with the Board only.

13. Executive session

The Board had a closed session to review the performance of the Managing Director and to decide on the annual bonus and annual salary increase.

14. Feedback to MD

The Board Chair shared the feedback with the Managing Director.

15. Close

The Board Chair closed the meeting at 17:30 UTC+1.

Resolutions