The RIRs in a post-IPv4 world: Is the end of IP address policy making nigh?

IANA's IPv4 pool was officially exhausted in early 2011; Regional Internet Registries (RIRs) are gradually eating through their remaining IPv4 reserves and, although there will always be a trickle of recycled IPv4 addresses coming through as businesses go bust or ISPs move entirely to IPv6, the bulk of RIR IPv4 activity in future will be maintenance of existing allocation records (including associated RPKI certification efforts).

While IPv6 is definitely the way of the future for the Internet, the sheer size of the IPv6 address pool, combined with simplified allocation policies that have deliberately reduced barriers to entry, means there are very few organizations that can't get IPv6 directly from the RIRs these days.

As a response to these changes, an APNIC policy proposal, prop-103, popped up on 9 July 2012 suggesting that there is no need for any more IP address policy development.

Early reaction to the proposal has been mixed. Some have agreed that it is pointless to play around with IPv4 policies any more; some think that IPv4 policy may still need to be changed. There is greater agreement that IPv6 policy may still need to be refined at some point in the future when there has been more experience in IPv6 deployment.

In a larger Internet governance context, however, the APNIC proposal highlights a major challenge facing the RIRs: what is their role in a post-IPv4 world?

Where will RIRs get their income?

Each RIR has a different fee structure, but broadly speaking the current RIR business model means that the majority of RIR income comes from membership fees associated to IPv4 allocations and management.

Looking forward, ISPs are likely to request far fewer allocations in IPv6 than in IPv4 due to the large size of the initial IPv6 allocations made by RIRs. The smallest allocation size, a /32, is likely to be sufficient for a significant percentage of ISPs, meaning that for RIR fee structures based on the graduated tiers of IP address holdings, most members, if judged solely on their IPv6 holdings, will be in the smallest tier. Currently, fee schedules for IPv6 address allocation and management provide a far smaller portion of RIR income, and given the above, will continue to do so, unless member fees associated with IPv6 are radically increased. Given RIRs are membership-based organizations, there is probably going to be little member support for such an increase.

As RPKI is deployed, RIRs may find it possible to turn certification into a non-insignificant source of income by charging "legacy" IPv4 address holders for certificates that regular RIR members receive for free. "Legacy" address holders, by the way, are organizations that received their IPv4 addresses before the RIRs were created, or before RIRs had member agreements that ensured members had to pay regular address maintenance fees. For a recent article on legacy addresses, see Legacy IP Addresses on Janet.

Unless RIRs make significant hikes in their IPv6 fees, or can make RPKI certification a financial success, however, the reality is that RIRs, in the next few years, may find themselves with significantly smaller incomes.

What will happen to RIR community dynamics?

RIR members and stakeholders have traditionally met and developed their sense of being an IP addressing community via RIR mailing lists and RIR meetings.

RIR meetings began for the purpose of developing policy and, to support the ability of RIR stakeholders to participate in policy making, meetings have included presentations and discussions on industry trends and practices. In a sign of the times, however, APNIC has dropped the use of "Open Policy Meeting" in favour of the policy-free title, "APNIC conference". AfriNIC and ARIN are now the only RIRs that call their meetings "Public Policy Meetings", but if the sentiments expressed by Randy Bush in his prop-103 prove true for all regions, it might only be a matter of time before these RIRs change the focus of their meetings, too.

Today, RIR meetings and mailing lists attract a mix of those who want to influence IP address policy development, those who want to understand the policies so they can successfully request resources, and those who are there to build their knowledge on the latest IP address-related industry developments.

With IPv4 becoming less important, both in terms of allocation and policy development, and with IPv6 space large enough and being governed by policies liberal enough to probably need only minor tinkering over time, will the policy-focused community members no longer be attracted to RIR discussions?

With simpler and easier to understand IPv6 policies, will RIRs also find that ISPs don't need to attend RIR training to figure out how to ask for addresses in future?

Will RIRs find themselves with a community that transforms itself to become ISP staff primarily interested in learning more about industry developments? If so, this leads to the next question:

What is the future core business of RIRs?

RFC 2050 states, "Regional Registries provide registration services as its primary function". Over time, to support this primary function, RIRs have developed a range of supporting services. However:

• A post-IPv4 world won't require the current number of trainers, help desk operators or document writers to explain the complexities of multiple-choice policies for IPv4 allocations and assignments.
• A post-IPv4 world doesn't require as many hostmasters to evaluate IP address requests, not only because IPv6 criteria are simpler and easier to meet, but also because the overwhelming majority of organizatons will never come back with an additional request for addresses. Compare that to the last 10 or so years of RIR operations, where ISPs have regularly returned with additional IPv4 requests.

Will RIRs decide that their core function, IP address management and distribution, has become a lighter function that can be met by slimmed down Secretariats?

A world in transition from IPv4 to IPv6 most probably will require more training and documentation on IPv6 deployment and dual IPv4/IPv6 networks. Will RIRs look to these as their new main activities and sources of income? Or will RIRs refocus their central functions to be RPKI certificate authorities, or expand training departments to cover a wider range of technical training (some of the RIRs already offer training courses outside the strict IP address management function that is the RIRs' current core business), or reframe RIR meetings and events as regional hubs that provide a platform for Internet operators to exchange best practices?

To place an emphasis on training services would require RIRs to compete with commercial training providers. If this is the case, the probability is that the training costs will need to be borne by those being trained, rather than being subsidized by member income, as is the case today. To place an emphasis on becoming platform for Internet operators to exchange best practices could work nicely, if RIRs work as partners with existing regional Network Operator Groups.

What does the potential change in RIR focus mean for their role in Internet governance?

If the RIRs do reframe their business models, what does this mean for their place in the Internet governance ecosystem? Currently, the five RIRs occupy an impressive three of the 10 places allocated to the academic and technical community on the IGF MAG.

The RIRs, with their traditional focus on technical policy development, have generally been able to occupy the high ground in Internet governance discussions. For example, while domain name policy and governance is seen to be open to influence from all sorts of conflicting interests (intellectual property advocates, privacy advocates, business entrepreneurs, etc.), criticism of addressing policy is less likely to be about conflicts of interest, and more likely to be about interpretation of statistical distribution of addresses (witness the debate in the recently-closed ITU IPv6 Group where some member states came to the conclusion that RIRs were failing to achieve equitable distribution while the RIRs were able to use the same statistics to conclude the opposite.) or whether something is or is not a technical trend that address policy should be changed to accommodate.

If RIRs cease to be organizations that have policy development as part of the core of their new business models, does this also change their position within the Internet governance world? Do RIRs become more like domain name registrars, focused more on resource distribution (albeit without the focus on profit)? Or, if RIRs reposition themselves to be closer in function to the Network Operator Groups (NOGs), do RIRs embrace a more NOG-like role in Internet governance? That is, NOGs seem to play a role in regional and local IGF initiatives, and similar capacity building efforts, but play little role in the larger political Internet governance sphere.

And tangentially, what happens to the ICANN Address Supporting Organization if RIRs change focus?

Could a change in focus give RIRs the ability to survive removal of their IP management functions altogether?

If RIRs downsize and/or change focus, a possible side-effect is that they will lose the capacity to respond to any future attempts by other organizations to relocate IP addressing activities to another form of institution-most likely intergovernmental. (I'm not going to discuss the pros and cons of moving IP address management into an intergovernmental framework here. There has been a lot written about that already, and I'm sure more will be written in future.)

Right now, with RIRs rightly being well-known for their IP address delegation work, the notion of addressing functions being moved elsewhere seems unthinkable. Not only because the current possible alternative homes for such a function are seen as antithetical to the Internet's multistakeholder, bottom-up approach to governance, but also because to remove IP address functions from the IRs right now would be to remove the beating heart of the organizations. Without that heart, the RIRs would, right now, almost certainly not survive. However, if the RIRs do, indeed, refocus their central activities outside pure address management, perhaps the RIRs could survive removal of addressing functions and become Regional Internet Registries of Internet technical information and practices, instead of registries of address information. And perhaps become homes for the regional NOG activities (AfNOG, NANOG, etc.).

Time for the community to discuss

Randy Bush's prop-103 touches on the most immediate change facing the RIRs: the declining role of address policy in the RIRs. The proposal has sparked off some interesting discussion on the APNIC Policy SIG mailing list. But for me, the larger discussion the RIR communities need to have is what they want the RIRs to become in a post-IPv4 world. RIR surveys have touched on this, but as we all know, there are a couple of drawbacks with surveys:

• As I learned well during a short stint working for a PR company specializing in the oil and gas industry, survey questions are often framed in ways that encourage participants to respond in ways the survey authors find favourable to their own goals.
• Surveys tend to attract a very small sample of the stakeholders, and don't necessarily reflect the true diversity of stakeholder opinions.

Like ICANN, all RIRs have sections of their meetings that encourage the open mic discussions. RIRs have mailing lists for discussion too. I hope RIR communities take the opportunity afforded by Randy Bush's proposal to starting think about what forms they'd like RIRs to take as they move towards a post-IPv4 world. After all, the RIRs are community-based organizations, and it is through the active participation of the community that the RIRs will be sustained, in whatever form RIRs may take in future.

Gender equality and Internet governance

The recent publication of the 2012 Internet Governance Forum (IGF) Multistakeholder Advisory Group (MAG) initially got me cranky to see that the RIRs are represented on the MAG by three middle-aged white men. Yes, one of those middle-aged white men is based in Dubai, and was born in the Middle East, and so speaks Arabic. Yes, another of those middle-aged white men is from South America and speaks both Portuguese and Spanish. And yes, the remaining middle-aged white man is there because he's representing an Asia Pacific organization. And speaks some Spanish, too, if I remember correctly. So the regional and linguistic representation boxes can be ticked.

But where are the women from RIRs? The one female representative from the RIRs, Cathy Handley, has been rotated off. Let's look at women on the MAG from elsewhere in the technical world. Emily Taylor, who was originally chosen as a representative of Nominet, has been rotated off. Nurani Nimpuno remains one of the technical community's representatives on the MAG. Constance Bommelaer, my colleague on the Commission on Science and Technology for Development Working Group (CSTDWG) on IGF, joins the MAG from ISOC. Overall, there are 23 women in the 56-member MAG for 2012. So there are still 10 more men on the MAG than women. So still not quite gender balance there. But not bad when you consider the following.

Gender balance in the Regional Internet Registries (RIRs)

First, a word of explanation. I am not picking on the RIRs because their gender balance is worse than any other one of the Internet technical organizations. It was simply easier for me to look at five RIR websites (plus the NRO one) than it was to look at around 200 ccTLD websites, 21 gTLD websites, or the wide number of IETF Working Groups. For all I know, gender balance is worse in those worlds. If I have the energy, I'll track those down later. Also, please note that I am not looking at cultural or linguistic diversity here. The RIRs, on the whole, do a pretty good job in that field.

There are five RIRs. The CEOs of all five are men. Four of the five Board Chairs are men. The Boards of ARIN, LACNIC, and RIPE are composed entirely of men. But look a little closer, and you'll find some women the RIRs:

AfriNIC

AfriNIC wins the gender balance race amongst RIRs, but even its figures are depressing. AfriNIC has a female Board Chair, Ndeye Maimouna Diop Diagne, and a female alternate Board member, Lillian Wambui Karanja. So two of its current 13 primary and alternate Board members are female. And one of its past 24 Board members was female.

One of AfriNIC's female staff has the title of manager, and there are two vacant manager positions, so there's a chance AfriNIC will get some more female management in the near future. Out of its current 22 staff, nine are women. But of those nine, only two work in the technical area (the other six in the technical area are men). The rest of the women work in traditionally "female" areas of communications and administration.

Update (Friday 4:24 pm): There is a second female manager at AfriNIC in the role of Registration Services Manager. The website just hasn't been updated to show it yet, although I suspect it will be updated shortly. The total number of female employees, however, doesn't change as an existing female technical staff member was recruited for the management position.

APNIC

APNIC comes second, being the only other RIR to have a woman on its Board, Wei Zhao. APNIC has also had another woman (also from CNNIC) on its Board (known as the Executive Council) in the past. So one out of eight current Board members is a woman, and one out of 22 past Board members has been a woman. It's actually worse than that if you consider a number of the past members served more than one term, meaning that only two women have been elected out of a total of around 40 places on the Board since the late 1990s.

There are two women on APNIC's 11-member Executive Team. But both in traditional "female" roles: human resources and an executive assistant. 29 of APNIC's 68 staff are women, seven of whom are in technical roles. The rest of the women, once again, work in those traditionally "female areas" of communications and administration. I'm including the female trainers within the broad area of communications, but if you want to consider them to be technical, it bumps up the female staff in technical positions to nine.

ARIN

ARIN has no women on its seven-member Board of Directors, and never has, but it does have three women on its Advisory Council (the body that advises the Board on policy matters).

There is one woman in ARIN's three-member executive team. ARIN currently has 50 staff, and two vacant positions. Of the current 50 staff, 20 are female. There are two names where I can't be sure of the gender, so possibly it's 22 female staff. Eight of the women work in technical areas. One other works in public affairs.

RIPE and RIPE NCC

Like ARIN, RIPE has never had a woman on its Board.

Nobody in its six-member senior management team is female. Out of its 137 staff, 51 are female. Of those, 10 are in what I'd consider to be technical positions. If you include the customer services women, it takes the technical total to 15. All the rest are, to be depressingly repetitive, in communications and administration roles. A number of the technical areas at RIPE NCC are completely male, including Research & Development, Global Information Infrastructure and the Database Group. There is one woman in the external relations area.

LACNIC

None of LACNIC's current Board members are women. LACNIC doesn't publish an easy to find list of their past Board members, but I think it's a reasonably safe to assume that past members haven't been female either. I wasn't able to find a staff list on LACNIC's website, so I can't analyze their staff composition either. But I'll give LACNIC the benefit of the doubt and assume that their male/female ratios are no worse than the other four RIRs.

NRO

The Number Resource Organization (NRO) is the coalition of the five RIRs and also performs the ICANN Address Supporting Organization (ASO) function. As such, the NRO Executive Council, which consists of the five RIR CEOs, is entirely male. And the 15-member NRO Number Council, which performs the function of the ASO Address Council (AC) has one female member, from the AfriNIC region. Developed regions of the world, you should be very embarrassed that it is a developing region of the world that is putting forward the single female representative on this international Number Council.

Gender balance in the IGF

Gender balance is one of the goals of IGF MAG composition, along with regional and stakeholder diversity. Likewise, gender balance is one of the items IGF workshop organizers are supposed to address in their list of workshop speakers. Women form just over two fifths of the current 2012 MAG. And a browse through past IGF workshops and main sessions shows that the majority have at least one female speaker. It's often not half male and half female, but at least women are on the panel. It could be far better though. Civil society is particularly adept at including women as representatives.

Comparing gender balance in RIRs and United Nations-related Internet governance areas

In the various moments of crisis over the past few years when it has looked like Internet governance might move into a government-only sphere, the technical community has been very vocal in insisting that Internet governance is at its best when it has multistakeholder input and governance. And the fact that the IGF MAG has almost as many women amongst its members as men shows that diversity is being given serious consideration. The CSTDWG on IGF also had a good number of female members, including three of the five technical and academic community representatives.

So compare the gender balance in Internet governance arenas at the international (UN-related) level with what's happening at the RIR level. Why so few women in key decision-making positions within the RIRs, both within the staff and within Boards? Why is there such a large gender imbalance both within decision-making roles and in technical positions? There are three issues I can see that contribute to this:

• Women traditionally have not chosen technical careers. But this is changing. There are a lot of women who have IT qualifications. And until women can see that other women are able to succeed in the IT world without having to beat off unwanted attention from the stereotypically socially inept male geeks, amongst other things, young girls will remain less likely to choose IT as a career. But if girls can see that being a woman in IT is not only possible, but rewarding, there'll be a greater pool of female IT graduates to be employed by organizations and companies.
• RIR staff appointments are made by RIR staff. Given so many of the senior RIR staff are male, it may not even enter their minds to think that it's important to encourage women in senior or technical roles. Even if it did, I suspect many of them would use the "But no qualified women applied for the position". To that, I say, "See above, about women in IT needing role models" and "Look harder, just like you look harder to find regionally diverse applicants".
• RIR Boards are nominated and elected by RIR members, not RIR staff. It is possible that RIR members, who are usually ISPs, suffer from the same male-dominated senior management and technical staff issues as the RIRs, and therefore, once again, the thought of gender balance doesn't even enter their consciousness during the election process.

The Internet community often talk about the benefits of "bottom-up development" in Internet development. But here, it looks to me like RIRs and their communities need to follow the "top-down" example of international UN-related Internet governance bodies that make gender balance a priority.

I am not having a go at gender balance in the RIRs just because I'm a feminist with a mission (although I am that). There is an additional issue at stake here. If RIRs —and possibly other technical Internet organizations that I haven't looked at here— don't address the current gender imbalance, then they may find it very hard to sit on international Internet governance forums in future. The RIRs currently only have one woman on staff with external relations/public policy experience they could put forward for an international Internet governance forum: Cathy Handley. And she has already served her time on the IGF MAG. Who else can RIRs put forward right now apart from middle-aged white men? Perhaps one of the very few female members of their Boards if they were willing to fund them? If the RIRs don't work to fix this gender situation, they may find themselves on the outer as bodies like the MAG look for gender-balanced member compositions. Other Internet organizations, which may have similar gender imbalances, could also find themselves in the same position.