June 2021 - ncc-services-wg - mailman.ripe.net

State of sanctions
by Athina Fragkouli 24 Nov '21

24 Nov '21

Dear Alex, Apologies for the delay in getting back to you. As an association under Dutch law, the RIPE NCC is in principle subject to EU and Dutch sanctions regulations. Of relevance to us are financial sanctions, which consist of: - Freezing of funds and economic resources of designated persons and entities; and - A prohibition on making funds and economic resources available to such persons and entities. So far, these sanctions apply to designated persons and entities listed in EU sanctions regulations for Iran and Syria. You can find the legislation (along with sanctioned persons/entities) here: - Iran: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32012R0267 <https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32012R0267> - Syria: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32012R0036 <https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32012R0036> Please note that the list of designated persons and entities is regularly updated. The RIPE NCC has reviewed its membership and has set a restriction on transfer and resource requests for three of its members. This was announced by the RIPE NCC Executive Board last year in April[1], followed by an update in June[2]. In late December 2020, the Dutch Ministry of Foreign Affairs (MFA) confirmed to the RIPE NCC its understanding that IP resources are considered economic resources, as defined in the EU sanctions regulations, and must be frozen for sanctioned entities. The MFA's primary concern is in terms of preventing the IP resources of sanctioned entities from being transferred, as well as preventing the allocation of additional resources. However, the MFA also said it believed the RIPE NCC had taken adequate steps to ensure compliance with sanctions and there was no need to deregister the IP resources of the three affected members. This was announced by the RIPE NCC Executive Board in March[3]. Please also note that the RIPE NCC had requested an exemption from EU sanctions regulations. However, the MFA stated that according to the regulation, there was no legal basis to exempt IP resources from sanctions. Regarding your last point, it might be difficult to provide a detailed overview, as anything we publish will have to be sufficiently anonymised to avoid identifying the affected members. However, we will see what we can do here, as we appreciate the value in having transparent reporting around this issue. Kind regards, Athina Fragkouli Chief Legal Officer RIPE NCC [1] Sanctions and the RIPE NCC: Current Status and Executive Board Position: https://www.ripe.net/ripe/mail/archives/ncc-announce/2020-April/001413.html <https://www.ripe.net/ripe/mail/archives/ncc-announce/2020-April/001413.html> [2] Sanctions and the RIPE NCC: Status Update https://www.ripe.net/ripe/mail/archives/ncc-announce/2020-June/001427.html <https://www.ripe.net/ripe/mail/archives/ncc-announce/2020-June/001427.html> [3] RIPE NCC Sanctions Update: https://www.ripe.net/ripe/mail/archives/ncc-announce/2021-March/001477.html <https://www.ripe.net/ripe/mail/archives/ncc-announce/2021-March/001477.html> > > From: Alex Le Heux <aleheux(a)tucowsinc.com <mailto:aleheux@tucowsinc.com>> > Subject: [ncc-services-wg] State of sanctions > Date: 20 May 2021 at 16:28:49 CEST > To: ncc-services-wg(a)ripe.net <mailto:ncc-services-wg@ripe.net> > > Hi All, > > The various types of sanctions and or such limits that apply to the RIPE NCC’s services have been a recurring topic for a couple years now. Recently, this seems to pop up more often though. This isn’t surprising as sanctions have become a more popular tool in the last few years. > > It occurred to me that we don’t seem to have a clear overview of what the total effect is: > > - Which sanctions, imposed by whom, affect the RIPE NCC’s operations and services? > - Who are the targets of these sanctions? > - Which of the RIPE NCC’s services are affected by these sanctions, for whom and in which way? > > (Please read “sanctions” with a wide definition and include such things as Dutch banks looking for money laundering that was mentioned during RIPE82) > > If there is a detailed overview of all this available, could the RIPE NCC publish this periodically? If not, can they start doing so? > > Best regards, > > Alex Le Heux

7 7

New on RIPE Labs: RIPE NCC and the Cloud - Let’s Start Again
by Patrik Fältström 11 Aug '21

11 Aug '21

I see the discussion about "RIPE NCC and cloud" in the archives and believe one of the reasons there seems to be a confusion is that indeed many issues are mixed in the same...hmm...whatever. I personally think deployment "in the cloud" implies an ability to deploy services in such a way (orchestration) that resources are dynamically allocated depending on for example load. This implies automatic scaling and dynamic allocation of storage, memory and CPU. Efficient such deployment can to some degree be independent of who is the provider of "the cloud". Quite often it is mostly efficient if in normal load it is deployed "on prem" while dynamic allocation during extreme load is "to an external provider". This to get most efficient use of the hardware one have invested in. For this to work, it is important to not(!) use specific services that often can also be offered by the provider of the cloud service. And this regardless of whether the deployment is on prem or externally. My suggested request to RIPE NCC is because of this to implement orchestration of services in such a way that the mechanism used is as provider neutral as possible. The 2nd request could be to remind RIPE NCC to do the actual deployment in an as efficient way as possible (whether on prem or not), but to be honest, this is what I always expect the Managing Director to do, and I do not think we members should do micro management. On top of this we have policy related requirements that in turn can be divided in two: 1. That RIPE NCC do not violate any by law requirements on data, data transfer, data storage and such things; and 2. That the policy expressed by the RIPE Community that is on top of the regulative requirements is implemented. Regarding these, I sure hope RIPE NCC is not violate any regulation. If they do we have some other issues. The 2nd list of requirements might have to do with the quite complicated situation RIPE NCC is in, to have customers in many different jurisdictions and the union of these legislations might be implemented in multiple ways, and when doing this selection on how to do "the right thing", RIPE community might have some interest in influencing it. I believe we see this for example in the DB WG on how to implement the database and here in this WG. But, separate from this I see questions where RIPE members do ask RIPE NCC to be more transparent on how (for example) legislation in the Netherlands is implemented. What I think we in the community should do though is to separate between when we want transparency and when we do believe we really do have input on issues that do not micro manage the work the managing director do. Personally, I think the Managing Director and his staff is doing good stuff and see no reason what so ever to question what decisions they have made. That said, I am curious in some cases to know what decisions they have made as maybe I have the same or similar deliberations to do at Netnod and might want to know more. But I do not question them. So, many things are intertwined and specifically mixed up are "us members being curious" and "us members actually wanting to provide input". From a technical stand point, I think the most important thing for "cloud" is to choose interoperable solutions so that migration from one cloud to another is possible, or at least as easy as possible. Including on-prem-clouds. Best, Patrik

9 12

New on RIPE Labs: RIPE NCC and the Cloud - Let’s Start Again
by Alun Davies 05 Jul '21

05 Jul '21

Dear colleagues, The community’s reaction to our cloud proposal was stronger than expected. In this article we look at some of the concerns we have seen so far, to make sure we heard you correctly: https://labs.ripe.net/author/felipe_victolla_silveira/ripe-ncc-and-the-clou… Please share any comments on this mailing list so the discussion can continue. Kind regards, Alun Davies RIPE Labs Editor RIPE NCC

11 23

Re: [ncc-services-wg] Fw: New on RIPE Labs: RIPE NCC and the Cloud - Let???s Start Again
by denis walker 23 Jun '21

23 Jun '21

Colleagues Gert put it very simply, I like to elaborate. What is the driving force behind this proposal? Is something broken? Has the RIPE NCC reached it's limit of capabilities in some area? For decades the RIPE NCC has provided the RIPE Database service to an exceptionally high standard. They have managed the whole system, it's design, software, engineering infrastructure, 24/7 operation, security. They have an excellent record of uptime for both updates and queries. They have built in resilience that has never yet failed beyond small incidents. They not only have significant levels of in-house experience and knowledge, but there are so many previous engineers still around within the community whose past experience and knowledge the NCC can draw on. It seems they now want to take a, potentially, irreversible step in a new direction. Sometimes that can be a breath of fresh air and breathe new life into a stagnant system. Or it can be the death of a previously successful service. So as Gert asked, what is the compelling reason for taking this step? Is something likely to break if this step is not taken soon? As someone else remarked, what happens if the new cloud service 'goes down'? Or if data is hacked or non-public data is leaked? Is the risk of resource hijacking affected in any way when this data is outside of the RIPE NCC and resource holders control? If the current high standard of service falls, what will the RIPE NCC's response be? Are we going to get that "Sorry but it is outside of our control, please contact the cloud provider" answer? Have all of these (and maybe other) questions been considered and answered in the proposal and impact analyses? Has any cost benefit analysis been done in terms of financial, human and reputational costs? (btw I personally am not for or against the proposal...I am just a good devil's advocate and like to help people see things from different perspectives) cheers denis co-chair DB-WG > From: Gert Doering <gert(a)space.net> > To: Alun Davies <adavies(a)ripe.net> > Cc: "ncc-services-wg(a)ripe.net" <ncc-services-wg(a)ripe.net> > Sent: Monday, 21 June 2021, 18:17:38 CEST > Subject: Re: [ncc-services-wg] New on RIPE Labs: RIPE NCC and the Cloud - Let???s Start Again > > Hi, > > On Mon, Jun 21, 2021 at 11:13:33AM +0200, Alun Davies wrote: > > https://labs.ripe.net/author/felipe_victolla_silveira/ripe-ncc-and-the-clou… > > > Is it just me or is this a somewhat reactive article that still does not > cover the > > "what does the NCC want to achieve with 'going to the cloud'" > > bit? > > Just because it's en vogue doesn't mean it's the right thing to do. > > > (And given that the glorious example of outsourcing the NCC ticket > system has *still* not led to an acceptable user experience...) > > Gert Doering > -- LIR contact > -- > have you enabled IPv6 on something today...? > > SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer > Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann > D-80807 Muenchen HRB: 136055 (AG Muenchen) > Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279 >

2 1

New on RIPE Labs: RPKI Repositories and the RIPE Database in the Cloud
by Maria Stafyla 11 Jun '21

11 Jun '21

Dear Martin, As part of our cloud first strategy, we have put in place policies mandating that if we decide to migrate to cloud a service that contains personal data, this data will be stored and processed in data storage locations within the EEA. When personal data is not processed outside the EEA, there is no transfer of personal data occurring. In the event that for example access to our data is required from outside the EEA (e.g. we request technical support from the cloud provider and this gets provided by technical staff outside the EEA), one of the offered under GDPR transfer mechanisms such as transfers based on an adequacy decision issued by the European Commission, Standard Contractual Clauses etc would serve as the legal basis for this transfer to take place. The most common transfer mechanism that we see being used by our service providers are the Standard Contractual Clauses and valid adequacy decisions. With regards to international transfers of personal data based on the Standard Contractual Clauses, we perform an assessment to understand what additional measures are required to be put in place on a case-to-case basis. Examples include technical (e.g. limiting access to the data that is strictly necessary for the particular case) and contractual measures (e.g. verifying the provider's transparency with regards to received orders to disclose their customer's data and how they respond to those requests). Regarding your last question, we would like to reassure you that before we migrate a service to the cloud various internal stakeholders including technical, security, legal, communications and other colleagues are consulted to advise on the matter. These analysis are meant for internal purposes. Kind regards, Maria Stafyla Senior Legal Counsel RIPE NCC

3 3