August 2021 - ncc-services-wg

State of sanctions
by Athina Fragkouli 25 Nov '21

25 Nov '21

Dear Alex, Apologies for the delay in getting back to you. As an association under Dutch law, the RIPE NCC is in principle subject to EU and Dutch sanctions regulations. Of relevance to us are financial sanctions, which consist of: - Freezing of funds and economic resources of designated persons and entities; and - A prohibition on making funds and economic resources available to such persons and entities. So far, these sanctions apply to designated persons and entities listed in EU sanctions regulations for Iran and Syria. You can find the legislation (along with sanctioned persons/entities) here: - Iran: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32012R0267 <https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32012R0267> - Syria: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32012R0036 <https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32012R0036> Please note that the list of designated persons and entities is regularly updated. The RIPE NCC has reviewed its membership and has set a restriction on transfer and resource requests for three of its members. This was announced by the RIPE NCC Executive Board last year in April[1], followed by an update in June[2]. In late December 2020, the Dutch Ministry of Foreign Affairs (MFA) confirmed to the RIPE NCC its understanding that IP resources are considered economic resources, as defined in the EU sanctions regulations, and must be frozen for sanctioned entities. The MFA's primary concern is in terms of preventing the IP resources of sanctioned entities from being transferred, as well as preventing the allocation of additional resources. However, the MFA also said it believed the RIPE NCC had taken adequate steps to ensure compliance with sanctions and there was no need to deregister the IP resources of the three affected members. This was announced by the RIPE NCC Executive Board in March[3]. Please also note that the RIPE NCC had requested an exemption from EU sanctions regulations. However, the MFA stated that according to the regulation, there was no legal basis to exempt IP resources from sanctions. Regarding your last point, it might be difficult to provide a detailed overview, as anything we publish will have to be sufficiently anonymised to avoid identifying the affected members. However, we will see what we can do here, as we appreciate the value in having transparent reporting around this issue. Kind regards, Athina Fragkouli Chief Legal Officer RIPE NCC [1] Sanctions and the RIPE NCC: Current Status and Executive Board Position: https://www.ripe.net/ripe/mail/archives/ncc-announce/2020-April/001413.html <https://www.ripe.net/ripe/mail/archives/ncc-announce/2020-April/001413.html> [2] Sanctions and the RIPE NCC: Status Update https://www.ripe.net/ripe/mail/archives/ncc-announce/2020-June/001427.html <https://www.ripe.net/ripe/mail/archives/ncc-announce/2020-June/001427.html> [3] RIPE NCC Sanctions Update: https://www.ripe.net/ripe/mail/archives/ncc-announce/2021-March/001477.html <https://www.ripe.net/ripe/mail/archives/ncc-announce/2021-March/001477.html> > > From: Alex Le Heux <aleheux(a)tucowsinc.com <mailto:aleheux@tucowsinc.com>> > Subject: [ncc-services-wg] State of sanctions > Date: 20 May 2021 at 16:28:49 CEST > To: ncc-services-wg(a)ripe.net <mailto:ncc-services-wg@ripe.net> > > Hi All, > > The various types of sanctions and or such limits that apply to the RIPE NCC’s services have been a recurring topic for a couple years now. Recently, this seems to pop up more often though. This isn’t surprising as sanctions have become a more popular tool in the last few years. > > It occurred to me that we don’t seem to have a clear overview of what the total effect is: > > - Which sanctions, imposed by whom, affect the RIPE NCC’s operations and services? > - Who are the targets of these sanctions? > - Which of the RIPE NCC’s services are affected by these sanctions, for whom and in which way? > > (Please read “sanctions” with a wide definition and include such things as Dutch banks looking for money laundering that was mentioned during RIPE82) > > If there is a detailed overview of all this available, could the RIPE NCC publish this periodically? If not, can they start doing so? > > Best regards, > > Alex Le Heux

7 7

Re: [ncc-services-wg] Draft Cloud Strategy Framework
by Antony Gollan 01 Sep '21

01 Sep '21

Dear Gert, Hank, Sorry for the delay with our response here. We have a few people taking their summer break at the moment, which has made it hard to get a proper response together. We will share something with the list next week. Kind regards, Antony Gollan Communications Team Leader RIPE NCC

4 3

Draft Cloud Strategy Framework
by Felipe Victolla Silveira 11 Aug '21

11 Aug '21

Dear colleagues, Following the recent discussion on this list, we have published an article on RIPE Labs with principles, requirements and a new draft strategy framework for our use of cloud providers: https://labs.ripe.net/author/felipe_victolla_silveira/ripe-ncc-and-the-clou… <https://labs.ripe.net/author/felipe_victolla_silveira/ripe-ncc-and-the-clou…> We gave an overview of this at the interim session of this WG last week. You can find the recording and minutes from that session here: https://www.ripe.net/participate/ripe/wg/active-wg/services/minutes/ripe-nc… <https://www.ripe.net/participate/ripe/wg/active-wg/services/minutes/ripe-nc…> The chairs of the working group have been kind enough to schedule a second interim WG session for 6 September where we can discuss this framework in more detail. Until then, we look forward to hearing what you think on this mailing list. Kind regards, Felipe Victolla Silveira Chief Operations Officer RIPE NCC

6 7

New on RIPE Labs: RIPE NCC and the Cloud - Let’s Start Again
by Patrik Fältström 11 Aug '21

11 Aug '21

I see the discussion about "RIPE NCC and cloud" in the archives and believe one of the reasons there seems to be a confusion is that indeed many issues are mixed in the same...hmm...whatever. I personally think deployment "in the cloud" implies an ability to deploy services in such a way (orchestration) that resources are dynamically allocated depending on for example load. This implies automatic scaling and dynamic allocation of storage, memory and CPU. Efficient such deployment can to some degree be independent of who is the provider of "the cloud". Quite often it is mostly efficient if in normal load it is deployed "on prem" while dynamic allocation during extreme load is "to an external provider". This to get most efficient use of the hardware one have invested in. For this to work, it is important to not(!) use specific services that often can also be offered by the provider of the cloud service. And this regardless of whether the deployment is on prem or externally. My suggested request to RIPE NCC is because of this to implement orchestration of services in such a way that the mechanism used is as provider neutral as possible. The 2nd request could be to remind RIPE NCC to do the actual deployment in an as efficient way as possible (whether on prem or not), but to be honest, this is what I always expect the Managing Director to do, and I do not think we members should do micro management. On top of this we have policy related requirements that in turn can be divided in two: 1. That RIPE NCC do not violate any by law requirements on data, data transfer, data storage and such things; and 2. That the policy expressed by the RIPE Community that is on top of the regulative requirements is implemented. Regarding these, I sure hope RIPE NCC is not violate any regulation. If they do we have some other issues. The 2nd list of requirements might have to do with the quite complicated situation RIPE NCC is in, to have customers in many different jurisdictions and the union of these legislations might be implemented in multiple ways, and when doing this selection on how to do "the right thing", RIPE community might have some interest in influencing it. I believe we see this for example in the DB WG on how to implement the database and here in this WG. But, separate from this I see questions where RIPE members do ask RIPE NCC to be more transparent on how (for example) legislation in the Netherlands is implemented. What I think we in the community should do though is to separate between when we want transparency and when we do believe we really do have input on issues that do not micro manage the work the managing director do. Personally, I think the Managing Director and his staff is doing good stuff and see no reason what so ever to question what decisions they have made. That said, I am curious in some cases to know what decisions they have made as maybe I have the same or similar deliberations to do at Netnod and might want to know more. But I do not question them. So, many things are intertwined and specifically mixed up are "us members being curious" and "us members actually wanting to provide input". From a technical stand point, I think the most important thing for "cloud" is to choose interoperable solutions so that migration from one cloud to another is possible, or at least as easy as possible. Including on-prem-clouds. Best, Patrik

9 12

RIPE NCC Services WG Draft minutes - RIPE 82
by Bijal Sanghani 02 Aug '21

02 Aug '21

Dear All, The draft minutes from the NCC Services WG at RIPE 82 are available online - https://www.ripe.net/participate/ripe/wg/active-wg/services/minutes/ripe-nc… <https://www.ripe.net/participate/ripe/wg/active-wg/services/minutes/ripe-nc…> Please feel free to send comments to the chairs or the mailing list. Kind regards, NCC Services WG Chairs

1 0