Independent Resource procedure and implementation

Hello, I would like to open discussion related to "Action Required: Contractual Relationship for Independent Resource Assignments" emails, that almost all LIRs received from RIPE NCC in the past. I have some notes from perspective of small LIR (or from perspective of person helping running multiple small LIRs). My first note points to system in general. Although RIPE NCC has many required informations in own existing databases already, it requires additional action from LIR in general. Typical small LIR has one or more PA allocations and exactly _one_ autonomous system registered. In RIPE database, there are records matching allocated PA prefix and ASN (route objects with proper origin AS and related inetnum objects, many ASNs has paired LIRs org: in aut-num object). In addition, RIS service (with history!) can be used for verification of these informations obtained automatically from database. For incomprehensible reason, RIPE NCC doesn't use these informations at all and instead of this abuses ALL LIRs with submiting simple form with exactly one record within it. I thing RIPE RCC has enough resources (financial and human) to do that automatically. My second note points to implementation of this new tool. I discovered, that I'm not able to "new" tool used for confirmation. I'm using PKI login feature and I have one identity paired with more LIRs. Although I'm able login to the LIR portal and modify everything I need with my certificate, I'm _NOT_ able to update informations on "Independent Resources" page. The main reason is, that RIPE NCC created new and separated (!) tool instead of simple integration of new feature/functionality to existing LIR portal. So, instead of reusing existing code used for LIR portal authentication, new outside code was developed for this new tool. And this new code doesn't implement all authentication features from LIR portal. In my point of view, this is quite unprofessional approach of modern application development. Aplications should be multi-layer, allowing easy new feature implementation. I reported this issue to RIPE NCC on friday last week, but first "answer" I received yesterday from RIPE NCC was initiation of audit in one LIR. Just fortuitous event? I don't believe. I have no problems with audit itself, I have all records, but this takes some additional time (and of course, money). Just because I claimed some problems to RIPE NCC staff due to problematic internal _implementation_ of new policy. Ok, I would like to open public discussions about this problem. There are some questions to answer and discuss: * why RIPE NCC just doesn't use informations from RIPE database in case of their availability and verifiability, why abuses small LIRs instead * why aren't RIS data used for automatic obtaining of requested informations, where this can be applicable * why RIPE NCC didn't integrate "confirmation" tool to existing LIR portal and why new outside application with _limited_ functionality was developed instead of reusing of existing code and functionality * what architecture is used for LIR portal in general, can be there easily implemented new features Of course, I understand, that there are large LIRs and some historic mess, where this action may be required due to lack of records in existing databases. But, I think this is NOT a case of LIRs started in past couple of years, where all required data should be available. With regards, Daniel

On 3 Sep 2009, at 07:18, Daniel Suchy wrote:
My second note points to implementation of this new tool. I discovered, that I'm not able to "new" tool used for confirmation. I'm using PKI login feature and I have one identity paired with more LIRs.
Yes, I have complained about this to the NCC, but have not been able to explain this problem to anyone who can help. Though hopefully someone at the NCC can pick up this email and advise the procedure. I wonder if the simplest solution is for people with multiple identities to handle the registration of these resources via email with a hostmaster ?
I reported this issue to RIPE NCC on friday last week, but first "answer" I received yesterday from RIPE NCC was initiation of audit in one LIR. Just fortuitous event? I don't believe.
Interestingly, this also happened to me (audit initiated Wednesday, my most recent email to hostmaster@ about the lack of ability to log into Independent Resources was Tuesday). However, I don't think the two are related. :-) Best wishes Andy -- Regards, Andy Davidson +44 (0)20 7993 1700 www.netsumo.com NetSumo Specialist networks consultancy for ISPs, Whitelabel 24/7 NOC /* Opinions are mine & do not constitute policy of those I work for */

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Daniel, Thank you for your mail. To address your first and second points, the RIPE Database is a public database. The aut-num objects that you mention are maintained by the Local Internet Registry (LIR) or the End User and have been assigned by the RIPE NCC over a number of years. This means that the information contained in the RIPE Database might be outdated or inaccurate. However, as a consequence of this project, many LIR organisation name changes have been initiated by RIPE NCC members and contact details have been updated by many LIRs, including recently set-up ones. This contributes to the improved quality of RIPE Database data. RIS data would have to be compared with the RIPE Database information, bringing us back to the points listed above. The RIPE NCC is also working on a project to enhance the quality of its registration data in order to help resolve similar cases in the future. Creating a separate process for 'small' and 'larger' LIRs would not be cost effective. Furthermore, the RIPE NCC is impartial and neutral to all its members. In the case you mention, where an LIR uses one AS Number for its infrastructure, the LIR is requested to select "My Infrastructure" on the interface provided. No further action is requested from them. I am sorry to hear that you see this as an abuse. To address your concerns related to the software, the current implementation of "single sign on" enables you to log in once using: - - Certificate AND password for certification *or* - - Just password (or both) for policy 2007-01 It does not currently allow login using only a certificate. We believe that this is a good thing. The ability to sign in using just 'certificate' degrades the security of the portal; users could generate such certificates without pass-phrases and then anyone with access to their computer could log in. Being an 'external user' and representing many LIRs results in having to log in as 'primary' user for each of them. This was recognised during the development of this project as a point for improvement. In the new version of the LIR Portal, which we are currently working on, this will be handled in a more user friendly way. Unfortunately, we could not integrate completely with the LIR Portal in the timeframe given to implement policy 2007-01. We decided not to make further developments to the legacy code base of the current LIR Portal because we already had plans to entirely rebuild the LIR Portal. We are currently working on the LIR Portal migration project. One of the first milestones will be to make the integration between old and new seamless for users. With regards to the RIPE NCC audit you mention, I can ensure you that this is just a coincidence. I apologise for any inconvenience caused by the LIR Portal integration and appreciate the feedback on our services. If you have any further questions or feedback please don't hesitate to contact me. Kind regards, Andrea Cima RIPE NCC Daniel Suchy wrote:
Hello,
I would like to open discussion related to "Action Required: Contractual Relationship for Independent Resource Assignments" emails, that almost all LIRs received from RIPE NCC in the past. I have some notes from perspective of small LIR (or from perspective of person helping running multiple small LIRs).
My first note points to system in general. Although RIPE NCC has many required informations in own existing databases already, it requires additional action from LIR in general. Typical small LIR has one or more PA allocations and exactly _one_ autonomous system registered. In RIPE database, there are records matching allocated PA prefix and ASN (route objects with proper origin AS and related inetnum objects, many ASNs has paired LIRs org: in aut-num object). In addition, RIS service (with history!) can be used for verification of these informations obtained automatically from database. For incomprehensible reason, RIPE NCC doesn't use these informations at all and instead of this abuses ALL LIRs with submiting simple form with exactly one record within it. I thing RIPE RCC has enough resources (financial and human) to do that automatically.
My second note points to implementation of this new tool. I discovered, that I'm not able to "new" tool used for confirmation. I'm using PKI login feature and I have one identity paired with more LIRs. Although I'm able login to the LIR portal and modify everything I need with my certificate, I'm _NOT_ able to update informations on "Independent Resources" page. The main reason is, that RIPE NCC created new and separated (!) tool instead of simple integration of new feature/functionality to existing LIR portal. So, instead of reusing existing code used for LIR portal authentication, new outside code was developed for this new tool. And this new code doesn't implement all authentication features from LIR portal. In my point of view, this is quite unprofessional approach of modern application development. Aplications should be multi-layer, allowing easy new feature implementation.
I reported this issue to RIPE NCC on friday last week, but first "answer" I received yesterday from RIPE NCC was initiation of audit in one LIR. Just fortuitous event? I don't believe. I have no problems with audit itself, I have all records, but this takes some additional time (and of course, money). Just because I claimed some problems to RIPE NCC staff due to problematic internal _implementation_ of new policy.
Ok, I would like to open public discussions about this problem. There are some questions to answer and discuss: * why RIPE NCC just doesn't use informations from RIPE database in case of their availability and verifiability, why abuses small LIRs instead * why aren't RIS data used for automatic obtaining of requested informations, where this can be applicable * why RIPE NCC didn't integrate "confirmation" tool to existing LIR portal and why new outside application with _limited_ functionality was developed instead of reusing of existing code and functionality * what architecture is used for LIR portal in general, can be there easily implemented new features
Of course, I understand, that there are large LIRs and some historic mess, where this action may be required due to lack of records in existing databases. But, I think this is NOT a case of LIRs started in past couple of years, where all required data should be available.
With regards, Daniel
-----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.11 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAkqf5bwACgkQXOgsmPkFrjPxfwCeNJWIiYb07uIXA1yW6sFnRNmJ qZwAn1JnBd+sjuGEX5zKe2cI2kkz3D93 =pDo0 -----END PGP SIGNATURE-----

Hi, On 09/03/2009 05:50 PM, Andrea Cima wrote:
To address your first and second points, the RIPE Database is a public database. The aut-num objects that you mention are maintained by the Local Internet Registry (LIR) or the End User and have been assigned by the RIPE NCC over a number of years. This means that the information contained in the RIPE Database might be outdated or inaccurate. Yes, this is public database, but updates are restricted to limited number of person in defined hiearchy. And you should have all logs related to these changes. Majority of changes _must_ be authorized by some known maintainer. You cannot have problem to obtain informations about last update time of any information from your database. So, you can easily focus to objects _not_ updated for several years...
However, as a consequence of this project, many LIR organisation name changes have been initiated by RIPE NCC members and contact details have been updated by many LIRs, including recently set-up ones. This contributes to the improved quality of RIPE Database data. RIS data would have to be compared with the RIPE Database information, bringing us back to the points listed above. In general, changes of organization name, merging and transfers of LIR aren't simple operation. Manual intervetion is required from RIPE NCC staff to change these key informations about LIR. I this case - you say, that RIPE NCC staff isn't updating these informations in case of change? From LIR perspective, in case of change there's requirement to provide similar informations to RIPE NCC staff, same as LIR provided at setup time. You're billing each LIR (at least) every year. So, you also have informations about existence of organisation, almost nobody will pay invoice to RIPE NCC behalf non-existing company.
The RIPE NCC is also working on a project to enhance the quality of its registration data in order to help resolve similar cases in the future. Creating a separate process for 'small' and 'larger' LIRs would not be cost effective. Furthermore, the RIPE NCC is impartial and neutral to all its members. In first place, there's need to improove work of RIPE NCC staff. As I mentioned above, you request many informations from LIRs, but it seems,
In the case you mention, where an LIR uses one AS Number for its infrastructure, the LIR is requested to select "My Infrastructure" on the interface provided. No further action is requested from them. I am sorry to hear that you see this as an abuse. Yes, but this must be done in some tool, which is NOT integrated to LIR
Again, it's just about pairing of informations in all of databases, that RIPE NCC has. It seems, that RIPE NCC is lazy to do this! Even, if all LIRs pay you (RIPE NCC) for this work. RIPE NCC has enough staff to do this. that this is "one time" communication between LIR representative and RIPE NCC employe, but not reflecting your databases. portal and which doesn't work with PKI authentication correctly.
To address your concerns related to the software, the current implementation of "single sign on" enables you to log in once using:
- Certificate AND password for certification *or* - Just password (or both) for policy 2007-01
It does not currently allow login using only a certificate. Yes, I know my password and I tried to use it. But, I'm able update informations only for "primary" LIR, not for secondary ones assigned to same certificate (and yes, I'm able to update anything on LIR portal). That "new" software is just broken. And probably you wont accept this fact!
We believe that this is a good thing. The ability to sign in using just 'certificate' degrades the security of the portal; users could generate such certificates without pass-phrases and then anyone with access to their computer could log in. I agree, but if I'm sucessfully authenticated, I should be able to update _ALL_ informations, where I'm responsible for them. Not only some of them.
Being an 'external user' and representing many LIRs results in having to log in as 'primary' user for each of them. This was recognised during the development of this project as a point for improvement. In the new version of the LIR Portal, which we are currently working on, this will be handled in a more user friendly way. Again, why there's new project, new authentication model and finally - more spent time and money for - from user perspective - very simple tool with one submit form. This functionality can be implemented to LIR portal. You can improove security of LIR portal in general, but there's no reason for develop outside - pure new - tools...
Unfortunately, we could not integrate completely with the LIR Portal in the timeframe given to implement policy 2007-01. We decided not to make further developments to the legacy code base of the current LIR Portal because we already had plans to entirely rebuild the LIR Portal. You HAD enough time. First version of policy is more than two years old. And there was NO requirement for implement pure new authentication at all. It's just your obscurity from your side. From your words, it seems, that RIPE NCC software development processes should be _deeply_ inspected. Where's reported process of development of "new" LIR portal?
Simple web form with few radio buttons and one submit button really doesn't require hard development.
We are currently working on the LIR Portal migration project. One of the first milestones will be to make the integration between old and new seamless for users. As mentioned above, RIPE NCC should report all these activities to RIPE members. Where're published these plans, roadmaps for migration, etc? Where's testing version running? RIPE NCC should NOT be a blackbox, it's membership-driven organisation. You should share ALL these informations with members.
With regards to the RIPE NCC audit you mention, I can ensure you that this is just a coincidence. Public RIPE NCC auditing procedure isn't much desciptive, there's no real methodology of this process. Existing policy gives rights to RIPE NCC for doing almost anything, RIPE-423 is very vague. And there's not real requirement for some reporting from RIPE NCC. Older RIPE-170 was slightly better, but was changed by some reason to this new - shorter version. There aren't any publicly accessible reports of audit activities for several years. Process of audits isn't transparent to RIPE NCC members. Again, we're talking there about RIPE NCC transparency...
Daniel

Hello Daniel,
Unfortunately, we could not integrate completely with the LIR Portal in the timeframe given to implement policy 2007-01. We decided not to make further developments to the legacy code base of the current LIR Portal because we already had plans to entirely rebuild the LIR Portal.
You HAD enough time. First version of policy is more than two years old.
The first moment the NCC can start implementing a policy is when consensus has been declared on the policy proposal. Before that point in time the policy can be discarded or changed. Implementing a policy proposal that might not even become policy would really be a waste of effort and money... - Sander

Hi, I aggree with the fact, that development can start _after_ consensus declaration. I'm just talking about fact, _how_ RIPE NCC implemented policy 2007-01. At this time, we have informations about particular ASN on _two_ places, with broken authentication system in one of these places. On LIR portal at resources_asn section we have ASN, date of creation and associated ticket. In policy 2007-01 tool we have information about type of user of that ASN (own infrastructure, end user, ...). This is bad approach, relevant informations should be concentrated. I believe, that simple radio buttons might be (simply) integrated into existing portal, this should be _really_ faster and cheaper. And in addition, all informations remains on single place. If RIPE NCC will develop new extra application for each policy (instead of reusing and enhancing existing code), it will really waste our money. And will be hard to work with informations disposed to many places. With regards, Daniel On 09/04/2009 03:41 PM, Sander Steffann wrote:
Hello Daniel,
Unfortunately, we could not integrate completely with the LIR Portal in the timeframe given to implement policy 2007-01. We decided not to make further developments to the legacy code base of the current LIR Portal because we already had plans to entirely rebuild the LIR Portal. You HAD enough time. First version of policy is more than two years old.
The first moment the NCC can start implementing a policy is when consensus has been declared on the policy proposal. Before that point in time the policy can be discarded or changed. Implementing a policy proposal that might not even become policy would really be a waste of effort and money...
- Sander

Hi Daniel, as we have hundreds of PI and ASNs, we have some experience with that, and this question is very important for us too. In ancient times RIPE DB had no org: in aut-num. So link ASN with a company is not established. I also know a lot of cases when someone use not their ASN with their inetnum, and vice version. So if someone announce his network with some ASN (you can see it in RIS, sure) - it NOT means it is THEIR ASN. Only the way to know it - ask them and ask the contract or some other legal notification. Daniel Suchy wrote:
Ok, I would like to open public discussions about this problem. There are some questions to answer and discuss: * why RIPE NCC just doesn't use informations from RIPE database in case of their availability and verifiability, why abuses small LIRs instead * why aren't RIS data used for automatic obtaining of requested informations, where this can be applicable * why RIPE NCC didn't integrate "confirmation" tool to existing LIR portal and why new outside application with _limited_ functionality was developed instead of reusing of existing code and functionality * what architecture is used for LIR portal in general, can be there easily implemented new features
-- WBR, Max Tulyev (MT6561-RIPE, 2:463/253@FIDO)

Hi Max, of course I understand this. But this is not case of small (and recent) LIRs. I have no problem with filling of missing informations, but this my discussion is about informations already contained in RIPE database. One of attributes is last update information. RIPE NCC staff can work with this - but probably they ignore this information. Daniel On 09/03/2009 07:54 PM, Max Tulyev wrote:
Hi Daniel,
as we have hundreds of PI and ASNs, we have some experience with that, and this question is very important for us too.
In ancient times RIPE DB had no org: in aut-num. So link ASN with a company is not established. I also know a lot of cases when someone use not their ASN with their inetnum, and vice version. So if someone announce his network with some ASN (you can see it in RIS, sure) - it NOT means it is THEIR ASN. Only the way to know it - ask them and ask the contract or some other legal notification.

Hi, On Fri, Sep 04, 2009 at 01:23:23AM +0200, Daniel Suchy wrote:
of course I understand this. But this is not case of small (and recent) LIRs. I have no problem with filling of missing informations, but this my discussion is about informations already contained in RIPE database.
The key point is that "this information is *not* in the RIPE DB" for a large number of end user resources. Take our own AS, for example. It lists our company name, sure, but it was requested 10 years ago via another LIR, as we have not been a LIR ourselves then. So it's quite important to check with that other LIR to make sure who is taking responsibility for it (they won't, we will) and make sure that the database information really is accurate. For many younger LIRs, the data might be perfectly accurate, but it's much less effort for everybody if the RIPE NCC just gives every LIR the opportunity to say "this is ours, this is not ours" first (which takes 10 minute per LIR) - and *then* the real work for the NCC starts, finding out what to do about all the resources that are tagged as "not ours". I think it would be a waste of our money if the NCC would hire 20 extra staff members to sort out through all these details for 5000 LIRs if it can be done with a 10-minute effort at every individual LIR. Gert Doering -- NetMaster -- Total number of prefixes smaller than registry allocations: 128645 SpaceNet AG Vorstand: Sebastian v. Bomhard Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (89) 32356-444 USt-IdNr.: DE813185279

On 09/04/2009 09:08 AM, Gert Doering wrote:
For many younger LIRs, the data might be perfectly accurate, but it's much less effort for everybody if the RIPE NCC just gives every LIR the opportunity to say "this is ours, this is not ours" first (which takes 10 minute per LIR) - and *then* the real work for the NCC starts, finding out what to do about all the resources that are tagged as "not ours".
I think it would be a waste of our money if the NCC would hire 20 extra staff members to sort out through all these details for 5000 LIRs if it can be done with a 10-minute effort at every individual LIR.
But RIPE NCC is wasting our money already and nobody really cares. For simple web form, with one submit button and few radio buttons they developed totally NEW application residing outside of everything else. This also costs money, of course. And there only somebody at RIPE NCC decided to develop this new tool instead of much easier and more cost effective implementation of new form into existing portal. If we're talking about money, there should be published detailed development plans for LIR portal and such tools. We should know, where our money are spent. In activity plan (RIPE-439,426), there's no statement about upgrade plans for LIR portal like total code rewrite mentioned by Andrea Cima from RIPE yesterday. I can imagine many new feature requests, for example ability to view details of own tickets (not only headers) on portal. There should be wide analysis BEFORE real development starts. RIPE NCC spams about every insignificant event, but I don't remember any global email from RIPE NCC asking members for some feature requests for this very important tool. The process is wrong in general... RIPE NCC has around 100 full-time employees already. It's not a little number, 55% of RIPE NCC incomes are spent in these people. We should know, what are these people really doing, if anybody mentions things like "we need more people for something". This is not a little number of employees.

On 4 Sep 2009, at 09:59, Daniel Suchy wrote:
But RIPE NCC is wasting our money already and nobody really cares.
I'm not sure either of these things is true. You're complaining about the costs of this new functionality (both to the LIR and at the NCC). And there have been a few postings on the thread you started. So at least someone cares. :-) It does appear that the revamped LIR portal missed features that would have make life better for the members. Which is a pity. But IMO it's a bit of a jump to go from that to saying the work on the new portal is a waste of money. Yes, some things could and should have been done differently. Some NCC resources will not have been utilised perfectly. So the focus should now be on how to do better next time.
If we're talking about money, there should be published detailed development plans for LIR portal and such tools. We should know, where our money are spent.
Of course members are entitled to decide how their money is spent and know how that money is spent. However there are limitations. It's utterly impractical for the membership to micro-manage every aspect of the NCC's activities. Which presupposes the membership has the time and interest to do that. Imagine if the membership had to debate how much the NCC pays for a plane ticket or who supplies its paperclips or which model and configuration of routers it should buy. Can you imagine how difficult it would be for the membership to reach consensus on these things at that level of detail? If you accept the principle that decisions about implementation matters have to be delegated, the question becomes one of deciding where these delegation points are and what happens at them. There is a reasonably clear chain of authority/control here. The membership decides the NCC's overall strategy by voting on the annual activity plan and charging scheme (which of course determines the overall budget). They also elect the NCC board. The board delegate the actual running of the NCC to the management, particularly the CEO, and direct them to carry out the tasks in the activity plan. The board does not get directly involved in operational matters. The NCC's executive uses its expertise to manage the organisation's resources to deliver the services that the membership have asked for. The output from this WG helps shape the activity plan.
In activity plan (RIPE-439,426), there's no statement about upgrade plans for LIR portal like total code rewrite mentioned by Andrea Cima from RIPE yesterday.
IMO the information in 1.4.2 of the current activity plan covers the operation of the LIR portal in appropriate level of detail. This says what the LIR portal does and what its goals are. Within reason, it shouldn't matter to the membership how the NCC actually implements that portal. Of course if someone does have questions about those internal details, they can ask and will get answers. For instance if someone wants to know precisely how much the NCC has spent revamping the LIR portal, a question to the CEO, CFO or a board member is all it takes. Note that membership decisions about the activity plan have practical considerations too. In theory I suppose the activity plan could detail every line item of the budget for the coming year. And the membership could vote on each of these at the AGM. But would it work in practice? Would LIRs have the time or inclination to go through something that detailed? And would that be an efficient or effective way to manage the NCC? Can you imagine the number and extent of the rat-holes that such an approach would open up?
There should be wide analysis BEFORE real development starts. .... I don't remember any global email from RIPE NCC asking members for some feature requests for this very important tool.
I agree wholeheartedly. Perhaps this WG could suggest some processes which would allow more discussion and review on requirements? Note that there's also difficult balance to be struck here. As a predominantly technical group, LIRs will tend to focus on the minutae of implementation detail: buy $VENDOR's $MODEL hardware, use such and such a version of MySQL/PHP/Linux/whatever, etc, etc. It's all too easy to be side-tracked into these rat-holes. When that happens, no progress gets made and reaching consensus becomes harder. Which would leave the NCC in limbo if it needs to get membership approval/ consensus for (say) a reskin of the LIR portal. That said, I believe it's not beyond the capabilities of this WG to develop suitable processes to work with NCC staff to produce requirements, minitor progress, review deliberables and so on. Though I'm sceptical if this list's membership or the NCC membership more generally has the time and inclination to take on that task. Hopefully your postings and this discussion will encourage others to prove me wrong.
The process is wrong in general...
Well I think you might be over-stating things. Is there a problem here? It looks like there is. Communication could be better. Perhaps this WG should be more involved in scoping and reviewing requirements for the services provided by the NCC. But a mechanism for that hasn't been produced. Yet. IMO that doesn't mean things are generally broken. Or that there isn't room for improvement. RIPE and the NCC are open and transparent. If policies or processes need to be tweaked or changed, there are mechanisms to do that. IMO it's up to people like you to come forward with constructive proposals for making things better.
RIPE NCC has around 100 full-time employees already. It's not a little number, 55% of RIPE NCC incomes are spent in these people. We should know, what are these people really doing, if anybody mentions things like "we need more people for something". This is not a little number of employees.
True. I fully agree that it's right and proper for the NCC membership to ask questions about staffing and budgets. It's probably not appropriate for the membership to dabble in operational detail: eg what a particular employee is paid or how they spend their time. I'd also point out that the NCC head count has hovered around 100 FTEs for a while now. If anything it's come down from ~110-120 a few years ago IIRC. Broadly speaking the membership is content with the NCC's services and fees: though I accept there may well be grudging acceptance in some quarters. [There are a few services I'm convinced the NCC should not be doing but the membership disagrees. Oh well.] However if there was a significant concern about the fees and services, this would presumably be reflected in the votes at the AGM. That doesn't mean to say that the NCC's staff costs and budgets don't have to be monitored and reviewed regularly. After all that's one of the responsibilities of being an NCC member. At a macro level, the membership elect a board to carry out some of that scrutiny. Even so the RIPE NCC is membership organisation, so it's ultimately up to the LIRs to decide what the NCC does and how it should be done.

On 09/04/2009 02:06 PM, Jim Reid wrote:
Of course members are entitled to decide how their money is spent and know how that money is spent.
However there are limitations. It's utterly impractical for the membership to micro-manage every aspect of the NCC's activities. Which presupposes the membership has the time and interest to do that. Imagine if the membership had to debate how much the NCC pays for a plane ticket or who supplies its paperclips or which model and configuration of routers it should buy. Can you imagine how difficult it would be for the membership to reach consensus on these things at that level of detail? If you accept the principle that decisions about implementation matters have to be delegated, the question becomes one of deciding where these delegation points are and what happens at them.
Of course, nobody will do micro-management of every detail. But on important tools - and LIR portal is important tool, there should be some interaction between RIPE NCC and members about changes, implementation of new features and member requirements. There are methods for feedback - like surveys. If RIPE NCC can "spam" us with just informative 3rd party surveys about IPv6 deployment, why cannot similar survey just run in relation to LIR portal, where they collects some inputs from members. I cannot recall such survey in past two years. LIR portal is tool for us, members, and there must be this interaction. RIPE NCC has to ask us, what we really need...
There is a reasonably clear chain of authority/control here. The membership decides the NCC's overall strategy by voting on the annual activity plan and charging scheme (which of course determines the overall budget). They also elect the NCC board. The board delegate the actual running of the NCC to the management, particularly the CEO, and direct them to carry out the tasks in the activity plan. The board does not get directly involved in operational matters. The NCC's executive uses its expertise to manage the organisation's resources to deliver the services that the membership have asked for. The output from this WG helps shape the activity plan.
But this doesn't mean, that the only activity of member is voting on general/wg meetings among few-page general documents. These materials are obviously targeted to (top) managers. Members should have detailed informations easily available, if they're interested. It's about transparency of operation, nothing else.
IMO the information in 1.4.2 of the current activity plan covers the operation of the LIR portal in appropriate level of detail. This says what the LIR portal does and what its goals are. Within reason, it shouldn't matter to the membership how the NCC actually implements that portal. Of course if someone does have questions about those internal details, they can ask and will get answers. For instance if someone wants to know precisely how much the NCC has spent revamping the LIR portal, a question to the CEO, CFO or a board member is all it takes.
Informations like "LIR portal need complete rewrite, because..." are important and should be stated in activity plans, if they're know. Just because complete rewrite will cost money. This is important information. Section 1.4.2 describes existence of interaction method, not really development plans and budget required for improving, these plan are in section 3 instead. We really don't know, how much money we spent in LIR portal development, for example. We even don't know, how much we spent in new software development in general, how we distribute available ressources.
Note that membership decisions about the activity plan have practical considerations too. In theory I suppose the activity plan could detail every line item of the budget for the coming year. And the membership could vote on each of these at the AGM. But would it work in practice? Would LIRs have the time or inclination to go through something that detailed? And would that be an efficient or effective way to manage the NCC? Can you imagine the number and extent of the rat-holes that such an approach would open up?
But significant development expenses should be covered and stated. We should know, how much we spent for DB, portal, RIS and another development. This helps in arranging of development priorities, focus to things mostly requested by members (surveys mentioned above). Another source of informations are usage statistics. It's better spend money in tools widely used instead of developing tool for 2-3 people.
I agree wholeheartedly. Perhaps this WG could suggest some processes which would allow more discussion and review on requirements?
Again - we can start with general member surveys. I thing, that not so much members watch activities in WGs, but they can give valuable feedback. If there are plans for development of new features (or review existing), we can simply ask members, if they're seeing particular feature helpful. Who's interested, will ansver here.
Note that there's also difficult balance to be struck here. As a predominantly technical group, LIRs will tend to focus on the minutae of implementation detail: buy $VENDOR's $MODEL hardware, use such and such a version of MySQL/PHP/Linux/whatever, etc, etc. It's all too easy to be side-tracked into these rat-holes. When that happens, no progress gets made and reaching consensus becomes harder. Which would leave the NCC in limbo if it needs to get membership approval/consensus for (say) a reskin of the LIR portal.
Of course, these are topic we should NOT discuss, there's no reason for these discussions. I personally really don't care about $VENDOR etc. Maybe this would be interesting information, but nothing else. I just would like to have properly working tools needed for my work.
RIPE and the NCC are open and transparent. If policies or processes need to be tweaked or changed, there are mechanisms to do that. IMO it's up to people like you to come forward with constructive proposals for making things better.
I'm not sure about NCC transparency. Many internal informations aren't implicitly accessible. Maybe they're available on request. But, why I cannot just login somewhere and download them, if I'm (or someone else) interested? This will be really transparent. And I thing uploading document to some store isn't really hard work. In result, this saves time and money, probably these documents are stored somewhere already (if I'll request something by email, someone from NCC will process it, search for requested document and this takes much more time/money). Of course, I'm talking about documents with no sensitive personal data. We're talking about documents covering new development plans and so on.
Broadly speaking the membership is content with the NCC's services and fees: though I accept there may well be grudging acceptance in some quarters. [There are a few services I'm convinced the NCC should not be doing but the membership disagrees. Oh well.] However if there was a significant concern about the fees and services, this would presumably be reflected in the votes at the AGM.
Voting on AGM its locked to be on-site at this time, this requires traveling (mainly) around the Europe, this is a big barrier. According to Axel Pawlik presentation on last AGM, there never voted more than 5% of members on-site. This isn't really representative. For comparison, in online membership survey 2008 we had ansvers from around 11% of members - this is still not very high number, but is better... This is another argument for better interaction with members over electronic surveys, for example. This will provide much better and more representative results/feedback compared to NCC meetings. Daniel

At 09:43 05/09/2009 +0200, Daniel Suchy wrote:
Voting on AGM its locked to be on-site at this time, this requires traveling (mainly) around the Europe, this is a big barrier. According to Axel Pawlik presentation on last AGM, there never voted more than 5% of members on-site. This isn't really representative. For comparison, in online membership survey 2008 we had ansvers from around 11% of members - this is still not very high number, but is better...
This is another argument for better interaction with members over electronic surveys, for example. This will provide much better and more representative results/feedback compared to NCC meetings.
Daniel
I raised this in June in members-discuss:
To change voting: http://www.ripe.net/ripe/docs/articles-association.html#seventeen we have to go via: http://www.ripe.net/ripe/docs/articles-association.html#twenty and will require 2/3 of those voting to be in favor of the change!
In July Axel posted on this list:
The Executive Board concluded that in order to widen participation in elections, it will propose to allow voting by postal ballot for Executive Board elections. This addition to the voting process will not require a major effort or a major investment from the RIPE NCC.
and on members-discuss in July I posted in response to Nigel Titley's comments:
In all seriousness though. If you wish to open a discussion on the election process, then this is the list to do it on. Note that the current board has taken the step of encouraging the NCC to make announcements on this list rather than just making them at general meetings. This is in order to encourage open debate. I'm pleased to see that this is having some effect. ...
The result is that i have not voted until now, because i don't know anybody and the cost to go to the GM meeting is too high... The proxy voting system allows you to vote remotely, but of course if you don't know us then, as you say, a vote is pointless.
How about the matter of electronic voting that I had raised previously? Why can't that be implemented?
-Hank
and so died the entire discussion thread of online voting. No one from RIPE NCC responded why electronic voting can't be implemented. Draw your own conclusions. -Hank

Hank, all,
and so died the entire discussion thread of online voting. No one from RIPE NCC responded why electronic voting can't be implemented.
It's not that it cannot be implemented. I said at the GM and later, that I'd prefer not to invest the ressources at this time to implement a perfect e-voting system, rather focussing on IPv4 run-out and 2007-01 implementation support. Hence the idea to use postal ballots. However, during last week's board meeting, we discussed the topic again. We acknowledge that there is a strong interest from members to implement electronic voting through the LIR portal. I'm changing priorities to have a system ready for the General Meeting in May 2010. Currently we are finishing the supporting documents for the next General Meeting, to be posted this week, this will include a modification to the Articles of Association to allow for a streamlined voting process including for e-voting. Hope this helps, Axel

At 11:16 06/09/2009 +0200, Axel Pawlik wrote:
Hank, all,
and so died the entire discussion thread of online voting. No one from RIPE NCC responded why electronic voting can't be implemented.
It's not that it cannot be implemented. I said at the GM and later, that I'd prefer not to invest the ressources at this time to implement a perfect e-voting system, rather focussing on IPv4 run-out and 2007-01 implementation support. Hence the idea to use postal ballots.
However, during last week's board meeting, we discussed the topic again. We acknowledge that there is a strong interest from members to implement electronic voting through the LIR portal. I'm changing priorities to have a system ready for the General Meeting in May 2010.
Currently we are finishing the supporting documents for the next General Meeting, to be posted this week, this will include a modification to the Articles of Association to allow for a streamlined voting process including for e-voting.
E-normously! -Hank
Hope this helps,
Axel

At 11:16 06/09/2009 +0200, Axel Pawlik wrote:
Hank, all,
and so died the entire discussion thread of online voting. No one from RIPE NCC responded why electronic voting can't be implemented.
It's not that it cannot be implemented. I said at the GM and later, that I'd prefer not to invest the ressources at this time to implement a perfect e-voting system, rather focussing on IPv4 run-out and 2007-01 implementation support. Hence the idea to use postal ballots.
However, during last week's board meeting, we discussed the topic again. We acknowledge that there is a strong interest from members to implement electronic voting through the LIR portal. I'm changing priorities to have a system ready for the General Meeting in May 2010.
Currently we are finishing the supporting documents for the next General Meeting, to be posted this week, this will include a modification to the Articles of Association to allow for a streamlined voting process including for e-voting.
Been a year, but here I go again, beating at this dead horse. The meeting next month allows proxy voting as detailed by Axel's email from yesterday:
Proxy Voting ------------- If your organisation is to be represented by a third party, not being an authorised employee or director, please fill out the proxy form and send it to us by 3 November 2010. Any proxy sent to us after this date will not be valid. The proxy form is available to download here: http://www.ripe.net/membership/gm/gm-november2010/proxy.html
If you go thru the effort of doing the proxy "thing", you will find that one cannot submit a scanned proxy form by email, rather one has to use a fax machine or postal mail. In this day and age, this just strikes me as ridiculous. But now back to e-voting. In the Articles: http://www.ripe.net/ripe/docs/articles-association.html section 17.1: 17.1 In addition to the possibility of the members to physically attend the meeting, the Executive Board may decide to open the possibility for the Members to attend the General Meeting through electronic means at a remote location and to vote through electronic means from a remote location. In addition the Executive Board may decide to open the possibility for the Members to electronically participate in deliberation at the General Meeting. The Executive Board shall regulate the (technical) procedure and the requirements for electronic attendance, voting and/or deliberation. The right to vote through electronic means shall only apply to Executive Board member elections. 1) Electronic voting for just executive board members is ridiculous as well. The more pressing issues are with charging schemes and other issues. Glad to see that this will be slightly changed as follows: http://www.ripe.net/membership/gm/gm-november2010/documents/changes-articles... But it is limited to what the Executive Board decides should be voted upon. I think whatever is voted upon in person should be allowed to be voted upon electronically w/o the EB having to get involved. 2) Last time electronic voting was used, one *had* to vote within a 15 minute window of opportunity. If you missed it, then you couldn't vote. I own or have owned numerous stocks and they allow electronic voting not just for the BoD but for many other issues as well. And one can vote for a few weeks before the general membership meeting. Only an organization that really doesn't want electronic voting would implement a 15 minute window to vote. As of today, we have 32 voting members attending out of how many LIRs - 5000? Does that make for democracy? I highly doubt it. Regards, -Hank
Hope this helps,
Axel

I own or have owned numerous stocks and they allow electronic voting not just for the BoD but for many other issues as well. And one can vote for a few weeks before the general membership meeting. Only an organization that really doesn't want electronic voting would implement a 15 minute window to vote. I suspect that none of the companies in which you owned stocks were a Dutch Membership Association. It is for that reason that we have this ludicrous situation, which, I assure you, none of the Board are happy with either. We have taken legal advice on the matter and have been told
Hank, On 28/10/2010 08:11, Hank Nussbacher wrote: ..snip.. that the system we've come up with is the only one we can legally use. Some background is probably helpful here. The concept of a Dutch membership association has its roots in the "water boards" or "/hoogheemraadschappen"/ set up to govern the "polders", the areas of reclaimed land, below sea level, for which the Netherlands is so well known. Government of these bodies was considered such an important matter (if you get things wrong, the sea comes in) that only those actually present at the meetings had the right to vote. The voting procedures for associations (and water boards) have retained this requirement down to the present day. A rather nice little explanation of the origin of the water boards, from which the Dutch associations draw their rules can be found at http://en.wikipedia.org/wiki/Water_board_%28Netherlands%29 Note that the water boards originally had the right to impose the death sentence for such offences as damaging dykes and drainage ditches. I sometimes wish that we had retained that right for suitable crimes against the internet.... but that is slightly off topic. We've managed to get agreement to change the rules to allow electronic voting but only on condition that we: 1. Webcast the General Meetings 2. Allow instantaneous voting within a defined timeslot The RIPE NCC was set up as an association for the tax benefits (we basically pay no tax at all). If the majority of the members want to change the constitution (basically winding up the RIPE NCC and reforming it as a regular limited liability company) and gain the ability to vote in advance of the GM for the payment of a higher membership fee then please let us know.
As of today, we have 32 voting members attending out of how many LIRs - 5000? Does that make for democracy? I highly doubt it.
Absolutely agree. It is a source of continued pain to the board that representation of the membership is so poor at the GM (approximately 3% including proxies and remote voting). It's difficult to see what else we can do though, given the legal constraints under which we operate. Best regards Nigel Titley Chaiman, RIPE NCC Board

Nigel, good background, now I know where water-boarding comes from ;) On 28 Oct 2010, at 11:39, Nigel Titley wrote:
The RIPE NCC was set up as an association for the tax benefits (we basically pay no tax at all). If the majority of the members want to change the constitution (basically winding up the RIPE NCC and reforming it as a regular limited liability company) and gain the ability to vote in advance of the GM for the payment of a higher membership fee then please let us know.
that is kind of a broad link that may or not have reason to be. Companies pay taxes on profits. In the absence of profit no tax is due (VAT is passed through, right?). So one could even argue that an LLC-type RIPE NCC would be cheaper as it would be a burden to accumulate huge reserves (which is where the current form seems to have most of its benefits) and so lower fees would be in order. Perhaps a more detailed analysis would be worth the time spent on it? Cost/benefit analysis? Joao

Joao Certainly worth looking at the cost/benefits of ditching the association status. There are other reasons for the association vehicle of course but it might be worth doing a review. Some of the original constraints no longer apply (Terena was still uncertain that this internet thingie would catch on, which is at the back of some of the more obscure bits in the Articles, including the clearing house funds). As I say, if the members want it, the board is there to ascertain and execute your wishes. All the best Nigel ________________________________________ From: ncc-services-wg-admin@ripe.net [ncc-services-wg-admin@ripe.net] on behalf of João Damas [joao@bondis.org] Sent: 28 October 2010 11:17 To: Nigel Titley Cc: ncc-services-wg@ripe.net Subject: Re: [ncc-services-wg] voting on AGM Nigel, good background, now I know where water-boarding comes from ;) On 28 Oct 2010, at 11:39, Nigel Titley wrote:
The RIPE NCC was set up as an association for the tax benefits (we basically pay no tax at all). If the majority of the members want to change the constitution (basically winding up the RIPE NCC and reforming it as a regular limited liability company) and gain the ability to vote in advance of the GM for the payment of a higher membership fee then please let us know.
that is kind of a broad link that may or not have reason to be. Companies pay taxes on profits. In the absence of profit no tax is due (VAT is passed through, right?). So one could even argue that an LLC-type RIPE NCC would be cheaper as it would be a burden to accumulate huge reserves (which is where the current form seems to have most of its benefits) and so lower fees would be in order. Perhaps a more detailed analysis would be worth the time spent on it? Cost/benefit analysis? Joao

On 28 Oct 2010, at 12:41, Nigel Titley wrote:
Joao
Certainly worth looking at the cost/benefits of ditching the association status. There are other reasons for the association vehicle of course but it might be worth doing a review.
A review would bring better foundations for discussions. It may also help push the current association model farther by illuminating on what is being missed, but comparing with other ways of doing things. I just don't like the sort of Jedi-like hand wave you seemed to be using here.
Some of the original constraints no longer apply (Terena was still uncertain that this internet thingie would catch on, which is at the back of some of the more obscure bits in the Articles, including the clearing house funds).
Yep. Note that having a reserve is something any sane company should be doing in any case, so don't go overboard. Joao

On 28 Oct 2010, at 11:17, João Damas wrote:
that is kind of a broad link that may or not have reason to be. Companies pay taxes on profits. In the absence of profit no tax is due (VAT is passed through, right?). So one could even argue that an LLC-type RIPE NCC would be cheaper as it would be a burden to accumulate huge reserves (which is where the current form seems to have most of its benefits) and so lower fees would be in order.
Well Joao, the first problem with this scheme is the NCC would presumably first have to raise its fees in order to build up huge reserves which would enable it to fund lower fees. Though if the NCC was making healthy profits, I'm sure the organisation and/or membership will find a way to spend these on special projects and get back to break-even. Call it the financial variation on Parkinson's law. The next problem is if the NCC was to demutualise it may well have unpleasant consequences. Like speculators buying up shares to take a controlling interest in the company or to swipe the cash reserves as a special dividend. There are obvious parallels with what happened to UK financial organisations that demutualised in the 1980s and 1990s. Carpet-baggers swooped in, raided the reserves and cashed out. Another issue is this LLC scheme probably needs a public limited company because its shares would have to be openly traded so anyone can become a shareholder rather than a member as at present. That makes the organisation open to capture. It would also have to act in the best interests of its shareholders. Which might not be the same as the best interests of the current membership or the broader Internet: "we can save tons of costs and get bigger dividends by no longer funding that pesky root server". Public companies have higher burdens for financial reporting and audits too. Even if the NCC was to become an LLC, I doubt it would make much difference to fees in the long run. Assuming the membership/ shareholders remained stable and the organisation continued along its current path, it's unlikely we'd see much change from the existing financial regime or a broadly break-even annual budget and one year's cash as reserves. Still, it would be interesting for someone to do a proper cost/benefit analysis. It wouldn't hurt to question or review establishes wisdom every now and then.

I would rather wait to see what the NCC might report back on this. Joao On 28 Oct 2010, at 12:55, Jim Reid wrote:
On 28 Oct 2010, at 11:17, João Damas wrote:
that is kind of a broad link that may or not have reason to be. Companies pay taxes on profits. In the absence of profit no tax is due (VAT is passed through, right?). So one could even argue that an LLC-type RIPE NCC would be cheaper as it would be a burden to accumulate huge reserves (which is where the current form seems to have most of its benefits) and so lower fees would be in order.
Well Joao, the first problem with this scheme is the NCC would presumably first have to raise its fees in order to build up huge reserves which would enable it to fund lower fees. Though if the NCC was making healthy profits, I'm sure the organisation and/or membership will find a way to spend these on special projects and get back to break-even. Call it the financial variation on Parkinson's law.
The next problem is if the NCC was to demutualise it may well have unpleasant consequences. Like speculators buying up shares to take a controlling interest in the company or to swipe the cash reserves as a special dividend. There are obvious parallels with what happened to UK financial organisations that demutualised in the 1980s and 1990s. Carpet-baggers swooped in, raided the reserves and cashed out.
Another issue is this LLC scheme probably needs a public limited company because its shares would have to be openly traded so anyone can become a shareholder rather than a member as at present. That makes the organisation open to capture. It would also have to act in the best interests of its shareholders. Which might not be the same as the best interests of the current membership or the broader Internet: "we can save tons of costs and get bigger dividends by no longer funding that pesky root server". Public companies have higher burdens for financial reporting and audits too.
Even if the NCC was to become an LLC, I doubt it would make much difference to fees in the long run. Assuming the membership/shareholders remained stable and the organisation continued along its current path, it's unlikely we'd see much change from the existing financial regime or a broadly break-even annual budget and one year's cash as reserves.
Still, it would be interesting for someone to do a proper cost/benefit analysis. It wouldn't hurt to question or review establishes wisdom every now and then.

Hank, all,
Been a year, but here I go again, beating at this dead horse.
it's still breathing... :-)
If you go thru the effort of doing the proxy "thing", you will find that one cannot submit a scanned proxy form by email, rather one has to use a fax machine or postal mail. In this day and age, this just strikes me as ridiculous.
And it is. Thanks for pointing that out. We're changing this and are about to send out an update.
But now back to e-voting. In the Articles: http://www.ripe.net/ripe/docs/articles-association.html section 17.1: 17.1 In addition to the possibility of the members to physically attend the meeting, the Executive Board may decide to open the possibility for the Members to attend the General Meeting through electronic means at a remote location and to vote through electronic means from a remote location. In addition the Executive Board may decide to open the possibility for the Members to electronically participate in deliberation at the General Meeting. The Executive Board shall regulate the (technical) procedure and the requirements for electronic attendance, voting and/or deliberation. The right to vote through electronic means shall only apply to Executive Board member elections.
1) Electronic voting for just executive board members is ridiculous as well. The more pressing issues are with charging schemes and other issues. Glad to see that this will be slightly changed as follows: http://www.ripe.net/membership/gm/gm-november2010/documents/changes-articles...
Indeed. We introduced e-voting primarily in response to members' comments about the rather arcane election procedure at the time. We've done it now once, and were satisfied that it seemed to work quite well. As you say, we are now preparing the article change that would enable e-voting on other topics as well, without further article change.
But it is limited to what the Executive Board decides should be voted upon. I think whatever is voted upon in person should be allowed to be voted upon electronically w/o the EB having to get involved.
Without trying to speak for the board, this would be the general intention. However, we would like to discuss how the procedures for this would impact the GM.
2) Last time electronic voting was used, one *had* to vote within a 15 minute window of opportunity. If you missed it, then you couldn't vote.
This is actually required by local law, which requires attendees / voters to be able to fully follow the meeting and discussions.
As of today, we have 32 voting members attending out of how many LIRs - 5000?
We have more than 7000 members this year. At the last GM, more than 200 votes where cast. Since we hold GMs during the RIPE Meeting week, attendance has gone up significantly. But yes, participation could be much better. Does that make for democracy? I highly doubt it. Sure it does. All members have the opportunity to vote, if they so wish. Is the current participation as high as we would want it to be? Clearly not. Looking forward to the next GM, eager to see the trend continuing and attendance improving. cheers, Axel

At 11:45 28/10/2010 +0200, Axel Pawlik wrote:
2) Last time electronic voting was used, one *had* to vote within a 15 minute window of opportunity. If you missed it, then you couldn't vote.
This is actually required by local law, which requires attendees / voters to be able to fully follow the meeting and discussions.
Thanks for the quick reply. The one item that still rankles me is the one above. Does this mean that any company listed on AEX and has a shareholders meeting - everyone has to be online at the time to vote? I suggest this issue be rechecked. Can anyone familiar with AMS-IX comment on their news item: http://www.ams-ix.net/ ------------------------- 14 October 2010, e-voting is back at AMS-IX In 2005, when the Dutch law allowed electronic voting officially, AMS-IX was quick to adopt an e-voting process. Any useful Internet based application, of course, is encouraged by AMS-IX. We checked with our lawyers at the time, who confirmed we could e-vote since we allowed any other means of voting, as it was now officially allowed and as Dutch law is quite pragmatic. Together with a company called Netvote, who at that time were the only ones with a ready notary approved electronic voting platform, we set up an AMS-IX dedicated environment. We used it satisfactory until end of last year. ------------------------- They too require you to be online at the time? Regards, Hank

On 28/10/2010 11:41, Hank Nussbacher wrote:
At 11:45 28/10/2010 +0200, Axel Pawlik wrote:
2) Last time electronic voting was used, one *had* to vote within a 15 minute window of opportunity. If you missed it, then you couldn't vote.
This is actually required by local law, which requires attendees / voters to be able to fully follow the meeting and discussions.
Thanks for the quick reply. The one item that still rankles me is the one above. Does this mean that any company listed on AEX and has a shareholders meeting - everyone has to be online at the time to vote? I suggest this issue be rechecked. I've asked Axel to do this
Nigel

On 6 Sep 2009, at 06:43, Hank Nussbacher wrote:
How about the matter of electronic voting that I had raised previously? Why can't that be implemented?
and so died the entire discussion thread of online voting. No one from RIPE NCC responded why electronic voting can't be implemented.
Hank, introducing electronic voting means changing the NCC's Articles of Association. As yet, nobody's come forward with firm proposals to do either of these things. Which is not surprising given that discussions haven't been under way for long and consensus has still to be reached. That's the short answer. For more detail, read on... There is a general acceptance that something has to be done to encourage and/or to make it easier for more members to vote. [Moving the AGM and GM alongside the RIPE meetings has helped a little. IIUC more people attend than when the GMs were standalone events.] The board has asked the CEO to look into electronic voting and progress has been made. Axel presented some options at the last AGM. There was even a discussion about voting reform at the 2009 AGM in May. See http://www.ripe.net/membership/gm/gm-may2009/minutes.html. Sadly, that discussion was inconclusive and no consensus emerged from the meeting about the way forward. The NCC Chairman asked the CEO to analyse the proposed schemes so that the membership can decide on adopting one (or not) before the AGM next year. So that presumably means there will be further discussion at the GM in Lisbon next month. I expect that if/when a consensus emerges an EGM will need to be called so that any new system could be in place before the 2010 AGM. BTW, it's a little unfair to blame NCC staff for not responding to your original question. They are expected to remain neutral on constitutional matters like this and not allow their personal opinions to influence the membership. If you are/were unhappy at the lack of reply to your earlier email -- I don't remember seeing it and would have responded if I did -- you should have contacted the board and/or CEO.

Jim Reid wrote: [...]
Hank, introducing electronic voting means changing the NCC's Articles of Association.
That's sort of easy, and quite well-understood, how to accomplish this. But...
As yet, nobody's come forward with firm proposals to do either of these things. Which is not surprising given that discussions haven't been under way for long and consensus has still to be reached. That's the short answer. For more detail, read on...
My feeling is that everyone who has already tried to get the fingers wet with eVoting, and in particular across national boundaries, still suffers from some substantial bruises ;-) I, definitely, do, and the size of the electorate(sp?) was very small, as compared to the membership of the NCC. We should keep in mind that voting by membership of an organisation like the NCC (size, money, importance, visibility,...) is not just like playing a game of Solitaire - it has substantial legal importance and business value. IMHO, whatever we may agree to use, eventually, has to be "bullet-proof", both operationally and legally. That's going to be an interesting (and "not so cheap") exercise, because it has to survive public scrutiny and challenges! Nevertheless, I think it would be a Good Thing[TM] to have it available, at some point in time. Wilfried.

On 5 Sep 2009, at 08:43, Daniel Suchy wrote:
Of course, nobody will do micro-management of every detail. But on important tools - and LIR portal is important tool, there should be some interaction between RIPE NCC and members about changes, implementation of new features and member requirements.
Well I look forward to you making suggestions on how this can be done. As I said before, there should be a role for this WG in developing/ discussing requirements, reviewing progress and so on.
But this doesn't mean, that the only activity of member is voting on general/wg meetings among few-page general documents. These materials are obviously targeted to (top) managers. Members should have detailed informations easily available, if they're interested. It's about transparency of operation, nothing else.
There's a balance here Daniel. Of course the NCC could publish everything. But I very much doubt this will actually help: who'd have the time or inclination to read all of that stuff? All of us have day jobs. :-) It would very probably lead to the sort of LIR micro- management by mailing list or organisational paralysis that we agree is undesirable. At the very least, I'd expect members to complain about money being wasted pumping out so much unwanted and unread detail. Broadly speaking the current level of detail is just about right IMO. If members generally wanted more information I'm sure they would have asked for that and more detail would be forthcoming. That doesn't mean more information can't be provided. And if there were regular or repeated requests for more detailed reports from the NCC, they would pretty soon be getting published as a matter of routine. Over to you and the rest of the membership.... So rather than go on here about how the NCC or this WG should/could do A or B, which is all very well in theory, how about turning that into practical suggestions or requests? For instance, you say you want members to have some input into requirements for the LIR portal. Fine. Please make some suggestions about how that discussion could be done. Better still, suggest a process for that so this WG has got something to consider instead of trying to deal with this in the abstract. We seem to be going round in circles here.
But significant development expenses should be covered and stated.
Perhaps. Assuming there's consensus on what's meant by significant. FWIW the NCC chairman said at the May AGM that adding e-voting to the LIR portal was estimated to cost €150K. Is that significant? It's around 1% of the annual turnover.
Again - we can start with general member surveys. I thing, that not so much members watch activities in WGs, but they can give valuable feedback. If there are plans for development of new features (or review existing), we can simply ask members, if they're seeing particular feature helpful. Who's interested, will ansver here.
I'm not sure member surveys are the answer here. Or that only the interested will respond. Still, it's worth trying... The sort of thing I had in mind was a simplified and lightweight version of the PDP. A proposal for a new project or service emerges somehow. A draft requirements document is produced. It gets discussed and refined on this list. When the Chairs of this WG declare consensus, the proposal goes forward the NCC to implementation after getting board approval.
Voting on AGM its locked to be on-site at this time, this requires traveling (mainly) around the Europe, this is a big barrier. According to Axel Pawlik presentation on last AGM, there never voted more than 5% of members on-site. This isn't really representative.
Indeed. This is a concern and something is being done about it. The intention is to have an e-voting system in place for the 2010 AGM. Provided the membership reaches consensus and approves a scheme.

Well I look forward to you making suggestions on how this can be done. As I said before, there should be a role for this WG in developing/discussing requirements, reviewing progress and so on. Well, I already mentioned online member surveys. This can be good method of interaction between members and RIPE NCC / this WG. If there are several things to develop and limited resourcess, we can ask members about their own priorities. We can ask members, which new functionality they would like to have on LIR portal in these surveys in addition. For example - i would like to have access to ticket details on LIR portal, it's one feature I miss.
There's a balance here Daniel. Of course the NCC could publish everything. But I very much doubt this will actually help: who'd have the time or inclination to read all of that stuff? All of us have day jobs. :-) It would very probably lead to the sort of LIR micro-management by mailing list or organisational paralysis that we agree is undesirable. At the very least, I'd expect members to complain about money being wasted pumping out so much unwanted and unread detail. You can give this option. Nobody will read ALL of this stuf. But if someone is interested in partucular document, he can just look. Complains about micromanagement are just phobia. I just think organisations like RIPE NCC should be to their members open and transparent. This means, that member can review, how particular public policy is implemented inside RIPE NCC processes. I believe, that if there's nothing wrong to hide, nobody will try to micromanage over lists.
Broadly speaking the current level of detail is just about right IMO. If members generally wanted more information I'm sure they would have asked for that and more detail would be forthcoming. That doesn't mean more information can't be provided. And if there were regular or repeated requests for more detailed reports from the NCC, they would pretty soon be getting published as a matter of routine. Over to you and the rest of the membership.... Recently I found, that general audit policy mentioned in RIPE-423 has some internal implementation document describing how to audit some LIR. There's no reason to hide documents like this. And this is only (real) example. How many other public RIPE policies have some internal "implementation" document, which is not public? Why should be documents like this hidden?
So rather than go on here about how the NCC or this WG should/could do A or B, which is all very well in theory, how about turning that into practical suggestions or requests? For instance, you say you want members to have some input into requirements for the LIR portal. Fine. Please make some suggestions about how that discussion could be done. Better still, suggest a process for that so this WG has got something to consider instead of trying to deal with this in the abstract. We seem to be going round in circles here. In general - survey is the first answer. Probably this should be done in two stages, in first we can ask members generally, what features they would like to have on portal. After evaluation, second survey we can ask members for priorities of frequently asked features, this step can be skipped in some cases (if sufficient resources are available). I have several sugestions about some enhancements. But I'm not sure, if just posting them here will tend to real implementation.
Perhaps. Assuming there's consensus on what's meant by significant. FWIW the NCC chairman said at the May AGM that adding e-voting to the LIR portal was estimated to cost €150K. Is that significant? It's around 1% of the annual turnover. It's not little amount of money. At least in accordance to fact, that many percent of turnover we spent in day-to-day operation, staff and so on. We have to look at this amount from the perspective of budget we have available for all new developments. Not only from perspective of whole turnover, where mandatory expenses are calculated.
I'm not sure member surveys are the answer here. Or that only the interested will respond. Still, it's worth trying... Yes, you're true here. But there's better some interaction rather than none. Same thing aplies to RIPE NCC meetings - only interested people attends. Mailing list in general is not realy usable for aggregation of requests. This mailing list I think many members doesn't watch at all. We have statistical comparison of live meetings and online surveys already.
The sort of thing I had in mind was a simplified and lightweight version of the PDP. A proposal for a new project or service emerges somehow. A draft requirements document is produced. It gets discussed and refined on this list. When the Chairs of this WG declare consensus, the proposal goes forward the NCC to implementation after getting board approval. Again - I think many LIRs aren't avare about importance of this list. And watching several mailing lists in parallel isn't easy. And isn't easy to orientate here. This can be barrier for many LIR actively participate on PDP. Well, but there're some general questions, which can be asked in general (not only in specific WG mailing list). This is another argument for general surveys.
Indeed. This is a concern and something is being done about it. The intention is to have an e-voting system in place for the 2010 AGM. Provided the membership reaches consensus and approves a scheme. I saw this, and I hope this will be approved :-)
Maybe some informational newsletter issued periodically (one per quarter, for example) going to general list shortly informing about active work on policies in each WG should be solution helping with better involvement of members. With regards, Daniel
participants (13)
-
Andrea Cima
-
Andy Davidson
-
Axel Pawlik
-
Daniel Suchy
-
Gert Doering
-
Hank Nussbacher
-
Jim Reid
-
João Damas
-
Max Tulyev
-
Nigel Titley
-
Nigel Titley
-
Sander Steffann
-
Wilfried Woeber, UniVie/ACOnet