ARIN 58 Public Policy and Members Meeting, Day 2 Transcript - Friday, 23 October 2026

Opening and Announcements

Ashley Perks: Good morning. Just a couple of minutes until we get started. We’re just coming up on 9:00. I’m sure people are still trickling in from breakfast and trickling in online. We’ll just give it a couple minutes.

Hope everybody had a good time at the social last night. I’m a little disappointed to not see everyone wearing their fedoras this morning. I really thought I’d see a bunch. I see zero. Oh, there’s one. I’ll take it, Kevin.

All right. It is 9:00, so I guess we’ll go ahead and get this show on the road. For long-time ARIN meeting attendees, if you’re wondering where Hollis Kara is, she is still here. She has not been replaced. You just get me this morning. But if you are really missing her, you will see her later this morning giving a presentation. I’m Ashley Perks. I’m the Communications Manager here at ARIN. And I guess we’re going to get this party started.

Let’s get it started with a big thank you to our volunteers, the ARIN Board of Trustees, the ARIN Advisory Council, and also the Number Resource Organization Number Council.

(Applause.)

I would be remiss if I didn’t also mention that it is our Board Chair Nancy Carter’s birthday today as well. So happy birthday, Nancy.

(Applause.)

Just a few – she’s 26, but doesn’t look a day over 21.

A few quick reminders, as we continue on.

Some tips that you can find handy to be able to participate in our event virtually for our virtual participants. Please remember that chat is an open discussion and it is monitored.

If you have a question or a comment for one of the presenters, please use the Q&A tab to submit that question, not directly in the chat. This way we know that you have a question. And don’t forget to put your name and affiliation.

If you need more time to ask your question, just use the raise-hand feature in Zoom and that way we know that you are coming.

If you are accessing the virtual Zoom in the room, please make sure that your device is muted and disconnected from audio, otherwise it’s just an infinity feedback loop, and nobody wants that.

If Zoom disconnects, please use the old turn-it-off-and-on-again trick. Just try to connect to it again. If you can’t, visit ARIN.net/streamARIN58 to view the YouTube livestream to continue watching the meeting. As soon as the Zoom is back up, we will make an announcement so that you can reconnect. If neither the Zoom nor the livestream are working, we will get back to you.

(Laughter.)

We will email you to let you know when you can rejoin.

Again, just a few reminders, this is both for in person and virtual. We will coordinate all discussion so everyone can be heard. Please speak slowly and clearly for our transcriptionist. And, again, do not forget to include your name and affiliation with any questions or comments submitted. That’s important for transparency.

We want to hear from everybody. So please let everyone have an opportunity to come to the microphone before you return for a follow-up comment or question.

If you have not yet connected to Wi-Fi at this point, I am not sure what you’ve been doing. But it is available for in-person participants. If you need it, the information is at the Registration Desk.

We’ve got a really fun agenda planned for us today. We’ve got our welcome – that’s me –following with the results from our 2026 Customer Satisfaction Survey that we held earlier this year.

After that, Brad Gorman is going to join us for a Routing Security Update. Hank Kilmer from the Board will come up here for the ARIN Financial Report.

Everyone’s favorite, the man, the legend, John Sweeting, will come up for the Data Accuracy Report. And then, if you’ve been missing Hollis Kara, she will be up here for an update on the ARIN Directory Services Consultation.

Lee Howard from the Board of Trustees will come up and talk about our IPv6 task force. Then we’ll have a quick break, followed by Christian Johnson, for our Information Security Update, Open Microphone, and then that’s it. You can go home. But you can’t stay here.

Remember, we are here to make ARIN meetings a safe place for everybody. We do have our ombudsman, Wade Hinton, in the room with us. Just a quick reminder to read the Standards of Behavior, if you haven’t already. And let’s just be cool.

And now let’s give our thank yous to our sponsors for ARIN 58. A big thank you AT&T, our Network Sponsor; our Platinum Sponsor, AWS; our co-Silver Sponsors, Secure64 and FlashStart; our Exhibitor Sponsor, IPv4.Global by Hilco Global; and, of course, our espresso bar host, Verisign.

(Applause.)

And I think with that, we will move on to our results from our 2026 Customer Satisfaction Survey with Adam Wedlake from Radius Insights. He’s a virtual presenter, so put your eyes on the screens.

2026 Customer Satisfaction Survey

Adam Wedlake: Hi, everyone. Okay, great.

So I won’t be going through all the slides because there’s a lot here. I’m going to focus on the key findings, recommendations. And then if we’ve got time I’ll look at the slides that convey the key insights.

Next slide, please.

Okay. So in terms of the background and objectives of this study, so this report consists of the findings from the Satisfaction Survey that ARIN runs every three years to better understand your member and why the community satisfaction and needs of the Internet number registry landscape evolved.

This report is focused on the latest wave of findings this year, in 2026, and the detailed objectives remain the same as in previous waves, with the key area of the survey being the measurement of the performance of ARIN against a set of dimensions that capture ARIN’s purpose and what it’s aiming to achieve.

And then we also capture what people expect of an excellent organization with the same mission as ARIN, so that then we can compare those expectations to performance and start to look at, are there any gaps where that could demonstrate there’s an unmet need for you to prioritize.

Next slide, please.

Okay, so the survey was run online from May to June this year. During that fieldwork period, we captured a total of 930 completed surveys, which is a much higher response rate compared to 2023, when we captured just over 300 total completes.

But the distribution of those responses remains similar to 2023, where we saw most survey completes came from ARIN members with a direct allocation of Internet number resources. And then we split that code out this year to distinguish between Service and General Members, and we also added a new code this year for those who have an allocation but they’re not under an agreement with ARIN, and we picked up 80 of those.

And then we have much fewer who do not have resources from ARIN, but are still part of the ARIN community, are still (indiscernible) interacting?, similar to 2023.

Just by that categorization with self-selecting for respondents in the survey, and we ensure those categories and descriptions match what is shown to members on that portal, so they’re informed when they’re answering that survey question.

So that total sample size of 930, that gives us a really robust sample with a low margin of error, so you can be really confident that the results reflect the population of ARIN’s community today.

I just want to give a note on the characteristics of the sample profile of this wave, because as we get more responses this way, we also noticed the profile of those respondents coming through was different from previous waves. So mainly we found that we were getting more professionally diverse respondents. And by that, we mean that we got more respondents in the two to 10 years of experience bracket than in previous waves, with about 40 percent of the total sample being there. And then there was also a broader mix of occupations beyond network engineering, which we typically get.

We had software coders, marketing and business development roles, system administrators, and then we also saw a lot more completes coming through your social media channel this wave.

So we see this as your best representation of your community today based on current engagement and available contact channels. And it’s really good. We know the community is always evolving, and social media is much bigger than it was three years ago.

It’s interesting to hear from a profile of your workforce that’s coming through this channel.

With that in mind, the differences to previous waves should be interpreted in this context because we’re now – we’re looking at a much broader, more diverse community profile. And each wave we do, the aim is to represent the current community at that time, the view on the current community.

Okay, next slide, please.

So I’ll start with the overall picture from this year’s findings. So the main takeaway really is that ARIN remains a highly valued organization, with expectations being met fairly consistently across most dimensions that we measured.

And we see opportunities to drive further loyalty to ARIN through the member experience. So making it simpler, easier and more responsive.

And an important piece of context to that is, as I just mentioned, we’re seeing a more professionally diverse and broad respondent profile this way. But it also means that member needs are becoming more diverse. So it really highlights ensuring that member experience is always meeting the community needs, is key.

So then to look into some of these details a bit more –some of these findings into a bit more detail, loyalty remains very strong. So ARIN’s image and reputation is solid. We do see a lower satisfaction this wave, but that is primarily a movement from the highest rating into the middle of the satisfaction scale rather than into dissatisfaction. So overall confidence in ARIN still remains high.

Looking across the scorecard we create for performance and expectations, we see the gap between performance and expectation has narrowed across nearly every major dimension. And that’s from both falling expectations and ARIN’s performance. So while that narrower gap doesn’t necessarily mean that absolute performance has improved, it does show that ARIN’s performance is closely aligned with the expectations of the community responding today. So it demonstrates there are limited unmet needs in these areas.

As we look at the specific dimensions, policy development is the standout. That’s now performing almost entirely in line with member expectations, and it continues to be one of ARIN’s strongest differentiators as we’ve seen in previous waves.

Where we do see opportunities to serve unmet needs in the dimensions is around operational execution, where we see that performance of ARIN and the expectation is, the gap is largest.

What we see there is the community are looking for more responsive support, clearer information, smoother request processes, greater transparency, and stronger confidence that ARIN continues to support self-governance across Internet registries. And so those are the areas most likely to strengthen loyalty going forward because there’s a large performance-to-expectation gap there.

We also see engagement broadening as well. So we see awareness and adoption of services such as RPKI, IPv6, and routing security continue to grow, which suggests that members are engaging with a wider range of your technical capabilities and educational resources.

And then finally, ARIN’s overall reputation remains a significant strength. So the community consistently view the organization as reliable, professional, open and trustworthy. And they are increasingly recognizing ARIN as both innovative and also socially innovative.

Then looking ahead, the strongest drivers of ARIN’s image are continuing to demonstrate value through effective use of financial resources and remaining responsive to the requests of the community and also just ensuring you’re demonstrating value through effective use of financial resources. That’s also something that’s coming up.

Next slide, please.

Okay. So before we get into the detailed results, I just wanted to briefly explain how to interpret the scorecard from our performance and expectation ratings dimensions.

As I touched on earlier, rather than looking at performance scores alone, we compare ARIN’s performance against expectations of an excellent organization with the same mission as ARIN. So you’ll see in these figures on the right, performance is shown in the blue boxes. And then expectation figures, those sit above the blue box.

So the goal really is to reduce the gap between what members expect from an organization like ARIN and what they believe ARIN is delivering. As those gaps narrow, it tells us that ARIN is moving closer to meeting community expectations.

So looking at the overall score, that’s exactly what we see this year. So you can see the overall performance gap has narrowed compared to previous waves, and both performance and expectation gaps have narrowed. So it suggests the stronger alignment overall. And we see the strongest performing dimensions are policy development, financial services and engineering, all now which have relatively small remaining gaps.

The largest gaps we see are customer service and Internet governance at the bottom of the list here. So we see the expectations there are continuing to outpace perceived performance. And you’ll see on the next slide, customer service remains a key area where, if it’s improved, it will have a positive impact on loyalty. So it does point to that opportunity around improving the member experience.

Okay. Next slide, please.

So this slide brings together those highest priority opportunities identified across the scorecard. So it shows the attributes within the various dimensions that have the largestperformance-to-expectation gaps. And then those that are in bold text, the attributes that combine a large gap with a strong relationship to member loyalty. So we did a key driver analysis to ascertain that.

What that shows is that improving those areas in bold is likely to have a significant impact on members’ overall experience, but also a likelihood to continue engaging with ARIN.

So if we look at this, a few themes emerge across the opportunities. So, firstly, policy development, as I said, it remains one of ARIN’s greatest strengths overall. But you can see the members continue to place high importance on ensuring the process produces useful and fair Internet number resource management policy. So that is something that they’re still looking for for improvement.

Within engineering, we see that members are looking for practical improvements. So timely delivery of new capabilities, more relevant tools and resources, making those resources easier to understand, particularly as adoption of your technical services continues to grow.

And then Registration Services, communications and outreach, customer service and security, if you look at those attributes, they all point to the common theme of operational execution.

So the community really want clearer processes, better communication, easier access to information, and more responsive service.

And then finally, Internet governance stands out here because confidence that ARIN supports self-governence has become a higher-priority opportunity compared with previous waves. So that’s something that has become more prominent.

But the opportunities here, I think they reinforce a consistent message, that members continue to value ARIN highly, but the greatest – so the greatest opportunity isn’t fundamentally changed, what’s being offered. But it’s just making interactions simpler, clearer, more responsive, more streamlined and kind of continuing to build on that technical leadership and trusted role that you have within the community.

Next slide, please.

So just kind of summarizing what we think of the kind of priorities/recommendations coming out of this wave’s research.

So, firstly, continued designing for a broader member community. So as I mentioned, compared with previous waves, we’re hearing from a more professionally diverse and less-tenured audience. And that reflects the ARIN community today. But it also means therefore the communications, navigation and educational resources, they all need to work for members with a wider range of backgrounds and technical experience. So it’s really important to consider.

Second, focus on reducing that friction across the member experience. As I kind of kept pointing to on the previous slides, that is kind of the common theme here. The community are continuing to value ARIN highly, but the biggest drivers of loyalty are operational. So they want those interactions to be simpler, clearer, more responsive – whether that’s finding information, submitting requests, receiving support, or understanding processes.

Then, thirdly, continue investing in engineering capabilities and technical enablements.

So we’ve seen in this wave results that adoption of services like RPKI, IPv6 and routing security, those continue to grow. So it makes the quality, the usability and the relevance of your technical tools and resources increasingly important to that member experience.

Fourth, continue communicating ARIN’s value and impact. So we see that the community is increasingly recognizing ARIN as innovative and socially responsible, which is great. And perceptions of efficient use of resources and responsiveness, community needs, those remain some of the strongest drivers of ARIN’s overall image. So it’s really important to continue to demonstrate the value that ARIN delivers just to keep reinforcing that positive reputation.

And then finally, just continue building on what is already one of your greatest strengths, which is member trust. So loyalty remains high. Members consistently describe you as reliable, professional, transparent, and community-driven. So really maintaining those strengths, while at the same time addressing some of those operational opportunities, will really help ensure that ARIN continues to meet the evolving needs of its community.

So those are all the summary slides. So we have now got some detailed slides. I’m not sure how many minutes I’ve got left, but I can go through some of those, if there’s time. Okay. Great.

This slide provides just a little bit more context behind the loyalty finding from the summary that I just discussed.

On the left here, this is your loyalty index. So overall loyalty, as you can see, remains strong. It is below the 2023 peak of 85, which was a peak. But the 81 is still consistent with 2017 and it’s still above that 2014 level.

Across the supporting measures, as I mentioned, we’ve seen some softening in the highest ratings for meeting member needs, value for fees and likelihood to continue at ARIN, but we aren’t seeing a movement into the dissatisfaction. It’s more just a movement into the middle of the scale.

So loyalty hasn’t weakened significantly, it’s just the sentiment is somewhat less pronounced than in 2023. But the overall relationship remains strong and stable with that 81 loyalty score.

Okay, next slide, please.

Okay, so this is the analysis we do by trying to understand and identifying what the needs and unmet needs of the community are. So the vertical axis shows how strongly each attribute influences loyalty. And then the horizontal axis shows the gap between expectation and ARIN’s current performance attribute.

So that upper right quadrant therefore represents the highest priority opportunities, because these are attributes where there’s a large gap between expectations in ARIN’s current performance. And we also know that it’s improving performance there is likely to strengthen member loyalty because it has a high impact on loyalty.

If we start at the top left actually, those will be your strengths. So you can see, as I mentioned, policy development remains one of your greatest strengths. So you can see attributes like Advisory Council effectiveness and Board oversight, those have a really strong influence on loyalty, and those are areas where you’re performing at or above expectations.

Then look into the opportunity side. So if you look at the attributes in the top right, those are concentrated around operational execution. So you can see the clearest request process stands out as the kind of highest priority opportunity. Then you’ve got organizational transparency, information accuracy, support for self-governance, and response timeliness.

And also in that top, right segment we see engineering represented through relevant tools, timely technical delivery, reinforcing that these capabilities are becoming increasingly important as adoption of services is growing, as we see in the survey.

So, yeah, it really just is evidence towards what I’ve been saying. The kind of biggest opportunity is around making that experience of working with ARIN simpler, clearer and more responsive, while continuing to build on your strong reputation, particularly around policy development.

Next slide, please.

I think we can skip this slide. It’s more detail on the previous slide.

Next slide, please.

John Sweeting: Can you hear me, Adam?

Adam Wedlake: Yes, I can.

John Sweeting: We want to leave a few minutes for anybody that has questions for you. I’m not sure if you have any other slides you feel you need. The whole report is on our website for everyone to go and look at.

But we do want to have some time left here for anyone that might have questions for you. If that’s complete then we’ll open up the mics and ask anyone that has any questions for Adam on the methodology and running of the explanations, if you didn’t understand his explanations of expectations and score and gap and all that, now would be the time to ask those questions from Adam.

If we have no questions for Adam, Adam, we’d like to thank you for coming and giving this update for us. And it’s kind of a little early in the morning but not that early, Friday morning. Thank you anyway.

(Applause.)

Now if there’s any questions for ARIN staff on the survey, there wasn’t – it was a good survey, but there wasn’t anything asking, like, what are the specific things you would like to see. So this would be a good time for anybody that has some specific improvements or comments or suggestions to come up to the mic and let us know.

John Curran is mic’ing up as well. So he’s available as well.

John Curran: I want to add a few words. I’ve lost my microphone, something I really don’t need but I’ll put it back on.

So there’s some things we clearly can take away from the survey, things like the clear request processing and website navigation. We’ve already spoken to the Board about that and are engaging on trying to improve that.

The challenge was that there’s some areas where we see there’s a desire for improved tools. And I look at that and I go, okay. I tell people, we have an ARIN suggestion process.

If you filled out the survey and said, ARIN needs better tools, now fill out the suggestion process and say which better tools we need so we know how to prioritize that work.

The other thing I want to point out, I’d be remiss not to, we closed the gap on expectations. Oh, hooray. If you look at the report, I will tell you that your expectations of ARIN have dropped significantly. So we closed the gap because you lowered your expectation. That’s not exactly the right way to do this. Okay?

I would prefer to not only exceed your expectations, I’d like your expectations to be higher, quite frankly. Please use the suggestion process, tell us what we need to do.

We do have, and you’ll be hearing about it later today, we do have a very tight financial picture, but we have a lot of opportunity to prioritize. It’s really important we prioritize on what you feel is important. So that’s it. Just thank you.

John Sweeting: We’ll go to Kevin over here on my left.

Kevin Blumberg: Kevin Blumberg, The Wire. John, you kind of brought up one of the things that I saw was a pinprick.

Organizational transparency is “an opportunity”, is a little scary to see. And I don’t know why that’s there. I’d like to understand it a little more down the road. But at the same time, Board and AC is really great.

I’m used to seeing things up and to the right. So when I see great is on the left and bad is on the right, that gets confusing to me. I think there’s some terminology. This was really good information, a lot to digest.

But there’s no sort of executive overview that simplifies it away from a more complicated study.

The term “opportunity,” there’s no opportunity about – needs improvement is really what it is. So a little less catchy corporate buzzwords, but otherwise it looked really good and hope to see more.

John Sweeting: Thank you, Kevin. Here on my right, your left. Lu.

Lu Heng: Lu Heng, Larus Limited. Internal suggestion, especially not just for ARIN, actually for the RIRs, I’d really love to see a unified API access for RPKI route object and anything really across the five different back-end databases. And it’s been causing much operational headache, around the development world and some of the RIRs, which you know you know, that don’t even have ultimately the access to RPKI and the creations and delegated RPKI servers, which I’ve been talking to some of the staff members. I understand some of the project was not a prioritized expression on the NRO level.

I’m making a comment here, I would really appreciate it for the efficiency of the entire Regional Internet Registry system, and also for the good of the Internet and efficiency of our operations, we do need to have unified portals for the registration database and for machine-automated, fault-proof cryptographic updated processes through APIs, I would really appreciate that. Thank you.

John Sweeting: Thank you, Lu.

John Curran: [off-mic] Just to understand, there’s a unified back-end database and there’s unified APIs.

There’s a few things you’ve asked for. Can you make those specific requests and put them in a suggestion process and say you want unified API, RPKI across the five RIRs so the community can talk about that, four or five different things we want to harmonize within the RIRs? We want to work on them in the right order.

Lu Heng: I’m saying the first order, which is pretty obvious for all the operators out there, the back end needs to be harmonized, that’s for sure. But that’s not the priority. The priority is the customer-facing side of things. The same front end you use, the same sort of API specification you use, the same sort of delegation of RPKI standard you use so that, for example, obviously my company operates across five RIRs, we have managed IPs across five RIRs.

I don’t want to develop – which now we do – but I don’t want to keep developing and updating five different sets of softwares to be compatible, updating five databases, which at least essential things need to be harmonized across five RIRs. And it needs to be standardized.

So, for example, update creating an assignment, which you have different names across five RIRs, assignment and reassignment here, then you’ve got location assignment, PA and PI in RIPE. They’re different names, but essentially it’s the same thing. And it should be able to have at least a unified, customer-facing APIs we can use. And maybe each of the community have different little tricks or that, but then you can make that in addition to that.

That’s technically easily achievable.

John Curran: My suggestion is that you put that in the suggestion process so that the others can also – I know it’s obvious to you, but other people may have a different view about the priority or what aspect needs to be done first.

So I got it. Put it in the suggestion process so it gets on the list and everyone can talk about it on ARIN Consult.

Lu Heng: I’ll do that. Thanks.

John Sweeting: Kaitlyn.

Kaitlyn Pellak: Good morning. Am I on? Good morning. Kaitlyn, Amazon, ARIN AC.

I wanted to call out, it is early. I have not had my third cup of coffee. But I just wanted to point out that this looks like this had the most responses in over 12 years to this survey, which I actually think is a really good sign that people are engaging more with ARIN and giving ARIN more feedback. I just wanted to note that because I think that’s excellent.

John Sweeting: Yeah, great takeaway. And it shows that ARIN, we’ve done a lot on outreach to get out there. The actual diversity of respondents was fantastic as well. That’s a great thing to pick up on, Kaitlyn. Thank you for pointing that out.

I see nothing else, so we’re going to call an end to this and hand it over to Ashley.

Ashley Perks: Yeah, get out of here. Next up, we have Brad Gorman, our Director of Customer Technical Services, to give an update on routing security.

(Applause.)

Routing Security Update

Brad Gorman: Thank you, Ashley.

Yes, my name is Brad. Most of you know me. But I’m the Director of Customer Technical Services. My team is responsible for answering the calls that come in about routing security, RPKI, DNSSEC, geolocation, any of the more advanced services that come in that ARIN runs.

But I know many of you who know me don’t really know me with a jacket on. I just wanted to let you know I am here.

(Reveals tie-dye shirt under button down.)

So, I promised myself I’d stand on schedule, so let’s get started.

Routing Security Update. I’m going to give you just a few results of numbers of how things are going in the global RPKI community, more explanation into the services and the performance within the ARIN region with regards to RPKI, and then go over some of the new features that we’ve been developing and things that are coming up in the future from some of your suggestions that have been coming in through the varying different ways.

So globally, RPKI validity is going up. It has been going up for years now, and part of that has been education of – from me, from the other RIRs –about the benefits and the importance of global routing security and RPKI, to the point that two years ago we were hovering about 50 percent coverage of resources that were being announced on the Internet.

As you can see up here, across the different protocols, is pretty – the common message. But if you took the overall look of routes that are on the Internet today, more than 72 percent of all announcements are covered by RPKI and are RPKI-valid.

In the beginning of September, we crossed a very big threshold: more than 1 million routes in the Internet Routing Table are covered by RPKI and are valid.

(Applause.)

So, for those of you who are aware, ROAs are about routing, making sure announcements are valid.

There’s another knob coming very soon into the RPKI and it’s called the ASPA, the Autonomous System Provider Authorization, and that’s intended to protect the path back to your announcement in the RPKI.

Between the two of these different knobs that are available, we’re going to seriously reduce the surface, the attack surface available for people who are intending to not do good things, or to protect Internet routing and security just for simple misconfigurations made by engineers at 2:00 in the morning. Many of us have been there. So, these two knobs and features, when they do come together, it’s going to be another big boom for the performance of RPKI.

We wanted to show you that ASPAs are still not standardized in the IETF. No routing vendors have released code that they need to support RPKI. But four of the five RIRs have already turned on the ability and the capability to create ASPA objects within our systems. And as you can see, the numbers have picked up even before it’s a thing. So, there’s definitely pent-up demand and need and desire to have this new feature included in the RPKI.

Real quickly, we’ve seen this before – for those who are aware – there are three different service offerings with regards to RPKI here at ARIN.

There is the classic hosted and delegated RPKI. Between the two of them, one is much simpler for the customer. You make your statements about resources, and ARIN does the heavy lift. We run as the certificate authority. We publish the high availability database.

On the other side, there’s delegated RPKI for organizations that maybe have regulatory reason to maintain control of their certificates. They run their own CA. ARIN, in that case, just verifies that any of the resources, or the resources that are within their CA were authentic and came from ARIN.

There’s one in the middle. It’s called hybrid. It’s the Repository Publication Service by name. For those people who don’t want to run their own repository but maintain control of their certificates, they have the option of off-loading that responsibility onto ARIN.

So inside of ARIN, the adoption for RPKI continues to grow. Month over – or quarter over quarter, year over year, there is a consistent growth in the number of Orgs that are adopting, moving forward, signing up for RPKI and creating their objects.

Don’t expect to see any difference or change in this moving forward. The message is getting out that it is important for everybody to do it. But one thing I do want to call out is amongst the organizations that have signed up, about 14 percent of them have hit the button that says, yes, I want to do RPKI but haven’t created one ROA. They haven’t created an ASPA. It’s not standard yet, that’s fine, I’ll give you a break on that.

But RPKI doesn’t work if the information is not there, and if the data is not entered. You are the resource holders. You need to do this. And as we all put our information together, the RPKI can only work better.

Adoption across different entity types, being government organizations, educational institutions and commercial deployments and use of resources and announcements that are on the Internet. Again, this – I don’t want to say eye chart – but this wall of words and percentages up here basically shows that even amongst all of the different entity types that are part of the ARIN community, all of them continue to grow with regards to adoption and use of RPKI making statements about their resources. So, this is a very heartwarming and good sign that the interest is there and continues.

Forgive anyone who is looking at this on a small screen. Forgive the people who are looking at it on the big screens here inside the room. But what this slide is representing is within the ARIN region, it’s not just the United States and Canada. We have a healthy portion of the Caribbean community that are also part of the ARIN region. And what I’m showing here is within each of the different countries and territories within the Caribbean, the adoption rates are actually pretty darn high.

If you look at some of the smaller organizations, smaller communities, there is a very high adoption of RPKI. And that really makes me feel really good that the message is getting out normally in places that maybe the voices aren’t heard.

Calling out the numbers for the United States and Canada, you can see, those are the red lines, and, okay, we may be bigger, but surely we have a long way to go to catch up and match up with our Caribbean members.

So, adoption across all of the resources inside of ARIN, and this is IPv4 resources in this case. Within our registry, we have 1.6 billion-plus IPs; 1.5 billion-plus of these are under contract and are available to be used at our RPKI services. And that’s great. That’s 94 percent. That’s a huge number. That’s good. And we’re fighting to get those last six, but it’s going to be a very long line because some of those announcements and resources are in very small blocks, so the numbers can start moving a little slower than we would like.

But the last line here is basically showing how much of all of those resources that are announced are covered by and are valid in the Internet, and that number is 59 percent, and that also only continues to grow.

Here’s another way of spinning the data within the region and the territories on their utilization and performance using RPKI. So, again, there’s a very good representation and coverage and interest and active use of RPKI within the Caribbean community. But all down the line, they all show increased growth.

Again, very good message is getting out there. People are using the products. And, thank you, everyone, who has been participating.

In general, yes, the information shows that people are paying attention and people are taking action. As before, RPKI doesn’t work - the benefits aren’t there - if you don’t make statements about your resources. We can’t do it for you. Have you to do it for yourselves. So, continue doing it. Keep your information up to date. That’s always important.

And in general, the RPKI is a global problem and it’s a global solution. So, everybody needs to do their part and take responsibility and move forward.

So, we have some new release coming up. It’s new features that are in development. I want to go over a couple of them that I think everyone’s really going to be excited about. It’s things that have been asked for a long time.

We’re calling it BGP Insight. What does that mean? We are going to have an interface that will show our users that come in and use our web interface, give information about what their presence looks like on the Internet today. What does that mean?

Any of your announcements that are covered or are in a state of RPKI validity that are valid, not found or invalid, so it gives you a good look into what you appear like to the outside world and maybe direct you towards the places that you might want to address.

If you have announcements that are marked invalid, you will have a way to get to the explanations and the understanding and present to you the options on how you want to bring everything to a valid state.

Also, on the other side of the equation, whenever you go and request a change, we’re going to be providing the foreknowledge of, hey, if you apply this change, this configuration that’s kind of waiting in the wings, what could be the outcome? It may not be what you want. So, we’re going to, again, present that to you, make sure that before you say “submit my change” you have a better understanding of what the end result is going to be.

So that will be coming with our next release next month. I hope everyone enjoys it. You have been asking for it a long time. It’s here. We’ve been listening. Thank you.

For those who don’t know, we have a traveling road show. We have what we call a deep dive into RPKI where we go out to the community, do a presentation and then have a hands-on workshop so people can understand how to use our interface and what it means and give a better explanation of, this is what you need to do, and really it’s not that hard to do, so let’s work through it together so you know and move forward and make that progress, getting information out there.

If you want to have any – if you want to give any input or interested in having this training brought to you, closer geographically, communicate with the training team at training@arin.net, and you can get more detail in where we’re planning on going, and maybe direct us towards going to a location that would be interesting to you.

Some of the other features that are in development or on a roadmap, we have new updates to our API and performance as it goes now.

We have, as the new features get turned up, the idea is we continue to update whether it’s the web interface or the API, so there’s parity between the feature set of the two.

We want to make sure that everyone who uses our services can take advantage of the products that we have.

We introduced a change log earlier this year. It gives a 365-day history of changes that have been made, identifies who made them and the method that they were made, so that if there is an unintended change in the data that’s in the RPKI, your configurations, it will be represented to you. And then you can use this data and go back and rebuild, maybe, what had been left behind or what you need to recreate for one reason or another.

We’re developing new features as far as how you can make your changes moving forward. Those, of course, include more of the ASPA configuration. And then we’re continuing to expand the inner RIR connectivity and collaboration so that we can provide the RPKI common – more equal information being presented regardless of which RIR that you are interfacing with.

And I’ll always say this, if you have any ideas, any suggestions, any requests, any gripes, we’re here to listen to it. I’m here in front of you. We have our suggestion input portal. Make your voice known. Again, global community, the member community. We’re here, we’re listening. And we’d like to do everything that will make it easier for you to get the job done and take advantage and use our routing security services.

So, help us shape the future.

routing.security@arin.net is the mailing list for my team. I’m on the road, just like you are; we’re all here traveling away from the day job and our desks.

So, my team, including myself, will receive messages and requests coming in here. So, make use of that. Arguably, you’ll get a faster response if all of us aren’t in the office at the same time. So that’s it. Thank you.

(Applause.)

Ashley Perks: If anyone has any questions, now would be the time to get to the microphones. I see we’ve got one over here.

Kevin Blumberg: Kevin Blumberg, The Wire. Brad, my only gripe is I have no gripe.

(Laughter.)

Over the last five years, your team has taken the deficits that occurred, fixed them, and then done this premonition and added features we didn’t even ask for, in many cases, maybe individuals did, but you’ve really improved the product, and I really have no gripes about that.

My gripe is about statistics. You’re going to get it. But it’s not your statistics, it’s the Internet statistics.

The problem is that when I see something like, wow, we are 58 percent or 82 percent, or I’m looking at a big provider that 98 percent, this is awesome. And you go, yes, 100 percent of the residential subscribers are covered, but all the core infrastructure, all of the banking, all the finance, all the insurance, all the important stuff isn’t covered because enterprise is too much about paying. And the messaging that is my biggest concern now when it comes to RPKI that by just looking at the statistics, we’re not looking at the impact of people who are not doing the right thing.

I think you’ve made all the tools. You’ve given us this tool now, see what your mistakes are going to be before you deploy. That’s phenomenal.

You don’t have to screw up your routing. We’ll tell you if you’re going to screw it up before you actually do it. Great.

But if enterprises and businesses aren’t deploying RPKI, and the providers that handle these customers aren’t telling them to deploy RPKI, we’re really doing a disservice. And I don’t think it’s ARIN’s mission to do that, but I don’t know how to get that out there. It’s everybody else’s responsibility, is what it seems like.

Brad Gorman: There are two kind of answers to your question. One of them is, yes, there are providers today, and more every day, that are putting the requirement on their customers to start using routing security, RPKI services. Hey, if you want to continue to maintain service with us or you want to sign up new, you must create these objects. So that’s part of what’s driving new organizations to sign up and new entries to be put in.

The other side of things is still RPKI is optional. There’s nothing that any, me or any of the RIRs can do to force anyone to use it. That will never happen. So, we really need to rely upon getting the message out.

Myself, my peers, we’ve been screaming at the mountaintop, on top of our soapbox, however you want to say it. But now it’s time for the community to continue that message and push it further out.

Talk to your peers, talk to your other sister networks within your region and say, hey, this is really important, we all need to take a step with this; this is a global effort. I ask you to evangelize now. And that will help get the message out there.

Kevin Blumberg: I do know that when my insurance control panel that tells me things that need to be improved on my site suddenly say critical vulnerability, not RPKI, maybe that will be the day people actually wake up.

Brad Gorman: Thanks Kevin.

Mohammed Aljanaby: Hi, Brad. Mohammad Aljanaby, Long Lines Broadband, small ISP in Iowa. Probably following up to what Kevin was just mentioning is, how do we continue to enforce this?

Part of the things that I’ve done is reaching out personally to my customers and helping them set up the ROAs on their side. I could say that I’m 100 percent ROAs in my ASN, but it’s a small network to manage.

Brad Gorman: Thank you very much.

Mohammed Aljanaby: But I guess to Kevin’s point is, how do we continue doing that? I don’t know. Part of it is, can we start reaching out to more folks to say, hey, you’ve got an IPv4 space, will ARIN please set up RPKI? I know we can’t enforce it, obviously, but how do we still continue to suggest it to customers and such?

Brad Gorman: I’ll give you a similar response. We as an RIR community are pushing that out there. The RPKI-interested community is pushing the message out there. But we’re pushing the rope. It just has to be again and again reinforced and put in front of people from different directions. Maybe it’s coming from the provider. Maybe it’s coming from messaging that the RIRs are putting out, that the community puts out on NANOG mailing lists or mailing lists in other regions across the world.

We’re certainly going to continue doing that. We’re going to go out and educate people with training, but it’s just as important, like you said, and communicate with your peers. Talk about it and say, hey, we’re doing this; you should really do it, too.

If you can show the advantage that you have taken out of making an RPKI configuration, that could be another boom to say, okay, this is what we want to do. Thank you.

Next question.

Betty Fausta: Hi, Brad. Betty Fausta, IPEOS, a Fellow. I have a question about ASPA. You say also ASPA will be supported, the creation, by the end of 2026.

When I saw the graph, there was a low rate in LACNIC and zero in AFRINIC. Could you explain more? And maybe we can show the slide about that.

Brad Gorman: I can go back to the slide, but the explanation is actually pretty easy. RIPE’s uptake happened because they enabled the capability last November. ARIN’s capability of creating production ASPA objects, or putting it into the production repository, we turned it up in April.

APNIC and LACNIC have come after us. In fact, LACNIC was very recent, in the last three weeks, I think, that they finally turned it up. AFRINIC is still developing it.

But, yes, they have committed - all the RIRs have committed - to be offering the capability for our membership to create ASPAs by the end of the year. So, it’s not there yet. That’s why their number is zero. But we certainly expect that there will be a similar uptake in the AFRINIC region as well once it’s available to them.

Betty Fausta: Thank you.

Brad Gorman: Sure. Are there any ROA questions?

Ashley Perks: Any online questions, Hollis?

Hollis Kara: Nope.

Brad Gorman: Fantastic. Thank you very much. I tried to keep it short. Thanks, Ashley.

(Applause.)

Ashley Perks: Thanks, Brad.

Next up we’ve got our Board of Trustees treasurer, Hank Kilmer, to come up and give the “Fun-ancial Report”, as coined by Nancy Carter.

(Applause.)

ARIN Financial Report

Hank Kilmer: So do your ROAs. There’s the Financial Report. No, just kidding.

No, coming after Brad, though, this will seem kind of tame.

From a Financial Report perspective, that’s what you want. You don’t want an exciting Financial Report.

I’m tempted to throw in slides that show we’re flat broke, just to make sure you’re paying attention. But no, this will be a calm presentation.

So for our agenda for this, I’ll just go over sort of what the work we’ve been doing, this is sort of the normal what we do each time we get together.

Give you the update, and then give you update on where we are in our performance on the different aspects of our finances, revenues, operating expenses, and overall position, along with our investment fund that we’ve got. So, pretty clean.

From the committee perspective, from the last time we met until now, is sort of the busy time of the year for us. We have met four times. We have gone over some pretty significant items going into the details of things.

We’ve reviewed our quarterly financial statements, reviewed them internally. We reviewed quarterly investments with the investment advisor.

We met with the CLA auditors to review our audit report, the draft audit report, to present to the Board. We met with the tax team to review our Form 990 tax forms for Board approval. And we reviewed a draft budget for next year, which is an important aspect of what we do.

It is our busy time of the year, that stretch. It is important, but we have a regular cadence for this. So none of this is a surprise.

Our overall performance, we were kind of challenged to come up with a high view., and so we put a high view together that shows that our revenues are pretty close to our budget. The variance there is within sort of what we would expect year over year.

Operating expenses are doing quite well in terms of our forecast and budget as well. We are 3.8 percent below budget. Our operating deficit is just over half a million better than our budget, and the investment income continues to do pretty well. It’s conservatively invested, as you recall, and is our operating deficit above budget.

So overall, the numbers are tracking to what we would want them to and expect them to. So there are no surprises for the organization and the community.

So revenues are kind of the absolute critical aspect. So we wanted to give some detail on our revenues. Our annual renewal registration fees, which is kind of the most critical in everything, is less than 1 percent under budget. It’s tracking pretty closely, and it’s matching what we had in 2025.

So that is our primary income, revenue. So we look at it very closely, and I’ll get into some details in the next slide.

Initial resource registration fees are pretty close to budget, as are transfer fees and other revenues. All of this is good news for us.

Like I said, the Registration Services Plan, the annual run rate of that, we track closely. We keep a close eye on this because it is such a big ticket item for us. So I wanted to take a look at it and kind of give you all a view of what we look at.

It’s stable, which is good, and predictable. That’s good as well. But it is such a big value for us, we track it closely.

And if we look deeper into that number, which is one of the things we pay close attention to, there’s four blocks of small, medium, and the large categories. We break it down per to make sure we’re hitting expectations for each sort of category of member, and we’re following our forecast and our plan with it and the expectations. It’s meeting the expectations.

You can see the small here. This is just under — this is about 49 percent of the total. So that’s a very good value for us.

You go to the medium and large categories, and you get the other 51 percent out of those. It’s tracking. We’re not seeing any major shifts in our customer base behavior or anything along those lines.

The breakdown of the 49/51 is something we keep a close eye on. It matters in terms of expectations and what we can do.

So operating expenses, the other side of the coin. The biggest ticket item for us in the operating expense is salaries and benefits. For an organization like ours, that’s what you would expect. So we track that. We are slightly under budget on that. We’ve forecasted the average number of employees at 106, and we’ve been running at about 103. That’s why we are a little under the forecasted budget there. Otherwise, it’s also a very predictable number for us.

Engineering operations is a little under budget. We’re tracking that closely. Some of that is timing of things and whatnot. But doing very well for controlling our expenses.

So to give a view of that in terms of a variance, you can see in this view that professional services is sort of the main thing that is giving us a budget variance, and that’s a good thing in that we haven’t needed as much outside professional services as we had budgeted for. That means things are healthy.

That number can go up and down based upon outside influence that we then determine we need to bring in experts and things to cover, special cases. So this is a sign to us — you always have to have it budgeted, and this is a sign to us that things are going in a good direction for not just us but the industry.

So our investment portfolio. Let’s take a look at that. So we have two funds, the long-term investment fund and an operating investment fund that we feed to cover our expenses.

And they are conservatively invested, which is the right thing to do, particularly for a long-term investment fund in volatile markets.

You can see that our earnings is just under $2 million, and that’s a 5.2 percent increase. So that’s a steady, healthy increase.

Our operating fund is, it’s more a transactional fund, so it doesn’t get the same level of earnings, but it’s more like your interest earnings and things like that. And that’s a 2.2 percent.

That’s why we keep it lower. It’s our working capital.

And we did transfer $2.4 million. We keep the operating fund at sort of a steady level, and so we transferred $2.4 million out of the long-term fund over into the operating fund to keep things running smoothly.

Overall, long-term investment fund, this is sort of over time the tracking of it. Other than 2022, we had the dip in global markets, as well it took us down a little bit. We’re tracking pretty nicely. This is a good conservative return, and we’ve been pretty satisfied.

We review the details of how things are invested regularly and will make adjustments in that as needed. But it’s a good, steady return.

So the asset allocations in that is spread across the different asset classes. A lot of it is in fixed income, and that’s part of how we can control sort of the steady return. And if you’re into finance, which if we’re technical people, we may not be, but if we’re into finance, this is a stable spread. So this is healthy.

This is just a view of our operating fund and how that works. We keep it at a steady level as best we can until we draw it down and then we replenish it and let it grow. And this is just sort of showing the return on that.

So our target reserve. We talk about what are these funds for. We have a target reserve. The Board wants to maintain a nine-month target reserve, which based on our budget is $26 million. We are currently in the investment fund just over $12 million more than that.

There is a reason for this, and that is because we — and I’ll remind everyone in a minute even more detail — but we are going to a balanced budget scenario where we don’t need to touch this.

We have a lot of challenges to — John and team — to not spend if it’s not in the budget and tight budget, tight controls on it, so we can get to a balanced budget so we can get to a healthy point where we can very predictably build the tools and services that the members want. We can allocate funding directly for those tools and services and not have it just be because we want to or a research or any other type of thing that happens in the industry.

So our financial position is very healthy. It’s strong. Our liabilities and our assets are in a very good shape. Our budgeting is well done and accurate. Brian and his team do a great job keeping us all in check. So we are doing well on all of that.

I’m kind of going quickly because there’s a timer here, by the way. So I wanted to remind everybody, and I just touched on this, but achieving a balanced budget by 2030 is a hard challenge for the organization. It puts a lot of pressure on controlling the expenses, and there’s a lot of great ideas that everyone wants to do, but it all costs money. And this is why you heard John just saying, put in your requests for improvements and we can prioritize, because we can do these things. We just have to fit it into a healthy plan and prioritize it.

So I fully support what he’s been saying. It’s how we’re going to get there. And we are in good shape getting there at this point. So with that — I’m in the questions.

Ashley Perks: If anyone has any questions relating to the ARIN Financial Report, please get to the microphones or start typing online.

Hank Kilmer: Do your ROAs.

Hollis Kara: I’m not seeing anyone.

Ashley Perks: I think you covered everything and no questions online. Excellent.

Okay. We are going to do a quick pivot because we are just running a bit behind just to keep you all updated. We will be doing the Data Accuracy Report by John Sweeting. And then we will be doing the IPv6 Task Force with Lee Howard. The ARIN Directory Services Consultation will be moved to after the break. So with that, let’s get John Sweeting on up here to talk about data accuracy.

Data Accuracy Report

John Sweeting: All right. It’s time to — all right. Good morning, everyone, I’m John Sweeting, CXO for ARIN. And what did I do? I went the wrong way. All right. So I’m going to give an update on our Data Accuracy Program.

So why is accurate registry data so important? Well, there’s several reasons. Number one, most high priority is the Internet operability and stability.

If people don’t know who the other people are that are using different resources, then coordination becomes practically impossible. So it’s very important that we maintain a very accurate registry.

It also helps to prevent the hijacking of resources, because if somebody comes to you as an ISP and says, hey, can you route this IP address for me? You can say, well hold on, let me go check Whois, let me check ARIN’s database and see if you’re allowed to be using those resources. So it helps with that.

Again, it supports the Internet community as a whole, and it also helps law enforcement to track down the players on the Internet that are looking to take advantage of people and things.

Okay. So our Data Accuracy Program is really a thorough audit and going through all of our data.

Of course everyone knows, at ARIN, we have a lot and lot of legacy data, legacy resource holders, that the data is very questionable because it’s so old. Some of it hasn’t been updated since the early ’90s, a few from the late ’80s, 1980s.

So that’s where we’re focusing our main resources at — and by resources, I’m talking mainly Misuk, because she’s mainly the one that’s doing the research on all of these legacy resource holder Org IDs.

These are the three objectives of the program: resolving unknown holder data, which is mostly the legacy holders; documenting nonagreement holders, so identifying holders whose data is known and accurate, but they have not entered into an agreement. And we have a lot of that.

It appears — what looks like a lot of legacy resources really are just resources that aren’t under an agreement because a lot of organizations have Internet number resources that they obtained before ARIN was incorporated but then they’ve gotten resources from ARIN too, and these resources end up in the same Org ID but some are under an agreement and some aren’t under agreement.

Then, of course, the main objective is to increase the agreement coverage, attempting to get all of our resources that are directly allocated to customers under an agreement. So the way we started going towards the unknown users was we broke it out into two different cohorts. One was unknown holder data, and the Org count there was 2,660, and that’s basically an organization that has never had a user ID established in ARIN Online and linked to the account.

So this account has been in ARIN the whole time that ARIN has existed, but nobody has ever touched the data in that Org ID. It’s the same as it was as when it was first input into the ARIN database.

There’s no users identified. No POCs. And nobody that we can reach out to to attempt to verify and update their data. So there was 2,660 of those organizations.

Cohort 2 is the outreach pipeline. There’s a little over 10,000 organizations there. They have contact information. They have a user that has been linked to a POC and linked to the Org ID. But it needs verifying through the Data Accuracy Program process.

Under that, there’s two different types.

There’s the mixed organizations. We call them mixed because they have resources already under an agreement, but they also have resources that are not under an agreement, so we definitely know who they are. They come in every year. They pay their annual fee, but they don’t have all of their — they’ve not opted to put their legacy resources under an agreement.

And then there’s the 9,000 organizations that have no existing agreement relationship whatsoever, they’re just an Org ID that has resources directly allocated to those organizations.

The way we’re going about it, the Cohort 1, the unknown data holder, we ensure they’re not routed and there is no known contact; we’ve done everything we can to try to figure out if there was a contact, there is none. So what we’ve done is we’ve stopped services on those and quarantined them, and they go on a 12-month hold, and we wait and see if anybody comes and says, hey, what happened; my resources disappeared out of Whois.

After 12 months, we hold a meeting, we call it the rights extinguishment meeting, it’s myself, our COO, our CFO, Richard and Brian, Michael and Jennifer from our legal team, and then a couple of our analysts that have gone through and verified the information. And we all look at it and we say yep, I guess those are ready to go out to the Wait List.

And then the second one is the outreach pipeline, and that’s the one that takes quite a bit of time and effort, and Misuk is going slowly, not slowly, but meticulously through those and reaching out to these organizations.

We’re having really good success, and I’ll get to the stats here in a minute.

So it’s targeted outreach based on numerous factors. We do a lot of research of who’s merged with who, who’s acquired who; bankruptcies. Misuk is really, really good at what she does. And if there’s somebody out there that has a valid claim to being a legal successor to these resources, we usually identify them.

So again the action, stop services, quarantine, 12-month hold, release to the Wait List, and Cohort 2, outreach engagement with pure legacy and mixed Orgs, prioritize the targeted outreach based on numerous factors, which I had just mentioned.

So we’re going to just look at the /16 engagement effort. I can tell you we have very few — we have one /8 holder, one /9, one /10, /11, one /12, one /13, I think three /14 holders and 10 /15 holders. We know who all those organizations are. We’ve contacted all of them. None of them wish to push their resources under an agreement.

So the first one where we get to a big number is our /16s. And there’s currently 715 — as of today it’s 709 because it’s gone down six in the last week, due to Misuk and her great work.

And again, it’s the same definition and criteria for the cohorts. Those 715 organizations are 49.1 percent of all the remaining space that’s not under agreement. So keep that in mind as we go to this next slide.

So the program at a glance. 372,877 /24s of space not under an agreement as of Q3 2026. There’s been 26,313 that have come under agreement since Q2, the end of Q2. And an 81 percent decline since Q1 2024.

That’s a pretty good-sized decline. There’s a good reason for that. A few big organizations, such as Department of Defense, put all of their resources under an agreement, and they hold about 20 percent of the total IPv4 resources of ARIN.

So that was a very big drop in what was out there not under an agreement.

Today, we have 16,212 legacy CIDR blocks. That’s down 331 since last quarter. And it’s down 6,578 since Q1 of 2024. And this last number is the number of /24 equivalents that have been distributed to the IPv4 Waiting List since Q1 of 2024 from this program.

Program makeup — and here’s some interesting statistics here — as we talked about the number of /24s, I mentioned that in my talk yesterday,

91.5 percent of the number of organizations have a /21 to a /24, but that only accounts for 5.9 percent of the total space.

You can see from the /17 and /20, it’s 4 percent, and then 6.6, and then the big challenge is with the 8, /8s to /15, it’s 0.1 percent of the number of organizations, but it’s 38.5 percent of the number of /24s, and then the /16. So you add those two together and you’ve got like 87 percent of the space is with folks that really are hard to convince them to put their resources under an agreement.

It is what it is. It’s a long, drawn-out process. We worked very hard at it. Like I said, we have to be very meticulous. We can’t put any risk to the organization. So we’re very careful as we go through this process of trying to recapture space that is just not used and put it, clean it up and put it out for use for our customers through the Wait List.

So there you see the big drop in Q4 of 2025. So there’s an 81 percent reduction since Q1 of 2024, and a 9.6 reduction since Q4 2025.

The step change there, of course, that’s what I was telling you about with DOD coming under an agreement.

So with that, I have completed what I wanted to share and will take any questions.

Ashley Perks: Thanks, John. Get your questions up here. We do have one online question, if we want to pivot to that before we go to the room.

Hollis Kara: Sure, we can go ahead. I’ve got Sean Marvin from Cross Industries, LLC: On extinguishing of IPs, roughly how many of those occur each year?

So how many do we actually extinguish annually on average, if that can be extrapolated on the spot.

John Sweeting: Well, it’s a mixture. So some of it depends on how many people decide they don’t need Internet number resources anymore and they don’t pay their annual invoice, so we reclaim those.

Those also get put on hold for a year in quarantine, and we make sure that they’re not on any bad lists and there’s no IRR objects out there in any of the IRRs, and we clean that up.

As far as the ones we reclaim from this program, from the cohorts, we just went — we started stopping service last year, so we just started using those resources for the Wait List this last quarter, and we actually exhausted the Wait List.

The only people left on the Wait List at that time were people that weren’t eligible on that time. I don’t have a direct number of what that is. I could get that number. I’m looking at Joe back there, and he’s probably working to get a number out of that. But I don’t have that off the top of my head. I imagine it’s somewhere in these numbers.

Hollis Kara: You’re on the wrong slide entirely. Just stay where you are.

Ashley Perks: We can always reach out. We’ll find it.

John Sweeting: All right. I can’t go back. I’m already on the next slide deck. So we’ll get that.

Adair Thaxton: Adair Thaxton, Internet2. By the nature of kind of how Internet2 and our constituents are set up, we have a lot of legacy space. We have a lot of space that is allocated to the state and regional research education networks which has been delegated to the universities and the K-12s and the local museums and so on and so forth.

So given that, are you doing outreach for the cohorts based with consideration of that hierarchical potential allocation? Like, we recently had a school district that appears to have gone into this process. And are you contacting the state research and education network? Are you contacting Internet2? Are you contacting EDUCAUSE? Is there an effort to identify, like, an industry org?

John Sweeting: So I think the one you’re mentioning actually was somebody that went into, signed an LRSA and then for some reason they didn’t pay and their resources got revoked. But, yes, we reach out to all those people.

I do talk to Steve. We do work with Steve, but we can’t give — a lot of the information can’t be shared with him, other than maybe, hey, Steve, these are Internet2, you need to reach out to them and say they need to contact ARIN, there’s something going on.

I can’t tell them if they didn’t pay their bill, we can’t do that. But we’re very meticulous, especially with the educational. We break it out into government, educational, enterprise.

Adair Thaxton: Okay, so there’s a kind of, like a very complex safety net?

John Sweeting: Yeah, and we’re very cautious, very, very cautious, especially if it’s being routed. If it’s being routed, we’re not going to stop service or anything until we contact somebody.

Adair Thaxton: Generally speaking, what is the time frame for resources to be revoked when they’re not being paid?

John Sweeting: It’s in the RSA. It’s at 120 days, we stop services. 180 days overdue, the RSA is terminated and they’re revoked.

Adair Thaxton: I have one more. Sorry. Is there any way to tell when an organization has been put into Cohorts 1 and 2? Is there any indication in Whois that would indicate that they are on that list and we need to step up our efforts?

John Sweeting: No.

Adair Thaxton: Okay. Thank you.

John Sweeting: Kevin.

Kevin Blumberg: Kevin Blumberg, The Wire. —

John Sweeting: I guess, there is one question — if the POCs are CKN, Contact Unknown dash 23, I think it is, or CKN-23, that’s an indication they’re in Cohort 1 because there is no known contact.

Kevin Blumberg: So for a decade we’ve been saying it’s not worth reclaiming the space, and that changed at some point. I didn’t get the memo. That’s fine. I don’t need to get all memos. I actually appreciate getting less from ARIN email-wise. So that’s okay.

John Sweeting: You asked for less email.

Kevin Blumberg: I know, I did ask for less. So I understand that there’s a balance of risk and there’s a balance of this and a balance of that.

What you’re doing with the /24s is a low risk in the grand scheme of things. But my first question is, it’s not that they’re not routed now. When was the last time they were routed, I think, is the magical question. And are you talking 10 years, 20 years, they were never routed?

John Sweeting: That’s one of the things where it says “many factors.” So we’ve broken down that first cohort, never routed, never, no contact ever. Never routed, no contact. Cohort 2, we have, it’s been routed and it hasn’t been routed in the last 20 years, 15, 10, and five.

Kevin Blumberg: So my main thing is, this is not really a policy issue. I don’t want it to be a policy issue, but I want to make sure that if ARIN is reclaiming space and they accidentally reclaim somebody’s space, give it out, that that other person is aggrieved, the first person. I don’t care about whatever. I want to make sure that there’s something to give them. So have a pool available for “oops.”

John Sweeting: You wanted to answer that, I guess?

John Curran: Before we started this project, we recognized the fact that we handled very, very old address blocks — (off microphone) — before we started this project, we took some very specific steps years ago to make sure that in the course of regular registration processing we could make a mistake and have an aggrieved /16 holder show up and say, what did you do to my records two years ago? So we do have contingencies about that, which we reviewed and made sure they were sufficient before John got the green light to go expand it and actually go actively looking at these.

So there’s arrangements made. We have plans, if something were to happen, there’s a way of handling it. It’s a risk management problem. I don’t want to talk about it in detail, but there is a strategy for handling that exact situation.

Kevin Blumberg: The cat’s out of the bag. So /24s are easy; they’re low risk individually. The bigger they get, the more the risk. When the size of the block is greater than ARIN in terms of its valuation, that gets far more scary.

But when people are now chomping at the bit because you did it for /24s, it must be okay to do it for a /8.

John Curran: We have it handled to a /16.

Kevin Blumberg: Right.

John Curran: Going below that, we have identified and spoken with every organization that has the right of (inaudible) block. Don’t expect us to do anything less than a /16. Those, as John said, all identified, and all been discussed.

Kevin Blumberg: That’s wonderful. Thank you.

John Sweeting: And Kevin, the big change wasn’t — it wasn’t like we need to go capture, clean this space and give it out because — it’s the data accuracy problem and the hijacking problems and everything else that if we don’t identify the correct holders of this space, we leave the Internet vulnerable.

Kevin Blumberg: I don’t disagree with this in the slightest. It’s a great project. It’s a culmination of a bunch of stuff, security being one of them. I understand all of that.

But it does open up where the wait list was never really — it’s just going to be some odds and ends. There’s a lot more to it. So from a community point of view, do we need to work on something that accepts the fact that there’s more coming in or just leave things the way they are?

John Sweeting: I think the AC has been advised of that and they’re working on several things with the wait list and all of that. Tina.

Tina Morris: Tina Morris, AWS, also ARIN Board of Trustees. My org does this periodically. We go through acquisitions, partnerships, what not, that they hold IP addresses. And we do this for the protection of the company and the resources, because as they’re acquired, sometimes people stop paying bills.

We found very different states, and oftentimes an organization is still maintaining that space. But we don’t know how long. So we just have to keep just shooting in the dark and doing all that.

I would love a way to put an in case of emergency contact on space. And I think this would apply to the Internet2 thing as well, where they have a list of organizations that they care about, that if they go dark, we can reach out and we can either start the very methodical process of asserting ownership of the space, or we can find the owners and get them to do it. Not an adverse possession situation, just a please let us know before you take action. So that’s one thing. And then my other would be a plea to all the members is, I know we’re a big company, but there’s education. There are partnerships. There are other companies.

The Internet’s been going on for a few years now. And properties have changed ownerships in different aspects. Look at your partners, look at your acquisitions, because you may find some surprises. You may assume they’ve been paying the bills or something and they may not have. Yeah, just better to check.

John Curran: Better to check.

John Sweeting: Thanks, Tina. And like I said, we are very meticulous, very careful with everything.

Tina Morris: I would love emergency, if all else fails, you’ve gone through the process and you’re ready to take some sort of action, contact me situation, and I can provide a list.

John Sweeting: We can definitely look at that. A suggestion would be great so we have it in writing and understand.

Ashley Perks: In the interest of time, let’s just take one more question and we’ll close the queues and you can save any additional ones for Open Mic.

Adair Thaxton: Adair Thaxton, Internet2. I’m fully in support of the emergency contact suggestion, and I can work with Tina on that.

John Sweeting: Perfect. Thank you. (Applause.)

Ashley Perks: A spirited discussion, so far so good. In the interest of time and also our poor transcriptionist, her fingers are falling off, we are going to shift our next presentation to after the break.

So if you want to go get some coffee outside, please do so. We’ll see you back here at 10:50 a.m., and then we’ll follow it up with our IPv6 Task Force, Directory Services and Information Security updates. So enjoy your break.

One more thing, sorry about that. Caribbean attendees, we’d love to take a photo of you with our Government Affairs Department, if you don’t mind, to meet us over here in the corner. We promise it won’t take more than a minute of your time.

(Break)

Ashley Perks: All right. We are going to get started. I know it was a short break.

If you’re still in line for coffee, stay in line, but then just join us when you can. We’ve still got people trickling in. So, we’re just going to give it just a minute or two before we bring up our esteemed Board member, Lee Howard, to talk about the IPv6 Task Force that the Board has started.

So far so good. I’ve got to tell you, I have a coffee delivery service for the espresso bar, and it’s been a lifesaver this morning so far.

All right. I think we are ready. I see Lee is prepping. He’s coming up here. Thanks so much for joining us for the second half of day two. I’d like to introduce to you Lee Howard. He’s on the ARIN Board of Trustees. He’s here to talk about the IPv6 Task Force. So, let’s go.

(Applause.)

IPv6 Task Force Update

Lee Howard: Good morning. ARIN has a Strategic Plan. We’ve talked about that a time or two this week. And a couple of months ago, the Board was going through the items on the Strategic Plan, and one of the items was about IPv6. And we said, well, what should ARIN do to support and promote the adoption of IPv6 in our region?

It actually became a more interesting and fulsome conversation than maybe we had originally planned.

But the first question in response to that question is, should ARIN do anything? Why should ARIN do anything? I wanted to come back to the community and say we think the community has said, please support and promote the adoption of IPv6. That’s a critical question for us to be asking the community right now.

But also – and this is sort of relevant to the presentation John Sweeting just gave – the last set of IPv4 addresses that aren’t under agreement, we don’t know that we have good data, the potential for fraud in that space is kind of high. It’s higher than we might prefer.

So, the more IPv6 adoption we have, the lower the risk of fraud that might come back to harm us or the community. And then finally, this is my engineering opinion, I think single stack is better than dual stack, and I think that single stack and IPv4 is not a great long-term engineering solution.

So, there’s a couple of reasons why we should probably be doing something. Not to say that ARIN isn’t doing something now. That’s a key moment. So ARIN’s already – I’m sorry, am I going too fast?

Hollis Kara: You’re going way too fast.

Lee Howard: I’m so excited.

(YouTube broadcast dropped at this point)

Hollis Kara: I know you’re excited. But just take a breath.

Lee Howard: Thank you, Hollis.

Hollis Kara: Gotcha.

Lee Howard: I will slow down. And I apologize to the transcriptionist.

So ARIN is already doing several things in this space. I would be remiss if I didn’t mention the online course about IPv6 Address Planning.

There’s the focus of ARIN’s outreach in recent times, in particular, has been around network autonomy, having independence from other providers by having your own addresses, and IPv6 means you can have the address space that you need. And also this newer concept of IPv6 mostly.

This is an effort out of the IETF to say, do IPv6-only where you can and IPv4 where you need to. It’s sort of moving past dual stack as a way to move towards IPv6-only without breaking anything that still needs IPv4.

There are two blog series that ARIN has posted over the years. The second one, the case studies, most of those are a little bit older, but several companies that had adopted IPv6 were able to post a blog saying how they did it and how they came to what their successes and lessons learned were.

The newer one is this, the business case studies, Matt Wilder was sort of the curator and proponent of that series and went to people in the community to say what are the business cases? Because there are more than one. Why are people choosing to spend resources adopting IPv6?

It’s a really good blog series, and I say that as a contributor, that I think there’s a lot of useful information there. And part of what I think is especially useful is that different organizations, different networks, will have different reasons to consider IPv6. So there’s a lot of different reasons there that you might see.

Alicia DiCiaccio: Ashley and Lee, we are currently Internet down.

Ashley Perks: I’m just realizing that. If you don’t mind to just take a pause, Lee, we want to make sure we can reconnect for our virtual viewers, because I know they’re very excited to hear about the task force.

Lee Howard: Absolutely.

Alicia DiCiaccio: We will let you know when we are up and running again.

Hollis Kara: This might be a good time for anybody to check their mail, maybe log in for their flights later.

Ashley Perks: The espresso bar does not need Internet to work.

(YouTube recording is reestablished.)

Please stand by. We are working to get you reconnected.

Thank you so much for your patience, everyone. We can keep going. Lee, we’ll add some more time back to your timer and you can go for it.

Lee Howard: Welcome back to everyone who is viewing remotely, appreciate you being here and your patience and being able to come back.

Where I was, I was talking about what ARIN is already doing and has been doing to promote IPv6, ARIN has been to – and this list is just this year of events that ARIN has been to, specifically talking about IPv6.

And so Albuquerque, M³AAWG, FISPA, Midwest Peering Summit, the Midwest Broadband Operators Conference, ISP America, and you also may have been to other events where you’re just seeing an ARIN Help Desk and, of course, they’re always there ready to talk about IPv6 and support people in getting their prefixes and learning what they need to do next.

So, as the Board was looking at the strategic item, we then said, well, we need to ask ourselves what else ARIN should be doing.

So, the first conversation was, we don’t think that awareness is the problem. For a long time, we all said we just need to get out the word and people will adopt.

Well, now every network operator I talk to, whether it’s an enterprise or an ISP or any kind of network, they all say, I’ve heard IPv6 that’s not the issue. But then they give me a list of why they’re not moving forward on adopting it. So, we’re trying to figure out that list, the reasons they’re not adopting it.

The task force has been impaneled to recommend the structure of the IPv6 program. So, we’re really looking right now more at the how do we collect the obstacles and issues that ARIN should be working on more than the what are those issues that we should be working on. That does not mean that I don’t want your suggestions. I do want your suggestions for what are the issues that we should work on. But right now I’m also thinking a lot about how do we put together a program to work on those issues.

And then finally, this is sort of a summary of the charter, finally, how do we know whether it’s working? Whatever program we put together, how do we know if it’s being effective? Those will be our metrics of success.

And part of this, we know is going to be – part of the reason ARIN is a uniquely valuable place to do some of this work, is its ability to convene community.

So, there’s got to be some level of community coordination. We’re specifically tasked, we the task force, are specifically tasked with figuring out how do we get the community together to provide mutual support.

Maybe there’s an online chat platform we should be using where somebody can log in say, hey, I’m seeing this weird thing, what am I doing wrong? Can anybody help me? And we can provide mutual support.

If we have that kind of platform, though, we have to figure out, how do we provide moderation? How do we make sure there’s a code of conduct and people are behaving appropriately and providing the right kind of support?

What do we do in terms of that larger what do we do, what’s the program plan for engaging in solving those kinds of problems? And then the task force is tasked to advise ARIN, to tell ARIN what they should be doing in terms of longer-term advocacy.

Should ARIN be engaging with the public sector, with governments, with other kinds of organizations, not just the network operators.

So, it’s still open questions that we’re here to ask for support on. So, we need your input. The task force consists of me and Rob Seastrom and Tina Morris. That’s where we are right now.

We absolutely need feedback from the community, your input, to say what should we do, how should we do it, so that we can better serve the community. That’s what I’m looking for. So, I’m open to thoughts, suggestions, questions, and we’ll worry about timing, see what we have.

There’s a guy over there I’ve seen before at the mic.

Kevin Blumberg: Kevin Blumberg, The Wire. You can’t come at this straight anymore, Lee, from forward. It’s a sideways sort of thing.

The issue is that IPv6 has reached critical mass. Those that have done it have done it. And those that are left don’t have any reason to do it. In their minds.

And we did this at the Internet Exchange from a point of view of looking at enterprises and talking to them, and it became three years of hand holding; 84 meetings with one enterprise. You’ll never make your money back because of how long it took.

Until there’s a actual reason and not doing – doing the right thing is not a reason. That’s an expense. That’s a cost center. And that reason may be insurance. It may be government. It may be security. There may be a whole different set of reasons. Until that exists, I hope this group is spending a very small budget because really you’re shouting at windmills.

At this point, ARIN has done a phenomenal job getting that messaging out. Those that are left now, you’re going to be shouting at windmills until there’s an actual financial reason for them to commit resources to doing these projects. And hopefully you can find what that is.

Lee Howard: I hear you. I hear that a lot that the business case is the biggest problem to solve. And that may be someplace where we need to spend some time focusing on, and I look forward to people’s thoughts and ideas.

I also hear people saying, well, I’d like to do IPv6 but. And then it’s the whatever comes after the but is the stuff that – there’s still people out there who are in that space as well.

There’s a point of diminishing returns. I don’t know where it is. But I don’t think that the only obstacle is the business case.

Matthew Wilder: Matthew Wilder, TELUS. I would say I would like to see the task force focus on maximizing return on invested effort. It probably goes without saying, but it is easy, as Kevin mentioned, to put a lot out there and not necessarily get a lot back for that effort.

A lot of thinking maybe should go into looking for the opportunities where we expect we could get some return.

I’ll give an example. We know, I think, from looking at enterprise being a tougher use case. Maybe that’s not where the effort needs to go, but if we look at eyeball networks, more and more we see CGN, we want to see maybe more IPv6 deployment for the end sites or services that those users are accessing.

How do we access those people? Talk to the right folks. Make it easy for them. I think I’d like to see some work around that.

Lee Howard: Great. Thank you. I appreciate that. I do hear very clearly from both you and Kevin, don’t overinvest in this space because we could easily be not using member funds in the best possible, most efficient way. So that’s a clear message, and I hear that.

Annika Snead: Annika Snead, Hibbits. I’m on the enterprise side. I totally agree on what they both say.

I think from the ISP side, you guys kind of did everything what it is, but it’s really the business justification.

If I just say “IPv6” in a meeting, everybody literally freaks out. I would say we don’t have any production or anything, and our problem’s already that we have a lot of application owners pushing back because we still have application which have hardcoded IPv4 addresses.

We have applications which are not IPv6 capable. Then, of course, to tell my boss, like, hey, let’s kind of start flipping over, nobody wants to have to run a dual stack.

A lot of people within the organizations are uneducated and are just scared of it. And the other point is like why should I change it – like, why fix it if it’s not broken?

Lee Howard: Absolutely.

Annika Snead: So, I think it’s more on the enterprise side to kind of start pushing. I don’t think there’s anything from the ISP side you guys really have to start pushing.

Lee Howard: There are definitely ISPs that have not adopted IPv6. We’re in a pretty good place. The largest ISPs in the region have. But there are a few that have not, and they tend to be more the medium to small size. But as soon as you get into the medium to small size, we’re absolutely talking about enterprise networks, yes. And it is a different set of challenges.

And it’s really interesting to talk to people in our community, which tends to be heavier on the carrier and hyperscalers community than in enterprise networking, which is why we need enterprise participation.

Anybody online?

Ashley Perks: No, we have nobody online. I think that will be it for you, Lee. Thank you so much.

Lee Howard: Thank you very much. Please come find us.

(Applause.)

Ashley Perks: Okay. If you’ve been missing her, she’s back. Here comes Hollis Kara to give us an update on the ARIN Directory Services Roadmap.

(Applause.)

Directory Services at ARIN

Hollis Kara: Kind of like a bad penny, I keep turning up.

All right. So, before I get started, something I feel like we’ve been leaning into all this meeting is how this is really yours. Right? We talked about it yesterday. It’s your meeting. It’s your policy.

As staff, we manage and run the registry, but we do it on your behalf and at your behest.

Mostly. There are some things that we have to do.

One of the things we’ve also talked a bit about today was the Consultation and Suggestion Process. That’s been mentioned a number of times. Please put it in as a suggestion so that it can be logged and moved through the pipeline in a normal way.

So, a little bit earlier, this fall, August/September, we actually ran a consultation on directory services, what we’re going to be doing going forward, and put forward a plan that we thought was just kind of a proposal to see what folks felt about how we could maybe consolidate those services.

And based on your feedback, we’ve adjusted that plan. I’m here to kind of walk you through what we proposed, which was that we have a multitude of data access services and we want to consolidate. The end-state goal is that RDAP be the primary way of doing that, single directory service that we are managing and maintaining.

There are a couple reasons why we want to get to that state. One, supporting multiple services has cost. It takes staff. It’s equipment. Also creates more attack surface for the organization; the more ways you have in, the more ways people can think to do things that you don’t want them to do.

So, we’re looking toward how we move to consolidate to a single directory service. And so we went out and we asked you that question. We posted it on the ARIN Consult Mailing List and on the website, and we also cross-posted to NANOG.

One thing I’ll point out that was interesting to me with this is we saw so much more participation on the NANOG thread. Not sure what that tells me, but it’s something for me to noodle on. And afterward, we kind of came back, we took all the input, and we mashed it together and we have three kind of distinct paths forward.

I’m breaking this into the different services for how we’re going to proceed. We had a proposal for RWhois. Everybody was pretty okay with that.

We had a proposal for how we can move off of Whois-RWS, which is ARIN’s homegrown service that we’ve had for about 15 years now. We had a little bit of suggestions there, so we’ve tweaked that a bit.

And the one that was the big topic of conversation was Port 43 Whois. Lots of feedback.

And we’re taking that one all the way back to the drawing board. But let’s talk through it.

For RWhois, nobody really objected to making that go away. Everybody was very in line with creating a migration tool for people who still want to use it. But basically, yeah, sure, you can do that. So, guess what? We’re going to do it.

What that means next is that we need to get on the engineering roadmap, get the work prioritized and done to build out that migration tool.

Also to identify some sources for open source’s RDAP servers that we can recommend folks use.

Once that work is done, that’s where the timer starts, and that’s when you’re going to see a concerted effort from our Customer Technical Services team and Communications to work with customers who we can identify who are using RWhois to inform them of this plan change, where to migrate, where to find the migration tool. We’re not going to do it for you, but we’re going to tell you where it is. We’re going to point you in that direction and make sure that you’re on that path, and then we’re also going to be running about a year-long campaign publicly to say, hey, it’s going away. Come back in a few months. Remember we said it’s going to go away. Really going to go away. We’ll get there and say, yay, it’s gone. That’s the plan.

For Whois-RWS, it’s a little stickier. I’ve chosen to divide this out into half. Didn’t have to. I chose to. Into the two separate services. We have the API, and we have the web interface. The API, we’ve actually done a lot of work on over the last few years. But there’s still some tweaks, and we got some feedback on that.

Before we can switch off the old API for Whois-RWS we’re going to close those gaps and we’re also going to – let me skip ahead. We’re going to also do some updates on our documentation and outreach with some of the customers who use that to make sure they understand.

Now, bear in mind that parity does not mean identical, right? So what you’re going to get out of Whois – sorry, out of the RDAP API and also the advanced search UI eventually, is not going to look exactly the same, but the features are going to be there, and we’re going to help you with understanding how to use the new one to get what you got out of the old one, even though it’s going to maybe have different labels and things like that.

So that’s the API. So, we’re pretty good to keep working ahead toward that. The changes that still need to happen with that are pretty subtle. As soon as those are done, we’re going to be moving toward switching off the old Whois-RWS API.

Now, the UI is a little trickier. I’m really pleased with the solution that we’ve come up with for that.

So, I don’t know if folks have paid attention or have noticed, but when you go to the ARIN website and you search Whois there, you’re actually searching RDAP. And that RDAP search doesn’t have – it’s a pretty basic, has some of the main queries, but it doesn’t have any kind of advanced search function.

We’ve added those advanced searches to the API. We have not added them to the UI.

When we switched to that, we actually left whois.arin.net available, which is what has the advanced Whois-RWS search. We didn’t take that away. We thought we could. We found out we couldn’t because there were things that people needed to do and that they relied on. So, we’ve left that up.

And it’s been seven years. We don’t want to leave ourselves in that state. So as a solution, what we’re preparing to do and what we’re working on now is a beta advanced search for RDAP, the RDAP UI.

Once that’s available, we’re going to publish that, and we’re going to leave whois.arin.net right where it is. We’ll be asking you to please go check out the RDAP advanced search. We’ll be asking folks who use RDAP search now to take a look at that.

During the course of that beta period, we’re going to be refining that. We’ll be looking for input from you on how we can make that search functionality work better. Going to give it at least six months, depending on what we’re seeing, we may extend that longer.

We will communicate to you fully what we plan to do as that evolves. But eventually, the end goal is that we will just redirect all the traffic from whois.arin.net to the new RDAP advanced search and that’s kind of going to gracefully go away, but we’ll do it with you to make sure that it meets your needs.

Which brings us to Port 43 Whois. This is where the lion’s share of the conversation happened. And there were some sections – some suggestions that, well, maybe you put a proxy in front of it. Guess what, a proxy just adds another thing to maintain and take care of. So it’s actually making more work instead of less. So that’s not feeling like a good solution for us.

There was talk about the security question of whether the Port 43 not being particularly secure, in any way secure, was a problem for ARIN to solve or something that the user is taking on with their own knowledge.

Also the backward compatibility. This community loves to talk about backward community – backward community – nope – backward compatibility and why and how that can’t be achieved. Or well, wish we thought of it sooner.

And the bigger more practical topics around the fact that we aren’t seeing RDAP as a built-in client in a lot of OS distributions. It’s not there yet publicly. So if you turn off Port 43, what are you going to break? And the answer is we can’t really know because we don’t necessarily know where people have that in their scripts and how they’re using it.

And it’s really pretty much impossible to figure that out.

People are like, okay, you’re going to communicate about this, but to who? If you don’t know who it is, how do you tell them?

I’m pretty good at communications. I can’t figure that one out. And, well, let’s look at the data and see what we can figure out. And guess what, most of the queries that are coming into Port 43 are coming from cloud-level providers.

We can’t trace that back beyond that point. So we really don’t know. But we do know that there’s still more volume on Port 43 than there is on RDAP, and that’s something that folks definitely wanted to see flip flopped before we even start talking about taking it away. So again, tooling is not shipped by default. We don’t have a good way to find everybody who’s doing this to get them to make changes before turning off something that might break things for people, which is never a good look.

And just maybe right now is not a compelling justification to turn off a service that works. So, yeah, kind of covered that. Kind of covered that.

I’m pulling a John Sweeting. John, I’ve been around you too long. I’m talking ahead of my slides. Geez ‘ol pete.

Okay. Here we go. So to wrap up, essentially, based upon the outcome of the consultation, the verdict is such.

We are going to proceed with RWhois retirement, pretty much the way we told you we were going to do. So keep an eye out. That’s coming. We’ll be communicating it.

The Whois-RWS API, similar story. We will be finishing up the work to make sure we have parity with the API and we can start taking that away.

The UI is going to be a longer path, but be on the lookout. We’re going to have a beta of an RDAP Advanced Search available, hopefully soon-ish. They’re working. Once we do, that will start the clock for us getting that input we need for you and being able to figure out when we can actually take that whois.arin.net search option away.

And Port 43, what about that guy? We heard you. It’s on hold. We’re going to monitor for the things you asked us to monitor for. We’re going to be keeping track and looking for that becoming a default in the OS distributions. We’re going to be monitoring traffic, and when we see that we have kind of reached the tipping point that you thought might be a good point to even start talking about turning it off, then we’ll bring it back to the community and see if you’re ready.

That’s where we landed. Does anybody have any questions about any of that?

I do reserve the right to phone a friend for anything that’s super technical. Go ahead, Kevin.

Kevin Blumberg: Kevin Blumberg, The Wire. No, this won’t be technical. Whois, really glad it’s not being turned off right now.

But more importantly, what none of these slides really said is, there needs to be consistency among the regions. If ARIN turns off Whois and everybody else leaves it on, we will be the ugly stepchild that turned it off, and they won’t understand why. Why can other regions do it and not them?

To me, Whois is a basic service, till it’s not. But for right now, it’s a basic service and it needs to be consistent among the regions.

What I would love for you to do is come up with a 10-year sunset for Whois among all the regions and actually commit to it so that the OS distributions, et cetera, get RDAP in there so that when you deploy five years from now, 10 years from now, you’re okay, because it’s going to literally be that long.

But if you don’t actually set a 10-year window, if you say in a year and you bluff and then you bluff and you bluff again, I think with Whois you need a 10-year outlook, but it needs to be all of the regions. It needs to be baked into what the basic services of the directory services are of all the regions and then there needs to be a sunset for all the regions. Thank you.

Hollis Kara: Thank you.

Adam Augustine: Adam Augustine, representing myself. Having run into similar issues with applications and various large organizations that I deal with, when you don’t know who to communicate with, you are forced to do what we call a scream test, which is something we picked up from Microsoft. You shut the service down for a brief period of time, see who screams, and bring it back up again.

We’re not at that point today – I’m not suggesting we do that – but at some point, it’s something to consider.

Hollis Kara: Good idea. Thank you.

Ashley Perks: We do have a question from online, Hollis.

Hollis Kara: Okay, go ahead.

Ashley Perks: Anthony Delacruz, Lumen. “Super happy to see my main concern item, getting the breakouts of those more specific CIDRs and other lookups noted onto the slide deck. Sign me up for the beta testing. Whoo!”

Exactly what he said.

(Laughter)

Hollis Kara: Anthony, appreciate your enthusiasm. We’ll sign you up.

Adam Augustine: Adam Augustine again.

Something else that occurred to me. We have a place to notify users who are using the Whois Port 43 service, and that’s in the banner at the top of every single Whois query, there’s some notes. Let’s start there. Start putting it in there.

Then, because that’s probably filtered out by most scripts, we add a noncommented line, a nonhashed line, and maybe do the scream test similarly, because that will disrupt, potentially, some of the parsing that happens, but maybe that’s a good thing, and you do it for an hour one day and then you wait a month and you do it for another hour.

People will start noticing. They’ll adjust. They’ll know at least. Just some ideas.

Hollis Kara: All right. Garth, did you write that one down? Garth got that one. Thanks. Go ahead.

Roman Tatarnikov: Roman Tatarnikov, IntLos. To think about it, most people who use Whois, they’re using automated scripts, and they’re not doing queries themselves. They use some kind of Python module or some other already premade solution.

So what might help is reaching out to developers or repo admins for various Linux software and talking to them like, hey, this module that you have that is using Whois, can you bake into it as a transition that even when someone uses the module that says Whois, but to give an option to use RDAP or something like that.

Because this way, a lot of people will just do the upgrades. They won’t care about what software does, as long as it works, and slowly but surely we can see the amount of queries on Whois go down and RDAP go up. That’s just one of the suggestions.

But I really hope that Whois is going to be sunset. It was very interesting to see this conversation on PPML. There was a lot.

Hollis Kara: It was lively. Thank you.

Appreciate the input. That’s a good idea. Anything else? Got anything else?

Ashley Perks: No, we’re good.

Hollis Kara: Awesome. Well, thank you very much, everyone. I will go sit back down.

(Applause.)

Ashley Perks: All right. We’re at our last presentation for the meeting before Open Mic. I’d like to invite Christian Johnson, our Chief Information Security Officer, to come up here and give an update on ARIN’s Information Security. Also a good reminder to change your passwords.

Information Security Update

Christian Johnson: Thank you. And good morning. I am going to try to move through these slides swiftly but not talk too fast, so wish me good luck.

Very quickly, we’re going to talk very briefly over some compliance initiatives that we have ongoing, give some general program updates for security, and then a little bit of a different take. We have some security information at ARIN.net I want to cover. And you’ll understand what I mean by “a little different” when we get there.

Compliance initiatives. We all know, or maybe we don’t all know, but I cover this each time I get up here. We have two main focuses for our security compliance, and that is the SOC 2 program that we run and the PCI DSS program that we run.

This year is the first year that we have folded ARIN Online into the SOC 2 program. I would love to be able to stand up here and say that we’ve got, that the audit is complete and that we’ve got the report in hand. And because it is a much larger audit this year with the addition of ARIN Online, it’s not complete yet.

We are right at the tail end, but we are hoping that within the next few weeks, within a month, that I’ll be able to report that we have the report in hand and that it will be available at your request.

So the scope for our SOC 2 program going forward, right now anyway, is ARIN Online and RPKI. The PCI DSS program covers the payment card environment within ARIN Online.

Both of those have specific focuses, but then they also include this little blurb down at the bottom. It used to be organization-wide controls, and there was a question at ARIN 57 about what that really meant.

And so I’ve sort of expanded the language to say it also includes controls across all of the departments of the company. But I also realize that that’s probably not — doesn’t say a whole lot either. So I included the next slide that talks about where the SOC 2 controls come from. And there’s a bunch of percentages on there.

It’s actually two different ways of looking at the data. ARIN has about 217 security controls that we look at from environmental security, physical security, personnel security, system security, you name it. About 217 separate controls that we monitor.

Just over a quarter of those are controls that are more general and cover the entire organization. Almost a quarter of those are product- or service-specific that we look at, in this case, ARIN Online, RPKI. And then there’s the rest of that, over half looks at both, has controls that apply both to the organization and to the specific services.

If you break it down by department, you can see the percentages down there. 60 percent of that comes from engineering. HR has percentages. Finance. We pull controls from the CXO Department. Governance pieces that we pull. Policies. How we do things, and the controls that we have in place coming from the InfoSec Department.

But even though it breaks out like that, there is a lot of evidence that actually comes from multiple departments to satisfy an individual control.

So while I put the percentages in there, that might be a little misleading because in some of these cases, 217 security controls, those might have 50 or more pieces of evidence that we provide for each individual control.

Some of them might be one piece, some of them, literally, I have some that provide over 50 pieces of evidence, screenshots of configurations, for example, that we have to provide so that the auditor can validate those things.

Some general program updates. We’ve talked about these before. We do all the fundamental stuff, like I’m doing annual security training that we provide to new hires also when they come on board. We do monthly phishing defense training. Those are literally emails that we send out to staff to keep everybody on their toes about the threats that can actually land in their inbox.

We also do monthly vulnerability scanning, reviewing those results that we get each month from the scans, and then actually doing the mitigations.

That doesn’t take into consideration the actual updates, the critical updates that arise that we try to address immediately.

We’re also doing monthly web malware scans of ARIN.net. Board and internal incident response and business continuity exercises that we undertake.

Obviously this was the first year of adding ARIN Online in, so there was a substantial amount of work just to get it to the point where we could run it through the audit. And then we also support ARIN’s Risk and Cybersecurity Committee.

New and upcoming initiatives. So in 2026, we enhanced overall our monthly vulnerability scan reviews. We know, if you’re following the news, there is an increase in tempo for vulnerabilities being turned over, and if you have any contact with your IT support folks, they are churning through vulnerabilities that are coming from Microsoft, from Adobe, from a lot of vendors that are identifying vulnerabilities at a much faster rate than we have in years past.

And so we have adopted some tools that help us to review our vulnerabilities and triage them, sort of aligns with our risk-based vulnerability management program.

I mentioned before that we’re doing background checks on all of our staff. The tentative completion schedule for that was to have it done by the end of the year. We’re working through that.

That may spill over into Q1, TBD, but we’re still tentatively focused on completing that by the end of the year. We normally run it during the earlier part of the year, early summer, but our annual security penetration testing is actually ongoing right now. So normally I would also say that we had done that and that was accomplished, but that’s ongoing. We hope to have that done by the middle of December, before the holidays, for everybody’s sake.

Security information at @ARIN.net. This was my placeholder that I mentioned earlier. There’s been a little change here. I’m actually very excited to be able to announce it.

I’ve talked about before, if you’re interested or your company is interested in what ARIN does for security, you can go to our information security at ARIN page. That’s located at ARIN.net.

It provides information around our data security practices, what we do to secure your data. What you can do to secure your data. It also provides a copy of our SOC 3 report. If you’re not familiar, the SOC 3 report is just a publicly releasable version of our SOC 2 Type 2 report from the audit that I was talking about earlier. That was great. That met our needs going forward.

What we have been able to stand up this year at ARIN, I’m very happy to be the one that can actually announce this, is that ARIN created, stood up a Trust Center.

You have probably seen this is a trend that is going on with a number of companies where they are creating centralized information around their security program and general administrative data that may not be related to their products or services but more about the company itself. And that’s what we have here.

We’ve taken the information that was available at “InfoSec at ARIN,” we’ve reorganized it, cleaned it up, presented it in a different way.

We’ve also added new information, information about the types of security policies that we have, more information around security practices that we’re running, as well as general program information.

Now, as the CISO for ARIN, I’m looking at all of the security policies and the practices that we have, but I’m also a consumer of our vendors’ data. And so when I go out, it makes it a lot easier for me if they have their organization organize their data in this way.

And so it actually works out very well for us to be able to say that we’re doing that for the rest of the community as well. I think it’s much better organized on the website, provides more information, and you can — I don’t think that there’s anything that’s been taken down. We’ve only added information to it.

And so I think it’s been a real benefit to have that go up this year, and to the survey results that were asking that we do a better job at communicating what we do for security, that was a comment that we got back before we had pushed this out. So I’m hoping that this makes a little progress in that area.

And I believe that was my last slide. So pending your questions…

Ashley Perks: If you have any questions, go ahead and line up to the microphones or start typing virtually. Looks like we’ve got one coming up to the mic.

Adair Thaxton: Were you guys or any of the services that ARIN offers affected by the certificate authority thing that came out earlier this week? Sorry, Adair, Internet2.

The certificate authority, with the 4—

Christian Johnson: Were we impacted, is that your question? No. I will say this — and neither cases, also the, is it the PHP, as well as the certificate thing, both sort of dropped at the same time, not directly impacted by either.

But in these situations, it’s always a good opportunity for us to sort of reflect on how we do things and the initial [deep breath] took place, okay, good; didn’t have to worry about that. But it also does give us an opportunity to sort of reflect and say, are there areas where we could do some things better? Are there some things to consider? And we’re in that phase of it right now.

Adair Thaxton: Thank you.

Christian Johnson: You’re welcome.

Kevin Blumberg: Kevin Blumberg, The Wire. A little bit towards Adair. Everything has become zero day, unfortunately, today.

The fact that you weren’t impacted by PHP. It’s the big one this week. Great. Wonderful. There were 850 CVEs last week and the week before.

It’s no longer about whether you were impacted, it’s now actually about whether your vendors were impacted, because that is what we are now starting to see, is where vendor impact has a greater attack surface, because our society has become one of convenience.

So I’m actually curious, are you looking at shrinking the number of services that you use as an organization over time to cut that third-party attack surface? Sort of like a reconciliation, no, we don’t need 18 versions of the same thing; we will focus on one.

Christian Johnson: Sure, that’s a great point. Directly to the question that you asked, I don’t think that we’re currently looking at shrinking our vendor pool, if you will.

We’re definitely — I think most people are doing this — paying closer attention to our third-party vendors and how they’re doing security, to the same point that I was talking about with the Trust Center and me going out and being — we’re going out before we even bring vendors on and reviewing their security. But even that, to your point, is not enough, because from tomorrow to today, the environment can change dramatically.

We are looking at and trying to track those vendors that we have, or that we’re considering, to keep the pulse of what their security steps are and those changes. We’re not currently looking at shrinking our vendors, but that doesn’t mean that we won’t be tomorrow.

Kevin Blumberg: Thank you.

Ashley Perks: Hollis, are we clear on the queue for Christian? We have one more question coming up. Hang on.

Lee Howard: Hi. Lee Howard, ARIN Board of Trustees in this case, because I just wanted to add to your response that the Whois project that Hollis was talking about, the Directory Services project that Hollis was talking about, is an example of trying to reduce the number of surfaces — services to reduce attack surface.

We do — the Risk Committee of the Board does look at the services that ARIN is providing more than is consuming as potential attack surface. What else can we look at to reduce our overall risk.

So definitely not in conflict with what you said, but sort of the other side of the thing to look at.

Christian Johnson: That’s a good point. Thank you, Lee.

Hollis Kara: Nothing online.

Ashley Perks: Well, I think you’re good, Christian. Thank you so much.

All right. We are open up for Open Microphone. If birthday girl Nancy and John Curran would like to come up to lead this, that would be great. Get your questions in the queue. Start lining up.

Open Microphone

John Curran: Microphones are open. Yes.

Mike Burns: Mike Burns, IPTrading. At the last meeting, I think it was, at the Open Mic, I pointed out the difficulty in searching the PPML. It’s just hard to search.

But since then, at least ChatGPT can do it. I don’t know if something changed there or somewhere else. But it is available.

But the second thing I wanted to mention was – and it relates to some postings on the AFRINIC policy list, which really seem to be AI-generated. And it’s probably going to come here as well.

People are going to either use AI to refine their posts or to actually write their posts, and I kind of want to know what the community thinks about that.

My argument was that, wherever the argument comes from, ad hominem means that we have to deal with the argument and not the source.

John Curran: Exactly.

Mike Burns: So, I don’t know. I’ve been thinking about different ways that AI would intersect with policy development. And I’m wondering if AI could be used as a devil’s advocate. It can’t vote, but it can review other arguments, kind of like Ask Grok or something.

John Curran: Let’s first talk about good policy development. I’ll note that this is something that’s evolved in each of the RIRs and at ICANN and at the IETF of what makes good policy deliberation.

I will tell you that I can say what the ARIN PDP is and what my own beliefs are. But this is ultimately yours to set. We’ve always taken the view at ARIN that it is the substance of the argument and not the number of times we receive it.

Also, the source of the argument is not relevant. If a dog is able to type at the keyboard but they give the insight that lets us finally refine the waiting list, then I welcome it, okay. More dog food to them.

So, the fact of the matter is a good idea is a good idea no matter where it comes from. So, when people use AI, there are people who use AI to clarify their speaking. They may not be a native speaker. They may have just – they know they’re not particularly persuasive, and so there’s nothing wrong with that, per se. But having the same argument presented repeatedly with slightly different variations, that doesn’t advance the conversation.

So, my own take, I believe the PDP says the same thing, is that we’re agnostic according to the source.

But at the end of the day, it’s the argument that’s put forth. We have something the other regions don’t have. Our policy process is administered by the ARIN AC. The ARIN AC is quite capable of looking at the actual arguments presented and the reasoning and the discussion and deciding whether or not that resonated.

The fact of the matter is that it’s one of the reasons we don’t, per se, vote on policy proposals, because you could – if you did a strict vote, you would end up with, okay, how many people on this email list are voting? Oh, well, we have 95 very similar responses voting yea or nay.

In a meeting, specifically to consider a proposal like this, at the end of presenting, in a dynamic interactive environment, we’ll do a show of support because we know the people participated and we know that they are interested enough to be in that session.

Doing the same thing via email over a balloting process, with the world of AI, you wouldn’t get necessarily a meaningful number. So, we do it after deliberation, a show of support. Our AC is capable of filtering duplicates that could occur on the Mailing List.

I don’t think we have the same risk factors, but that’s my own view.

Mike Burns: There’s a follow-up. Is this something we can discuss on the PPML list, or should it be somewhere else?

John Curran: The tools for AI?

Mike Burns: Using AI as it intersects, as you say, with policy development. I mean, you could abuse AI and just word things, the same argument, differently, and flood the list. Which I assume there is some moderation capability to exclude those.

But I don’t know how people feel about AI posting directly to the list or detecting AI posts and whether that’s of some value.

John Curran: You say AI posting directly, an agent with no actual identity behind it?

Mike Burns: Correct.

John Curran: Oh, well we actually have that covered as well. Note that we require attribution of posts back to an actual human being. We don’t take anonymous posts. We don’t take agentic posts. It would be up to the AC if they wanted to propose a PDP change otherwise.

Mike Burns: Right. I will note that in AFRINIC, these apparently AI posts were attached to real people but they were like a cashier at a supermarket or something like that. They had a real identity, but they obviously weren’t posting. It seems like something we should consider.

John Curran: Presently, our AUP would prohibit such, if it was just repeated; it’s not adding anything to the conversation.

Mike Burns: What about the idea that AI posts are kind of detectible by other software now? Is it something that should be employed by the AC to determine which post was AI-generated, which wasn’t?

John Curran: We haven’t had the problem, so we haven’t had to look for detection. If the AC says they need a tool, the tools are out there, we’re happy to go get them. But it’s up to the AC as to whether they would need that to facilitate that discussion.

Mike Burns: And it’s not really up to the policy development community?

John Curran: I’m not hearing a change to the policy development being proposed.

Mike Burns: I’m not proposing anything. I’m just looking down the road a little and trying to lay some foundation.

John Curran: As I said, if the AC wants a tool and they think they need it, absolutely, we’ll get them a tool. But the PDP is pretty clear on how we handle duplicative comments and anonymous –

Mike Burns: Yeah, duplicate and anonymous is just one component of this. But thank you.

John Sweeting: John Sweeting, ARIN CXO. I just have some numbers for that online question. In 2025, ARIN distributed 2,241 /24s to 892 organizations via the wait list via the extinguishment, rights extinguishment process. And to date – well, through third quarter this year, it’s 1,999 /24s to 857 organizations, with Q4 still coming up.

Just for anybody that qualifies for the wait list that has a need for some IPv4, I would just urge you to take the time to put in a request for this quarter.

John Curran: And consider whether or not you need more than a /24 and you want to wait, because /24s are being recovered. /23s and /22s are rare. So, the people who say I want to be on the wait list, I don’t want to accept the /24, are stepping out of the current of addresses coming back.

Leif – John’s staff. He doesn’t count.

Leif Sawyer: Leif Sawyer, ARIN Advisory Council. I was remiss yesterday. I missed something during my presentation of 2025-1, and that’s to acknowledge my co-shepherd Elizabeth Goodson and the work that she did. So, thank you.

(Applause.)

John Curran: Very good. Opposite mic. Go ahead.

Kevin Blumberg: Kevin Blumberg, The Wire.

AI is a real problem. And I love AI. I absolutely love it for cleaning up. But saying that, I do not need to argue with a hallucinating agent, and the PPML has had those. They have had arguments that were taken from, again, backing them out, they were taken from posts from 2013 from discounted theories back then and they’re treating them as the reality and the truth.

I do not need to argue with hallucinations. Cleaning up and using AI for that, I have no problem with that. I have a problem with pseudonyms, and we have those on the PPML, and that needs to be seriously addressed. We have attribution problems, and we have hallucinations.

We need to look at what the education industry is doing in regards to that and, unfortunately, K-12 to universities have had a huge issue with out and out theft of ideas and a number of issues with just complete garbage. And they’ve had to fire students. Sorry, that’s not allowed.

They’ve set up rules. Are the rules followed? Don’t know. But we need to do a better job and not just say AI is a reality and deal with it and actually say, no, this is harmful to having discourse.

John Curran: In which case, Kevin, are you proposing change to the PDP, or you think we need tools? What specifically do you want? Because I need a hard proposal here.

Kevin Blumberg: I’m saying instead of trying to force IPv6 on enterprises that don’t want it, I think our policy process is at greater risk by AI today – and I’m a supporter of it.

John Curran: And so what should be done about that risk?

Kevin Blumberg: Figure it out. I’m saying spin up something and figure it out, because I don’t have the answer.

John Curran: Okay. I don’t have the answer either. So, let’s talk about that. Let’s get people who have the answer to make suggestions.

Kevin Blumberg: All I’ve seen is the issues, John, and they are far more prevalent, if you look, than I think we’d like them to be, as much as we admit them. I think we need to take a strong view of, how as a community, what we consider acceptable. And I don’t have the answer to what that is.

There may be people who want – I want to run my agentic bot and have it argue with Kevin Blumberg at The Wire for the next six months. Kevin Blumberg at The Wire will not be arguing with bots.

John Curran: Okay. Yes.

Lee Howard: Thank you. Lee Howard. I did want to respond to both Mike and Kevin on this because what I’m hearing is a request to review the moderation policy on PPML, not the Policy Development Process.

That’s the specific thing that I’m hearing a request for, right? I don’t know what the moderation modification is yet. So, I think we will take that back. Absolutely.

John Curran: Right. And if that’s what we need to do, we’re happy to do it. Let’s get – the community needs to get a little more specific on it.

Lee Howard: Do you think PPML is the place to have that conversation?

John Curran: Yes. Absolutely.

Hollis Kara: We have an online comment on the same topic from Alan Rowley of Citizen Support, LLC.

He says, “I would say no use of AI as if used it would cause issues with legal and clarity of policy and more. Simple misinformation is if AI does not know the answer, it will make up an answer and state it as correct even when it is made up. Also, it will change data when it misunderstands it, for example, using data from Reddit instead of the same ARIN policy and more examples, et cetera.”

John Curran: Thank you. Next.

Betty Fausta: Betty Fausta, Fellow, IPEOS. I just want to thank the ARIN community to welcome our Fellows, and particularly the team of ARIN care about Fellows. And it was really interesting. And a special thanks to my mentor, Nancy. She’s very grateful, and she speaks slowly for me because my first language is French and it’s not easy every time.

Secondly, I want to share some consideration. I talk with a lot of ISP in my region – I’m from Caribbean. People from St. Martin are French. ISP told about consideration of child abuse and some traffic, human traffic linked to allocation of IP.

There is a real problem to note, to tag bad behavior. So, this is one of my considerations.

I don’t know which committee or if it’s really a consideration now for ARIN, but just I want to put this information now.

John Curran: Thank you. Next.

Achie Atienza: Achie Atienza from APNIC. First thing’s first: Happy birthday, Nancy.

This will be on the lighter side. So really appreciate the interaction here. So, we have some notes to take back to the community from our side.

That would be very much appreciated.

The homework that we got here is totally worth it for the 20 hours plus of travel we did from Asia. Maybe if you want to do the same all the way back, you can come to APRICOT Hong Kong next year and also in Mongolia by September.

John Curran: Thank you. Yes.

(Applause.)

Far microphone.

Tina Morris: Tina Morris, AWS, and I will join you in Hong Kong.

So, something from yesterday – also, Board candidate, current Board member, all those things.

Something from yesterday that kind of bothered me – I think those of you who have been part of the community for a while know the background of this, but we had, during our congratulation period, we had – and some other talks – we had a lot of people talk about volunteering in multiple roles at ARIN and other organizations.

It started to sound a little bit like, if you do this role, then you get that role. And that bothered me a little bit. I thought it was a little too simplistic and doesn’t appreciate all the work people have done and the growth they’ve done in their day jobs and through other trainings and just personal determination.

So, I wanted to kind of take a moment to say thank you to our volunteers that have done all that work to grow, and to also anybody that’s considering doing things, it’s a long path. And when people serve for 10 years in one role, they learn a lot of skills. And then they can sometimes take that to a different role and sometimes take it back to their company or whatever.

But just to say because you were the AC chair, then you go to the Board, and then you go to the NRO or ICANN or whatever, that’s just not how it works. I felt like we really simplified it yesterday by showing so many wonderful examples of volunteers we have in our community that have done so many different roles.

I don’t want that also to seem like an inside club, as somebody, if you haven’t volunteered, it’s not closed off to you at all. Please participate. There’s a lot of ways to get prepared for that. We have a mentorship program through Fellowship, but also, if you’re interested, reach out to any of us that are serving. We’d really love to invest time and grow other people. It’s not just an inside clique where you move from one to the other to the other. I just wanted to say that.

John Curran: Our volunteers are welcome in any role, in any capacity, and there’s no right path. You can decide you’re going to work on policy proposal and then you can decide you’re going to work on the AC, which isn’t really working on policy proposal.

It’s administering the policy process. And then you can decide you’re going to work for the Board or maybe you’re going to work on more policy proposal. Everyone helps in the capacity that makes sense to them. There’s no particular right road to follow.

Alyssa Quinn: I stepped into Open Mic a little late so I hope this hasn’t been covered already.

But yesterday we talked a lot about TIPTOP, and there was some discussion of how we have a monitoring role in the IETF and then a support role when protocols do emerge, which is wonderful.

Another item that’s happening there that I think we ought to be monitoring right now is there are several RFCs around agentic identification and authentication. And there are some unique identifier functions emerging there, and I think that’s something that the RIR system needs to be watching very closely and responding to very rapidly when and if systemic identification do end up emerging from IETF.

John Curran: Excellent point. I think it’s worth saying, generically, the IETF creates protocols, and those protocols often have identifiers, and those identifiers often are leveraging things like the IPv6 identifier space. And they don’t necessarily use the general purpose Internet Number Registry System that we run with the other four RIRs.

For example, there was – we have outer space, and obviously that’s something that people have said specifically they do want coordinated. They want to have done by the RIRs.

We have agentic AI, which is a jump ball, don’t know, but it’s the type of thing that happens. We have drone identifiers issued and that’s completely independent, but within the IPv6 address space and being done in a different type of system.

So, yes, I highly recommend, if you’re interested in the use of the identifier space in general, that it’s worth paying attention to the activities of the IETF.

We have a number of people on staff who do that. I’m one of them. But even knowing it’s going on isn’t the same as knowing whether this community wants to take a stand in it.

So, I need more than me. I need people in the community who are interested to participate in the IETF, at least pay attention to what’s happening in some of the identifier spaces, because these will come up from time to time.

Thanks. Excellent point.

Ashley Perks: We do have one online question. This one is actually for Lee Howard.

Hollis Kara: I have a comment on the IPv6 Task Force from Michael Ackerman, Blue Cross. He says, “The task force is a great idea, all caps, and seems to have a lot of education and support areas that enterprise will need if they deploy IPv6. But none are currently considering IPv6 because we don’t see a strong business case or a compelling technical case.

Can ARIN and this task force help with showing enterprises where such may exist, and what can enterprises or organizations like INTC do to assist with this process?”

Lee Howard: Lee Howard, from I guess from the IPv6 Task Force in this particular context. Thank you, Mike. That’s a really good question. I will point back to the blog series on the business case that ARIN has on its website. That’s a good place to start. And I certainly hope that we can help.

I know we have, you and I, have talked about the business cases for enterprises and what organizations like yours might want to hear. But I think there’s probably more for us to do.

And I also will say that we are here in service to the community, and as I think somebody said earlier, we’re not trying to force anybody to do something that is not right for them or their organization or their network.

So, if it’s not right for you, don’t do that. But if you think it is right for you and we just need to articulate why in a better way, we are absolutely here and happy to help do that. I hope that answers the question.

Ashley Perks: He actually is going to have a follow-up. He wants to speak directly. So we’re getting that set for you. Do we have him, tech team? Can you unmute, Michael; I think you’re on mute on your Zoom. I’m sorry.

Alicia DiCiaccio: Ashley, it looks like we have a difficulty that our participant is not able to unmute to be able to ask his question. So, Michael, if you’re able to continue with your question in the Q&A, we will be able to go through and follow up.

Ashley Perks: Sure. I also provided Michael with your Board email address as well, Lee. So, if he has any follow-up questions or considerations, he’s welcome to message you.

Lee Howard: Of course, in the slides were the email addresses of the three of us on the task force, so anybody else can do the same thing. I’m pretty sure he knows how to reach me.

Ashley Perks: It sounds like you guys have already talked about it.

Lee Howard: I’m delighted to hear that he’s online.

John Curran: Excellent. Thank you, Lee. I’ll be closing the microphones. Get in the queue if you want to get in the queue. Yes, Lee.

Lee Howard: (Singing “Happy Birthday” to Nancy)

(Applause.)

John Curran: Do we have any remote participants? I see no one at the queue.

Open Microphone is completed. Thank you very much.

(Applause.)

Closing Announcements and Adjournment

Ashley Perks: Thank you. Okay. You’re almost done. I promise. I do have a few just closing announcements for us. First of all, thanks for joining us. ARIN 58, we did it!

(Applause.)

Thank you to our Network Sponsor, AT&T. Platinum Sponsor, AWS. Our co-Silver Sponsors, FlashStart and Secure64.

Our Exhibitor Sponsor, IPv4.Global by Hilco Global. And, of course, the espresso bar host, Verisign.

(Applause.)

If you missed today or just want to check out what happened, you can read our daily recaps at ARIN.net/blog. Yesterday is also up there as well with some very fun pictures of some of you.

And, of course, save the date for ARIN 59. April 11th through 14th in 2027. It will be in beautiful Cleveland, Ohio. We’re very excited to see you there. I’ve already requested pierogies to be on the menu. I see this was exciting. Everyone’s here for that.

We always want to know how we did. So please, please, please, submit our meeting survey. There’s a QR code on the sign in the lobby or you’ll also receive a follow-up email today with a link to it. You can be in the running to win a beautiful, fancy Away suitcase. That’s my Vanna White.

Two quick announcements for those of us here in the room. For our Caribbean delegation, just a reminder that the Caribbean Roundtable is being held directly after this in the Flagler room, so please go hang out with Bevil and Co.

For our members from other RIRs here, I’m looking at you Alastair and others, as well as ARIN Board, please come up front. We have a APNIC Board member who would like to take a photo of all of us together. No names mentioned.

That being said, safe travels home. We can’t wait to see you at a future ARIN event, and that’s it.

(Applause.)

(Meeting concluded at 12:03 p.m.)