Reflections on Six Months as Chief Registry Officer

Same mission, different world

Since rejoining the RIPE NCC as the Chief Registry Officer just over six months ago, I have been contemplating the extensive changes in the Registry since I left over a decade ago. Our core values and mission remain the same; we are the custodians of IP addresses and ASNs for a complex and diverse service region. We ensure Registry accuracy, maintain compliance with the relevant regulatory bodies in our service region and allocate Internet number resources in accordance with RIPE policies. And I’m very happy to see the dedication, integrity and expertise of the Registry department remains the same.

Yet so much has also changed. The world around us is in a very different place. We have more responsibility than ever as we face a rocky political environment, regional conflicts, and growing external regulations. This has triggered a wider discussion about ensuring the future stability of the RIPE NCC which I encourage you all to participate in.

The changing landscape and impact on the Registry

The landscape around the RIPE NCC has transformed significantly over the past decade. Demand for IPv4 has not noticeably declined since RIR IPv4 exhaustion in the early 2010s, resulting in the emergence of a multibillion-dollar market for IPv4 resources. IPv6 addresses are also now being exchanged on this secondary market, despite RIRs holding an abundance of IPv6 space to distribute to their members and End Users. Personal ASNs have also become popular, which I will share some statistics on later in this article.

Today, the RIPE NCC operates in the centre of this industry, administering the allocation and transfer of IP addresses within a complex global ecosystem. This shift has not only redefined our operational focus but has also highlighted the important economic dimensions of our role as a registry.

With over 70 countries in our service region, we also see the complexity of Registry work escalate as we deal with the implications of conflict and sanctions. Our due diligence and sanctions checks have had to become much more extensive and robust for all request types. We screen and monitor all applicants, members and End Users for sanctions via a third-party tool to make sure we are fully compliant with EU sanction regulations. Sanctioned entities cannot acquire further resources or transfer existing ones. We also check our members against OFAC sanctions, because currently we cannot request or collect funds from Ultra High Risk Countries as defined by Dutch Banks. As this definition is based on all sanctions including OFAC, we apply the same caution with OFAC sanctioned entities.

The effect on the Registry department has been substantial, with increased risks and scrutiny on our operations leading to increased pressure. The team has shown tremendous resilience and adaptability in continuing to provide a high level of support to all our members in the face of these challenges, something that we remain fully committed to maintaining.

Inside the Registry today

The curious case of growing ASN workloads

The Registry department is a hive of activity, and I’d like to share some insights on what we’re currently busy with. One area that I want to highlight, due to the somewhat surprisingly high workload it generates, is the assignment of Autonomous System Numbers (ASNs) to End Users.

The overall number of ASN requests today is very similar to what it was five years ago. However, the key statistic here is that the number of End User ASN requests has doubled. In the first half of 2019 we received ~500 ASN requests for End Users, and we are currently on track to hit ~1,000 requests in the first half of 2024 alone.

The significance of this has to do with the additional workload it generates. We estimate that it takes an extra hour on average for an IPRA to process an End User ASN request compared to an LIR Infrastructure ASN request. This includes adding the End User to our sanctions screening and monitoring tools, verifying the End User against an official source, and performing additional policy compliance checks and evaluating the sponsoring LIR agreement. This additional work translates to roughly 2,000 extra hours, equivalent to almost 1.5 FTEs, compared with five years ago.

We also have the “unused ASN project”, where we list ASNs that have not been visible on the Internet uninterrupted for at least 13 months and if they incurred no registration change (transfer, sponsorship change etc.) during that period. We then contact these resource holders to see if they can be returned to the RIPE NCC. Today the number of ASNs on this list stands at around 3,900 but we check only 100 per month due to capacity constraints. The actual number of unused RIPE ASNs is much higher. Other ASN-related tasks include re-verifications, regular de-registrations, transfers, and so on.

It’s worth noting that we do not have a dedicated charge for ASNs. This means that the costs for handling ASNs are currently spread evenly across the entire RIPE NCC membership. Option C in the RIPE NCC 2025 Charging Scheme 2025 introduces a fee of EUR 50 per ASN assignment. If members vote for this option at the upcoming GM, this would transfer ASN-related costs from the base membership to those LIRs holding higher numbers of ASNs for their infrastructure and sponsored End Users.

More interesting RIPE ASN statistics

We have noticed an exponential growth in ASNs being assigned to natural persons since 2021. This indicates a growing popularity for individuals to hold their own ASNs.

The following chart shows the volume of RIPE ASNs assigned by the top 50 LIRs in terms of ASNs. On average, these LIRs sponsor more than 135 ASNs each.

Other Registry ticket insights

Quantifying workload is always complicated so let’s start with facts. The first four months of 2024 have seen the total number of Registry tickets return to pre-covid volumes.

We have over 20 different types of Registry ticket categories. In the table below I list what I think are the most interesting top 10.

Processing transfer requests is critical to our mission of maintaining an accurate registry. Many people believe transfers are our main source of work these days. However, while the number of transfers that we handle remains high, and we expect this critical function to keep us busy for years to come, we now spend less time on average per transfer request. This is largely down to improvements we’ve made to our supporting documents, request forms and automation that we have developed in recent years.

In the table below, we can also see that the number of tickets in the NCC and RIPE DBM queues have dropped significantly. This is where most questions about our services, procedures, and the RIPE Database arrive. This decrease is largely due to the successful (re-)introduction of our interactive chat service, improvements to our webforms, and clearer public communication.

^{Note: these numbers are total tickets that we handle per queue, including abandoned requests.}

Fraud handling

Falsified documents and misleading information are a risk to the registry. And with the high value of Internet number resources, we must be very vigilant to protect the registry and the resources held by our members and End Users. Fraud can lead to closure of membership, resource deregistration, and blacklisting from becoming a member of the RIPE NCC for five years. All cases of confirmed fraud are reported to the authorities, as instructed by the RIPE NCC Executive Board in 2017. This applies to the submission of fraudulent documents both by existing members and membership applicants.

In recent months, we were notified by a member that they had seen some unusual activity in their LIR account. This led us to proactively investigate multiple accounts, and our team uncovered a pattern of incidents. Attempts were made to gain access to resources through fraud and to transfer resources without authorisation from the legitimate holders.

One member experienced an operational impact, and in two cases, resources were transferred, based on the submission of fraudulent documentation. The transfers were reverted following our investigation. The perpetrator who submitted the fraudulent documents had their RIPE NCC membership terminated, their resources deregistered, and they were blacklisted from becoming a RIPE NCC member for five years. This was also reported to the authorities (consistent with our approach as mentioned above).

This is a stark reminder to everyone to secure your RIPE NCC Access account:

• Be vigilant about the validity of your email domains and email security
• Ensure that all contacts in your LIR account are valid and kept up to date
• Report any suspicious activity to us immediately
• Store account credentials in a secure manner, and stop using shared accounts

Further details can be found in our Registry Investigation Report.

Conclusion

Our Registry Department is still bustling with activity and we must be vigilant in our work now more than ever. We have demonstrated that we can evolve with the changing world to meet the resulting demands on our operations. As the trusted, neutral body of Internet number resource custodians, we are wholly committed to continue supporting our membership and the wider RIPE community.

I plan to cover more registry related topics in future articles. Please let me know if there is a subject or dataset of particular interest (you can always email me at jkennedy@ripe.net). And make sure to keep an eye out for these upcoming discussions:

• IPv6 stockpiling
• Legacy
• Why PI?
• What role the RIPE NCC should play (if any) in facilitating connections between buyers and sellers on the IPv4 transfer market