Criteria for the Accreditation of Regional Internet Registries

Back in 2001: ICP-2 - Criteria for the establishment of a new Regional Internet Registry

In 2001, a document was developed that stated the criteria for the recognition of new Regional Internet Registries. Back then there were only three Regional Internet Registries (RIRs): ARIN, APNIC and the RIPE NCC. This document, known as "ICP-2", was based on the criteria that the three existing RIRs adhered to. The ambition was that any new RIR would follow the same requirements as the existing ones. After the development of ICP-2, two more RIRs were established: LACNIC and AFRINIC.

Although the criteria set by ICP-2 refer to the establishment of new RIRs, they are implicitly considered to be ongoing obligations that all RIRs must adhere to for the maintenance of their accreditation/recognition (the intention of the document was certainly not to allow an RIR to abandon these commitments after receiving accreditation/recognition).

Today

For the last couple of years, AFRINIC has found itself in a very difficult position. Faced with corporate governance issues and a number of litigations, AFRINIC has no legal representation. There is no board with quorum and no CEO. Nobody has the authority to call for an election, and there hasn't been a members' annual meeting or a policy development meeting for at least a year. Attempts for an official administration appointed by court ("Official Receiver"), authorised to call for an election, have been paused subject to an appeal. The details of the relevant litigations are not publicly available, which makes it difficult to predict the outcome or what this means for the future of AFRINIC's corporate governance.

Despite this situation, it is very important to note that the AFRINIC registry remains operational without any considerable disruptions. This is thanks to the AFRINIC staff who provide their services under very difficult circumstances and should be recognised for their great work in doing so.

At the same time, AFRINIC's difficult position has raised the attention of many parties towards the resilience, governance and accountability of the global RIR system. Although each RIR is an independent legal entity, with its own processes and governance, all RIRs collectively form the Internet Numbers Registry System and all of them have committed to be collectively responsible for it. This system is now under scrutiny. The RIRs, as self-regulatory bodies, increasingly need to prove with their communities that there are adequate checks and balances ensuring the stability and self-governance of the Internet Numbers Registry System.

The criteria set in 2001 for the accreditation of an RIR need to be revised through a broad community-led consultation. This will be a long-term process, though it is necessary for strengthening the RIR system. In the meantime, we can only create some assurance that the existing obligations outlined in ICP-2 are being respected by all RIRs at all times. The creation of such assurances would function as the foundation for the proper long term review of the RIR accreditation and the update (or rather replacement) of ICP-2.

Accordingly, while the other four RIRs are following the developments in AFRINIC, we have also been considering ways to strengthen the accountability of the RIR system, to ensure that (1) already existing obligations RIRs have committed continue to be respected and (2) the criteria sent in 2001 for the accreditation of an RIR are revised by the RIR community. The resulting plan has two parts:

1. Short term plan - Creation of ICP-2 Implementation Procedures

As mentioned above, the document "Internet Coordination Policy 2" (ICP-2) provides clear criteria for the accreditation of new RIRs. These requirements are necessary to maintain this accreditation, and they are common and applicable to all RIRs.

What is missing from the document, however, are implementation procedures to verify that these criteria continue to be fulfilled after accreditation, including a process to review compliance with these criteria and possible outcomes after a review process has concluded.

In October 2023, the NRO EC, in consultation with ICANN, took the initiative to prepare a draft of these procedures. This is a supplementary operational document, based on the existing criteria and obligations outlined in ICP-2. It neither creates new obligations, nor removes any of the obligations for maintaining the RIR status, and it does not replace ICP-2 either. In this document, the NRO EC acknowledges that the accreditation criteria are common and applicable to all RIRs, including those established prior to the adoption of ICP-2.

In January 2024, the NRO Executive Council (EC) asked the NRO Number Council (NC), as the RIR communities' representatives, to review that draft document. That same month, the NRO NC completed its review of the draft and expressed its endorsement for the initiative, together with some valuable feedback. Notably, the NRO NC agreed that:

“ICP-2 must implicitly or inherently require RIRs to continue to comply with the requirements of their accreditation.[...] We also agreed that the legitimacy of the Implementation Procedures was bolstered by the fact that it neither added any obligations to nor subtracted any obligations from the existing RIRs as provided in ICP-2.”

The draft is now being finalised by the NRO EC and the plan is to adopt it in consultation with ICANN soon.

Please note: as with a RIPE NCC procedural document, which describes the implementation of a RIPE policy, this is an operational document implementing the already existing criteria. As such, its adoption is not subject to community consultation.

2. Long term plan – Revising the criteria for RIRs

Although the implementation procedures were based on the existing criteria and commitments in ICP-2, they are quite old (ICP-2 was developed in 2001). The NRO EC considered that a revision of the provisions set in the document was needed to strengthen the accountability of the RIR system to the Internet community.

Unlike the implementation procedures explained above, a full revision of the criteria for the accreditation of an RIR should take place at the community level. Accordingly, the NRO EC has asked the NRO NC to establish and manage a process to update ICP-2 in the 2024-2025 timeframe, which would include:

• Development of an initial draft updated ICP-2 proposal

• Consultations in each of the RIR communities to review the updated draft

• Incorporation of feedback from these consultations by the NRO NC to produce a consensus update to ICP-2 for recommendation to the NRO EC for their finalisation and adoption, in consultation with ICANN (and possibly the wider ICANN community).

The NRO NC has been working intensively on this task since January 2024. They will soon publish a timeline for this work that extends until 2025. The timeline is based on the cycle of RIR meetings (from APNIC 58 until RIPE 90). Before each of these meeting cycles, the NRO NC should publish drafts for the RIR communities' consultation:

• In August 2024, it will publish a document outlining the principles for the creation of the RIR requirements for community consultation via an organised survey. The document will be discussed at the RIR meetings (starting from APNIC 58 in September 2024 until RIPE 89 in October 2024).

• In February 2025, after reviewing feedback on the principles document, the NRO NC will publish a first draft of the RIR requirements. This draft will also be subject to community review and will be discussed at the RIR meetings (from February 2025 at APNIC 59 until May 2025 at RIPE 90).

• In June 2025, it will start developing the final document for the NRO EC and ICANN Board consideration. If more consultation is needed, the timeline may extend for another cycle of RIR meetings.

To facilitate the community discussion, the NRO NC intends to create a mailing list so that there is one communication channel for all RIR communities. Since ICANN has a role in the accreditation of RIRs, its community may also be invited to comment. ICANN will therefore likely launch its own public consultation in parallel to the work mentioned above.

At the conclusion of this process, we should be able to defend the accountability of the RIR system and of course provide members of the RIR communities with reassurance that their RIR will always be able to fulfil its role and that the Joint Internet Registry will remain stable and reliable.