Network Infrastructure Must be Stable

by Leo Vegoda

Mark Zuckerberg changed Facebook’s motto to “move fast with stable infrastructure” in 2014. He told Business Insider that they’d continue to move forward “even if we move a little bit slower.” Considering how and where to move is a part of maturing.

IP address registries have matured. Once they were central to rapid innovation; now they are foundational network infrastructure. Their tools have become better and more reliable because users test them every day. The RIRs improve the tools when users get stuck and ask questions.

Tool development is often rapid but governance moves slowly. Governance is tested less often. APNIC’s Executive Council (EC) meets just four or five times a year. APNIC members elect new EC members for two-year terms each year. That slow pace is reflected in the number of changes to its by-laws since 1998: two.

Mature network infrastructure operators

Why does this matter? How could an unstable APNIC impact network operators and ordinary internet users?

One way to answer this question is to look at comparisons. IP addresses are a bit like land. So, APNIC is a bit like a land registry. Landowners could lose title to their land if a land registry is poorly run. All the services that rely on land registry data would become less reliable.

Governments spend money so everyone has internet access because it’s so important. And as more business relies on the internet, its security becomes more important. APNIC and the other RIRs issue digital certificates linking IP addresses to owners. Many networks now use them to increase the integrity of the paths data takes across the internet. The integrity of these RPKI certificates is more important each day.

Revoking an RPKI certificate – or even sustained interruptions to service – would be bad for the network operators. It would also impact the users who rely on the services those networks support. Flight plans and taxes are essential functions that are now filed on the internet. 

APNIC isn’t handing out much IPv4 space now. The little they issue comes from space they reclaim. All five Regional Internet Registries (RIRs) see a trickle of space coming back to them when organizations close. The precise amount varies but it hovers around 100,000 IPv4 addresses per year. That’s a bit more than a /16, often known as a Class B.[1] 

IPv4 addresses are worth at least $35 each and AWS’s new pricing prices their use at $47 each per year. At those prices, APNIC’s trickle of space is worth millions, and there’s a little more of it each year.

The election at APNIC 55

The stability of the RIRs depends on company law, organizational by-laws, and implementation.

APNIC adopted a code of conduct for EC candidates in December 2022. Clause 8d forbids using whois or lists “for electioneering or spam (for example, by using whois data to send unsolicited emails).” Nonetheless, there were reports of candidates spamming voters in the 2023 election campaign. Others worried that four of the candidates came from just one organization.

APNIC warned members about the unsolicited calls impersonating it. Its warning explained that it “will never call Members to discuss EC election candidates.” It ended up hiring a law firm – Maddocks – to oversee the election code of conduct.

None of the four linked candidates was elected but the experience scared some members. Australian computer scientist, Karl Kloppenborg, proposed a set of governance reforms. He reasoned that they were so important that it was important to engage the APNIC members based outside the region who tend not to vote.

Better by-laws

Karl Kloppenborg’s proposals focused on ensuring diversity, reducing the risk of candidates having a significant conflict of interest, and formally defining who is accountable for ensuring a free and fair election.

APNIC’s members urged the EC to act on them. It did. Their governance review took his proposals and turned them into by-laws changes. Members voted on them at APNIC 56 in Tokyo – and online.

A quarter of APNIC’s 9,700 members voted. They overwhelmingly supported the five changes. In the future:

• Nominees for the Executive Council must come from the region.
• Nominees must not work for another RIR, impact APNIC’s ability to perform its job if elected, or be engaged in litigation against APNIC.
• Elected Executive Council members must each come from a different organization.
• A new Electoral Committee must oversee elections and ensure all nominees are eligible to serve.

25 years ago, when APNIC’s membership was much smaller, the first four would have been easy. Candidates’ employers tended to be smaller. APNIC was a less attractive prize.

But the industry is bigger now. Consolidation means that some companies are huge global corporations. And APNIC as both an internet “land registry” and a key component in internet security is increasingly attractive to a wide group of people whose interests aren’t aligned with the needs of most members.

These by-law changes were well designed and should help protect APNIC’s integrity for years to come.