11am. Side room. Co‑operation.
DESIREE MILOSHEVIC: Good morning everyone and welcome to the Co‑Operation Working Group session at RIPE 93. Welcome to Sofia and our room full of windows here. So it's good to see everyone, online and here in the room. A very warm welcome to our colleagues and we have four presentations for you today and they will be covering different topics from digital municipality infrastructure to international standards deployment and also looking later on on the European regulatory framework on interconnection and peering. And lastly cyber security.
But before we go into agenda, let me just acknowledge the transition of the leadership team in the Co‑Operation Working Group. We had a selection this summer so I'd like to welcome our new co‑chair, Peter Koch, and so please give Peter a very warm welcome.
(APPLAUSE.)
I am very pleased to have Peter joining our team to work on our group activities but also I'd like to acknowledge that my co‑ Achilleas Kemos, who is joining us online, has decided to step down and I'd like to thank him for all the work and the commitment to the working group activities over the years and he will have a few moments to say something before the end of our session.
Lastly I also like to welcome our incoming chair, Bastion Goslings, who also got support from the community and he will be joining our team after RIPE 93, his first Co‑Operation Working Group meeting would be in Vilnius next time.
So these are voluntary roles so I just need to remind everyone and working group work depends on people dedicating their time to community, the RIPE community and working together with everyone in the secretariat.
So we'll now let me briefly introduce the programme. I said we are covering four topics and we'll start with Florian Holzbauer, he is from the interdisciplinary transformation institute in Austria and he will be talking to us about municipalities which is his analysis of the municipalities in countries and mapping the digital infrastructure across these municipalities. You said in GDPR countries, are there any that are not?
And next speaker will be a remote speaker, it's Rudiger Martin from the European Commission who will give us an update on the multistakeholder forum on the internet standards deployment, I am sure you are familiar, Martin who was also our speaker last year.
So finally after that we'll hear from Innocenza Genna and we'll be talking about interconnection and peering regulatory changes in the EC.
And lastly we have our last remote speaker Fredrik Lindeberg from Netnod and we'll also hear about surviving in cyber space. So with that, are there any comments on the agenda?
I hear none. Thank you all. I will invite our first speaker Florian to come and take the floor.
FLORIAN HOLZBAUER: Happy to be here and share a data set on local government hosting and hopefully some new insights for you and what local governments do and hosting infrastructure. This is a study I did with my colleagues Gabriel and Johanna from ITU.
So why did we look into this, if February 2026, there was this post on LinkedIn my feed and it showed this nice map from Switzerland but you can also see there is large part of it are red because these municipalities host their email struck or routing, inbound email through US Cloud providers, this is a little bit shocking to see a country like Switzerland and using governments using and relying on US cloud operators. I should should we worry about this? 2026 brought a lot of examples where geopolitically situations arise and you can see it has both effects on the availability of services, so this is the more famous case with the ICC and it got sanctioned so it was not able to use the services any more of US providers but I think the second example is a little bit less known and you could see that the Dutch civil servants and their email content was given to US government.
Because the they worked on the Digital Services Act which is which would make social media more responsible for the content that is revealed and this is I think an incident that also affected the confidentiality of regular public servants.
We thought what is the situation in other countries? And is there any data set yet that is available that we can use to measure this? And the first thing that came to mind is Eurostat has this broad data foundation across countries in Europe and we can see it has data such as the population on the right side. You can see that no such data is yet collected on the digital infrastructure. So we thought the idea was can we link Eurostat local administrative units with domain names that we can extract from wikidata. And what coverage do we get from that?
And today I want you to show both the dataset, we will look at the data example from one specific municipality and we will go into breadth across countries and compare what is the situation?
Let me start by looking Delft which presented the study the RIPE NCC is from Netherlands, I thought it was a good fit to look at Delft, the overall goal is make it reducible and automatable for all countries. We start with the overview, you can see the take the data from Eurostat, we have the information to put it on the map, we link it with wikidata and forward resolve all the domains we get from wikidata and with the IP addresses we can attribute them to the hosting locations and head quarter locations of the organisations that host the infrastructure.
So let's start by looking at what Eurostat already provides. You can see here we have some several data entries and you can see they have the nomenclature on territorial units and they have different players, two and three are mostly provinces inside the country and the one we are interested in is the LAU layer, the local administrative unit clear, be careful it's not a municipality in every country, sometimes it's also smaller units.
We get an identifier, which we do not know how it translates to the wikidata information, we get all the demographic data already population and also some Joe graphic data.
Then we are interested in what coverage we get, we can see the number of local administrative units is very uneven across countries, for example France still uses 35,000 municipalities while you can see for example Netherlands we have 342. But this is also very recently so in 2023, they merged 1,000 municipalities into that 342 to make administration easier. This is also represented in the data, we are happy this is up to date.
And then the next step we look at wikidata, I think most of you are familiar with Wikipedia on the right side, you get when you search for Delft for example you get this nice summary on the right side, it's part part of course of Netherlands and where this information is taken from, you can see on the left side it's the graph database basically behind Wikipedia, it's called wikidata and it links all the wikimedia entities such as Delft to other entities and you can see it has an instance of relationship of municipality with Netherlands and we can look for property codes to extract all the municipalities of a country with that. So this gives us queries that we can execute against wikidata and collect all the municipalities of a country.
And then we get this data from Wikidata, we get a property value for each country that gives us all the lists of the municipalities, we have also identifiers in there that we try to match against GISCO identifier, we are sure it's the same municipality we are talking about. So there can be sometimes municipalities with the same names and if we are unsure or if there is no matching identifier for a country, we do a geospace look up by taking the centre of the municipality and then taking the two... from Eurostat and locate it in there.
So by having this, we have now our domains that we want basically across countries.
And we have them for website but also for email entries, sometimes the website is hosted on a different domain than the mail, and we extract both from Wikidata and this gives surprisingly the large coverage, so we can see that 93% of the municipalities from Eurostat actually have a Wikidata entry. And most of them have digital services and a domain that is either website or email in Wikidata.
Sometimes for example with the 35,000 municipalities in France, we can also see that they just use telephone numbers still, not every municipality has yet a website or an email.
What we see then is we can take these domains and further resolve them. And we get now a list of IP addresses for both the IPv4 and IPv6 reachability. We have the inbound records for mail. We use SPF to get an outbound view of who is trusted to send emails for municipalities. And we can see we also resolve the DNS zone hosting so that the AuthDNS server. The entries are actually up to date, they are not, so we can see a lot of them actually resolve to records, to IP addresses basically, 97% of the name servers, surprisingly 81% already have SPF records set.
Looking at the physical hosting location, we use IP for the geolocation data, we can see the Delft operator in Belgium, where it's physically located in Belgium the service and for mail and DNS they are in Netherlands. And also for the headquarter jurisdiction, we use CAIDA date to locate the HQ and company name and we can see also the head quarter of the provider is in Belgium here.
So yeah, looking at this data table, this summarizes the data we collect and with that we can also nicely put it on a map and get an overview, you can later check out the map also but now stick with me, I will walk you through what you can see on this map. And we first start looking at the hosting layer here.
But before diving deeper into the map, I want to talk about the limitations. So, for example, if we resolve domains, there might be CDN fronting, which we also say is some part of the dependency, while we cannot see the service behind it of course, it could be the email is hosted locally, that forwards the mail to Microsoft behind it that we do not see but still they have a local post stance, so most of the cases, also we can measure outbound email limited for SPF, we see a lot of trusted senders but we don't know the main sender for the domain, we have would have to receive email from them. We ran also a platform doing this, but didn't do it for this study, you can check out email security scans.org which measures the output of the domain.
Finally we do not see all the digital infrastructure that is used to for the regular daily base basically inside the local municipality. But we have a comparable set across countries. Let's see what we can find out. I will share today five insights with you, we look first at hosting locations, whether domestic, or EU or external hosting or ownership and control, the gap between the Fine Gael hosting locations and the head quarter of the companies.
Then we will look at local provider usage, is there in county operators that can actively used for municipality infrastructure, and also interested in centralisation, there there is a single operator, does it mean if there is a domestic market the service is standardised or not and look at policy effects, whether we can see an increase in IPv6 reachability in countries that actively enforce this.
To so starting with the hosting locations, here you can see it on the map if you go to the hosting tab, you can look at either domain particular or in EU hosting and between the different technologies and you can see that the map is very green right now, a lot of the country operate the map infrastructure inside the country domestically.
And here we sort countries by the regions in Europe, so we use the United nations scheme for doing this and if you look at one of the technologies that's hosted more domestically and we can see also depending on the country look like, you get a very different picture. Especially when you start comparing the technologies so once you go from web hosting to mail hosting you can see that in northern Europe already that there is a large part that hosts in the EU and not domestically and we can also see that across the regions there is all these countries that have higher shares of domain particular markets while others do not in these regions.
To pick some examples, Germany, in western Europe ‑‑ we can see in eastern Europe there is different countries and Bulgaria is one of the countries that has more in‑country hosting, not the same as Czech Republic or Poland or Hungary but still.
So, this is I think a very interesting plot that shows the physical hosting locations so in red you see the inbound mail and you can see the circles on the right side is the share of the domains that are hosted physically inside the country.
And then the triangle and the further it goes from the physical hosting location, the larger the gap is basically so the head quarter is not inside the EU if the share is lower.
You can see that this gap is especially large in northern Europe, they have the infrastructure in the country but it is not owned by companies inside the country.
Or in the EU.
Largely because of Microsoft.
They do a pretty good job in lobbying there I guess and in Eastern Europe, we can see an opposite picture, very interestingly in Eastern Europe both the inbound and outbound infrastructure for the outbound senders resides both on the physical level and also the organisational level domestically.
So here on the map you can see this becomes very clearly visible, if you go on the operator tab, you can see that the northern Europe becomes red here.
And looking at the operators that are used here, of course Microsoft leads the list, we see cloudflare and Amazon and Google. But we also see Hetzner and OVH for web hosting across countries.
Two local alternatives exist in the country and here we have a provider step that lists all the operators inside the country and you can also see some very funny regional trends, if you look at Belgium for example, there's a clear split between Flanders and the south, Bologna, there must be regional politics going on here.
It has a clear effect on the provider choices.
SPEAKER: Language.
FLORIAN HOLZBAUER: We look at the maximum share of one operator inside a country and while there is CloudFlare and Amazon leading list, you can also see in countries there is local alternatives such such as the information system in authority or post at that Slovenia, so there is local providers present. With this high shares in the countries, we thought does it mean that the data structure is very standardised, on individual operators countries with high domestic shares do we have a single high operator running or not. We calculated the web host distance which is a very common metric for market centralisation and you can see that venues below 0.1 with competitive markets and then there's moderate and highly concentrated markets and you can see that of course there's a large share of countries that have very concentrated infrastructure for example if you remember the northern Europe, they relied on Microsoft for most of the email hosting but you can also see there's countries that down on the bottom side have competitive markets and domestic markets such as Germany, Poland, Spain and Hungary.
So on the map you can again see that these countries stand out on the concentration or centralisation tab, where we visualise there's more of a distance.
So lastly, one of my research topics was IPv6 adoption, so I couldn't and I was very templed to look at what are the chances of reaching my local government over IPv6. And before we start looking at the research, I think you can already get what we are looking at, is that most countries leading, lead by Italy on the top, that there is very low IPv6 reachability. And then we can see that the box plot present web adoption we can see mail DNS with the other similar, so mail and DNS is usually more centralised but we can see also there is a clear country difference here and we can see that on the bottom side, there is Czech Republic, Lithuania and Netherlands. And maybe there is a few people from Netherlands and they know that they have also policies in place so here we can see a clear effect, Netherlands, standardisation form, there is such a measurement already existing for Netherlands, it does track not only the hosting locations, they are more focused and security perspectives here and we can see by the end of 2021, it was, there was a policy that either you comply or you explain why not. And that you have to be IPv6 reachable if you are a public entity in Netherlands.
So yeah, this is an explanation for this trend here that there's a few countries that stand out where you are more likely to reach our local government over IPv6 but for all the other countries, there is no real adoption yet.
So yeah to summarise my insights, we can visualise how the domestic and external hosting we see this large gap in northern Europe, we have local operators that usually operate the single technology in the web mail or DNS but not across the stack.
We have found domestic and deseven lied markets such as Germany and Poland and we see the policy effect is clearly visible for countries that are actively doing it.
So I am not a policy person, I am a measurement guy, I put some for you to discuss here, that maybe we should have policies on internet policies that include municipalities, I think it's also useful to have requirements for email routing for municipalities of a certain size and also hosting locations should also include organisational requirements and it would be very useful to have such a system as in Netherlands that tracks modern internet standard adoption, also inside Europe, not only for one country and I hope it's possible with the set of local government domains that we extracted from Wikidata and of course this data set is now public, we also have a follow up work here that I am shortly going to going to pitch, we extend the measured standards towards security standards, I hope we have a system running into the future close to internet.NL, to have recommendations where operators go from and choose local operators. And we also have a paper that not looks at local governments but instead to banks, universities and news and governments.
So here's a link to it. And also if you are interested in how your own country is doing, I can recommend check your own country on the map and also the data is downloadable on internetwarte.eu, so thank you and happy to have some discussion on this now.
(APPLAUSE.)
PETE KOCH: Thank you, Florian, we have ‑‑ Florian, we have a minute for questions.
NIALL O'REILLY: Sorry this is a comment, I want to make a mention of complimentary resource which focuses on the applications rather than the hosting, unfortunately I think it's only available in Dutch, it's called open OpenSourcewerken.nl, your browser can probably translate it and it's how to get, how to start migrating from proprietary tools to OpenSource tools and what the known pitfalls and so on are, it's really useful. Really encouraging, I don't know whether it's useful.
PETE KOCH: Thanks, could you please share with an information with consistent or two on the mailing list for the working group. I am closing the queue.
AUDIENCE SPEAKER: Speaking strictly for myself, some of the hyperscalers have specific products that are supposed to be EU compliant so to keep data in the EU like the AWS EU storing cloud, how do you count them, do you count them as EU or not.
FLORIAN: We were very strict, once the headquarter is outside the EU, we would count them as outside the EU.
AUDIENCE SPEAKER: Thank you.
MIRJAM KUHNE: Speaking here as a Dutch citizen, I want to point out the internet.nl website is accessible worldwide, you can put in .BG and you get the same test, you can use that test for domains outside the Netherlands.
AUDIENCE SPEAKER: Will. I am wondering if it could be really difficult to have some kind of data about that for Switzerland more specifically because I saw that on the and if we can help to do that, it would be absolutely great and I would love that.
FLORIAN HOLZBAUER: So I mean two points, maybe it would be nice to actually use internet dot L N and give them the domain list and see if they have get the same statistics on the other countries, for Switzerland I think David is actively working for email on it at least for Switzerland, we only included EU countries.
AUDIENCE SPEAKER: Thank you.
PETE KOCH: Thank you, and thanks again Florian for the presentation and for your work, that's inspiring and actually it's setting a good starting point for the next contribution we have. Next on the stage virtual will be Rudiger Martin from the European Commission. He is a returning presenter, a couple of RIPE meetings ago he was at the Co‑Operation Working Group together with a colleague presenting the multistakeholder forum on internet standards deployment. And this is kind of linked to what we have just seen, internet standards and deployment of those. And we invited Rudiger to give an update on the state of affairs and with that Rudiger the floor is yours. And you should be able to drive the slides yourself. If that doesn't work, please give us a click or something. Rudiger, go ahead please, thank you.
RUDGER MARTIN: Thank you. Thank you Peter. I hope you can all hear me in the room, at least the sound check before was fine. Sorry for not being in the room in Sofia today, this was not possible. Next time I will really try to be in the room also.
So yes indeed there is some connection to the previous talk especially if you look for instance at IPv6 adoption. And last time as Peter just pointed out, I have been in this working group before the forum started, today I have a short reminder of what the forum is all about and then where the work stands after the last meeting in October. And how to follow or...
Of course the slides are my own summary and they are also minutes and current drafts that are ‑‑ right, now first the forum in brief.
This is a quick recap for everybody who wasn't there at RIPE 90 or hasn't seen any of our other presentations or who is not a member of the forum. I guess that there are also a couple of members of the forum in the room. So for everybody who knows this very well, please bear with me, I thought it was important also to give a refresher or an introduction for everybody who has never seen this before.
So, the starting point is that NIS2 implementing regulation and X.6.72 related requirements are encoded. Please note this is not the overall NIS IP environment but a specific set of entries so it's slightly less broad and the requirements are an implementation plan for the full transition to IPv6, secure appropriate and gradual plus measures to accelerate it and implementation plan for modern E security standards and best practices for first DNS security and second for routing security and hygiene, so for the last requirement under L, there is no implementation plan here and that... the guidance as you can see.
Now where does the forum come from, this implementing regulation in recital 8 is the mandate since it identifies specific challenges regarding the identification of those best available standards and deployment techniques, which are supposed to be implemented following these requirements, and since this is hard a multistakeholder forum should be founded which works out together with multistakeholder community, what that actually means in operational terms.
And this forum has been tasked to draft guidelines and the guidance is for the entities in scope, but also very importantly meant to support volunteer deployment beyond them. So the expectation is really that there will be broader ecosystemic effects.
On this slide you basically see how I would describe the forum's role. So the Rel lation sets the objectives, it's to increase the security in networks by reaching certain objectives which are security related. Then the content comes from standards and operational experience, IETF security, RIPE community, MANRS community, other communities, you name it, and the forum translates between the two.
And the result basically if you look back to operators as deployment guidance and built on existing standards and it does not develop new homes. So the question is how discussion becomes guidance.
There are four work streams, each with a chair and a technical editorial group that drafts between meetings.
The members comment in writing on each draft and open points go to the meetings. Where there is no agreement, the options are written out.
A co‑ordination group then keeps the four work streams consistent so that things which are relevant for all works teams are not diverging.
Now, in terms of participation, we have more than one hundred participants across four work streams. And this includes network operators and telecoms, cloud and infrastructure providers, DNS and routing operators, email security practitioners, vendors and technology providers, researchers and technical community participants, national authorities.
The call for participants remains open throughout the forum's work, it's always possible to try the forum still on its face. Now I will move to the actual update where the work stands.
So developing the guidance, deployment guidance is a structured process. You may remember if you have seen the presentation before that we had planned for a bit of an earlier start; however, we took voluntary and intentionally more time than planned to consult before launching, including in this working group and at RIPE 90 and IETF 1 and 23 to get it right from the start and we had the kick‑off meeting in January and so far four rounds of meetings in January, March, June and October. Currently we are what we call in what we call the phase A 3, analysis of information challenges, deployment techniques and timeframes. The working draft already exists and the milestone M 2 and 2027 is a complete set of draft guidelines that goes into a consultation. The final guidelines are actually planned for Q4, 2027 and that is of course in the ‑‑ it might be faster but it might also be slower.
Now, on the current stage of the work.
Since RIPE 90 the forum is established, we identified standards and best practices, this is largely completed, the basis of what we are actually talking about and what the guidelines are being drafted upon.
The analysis of the deployment challenges and the drafting is ongoing and there are drafts as I said in all four work streams currently verse 0.5 and 0.6 and common at this employment timeframes come later and we will move to consultation and finalisation phase afterwards.
So make it a bit more tangible, I wanted to give you an example of work stream one on IPv6, so that's the outline of the IPv6 guidance, it has ten sections. The first sections are the draft written and a test being reviewed and still being added and reviewed, it's essentially about the intended scope and audience and explains the requirements, it has an agreed transition taxonomy, which is an important instrument to basically show, to clarify the terms we are talking about within the guidance, then it clarifies what an implementation plan should contain, it has a session on the assessment of the current state. So that stakeholders who want to apply or should apply it actually have an easy way of seeing where they are actually currently, at what stage, importantly currently under drafting, the definition of the target stage, there we go to go exactly and transition path and acceleration measures, how do you do this an since the requirement also asks for accelerations so how could this all be faster. And then finally governance, risk management and review implementation considerations and indicative evidence of preliminariation.
The email guidance follows a similar plan since it's also implementation plan based. DNS and routing are different because they are corresponding requirements ask for deployment of best practices, not a plan. So these drafts are set out best practices per role, plus governance and evidence.
Now that's one of the examples most people ask about, it's the first requirement on the full transition and the draft uses four stages which are commonly acknowledged and commonly used across multiple technical communities. IPv4 only as a starting point not always of course some organisations are always a lot further, dual stack and IPv6 only and of course do not get a shot, IPv6 as the target state does not mean this is the ideal state, where there is no IPv4, nowhere whatsoever but as an operationally realistic target state that is why the forum does exist to make it operationally realistic.
As I said the regulation asks for a plan for the full transition and what has been recorded since the spring meeting that this is a target reached securely and gradually, dual stack is coexistence and not the target, IPv6 mostly as been intermediate stage. As I said this does not mean there's a switch off of IPv4 everywhere, IPv4 only destination was course need to stay reachable throughout translations and there are there is a couple of other time limited documented exceptions.
Right. So then just on the common ground. Across the work streams, very briefly I already commented on IPv6. On email it's about a layered standards, architecture, authentication, transport security and mail locks access. On DNS it's about DNSSEC signing and validation as the baseline, but it's also about other things such as the resilience of resolvers, name servers, you name it. And routing, we spoke about route origin validation and ROAs in the baseline, tutoring and anti spoofing. And the questions now which shape the next draft are ‑ so what we discussed in October, which is of course my reading and the minutes will be the reference, there we discussed about the target per environment because of course it makes a difference whether you are in the client environment or the service environment and also what does it mean IPv4 external boundary and e‑mail we discussed for instance about quarantine versus rechecked as a target, time limited exceptions and Dane and MTSSTS. And for DNS a big discussion about DS publication and the resilience of public AuthDNS and for routing, strengths of session protection, validator resilience and possibly ASPA publication.
If I take a Birdseye view on the forum, just a few emerging observations across the forum, I think that across work streams the drafts go clearly beyond trusts reaching on the protocol which is from different from a meaningful deployment. So for IPv6 it's dealing with transition governance, measurable progress and common horizons, for email it focuses is the set up actually effective. For DNS who applies what in practice and for routing, that every ROA and every validating networks adds protection between before deployment is universal. And in October we had two emerging schemes which I personally think is very important since this is not about reinventing the wheel, but this is about pointing to maintained sources, RFC, BCPs, IANA registries instead of re‑stating they will and also we discussed handling exceptions transparently, technical reasons, review over time.
Yeah, and that more or less brings me to the end of the presentation, so the next steps are that the next draft will follow now in each work stream, followed by a written review and the next plenary session will be in 24‑25 February and there are common deployment timeframes and we will discuss later in the current phase. And as I said the final guidelines indicative of Q4 in 2027.
So how to participate. Well, it's best to read the drafts, join a work stream or then later on participate in the consultation before the guidelines are finalised. And of course feel free also to get in contact with the forum chairs, the forum participants. And yeah, that's it for now. Thank you. And I am available for questions of course.
PETE KOCH: Thank you, Rudiger.
Thanks for that update and also going into some of the technical details that might be of strong interest for this community. We have a few moments for questions. Does anyone ‑‑ people are not really rushing to the mic.
Rudiger, you mentioned the consultations, so we know there is the editing groups and the work streams deal with this, there will be a public consultation? And apologies for putting you on the spot. Is there a timeframe for that consultation foreseeable right now?
RUDIGER MARTIN: Yes, it will be public, that's the intention. A timeframe is not foreseeable right now since, well insofar as that this will be at the end of the drafting. So the idea is essentially not everybody has the resources and the time available to participate in the forum. On that note we highly appreciate the great expertise which is actually coming to the forum, so we are very happy about the participation. And the idea here is also to give the possibility to comment if you are not ‑‑ if you do not have the resources to come along.
PETE KOCH: Thank you, this will probably not have any final update, we'll hear from you and from the forum again in this or other groups. And with that I'd like to hand it over to Desiree. And thanks, Rudiger, for joining us. You are most welcome to stay, there might be other interesting regulatory topics here in the next discussions, presentations, thank you.
(APPLAUSE.)
DESIREE MILOSHEVIC: So I'd like to introduce our next speaker. We all know that interconnection and peering is fundamental how the internet works and we have this recurring topic and sometimes the regulatory framework may interfere with the basis of our work for the network service operators. It's my pleasure to invite Innocenzo Genna to tell us a little bit about the Digital Networks Act because he has been following and publicising widely about it so thank you for being back with us and the floor is yours.
INNOCENZO GENNA: Thanks. OK. So thanks for the invitation, I know that I have to check the time also because I have a plane so...
So what to do with this. OK so today I would like to tell you what's going on in the interconnection peering in Brussels. There is something wrong happening around this, not because you will think ah he is another wrong thing of Brussels. No, normally the wrong things in the capitals and someone brings to Brussels and then give us. I would like to tell to you today. Then we deal with interconnection for a long time and interconnection is basically based on the principle of commercialisation of freedom consumers, by the way this is because European rules, the European rules guarantee for that. It's not because it is your choice, it's because there is since‑‑ in fact, here there is a European framework which states that in general, interconnection is a matter of commercial freedom. This is in the current code and this is also in the new piece of legislation which is going to be debated in Brussels which is named the Digital Network Act which is still under review and discussion, will last some time, but we have to follow because there may be some things which are of interest for you.
Should this DNA create some alarm or concern, because you may have heard some people saying that this piece of legislation may affect them, most of the things you were dealing with. This is why. In fact, there was a debate before the DNA led by the previous Commissioner which accidentally, which was the France Breton, was also former CEO of a big telco, Orange. And this Breton was very large and clear in saying we have to change the systems and try to bring new rules and we have to rebalance the relationship with telcos and the internet world, it's not good how the money is distributed in the system, you have to rewrite everything. This is the so‑called debates of fair share. And with other like cloud convergance and so on, OK, but then Breton left, there was a new Commissioner for the digital society and what happens in the proposal which has been announced by Breton called Digital Act but in the proposal filed by this new Commissioner, there's almost nothing of what Breton has been proposing, really nothing. This is why, I mean, even if there is some reason for people to be concerned because you have been reading the newspaper before the DNA, then to have actual concern, you have to read the actual text. I will discover that there are not so many bad things in this DNA. To the contrary and in fact I always tell to my colleagues that the DNA, the Digital Networks Act, is not that bad if you compare it with the expectations, the expectations are much worse than what you get in the, it sound relatively good with respect to that has been told beforehand.
But, but, we are talking about a proposal. Then the proposal can be changed because there may be amendments and other stuff, you have to look at amendments which are filed which could change the shape of the text just to give you still a general information, what is the DNA about, it's about the spectrum of copper switch off, resilience, the interconnection matter and what normally regards the relationship between telcos and and is relatively small. So what the people are discussing in Brussels is basically spectrum and migration from copper to fiber. That's the real issue there. Of course interconnection matters, but it's not really speaking the core of the discussion.
In fact, what you should look in the DNA are if there is any fair share, how the interconnection is built, there is a system of co‑operation between telcos and OTT I will talk about, there is a new authorisation rage for operator which may be of interest and something about net neutrality, this is what may be of interest for you.
But fair share, all of these debate which has been proceeding for some years, the DNA, there is nothing of that, no fair share in DNA, there is no provision saying that a content provider or big internet company must remove Telco which are trust party the traffic up to end users, there's nothing of that, so, that's very clear and it's not in the text, the Commissioner is not really adamant of that, the European government said in writing in some that they don't want it and it's not in the text.
OK then you have interconnection, about interconnection, there is no real change. So the DNA is configured, what does this mean in the European framework in the code is that in general, interconnection is a matter of commercial freedom, but there are some differences between private and public networks. Public networks are mostly the networks which connect directly to end users, so typical telecom network. Private networks are not dealing with connectivity to the public. And the... is a bit more stringent with respect to public networks because for public networks there is a duty to negotiate interconnection which means that you are telephonic, if you have Dutch telecom and an operator comes to you, you cannot say I don't want, you must take... and in case of failure on negotiation, you can go to regulator and the regulator can decide whether in the case it is necessary to interconnect and why.
Because there's a matter of end‑to‑end connectivity. So the rules of public networks are there are because you want to make sure that end users of all the network systems can connect somehow. That's the reason. No more than that.
This is why there is no similar rules for cloud network and cloud, because even those networks if they refuse interconnection to someone, then the internet can find other ways to connect at the meeting point so there is a not a problem, even then you can agree with competition rules, if there is a big cloud provider behaving badly, you can go to antitrust authority and you can create a competition grid, but there is no obligation to interconnect. So this is as it were, it should work. But, but. We have something new because you don't have to fear identity but you have to fear some amendments. And in fact you see that, you see this Mr Kobosko that nobody knew, he is an important member of the Parliament, is a representative of the Parliament in the negotiations of the DNA and now is a draft report which should be the position of all the amendments of the Parliament with respect to DNA and here he is put provision whereby that the these obligation and duty for public networks now will also apply to some so‑called significant traffic provider which trust part on average 2% of the internet traffic in download in Europe, OK.
So this means that in that case you will be as an operator, you will have the right to interconnect with those operators and in case they refuse, you can go to the regulator and eventually getting a decision in which interconnection is made mandatory and eventually reimbursing some cost and this is the trick which is behind this provision is some operators believed that if they go to the regulator, they can get it removes them all the investments they made in the network so that there will be some equity and some, not equity, fairness in the world that all the cost will be fairly distributed.
So it's the fair share idea behind that. I tell you that in any case, it will not work because to get to this objective you may also need in the code a clear rule saying that there must be these reallocation of ‑‑ real location of cost, this rule is not there, why is why if you start to go in this case you just will have a lot of uncertainty. But, but, I think this is in any case a stupid thing because even if it is something that is not going to work is a step in the wrong direction and I think that I would normally you should encourage steps in the right direction, if you see steps in the wrong direction, you could I like to say there is something wrong there.
This is my, why, because if there is a provision in a case there will be a huge incentive to litigate. All operators will have an incentive to ask mandatory to connection with those big significant traffic providers, why, because there is a potential possibility to get some money. So what, irrespective whether you believe it's right or not, but if you are the CEO of a company, especially a listed company and you have this possibility you have to do it because there is a potential to get some money from Google by the way, you have to try it.
So the only sure effect of this provision was a huge amount... and a market which was relatively calm, then the be characterised by a high‑level of people making disputes so it makes sense but for what, I don't know.
This is why my address to you as a technical community is to take a pen, a piece of paper and write to Mr Kobosko saying, hey, this as stupid thing, sorry, you should stop it. I understand that you are a neutral community and you are an organisation which represents various... but it would be sufficient that you individually, you get together, you make this recommendation, you present yourself as people who understand how the internet works and you present yourself and you are a member of this community so you don't represent RIPE but you are member of the community, you write and you say sorry, this is a wrong step in the wrong direction and that's all. It will be very appreciated because members of the Parliament are always, they always get a lot of, let's say, letters and complaints by stakeholders which have a legitimate vested interest and in your case you have a technical community, I think the position of a technical community is very valuable in this kind of discussion.
Then you will have in the DNA another provision which is created a lot of discussion about these articles which basically create a platform of co‑operation between telcos and OTT, there have been a lot of debates where this could led to again to kind of fair share situation, legal analysis is not, this system is there why because there was a lot of debates about fair share before the DNA about the impact of traffic, the information that telcos have, they have to transmit all this traffic and user and so on and objective of these co‑operation is to create a structure between these kind of operators, action information, having BEREC the European supervision and trying to keep the situation transparent and also they put the voluntary consideration there, nothing is binding, maybe you can argue whether this is really useful, maybe not, but this is not the real issue in the DNA, the real issue is what is the amendments I told you before.
Then there is an authorisation regime, this is somehow connected to ‑‑ the idea here is the typical authorisation regime of telecom operators will also apply to some not Telco operators but in any case managing telecom infrastructure by cloud provider, like CDN, the limits are not completely clear, in fact I have been discussing this with some of you, this new rage could go too far beyond and include the DNS infrastructure and so on and I am not sure about it and that maybe you should have a look at that.
In any case, there is a clear objective of the Commission to expand the reach of jurisdiction by the regulators, by the Telco regulators or the cloud providers and so on, you can agree whether it is right or not. To some extent it makes sense that a regulator can have a supervision on all the infrastructure in the territory irrespective whether they are monitored by a Telco operator or by a cloud provider, it is a legitimate request. On the other side you don't see exactly the boundaries of these new provisions and especially the scope because cloud providers CDN are already subject to NIS2, you would ask OK, you are in principle or increasing the supervision on these operators but why, what is the objective, what is the scope, this is not clear here. It is a point of contention, I am not saying you have to scream but probably it would be trusted to try to understand back there what are the boundaries of these new authorisation regime to avoid that there are no unintended consequences.
About the net neutrality, even there are no huge differences with respect to the current regime, of course the open internet regulation up to now were separated a piece of legislation now are migrated into the DNA and some people are alerted about it and the discussion whether the recitals of the open internet relations will be clearly introduced in the DNA, the recitals are the proceeding part of a lab they contain the reasoning and they are important, they are important because they help you to interpret how the rules are applied.
There is a discussion whether it will be necessary to copy all the recitals and bring it into the DNA or doing some other ways, OK, but this is more legal matter but you will hear about. In general, I would say that the only point of attention account DNA, there is still the discussion about specialised services which normally is being built with ‑‑ along the lines of better we can, you have BEREC adopting the alliance and helping regulators to apply, also for specialised services. The DNA says something else, for the specialist services, it's not BEREC, it is the Commission which will enact a specific act.
And since the Commission is a more political body rather than BEREC, the suspect you may have that there is an intention to give to the specialised services for political than a technical meaning.
So I am not saying this is automatic but in Italy there was a famous politician says if you think something badly, what was it ‑‑ I don't remember but I will tell you later, I will send it! But it was a politician that was condemned for Mafia reasons but it was very smart.
OK, so my conclusion, DNA is still going, there for one year and they are not bad things as I told you. If you really read the legal text, it's not that bad. But things can get bad if there are bad amendments and to my personal experience now I see that bad amendments going on, the one in the Kobosko report, Mr Kobosko is not that bad, he is the rapporteur of the Parliament, he has a lot of Parliament behind him and there's one Parliament coming from a specific country saying I want this kind of stuff and then he take it.
What will happen then there will be other members of the Parliament will say yes or no and at the end of the day, Mr Kobosko will decide whether to keep it or not. This is why you can play a role there. You should write to Mr Kobosko and especially to the other member of the parliament and saying please, tell Mr Kobosko to destroy these amendment and if you are successful, you have been doing good work.
So this time normally should be 12th November, but I have been told it's probably postponed to 4th December.
So you have more OK. So let's that's all from me for my side.
(APPLAUSE.)
Now remember, if you think bad things, maybe you make a scene but you are right.
DESIREE MILOSHEVIC: Great talk, thank you for calling the RIPE community to act before 12th November. December. OK, we have time.
I will take questions from the floor first and there's one online as well.
AUDIENCE SPEAKER: Blake Willis. Thank you very much for preparing this especially for folks that might not have time to follow all the things that are going on. Two questions for you.
First of all, as a large transit carrier where we neither have captive eyeballs nor providing content very often in this kind of proposed legislation, we don't see anything acknowledging the fact that carriers that don't do those two things exist as kind of a middle man between the two content providers. When I have responded to surveys, they classify it as cap because we didn't have any captive eyeballs. I am not a content prider, a transit provider. Do you see any progress towards acknowledging that the role of independent transit providers in the DNA?
INNOCENZO GENNA: Well, you are right, but normally as a transit provider it's even if you are not connecting the bringing the traffic to end users, you are considered to be a public network because you are transmitting connectivity to the end user although you are the middleman as you said. But normally regulators, they consider you a public network provider because you are transmitting connectivity accessible to the public, there is the reason behind. So it is a notion of public network in the wide interpretation. This is an area of uncertainty which is in the code and still in the DNA and until now this uncertainty didn't matter much because we were in a world in which everybody was making a Telco job, a telecom job. Now there is the intention of the DNA to expand the rules, become telecoms. This uncertainty will start to matter but in any case, what can be affecting you is that in general the system especially coming from the Kobosko amendments will make more modification and more cost to increase. And the result is even for you as a middleman which are not directly affected but if you are working in a market where everything is getting disputed and costs are increasing, maybe there will be an evident on you as well.
AUDIENCE SPEAKER: Thank you. The second one real quick was a lot of provisions in the DNA seem to lean very heavily on BEREC doing any en forcement or regulatory chats, etc, do you see provision for funding that, that was kind of BEREC's push back, they said if you want us to do those, somebody needs to pay for it.
INNOCENZO GENNA: Yes, OK, BEREC is making opinion supporting the Commission is not enforcing. Enforcement is made by the national regulator but Beck remember is providing common opinions, so the regulator has a piece of paper saying what should be done in general, the funding matter is concrete issue, the Commission want to solve it by creating an office which is called office of digital networks which will be the secretariat of the better recognise which will be funded and maybe could be a good idea but is an idea of the Commission, in my opinion, to try to weaken the BEREC and creating a secretariat which should be under the control or not the BEREC and some, yeah, there is this risk that using the funding to create OK a European agency of Telco which in general may be a good thing but it should be technical. Why, if it is under the control, the Commission will be political because we know in the last 12 years, the Commission has been very political in doing this stuff. And to some extent is correct but maybe having a strong BEREC which is technical and continue to have its work in the independent way for me is is a good thing in the entire ecosystem.
DESIREE MILOSHEVIC: One more, question and comment from David from the Internet Society, David with you like to speak for yourself? And.
AUDIENCE SPEAKER: I think you are totally right on what you say I think we need to steer the community really to engage with you on this issue. Let's think about soccer, a soccer field, somebody puts the ball on the penalty spot and is ready to shoot to the goal and there's no goalkeeper. This is what the European Commission did, they prepared a text that's innocuous as you said. But it's ready to be filled with amendments, to fill out all the danger of big tem come operators not only on the issues that you said on interconnection but also a spectrum and topics and perhaps it's not an issue with the community, the issue of IP connection and net neutrality, creates the perfect storm for a set of amendments that we have already seen not only in Kobosko report but also in the Linga and core committees. There are amendments it's in the right direction pushing for what needs to be done in the wrong direction but also amendments exactly to clear this perfect storm of fair share, not only about payments between big tell tow, also about technical measures so it's even worse than fair share meaning just payments, it's worse than that.
And what we see on the Kobosko report is exactly the wrong path. It mentions the IP interconnection but my fears, and you didn't mention, you didn't go into the changes in net neutrality, what we see in reality here is a situation where even big tech could be comfortable because they are the ones with the lawyers and with the means to make this agreement with big telcos. Creating new barriers for medium size and small size companies. So this is the worry here, this is the perfect situation to the perfect storm, to change how the internet works. So I am calling the RIPE community to stand up. Even if you extend the deadline, can you can reach out to me and I can give you the name of the members of Parliament that need to be informed of what they are voting, otherwise this is going to be a game changer on the internet. So my email address is my family name, franci@... at I am ready to share with you the email addresses of people that need to be informed in European Parliament.
We have talked to our community, to reach out to the members of Parliament from the national politicians and we hope some of you will. Thank you.
DESIREE MILOSHEVIC: Thank you so much, David, please feel free to share the comments and a huge round of applause again for Innocenzo Genna. David. We need to move on with our programme. We have an AOB as well, I'd like to introduce our next speaker Fredrik from Netnod, I hope he is online. He is online of course.
Welcome and we are going to learn a lot about cyber today from the chief information officer, security officer at Netnod, the floors is yours, thank you.
FREDRIK LINDEBERG: Thank you. Yes, I just tried to switch slides, ah now I can do. I am Fredrik Lindeberg, the chief security officer of Netnod, I will talk about surviving in the cyber landscape, if you have any issues with the sound, raise your hand and I will try to do something about it.
So, for knows who don't know, Netnod is foundation owned operator neutral internet infrastructure entity, we operate the largest set of inter exchanges in the in order discs, we are one of the root service operators, we operateiroot and DNS services and for other second level domains, we on behalf of the Swedish government distribute time and frequency on fibre optics and we have started to offer security services in relation to resilience and
I am going to talk about today is survival and that would be survival both versus adversaries and also in case of normal failures. So if we look back a bit, we usually looked at risk and effect as something based on chance. We have natural Es, components that fail, etc, events which didn't care that much about who you were, you could calculate meantime between failures, you could use statistics, you could use two different solutions flex to each other with redundancies to halve the risk, things occur to castically at any time, there's no structure to it but the world of today is a different. And in today's cyber world, I don't want to say usually but sometimes there's an an tag NIST, someone who chooses what should fail and when. If ask the Swedish security services, that would be Russia, China and Iran, other direct or via proxies. The thing is when an antagonist chooses you, your risk value doesn't matter any more, it's all about consequence. So history provides little to know information about which event will happen in which order. And two solutions of a similar type don't necessarily provide the same redundancy end and usually if you have an adversary on antagonist, they will pinpoint the location where you are weakest and they will target this specific location.
So chance does not care who you are but an adversary does. So instead of thinking about risk as a measure of probability and consequence, we basically only have to look at consequence. So if you did a risk assessment two or three years ago, it was probably reasonable to say that a low probability event with a high impact event could be accepted, right, because there was a very low chance, a very low probability that something would happen. But in today's world, it will probably happen because there is some antagonist that wants that specific thing to happen, that wants that specific consequence.
So it used to be a rational decision, you could easy disregard the consequences because they were probably low and you were probably running that right because history said the probability was low.
So it was a decision based on ‑‑ a decision based on your actual history, but that's no longer the case.
To be a bit formalistic, probability is the property of the adversary as intent, if the adversary's intent is to make you suffer or services go down, the probability is 100% they will try it, so low probability events have become high probability events. As a context here the Swedish intelligence and security service has come out publicly and said this to Swedish co‑operations that the frequency, the scope and the effort will increase in the upcoming years. So accepting risk previously was the right decision but not the revisiting it now is definitely not the right decision. This is the wrong decision. You have would have to revist that risk.
In the same context, it's also important to think about in our digital world that if we go back 20 years or 25 years, the digital components they were compliments, right, you had a computer you used once or twice a day perhaps. That is not the case any more. Everything is digital today. You use computers, you use laptops, as you have done for 10, 15 years. But today probably the deluxe system to the building in your end is based on some digital component, if there is something going haywire on the other side of the world, it might be that you cannot open doors in your building any more or that your car cannot start because it needs an acknowledgment from a server on the other side. So everything we do today requires some kind of digital dependency, even the physical things we do, the physical world we live in today has digital dependencies which have to work for society to function regardless of whether it's opening a door, operating an ER, starting a car or sending an email or making a phone call. So we live in a digital era today.
I will continue on here and talk a little bit about conflict and influence.
If you look at influence in a traditional sense, let's talk about war. There is usually a quite clear timeline where influence and the effect of influence increases over time and then there is some event happening where you go from peace to heightened alert and ultimately to war.
So there are two points I want to make here, one is that there is some kind of escalation, the effect of influence increasing over time.
Should I stop or should I continue Peter?
DESIREE MILOSHEVIC: Please continue, Fredrik, we can now see you and hear you well. So you have five minutes left. Sorry a little bit less.
FREDRIK LINDEBERG: I will hurry along. Yes, so as time increases, so does the effect and you can also do things over time, in case of attributional war, you can call in your conscripts. In a digital era it's not the same. You will probably be experiencing the same kind of influence during peace time as you do during war time. So the important take away here is if you operate any kind of digital infrastructure and this could be anything from data centres to IXPs to concert services to ISPs to whatever, you probably need to be able to sustain the same kind of effect and influence occuring peace time as during war time.
And you also don't really have any time to escalate or ramp up production or infrastructure before you have heightened alert or war.
So when there is actually when we have gone all the way to war, that's not the same to put more fiber in the ground, the fiber needs to be in the ground from the beginning, the extra servers need to be in place and redundant from the start.
I will speed up a bit and skip some slides to finish my presentation on time.
I just want to mention a couple of quick words about AI, so AI doesn't change the attacks that much, they change the time lines, the magnitude, the speed of things. So suddenly fixing something the next day is not good enough, you have to be on your feet and act faster. And slowness becomes a bit problematic, you must be faster than the others, you must be quicker than the others.
Another thing I want to mention, that is that agents have become insiders here, so when you think about AI, you also have to think about them like any other insider in your company, who can you trust. Based on what you actually trust, both your people and your agents.
I want to mention quickly something about regulatory developments. And I am being a bit blunt here by intention, reality is quite a bit more nuanced, but in the EU, we are focusing a lot on exant regulation which is tied to a complex layer of processes, decides what you should do in that war. If you look on the other side of the pond towards the US, they have shifted their regulatory approach or their compliance approach drastically the last couple of years, in September of 2024 the Department of Justice changed the entire direction of their compliance programmes and instead of deciding what actors should do, compliance programmes should focus on if they have the right effect. The three guiding questions of any US compliance programme should be if the programme is well designed, adequately resourced and in if works in practice. When we say this, we like to think about when are we looking at compliance and when we are looking at actual survival because those might not be exactly the same thing.
I will quickly rush towards the end.
I will quickly mention that when we talk about security and survival, we have a duty to think about. And that is that confidentiality and availability often, it has two often different optimum solutions, when you think about availability, you want to build some form of network of nodes, you want to have many redundant nodes that can function on their own, when you think about confidential, it's the other way around, you want fewer nodes and you want them really controlled and well defended. And these architectures don't really go hand in hand and can create quite complex challenges, especially if the requirements are not properly communicated with the architect or the IT department.
I will go towards the end here.
So I think you should ask yourselves, do you as an organisation know what you do? Do you know which expectations are put on you? As an ISP for example, do you know during which circumstances your clients have to function? And for yourself then, do you know which IT systems an functions you should keep available, how can they should function, etc.?
In Sweden we have a requirement which came into force quite recently that all municipalities and government agencies need to function for two weeks without external help in case of crisis or ultimately war. That will be without power basically.
And just I really want to reiterate at this point that compliance is one thing, survival in crisis is another thing.
So we think the best way forward for all organisations interested in survival is to agree on what you do that really matters because in case of crisis, you need to prioritise resources and to be able to prioritise resources you need to have already agreed on what you do that is important.
You also need to take stock and identify what you are dependent on to do that which you do.
These could be su suppliers or hardware or people, it could be whatever but you probably need to identify what you really need to function. And then you also need to ensure that everything works as expected when they are needed, when your services are needed. We think the best way to do this is actually to do some form of failure test, where you operationally disconnect dependencies and other things and try what actually happens in a real world scenario. Not only write a paper saying we have planned for this, actually test it. Does our redundant network work if we unplug half of the nodes or reboot a server, etc, etc.
Yes. And also think about working together. Nobody can be strong alone today. So think about who are your friends, how would you communicate with them, how would you be affected by your friends taking a hit; going off‑line or whatever.
Remember a chain is no stronger than its weakest link. And you have to do your own assessments, right. Not necessarily your risk assessments but perhaps your consequence assessments. But they are not enough, you also need to exercise, you need to practice and you need to know that things actually work as they are supposed to, even during crisis.
DESIREE MILOSHEVIC: Thank you. A huge round of applause for Fredrik and for your being a good patient audience. Before we close we returning to the change of leadership and give a word to our co‑chair, Achilleas Kemos. We really are grateful for all the contributions he made over the years to the working group. Achilleas we can hear you.
ACHILLES KEMOS: I put the camera on, I don't know why not I can't see you.
DESIREE MILOSHEVIC: We do hear, we can't see you, I don't know we know what you like look like.
ACHILLES KEMOS: OK, thank you Desiree, last summer in the discussions we had in the group about the new co‑chairs, I had expressed a willingness to be with you today physically; unfortunately this has not been possible, the negotiations we have for the next financial framework made it that it's much easier to attend especially when there is an online possibility, this is also what happened to Rudiger and myself. Anyway, I would like to thank Julf also, we worked together for ten years and he left already this summer, and to also you, Desiree, that you have been driving this group with very smoothly and with efficiency. We have seen today that the group will continue being of excellent priority and so on. I would like to thank all the group for all these interesting debates and issues that we discussed throughout these years, always nice and friendly atmosphere. I would like to thank also NCC for their support. And finally say that we were also keeping tabs especially via the Brussels roundtable that NCC regularly organises. So thank you all and keep in touch.
DESIREE MILOSHEVIC: Achilleas and great to see you, sorry not in person and thank you to all the speakers. (APPLAUSE.)
We can see you well and the new chairs and incoming chairs are still here, so thanks very much. Please do not forget to rate the talks. We have a small announcement, a reminder you should all vote, the people who are eligible to vote at the RIPE NCC GM today. They should pick up their sticker at the reception or Registration Desk in order to enter the general meeting today until 4pm, so that's a reminder, please if you have any comments you will find us in the corridor.
PETE KOCH: Thank you very much, you are now relieved. Welcoming Bastion of course. Thank you very much to Achilleas, and I hope to see you again in this or other venues. And welcome, Bastion.
DESIREE MILOSHEVIC: Thank you, all.
(APPLAUSE.)
Lunch break.
End of session in side room for today.