Summary

  • Draft minutes of the RIPE NCC Executive Board's September meeting record a response to the suspension of an Italian service provider's .org name: the CEO urged contingency plans, and the Board agreed to accept the risk “for now” while checking possible safeguards.
  • RIPE NCC's published risk framework calls for classification, treatment plans when risk exceeds appetite, regular monitoring and twice-yearly Board progress reports. The public meeting paragraph offers no owner, control, deadline or next review date for this particular exposure.

The Boardroom’s Smallest Unit of Time: “For Now”

A domain name disappeared from DNS after a US sanctions designation. At the RIPE NCC Executive Board, the response eventually fit into an AOB paragraph. A member raised the case, the chief executive said contingency plans should be put in place, and the Board agreed to accept the risk for now while checking for safeguards. The phrase sounds temporary. Temporary decisions become durable when nobody writes down what ends them.

That sequence appears in the draft minutes of the 195th Board meeting, held on 14–15 September and published on 29 September. It is an AOB discussion, not a numbered resolution. The paragraph does not name a risk owner, a treatment option, a due date or a date for the Board to return to the matter. It does record one useful fact: the institution put a cross-border domain-dependency question in front of its directors instead of leaving it entirely in an email thread.

The incident that prompted the question is concrete. OFAC's 26 August notice placed Autistici Inventati on the US Specially Designated Nationals list and named www.autistici.org as its website. In his original post to the RIPE DNS Working Group, Timo Hilbrink reported that the .org registry operator set serverHold on the domain two days later. ICANN's EPP status guide says a registry operator sets that status and the domain is then not activated in DNS. The OFAC notice records the designation; it does not record an order to the registry. The public event still shows why a legal decision in one jurisdiction can become a technical state change with a global audience.

Hilbrink's RIPE 93 lightning-talk abstract asks whether the same mechanism could affect other large generic domains and how to limit damage. His earlier mailing-list post asked a sharper question: what if ripe.net were ever put on serverHold? That is a scenario, not a report that RIPE NCC is sanctioned or that its domain has been held. The Board minutes show that the question reached the directors and that the chief executive called for contingency plans.

The Risk Framework Already Has a Grammar

The Board does not need to invent a vocabulary for this. In its 2025 Financial Report, RIPE NCC says its enterprise risk assessment runs at least annually, with departmental registers. Risks outside appetite receive treatment plans. A Governance Committee monitors progress regularly, and execution progress is reported to the Executive Board twice a year. A December 2025 update calls its appetite for operational and compliance risk “cautious” and its appetite for strategic risk “balanced.” The report also identifies sanctions and jurisdictional complexity as pressures on services, contracts and continuity.

A domain-dependency exposure can touch more than one of those categories. The public September paragraph does not tell members how RIPE NCC classified this one. That is the missing join between a real case, a Board discussion and the institution's own risk machinery. “Accept for now” may be a reasonable interim choice. The published record gives readers no way to tell what “now” means or which safeguard the Board expects to see next.

The same distinction applies to the proposed contingency plan. A plan could involve service inventory, domain dependencies, alternative access paths, communications to members, or a test of restoration procedures. Those are possible controls, not claims that RIPE NCC has adopted any of them. The minutes contain no list. If an internal workstream exists, a compact public status record could expose its owner and milestone without publishing sensitive operational details.

The risk is also different from ordinary sanctions screening of a member transaction. RIPE NCC's report describes continuous due diligence and automated screening of members and suppliers. The Board's AOB exchange concerned whether an outside registry's handling of a domain name could affect RIPE NCC itself. One problem sits at the service gate RIPE NCC operates; the other sits under a name and legal jurisdiction on which that institution may rely. Filing both under the word “sanctions” would hide the control boundary that matters.

A Date for the Next Question

The next public Board record can settle four small questions. What class of risk did RIPE NCC assign to this dependency? Who owns the assessment? What safeguard or contingency exercise is being evaluated? When will directors review the result? A positive answer does not require publishing a private legal opinion, a complete internal register or a map of security weaknesses. It requires the Board to make its own temporary decision auditable.

The 195th minutes are marked draft, and a later approved version may add detail. The Board may also have controls that are absent from the public paragraph. For readers, the test is the next published record: a treatment entry, a dated action, a Board follow-up or a reasoned decision that the exposure sits within appetite. An hourglass on a boardroom table is a reminder of time passing. It is not, by itself, a continuity plan.

Original records