295-17 Peering Report and Study

Home , Internet traffic, Internet transit

295-17

Attachment A Follows

Senate Bill No. 289–Senator Denis

Joint Sponsor: Assemblyman Paul Anderson

CHAPTER......

AN ACT relating to the Information Technology Advisory Board; requiring the Board to conduct a study of peering that includes an analysis of potential benefits of peering arrangements to the State and its political subdivisions; requiring the Board to submit a report of its study to the Director of the Legislative Counsel Bureau for transmittal to the 79th Session of the Nevada Legislature; and providing other matters properly relating thereto.

Legislative Counsel’s Digest: Existing law creates the Information Technology Advisory Board which has various duties relating to information technology. (NRS 242.122, 242.124) This bill requires the Board to: (1) conduct a study of peering, including an analysis of potential benefits of peering arrangements to the State and its political subdivisions; and (2) submit a report of its findings, including any recommendations for legislation, to the Director of the Legislative Counsel Bureau for transmittal to the 79th Session of the Nevada Legislature.

EXPLANATION – Matter in bolded italics is new; matter between brackets [omitted material] is material to be omitted.

THE PEOPLE OF THE STATE OF NEVADA, REPRESENTED IN SENATE AND ASSEMBLY, DO ENACT AS FOLLOWS:

Sections 1-7. (Deleted by amendment.) Sec. 8. 1. The Information Technology Advisory Board created by NRS 242.122 shall conduct a study of peering that includes, without limitation, an analysis of potential benefits of peering arrangements to the State and its political subdivisions. 2. In carrying out its duties pursuant to this section, the Board may hold meetings that are in addition to the meetings that the Board is required to hold pursuant to NRS 242.123. 3. The Board shall submit a report of its findings, including, without limitation, any recommendations for legislation, to the Director of the Legislative Counsel Bureau for transmittal to the 79th Session of the Nevada Legislature. 4. As used in this section: (a) “Peering” means the voluntary physical interconnection of administratively separate Internet networks for the purpose of exchanging traffic between the users of each network. (b) “Political subdivision” means a city or county of this State. -

– 2 –

Sec. 9. This act becomes effective on July 1, 2015.

20 ~~~~~ 15

Attachment B Follows Extracts from FCC 15-24 Report and Order (“Network neutrality”) concerning “peering”

Footnote 482, page 86 As a general matter, Internet traffic exchange involves the exchange of IP traffic between networks. An Internet traffic exchange arrangement determines which networks exchange traffic and the destinations to which those networks will deliver that traffic. In aggregate, Internet traffic exchange arrangements allow an end user of the Internet to interact with other end users on other Internet networks, including content or services that make themselves available by having a public IP address, similar to how the global public switched telephone network consists of networks that route calls based on telephone numbers. When we adopted the 2014 Open Internet NPRM, the Chairman issued a separate, written statement suggesting that “the question of interconnection („peering‟) between the consumer‟s network provider and the various networks that deliver to that ISP . . . is a different matter that is better addressed separately.” 2014 Open Internet NPRM, 29 FCC Rcd at 5647. While this statement reflected the Notice‟s tentative conclusion concerning Internet traffic exchange, it in no way detracts from the fact that the Notice also sought comment on “whether we should change our conclusion,” whether to adopt proposals to “expand the scope of the open Internet rules to cover issues related to traffic exchange,” and how to “ensure that a broadband provider would not be able to evade our open Internet rules by engaging in traffic exchange practices that would be outside the scope of the rules as proposed.”

Footnote 489, page 87 See, e.g., Verizon Reply at 58 (explaining that “new arrangements [are] emerging on a regular basis to provide for efficient network planning and traffic delivery, as well as improved service for customers as their demands for Internet services continues to grow”); AT&T Reply at 96 (“For more than two decades, such interconnection has taken the form of „transit‟ and „peering‟ agreements, and in recent years, „on-net- only‟ agreements have arisen in response to growing demands for video and other forms of media-rich content.”); see also Werbach, Kevin D., The Centripetal Network: How the Internet Holds Itself Together, and the Forces Tearing it Apart (2009), 42 U.C. Davis L. Rev. , 343, 371 (2009), http://ssrn.com/abstract=1118435 (anticipating the evolving interconnection ecosystem).

Paragraph 198, page 88 In addition, several large broadband Internet access service providers, such as AT&T, Comcast, Time Warner Cable, and Verizon, have built or purchased their own backbones, giving them the ability to directly interconnect with other networks and edge providers and thereby lowering and eliminating payments to third-party transit providers. These interconnection arrangements are “peering,” involving the exchange of traffic only between the two networks and their customers, rather than paid transit, which provides access to the full Internet over a single interconnection.493 Peering gives the participants greater control over their traffic 494 and any issues arising with the traffic exchange are limited to those parties, and not other parties over other interconnection links. Historically, broadband Internet access service providers paid for transit and therefore had an incentive to agree to settlement-free peering with a CDN to reduce transit costs;495 however, where large broadband Internet access service providers have their own national backbones and have settlement-free peering with other backbones, they may no longer have an incentive to agree to settlement-free peering with CDNs in order to avoid transit costs. As shown below in Chart 1, the evolution from reliance on transit to peering arrangements also means an evolution from a traffic exchange arrangement that provides access to the full Internet to a traffic exchange arrangement that only provides for the exchange of traffic from a specific network provider and its customers.

Footnote 496, page 88 J. Scott Marcus, The Economic Impact of Internet Traffic Growth on Network Operators at 4, WIK- Consult (Oct. 24, 2014), http://dx.doi.org/10.2139/ssrn.2531782 (“Very few ISPs are able, however, to use peering to reach all Internet destinations. Even well-connected ISPs typically purchase transit from one or two other IS s in order to reach destinations that are not covered by their own peering arrangements.”) (emphasis in original).

Chart 1, page 89

Chart 1: Evolution in Transit Market Transit in the 1990s Paid Peering and CDNs Today

Paragraph 199, page 89-90 Recent Disputes. Recently, Internet traffic exchange disputes have reportedly involved not de-peering, as was more frequently the case in the last decade, but rather degraded experiences caused by congested ports between providers. In addition, these disputes have evolved from conflicts that may last a few days,497 to disputes that have been sustained for well over a year,498 and have gone from disputes between backbone service networks, to disputes between providers of broadband Internet access service and transit service providers, CDNs, or edge providers. The typical dispute has involved, on one side, a large broadband provider and on the other side, a commercial transit provider (such as Cogent or Level 3) and/or a large CDN.499 Multiple parties point out, however, that interconnection problems can harm more than just the parties in a dispute.500 When links are congested and capacity is not augmented, the networks—and applications, large and small, running over the congested links into and out of those networks—experience degraded quality of service due to reduced throughput, increased packet loss, increased delay, and increased jitter.501 At the end of the day, consumers bear the harm when they experience degraded access to the applications and services of their choosing due to a dispute between a large broadband provider and an interconnecting party.502 Parties also assert that these disputes raise concerns about public safety and network reliability.503 To address these growing concerns, a number of parties have called for extending the rules proposed in the 2014 Open Internet NPRM to Internet traffic exchange practices.

Paragraph 200, page 90-91 The record reflects competing narratives. Some edge and transit providers assert that large broadband Internet access service providers are creating artificial congestion by refusing to upgrade interconnection capacity at their network entrance points for settlement-free peers or CDNs, thus forcing edge providers and CDNs to agree to paid peering arrangements.504 These parties suggest that paid arrangements resulting from artificially congested interconnection ports at the broadband Internet access service provider network edge could create the same consumer harms as paid arrangements in the last- mile, and lead to paid prioritization, fast lanes, degradation of consumer connections, and ultimately, stifling of innovation by edge providers.505 Further, edge providers argue that they are covering the costs of carrying this traffic through the network, bringing it to the gateway of the Internet access service, unlike in the past where both parties covered their own costs to reach the Tier 1 backbones where traffic would then be exchanged on a settlement-free basis.506 Edge and transit providers argue that the costs of adding interconnection capacity or directly connecting with edge providers are de minimis.507 Further, they assert that traffic ratios “are arbitrarily set and enforced and are not reflective of how [broadband providers] sell broadband connections and how consumers use them.”508 Thus, these edge and transit providers assert that a focus on only the last- mile portion of the Internet traffic path will fail to adequately constrain the potential for anticompetitive behavior on the part of broadband Internet access service providers that serve as gatekeepers to the edge providers, transit providers, and CDNs seeking to deliver Internet traffic to the broadband providers‟ end users.

Paragraph 201, page 91-92 In contrast, large broadband Internet access service providers assert that edge providers such as Netflix are imposing a cost on broadband Internet access service providers who must constantly upgrade infrastructure to keep up with the demand.510 Large broadband Internet access service providers explain that when an edge provider sends extremely large volumes of traffic to a broadband Internet access service provider— e.g., through a CDN or a third-party transit service provider—the broadband provider must invest in additional interconnection capacity (e.g., new routers or ports on existing routers) and middle-mile transport capacity in order to accommodate that traffic, exclusive of “last-mile” costs rom the broadband Internet access provider‟s central offices, head ends, or cell sites to end-user locations.511 Commenters assert that if the broadband Internet access service provider absorbs these interconnection and transport costs, all of the broadband provider‟s subscribers will see their bills rise.512 They argue that this is unfair to subscribers who do not use the services, like Netflix, that are driving the need for additional capacity. Broadband Internet access service providers explain that settlement-free peering fundamentally is a barter arrangement in which each side receives something of value.513 These parties contend that if the other party is only sending traffic, it is not contributing something of value to the broadband Internet access service provider.

Paragraph 202, page 92-93 Mechanism to Resolve Traffic Exchange Disputes. As discussed, Internet traffic exchange agreements have historically been and will continue to be commercially negotiated. We do not believe that it is appropriate or necessary to subject arrangements for Internet traffic exchange (which are subsumed within broadband Internet access service) to the rules we adopt today. We conclude that it would be premature to adopt prescriptive rules to address any problems that have arisen or may arise.514 It is also premature to draw policy conclusions concerning new paid Internet traffic exchange arrangements between broadband Internet access service providers and edge providers, CDNs, or backbone services.515 While the substantial experience the Commission has had over the last decade with “last-mile” conduct gives us the understanding necessary to craft specific rules based on assessments of potential harms, we lack that background in practices addressing Internet traffic exchange.516 For this reason, we adopt a case-by-case approach, which will provide the Commission with greater experience. Thus, we will continue to monitor 517 traffic exchange and developments in this market.

Paragraph 203, page 93 At this time, we believe that a case-by-case approach is appropriate regarding Internet traffic exchange arrangements between broadband Internet access service providers and edge providers or intermediaries— an area that historically has functioned without significant Commission oversight.518 Given the constantly evolving market for Internet traffic exchange, we conclude that at this time it would be difficult to predict what new arrangements will arise to serve consumers‟ and edge providers‟ needs going forward, as usage patterns, content offerings, and capacity requirements continue to evolve.519 Thus, we will rely on the regulatory backstop prohibiting common carriers from engaging in unjust and unreasonable practices. Our “light touch” approach does not directly regulate interconnection practices. Of course, this regulatory backstop is not a substitute for robust competition. The Commission‟s regulatory and enforcement oversight, including over common carriers, is complementary to vigorous antitrust enforcement.520 Indeed, mobile voice services have long been subject to Title II‟s just and reasonable standard and both the Commission and the Antitrust Division of the Department of Justice have repeatedly reviewed mergers in the wireless industry. Thus, it will remain essential for the Commission, as well as the Department of Justice, to continue to carefully monitor, review, and where appropriate, take action against any anticompetitive mergers, acquisitions, agreements or conduct, including where broadband Internet access services are concerned.

[Additionally, statements of individual Commissioners contain peering references.]

______

Internet Peering and Transit

Anna-Maria Kovacs Ph.D., CFA1

April 4, 2012

Executive Summary

The Internet has evolved from four university mainframes connected by 64-kilobit lines to a network of networks that spans the globe, connecting hundreds of millions of devices and carrying hundreds of exabytes of traffic per year. Its key characteristics have been adaptability and responsiveness. It has accommodated changes in its own infrastructure and topology, changes in technology at its edge, changes in type and volume of traffic, changes in types of market participants and their relationships, and changes in methods of compensation for the exchange of traffic.

The Internet has had very little formal governance and no regulation to slow its responses or divert its course. The absence of rate regulation has been particularly helpful, providing the flexibility that allows the Internet to accommodate seamlessly ever-larger volumes, suddenly-emerging new types of traffic, and new players both at the core and the edge. The Internet’s traffic moves along on commercial agreements, many of them hand-shake agreements. The system has evolved from peering among academic and government networks to a mixture of paid and unpaid peering and transit among various types of commercial networks. Competition is rife, with the five largest bandwidth providers carrying only about a third of the international capacity of the U.S., and new entrants like Google and Comcast smoothly displacing incumbents in the top 10. Because of its informality, this unregulated system has facilitated the necessary investment in infrastructure to support the explosive growth of traffic that the Internet carries, and carries at ever-lower prices. That, in turn, has stimulated economic growth and job creation in the U.S. and around the world.

1 Anna-Maria Kovacs is a Visiting Senior Policy Scholar at the Center for Business and Public Policy at the McDonough School of Business at Georgetown University. She has covered the communications industry for more than three decades as a financial analyst and consultant.

The author gratefully acknowledges Broadband for America for providing financial support for this paper and for obtaining all the required permissions for citations.

Internet Peering and Transit

From its inception as four university mainframes connected by experimental packet switches and 64- kilobit lines to its present incarnation as a commercial network of networks connecting hundreds of millions of devices via routers using Internet Protocol over multi-gigabit links, the Internet has constantly evolved. New technologies and demand for new services have grown in tandem, driving and reinforcing each other. Adaptability and responsiveness have been the distinguishing characteristics of the Internet. With very little formal governance and no regulation to slow its responses, it has accommodated:

 Changes in the infrastructure over which the Internet itself rides  Changes in the topology of the Internet  Changes in technology at the edge  Changes in type of traffic  Changes in volume of traffic  Changes in types of market participants and their relationships  Changes in methods of compensation for exchange of traffic

The Internet responds swiftly and automatically to changes in the most crucial factors that affect it. The Internet’s ability to handle vast increases in the volume of traffic and accommodate new types of traffic, to be indifferent to the types of players who own and manage its physical infrastructure and to the evolving relationships among them, to move seamlessly from generation to generation of innovative hardware and software both at the core and the edge—this is the greatest gift of the Internet.

The Internet has been unregulated, and that lack of regulation is a key factor in its success. Any particular regulation may be good or bad, but the process is rarely swift, and by its nature tends to look backward rather than forward. Laws are built upon precedent and created with deliberation—that is their strength and their weakness. Regulation of a global network that crosses myriad jurisdictions is exponentially vulnerable to delay. In dealing with forces at the edge whose constant shape-shifting cannot be predicted, unintended consequences are inevitable. Because it is not regulated, the Internet is free to respond quickly at its core to the changes innovation brings at its edge.

What has worked particularly well for the Internet has been the absence of rate regulation. Much of the Internet’s traffic moves along on hand-shake agreements, and the rest on commercial agreements. Despite—or because of—its informality, this system has facilitated the necessary investment in infrastructure to support the explosive growth in the volume of traffic that the Internet carries, and carries at ever-lower prices.

Without rigid boundaries to limit its growth and strait-jacket its development, the Internet has not only grown rapidly itself, but has fostered the growth of the vast and ever-changing ecosystem that is the foundation of today’s global economy. It is a truly remarkable example of Adam Smith’s “invisible hand” in action.

Early history of the Internet--Inception to commercialization2:

In 1969, Bolt Beranek and Newman (BBN) installed Interface Message Processors (IMPs), which were experimental packet switches, at four universities across the U.S. and connected them with phone lines. This was the origin of ARPANET, funded by DARPA (Defense Advanced Research Projects Agency), which linked mainframes via remote login for timesharing.

 In 1970, Network Control Protocol (NCP) was developed as ARPANET’s first host-to-host protocol. It was implemented in 1971-1972.  In 1972, BBN introduced the first email system.  In 1972, Metcalfe invented Ethernet. It was established as a standard protocol and was commercialized in the 1980’s.  In 1973, the first written version of Transmission Control Protocol/Internet Protocol (TCP/IP) was developed. It was designed for nationwide networks, to be the general infrastructure on which applications could be layered.  In 1980, TCP/IP was adopted as a defense standard, and in 1983, the shift from NCP to TCP/IP was implemented. TCP/IP remains the standard for the global Internet.  In 1986, NSFNET was funded by NSF to connect academic supercomputing sites. ARPANET continued to serve and be funded by the military.  In 1989, Tim Berners-Lee, then at CERN, invented the World Wide Web.  In 1989, Border Gateway Protocol (BGP) became an Internet standard, with the current version BGP4 adopted in 1995.  In 1990, ARPANET was decommissioned.  In 1991, a Commercial Internet Exchange was established in Santa Clara, CA to connect burgeoning private Internet networks. In 1992, arrangements were made for it to exchange traffic with NFSNET.  In 1993, saw the first commercial web browser.  In 1995, NFS privatized the Internet. Government funding of the Internet ceased and the Internet became a commercial enterprise.  Since 1995, the Internet’s infrastructure has been privately funded.

What is the Internet now?

The Internet is a global network of networks that transport communications in Internet Protocol (IP).3 It is, simply, an ever-expanding set of networks that exchange traffic, whatever its origin or destination, as long as it is expressed in IP.

2 This section draws most heavily on Leiner, Cerf, Clark et al, “Brief History of the Internet”, but also on Kende, “IP Interconnection Ecosystem”; Oxman, “Unregulation of the Internet”; Yoo, “Internet’s Architecture”. 3 TeleGeography, “Market Structure,” p. 1. For discussions of the Internet as a network of networks, see also: Norton, Peering Playbook; Oxman, “Unregulation of the Internet”; ENISA, “Inter-X”; Yoo, “Internet’s Architecture”.

Another way to look at it is that the Internet has become the primary medium for the carriage of traffic globally. Figure 1 below4, from TeleGeography, shows that by mid-2002, seven years after the Internet became privately owned and managed, it accounted for 70% of all international traffic, with switched voice accounting for 5% and private networks accounting for the remaining 25%. By mid-2011, the Internet’s role became even more significant, with 80% of international traffic carried on the Internet. Switched voice has all but disappeared at 0.3% of traffic, and private networks now carry less than 20% of traffic.

Although the Internet quickly assumed the role of primary global communications medium, it continues to grow at a phenomenal rate. At the time the Internet was privatized in 1995, it connected fewer than 10 million hosts. By January 2002, it connected roughly 147 million hosts and by January 2012, it connected roughly 888 million hosts.5

4 Figure 1: Reproduced with permission from TeleGeography, “Capacity”, Figure 4, p. 6. 5 Internet Systems Consortium, “Host Count”.

There are various ways to look at the Internet’s growth. TeleGeography measures it in international Internet bandwidth—i.e., its capacity for carrying traffic between nations. Since 2002, that has grown from 0.9 Tbps to 54.9 Tbps, a compounded annual growth rate (CAGR) of 58%.6 As Figure 2 above shows, even in more recent years, international Internet bandwidth has more than quintupled.7 From mid-2007 to mid-2011 it grew from 8.7 Terabits per second (Tbps) to 54.9 Tbps. Even those statistics understate total global Internet bandwidth, because they measure only capacity for traffic that crosses international boundaries. For the U.S., in particular, that ignores roughly 80% of the bandwidth capacity (as measured at the ten largest U.S hubs), which has been growing at 37% CAGR over the last four years.8

And the growth is expected to continue. Cisco Visual Networking Index (VNI) publishes an annual forecast of Internet traffic. Unlike the TeleGeography graph which measures capacity—i.e., how much bandwidth the network could provide per second at any given point in time, Cisco’s graph, shown below, measures actual traffic carried over a period of time. Looking back at roughly the same period covered by TeleGeography, Cisco translates that capacity to exabytes used per month. In Figure 3, Cisco shows that traffic grew from roughly 80 petabytes per month in 2001 to more than 20 thousand

6 Calculation based on TeleGeography, “Capacity,” Figure 3, pp. 4-5. 7 Figure 2: Reproduced with permission from TeleGeography, “Capacity,” Figure 1, p. 1. 8 Calculation based on TeleGeography, “Region: United States,” Figures 4 and 5, pp. 4 and 6.

© Anna-Maria Kovacs 2012 Page 5 petabytes--i.e., 20 exabytes--per month in 2010.9 Given the already large base of traffic, growth can’t continue at that torrid rate. However, Cisco still projects a CAGR of 32% which will result in a quadrupling of traffic from 2010 to 2015, with traffic in 2015 expected to reach over 80 exabytes per month. On an annual basis, that will equate to a zettabyte, hence the name of Cisco’s mid-2011 VNI report—“Entering the Zettabyte Era”.

While both TeleGeography’s and Cisco’s statistics show the Internet’s remarkable ability to expand raw capacity to meet demand, Cisco VNI’s graph shows in greater detail the variety in types of demand that the Internet has met with seamless supply. The transformational milestones Cisco points out include shifts in types of end-users, devices, and types of traffic. Consumers overtook businesses as users of the Internet in 2003. In 2010, Internet video displaced peer-to-peer (P2P) as the largest source of consumer Internet traffic, a distinction P2P had claimed for the prior decade, according to Cisco. One critical driver--the number of networked devices--is expected to double in the next four years, even though in 2011 the number of networked device matches the entire global population. The nature of the devices also is changing with non-PC devices becoming increasingly prevalent. The nature of the traffic is changing in another respect, as well, with wireless--both fixed and mobile--playing an increasingly important role as origin or destination of traffic.

9 Figure 3: Reproduced with permission from Cisco, “Zettabyte Era,” Figure 1, p. 5.

Capacity on the Internet is not only growing rapidly, it is dispersed among a large number of owners. TeleGeography points out in its “Capacity” report that on international routes connected to the U.S., the top five carriers have only about 35% of the bandwidth, the next fifteen have about 33%, and the rest control another 32%.10 That distribution of capacity has been remarkably stable over the past five years.11

How does the Internet work?

An obvious question is, how does this wondrous creature work? What makes it so adaptable to changes in its ecosystem as well as so responsive to such large increases in the sheer volume of demand?

The Internet is actually a pretty simple construct that links independent networks that are responsible for maintaining themselves, and that interact via commercial agreements that may be as informal as “handshakes”:

 Each network that transmits data on the Internet is an Autonomous System (AS) and is identified via an ASN (Autonomous System Number). Each AS is responsible for maintaining the IP addresses of its own customers. To interconnect, the networks direct their IP traffic via their routing tables.

 The relevant protocols are TCP/IP at the transmission and Internet layers and BGP4 at the application layer.

 Physically, the Internet consists of routers that direct streams of packets over fiber, copper, coax, wireless, and satellite links. Each network is responsible for its own facilities. They meet at interexchange points that may be owned by one of the networks or by a commercial vendor.

 The infrastructure of the Internet is privately owned, and private investment has upgraded it continuously since 1995 to meet increasing and changing demands.

 Traffic on the Internet is exchanged based on commercial agreements among the relevant networks, with or without compensation. The agreements may or may not be formalized via written contracts.

Those are the essential characteristics of the Internet, and they have not changed fundamentally since 1995. It is a very simple, flexible, and resilient system that works well even though those agreements are now made among thousands of networks operating in countries across the globe.

What has changed is the level and type of demand placed upon the Internet, as users and applications have proliferated. The Internet has responded by modifying its topology and, along with it, some

10 TeleGeography, “Capacity,” pp. 31-32. 11 TeleGeography, “Capacity,” Figure 33, p. 32.

Who are the players and how have the relationships among them changed?

Network topology:

As Professor Yoo of the University of Pennsylvania explains in a paper about innovation in the Internet’s architecture,12 once the Internet was commercialized in 1995, several commercially-owned backbone providers took over from the prior NFSNET backbone, interconnecting with each other at Network Access Points (NAPs). These backbone Internet Service Providers (Tier-1 ISPs) also connected to regional ISPs (Tier-2 ISPs), whose networks in turn connected to local distribution facilities, i.e., central offices and cable head-ends. As Figure 4 shows,13 the relationship of last-mile providers, regional ISPs, and

backbone providers was hierarchical (as had been NFSNET), providing a unique path between each set of nodes.

12 Yoo, “Internet’s Architecture,” pp. 81-85. 13 Figure 4: Reproduced with permission from Yoo, “Internet’s Architecture,” Figure 3, p. 85.

Over time, that simple hierarchical topology has evolved into a more complex topology as it has responded to changes in volume and type of demand. In addition to backbone and regional ISPs, i.e., Tier-1 and Tier-2 ISPs, content delivery networks (CDNs)--some owned and/or dedicated to a single content provider and some serving many content providers--have been added to the mix. Rather than being limited to a single relationship, each of these may now exchange traffic with any of the others. Figure 514 below from ENISA’s report describing the resilience of the Internet interconnection system shows how complex the exchange has become.

The players and the mesh of commercial arrangements among them—peering, Internet transit, direct Internet access:

To understand the differences between the early topology and the current version, it is important to understand the function of each player and the basis on which traffic is exchanged between different types of players.15

 Backbone providers, also known as Tier-1 ISPs, often maintain backbone networks as well as IP- address routing tables that include all IP addresses, so that they are able to route traffic anywhere on the Internet.

14 Figure 5: Reproduced with permission from ENISA, “Inter-X,” Figure 28, p. 89. 15 See Norton, Peering Playbook; TeleGeography, “Market Structure” and “Pricing”; Woodcock and Adhikari, “Survey”; Yoo, “Internet’s Architecture.”

 The Regional ISPs, also known as Tier-2 ISPs, maintain smaller networks and IP-address routing tables that contain their own customers. They can also provide their customers with access to the whole Internet, but they do so by supplementing their own network with either unpaid or paid partners.

 Content delivery networks (CDNs) such as Akamai or Limelight enable content providers to cache their content at various points close to the edge of the Internet. Some CDNs serve multiple content providers, while others are dedicated to and owned by one specific content provider such as Google or Amazon. CDNs may rely heavily on ISPs for transport, but a few own facilities of their own that are as extensive as those of some backbone providers. In some cases, e.g. Level 3, an ISP may also take on the function of a CDN.

 IXPs are Internet exchange points. ISPs connect to one another at IXPs, which may host many ISPs or only a few. The IXPs may be owned by a particular ISP or may be owned by a third-party such as Equinix that is not an ISP itself, making that a ‘neutral’ IXP. CDNs may also connect to ISPs at IXPs.

All traffic among ISPs--or ISPs and CDNs--is exchanged on the basis of commercial agreements. There are no regulated rates for exchanging traffic over the Internet. As Figure 6 below shows, the agreements may be for paid or unpaid exchange, and may provide access to part or to all of the Internet.

 “Internet peering is the business relationship by which two companies reciprocally provide access to each other’s customers,” according to Bill Norton, one of the founders of Equinix and an expert on peering and Internet transit arrangements.16

 Peering provides two ISPs access to each other’s customers, not to the entire Internet. Peering has generally been unpaid—i.e., settlement-free—but a trend toward paid peering has developed, as well.  Internet transit is a paid arrangement. It gives the Tier-2 ISP or the CDN who pays Internet transit the right to reach the entire Internet. That reach comes not only via its partner’s own customer base, but also through all the relationships that the partner has with other ISPs.

 Bill Norton defines Internet transit: “Internet transit is the business relationship whereby an Internet Service Provider provides (usually sells) access to the global Internet.” He adds, “Customers connect their networks to their Transit Provider, and the Transit Provider does the rest.”17

 Thus, peering stops at the border of the partner’s own customer base. Transit, however, allows both parties to pass through and beyond the borders of the partner’s customer base, to enjoy the

16 Norton, Peering Playbook, p. 83. 17 Norton, Peering Playbook, p. 41.

benefit of all the relationships that the partner has with other partners, and that those, in turn, have with yet more providers, so that ultimately the entire Internet becomes reachable.

 Settlement-free peering:

o As the name suggests, settlement-free peering is done between “equals”. It does not involve payment—the traffic is freely exchanged. Each party provides the other partner with access to its own customers, not to the entire Internet.

o When the Internet was first commercialized, in the timeframe represented by Figure 4 above, settlement-free peering was the only form of peering available and was done only among Tier-1 ISPs (and universities).

o Settlement-free peering is still the most common method when Tier-1 ISPs exchange traffic with each other.

o However, today, settlement-free peering may occur not only between Tier-1 ISPs, but also between Tier-2 ISPs exchanging balanced amounts of traffic among themselves, or between a combination of CDNs, Tier-1 ISPs and Tier-2 ISPs, again depending on the balance of traffic and benefit to the parties.

o As Bill Norton points out in his Playbook, that balance is not just based on volume, but mutual benefit. It may consist of the volume of traffic peered bi-directionally, or it may be proportional to the desirability and/or uniqueness of the routes, or it may represent the number of end-users reached.18

 Paid peering: May be used if there is a traffic imbalance, so that settlement-free peering is not appropriate, but the paying ISP only wants access to its larger partner’s customer base, not to the whole Internet.

 Looking at it from the other angle, a payment-free relationship occurs between partners who are peers in the sense of bringing relatively equal traffic to the relationship. A paid relationship assumes that traffic will be out of balance in some way, and the form it takes—paid peering v. transit depends on the extent of the reach the payer wants.

 One of the most important points made by Bill Norton is that even settlement-free peering is not free, in that each party has its own costs to cover—costs of both links and the facilities at the IXP. Thus, each provider must decide for each route what method to use—peering, transit, or self- provisioning of facilities. The decision has to be based on the breakeven between the cost of transit and the cost of peering, on the volumes involved, and possibly based on other factors such as acceptable latency.19

In the early years of the commercial Internet, as depicted in Figure 4 above, Tier-2 ISPs connected to the entire Internet by buying transit from one particular backbone provider at one of the relatively few available interconnection points (IXPs).

Today, as depicted in Figure 5 above, the mesh of connections is much richer and more complex. In Figure 5, the yellow lines represent peering and the blue lines transit. A Tier-2 ISP may connect at any of a large number of IXPs, and may do so not only with multiple Tier-1 providers but also with Tier-2 providers of various sizes as well as with CDNs, some of which are owned by and serve one specific content provider.

Some of the largest content providers have, in effect, created networks equivalent to those of Tier-1 ISPs. Google has the most extensive set of peering points, covering every continent, but Microsoft, Yahoo, Amazon and Facebook also have extensive peering. TeleGeography, citing Arbor Networks, indicates that “Google has boosted its share of traffic exchanged via peering links from 40 percent in 2008 to 60 percent in 2010.”20

Not surprisingly, one of the best explanations of the range of choices available to a content provider who wants to distribute content over the Internet comes from Level 3, which is both a Tier-1 ISP and

18 Norton, Peering Playbook, p. 83. 19 Norton, Peering Playbook, p. 109. 20 TeleGeography, “Market Structure,” p. 6.

CDN. Figure 7 below21 was submitted by Nicolas Pujet, SVP of Corporate Strategy for Level 3, as part of a Declaration he made to the FCC in July 2011 in the Level 3 – Global Crossing merger docket. Pujet explained in that Declaration : “In the early days of the Internet, to reach the Internet and each other, content providers and ISPs were in large part dependent on purchasing IP transit from Tier 1 backbone providers, which acted as middlemen, exchanging their customers’ traffic between themselves through peering. Today’s ISPs and content providers have much more choice.”22 He details some of the options available today to a content provider or regional-ISP:23

 Because of the low cost of dark fiber as well as of dedicated wavelengths and of the associated equipment, it is increasingly common for content providers and non-backbone ISPs to build or lease their own physical networks, and then exchange traffic either via “direct peering”24 without using a 3d-party transit provider, or via public peering at interexchange points.

 Another option is to buy Internet transit from one or more providers who will then carry the IP traffic. Pujet notes that “Today there are dozens of providers with U.S. backbone networks

21 Figure 7: Reproduced from Level 3, “Pujet Declaration,” Figure 1, p. 6. 22 Level 3, “Pujet Declaration,” p. 5. 23 Level 3, “Pujet Declaration,” pp. 5-8.

24 Level 3, “Pujet Declaration,” p. 6.

providing transit service nationwide.”25 He includes a graphic (which we show as Figure 11) from DrPeering, i.e., William Norton, to show the radical decreases in Internet transit pricing that have occurred between 1998 and 2011.

 Yet another option is to pay a CDN to store content close to the ISP and end users, bypassing backbone transit providers completely. Specifically, Pujet notes that the Renesys dataset lists thousands of autonomous systems and says that Level 3’s IP Product Management team estimates that 38 companies sell transit or offer peering on a national basis using an IP backbone.26

 He also points out that multi-homing, i.e., sharing traffic over at least two providers, is a common practice, and that only about 10% of Level 3’s and Global Crossing’s customers are single-homed to one or the other.27

The FCC, in the order approving the Level 3 – Global Crossing merger without any conditions, discussed the various choices available for the exchange of Internet traffic, including the various forms of Internet peering and transit, and the use of CDNs. In its rationale for allowing the merger, the FCC noted that the number of Tier-1 ISPs has increased since 2005. It cited Level 3’s assertion that there may be as many as 38 providers that sell transit or offer peering on a nationwide basis. And it accepted Level 3’s arguments regarding multi-homing. The FCC noted that the relationships between the entities carrying Internet traffic are governed by privately negotiated commercial agreements. In allowing the merger, it described a market that offers numerous choices to customers large and small.28

Peering continues evolving, but remains highly informal:

What is particularly interesting is that this complex mesh of facilities and relationships works seamlessly, based on commercial relationships that in many cases are highly informal.

Packet Clearing House (PCH) published the results of a survey on May 2, 2011 in which it focused on peering relationships.29 PCH points out that there are 5039 ISPs that interconnect to form the mesh that is the Internet. PCH distributed a voluntary survey between October 2010 and March 2011. It received responses from roughly 86% of the ISPs, representing 96 countries, including all OECD member countries. As a result, PCH was able to study 142,210 peering agreements among 4331 different ISP networks. In 1032 cases, both parties to the same agreement responded, and PCH found that in 99.52% of the cases, their responses to the survey were identical, giving PCH comfort that survey respondents understood the questions clearly. PCH notes the limitations of its methodology, in that the survey was voluntary and does not represent all interconnections agreements that exist. Nevertheless, the sheer size of its sample makes its observations important.

25 Level 3, “Pujet Declaration,” p. 7. 26 Level 3, “Pujet Declaration,” p. 5. 27 Level 3, “Pujet Declaration,” p. 7. 28 FCC, “Global Crossing and Level 3 Consent to Transfer Control, pp. 9-16.” 29 Woodcock and Adhikari, “Survey.”

PCH found that:

 99.51% of the peering agreements—i.e., 141,512 of the 142,210--were informal. They “were ‘handshake’ agreements in which the parties agreed to informal or commonly understood terms without creating a written document. The common understanding is that only routes to customer networks are exchanged, that BGP version 4 is used to communicate those routes, and that each network will exercise a reasonable duty of care in cooperating to prevent abusive or criminal misuse of the network.”30

 99.73% of the agreements were symmetric. All but 374 or the 142,210 agreements “had symmetric terms, in which each party gave and received the same conditions as the other.” In the few asymmetric cases, one party compensates the other via paid peering to receive routes it might not receive, or has to meet minimum peering requirements. But in 141,836 cases, parties simply exchanged routes without settlements or other requirements.31

 Most of the networks have small numbers of interconnection partners, with 62% having ten or fewer. Only 12 networks had more than 700. However, there are some spikes which are the result of large multilateral peering agreements (MLPAs), at the Hong Kong, Warsaw, and Frankfurt Internet exchange points. The multilateral peering agreements tend to follow the same form and terms as bilateral, except that they have more than two parties.32

 Multilateral agreements appear to be gaining ground, especially outside the U.S. While most networks have few interconnection partners, those that do have them account for a large portion of the Autonomous System pairs PCH observed. PCH notes that “As an example, the 144 participants in the Hong Kong Internet Exchange multilateral peering agreement represent 10,296 AS-pair adjacencies, and each one of those participants individually exceeds the average “tier-1” carrier in degree of interconnection.”33 PCH speculates that “just as ‘donut peering’ overtook ‘tier-1’ peering in the late 1990’s, multilateral peering may now be overtaking bilateral peering, at east in sheer numbers, if not necessarily in volume of traffic.”34

 PCH finds that Tier-1 carriers tend to have many IPv4 addresses, but very few interconnection partners. On the other hand, large CDNs with similar scale and degree of infrastructure investment tend to have very broad interconnection, both in absolute numbers and in geographic diversity.35

30 Woodcock and Adhikari, “Survey,” p. 2. 31 Woodcock and Adhikari, “Survey,” p. 2. 32 Woodcock and Adhikari, “Survey,” p. 5. 33Woodcock and Adhikari, “Survey,” p. 6. 34 Woodcock and Adhikari, “Survey,” p. 6. 35 Woodcock and Adhikari, “Survey,” p. 7.

Thus, whatever advantage Tier-1 ISPs may have had in the past as a result of their extensive routing tables, new entrants can now achieve the same result by interconnecting with many partners, both via bilateral and multilateral agreements.

Internet Transit—prices are falling:

When an ISP (or CDN) buys Internet transit, it is paying its partner to transmit its traffic to the entire Internet, not only on the partner’s own network but on the entire mesh of networks with which the partner and the partner’s partners and their partners ad infinitum have Internet transit or peering agreements. The ISP pays for transit by port capacity, possibly but not necessarily with a minimum commitment. Unlike leased lines for which payment is a function of distance, Internet transit is not paid on a distance-basis, but on a capacity-basis, e.g. for full port size of 100 Mbps or 1 Gbps or 10 Gbps, or for a commitment for a portion of a port, i.e., for a specified data rate on a particular type of port. Alternately, payment may be for the data-rate that is actually experienced in a given month, usually measured at the 95th percentile (thus disregarding occasional peaks). Thus, the ISP is paying its partner to pass a certain amount of traffic through its port, from which point it can go anywhere on the Internet, by whatever route is available through that partner’s mesh of partners. Depending on the routes sought, an ISP (or CDN) might buy transit from a Tier-1 ISP or from a Tier-2 ISP.36

A general but not invariable rule is that rates are lower per Mbps:

 if a minimum capacity is committed—the vendor can plan for the capacity  for greater capacity—e.g. 900 Mbps costs less than 200 Mbps on a GigE port measured per Mbps  if it is on a higher capacity port (which to some extent also presumes greater volume, as well as possibly a newer and more cost-effective technology)

The TeleGeography database provides extensive detail about Internet Transit pricing: by city--both international and U.S. domestic, by type (SDH/SONET or Ethernet) and bandwidth of connection, and by carrier. These are summarized in various ways in TeleGeography’s Global Internet Geography Reports each year. A pair of tables from the 2011 pricing chapter, showing prices for some U.S. and Canadian cities, helps illustrate the point. The first table, Figure 8 below,37 shows median prices for the monthly recurring cost of a full-commit 1 GigE port and the second, Figure 9 below, for a 10 GigE port, for the years 2008-2011 (measured at mid-year).

 The tables show that prices have been falling steadily over the 2008-2011 period, even if one looks within a single technology and port size: down 12-18% compounded per year in the U.S. for 1 GigE port and down 17% to 25% compounded per year for 10 GigE ports.

 The tables show that there is some variation in median rates in the U.S. from city to city, but not much. The median across the country is fairly uniform, particularly at major hubs.

36 See: Norton, Peering Playbook; TeleGeography, “Market Structure” and “Pricing.” 37 Figures 8 and 9: Reproduced with permission from TeleGeography, “Pricing,” Figures 8 and 9, pp. 9 and 10.

 However, while the median price is fairly uniform across the U.S., TeleGeography also shows that there is quite a range around the median. For example, in New York, the price per megabit for a full GigE port at the end of second quarter 2011 ranged from $3.00 to $10.90, around the median of $6.70.38

 The price per Mbps in a given city, on a given port size, also ranges considerably by data-rate commitment, at least for some carriers. Again in New York in 2011, over a 1 GigE port, one carrier charges roughly $18 per Mbps when selling 100 Mbps but only about $6 when selling 1000 Mbps on a 1 GigE port. In the same city, for the same port type, another carrier’s price declines from $8 to $4 over the same range, while yet another’s price is fairly steady over the whole range at about $7 to $6.39

38 TeleGeography, “Pricing,” p. 7. 39 TeleGeography, “Pricing,” p. 9.

It is also important to note that while median-price variations within the U.S. for particular types and volumes are small, they are significant if one looks across the globe. Prices in the U.S. and Europe are roughly a third of what they are in Asia which in turn is about half the price in Latin America (disregarding Sydney and Manila, which appears to be the most expensive markets by far).40 But, as Figure 10, from TeleGeography,41 shows, prices are converging over time. As Norton explains extensively in his Playbook, carriers from high-priced regions, e.g. Latin America, Africa or Asia, have the option of using a direct connection to a low-priced region such as the U.S. and then using Internet transit from there. The convergence of transit prices in the international graph above may be an indicator that ISPs are making use of that option.

Focusing again on the U.S., the decline in Internet transit prices over the last 13 years, and the expectation that it will continue, are best summed up by the graphic below from Norton’s DrPeering website (and Playbook), Figure 11 below.42 Norton shows that the price of transit has been falling steadily and sharply. This chart tracks the price for Internet transit in the U.S. since 1998 and projects ahead to 2015. The price is expressed on a megabit/second basis for committed capacity. As Norton explains, it is a rough indicator, but it is a useful one in that it provides an extensive time series. It is also confirmed to some extent by various TeleGeography reports. For example, the February 2005 TeleGeography Bandwidth Pricing Report shows the price per Mbps in New York on an OC-3 port declining from 2003-2005 from a range of about $80 to $120 in 2005 to about $30 to $50 in 2005. Recent prices in the DrPeering graph correspond to the price for 10GigE ports.43

Norton explains that he polls 30-50 people three to five times a year at operations conferences that he attends each year.44 While the TeleGeography data we cite above is specific to particular cities and port types and sizes, our impression is that Norton’s data cuts across those variations. In other words, what he is gathering is what ISPs and CDNs are paying for the best Internet transit deal they can get, when they have done all their shopping across carriers, port size and types, potential routing, required quality, etc.

A slightly earlier version of this graph was cited by Level 3 in its FCC docket to show the rapid decrease in Internet transit prices. But Internet traffic exchange can be optimized even further. As Level 3’s Pujet pointed out to the FCC, content providers, CDNs and ISPs choose between directly-owned/leased facilities, Internet transit, and settlement-free or paid peering. Thus, even the sharply declining Internet transit prices in the DrPeering graph above do not fully reflect the lowest price available to those who wish to exchange traffic over the Internet.

40 TeleGeography, “Pricing,” p. 2 and “Regional Analysis Asia”, p. 16. 41 Figure 10: Reproduced with permission from TeleGeography, “Pricing,” Figure 1, p. 2. 42 Figure 11: Reproduced with permission from Norton, “Internet Transit Pricing.” Also in Norton, Peering Playbook, Figure 2-4, p. 48. 43 TeleGeography, “Pricing,” p. 10 and “Bandwidth Pricing Report” p. 2. 44 Norton, Peering Playbook, p. 48.

Even within a region, there is now usually a trade-off between peering vs. Internet transit for Tier-2 ISPs, large CDNs and content providers. One of the most interesting graphs in Norton’s Playbook, which we show as Figure 12 below, 45 depicts the break-even between peering and transit. Even when peering is settlement-free it does have costs—facility rent, utilities, router, etc. Norton explains how an operations manager or peering coordinator would go about deciding over what volume of traffic to peer rather than use Internet transit.

Similar sorts of calculations could be—and no doubt are--made for the breakeven between owning/leasing facilities, peering, and Internet transit.

45 Figure 12: Reproduced with permission from Norton, “Internet Transit Pricing.” Also in Norton, Peering Playbook, Figure 5-2, p. 109.

As Packet Clearing House, Level 3, and others point out, there is an enormous universe of providers of peering and transit among whom one can choose when seeking to exchange traffic. The simple universe of bilateral relationships that prevailed at the time the Internet was privatized has been replaced with a complex web of players, who can optimize for both price and quality.

How is the Internet ecosystem evolving?

The ability of the Internet to adapt to change has been critical to the success of the ecosystem that relies on it. New players have entered (and in some cases left) the market at various levels—backbone, regional ISP, CDNs, and content providers—some providing their own facilities, while others rely on the open market.

The networks they run are very different from the 64 kilobit lines that attached four mainframes in 1969--capacity is now measured in 100 Gigabit increments and the networks connect to and through myriad other networks. Not only are the networks that constitute the Internet itself changing, so are the things it connects. The Internet is simultaneously meeting the very different demands of ever-more- powerful mainframes, PCs in various client-server configurations and the emergence of multi-core PCs, as well as hundreds of millions of individual devices—from PCs to tablets to smartphone to game boxes- -each making its own separate demands over a variety of different broadband technologies. Upgrades

© Anna-Maria Kovacs 2012 Page 21 to access technologies—wired and wireless—are expect to result in a quadrupling of global average residential Internet connection download speed from 7 mbps to 28 mbps from 2010 to 2015.46

The Internet manages to respond to it all, without any ‘central planning.’

As Figure 13 below47, from TeleGeography, shows, the Internet keeps responding to enormous increases in demand for throughput with corresponding increases in supply. As peak utilization of a route gets to the 50%-60% level, the necessary investments are made to add capacity, to keep utilization within that margin of safety.

One aspect of the Internet’s adaptability is its accommodation of sheer volume growth. McKinsey’s recent study of the Internet’s impact on the economy notes that 2 billion people are now connected to the Internet.48 As Figure 14 below,49 from Cisco VNI’s “Entering the Zettabyte Era” white paper shows, consumption of bandwidth has grown exponentially. Global Internet traffic per capita increased from 1 megabyte per month in 1998 to 1 gigabyte per month in 2008 and is expected to grow to 9 gigabytes per month by 2015. Cisco expects total Internet traffic to grow from 1 exabyte per year (1000 gigabytes) in

46 Cisco, “Zettabyte Era,” p. 11. 47 Figure 13: Reproduced with permission from TeleGeography, “Traffic,” Figure 5, p. 6. 48 Manyika and Roxburgh, “Great Transformer,” p. 1. 49 Figure 14: Reproduced with permission from Cisco, “Zettabyte Era”, Figure 3, p. 7.

2001 to 1 exabyte per day in 2013.50 Global IP traffic has increased eight-fold from 2005 to 2010 and is expected to quadruple by 2015.51 In other words, total global Internet traffic is forecast to grow at a compounded annual rate of 32%, between 2010 and 2015, reaching roughly 1 zettabyte during 2015.52

But what also matters are the abrupt changes in the type of traffic. Steady flows of data were replaced around 2000 by vast amounts of P2P (peer-to-peer), which grew to two thirds of consumer Internet traffic by 2005. That, in turn, has been supplanted by video downloading, which exceeded P2P in 2010. By 2015, Cisco expects video to constitute 61% of consumer traffic and file sharing 24%, online gaming 15% and VOIP only 1%.53 Traffic from wireless devices—using WIFI as well as mobile--will exceed traffic from wired devices by 2015, at 54% up from 37% in 2010. Mobile data Internet traffic will grow at a compounded rate of 92%, to comprise 8% of total IP traffic by 2015, with fixed Wi-Fi comprising nearly half of total IP traffic in 201554. Other categories that could grow quickly include cloud-gaming, unicast rather than multicast TV broadcasting over the Internet, and adoption of 3DTV.55

50 Cisco, “Zettabyte Era”, pp. 6-7. 51 Cisco, “Forecast,” p. 1. 52 Cisco, “Zettabyte Era”, pp. 1 and 5. 53 Cisco, “Zettabyte Era,” pp. 2, 4, and 8. 54 Cisco, “Zettabyte Era,” pp. 2, 3, and 10. 55 Cisco, “Zettabyte Era,” pp. 13-14.

Cisco is far from alone in showing how dynamic the Internet is. Network upgrades—and thus investment--are a function of both the type of traffic and peak levels. Sandvine, which provides information on Internet traffic flows, shows the rapid change in the composition of Internet traffic. As Figure 15 from Sandvine shows,56 between 2009 and 2011, over North American fixed access networks, real-time entertainment increased from 29.5% of the peak-time traffic to 53.6%. In the same timeframe, web-browsing fell from 38.7% of the traffic to 16.6%.

As Figures 16 and 17 below, both from Sandvine,57 shows that very different applications constitute the traffic on fixed access v. mobile access, and for upstream v. downstream. Netflix makes up 29% share of aggregate fixed-access traffic, all of it on the downstream. BitTorrent (P2P) still makes up 47.6% of the upstream traffic on fixed networks. On mobile networks, however, BitTorrent only makes up 3.8% of the upstream, and Netflix makes no appearance in the top-10 applications at all. For mobile, Facebook, HTTP, and YouTube are the applications that account for the greatest traffic.

56 Figure 15: Reproduced with permission from Sandvine, “Global Internet Phenomena,” Figure 2, p. 6. 57 Figures 16 and 17: Reproduced with permission from Sandvine, “Global Internet Phenomena,” Tables 1 and 2, pp. 8 and 12.

The difference in the type of application that users access over fixed v. mobile broadband makes the prediction of explosive growth in mobile broadband over the next five years particularly significant. Ericsson’s Traffic and Market Data Report: on the Pulse of the Networked Society, which was published in November 2011, forecasts that mobile broadband subscriptions will rise from about 1 billion in 2011 to nearly 5 billion in 2016, with roughly half a billion PCs and tablets and the vast majority handheld devices. Ericsson expects fixed broadband subscriptions to remain well under 1 billion in 2016, but points out that while mobile subscriptions generally mean one user per subscription, fixed means one per household, with as many as three users per fixed subscription.58

The change in the type of applications that account for Internet traffic has been reflected in changes among those who carry the traffic. ATLAS Observatory analyzes traffic based on anonymous Autonomous System Number (ASN) (origin/transit) data. In 2007, the top-10 networks that accounted for 29% of Internet traffic were all traditional Tier-1 ISPs. By 2009, Google and Comcast had entered the top 10. Google, in fact, took over the #3 spot with 5.2% of traffic, more than any ISP except Level 3 and Global Crossing, who have since merged and whose combined share increased from 10.3% in 2007 to 15.1% in 2009.59

The Internet and the global economy:

The OECD did an extensive study called the “Future of the Internet Economy” on the contribution of the Internet to the global economy. As the FCC’s “National Broadband Plan” had found for the U.S., the OECD found that the Internet can improve people’s lives via e-commerce, education and job training, e- health, and access to employment. The study also found that from 1995 to 2008, the ICT-services sector grew gross-value-added much faster than the OECD’s total businesses and total services, and that ICT- services employment growth over that period much exceeded that of business as a whole, with ICT employment growing at 18% v. business employment at 12%. The OECD study also found that ICT investment contributed more to GDP growth in most OECD countries than non-ICT investment in the 2000-2009 period. The OECD study also noted particularly the contributions ICT makes to labor productivity and R&D investment.60

McKinsey Global Institute’s October 2011 paper “The great transformer: The impact of the Internet on economic growth and prosperity” points out that the Internet accounted for 21% of the GDP growth for mature economies over the past five years. McKinsey found that the Internet accounts, on average, for 3.4% of GDP in the large economics that account for 70% of global GDP.61 McKinsey also highlights that maturity of the Internet ecosystem has a positive impact on living standards, via an increase in real per capita GDP of $500. The Internet rejuvenates traditional businesses, as well as creating new online businesses, and is a catalyst for job creation.62 Summing up, McKinsey highlights that the Internet is a

58 Ericsson, “Traffic,” p. 6. 59 McPherson, “Bandwidth Bandwagon,” p. 5. 60 OECD, “Future of the Internet Economy,” pp. 26-27, 29. 61 Manyika and Roxburgh, “Great Transformer,” p. 1. 62 Manyika and Roxburgh, “Great Transformer,” p. 3.

“positive disruptor”: “we should not lose sight of the enormous value the Internet economy has already brought to rich and poor nations alike and its potential to boost growth across the globe.”63

Finally, a recent study by Ericsson, Arthur D. Little, and Chalmers University of Technology found that doubling the broadband speed for an economy increases GDP by 0.3%, and that additional doublings of speed can yield an additional GDP stimulation of 0.3%, so that a quadrupling of broadband speed would result in 0.6% GDP stimulation.64 That makes Cisco’s expectation of quadrupling of download speed during the 2010-2015 period particularly encouraging.65

Summary and Implications:

What does all of this say about the Internet? It is an extraordinarily successful demonstration of Adam Smith’s “invisible hand.” The Internet evolved, naturally, in tandem with the evolution of its ecosystem, both depending upon and enabling changes in computing, software, and network technologies. Both the building blocks of the Internet itself and all those things the Internet connects have been transformed repeatedly since the 1960’s. With absolutely no regulatory intervention, with a compensation system that is entirely unregulated and to a great extent informal, the Internet has responded to demand that is not just explosive in volume but unpredictable in type. Supply has unfailingly met demand, at ever-lower prices.

The Internet’s responsiveness and adaptability stands in stark contrast to the rigidity created by the regulatory compensation regimes that have stifled conventional telephony. An April 2009 OECD paper points out that the accounting-rate system constrained the use of international telecommunications services and did not tend to result in network investment.66 The problematic effects of the U.S. intercarrier compensation system have been thoroughly aired in the recent FCC reform docket.67

What is worth highlighting is that the reform the FCC just ordered involves a transition that will take seven more years to complete, having been ordered fifteen years ago in the Telecom Act of 1996, having been attempted several times in the years since then. In the meantime, the U.S. switched- communications market has withered.

The Internet, on the other hand, was commercialized in 1995 and in the sixteen years since then has added thousands of networks serving hundreds of millions of people and their devices around the globe. It responds to new applications, such as video-downloading, by expanding bandwidth at a rate of nearly 60% per year, spawning a new layer of network architecture around CDNs, and welcoming Google into the top-10 network providers in the number three spot as soon as Google chooses to provide its own network.

63 Manyika and Roxburgh, “Great Transformer,” p. 9. 64 Chalmers University, press release. 65 Cisco, “Zettabyte Era,” p. 11. 66 OECD, “Network Externality,” pp. 11-12. 67 FCC, Report and Order.

What makes the Internet so effective is not just its own simplicity and adaptability, but the absence of externally imposed rigidity. In 1999, Jason Oxman wrote in an FCC working paper: “The success of the Internet has not been an accidental development. Market forces have driven the Internet’s growth, and the FCC has had an important role to play in creating a deregulatory environment in which the Internet could flourish.”68 In June of 2011, an OECD “Communiqé on Principles for Internet Policy- Making” makes the same point: “As a decentralized network of networks, the Internet has achieved global interconnection without the development of any international regulatory regime. The development of such a formal regulatory regime could risk undermining its growth.”69

Indeed, any attempt to impose economic regulation on the Internet is likely to slow not only its own evolution but the innovation at the edge that depends on the internet’s core. The multi-year delays and the rigidity that accompany regulatory proceedings are not designed for either the growth rate or shape-shifting of the Internet. Were the Internet subjected to economic regulation, investors would expect slower growth and less responsiveness not only in the market for infrastructure, but in the edge markets for services, applications and devices that rely on it. Funding the Internet’s infrastructure would become more difficult.

Vinton Cerf, David Clark, and several others who contributed to the genesis of the Internet recently wrote a brief history of the Internet, from which we cited extensively at the beginning of this paper. Their summation was: “One should not conclude that the Internet has now finished changing….[It] is making possible a new paradigm of nomadic computing and communications.”70 That paradigm will bring its own new challenges, which can best be met within a commercial, unregulated framework.

68 Oxman, “Unregulation of the Internet,” p. 3. 69 OECD, “Communiqué,” p. 3. 70 Leiner, Cerf, and Clark, “Brief History of the Internet.”

Internet Peering and Transit bibliography:

Cisco. “Cisco Visual Networking Index: Forecast and Methodology 2010-2015.” June 1, 2011. Last accessed on April 1, 2012 at http://www.cisco.com/en/US/solutions/collateral/ns341/ns525/ns537/ns705/ns827/white_paper_c11- 481360_ns827_Networking_Solutions_White_Paper.html

Cisco. “Cisco Visual Networking Index: Entering the Zettabyte Era”, June 1, 2011. Last accessed on 12/6/11 on the Cisco website under White Papers. Last accessed on April 1, 2012 at http://www.cisco.com/en/US/solutions/collateral/ns341/ns525/ns537/ns705/ns827/VNI_Hyperconnect ivity_WP.html

Chalmers University of Technology, Ericsson, and Arthur D. Little. Press release. September 27, 2011. Last accessed on April 2, 2012 at http://www.chalmers.se/en/news/Pages/New-study-quantifies-the- impact-of-broadband-speed-on-GDP.aspx

Elliott, Jim. “IBM Mainframes – 45+ Years of Evolution.” IBM Corporation, 2010. On IBM website, last accessed on April 2, 2012 at http://www.vm.ibm.com/devpages/JELLIOTT/pdfs/zhistory.pdf

European Network and Information Security Agency (ENISA) “Inter-X: Resilience of the Internet Interconnection Ecosystem.” Ed. Panagiotis Trimintzios. Full Report, April 2011. Last accessed on April 2, 2012 at http://www.enisa.europa.eu/activities/Resilience-and-CIIP/networks-and-services- resilience/inter-x/interx/report/interx-report

Ericsson. “Traffic and Market Data Report – on the Pulse of the Networked Society.” November, 2011. Online. Last accessed on April 2, 2012 at http://hugin.info/1061/R/1561267/483187.pdf

Federal Communications Commission. “Memorandum Opinion and Order and Declaratory Ruling: In Matter of Applications filed by Global Crossing Limited and Level 3 Communications, Inc. for Consent to Transfer Control.” IB Docket No. 11-78. Adopted September 29, 2011. Last accessed on April 2, 2012 at http://transition.fcc.gov/wcb/cpd/214Transfer/214completed2011.html

Federal Communications Commission. “National Broadband Plan.” 2010. Last accessed on April 2, 2012 at http://www.broadband.gov/plan/

Federal Communications Commission. “Report and Order and Further Notice of Proposed Rulemaking.” WC dockets 10-90, 01-92, 96-45. Released November 18, 2011. Last accessed on April 2, 2012 at http://transition.fcc.gov/Daily_Releases/Daily_Business/2012/db0206/FCC-11-161A1.pdf

Internet Systems Consortium. “Internet Host Count History.” 2011. Last accessed April 2, 2012 at http://www.isc.org/solutions/survey/history

Kende, Michael. “The Digital Handshake: Connecting Internet Backbones.” OPP Working Paper No. 32, Federal Communications Commission, September 2000. Last accessed on April 2, 2012 at http://www.fcc.gov/working-papers/digital-handshake-connecting-internet-backbones

Kende, Michael. “Overview of recent changes in the IP interconnection ecosystem.” Analysys Mason, January 23, 2011.

Leiner, Barry M., Vinton G. Cerf, David D. Clark, et al. “A Brief History of the Internet,” Internet Society, 2011. Last accessed on April 2, 2012 at http://internetsociety.org/internet/internet-51/history- internet/brief-history-internet

Level 3 Communications Inc. “Declaration of Nicolas Pujet.” In Federal Communications Commission IB Docket 11-78, July 21, 2011. Last accessed on April 2, 2012 at http://apps.fcc.gov/ecfs/document/view?id=7021695741

Level 3 Communications Inc. and Global Crossing Limited. “Joint Opposition and Reply Comments.” In Federal Communications Commission IB Docket 11-78, July 21, 2011. Last accessed on April 2, 2012 at http://apps.fcc.gov/ecfs/document/view?id=7021695740

Labovitz, Craig, Scott lekel-Johnson, Danny McPherson, Jon Oberheide, and Farnam Jahanian. “Internet Inter-Domain Traffic.” New Delhi, India: SIGCOMM’10, August 30-September 3, 2010.

Labovitz, C., lekel-Johnson, S., McPherson, Danny, et al. “ATLAS Internet Observatory 2009 Annual Report.” Last accessed on April 2, 2012 at http://www.nanog.org/meetings/nanog47/presentations/Monday/Labovitz_ObserveReport_N47_Mon. pdf

Manyika, James and Charles Roxburgh. “The great transformer: The impact of the Internet on economic growth and prosperity.” McKinsey Global Institute, October 2011. Last accessed on April 1, 2012 at http://www.mckinsey.com/Insights/MGI/Research/Technology_and_Innovation/The_great_transformer

McPherson, Danny. “Bandwidth Bandwagon: An ISOC Briefing Panel.” ATLAS Internet Observatory. November 11, 2009. Last accessed on April 2, 2012 at http://www.isoc.org/isoc/conferences/bwpanel/docs/20091111_bandwidth_mcpherson.pdf

Norton, William B. The Internet Peering Playbook: Connecting to the Core of the Internet. Palo Alto: DrPeering Press, 2011. Paper edition.

Norton, William B. “Internet Transit Pricing – Historical and Projected.” DrPeering.net, 2011. Last accessed on April 2, 2012 at http://drpeering.net/white-papers/Internet-Transit-Pricing-Historical-And- Projected.php

OECD. “ Communiqué on Principles for Internet Policy-Making: OECD High-Level Meeting on the Internet Economy”. Paris: June 28-29, 2011. Last accessed on April 2, 2012 at http://www.oecd.org/dataoecd/33/12/48387430.pdf

OECD. “The Future of the Internet Economy – A Statistical Profile.” June 2011 update. Last accessed on April 2, 2012 at http://www.oecd.org/dataoecd/24/5/48255770.pdf

OECD. “Network Externality Premiums and International Telecommunication Traffic Exchange.” OECD Digital Economy Paper 152. OECD Publishing, April 15, 2009. http://dx.doi.org/10.1787/222470556326

Oxman, Jason. “The FCC and the Unregulation of the Internet.” OPP Working Paper No. 31, Federal Communications Commission, July 1999. Last accessed on April 2, 2012 at http://www.fcc.gov/working- papers/fcc-and-unregulation-internet

Sandvine Intelligent Broadband Networks. “Global Internet Phenomena Report.” Fall, 2011. Last accessed on April 2, 2012 at http://www.sandvine.com/downloads/documents/10-26- 2011_phenomena/Sandvine%20Global%20Internet%20Phenomena%20Report%20- %20Fall%202011.pdf

TeleGeography. “Global Internet Geography: Capacity Trends.” PriMetrica Inc., 2011.

TeleGeography. “Global Internet Geography: Bandwidth by Region.” PriMetrica Inc., 2011

TeleGeography. “Global Internet Geography: Market Structure.” PriMetrica Inc., 2011.

TeleGeography. “Global Internet Geography: Pricing.” PriMetrica Inc., 2011.

TeleGeography. “Global Internet Geography: Regional Analysis--Asia.” PriMetrica Inc., 2011.

TeleGeography. “Global Internet Geography: Traffic.” PriMetrica Inc., 2011.

TeleGeography. “TeleGeography’s Bandwidth Pricing Report.” PriMetrica Inc., February 2005 and July 2005.

Telephone World, “Overview & Background on Electronic & Digital Switching Systems.” December 17, 2010.

Woodcock, Bill and Vijay Adhikari. “Survey of Characteristics of Internet Carrier Interconnection Agreements.” San Francisco: Packet Clearing House, May 2, 2011. Last accessed on April 2, 2012 at http://www.pch.net/resources/papers//peering-survey/PCH-Peering-Survey-2011.pdf

Yoo, Christopher S. ”Innovations in the Internet’s Architecture that Challenge the Status Quo.” Journal on Telecommunications and High Tech Law 8 (2009): 79-100.

78th Session SB 289 ITAB Related Legislative Testimony

SB289 View Bill in NELIS Introduced in the Senate on Mar 16, 2015. Revises provisions relating to the Information Technology Advisory Board. (BDR S-892) By: (sponsorship) Mo Denis, Paul Anderson; Fiscal Notes View Fiscal Notes; Effect on Local Government: No. Effect on State: Yes.

78th Legislative Session Activity, chronological order:

1. Senate March 16, 2015 Read first time. Referred to Committee on Government Affairs. To committee. Senate Bill No. 289—AN ACT relating to homeland security; requiring each provider of Internet protocol service which serves an agency or political subdivision of this State to maintain certain peering arrangements within this State; and providing other matters properly relating thereto. Senator Denis moved that the bill be referred to the Committee on Government Affairs. Motion carried. [Senate Journal, 3/16/15, pg 6] http://nvleg.granicus.com/MediaPlayer.php?view_id=14&clip_id=3758

2. Senate March 17, 2015 Read From printer. To committee.

3. Senate Government Affairs Mar 30, 2015 01:00 PM Agenda Heard, No Action http://nvleg.granicus.com/MediaPlayer.php?view_id=14&clip_id=4031

4. Senate Government Affairs Apr 10, 2015 01:00 PM Agenda Amend, and do pass as amended http://nvleg.granicus.com/MediaPlayer.php?view_id=14&clip_id=4297

5. Senate Final Passage (1st Reprint) Apr 16, 2015 Read 2nd and 3rd time, Passed, and amended. Yea 20, Nay 0, Excused 1, Not Voting 0, Absent 0 Placed on Second Reading File. Read second time. Amended. (Amend. No. 472.) To printer. [pg 9 - 12]; Declared an emergency measure under the Constitution; Read third time. Passed, as amended. [pg 173] http://nvleg.granicus.com/MediaPlayer.php?view_id=14&clip_id=4374

6. Assembly April 17, 2015 Read first time. Referred to Committee

7. Assembly Government Affairs May 07, 2015 08:30 AM Agenda Heard Bill Text As Introduced 1st Reprint Adopted Amendments Amend. No. 472 http://nvleg.granicus.com/MediaPlayer.php?view_id=14&clip_id=4717

8. Assembly Government Affairs May 12, 2015 08:30 AM Work Session Agenda Amend, and do pass

Bill Source: http://leg.state.nv.us/Session/78th2015/Reports/history.cfm?ID=677

LCB Source: http://www.leg.state.nv.us/Granicus/ Meeting & Floor Session Videos

Request for Information Information Technology Advisory Board Study of Peering

Senate Bill No. 289 as passed by the Nevada Legislature (2015 Session) directed the Information Technology Advisory Board (ITAB) “to conduct a study of peering that includes, without limitation, an analysis of potential benefits of peering arrangements to the State and its political subdivisions.”

As originally introduced, Senate Bill No. 289 provided, in part, “Sec. 6. 1.Each provider of Internet protocol service which serves any agency or political subdivision of this State shall interconnect and maintain a peering arrangement within this State with all other providers of Internet protocol service which serve any agency or political subdivision of this State. 2. An agency or political subdivision of this State may not obtain Internet protocol service from a provider of Internet protocol service if the provider has not complied with the provisions of subsection 1.” The foregoing text does not appear in the bill as passed by the Legislature.

Jurisdictional and Pre-emption Issues The Federal Communication Commission, in its Report and Order released on March 12, 2015 (FCC 15-24), popularly referred to as the “Net Neutrality Order”, provided as follows in Paragraph 202, page 92-93:

As discussed, Internet traffic exchange agreements have historically been and will continue to be commercially negotiated. We do not believe that it is appropriate or necessary to subject arrangements for Internet traffic exchange (which are subsumed within broadband Internet access service) to the rules we adopt today. We conclude that it would be premature to adopt prescriptive rules to address any problems that have arisen or may arise.

Additionally, in paragraph 203, page 93:

At this time, we believe that a case-by-case approach is appropriate regarding Internet traffic exchange arrangements between broadband Internet access service providers and edge providers or intermediaries—an area that historically has functioned without significant Commission oversight.518 Given the constantly evolving market for Internet traffic exchange, we conclude that at this time it would be difficult to predict what

new arrangements will arise to serve consumers’ and edge providers’ needs going forward, as usage patterns, content offerings, and capacity requirements continue to evolve.519 Thus, we will rely on the regulatory backstop prohibiting common carriers from engaging in unjust and unreasonable practices. Our “light touch” approach does not directly regulate interconnection practices. Of course, this regulatory backstop is not a substitute for robust competition. The Commission’s regulatory and enforcement oversight, including over common carriers, is complementary to vigorous antitrust enforcement. [Footnotes omitted]

The FCC’s Net Neutrality Order was appealed, and, on June 14, 2016, the United States Court of Appeals for the District of Columbia upheld the order and its jurisdictional basis.

Question 1: Does the doctrine of federal preemption effectively prevent a state from enforcing any statutory or regulatory provision affecting “arrangements for Internet traffic exchange” including peering?

Risk Reduction Issues Various propositions were put to the Legislature in committee hearings regarding risk reduction if in-state peering were required. These propositions are generally devisable into two categories: risk reduction in the physical world (involving continuity of service) and risk reduction in the cyber world (involving wrongful access to information).

Physical world threats include destruction of internet backbone infrastructure facilities (for example, severance of a fiber link or destruction of a key microwave facility), destruction of a last-mile facility (for example, the physical link – copper wire, fiber, or wireless – connecting a government building, enterprise, or home with a larger, upstream, telecommunications infrastructure facility), and physical security of the data center within which the peering exchange of traffic takes place.

Since the earliest days of ARPANET, the internet has been designed to be self- healing. Information headed towards a destination on a path determined by the routing tables within a router will be re-routed on a secondary path if the primary path is not available. So, a packet from Clark County destined for Washoe County will be re-routed if the primary path (as determined by routing tables) is unavailable. This is true regardless of whether the primary path is via an out-of- state facility or whether the primary path is wholly within the State. Specifically, a packet travelling over a wholly in-state facility as directed by the routing table of a required in-state peering router, will be directed to an out-of-state path if the more direct in-state path is unavailable. Bottom line: restoration of public internet

connectivity will occur whether in-state peering is required or not. Caveat: the self- healing of internet backbone facilities does not apply to private or closed networks where routing is limited to those facilities included within the private network. As regards private networks, restoration of service in the event of a physical disruption is a function of network design and would not be affected by an in-state peering requirement.

Loss of a last-mile facility will result in loss of internet connectivity. Period. Requiring in-state peering will not address this physical risk.

Requiring in-state peering does not, by itself, address the issue of physical compromise of a data center within which peering occurs.

Question 2 If, as outlined above, the physical world threat (involving continuity of service) over public internet facilities between two points in Nevada is not realistically affected by an in-state peering requirement, should Nevada instead legislate minimum physical security requirements for data centers in Nevada where peering of public internet traffic takes place as the most effective way to reduce risk in the physical world?

Cyber threats (involving wrongful access to information) can be directed at information in transit or information at rest.

While an in-state peering requirement may well affect the route taken by packets originating in Clark County and destined for Washoe County, that requirement does nothing to reduce the cyber threat to information at rest at either the originating location or at the destination location.

The Nevada Encryption Statute, NRS 603A.215, passed in the 2009 Legislative session, was designed to protect certain data in transit by incentivizing data collectors doing business in Nevada to encrypt personal information to the current encryption standard adopted by the National Institute of Standards and Technology (NIST). The 2015 Legislature expanded the scope of protected in-transit data by expanding the definition of “personal information.” The approach of Nevada in incentivizing desired behavior can be contrasted by the contemporaneous approach of Massachusetts, which put in place a detailed regulatory environment that mandated entities to adopt specified procedures in order to protect data from wrongful access.

Question 3 What percent of successful data compromises have been directed at data in transit as compared with those directed at data at rest? In Nevada as compared with the United States as a whole? How will an in-state peering requirement increase the security of in-transit data originating from, or destined for, a location in Nevada?

Service Improvement Issues Various propositions were put to the Legislature in committee hearings regarding service improvement if in-state peering were required

All other things being equal, it is true that a shorter, more direct communications pathway over public internet facilities will theoretically reduce latency and jitter, thereby improving the end user experience when watching streaming video or participating in a voice communication. (Virtually all of what used to be described as “long distance” calls involve a at least a portion of the call utilizing Voice over Internet Protocol, or VoIP.)

However, “all other things” are seldom equal. The entire communications pathway includes facilities other than public internet facilities. The end user experience can be degraded if, for example, last mile facilities are undersized, if internal Local Area Networks or home networks are congested, or if a cellular end user is experiencing signal attenuation from being located too far from a serving cellular tower.

Question 4 Will an in-state peering requirement result in an increase in service quality that is perceptible to the end user? How do you know?

No other states currently require in-state peering.

Question 5 What would be the effect on Nevada end users if contiguous states enacted in- state peering requirements identical to those enacted in Nevada? If all states enacted identical requirements? If all countries enacted similar provisions?

Contract and Competition Issues Various propositions were put to the Legislature in committee hearings regarding a reduction of competition among major communications carriers in the event that some did not comply with whatever final requirements an in-state peering mandate contained and, consequently, would be compelled to limit their service offerings in Nevada.

other judicial officers (2) information supporting the de-centralized functioning of the Departments of Motor Vehicles, Health and Human Services, Training and Rehabilitation, Agriculture, Business and Industry, Public Safety (including the Division of Homeland Security), and all other state agencies.

Virtually all county and municipal governments operate their own private networks, sized appropriately for their individual needs.

All private networks operated by Nevada governments rely heavily, almost exclusively, on facilities and services that are owned or operated by major communications carriers. (The State microwave system currently is a significant exception.)

Question 6 To carriers (secondarily to governments): Do you provide facilities and/or services considered essential to the continued, non-degraded, functioning of government private networks? Are these facilities and/or services currently subject to competition, that is, could a competitor replace the facilities and/or services you provide?

Should an in-state peering requirement reduce carrier competition, one of the affected markets is likely to be the market for facilities and/or services necessary to support private networks (including government private networks)

A major set of intended beneficiaries of an in-state peering requirement would be end users (see Question 4 above).

The set of potentially adversely affected entities (governments operating private networks) may overlap, but is not congruent with, the set of intended beneficiaries (end users of public internet services).

Question 7 Discuss the public policy considerations that would support the financial risk of in-state peering being borne by one set of entities while the proposed benefits of in-state peering would be conferred on another set of entities.

An in-state peering requirement that uses as an enforcement mechanism the prohibition of entering into a negotiated contract with government entities, changes, directly or indirectly, or supplements, the current provisions of Chapter 332, Purchasing: Local Governments, and of Chapter 333, Purchasing: State, Nevada Revised Statutes, and their implementing regulations.

What attendant statutory or regulatory changes would be required? For example, could an entity object to a contract award on the basis of non- compliance with an in-state peering requirement even though that entity did not participate in the relevant procurement process (an RFP or sole source procurement justified by a lack of vendors capable of supplying needed communications facilities and/or services)? Are the costs of the oversight and enforcement efforts justified by the likely benefits of an in-state peering requirement? (See Questions 3 and 4 above.)

Economic Development Issues Various propositions were put to the Legislature in committee hearings suggesting that by being the first state in the country to require in-state peering, Nevada would become more attractive to firms (particularly “high tech” companies) considering relocation to Nevada.

Yet, a mainstay of Nevada’s economic development strategy is to emphasize its low regulatory environment.

Requiring in-state peering would entail state interference in a market previously the exclusive domain of privately negotiated commercial agreements – a domain that even the Federal Communications Commission has refrained from regulating. (See text preceding Question 1.)

Question 9 What benefits, attributable to an in-state peering requirement, would appeal to an enterprise considering relocating to Nevada? Conversely, what enterprises, if any, would consider an in-state peering requirement as a negative factor in determining whether to relocate to Nevada?

Obsolescence Issues Various propositions were put to the Legislature in committee hearings suggesting that an in-state peering requirement could be effectuated once fiber infrastructure was constructed that provided a direct optical/electronic pathway between Clark and Washoe Counties.

The anticipated completion date for that infrastructure project is before the final day of the 2017 Legislative session.

Question 10 If the benefits of in-state transit are sufficiently great (see Questions 3 and 4), won’t providers of services delivered over public internet facilities negotiate

the use of wholly in-state fiber facilities in order to provide the best possible service to Nevada end users as a matter of self interest, thereby rendering an in-state peering requirement irrelevant?

Technology marches on.

Software-defined networking (SDN) and SD-WAN technology purportedly allows network administrators to decouple network control from the underlying physical infrastructure.

Question 11 Are there emerging or anticipated technologies that would replace, in whole or in part, traditional routing functions and peering arrangements, thereby rendering an in-state peering requirement obsolete? If so, in what time frame are these technologies likely to emerge as significant substitutes for existing technologies and commercial peering agreements?

Other Issues Question 12 What other issues, not covered by the foregoing questions, do you believe are relevant to the Peering Study undertaken by the Information Advisory Board (ITAB)?

Option to appear before ITAB Question 13 Would you like to appear before ITAB to augment your responses to the foregoing questions?

The length of your testimony will be determined by the Chair, but you should anticipate your testimony will be limited to 10 minutes.

Submission Requirements Unlike the FCC and state public utility commissions, ITAB has no dedicated staff. Submissions will be provided to Board members and made available to the public on the web site maintained by the Enterprise IT Services Division of the Nevada Department of Administration (see, http://it.nv.gov/Governance/dtls/ITAB/Information_Technology_Advisory_Board_(ITAB)/ )

Answers to the foregoing questions are limited to a total of five pages (8”x11”), using 12 pt. Times Roman or comparable font, single spaced, 1” margin on both sides, top and bottom and submitted in electronic .pdf format.

In order to be considered, answers must be sent to [email address] with “ITAB Peering [Your Name]” in the subject line not later than [date, approximately 10 days before next scheduled ITAB meeting]

______

Attachment C Follows

Request for Information Information Technology Advisory Board Study of Peering

Legislative Background Senate Bill No. 289 [S.B. 289] as passed by the Nevada Legislature (2015 Session) directed the Information Technology Advisory Board (ITAB) “to conduct a study of peering that includes, without limitation, an analysis of potential benefits of peering arrangements to the State and its political subdivisions.”

As originally introduced, S.B. 289 provided, in part, “Sec. 6. 1.Each provider of Internet protocol service which serves any agency or political subdivision of this State shall interconnect and maintain a peering arrangement within this State with all other providers of Internet protocol service which serve any agency or political subdivision of this State. 2. An agency or political subdivision of this State may not obtain Internet protocol service from a provider of Internet protocol service if the provider has not complied with the provisions of subsection 1.” The foregoing text does not appear in the bill as passed by the Legislature.

S.B. 289 View Bill in NELIS Introduced in the Senate on Mar 16, 2015. Revises provisions relating to the Information Technology Advisory Board. (BDR S-892) By: (sponsorship) Mo Denis, Paul Anderson; Fiscal Notes View Fiscal Notes; Effect on Local Government: No. Effect on State: Yes.

78th Legislative Session Activity, chronological order: 1. Senate March 16, 2015 Read first time. Referred to Committee on Government Affairs. To committee. Senate Bill No. 289—AN ACT relating to homeland security; requiring each provider of Internet protocol service which serves an agency or political subdivision of this State to maintain certain peering arrangements within this State; and providing other matters properly relating thereto. Senator Denis moved that the bill be referred to the Committee on Government Affairs. Motion carried. [Senate Journal, 3/16/15, pg 6] http://nvleg.granicus.com/MediaPlayer.php?view_id=14&clip_id=3758 2. Senate March 17, 2015 Read. From printer. To committee. 3. Senate Government Affairs Mar 30, 2015 Agenda Heard, No Action http://nvleg.granicus.com/MediaPlayer.php?view_id=14&clip_id=4031 4. Senate Government Affairs Apr 10, 2015 Agenda Amend, and do pass as amended http://nvleg.granicus.com/MediaPlayer.php?view_id=14&clip_id=4297

5. Senate Final Passage (1st Reprint) Apr 16, 2015 Read 2nd and 3rd time, Passed, and amended. Yea 20, Nay 0, Excused 1, Not Voting 0, Absent 0 Placed on Second Reading File. Read second time. Amended. (Amend. No. 472.) Read third time. Passed, as amended. http://nvleg.granicus.com/MediaPlayer.php?view_id=14&clip_id=4374 6. Assembly April 17, 2015 Read first time. Referred to Committee 7. Assembly Government Affairs May 07, 2015 Agenda Heard Bill Text As Introduced 1st Reprint Adopted Amendments Amend. No. 472 http://nvleg.granicus.com/MediaPlayer.php?view_id=14&clip_id=4717 8. Assembly Government Affairs May 12, 2015 Work Session Agenda Amend, and do pass http://nvleg.granicus.com/MediaPlayer.php?view_id=14&clip_id=4799 9. Assembly May 13, 2015 From committee: Do pass. 10. Assembly May 14, 2015 Read second time. 11. Assembly May 18, 2015 Read third time. Passed. Title approved. (Yeas: 40, Nays: 1, Excused: 1.) To Senate. http://nvleg.granicus.com/MediaPlayer.php?view_id=14&clip_id=4929 12. Senate May 19, 2015 In Senate. To enrollment. 13. Approved by the Governor May 27, 2015. Chapter 248. Effective July1, 2015.

Additionally, in paragraph 203, page 93:

requirements continue to evolve.519 Thus, we will rely on the regulatory backstop prohibiting common carriers from engaging in unjust and unreasonable practices. Our “light touch” approach does not directly regulate interconnection practices. Of course, this regulatory backstop is not a substitute for robust competition. The Commission’s regulatory and enforcement oversight, including over common carriers, is complementary to vigorous antitrust enforcement. [Footnotes omitted]

The FCC’s Net Neutrality Order was appealed, and, on June 14, 2016, the United States Court of Appeals for the District of Columbia upheld the order and its jurisdictional basis.

regards private networks, restoration of service in the event of a physical disruption is a function of network design and would not be affected by an in-state peering requirement.

Loss of a last-mile facility will result in loss of internet connectivity. Period. Requiring in-state peering will not address this physical risk.

Requiring in-state peering does not, by itself, address the issue of physical compromise of a data center within which peering occurs.

Cyber threats (involving wrongful access to information) can be directed at information in transit or information at rest.

Service Improvement Issues Various propositions were put to the Legislature in committee hearings regarding service improvement if in-state peering were required

Question 4 Will an in-state peering requirement result in an increase in service quality that is perceptible to the end user? How do you know?

No other states currently require in-state peering.

The State of Nevada operates what is likely the largest private, closed network in the state. The State’s wide area network (WAN), popularly known as Silvernet, connects state agencies to government agencies (both state and local) in all Nevada counties and municipalities. It is the only electronic pathway that provides (1) criminal justice information to law enforcement, courts, parole and probation officers and other judicial officers (2) information supporting the de-centralized functioning of the Departments of Motor Vehicles, Health and Human Services, Training and Rehabilitation, Agriculture, Business and Industry, Public Safety (including the Division of Homeland Security), and all other state agencies.

Virtually all county and municipal governments operate their own private networks, sized appropriately for their individual needs.

A major set of intended beneficiaries of an in-state peering requirement would be end users (see Question 4 above).

Question 8 What agency would determine whether the in-state peering requirements were met for the purpose of state procurement actions? For the purpose of local government procurement actions? How would its decisions be enforced? What attendant statutory or regulatory changes would be required? For example, could an entity object to a contract award on the basis of non- compliance with an in-state peering requirement even though that entity did not participate in the relevant procurement process (an RFP or sole source

procurement justified by a lack of vendors capable of supplying needed communications facilities and/or services)? Are the costs of the oversight and enforcement efforts justified by the likely benefits of an in-state peering requirement? (See Questions 3 and 4 above.)

Yet, a mainstay of Nevada’s economic development strategy is to emphasize its low regulatory environment.

The anticipated completion date for that infrastructure project is before the final day of the 2017 Legislative session.

Question 10 If the benefits of in-state transit are sufficiently great (see Questions 3 and 4), won’t providers of services delivered over public internet facilities negotiate the use of wholly in-state fiber facilities in order to provide the best possible service to Nevada end users as a matter of self interest, thereby rendering an in-state peering requirement irrelevant?

Software-defined networking (SDN) and SD-WAN technology purportedly allows network administrators to decouple network control from the underlying physical infrastructure.

Other Issues Question 12 What other issues, not covered by the foregoing questions, do you believe are relevant to the Peering Study undertaken by the Information Advisory Board (ITAB)?

Option to appear before ITAB Question 13 Would you like to appear before ITAB at its next meeting on October 27, 2016 to augment your responses to the foregoing questions?

The length of your testimony will be determined by the Chair, but you should anticipate your testimony will be no more than 15 minutes.

Answers to the foregoing questions are limited to a total of five pages (8”x11”), using 12 pt. Times New Roman or comparable font, single spaced, 1” margin on both sides, top and bottom and submitted in electronic .pdf format.

In order to be considered, answers must be sent to [email protected] with “ITAB Peering [Your Name]” in the subject line not later than October 17, 2016.

Attachment D Follows

*** NOTICE OF PUBLIC MEETING ***

INFORMATION TECHNOLOGY ADVISORY BOARD

LOCATIONS: Legislative Counsel Bureau Grant Sawyer Building 401 S. Carson Street 555 E. Washington Avenue Room 2134 Room 4412 Carson City, Nevada 89701 Las Vegas, Nevada 89101

If you cannot attend the meeting, you can listen to it live over the internet. The address for the legislative websites is http://www.leg.state.nv.us. Click on the link ―Live Meetings‖- Listen or View.

DATE AND TIME: August 31, 2016, 1:00 p.m.

AGENDA

1. CALL TO ORDER and ROLE CALL

Chairman Diflo: So, for the record, my name is Paul Diflo, I'm the new chair of the ITAB Committee. At this time, I would like to call the August 31st, 2016 ITAB meeting into session. Kelly, if I could ask you to do a role call and then let me know if we have a quorum?

Kelly Kiesow: Okay. Assemblyman Anderson?

No response heard.

Kelly Kiesow: Senator Lipparelli?

No response heard.

Kelly Kiesow: Director Malfabon?

Director Malfabon: Present.

Kelly Kiesow: Director Cates?

Director Cates: Present.

Kelly Kiesow: Director Whitely?

Steve Fisher: Steve Fischer for Director Whitely.

Kelly Kiesow: Mr. Marcella?

Joe Marcella: Present.

Kelly Kiesow: Ms. Krause?

Catherine Krause: Present.

Kelly Kiesow: Mr. Betts?

Mr. Betts: Present.

Kelly Kiesow: Ms. McGee?

No response heard.

Kelly Kiesow: Chairman Diflo?

Chairman Diflo: Present.

Kelly Kiesow: Mr. Chairman, we have a quorum.

2. PUBLIC COMMENTS (for discussion only) – Chairman Diflo: Thank you, Kelly. So as this is a public meeting, I want to open up for public comments but I would like to keep this Agenda Item open so that we can take Agenda Item — we can take comments after Agenda Item 6, and again at the end of the meeting. So, at this time I would like to ask anybody in the North from the public that would like to speak. I would like to throw out the caveat.

If you would want to speak to Agenda Item No. 6, I'd ask that you wait until after we open for public comments after Agenda Item No. 6. Seeing none, I will ask if there is anybody from the South from the public that would like to speak?

Joe Marcella: Chairman Diflo, we had four representatives come in just about three minutes ago. Would you like me to have them identity themselves?

Chairman Diflo: Thank you, Joe. That would be great.

Joe Marcella: Gentlemen? Ma'am?

John Lopez: Excuse me. Good afternoon. My name is John Lopez; I am Government Affairs Manager for Cox Communications here in Las Vegas. I think we are going to be speaking to Agenda Item No.6 that has to do with peering study, if I'm not mistaken?

Chairman Diflo: That is Agenda Item No. 6. That is correct.

John Lopez: Okay. Great. We will deliver our comments at that time then. Thank you.

Chairman Diflo: As stated, I would like to keep this agenda item open and I would like to proceed with the ITAB meeting at this time.

Joe Marcella: Chairman Diflo, we have another board member that just arrived.

Senator Lipparelli: I'm Mark Lipparelli.

Chairman Diflo: Welcome Mark. Kelly, can you log that Mark is here?

Kelly Kiesow: Yes. I will make note of that.

3. COMMENTS BY THE CHAIR (for discussion only)

Chairman Diflo: Okay. I would like to start. You've seen from the posted minutes that ITAB last met in October of 2014, which is not consistent with NRS242, which states that the board should meet once every three months, but may meet further times as deemed necessary by the tier. Based on some agenda items, specifically Agenda Item No. 6, we will be meeting once more before the legislature begins and that date will be October 27th, 2016. Kelly, I believe the time is going to be from 2:30 until 4:00, is that correct?

Kelly Kiesow: That is correct.

Chairman Diflo: Since the last meeting, we have a new State of Nevada CIO. So, I would like to formally welcome Shannon Rahming to her first ITAB meeting. Welcome Shannon. We also have a new ITAB Chair, and my disclaimer is, this new ITAB Chair is a novice at best when it comes to the onus's and rules for the meetings. So, having said that, I'm going to be leaning on the expertise of former chair, Mr. Joe Marcella, who is still a member of the Board, as well as Jeff Menicucci.

As it's been well over one and a half years since we've met, I want to take the time to remind the board that NRS 242 defines the creation, the members, the chair, the duties, the powers, and the compensation for ITAB, and it defines what The Board shall do — it would behoove us all if we all just went out and reread 242. I'm not going to read now, but it boils down to ITAB exists as a resource to help improve operational effectiveness and efficiency at the State of Nevada Information Technology Division and there is no funding or budget ownership by this group.

Kelly Kiesow: Excuse me, Mr. Chairman? I noticed Mr. Anderson — is Assemblyman Anderson here?

Chairman Diflo: Welcome Assemblyman Anderson.

Assemblyman Anderson: Thank you. Appreciate it. Sorry for being late.

4. APPROVAL OF MINUTES: August 8, 2014 (for possible action)

Chairman Diflo: The next agenda item is the approval of the minutes from the October 13th, 2014 ITAB meeting which have been posted. Can I have a motion to accept the minutes?

Joe Marcella: I so move.

Chairman Diflo: And second?

Senator Lipparelli: I'll second that. Mark Lipparelli.

Chairman Diflo: Okay. And all those in favor?

Director Malfabon: Mr. Chairman, can I state since I was not present — what is the instructions to the people that were not on the Board at that time?

Chairman Diflo: Yes. If you were not present and haven't read the minutes, I think abstain would be the correct response.

Director Malfabon: Because I wasn't present, I prefer to abstain. Director Malfabon for the record.

Chairman Diflo: Very good.

Steve Fisher: Steve Fisher for the record, since I was not present at that meeting, I would abstain as well.

Catherine Krause: Catherine Krause for the record, I will echo that with the other members. I was not present nor a member of the board at the time.

Director Cates: Patrick Cates. Ditto, but I have a question for the AG on the point of order. If we all abstain, is there enough votes for a valid vote?

Jeff Menicucci: I believe the numbers are in our favor — if everyone votes in the affirmative — I believe the numbers are in our favor for a valid —

Director Cates: Well, you've got four people that aren't going to vote.

Jeff Menicucci: I believe we have — do we have nine?

Kelly Kiesow: Nine members total. We have today, yes, nine people.

Jeff Menicucci: Okay. I was right then.

Craig Betts: Just to follow suit, Craig Betts. I was not present either, so I will abstain.

Speaker: So, now we have a problem.

Chairman Diflo: So, now we only have four who actually have any knowledge of what transpired.

Catherine Krause: Mr. Chair? If this makes sense, just a suggestion, maybe those who were here, if they can affirmatively state that they think it's accurate. I mean, I don't know if that is reasonable for us to then feel more comfortable voting, that weren't here.

Chairman Diflo: That seems like a fair recommendation. I for one was here, I have read the minutes and they do seem accurate. Joe, I believe you were at that meeting as well?

Joe Marcella: They are accurate. Just one comment, I rather they weren't verbatim because my New York accent comes through.

Chairman Diflo: I noticed that when I was reading them, yeah.

Joe Marcella: I think it's a good idea to proceed.

Speaker: So, the recommendation I think is that we get a majority of those present voting even though they may not have actually been present for the meeting in question.

Chairman Diflo: Okay. Are there any other members that were here at the last meeting and have read the minutes, and are willing to accept those minutes?

Assemblyman Anderson: This is Assemblyman Paul Anderson and I don't believe I was in attendance in the last meeting, however, I have read the minutes, watched the video, and am comfortable approving and sustaining the vote.

Chairman Diflo: So are we okay with that?

Speaker: Yes.

Chairman Diflo: Very good. At this point I would like to go — oh. I apologize. As I stated with my disclaimer, I need somebody to keep me honest at these public meetings. At this time, we would like to take a vote. All in favor?

Group: Aye.

Chairman Diflo: So, moved.

5. CIO UPDATE (for discussion and possible action) – Shannon Rahming, State CIO

Chairman Diflo: Heading on to Item No. 5 which is a CIO update and I would like to welcome Shannon.

Shannon Rahming: Good afternoon committee members. For the record, my name is Shannon Rahming and I'm the Chief Information Officer of Enterprise IT Services. First, I would like to take a moment and thank you for taking the time to attend the ITAB meeting, it is very much appreciated. In the interest of time as we have a very full agenda, I'm going to be giving a very brief overview. I was brought in [Inaudible 01:08:16] CIO in April 2015, in the middle of the '16, '17 legislative session. I was officially appointed to the position in October 2015.

During the session, EITs was granted three additional desktop employees to support placing tablets into the NHP vehicles, and for additional support needed for the Department of Administration and the Governor's office. The Tablet Project is a four-year project with 600 total tablets, of which we have deployed 185. We have another 150 on order right now, and the rest will be placed into vehicles in '18 and '19. So, we will have all 600 of them by year '19.

During the session, EITS was also granted a contractor to continue the disaster recovery efforts for the computing unit. We have had a contractor part time starting July 1, 2015 and she will be rolling out the project in October 2016. The Legislature granted us a full-time employee starting Fiscal year 2017. That position has been posted, we are getting a listing and we will be hiring that person very soon. That person will be working with our MSA contract person for some turnover, and then will continue on with all of the plans that we are working on for the computing unit, for disaster recovery.

The plans to be updated are the main frame, the unit systems, the VM System, AD, DNS, Convult Backup System, server, storage, and share drives. We also were given a small amount of money to do a cloud pilot project. We are working on Office 365 deployment with the Governor's office of Economic Development. This will allow EITS to get knowledge on how to manage this application for future deployments in the state.

The Legislative session also granted us an additional employee to manage the Endcap system. This is the proximity car system that allows access to buildings for appropriate people during

appropriate times. We currently are supporting 1,096 swipe stations, and 12,379 employees using those cards for access throughout the state. The CJIS Modernization Project for this phase was given six contract MSA programmers for the Fiscal year '16 and '17. That is the Criminal Justice Information System, when I say CJIS. They have been hired and are on schedule to complete the modernization of the criminal history offender tracking system on July 1, 2017. That is phase one of that project.

The next phase will hopefully be approved and funded by the '18, '19 Legislative Session. This is a ten-year project, as there are many public safety systems that need to be modernized due to non- supportive current systems. EITS is working in tandem with DPS to strategize and complete the project for all phases that will be funded.

In an effort to provide better customer service and continued infrastructure services to our agency partners, being Department of Public Safety, Department of Administration and the Governor's office, I am restructuring EITS to have an enterprise and agency group. The Enterprise group is comprised of the network, telecom, microwave, mainframe, Unix, and the server group. The Agency group will be help desk, desktop, programming, database and project management. We are currently in the process of hiring the chief position for the Agency group, allowing an IT type manager for those agencies to go to.

So, they will have one IT tech manager that they can go to, to get all of their issues taken care of. Again, that will be for our agency folks which is, again, DPS, DOA and Governor's office. It then allows for the Enterprise IT folks to continue to take care of all the enterprise issues for the whole state while allowing the agency group to be the go between our Agencies, and the other IT folks.

EITS is also working closely with the Nevada Department of Education for the remediation plan utilizing a new tool called Site and Proof, to find and modify the websites that need changes made for compliance. The Microwave Replacement RFP was awarded and the vendor has deployed personnel to the field to start the site surveys. The completion should be August 2018. This will allow the Microwave System to support the new IP based Nevada Shared Radio System, which is the public safety radio system used by highway patrol, sheriffs, police, fire, et cetera.

Nevada was awarded a Homeland Security Grant Funding for additional security tools during the last round. We also are working with the city of Henderson, who received funding to create a template for a cyber instant response plan that can be used anywhere within the State of Nevada. We also have used previous grant funds to work with other means of [Inaudible 01:13:03] such as North Las Vegas, for purchasing network monitoring capabilities.

Nevada was also one of only five states awarded the National Governors Association Cyber Policy Grant. The other states awarded this grant are Oregon, Connecticut, Louisiana and Illinois. We are working diligently for the next eight months on our incident response plans,

cyber center, and our Cyber Policies, to utilize all of the expertise and knowledge we can gain from this award. I have been working with CIOs of the various means of [Inaudible 01:13:35] to see where we can work together to get better pricing on IT software and services, and collaborate on planning for the future.

I meet regularly with the CIOs from Las Vegas, North Las Vegas, City of Henderson, Clark County, Clark County School District, Washoe County, Reno, Sparks, Carson City and Douglas. I have also been meeting with the IT managers from all State Agencies. This allows us to get an understanding of what each agency is doing and if we can get any synergy going for any of our projects. We also work together for solutions on common problems.

The Technology Investment Request Prioritizing Process — say that three times, which included directors for most Agencies in the State for the '18, '19 Legislative Session, looked at requesting made for more than $500K of which there were 18 requests for a total of $128M, with $60M of that being from general funds. The prioritized list was sent to the budget office.

We are continuing to work diligently with all of the Agency capacity needs for Silver net. We have been replacing network equipment to allow for more capacity, north to south, for a current total of 15-gigs north south. We currently have equipment in Switch in Las Vegas, and also will be moving equipment to ViaWest another facility in Las Vegas, which allows us to obtain an additional 10-gig circuit for our North, South run. That will give us a total of 25-gigs, north and south.

This is paramount for disaster recovery planning. It allows us the capacity to do the backups that we need to do, so that we can actually recover in a disaster. As everyone knows, backups are your cornerstone of disaster recovery. I realize I just said a lot and I'm sure you might have a couple of questions, but I wanted to give you a very high level overview of what's been happening with EITS. Thank you again for the opportunity to share this update with you.

Chairman Diflo: Thank you, Shannon. It sounds like you've been very busy since you started in the role.

Shannon Rahming: Yes. It's been great.

Chairman Diflo: Well, good. Are there any questions for Shannon?

Steve Fisher: For the record, Steve Fisher. I just have one question. How many staff do you have in EITS approximately? What is the size of your staff?

Shannon Rahming: The size of our — fully staffed is 184.

Steve Fisher: Thank you. I just have one other question. You mentioned — for the record, Steve Fisher. You mentioned Office 365, and the pilot project you're running. Can you talk to us a little bit about, maybe, some futuristic plans on Office 365? Just briefly?

Shannon Rahming: I can't talk a lot about it. I can tell you what we're doing with the pilot project. What we are doing with the pilot project is, we will be setting up the Ecowood group which is about 50 folks, putting them into a Cloud Office 365 environment, where they will be using Office 365 and they will also be using email. From that — they'll be using that Office 365 email client to be able to do their email.

As some of us are aware, the Ecowood group does travel all over the world, literally. So, it's very difficult for them to not be cloud based. So, they are a perfect group to do this project with. What our hope is that we will be able to build it so that other folks can come to us. As we all know, we don't have that funding yet at this point in time. So, we are trying to build for the future if possible, setting up our basic platform where others can come to it.

Steve Fisher: Thank you.

Shannon Rahming: Thank you.

Assemblyman Anderson: Mr. Chair, Paul Anderson down here in the south.

Chairman Diflo: Yes. Mr. Anderson, do you have a question for Shannon?

Assemblyman Anderson: Thank you. Shannon, can you talk to us a little bit about the backups between multiple data centers and what the benefit is, splitting between Switch and Vios down here in the south? If we're not doing — well, just kind of give me an update on why we're splitting that between data centers.

Shannon Rahming: Sure. For the record, Shannon Rahming. We are splitting data centers for a couple of reasons. A, that they're in different parts of the valley. So, if there is a disaster in one part of the valley, hopefully we won't be hit unless it wipes out the entire valley of Las Vegas. At that point in time, we will have bigger issues than that. So, that's part of why we're splitting it.

We also are — the data center that we're in now in Switch right now, is very limited in size. As far as when we have to do, specifically, welfare disaster recovery tests, we have nowhere for our folks to stand. So, they are literally kind of lined up. What we have at Viawest gives us a lot more room, and a much better situation for that to happen in. So, it's not only for disaster recovery but more for also — make it easier for us.

Joe Marcella: Chairman? Joe Marcella in the south.

Chairman Diflo: Yes, Mr. Marcella?

Joe Marcella: I had one question for Shannon. I was curious, not only have you made great strides this year, or actually since 2014, is when you first took office. I have seen some significant improvement, and the approach towards certainly more of an umbrella state, the question would be, is there a strategic objective as well as a formal plan going forward that the board can review?

Shannon Rahming: Great question. Shannon Rahming for the record. We are working on that strategic plan right now. That is something that we are working on this fall and will have ready — for a formalized plan, yes.

Joe Marcello: Thank you.

Shannon Rahming: Thank you.

Chairman Diflo: For the record, Paul Diflo. So, Shannon, that strategic plan, that would follow the budget terms, would be two years' strategic plan?

Shannon Rahming: It will probably go beyond that, but it will definitely will fall for the budget and will be available for that, in that point in time. But, I'm looking at more of a five-year plan.

Chairman Diflo: Great.

Shannon Rahming: To go beyond the two years, so we can continue on.

Chairman Diflo: Great. Thank you. Yes, sir? Mr. Cates?

Director Cates: If I could just add on to Shana's comments a little bit. The Governor issued a strategic frame work for his budget building and it includes goals as far out as five years, stretch goals. So, EITS and the other Agencies within the Department of Administration are updating their strategic plans to align with that right now. We intend to have that ready for the legislature.

Chairman Diflo: Perfect. Thank you, sir. Are there any other questions for Shana before we let her off the hot seat? Hearing none — oh, we do have one more.

Director Cates: I just want to give a plug for my employee. Shana worked for me as the Director of the Department and she's done great work in a very short period of time. She enumerated some of the many things that she has been doing. I would like to particularly commend her for her reorganization plan to separate the EATS functions between Agency and Enterprise Level Services. For those that don't know the history, EITS was combined with the IT Shop from public safety a couple of years ago.

That was a — and continues to be a difficult and challenging process. I think it took a while to figure out the best way to align our resources to improve customer service. I think she has a great plan that she's putting in place that I think is really going to help the Agency going forward.

Shannon Rahming: Thank you.

Chairman Diflo: Okay. Thank you, Shannon. Appreciate it.

6. IMPLEMENTATION OF SB 289 (2015) (for discussion and possible action) – Jim Earl

Chairman Diflo: Now before we get to the meat of the meeting, which is Agenda Item No. 6 on the peering study, I was reminded to let everyone know that we have a hard stop today right at 4:15. So, the meeting is scheduled until 4:00, we would like to complete the meeting by 4:00. But we absolutely have to be out of the room by 4:15. Especially for public comments, if we could keep them between three and five minutes, that would be very helpful.

So, regarding Agenda Item No. 6, as you can see from the agenda, Senate Bill 289 was passed in 2015. It requires that the ITAB Board conduct a study of peering. That is including an analysis of potential benefits of peering arrangements to the State and its political subdivisions, and then submit a report of its findings and a recommendation. Now, the recommendation could be anything. It could be that we don't have a recommendation, but based on the fact that SB 289 passed, we are committed to do the study.

So, in today's meeting, we need to discuss what that study is going to look like. As far as I understand, we have [Inaudible 01:23:39] You can be as informal or as formal as we want. We need to decide how we are going to conduct such a study, and this is a decision that we need to make today; prior to the next meeting on October 27th, when we can review the findings and agree upon a recommendation that needs to be submitted prior to the start of the next Legislative Session in January.

I am particularly interested in hearing from Assemblyman Paul Anderson on how we can be most helpful to the legislature regarding SB 289. First, I thought it would be helpful to give a brief summary of what peering is and then I am going to turn it over to Jim Earl, and he is going to give us a more in-depth overview, and talk about our options as well.

Now, as far as I'm concerned, simply put, peering is an exchange of data between networks. There are multiple networks, some big, some small, peering is the connection point to exchange that data. For the State of Nevada, and EITS in particular, they contract for facilities and services with AT&T and Charter, and Cox, and perhaps others. The study is having us look at peering arrangements or providers like AT&T and Charter would have to peer with all of the other service providers in the State of Nevada, and that exchange point would take place in the state.

Jim, I would like to turn it over to you to go into more detail and if you want to elaborate, or correct anything about that definition of peering, that would be welcome.

Jim Earl: Thank you very much, Mr. Chairman. I'm Jim Earl and I don't think any correction is necessary on your explanation. I would like to take about ten minutes perhaps and outline essentially four things. One, how the Board got here. Second, what the Boards mission is under the applicable statute created by the passage of Senate Bill 289 in the last legislative session. What I see is the options for the Board Study, and what a report the legislature might consist of.

Now, let me make one disclaimer upfront, and then you'll hear me repeat it a couple of different times. That is that, anything that I talk about, and anything that I've written in terms of background documents, represents my personal opinion and my personal opinion only; as will become apparent when we look at the legislation. It's inappropriate for EITS, or for the Department of Administration, or any of the executive branch, to take a position on what the board ought to do. That's really for the board itself to determine. That's how the legislation was essentially established.

So, in terms of how the board got to where it is, as you correctly indicated, Senate Bill 289 was introduced early in session March 16th of 2015. Its co-sponsors were Senator Dennis, [ph 01:27:08] a former member of ITAB, and Assemblyman Paul Anderson, both a former member of ITAB, and a current member of ITAB.

The critical thing about SB289, is that the Bill as introduced, is very different from the bill that was passed and signed by the Governor. In its first iteration, and I'm going to read directly from the Legislative Summary of SB 289, this Bill require each provider of Internet Protocol Service, which serves an Agency or Political Subdivision of this State, to interconnect and maintain a peering arrangement within this state, with all other such providers of Internet Protocol Service.

That particular requirement was going to be enforced in terms of the original Bill by a prohibition that essentially prohibited a State Agency, or any Government Agency within the State of Nevada from obtaining Internet services from a carrier or provider that did not comply with the required instate peering arrangement that I've already outlined.

The Enforcement Provision reads like this, an Agency or political subdivision of this State may not obtain Internet Protocol Service from a provider of Internet Protocol Service if the provider has not complied with the provisions of subsection one. The provisions of sub session one are virtually identical to the summary I read just a moment earlier that requires instate peering among essentially all Internet Service Providers that would offer business to, the State, or Political Subdivisions, and Agencies thereof.

Now, during the legislative hearings, which occurred almost exclusively in terms of substance before committees related to Government Affairs, there were a number of interveners and testimony that was elucidated from other carriers and from Switch, and from the Committee

sponsors and indeed, other members of the public. The end result was that the original Bill was amended, and it was amended almost by complete substitution. The Bill which passed is the one that you refer to and — where a particular provision of that Bill are included in Agenda Item No. 6.

So, everybody has essentially the precise language of the Bill right upfront in the agenda. That particular section, two parts, the information technology advisory board, created by NRS 242.122 shall conduct a study of peering that includes without limitation, an analysis of potential benefits of peering arrangements to the State, and its political subdivisions.

Then, the requirement for the Board, which is essentially the second part of what I wanted to talk about, which is the Board Mission. The Board shall submit a report of its findings, including, without limitation, any recommendations for legislation to the Director of the Legislative Council Bureau for transmittal to the 79th session of the Nevada Legislature. And, frankly that is all. There is no reference to an instate peering requirement in the bill, as was passed. And, there is only limited guidance as to what the study is to consist of.

There is also only limited guidance on the report itself, which has to include some findings — including without limitation any recommendation for legislation because that direction is without limitation, it's open to the board to recommend other things. I'll talk a little bit about some of things that ultimately, you might want to consider when we get there.

In terms of the options for the study, as you correctly outlined in your introductory remarks, the guidance that the statute provides is not very specific. Just some of my observations about the position of the legislature, and passing SB 289. The legislature was aware that ITAB has no permanent staff, was also aware that ITAB is not a rule-making body nor is it an adjudicatory body such as the public services — Public Utility Commission state of Nevada, or at the federal level, the Federal Communication Commission, the FCC.

The legislature would also be aware that this body, ITAB, is subject to the open meeting law; therefore, has to take its decisions in congruity with the provisions of the Open Meeting Law, which makes us unlike a regulatory agency that exists at the state or federal level. Where, again, depending on what Public Meeting Laws are applicable at the state and federal level, operate in slightly different functions so that — in the case of the FCC for example, each individual FCC Commissioner can discuss issues not only with the staff that is doing the actual work within the FCC, but with the FCC Legal Staff, as well as his own staff.

The FCC Commissioner has between two or three regulatory attorneys on his personal staff, in addition to the General Counsel's Office of the FCC, which has about 100 regulatory attorneys in it. In addition to the staff of the FCC which has somewhere between 500 and 1,000 regulatory attorneys, in addition to supporting engineers and economists.

So, the picture that I want to paint is that ITAB is being asked to perform a study on peering that is — with many more limited — much more limited support than would occur at the federal level, or indeed at the state level in a Public Utility Commission. So, the question for you to really come to a conclusion about is, how to conduct the study?

If you'll notice in the agenda, there were two options of, indeed, many. One was that the board could, again the discretion is totally yours, simply have an agenda item in any number of meetings that it sees fit to hold, where the board would invite members of the public to come forward and give their opinions, and state their positions and rationales for what the Board should conclude in terms of its recommendations to the legislature.

Also, on the agenda is a Straw man, in terms of written questions that the board might use to guide a more in-depth inquiry in what would be another option that would solicit, and would request for information from members of the public to respond to these particular questions, or indeed, any questions that the board might have by a particular date, so that the Board would have those before them at the time that the board opened up later agenda items for public comment on either the study, the conclusions reached, or anything relating to instate peering and the precise words of the Boards requirements as indicated by the statute or the provisions of SB 289 as passed.

Now, quite frankly, I was the one who prepared the questions and there were essentially two inputs to that. One, I went back and I listened again, watched again, the video recording of all of the testimony during the legislative session that took place with regards to 289. One of the documents that was provided to both members of the public and to the board in terms of background, which is titled 78th Session SB 289 ITAB Related Testimony, that has the url's in it that will take someone who is interested to the committee testimony that was taken during the last legislative session.

The other thing that I was mindful of was, the FCC does not talk about peering very frequently. It's been a couple of decades since I was part of the General Councils Office at the FCC. So, I can't represent to you that I'm up to date, but to my personal knowledge, the most specific that the FCC has been in those 10 to 15 years, are contained in the background document extracts from the FCC 15-24 Report and Order.

That Report and Order is generally referred to as the Net Neutrality Decision and that particular document — which, if anybody wants to see it, I'll get up and get it out of my briefcase. That particular report and order is about 2-1/2 inches thick, and the particular extracts here — extracts from that order, were the FCC both describes what peering is, talks a little bit about what it's rationale is for not interjecting itself into the regulatory possibility surrounding peering, preferring to leave that to negotiations among carriers, and any other observations with regards to peering that the FCC made.

So this is essentially, as far as I am concerned personally, the latest word from the Federal Communications Commission, on national peering, what it is, and why the FCC at least has decided not to become involved in the commercial negotiations among carriers when they conclude peering arrangements.

So, when coming up with these questions, I was mindful of the questions that individual legislature on the — particularly the Senate Committee on Government Affairs, asked. And, drafted this particular Straw man with the idea in mind, if I were a member of the Senate Committee on Government Affairs, and I had been through the process in the last legislative session, what would I like to know about peering that would guide any decision that I wanted to make? Good or bad, pro or con, up or down, about peering in the upcoming legislative session.

Let me repeat, these are my thoughts and certainly nobody in the Executive Branch. The board is absolutely free to disregard any or all of the questions that I drafted as part of this Straw man. You're free to substitute anything that you want for it, and you're entirely free to say, no, we don't want to do written questions, we just as soon simply open the next board meeting for members of the concerned public to come in and talk to us about what our peering arrangements might be.

Now, this has some consequence also for the way in which carriers and other members of the public might want to both address you, and if you do choose to move forward with written questions, how they might want to respond. If you take both the FCC and Public Utility Commission, you really have one group of regulatory attorneys who are writing submissions for another group of regulatory attorneys.

So, if we're looking at an FCC proceeding, that is open and is of interest to major communications carriers, the FCC will have laid out the questions that it wants to have addressed, the responses will come essentially from the regulatory attorneys of those carriers, they will be addressed to the regulatory attorneys within the FCC, who will then come up with a draft Report and Order that goes through an internal process and involves [Inaudible 01:42:02] of the regulatory attorneys, once again, who sit on the staff of individual commissioners.

It's not really the situation that we have here in Nevada as a result of SB 289. What is requested is some meaningful guidance that the legislature hopes the Board can provide, channel, and refine, to be considered by the next legislature. So, what I tried to do was produce some draft questions and some backgrounds which is technically and legally correct, but is designed essentially to provide guidance to — and interested and concerned [Inaudible 01:42:55] legislator.

I was very mindful of the, sometimes very perspective questions that were asked by members of the Senate Committees that heard this particular Bill. My last topic is some suggestions as to, what a report to the legislature might contain. I do this to give — the thought being that if you know what the end product might be, or at least think about that a little bit, that affects the steps that the board might decide to take in order to get to that end product.

Again, these suggestions are my suggestions only and are not something that would necessarily — that the board might decide to do. Your guidance is the statutory guidance, which we've already been over. In my mind, what might constitute a report to the legislature could include the following.

First of all, the minutes of this ITAB meeting, and any other ITAB meeting that are relevant to peering. The background documents that the Board considered, and I would include in those, the three or four documents that are posted on the Board website and have been provided to members of the public. Just so the legislature and anybody that wants to take a look at it, knows what was available to the public and available to the board in terms of background, as a result of being one of the under pins of the study.

Should ITAB decide that its wants to go down a written questions route, then the written questions that the ITAB decides to request information formally on, would become part of the reports to the legislature. Company responses to those questions would be included, along with any recommendation the ITAB is to make. And, to pick up on a point that you made earlier on and I repeated at the beginning of my little presentation, that's pretty much in the discretion of the board, as a result of the descriptions that are contained in the statute.

So, you can make ITAB — depending on what it wanted to do, could make no recommendation for action, could recommend a specific legislation, could make a recommendation that no legislation is warranted, it would be open to you to recommend further study, perhaps by the Public Utility Commission or some other entity, if you see fit. This is really open to you and I would ask that what you've heard from me today only be a part of the guidance that you consider.

You should also consider the guidance of any member of the public, firm, or individual in terms of their suggestion to you, regarding Agenda Item No. 6, which was very specifically, to provide input to the Board as to how to the Board should exercise its discretion to conduct the study. So, Mr. Chairman, I would be more than willing to answer any questions now and I will certainly stand by if at any time you would find my personal opinions helpful to the guidance of the board.

Chairman Diflo: Thank you, Mr. Earl. I want to point out that you did a very thorough job with the homework on this topic. I have read the questions, reviewed the questions, and I think they're all pertinent. So, for myself and the board, we appreciate the thorough background work that you have provided us today.

Jim Earl: Thank you very much.

Chairman Diflo: At this point, I would like to open to the Board. Are there any questions for Mr. Earl in particular? Or as I mentioned earlier, Assemblyman Anderson and I would be anxious to hear how you believe the ITAB board can assist the legislature coming up.

Assemblyman Anderson: Sure. If there are no other questions, I would be happy to jump in. Jim, thank you very much for the details and certainly the effort in trying to figure out what we often look at as a lot of interpretation into what we're trying to accomplish in the legislature.

I think that there are probably some folks that want to enter into public comment on the issue, and I think I would wait to comment after that, however, I would just probably add to the basis that I am fairly clear on what peering is. I was a co-sponsor of the Bill, quite frankly because I could explain what peering was to the legislative body, and my background in IT and as an owner of a company that manages IT assets for other companies.

I am familiar with the cost and the infrastructure, and what it takes to do peering. I also recognize that peering is very concentrated in a very select few locations in the nation, and that while there can be some strategic benefit to having peering in other locations, also the cost of requiring that on a Governmental Bureaucracy level, may not be the best way to approach that subject matter.

So, I know that there are a lot of folks that would like to chime in on this. I would like to hear their opinions, and I'm happy to — at the end of that, express my desires of what direction — or at least my opinion of where we should go, in regards to the study itself.

Chairman Diflo: Appreciate it, Assemblyman Anderson. Are there any other comments from the board?

Director Cates: Mr. Chairman, I think that we would like to hear some of the public comment, and then kind of weigh in after that.

Chairman Diflo: Okay. Thank you. So, since we have left Agenda Item No. 2 open, I would like to ask at this time if there are any public comments here in the north. Probably the best way to do that, is to come up here and be sure to state your name for the record.

Stephanie Tyler: Mr. Chairman, members of the community, for the record, my name is Stephanie Tyler. I am the State President of AT&T, Nevada. Appreciate, first of all, the incredible work of Mr. Earl. The Straw man represents, you know, obviously a lot of thought and a really thorough process. Quite frankly, a process that we are quite familiar with through the FCC. His discussion and, kind of, reminder of how the FCC is staffed, and how deeply they are staffed, and the processes they go through, is a very stark reminder to me of what we do at the federal level as well.

So, primarily, what I wanted to do is state for the record that we do not believe, from an AT&T standpoint, that this is necessarily something that is needed. Quite frankly, if State or local governments want to contract with providers that have only instate peering, that option is clearly open to them today. We believe it is a fundamental issue of choice.

We manage our network nationwide and worldwide, with obviously a constant eye towards security and some of the very things that Mr. Earl included in his Straw man questions. So, from that standpoint, I wanted the record to be clear on that. Also, I wanted to basically, again, listening to him describe some of the work before you, to be able to offer to be a resource. As I indicated, we are a worldwide telecommunications company, we have resources at a variety of different levels whether it's communications with NARUC which is the National Association of Regulatory Commissioners — Utility Commissioners. Or, the national Telecommunications Information Association. There are lots of regional groups as well.

So, if there's any information, anything that we can provide, especially understanding a little bit better about some of your staffing limitations, we would like to be helpful on that front too. Again, we will be part of this process, but mostly just wanted to state our desire to be a resource if that's helpful, and again secondarily, state that we believe that this is an issue that, kind of a, a solution search of a problem.

Chairman Diflo: Thank you for your input. Let me ask you a question regarding the format of a study. Do you have any suggestions on how you would do a study like that, being a global company, are you aware of any other states that have done something like this? What format might they have used?

Stephanie Tyler: Well, again, I believe there is the beginning — within the Straw man draft, of some of the answers to some of those questions. But, no, to the best of our knowledge, no other state has attempted to utilize something like this. This has been something, quite frankly, new. When this piece of legislation came up during session, we reviewed it at the national level and came back with no one else having really considered it, even in this fashion.

Chairman Diflo: Would you mind if I opened the questions up to the rest of the board?

Stephanie Tyler: Sure.

Director Malfabon: Director Malfabon for the record. So, I saw that there was a statement in the backup materials about — well, in the legislative discussion about it. If Nevada is at the forefront, this could be attractive to business? Could you comment on that? I hear a lot of concern about, kind of let the market play out, and let the Agencies that want to do this, procure those services. Any comment about that legislative discussion on attracting businesses through this requirement?

Stephanie Tyler: I'm very glad to respond to that, if I could Mr. Chairman? Absolutely. I believe that, again, the choice issue — I keep coming back to that very simplistic answer, because if a company is interested in looking at Nevada, and particularly perhaps Northern Nevada — in fact, I have to disclose, I sit on the Economic Development Authority of Western Nevada, which is EDAN, which is the primary recruiter of wonderful companies like Tesla. But, that option is clearly there to them.

If by choice, they like the idea of having all of the peering done in state for some particular reason, then they clearly have that option, and that is a great option for them to have. Or they have the option to do business with a company that would peer — like, for example, we do some of our peering in L.A. For security reasons, we believe that that is the best way for us to safeguard our network, is to not — you know, if there was some cataclysmic event in Nevada that took up a good portion of Nevada, then all of your peering is in Nevada, then your isolated just to that.

Again, sorry, I am going to do this at very high levels that I'm sure you all understand much more than I do from that standpoint, but, you know, we believe again, that our network is more secure by having these ultra secure locations in a couple of different spots. Again, that's how we feel it's best, but at the end of the day, it's about choice. Nevada is wonderfully positioned, and again, our economic development efforts I think are going great as a result of some of these different options. So, again, it's a choice issue.

Chairman Diflo: Are there any other questions from the board?

Assemblyman Anderson: Assemblyman Paul Anderson down here in the South. So, I think that, you know, just to clarify some of the intent. I think the goal of the Bill was certainly to address some security and reliability standpoint issues. We recognized that that, again, peering is concentrated in specific areas of the nation. When you have Washoe Boulevard, [ph 01:56:38] for example, that would, you know, could potentially go down, there are some catastrophic results of that that could have an impact, frankly for Nevada's infrastructure. Whether that be private or public infrastructure. I think the cost to vendors is clear.

What is unclear, at least — I think the purpose of the bill and the reason there was discussion, at least from our point of view is, whether or not government should be involved in those decisions. I think that was clear in the testimony here, you know, maybe the choices are something that we need to consider above the security and safeguarding of Nevada's data, and the speed of that data, and the point of origin and destination, whether that revolves around running through L.A to Reno, or a direct Las Vegas to Reno route.

That's really where we come into the details of this. We start getting to the zero's and the ones of what peering is and what needs to happen there. Again, I guess — I'm not sure if I have a question or am just making a statement here, but, I think the government involvement is certainly unclear and the point here, I think, is to have a clear discussion and I appreciate the points that have been made here and will probably be concurred with other folks. But, the speed, competiveness, and the reliability of network inside of Nevada, you know, Nevada in general has been behind the curve when it comes to those specific items. That comes business network, whether that's in urban or rural areas, if you look at other cities and other regions, they have developed out faster and stronger than we have. A lot of it is simply business demand and we recognize that.

Again, I think the redundancy or peering, the network infrastructure, those pieces are fairly clear as to, that's generally a free-market value of [Inaudible 01:58:54] businesses willing to invest and where they're getting the most return on investment. I think the question that really resolved into a study between this Bill and, again, my participation in this Bill as a co-sponsor, is really because I understood what peering was, and could explain that to the legislative body versus maybe some others who maybe didn't understand at the same level.

I think, again, the discussion is good. It's good to clarify where free-market should reign and where government should have a discussion about their reliability. Again, the point was made that we're maybe the first to have this discussion, it doesn't mean it's a bad discussion to have. Certainly, as we look forward to whether or not we want to — to how deep we want to get into the study, how prolific we want to get into discussion and the needs of a peering arrangement that’s mandatory versus set in the free-market, I think those are key issues that we are trying to address here.

So, I appreciate the perspective and I think other folks will have similar perspectives. I just want to set the stage that the point of the study is really to be in perspective on where the government — the state government in this case, should intervene, should be involved, and where it shouldn't. I appreciate the clarification, this is certainly from AT&T perspective and I'm sure others will get us their perspectives, too.

Stephanie Tyler: Mr. Chairman, if I could? Mr. Anderson, thank you, I appreciate that. That is good perspective and again, I think this is a healthy discussion. Again, back to my original point, if there is a resource position that we can be helpful with, we are more than glad to do that, given our national perspective.

Chairman Diflo: Okay. We appreciate your input. Assembly Anderson, that was well said, and that helps me. Appreciate it. If there is anybody else from the public up north, please step up, state your name and company.

Shelly Caproe: Hi Chairman, and Board. I'm Shelly Caproe. I'm with [Inaudible 02:01:12] representing Charter Communications today. We would like to second Stephanie Tyler and AT&T's comments. We want to thank Mr. Earl for the obvious work he has done on this issue. Also, I want to thank Assemblyman Anderson for his comments on the government's role in peering.

We don't have any suggestions in how we feel you should conduct the study, which I know this is what the conversation is about, but we do want to make sure that it's known that Charter would like to play a role in the study, however you determine that's done. Whether it's invited guests giving their views, or the draft of questions and responding to those questions.

We do want to point out a couple of things. If the draft is approved, there are a couple of questions on there that we think are important. Number four goes into, like what was mentioned, the cost and the benefit that comes out of that, and does that have really an effect on the consumer and the cyber security? And, number eleven, goes into taking into account emerging technologies, and putting something in the legislation that may not keep up with the pace of emerging technologies. That's it. We would like a role, and we're here for any questions you have. That's it.

Chairman Diflo: Shelly, I would like to ask you the same question I asked Stephanie. You're a global company, are you aware of any other states that have done this, and what format they may have used for a study?

Shelly Caproe: I don't have any [Inaudible 02:01:18] on that. I would be very happy to ask Charter that question and get back to you on that. I don't know. I know that they don't feel it's necessary in state.

Chairman Diflo: Okay. Then like we did with Stephanie at AT&T, I would like to invite the Board to ask you questions as well. Okay. It looks like we have no questions from the Board. Thank you, Shelly.

Shelly Caproe: Thank you.

Chairman Diflo: Is there anybody else up north that would like to public comment? Seeing none, is there anybody in the south that would like to make a public comment? If so, please step up, state your name and company.

John Lopez: Good afternoon. My name is John Lopez, for the record, Government Affairs Manager for Cox Communications here in Las Vegas. I brought my colleague with me.

Michael Acardi: Good afternoon. For the record, Michael Acardi, Director of Technology for Cox Communications.

John Lopez: Just wanted to start out and thank the Chairman and the Board for your service in doing this. Not having a permanent staff, I'm sure is quite a challenge. Also, wanted to thank Mr. Earl for his work on the questions. We thought they were very good and raised some very good topics regarding the subject of peering.

Just wanted to start out by saying that Cox Communications opposed Senate Bill 289 in its original form, when it was introduced. That isn't commentary on the fact that it raised some important issues. Assemblyman Anderson, we agree with your comments that having this conversation is very important. It's a subject a lot of people don't know about, and don't understand how networks move data around.

So, we really appreciate the opportunity to be a part of this discussion and offer our experts from Cox Communications to provide the Board with any information or have discussions as you deem appropriate. The problem with requiring a government mandate — to require peering within the State of Nevada, the biggest problem with it is that it is just not consistent with modern technology.

Internet traffic doesn't understand borders. If there were to be a situation where — at any location, if there is a disaster or failure or something like that, our network automatically reroutes that, and the customer doesn't even notice that that routing is going on. So, we think that a government requirement to contain that in the State of Nevada is just really not consistent with how the Internet works.

Cox is the largest ISP provider in the state of Nevada, and we do know a lot about how networks operate. Like I said, we maintain a number of redundancies in our network so that if there was a failure at one point, it would be quickly rerouted.

We're also concerned that mandating a route — if that's the single route that it has to go with in the state of Nevada, you're actually putting the system more at risk, instead of allowing these arrangements to travel with where technology dictates that they need to travel to. And, Mr. Earl brought up about the Federal Communications Commission, they have thousands of staff members. I worked in D.C for a long time and even in their [Inaudible 02:06:58] order, the FCC — with all of these attorneys onboard, they have looked at it. I just want to quote, they said — the FCC said, we do not believe that it is appropriate or necessary to subject arrangements for Internet traffic exchanges. We conclude that it would be premature to adopt prescriptive rules to address any problems that have arisen, or may arise.

From my company's perspective, I can tell you that this commission has not been shy about regulating Cox Communications and other companies like ours, and just the signal that the FCC doesn't even want to go here, I think is something that the Board should perhaps take a look at. That a federal regulatory body is just not willing to go there right now.

So, let's see. Nevada, to our knowledge, no other state has this type of peering arrangement, and we don't think Nevada should be the first to experiment with an instate mandated peering requirement. We, as a stakeholder, we just want to be at the table.

So, as far as any recommendations for the report, of course the company would like the recommendation or the report to be that Nevada Legislatures should actually exercise extreme caution before doing a mandate on instate peering. So, yes, it would definitely be our recommendation that there is a recommendation in the final report to legislatures to please emphasize caution.

So, with that, that is my statement. I am happy to answer any questions, and Michael Acardi is also here from the technical perspective if any members of the board would like to engage us. Thank you.

Assemblyman Anderson: John, do you have any recommendation for the format of this study?

John Lopez: I think it would be appropriate to include written comments which Cox would hope to be — to have the opportunity to provide to the board going through a number of these issues. You know, what the practical results are, what the costs is to companies like ours and also consumers, and to the State, as a matter of fact.

I mean, is there really going to be that much of an incremental benefit to state Agencies and local governments if they have to comply with a mandate? So, I would recommend including written comments if you choose to solicit those, to put in the report so that legislatures have an opportunity to go through it themselves and see what's provided.

Chairman Diflo: Appreciate that insight. I would like to open up for questions from the board.

Assemblyman Anderson: Mr. Chairman, if I could?

Chairman Diflo: Yes, sir.

Assemblyman Anderson: I think having technical expertise at the table here would be beneficial to define peering, and if we could, in layman's perspective, and help understand, sort of, just the basics of how Internet traffic works which is essentially what we're talking about on the peering arrangements. So, we could maybe open that up if it would be okay with the Chairman?

Chairman Diflo: Yes. That sounds like a fantastic idea.

Michael Acardi: So, you did a good job of explaining it earlier. I just had a little more commentary to it, and use some real world examples. I'm sorry. Michael Acardi, Cox Communications.

An example would be a Charter customer in northern Nevada communicating with a Cox Communications customer in southern Nevada. If you let the Internet do its thing, it will automatically route traffic from the Charter customer in northern Nevada, to the Cox customer in southern Nevada. Well, if there is a lot of traffic being exchanged between those two company's customers, there could be benefit to having a direct connection between Charter and Cox Communications, for example. That arrangement would be defined as peering.

Another example would be video over the cloud providers that provide video services, companies like Netflix to a customer in southern or northern Nevada. If there is a lot of traffic between that video provider and the ISP, there could be benefit to the customer — to the two companies to have a direct connection. As AT&T stated earlier, all ISPs closely monitor their networks and monitor their bandwidth usage between not only their customers, but other ISPs throughout the country and the world, and we continually identify opportunity for making our networks more efficient.

So, that's how we look at our peering arrangements, to make it most efficient for our customers and at the same time, we still have our automatic rerouting of traffic in case a peering center goes down. I can tell you from Cox's perspective, we do, as others have mentioned, have peering at Wilshire in Los Angeles, but we have peering in many other locations including within the state.

Leaving Las Vegas, we have a lot of different routes, over seven, that traffic could take to go to northern Nevada. So, all of that traffic routing takes place in within 50 milliseconds. So, we are confident that our customers, in case of a catastrophe, their traffic could be rerouted automatically in a very quick fashion to reestablish communications.

Assemblyman Anderson: If I could jump in, if that's all right?

Chairman Diflo: Yes, sir.

Assemblyman Anderson: So, I appreciate that explanation. I think that when you look at, sort of, the zeros and ones that are transported over the network, you have what's going BGP, right? Sort of your — it's not the definition the acronyms, but essentially, the best route.

So, how do we figure out the fastest way from point a to point b? That's generally what most networks revolve around. It's an autonomous or independent type protocol, that no matter what vendor you use or what your — whether you're AT&T or Cox for that matter, you can transport data across those networks in a peering arrangement using that protocol.

So, I think that one of the discussions that came up during session and before session was the advantage of saying, well, if it's state data, we would like for that to stay in the state. There is security and discussions that can be wrapped around that. It's not really the ideal thought process, or the definition of what the Internet was supposed to be — as an open architecture that we could transport data across wherever we needed it, and to the fastest points we needed it. But, as we talk about peering, the idea that we could take data from Vegas to Reno for example, as the fastest protocol because we have a peering arrangement that's mandated, was part of the discussion.

That's really what we're talking about here, whether we should be mandating those peering arrangements or not. That is essentially — and I appreciate the definition and I think that's a

great description of what peering is, is essentially how do we get data from point a to point b the fastest, and the most secure? Peering that is most local, or the fastest path is often the best route.

So, again, just to add to the conversation of, I think the open discussion is whether or not, again, the state government should be involved in this decision or not. I think that is very much a negotiable point, especially from my end, as a free-market guy. Again, I think the discussion itself, security, the path, the fastest route, the emphasis we could bring if we were Wilshire in Vegas or Reno. That’s an economic development question built into that, right? As far as how much data resource could potentially be pushed into those areas.

Again, whether or not it's the right direction to go, I think that it's great that we're having this committee and the purpose of studying it versus forcing it through a legislative session. There is some thought there that — Las Vegas was one Wilshire, or if we had a first street or any data center that you want to look at in Nevada and Reno, and what that would do for economic developments inside of that. You can certainly look at one Wilshire and see the economic development happen inside of that tower or that building.

I appreciate the insight and I think it's critical that we understand at least the basics of how data flows across the Internet. Not very salacious or exciting, but at the same point, extremely critical to the flow of data and, quite frankly, the day to day activities that we have as consumers of that data.

So, I appreciate the insight from Cox and folks that have already spoken. I think it continues our mindset and thought process on how we should proceed. So, thank you.

Chairman Diflo: Thank you Assemblyman Anderson, appreciate it. Michael, I have a question for you as long as you're here I want to take advantage of your technical expertise. A couple of people have mentioned that new technology may change the way that peering is done in the future. I'm curious, with the adoption of software based networking, do you see that changing the look of how the peering or the exchange is done between networks?

Michael Acardi: Sure. Software Defined Networking is definitely coming in the future and many companies are already implementing it. That will make the efficiency of the Internet greater. It will make many connections dynamic, by that I mean — let's say you have a 1-gig connection from Las Vegas to Reno or Carson City with a traditional network, if you need to increase that there could be some manual labor and definitely physical connections, and a person looking at it. With Software Define Networking, one of the features and benefits could be that somebody just sits at a computer and within a few clicks, increases that bandwidth.

It takes that BGP, that protocol, that was spoken about earlier and enhances it. It just makes networking much more efficient. Doing things like forcing a specific route or a specific peering facility, could inhabit the ability of Software Defined Networking to utilize all of the features and benefits that are available within that technology.

Chairman Diflo: Thank you, Michael. Appreciate it. Are there any other questions from the Board? Seeing none, thank you representatives from Cox. Is there anybody else down south that would like to make a public comment? You would state your name and your company.

Randy Robinson: Thank you, Mr. Chairman. For the record, Randy Robinson on behalf of Century Link. Most of what, I think, needs to be said has been said by the folks who proceeded me here at the microphone. We would associate our comments with those.

I think, Mr. Chairman, that you pitched it right. The bill requires a study so there will be a study that will be conducted. I also think that Assemblyman Anderson has rounded out what that is, and what the issue is. The question of what role, if any, the government should play is much different than, should the government have a mandate with respect to peering arrangements?

So, as the study proceeds in whatever fashion this body determines best, I think it's important to keep that clarity of separation between those two issues because it will certainly determine the direction of the study. I think that the background work that has already been done provided the committee is on target, a very comprehensive approach, I appreciate the work that has gone into that. It kind of flushes out that fundamental difference — excuse me, fundamental difference in the direction that this study might go. I'm not the technical guy, but I'm happy to answer any questions that you may have.

Chairman Diflo: I would like to start with the same question that I asked everybody else. That is, is there a preferred format that Century Link would like to see? We heard Cox say that they would prefer the written questions.

Randy Robinson: Yes. Thank you, Mr. Chairman. Again, Randy Robinson from Century Link. I think that's on target. I think if you put the questions out there, particularly again with this background information and let a variety of providers and other folks in the industry comment in written format. Then I would also welcome the opportunity to give public comment or presentation before this body based on that written comment. Let's have a robust discussion, let's have an open and transparent discussion. Let's have a robust discussion about the idea of peering.

Again, as Assemblyman Anderson pointed out, there may be some other benefits to this discussion for us here in Nevada and we — in a focused manner to expand our economic interest in the data industry. So, I think a robust discussion is helpful. I think written comments and giving everybody a base line, and a chance to thoughtfully lay out their cases also will be of benefit to this committee.

Chairman Diflo: Thank you. I would like to ask the board if they have any questions for the gentleman from Century Link? Seeing none, we thank you for your comments. Are there any other public comments at this time on Agenda Item No. 6? Okay. I see none.

The ITAB board has heard from Mr. Earl, we have heard from representatives of the various providers or stakeholders, and now it's up to us to decide on the format for the study. We have to decide on a format this afternoon. If I may, I guess I would like to just reiterate a couple of the ideas that we have heard today.

One option would be to invite the public to come talk at the October 27th meeting without any written questions. We could have what was described as a robust discussion. The second option would be to make public, a list of questions. If we were to do that, we would have to ask that the responses be sent back via email, and put on — I would imagine the website, at least ten days prior to the October 27th meeting. That would give us time to review those questions and analyze it, and make a decision on the 27th.

The third option that I heard was a combination of both. Let me answer the questions and then invite me back for some robust discussion. Maybe even a fourth option is, you know what, I've heard enough today, and maybe on the 27th we come up with a recommendation. That's what I have written down. Is there any — I would love to get input on any other options from the board. Joe, you are so quiet today, it's unlike you.

Joe Marcella: Yeah. It's very, very unusual. Mr. Chair, it seems obvious that the question is — or originally was, what was the legislator's intent, and the problem to solve, the resources and constructs of the study. What would be necessary to respond to, with the legislators — the legislatures have requested of ITAB. And, the last thing, and probably significant portion of all of this is, what is the government's role in managing what the outcome is going to be.

I agree with you, Chairman Diflo, that we have heard quite a bit about what peering is, how it's affected those from a positive and negative perspective. I think the only issue we have today is, how do we proceed to solidify the opinions? Do a comparative analysis — do some level of benefit analysis to find out if, in fact, we are solving a problem, and then present that back not only to the board, but to the public.

May I suggest, and I don't mean to cause work because our resources are less — or few. What we have done in the past is taken a group from the board that has volunteered to receive those emails, consolidate that information. With the assistance of Mr. Earl, put together some sort of a presentation or opinion for the next meeting that can be, at that point, a discussion. Those folks representing communications in Nevada north and south, could be present at that meeting.

Chairman Diflo: Okay. Let me reiterate — let me make sure a point of clarity, that I understand what you're saying, Joe —

Joe Marcello: It's my New York accent.

Chairman Diflo: You're suggesting that we do not have a list of formal questions that we send out to the providers? That we're looking for input from the board now that we have heard this

information, we put together a presentation and invite the providers back on the 27th, have a robust discussion, and develop our recommendations at that time? Is that summarized correctly?

Joe Marcello: I think the formal questionnaire is still a necessary item.

Chairman Diflo: Okay. All right. I missed that. Very good.

Joe Marcello: And how it's analyzed, and how those questions are reviewed, is really the only question, or the only real task.

Chairman Diflo: Okay. Any other input at this time? Mr. Earl?

Jim Earl: This is Jim Earl. Joe's suggestion as I understand it, would involve sending some group of questions out, and having responses ten days or so before the next board meeting. I would be perfectly willing to contribute time and effort to deal with a subset of the board, in terms of sorting out comments and coming up with one or more possible recommendations.

There is one very important caveat here, and that is I want to turn to the Boards Legal Advisor and — anytime that a body that falls within the scope of Application of a Nevada Open Meeting Law, convenes a subset of members to make decisions even though they need not necessarily be the final output of the entire body. That raises issues under the Nevada Open Meeting Law.

I'm not sure that I have the correct perspective of how that may play out in practice. My present understanding, and I stand to be corrected or modified by the Boards legal counsel, is that such a group — in order not to run afoul of the Nevada Open Meeting Law, needs to be considerably below the quorum of the body necessary to conduct business. Whether that is the only restriction of meetings of a subgroup of individuals — I diver to Jeff. But, that that is clearly a possible danger, if you will, of Joe's suggestion.

We only have such a large group, or do something that in any way, would violate the Nevada Open Meeting Law, if there is a small constituent group that meets outside of the hearing of the public.

Chairman Diflo: Let's get that answered first before we go any farther. I will diver to —

Jeff Menicucci: Jeff Menicucci for the record. In general, a subcommittee would also be subject to the Open Meeting Law. So, without knowing what the plan is on that, it's hard to give definite answer. We would have to give careful consideration to the Open Meeting Laws if a subset or a subcommittee of the Board were to be engaged in creating the questions or having discussion and then making recommendations back to the board.

It should not be a problem if the board decides today, here in open meeting, what questions to be submitted to the industry, soliciting their responses. Then the responses of course would be to the

full Board. If the Board considers those in a future meeting, those materials would of course be public information as well.

Chairman Diflo: Okay. Thank you. So, we have the list of questions that were developed by Mr. Earl. If everyone has read those — I guess I would like to ask if you feel that they are sufficient, if there is any that you would like to modify or add to that. Maybe if we go down the road of getting the questions defined today so that we can publish them for response.

Assemblyman Anderson: Mr. Chair. Assemblyman Anderson, if I could?

Chairman Diflo: Yes, sir.

Assemblyman Anderson: I think that as we have had the discussion here — well, I will start with the written questions. I don't think it's a bad idea to send those questions out and get some feedback and put some information on the record. I think that helps really well for legislative action or inaction, in the next session.

My concerns, my discussion, my desires of what this Bill is to achieve, have been satisfied at this point. I think that in the interim — and also from the legislative session and during the interim, the discussions I've had and, sort of, solidifying those discussions here on the record, for me, I think we understand best what peering is, how it may or may not benefit the state, and also what the government's role should or shouldn't be. Quite frankly, it's been clarified for me.

Again, not just in this meeting but in previous discussions and during legislative sessions as we've turned it from a bill to a study, and have had interactions beyond that. I think that I don't want to distract from other priorities, especially from our State CIO who has an abundance of priorities to try and figure out and balance.

So, my recommendation, while certainly may not be the Boards desire, but certainly would say, I would like to understand if there is an opportunity here to make the state a competitive entity when it comes to the IT infrastructure of the State and beyond. Whether that's the private industry or the public side of things, but I certainly don't want to chase our tails on the issue.

I'm not opposed to the idea of what may comprise of a subset — rather a subcommittee of a subset of this committee to research the issue a little bit more. But, I think my personal recommendation, and I think from the legislative intent, is to understand the issue better, recognize that maybe now is not the time to have any possible direction from the state side of things, and let the free-market go as it may and see what beneficial options may be as technology continues to progress.

I think our folks from Cox stated that pretty clearly, that this stuff changes quite frequently and there may be protocols that benefit us beyond what we could put in statute. That's, I guess, both a balance that I have as a Legislator and a private citizen, is what I want to put in the statute that is

very hard to change versus guidelines and discussions that a committee like this can have that gives guidance and direction versus solidifying something in statute.

So, I don't know if I clarified anything there, but I'm comfortable with the answers we have heard today. I'm comfortable with the testimony we've heard from the major players in the group that had a vested interest in this Bill and in this legislation and the technology itself. I'm also comfortable with where we're at today, and if we feel the need as a committee, to have further discussion, I would certainly urge that that goes into a subset of this committee so that we can focus on, obviously, advising the State CIO on more critical issues.

I'm happy to answer any questions as well, if there were questions on intent or desire from the legislative side. Mr. Liperalli stepped out at a key moment, so I guess I'm the only Legislator here to answer these questions.

Chairman Diflo: I appreciate your input. That was well said and I happen to agree with you. Mr. Earl?

Jim Earl: Jim Earl. Mr. Chairman, I'm not sure that I've got this right, so please forgive me if I'm off by 180-degrees, or 90-degrees, or whatever. After having listening to, perhaps, the last ten minutes of discussion, a question was raised in my mind whether it would be sufficient at this meeting, for the board to adopt a recommendation now that might — given the last ten or fifteen minutes of discussion, read something like, the board recommends future consideration be given to the role of State Government in increasing he competitiveness of Nevada and its citizens, in an economic world where Internet communications are increasingly important.

And that be the recommendation of the board to the legislature, and that would mean that the report would essentially include everything that has been considered by the board up until this point.

Chairman Diflo: It seems a little vague, if you don't mind my saying, without making the actual statement that we're recommending no action from the Nevada State Legislation at this time. Then I would have to look at General Counsel to see if we can make a decision like that today because that really wasn't on the agenda, was it? Our Agenda Item was more of deciding on the format. Again, I'm just trying to avoid violating any Public Meeting Laws here.

Jeff Menicucci: Jeff Menicucci. The first part of the Agenda Item is pretty broad, but it does seem to be limited by the last sentence in terms of what the board may consider, and what it may do. It may consider the form this study is to take, including various items. I believe the way it's written, it appears that the intended item of Agenda Item No. 6, was to consider the form of the study and not to finalize the recommendation at this meeting.

Chairman Diflo: Right. Would it be appropriate — I think we can all agree that we would like to see the written responses, that we use the list of questions that Mr. Earl has developed for us,

we ask that those responses be sent back by the 17th. We then email those responses to the board for preparation and we'll give 15 minutes to the agenda on the 27th to develop a recommendation?

Assemblyman Anderson: Mr. Chair. Assemblyman Anderson down south again. I would certainly support that as a motion if you would like it, at this point. I think that is appropriate. We'll get things on the record that those are items that can be passed on to the legislative body. We can obviously choose to take no action, or have no recommendation from this side of things, but based on those written responses, I would be happy to make that motion as you described it.

Chairman Diflo: That would be great. Then I would ask for a second?

Catherine Krause: Second. Catherine Krause, for the record.

Chairman Diflo: Great. Thank you very much. Are there any other comments on that Agenda Item No 6, or have we beat it to death?

Director Malfabon: Mr. Chairman, it was mentioned that there were links from the legislative discussion and maybe we provide those links as well, along with the questions so that if someone is interested, can look at the history of the legislation with the link to the NRS and the commentary. There is an opportunity to look at some of the discussion during the legislative session too.

Chairman Diflo: Yeah. I think we can send that out. I'll get with Kelly and we'll make sure that that gets to everybody. I think that Mr. Earl, —

Assemblyman Anderson: Mr. Chair?

Chairman Diflo: Yes, sir?

Assemblyman Anderson: Assemblyman Paul. I would be happy to mend the motion itself to include those links that are in today's agenda. I think those links are direct to both the testimony and any legislative intent that may be wrapped around those questions. I think we could wrap it into a motion if you're [Inaudible 02:42:45] to that?

Chairman Diflo: I am. That would be great. I'll ask for a second?

Catherine Krause: Second.

Chairman Diflo: Great. Thank you very much. Item No. 7 on the Agenda —

Speaker: Are we going to vote?

Chairman Diflo: Oh. I'm sorry. We've got that voting thing. All right, so we have the second. All those in favor?

Group: Aye.

Chairman Diflo: All right. All those opposed? All right. So be it.

7. INFORMATION SECURITY UPDATE (for discussion and possible action) – Brian Wilcox, State CISO.

Chairman Diflo: This takes us to Agenda Item 7, and Brian Wilcox the State CISO is going to give us the status on the State of Nevada security.

Brian Wilcox: Good afternoon Mr. Chairman, members of the board. For the record, my name is Brian Wilcox and I am the Chief Information Security Officer for the State of Nevada. I wanted to thank you for the opportunity to provide you a brief update on where we are with the Information Security Program.

To begin with, I wanted to just give a brief update from the last ITAB, again, as the CIO Shannon Rahming had indicated, the [Inaudible 02:44:09] position had been filled. I just wanted to also, for the record, say that I appreciate the Governors activity. He is very active in the Homeland Security area and continues to support Cyber as one his highest priorities. I would also like to say that Director Cates, and CIO Rahming also are very active in the cyber support and I am very appreciative of their efforts as well.

So, I became CISO in January of 2016 and at that time I commenced a 90-day review of the OIS Strategic and Tactical Capabilities. At that time, and after the review was finished, we ended up adopting a Governess and Risk Management framework in order to be able to manage the Office of Information Security based on the NASIO [ph 02:45:10] standards. Now those are nationally recognized standards for security.

So, based upon that, we then moved into looking at metrics and tracking. What we evaluated was a new set of key point performance indicators, along with staff utilizations. So, at the end of that 90-day evaluation, it gave us the positional capability to start setting our strategic and tactical initiatives for moving forward. We started off very early on with some grant applications, as previously eluded by Ms. Rahming, to the tune of slightly over $550,000. The applications have been successfully submitted and we're just expecting to hear from their successful conclusion very shortly.

Again, we were selected for the National Governors Association, the Policy Academy — which will help us steer us into a more structured governess framework. This might result in some changes to NRS. There is a possibility they are denying C242, and 603A.

Finally, we developed our wind drive grow strategy. Our wind strategy is to expand current customer and partner use of our enterprise security services that appropriately safeguard IT systems and proprietary information. This helps us with our vulnerability and threat management. We are scanning devices, we have a stable amount of scanning at this point but we do expect an expansion of scanning based upon some marketing efforts, and also some other state security activities that continue to drive moving with the device scanning.

Our next strategy is to develop programs to implement state-wide efficiencies of security systems, which in turn is the basis for our continuous improvement initiatives. We are looking at changing and improving our incident response. We have a new coordinator who is in charge of these process enhancements. Our incident responses from Agencies are back in the double-digit area which is very encouraging because we had seen a slight declination. Now we're getting a much more highly active response when it comes to answering incidents.

Finally, we're looking into grow strategy to develop programs and increase state-wide capabilities of our security services, which in turn is the basis for implementing new state security services and tools. We have currently five programs in development and I would like to give you more details of those, but I prefer to leave those as we continue to develop them. Not to give away any of our deficiencies, I would say, in our current infrastructure.

So, once again, I appreciate the opportunity to provide this update. If there are any questions, I would be happy to take them now.

Director Malfabon: Director Malfabon for the record. So, I know I received an email from Deter [ph 02:48:55] about false unemployment claims.

Brian Wilcox: Yes

Director Malfabon: I know that it was significant at our department, the Nevada Department of Transportation. There were over 170 employees and we really don't know at this time where the data breach was, but I know that they have Social Security number for myself. We've given information to our employees about what to do and provided some support there, but not a lot of information is — as I understand, it's an investigation that's ongoing.

Any comment on any timeline anticipated for that? I know that you probably don't want to go on the record on anything that's under investigation but just wanted to bring that up. It happened to me personally.

Brian Wilcox: Certainly. Brian Wilcox for the record. Yes, indeed, it is an active investigation. So, we would not be able to comment deeply on what is actually ongoing, however, it — I guess I would have to say at this point, this is not a new investigation. I actually ran into this a few years ago while I was at DMV.

So, this has been actively investigated at the federal level for some time. So, while there are evaluations going on to ensure whether there has or has not been any exfiltration of any information out of our areas, at this point there is nothing that is pointing to that. So, we are looking at all of the contingences and any options that we would have to continue to find out if there was any way, shape, or form part of our infrastructure that was the cause of it.

I, too, was a victim of this but mine came out of the federal side when I was working on some federal programs. So, a lot of this information is readily available on the dark web with many unfortunate consequences. Deeter has worked on this for a bit.

We are currently performing a vulnerability assessment, we just finished that vulnerability assessment and I'm waiting on the report for that to see what those results are. We also have one of us manage service partners doing some analysis at this point. I'm afraid that that is probably all I'll be able to comment on. I wouldn't be allowed to go any deeper.

Director Cates: For the record, Patrick Cates. Thank you, Brian, for that information. I would just add on to that, to really emphasize — as Deeter put out in her press release last week, it does not appear that any State of Nevada data has been compromised in this.

This is a nation-wide problem, it's not specific to State of Nevada employees. It's not even specific to the State of Nevada citizens. It is a multi-state issue of people using false identification to file claims. Out of an abundance of caution, Brian and his group are looking at the state systems to make sure that we don't have vulnerability that — the reports that I have received, we see no evidence that it in any way has resulted from compromised data that the State of Nevada is responsible for.

Steve Fisher: Mr. Chairman, I just had a question. For the record, Steve Fisher. We participated in an exercise called Cyber Storm 5, I think it was during the spring time. I know we learned a lot from an Agency perspective, participating in that exercise. I'm just curious, were there some lessons learned at the state level with regards to that exercise?

Brian Wilcox: Yes. Brian Wilcox for the record. Yes, indeed. EITS along with several Agencies participated in the Cyber Storm 5 exercise. I was just new in the position when it launched. Actually, I was transitioning out of DMV, so I had had prior experience with Cyber Storm 4. So, the answer to the question is, yes. There were lessons learned in regards to communications, incident response.

Several of those are being factored into the risk profile that will now actually promulgate through and tie into our strategies, of wherever those gaps were identified in that particular exercise. They will be put into the risk profile and then obviously we will respond in kind, to provide a strengthening if indeed there were various gaps identified in our operational processes.

Steve Fisher: Thank you.

Chairman Diflo: Brian. For the record, Paul Diflo. Quick question on your overall IT Security Program. Is user based training part of that? I mention it because we have had great, measurable success actually, at my company when we started training users about unhealthy behavior, especially when it comes to phishing attempts. You can really prevent a lot of breeches just by training the user base. I'm just wondering if that is part of your program?

Brian Wilcox: Brain Wilcox for the record. So, the answer is yes. We have a yearly requirement for training. We use a federal-based program. We are all required as state employees, no matter who, to take that training once a year.

We also participate actively in the October exercise for National Cyber Security Month, and as a matter of fact, we're just getting tuned up for that particular event now. That will be in conjunction with the Governor and various other entities. So, yes, indeed.

Chairman Diflo: Mr. Earl?

Jim Earl: Mr. Chairman, if I can augment that. I want to announce publicly that I completed my annual training yesterday on the particular web exercise to which Brian has eluded.

Brian Wilcox: Congratulations.

Jim Earl: And it was successful on the first try which is another plus. I will stick that feather in my own cap as well. To the specific questions that you answered, since it's fresh in my mind, there is a very specific questions that deal with spear phishing and phishing generally. There is a bit of a background discussion within the roughly hour, hour-and-a-half, online training about how circumstances have changed over the last couple of years.

One of the reasons that I took it and went through all of the training modules, as opposed to taking an option and just skipping to the end and seeing if I could pass the test, was I wanted to see how much information was contained, whether I thought it would be meaningful to a state employee. One of the things that struck me, which is essentially what I think your question was trying to get at, was I found that it was actually quite current.

There were a number of exercises in more than one module, that dealt with some of the problems associated with social networking, and how social networking could open the opportunity for phishing in ways which seem to be fairly innocuous. Some of the introduction to social networking were those things which many of us would not think twice about doing, like posting a picture of a family vacation onto a social networking site. Or, taking particular pride in the accomplishments of our children and putting their information and some photographs of them on a social networking site.

So, while my mind is fresh, and while your question was very timely, I thought I would contribute that. At least in my experience, the annual training that is available, is pretty good and pretty updated, and addresses some of the problems that are quite current as I see it.

Now, we do have a compliance issue. Brian and Brian's folks are quite good at reminding those of us at EITS that we darned well better do the annual training because — in the words of an ancient English poet, if gold will rust, what will iron do? Meaning that, we have to comply totally if we expect anybody else to comply at all.

The participation rate is pretty good in the Department of Administration as well, for much the same reason. But, I have to tell you, at least based on the discussion I had yesterday, with a person who works for Brian and who is responsible for setting all of this stuff up and managing it, that the compliance rate is not as high as we think it should be, in all Agencies across the state.

So, to the extent that this can be a reminder to see our decision makers and managers across the state, the training is available, but it doesn't do us any good if none of your employees take it.

Chairman Diflo: That's a great point. Thank you. Are there any other questions for Mr. Wilcox?

Catherine Krause: This is Catherine Krause for the record. This is more of a comment than a question in support of what you were just talking about with the trainings. So, at the Attorney General's Office, we do have an annual process, and I think we do have pretty good compliance.

Just to tell you as far as the effectiveness of the training, our employees do often contact either the helpdesk or they will call me, or one of our staff if they see something that they think either they shouldn't click on, or they might should have not clicked on. So, because of the training, they're pretty well-aware and I think it has been pretty effective. I just wanted to throw that support in there.

Chairman Diflo: Thank you. Are there any other questions for Brian?

Joe Marcella: Chairman Diflo, Joe Marcella for the record. I had one question for Brian. Brian, several years ago, understanding that all of the Agencies infrastructure tend to be proprietary and vertical in nature, there was a concerted effort to try and standardize security across the board and I think a lot of effort was made to do that. Understanding that that is infrastructure, and that's sort of the mechanics of keeping it safe, could you give us a briefing on how that project faired?

Brian Wilcox: Brain Wilcox for the record. So, I would have to say the overall effort has been satisfactory to good. We've had the opportunity now to deploy enterprise tools in order to be able to provide vulnerability scanning, to be able to look at virus signatures, to keep programs updated and much more of what you would consider an enterprise effort.

So, while I would say, and why I would say it's average at this point, is that the participation rate is not as great as we would like it to be. We are an advisory body, so while we do have the ability to do capabilities, we would like to, of course, always market our services and provide as much capability as possible. So, I hope that addressed your question.

Joe Marcella: Yes. Thank you.

Chairman Diflo: Thank you very much for your informative input, Mr. Wilcox.

Brian Wilcox: Thank you again, very much.

8. BOARD DISCUSSION (for discussion and possible action) – Chair, Paul Diflo, and Shannon Rahming, State CIO.

Chairman Diflo: That takes us to Agenda Item No. 8. It is titled Board Discussion, but really what this is about is something that Assemblyman Anderson said, we're all busy, we want to make the best use of everybody's time. What we want to do is ask your input for any specific agenda items for the next ITAB meeting. I'll open that up for any suggestions.

Director Malfabon: Director Malfabon for the record. We could consider getting the Office of Science Innovation and Technology to give a presentation to some of the work that they are doing on broadband and Nevada, and getting out to some of the last mile locations, the rural areas of the state.

Chairman Diflo: Okay. That sounds like a good idea. Appreciate that. Any other input? If not, we have already determined the date of the next Board Meeting

9. DETERMINATIOIN OF DATES FOR FUTURE BOARD-RELATED ACTIVITIES (for discussion and possible action) – Chair, Paul Diflo.

Chairman Diflo: Again, as a reminder, it's October 27th, from 2:30 until 4:00. And before I ask for a motion to adjourn, Item No. 2 is still open. At this time, I will ask if there are any additional public comments. Hearing none, we will close Agenda Item No. 2, and I will ask for a motion to adjourn.

Assemblyman Anderson: Mr. Chair, Assemblyman Anderson.

Chairman Diflo: Yes, sir? Assemblyman Anderson: Before I make a motion I would like to congratulate you on a meeting well done. Certainly, I know the experience of chairing for the first time, and it's always a bit of a challenge understanding the rules and the discussion, and the points of order. So, great job. I appreciate the efficiencies there.

10. ADJOURNMENT

Assemblyman Anderson: I would motion to adjourn.

Chairman Diflo: Thank you very much for the feedback. Second?

Director Malfabon: Director Malfabon. Second.

Chairman Diflo: All right. The meeting is adjourned.

Attachment E Follows The following responses are provided jointly on behalf of AT&T, CenturyLink, Charter Communications and Cox Communications.

Information Technology Advisory Board – Study of Peering

1. Does the doctrine of federal preemption effectively prevent a state from enforcing any statutory or regulatory provisions affecting “arrangements for Internet traffic exchange” include peering?

In its 2015 Order , the Federal Communications Commission (“FCC”) found “arrangements for Internet traffic exchange,” including peering, are broadband internet access service subject to the FCC’s authority under Title II of the Communications Act (“Act”).1 The FCC retained targeted authority over such arrangements through section 201, 202, and 208 of the Act, but forbore from a majority of other provisions in the Act. 2

Nevada cannot enforce a statutory or regulatory provision affecting “arrangements for Internet traffic exchange.” The FCC classified broadband Internet access service as jurisdictionally interstate for regulatory purposes. 3 Further, the FCC specifically noted that states may not continue to apply or enforce any provision from which the FCC granted forbearance. 4 The FCC also announced its “firm intention to exercise preemption authority to preclude states from imposing obligations on broadband service that are inconsistent with the carefully tailored regulatory scheme” adopted by the FCC. 5 Any attempt by Nevada to impose an in-state peering obligation would be inconsistent with the regulatory scheme established by the FCC.

1 Protecting and Promoting the Internet, Report and Order on Remand, Declaratory Rulings and Order, GN Docket No. 14-28, FCC 15-24 (rel. March 12, 2015)(“ Order ”), affirmed on appeal , U.S. Telecom Ass’n v. FCC. No. 15-1063, slip op. at 97-106 (D.C. Cir. June 14, 2016), pets. for en banc rehearing pending ; para. 195 (“[t]he definition of broadband Internet access service includes the exchange of Internet traffic by an edge provider or intermediary with the broadband provider’s network.”); para. 202 (“…arrangements for Internet traffic exchange (which are subsumed within Broadband Internet access service…”)’ para 204 (“As a telecommunications service, broadband Internet access service implicitly includes an assertion that the broadband provider will make just and reasonable efforts to transmit and deliver its customers’ traffic to and from ‘all or substantially all Internet endpoints’ under sections 201 and 202 of the Act.”) See also, para. 204 (“…disputes involving a provider of broadband Internet access service regarding Internet traffic exchange arrangements that interfere with the delivery of broadband Internet access service end user’s traffic are subject to our authority under Title II of the Act.”) 2 Order, para. 195 3 Order , para. 431 4 Order, para. 432. 5 Order, para. 433.

2. If the physical world threat over public internet facilities between two points in Nevada is not realistically affected by an in-state peering requirement, should Nevada instead legislate minimum physical security requirements for data centers in Nevada where peering of public internet traffic takes place as the most effective way to reduce risk in the physical world?

An in-state peering requirement will not reduce the exposure of cyber threats against Nevada state entities. Any Nevada state service, data, or critical infrastructure exposed to the public internet is vulnerable to a variety of cyber-attacks, including Distributed Denial of Service (“DDOS”) attacks and the infiltration/exfiltration of data. In order to protect such critical infrastructure and/or data from the public internet, the industry best practice is for the data to be: 1) encrypted at the end points; 2) within a private virtual private network (“VPN”) context (not routed on the public internet); or 3) transported over a dedicated private line between end points. Specifying additional physical security requirements for data centers where peering traffic takes place would not be any more effective on potential data compromises. Since most data centers contain the same critical business system data that would potentially be transported over the internet, a holistic approach to physical security would be required. It would not make sense to add additional physical security around peering if the physical servers where the data resides does not have the same set of physical security standards applied. Requiring in-state peering is like requiring only one door to be locked of a multi-door building. 3. What percent of successful data compromises have been directed at data in transit as compared with those directed at data at rest? In Nevada as compared with the United States as a whole? How will an in-state peering requirement increase the security of in- transit data originating from, or destined for, a location in Nevada?

The responding companies are not aware of any specific information separating data compromises in transit compared to those at rest, let alone in Nevada compared to the United States as a whole. An in-state peering requirement does not increase the security of data being transmitted in/out the State of Nevada due to reasons cited in question #2. 4. Will an in-state peering requirement result in an increase in service quality that is perceptible to the end user? How do you know?

An in-state peering requirement would not perceptibly increase service quality to end users in Nevada as there are too many variables external to peering that impact service quality. In-state peering would also be a significant departure to the proven long-standing industry practice of how networks interconnect to exchange internet traffic. National and global networks typically interconnect in a few regions that encompass large geographies that include multiple states.

Adding peering within the state of Nevada is likely to result in companies having to re-architect how networks are configured, adding inefficiencies and unnecessary cost, because every additional peering exchange is another “entry point” into the network that must be managed. The more entry points, the more difficult it is to manage network traffic. Additionally, each one

2 of these “entry points” becomes another security threat to the network. In order to protect the end user experience and in some cases, sensitive information, companies prefer to maintain a reasonable number of entry points into the network. Each additional entry point becomes another target for security attacks, making the network more vulnerable.

5. What would be the effect on Nevada end users if contiguous states enacted in-state peering requirements identical to those enacted in Nevada? If all states enacted identical requirements? If all countries enacted similar provisions?

If multiple states or all states, or even all countries, required local peering arrangements, most customers would see few, if any, positive impacts to the user experience. Adding more and more peering points to a network with an already richly established fabric provides diminishing returns.

Networks benefit when interconnecting at large scale. Peering works precisely because ISPs, CDNs (Content Delivery Networks), and content providers all work together so that major network entities meet at as many exchange points as efficiently needs and the market otherwise dictate. For this reason, best practices within the internet community long ago have generally resulted in the selection of a few carefully chosen geographic sites throughout the country as interconnect points. This practice has been in place for well over 20 years. The Internet has flourished as a result.

This leads to the last point - cost. Adding additional peering points in some/all states, with associated colocation, circuit, fiber and construction costs, would be prohibitive, with no demonstrable end user benefit.

6. To carriers (secondarily to governments): Do you provide facilities and/or services considered essential to the continued, non-degraded, functioning of government private networks? Are these facilities and/or services currently subject to competition, that is, could a competitor replace the facilities and/or services you provide?

Numerous providers offer services to multiple residential/commercial and government locations. These services allow for both commercial and government entities to conduct business with the outside world, and connect peer to peer with other locations internally.

7. Discuss the public policy considerations that would support the financial risk of in-state peering being borne by one set of entities while the proposed benefits of in-state peering would be conferred on another set of entities. As outlined in the response to Question 4, there will be no material benefit conferred by a mandatory in-state peering requirement and it will impose significant costs on providers. The end result is that such a requirement would constitute a tax on ISPs, an exaction by the state that provides no direct benefit to the providers (or any other entity).

8. What agency would determine whether the in-state peering requirements were met for the purpose of state procurement actions? For the purpose of local government procurement actions? How would its decisions be enforced? What attendant statutory or regulatory changes would be required? For example, could an entity object to a contract award on the basis of non-compliance with an in-state peering requirement even though that entity did not participate in the relevant procurement process (an RFP or sole source procurement justified by a lack of vendors capable of supplying needed communications facilities and/or services)? Are the costs of the oversight and enforcement efforts justified by the likely benefits of an in-state peering requirement? It is not clear whether any existing state agency has the expertise or capacity to monitor a mandatory in-state peering requirement and ensure that every state and local procurement process complied with the obligation. It would require the continuous updating of a database of the companies required to comply with the mandate as well as monitoring all state and local procurement procedures to ensure that entities responding to RFPs were compliant with the mandate. Significant changes in state and local procurement laws would most likely be required to give the state agency or agencies veto authority over the awarding of a contract to a non-compliant entity, or the ability to challenge and rescind an award after it is made. Disqualified entities would likely challenge decisions based on inaccurate compliance data. As noted in the response to Question 4, the lack of benefits to any party, including end users, of a mandatory in-state peering requirement, more than outweighs the costs of creating a new oversight and enforcement process. 9. What benefits, attributable to an in-state peering requirement, would appeal to an enterprise considering relocating to Nevada? Conversely, what enterprises, if any, would consider an in-state peering requirement as a negative factor in determining whether to relocate to Nevada?

There is nothing appealing about requiring a service provider to expend capital to comply with an in-state mandatory peering requirement that brings no benefits to the provider or its customers (see response to Question 4). Such a requirement would be a disincentive to companies looking to relocate to Nevada.

10. If the benefits of in-state transit are sufficiently great (see Questions 3 and 4), won’t providers of services delivered over public internet facilities negotiate the use of wholly in-state fiber facilities in order to provide the best possible service to Nevada end users as a matter of self interest, thereby rendering an in-state peering requirement irrelevant? Software-defined networking (SDN) and SD-WAN technology purportedly allows network administrators to decouple network control from the underlying physical infrastructure.

Peering discussions rarely include fiber as a topic since fiber is considered part of the base network infrastructure, and because fiber requirements are different for each company. Additionally, national network operators generally do not build business or network models that consider Internet connectivity for one individual stand-alone state; rather, network planners include multiple or groups of states in their models as part of their overall regional and national networking strategy. In-state peering only is not an approach that large network operators generally consider in developing a peering strategy for a region or nationally. As a concept, in-state peering would only satisfy users that are locally embedded, and, while it may theoretically offer a better experience, it would be limited to only those users that have that narrow requirement. The reality of the Internet is that all users have an expectation of global reachability, and therefore internet data is expected to be available from almost every origin and destination point worldwide. This means that, both as a matter of connectivity and competition, network operators must consistently develop network deployment strategies that are national and global in scale in order to fulfill this real-world expectation of Internet users. As such, limiting peering to in-state only has little or no utility to the user/customer. 11. Are there emerging or anticipated technologies that would replace, in whole or in part, traditional routing functions and peering arrangements, thereby rendering an in-state peering requirement obsolete? If so, in what time frame are these technologies likely to emerge as significant substitutes for existing technologies and commercial peering agreements?

There are no anticipated technologies that would completely do away with peering relationships between networks. Some technologies and business arrangements may optimize routing over a peering infrastructure (e.g. SDN-WAN applications), and possibly require more extensive peering relationships, but traffic exchange between networks will ultimately continue to be arranged by some means of interconnection. The basis for these interconnections will vary greatly based on the type of companies exchanging traffic, what type/mix of internet traffic is being exchanged, and network infrastructure considerations.

12. What other issues, not covered by the foregoing questions, do you believe are relevant to the Peering Study undertaken by the Information Advisory Board (ITAB)?

Taken as a whole, the questions in the RFI are both thoughtful and comprehensive, and allow respondents to thoroughly address the necessary and relevant issues pertaining to the idea of in- state peering that should be considered in the present regulatory and technological environment.

Attachment F Follows

*** NOTICE OF PUBLIC MEETING ***

INFORMATION TECHNOLOGY ADVISORY BOARD

LOCATIONS: Legislative Counsel Bureau Grant Sawyer Building 401 S. Carson Street 555 E. Washington Avenue Room 2134 Room 4412 Carson City, Nevada 89701 Las Vegas, Nevada 89101

DATE AND TIME: October 27, 2016, 2:30 p.m.

Below is an agenda of all items to be considered. Items on the agenda may be taken out of the order presented, items may be combined for consideration by the public body; and items may be pulled or removed from the agenda at any time at the discretion of the Chair. Background documents for Agenda Item 5, Implementation of SB 289 (2015), are available on line at http://it.nv.gov/Governance/dtls/ITAB/Meetings/Meetings/. AGENDA

1. CALL TO ORDER and ROLL CALL

Chairman Diflo: I will call to order the October 27, 2016 Meeting of the State of Nevada Information Technology Advisory Board. I will ask Kelly, if you could do a role call and then let us know if we have a quorum?

Kelly Kiesow: Okay. Assemblyman Anderson?

Paul Anderson: Here.

Kelly Kiesow: Okay. Senator Lipparelli? Chairman Diflo?

Chairman Diflo: Here.

Kelly Kiesow: Director Cates? Director Whitley?

Ellen Crecelius: Ellen Crecelius here for Director Whitley.

Kelly Kiesow: Director Malfabon?

Director Malfabon: Here.

Kelly Kiesow: Ms. Krause?

Catherine Krause: Here.

Kelly Kiesow: Mr. Betts?

Craig Betts: Here.

Kelly Kiesow: Sherri McGee?

Sherri McGee: Here.

Kelly Kiesow: Joe Marcella?

Joe Marcella: Present.

Kelly Kiesow: Mr. Chairman, we have a quorum.

2. PUBLIC COMMENTS (for discussion only) – No action may be taken upon a matter raised under this item of the agenda until the matter itself has been specifically included on an agenda as an item upon which action may be taken. Public comments may be limited to 3 minutes per person at the discretion of the Chair. Comments will not be restricted based on viewpoint. The Chair may, at its discretion, hold this agenda item open in order to receive public comments under other agenda items.

Chairman Diflo: Very good, thank you, Kelly. Agenda Item 2 is Public Comments. Just like the last meeting that we had, I would like to keep this item open until after we get through Agenda Item No. 5. Agenda Item No. 2 is for any general public comments. I would ask that any public comments, specific to Agenda Item 5 on the Peering Study that we bring up at Agenda Item 5.

With that disclaimer, is there any public comments? Okay.

Joe Marcella: Chairman Diflo, none down here.

Chairman Diflo: Very good, thank you Joe.

3. COMMENTS BY THE CHAIR (for discussion only) – Chair, Paul Diflo.

Chairman Diflo: Very good, thank you Joe. We’ll go to Agenda Item No. 3, keeping Agenda Item No. 2 open. I wanted to start out by thanking everybody for attending this meeting so closely to the last meeting. If you’ve read the agenda, you see we only have one agenda item to discuss at this meeting. We expect it to be shorter than normal.

I also want to take this time to publicly thank AT&T, Cox, Charter and Century Link, for providing us a consolidated response rather than four independent responses to our peering questions. Today we’re going to discuss the responses. We can ask the internet suppliers any additional questions, but in the end, we must provide a recommendation to the Legislative Council Bureau, for or against SB 289.

4. APPROVAL OF MINUTES (for discussion and possible action) – Chair, Paul Diflo. Discussion and decision to approve minutes of the meeting on August 31, 2016.

Chairman Diflo: At this time, I’d like to move down to Agenda Item No. 4, Approval of the Minutes. I’d like to ask somebody for a motion to approve the minutes that was from the meeting held August 31, 2016.

Speaker: So moved.

Chairman Diflo: Do we have a second?

Speaker: Second.

Chairman Diflo: Okay. Motion carried.

5. IMPLEMENTATION OF SB 289 (2015) (for discussion and possible action) – Chair, Paul Diflo.

Chairman Diflo: Let’s get into Agenda Item 5 which is titled the Implementation of SB 289 for discussion and possible action. I’m assuming that all Board Members had a chance to review the responses to the public’s questions. At this time, I would like to ask if any Board Members have any specific items they would like to discuss regarding those responses? I see we have representation from the responders in Reno. Joe, you mentioned we have representation from the responders in Las Vegas. I will point out, we may ask you to come up and answer any questions that the Board Members may have.

At this time, I will open it up for any questions, or any discussion, regarding the responses. [pause] Okay. Seeing that there are no questions from any of the Board Members, I would now like to ask the responders, if there are any public comments specific to the peering study? Anyone from Reno? This is your opportunity for final—final comments.

Randy Brown: Thank you Chairman Diflo. Randy Brown on behalf of AT&T. First, we appreciate you giving us the opportunity to respond to the questions. Given the discussion at the first meeting, we quickly realized the limited resources of this Committee and provided the joint response to try and consolidate it into one document. I appreciate your comments on that as well.

I think the responses are comprehensive and you’ve all had a chance to take a look at them. I would just say that, from AT&T’s perspective, legislative a technology policy is really not in the best interest of the State. Technology is rapidly changing and putting something into statutes that may or may not be relevant in the very near term or even in the long term, we don’t believe is good public policy. We believe that states and local governments and other instrumentalities have the tools that they need, if this is an important issue to them, they simply write it into an RFP. That gives them the flexibility they need going forward, rather than legislating it.

We appreciate the opportunity to be part of this study and we’d be pleased to answer any questions.

Chairman Diflo: Appreciate those comments Randy. Are there any public comments regarding the peering study down in Las Vegas?

Joe Marcella: We have one.

John Lopez: Thank you Mr. Chairman. John Lopez for the record, on behalf of Cox Communications, Las Vegas, Government Affairs Manager. We don’t really, as a company, don’t have anything to add, other than our recommendation is a company that the Board not recommend any legislation to mandate any peering arrangement. If you have any questions, we’d be happy to answer them but thank you for the time that you’ve served on the Board. We very much appreciate it.

Chairman Diflo: Thank you for your comments. Yes sir.

Mike Eifert: Thank you Chairman. For the record, my name is Mike Eifert. I’m the Executive Director for the Nevada Telecommunications Association. I too would like to thank the four companies that put together the answers to your questions. AT&T and Century Link are members of my association. Really, I guess my comments reflect those of the rural companies in this state. I agree with the gentleman from Cox just said and with Randy Brown’s comments that I don’t see a benefit to the State in pursuing this and really if I look at Question 1, I have a lot of concern—or, answer to Question 1, I have a lot of concern with litigation as it pertains to the FCC’s authority or what their perceived authority is over this.

This also would impose a burden of cost. The four companies that put this together obviously are very large companies, but the rural companies in Nevada are very small. Interconnection agreements cost money. They take time, they take resources and I think that’s something that I wanted to point out, that a little bit not stated in the answers to your question. I thank you for the time to allow me to make these comments and to answer any questions you might have.

Chairman Diflo: Thank you Mike, appreciate it. Okay, final call for public comments, either in Reno or in Las Vegas. Seeing none. We had the opportunity to discuss this topic on October 31st. We’ve had the opportunity to read the formal written responses from the internet providers. And we’ve heard their comments today. At this point, I’d like to ask for a motion on a recommendation that we would send to the Legislative Council Bureau.

Paul Anderson: Mr. Chair, Assemblyman Anderson, if I could?

Chairman Diflo: Yes sir.

Paul Anderson: Maybe I’ll make some comments first and then if it’s appropriate I’ll be happy to make a motion. I think the goal of SB 289, frankly has been reached. We looked at security response rates, precedent enforcement, possible restrictions on technology and putting those things into statute which would certainly limit innovation. As quickly as this industry moves—I’m in the IT industry and it seems like I’m reinventing my own company every couple of years or sooner, just to keep up with things.

I think also, the current tool sets that we have at hand, which was mentioned by one of our industry experts, as far as putting something into an RFP, if they felt like it was a necessary requirement—I think 289, while it turned into a study and brought to us to be able to dive a little more deeply into this topic. I certainly appreciate the time that our folks have put into it. Both our industry experts and staff and our State CIOs have had to manage this one for us. I think there’s some good things that we put onto the record. I think there some good answers built into these questions and I appreciate the consolidated response as well. There are probably a lot of people that would want to chime in on this issue.

So, with that, if it’s at the Chair’s discretion, I think we’ve met the goals of SB 289. I feel like we’ve delved into the issue, understand how it may or may not affect the state and certainly the goals of us being on the forefront of technology—not being regulated into anything that would limit us.

My response—my motion, if it’s acceptable to the Chair would be that we accept the answers, the consolidated answers that were given to us, that we make those part of the record and submit a report to the LCB, the Legislative Council Bureau, that would make a recommendation that no legislation move forward based on the recommendations that this Committee has found.

Chairman Diflo: Thank you Assemblyman Anderson. Any discussion? Any comments from other Members of the Board? Seeing none, I’d like to ask for a second.

Catherine Krause: Second. Catherine Krause for the record.

Chairman Diflo: Thank you. This motion I believe would need a vote, all those in favor. [ayes around] Motion carried.

At this point, I would like to ask for a second motion to allow the Chair to forward the recommendation to the Director of Legislative Council Bureau, along with the background documents considered by the Board. So any of the applicable minutes, as well as the formal responses from the internet providers.

Paul Anderson: Mr. Chair, Assemblyman Anderson. I’m happy to reemphasize that portion and make sure that all the minutes, the details, the responses from our vendors and the industry experts, as well as any comments from this Committee be included in the recommendation and response to LCB, Legislative Council Bureau.

Chairman Diflo: Thank you Assemblyman. May I ask for a second?

Sherri McGee: For the record, Sherri McGee, I second.

Chairman Diflo: And this would require a vote. And all those in favor. [ayes around] That motion carries.

6. BOARD DISCUSSION (for discussion and possible action) – Chair, Paul Diflo, and Shannon Rahming, State CIO. The Board may identify issues within its statutory mandate to be addressed at future meetings.

Chairman Diflo: Agenda Item 6, this is the spot on the agenda where we usually bring the CIO up and have him/her report. Shannon, do you have anything to report today?

Shannon Rahming: Hi, thank you very much. Shannon Rahming for the record. First of all, I’d like to thank the Board and I’d like to thank the vendors for coming up and A) putting all the effort and time into this. We really appreciate it. It’s wonderful the State of Nevada is very appreciative and thank you very much for doing that. That’s wonderful. Pretty much everybody knows what’s going on. We’re working on budgets right now. Getting ready for the next Legislative Session. If you have any questions for me, let me know, but I really have nothing else to report.

Chairman Diflo: Any questions for Shannon?

Paul Anderson: Shannon, thanks for being here today and I appreciate it. I think there’s been a lot of reorganization in your Department, I guess, I’d just like to hear how that’s going and I know that you’ve put some different teams together. I’d love to hear some specifics about those teams and just sort of some background on where you think [tape cut] going.

Shannon Rahming: Great, thank you. Thank you for the question. Shannon Rahming for the record. We are at this point in time putting together an agency IT area. In fact, our new Chief starts on Monday. Yeah! Very excited. So, she—her name is Suzy Block. She will be over our area which is development. So programming, database, help desk, desktop and our project management group. Then we will, eventually, once it’s approved, through the Legislative Session, we will eventually bring in some more server type folks and some network. Then we will have basically two areas. We will have our Enterprise Area. That area will take care of all the enterprise needs for all the state agencies. Then we’ll have our agency group and they will specifically take care of Department of Administration, Department of Public Safety and the Governor’s Offices. That’s going to be the split. That agency group will be those agencies direct IT Department. It’s like having their own IT Department and that’s exactly who they go to. They will have one chief to go to. If they have any issues with anyone else, they can go directly there. That Chief’s responsibility would be to then be the liaison to the other areas to take care of the problems and the issues. That’s where I’m doing it. We’ll have like an Enterprise Group and then Agency Group. One vision, two missions, basically. We are rolling forward. Like I said, I’m very excited to get our new person on board.

Paul Anderson: Thank you for that. If there’s any updates on the DPS. Obviously there was a leap of faith from DPS to jump in with EITS. I know there’s always obstacles and tough times. How is that going and are we making some great progress there? Also, kind of the integration with all the federal side of things that DPS has to deal with.

Shannon Rahming: It’s certainly going and yes, it was a leap of faith. I don’t have all the background because I wasn’t here at that point in time but we have moved forward a lot. We have certainly done a lot for their network. Refreshed it, a lot. We’ve also been able to get a lot of coding done for them. A lot of projects have been done for them. We have been able to take care of their help desk needs 24 hours a day, 7 days a week, 365 days a year. We have put that in. That was a change for EITS because they were used to an 8:00 to 5:00 help desk and of course, with our officer safety, we needed 24x7x365 to help take care of that.

It’s been an experience for both sides. EITS has had to learn a lot about the federal side of it and also the public safety side and public safety has gotten the opportunity to utilize a lot of our tools and a lot of our expertise and knowledge from the network perspective.

Is it perfect? It’s not perfect yet. Is it getting better? It’s getting much better, yes.

Paul Anderson: Mr. Chair, if I could have one more.

Chairman Diflo: Yes sir.

Paul Anderson: I’m curious. As you develop kind of this new infrastructure and Agency Department versus the Enterprise Department, I think those are great ideas. How do you see

that—and you already mentioned you’re rolling into the budget season here. Obviously agency budgets are now public, as of the 15th. We’re getting through [inaudible] and moving forward. Do you see the—you’re a cost agency, right, where you pass on those fees to—

Shannon Rahming: Yes, internal services funds.

Paul Anderson: Internal service funds, thank you. I sit on WAZE, I should know that nomenclature pretty clearly. That said, do you see any added costs or obstacles in making sure you can recoup those costs as you develop out different teams and departments or do you think it’s going to be a wash in the end.

Shannon Rahming: I think it’s—in developing—Shannon Rahming for the record. In developing those teams, we’re not adding people at this point in time. If we are adding people, it’s going to be based on looking at something new. We’re utilizing existing employees. We are re-massaging the money, I guess, for lack of a better term. I mean, the money is already there, but it’s going to be allocated differently. I don’t expect we’re going to see a large increase in funds, based on doing this. Again, we’re utilizing the same employees. They’re going to be doing something different. We’ll be collecting their funds at different mechanisms.

Paul Anderson: Repurposing those funds.

Shannon Rahming; Yes.

Paul Anderson: All right. I appreciate the progress and I’m hearing good things on the ground. Obviously there’s always rumblings that change is tough, but you know, change needs to happen quite often. Appreciate your efforts.

Shannon Rahming: Thank you very much.

Paul Anderson: Thank you Mr. Chair.

Sherri McGee: Chairman, Sherri McGee for the record. I do have a question for you Shannon. With the ERP replacement that’s happening in the state, so can you give me an update of what’s happening today and what’s being planned for in the next legislative cycle?

Shannon Rahming: Certainly, Shannon Rahming for the record. Right now, we are actually—next week we are having some demos, for ERP demos. Right now, we are actually just going through and mapping out all the processes. With the goal to get an RFP out in the next biennium and then we’ll forward from that. The RFP has not been written. It’s being— all the processes, like I mentioned are being documented right now. Then the RFP will go out.

Sherri McGee: For the record, Sherri McGee. Has the funding been established for that project?

Shannon Rahming: There has been a request. There was a tire that was put through that was voted on. There was an amount put into the tire. There has been no funding besides the original funding to actually put the RFP out. The funding would have to come in this biennium and the next biennium.

Sherri McGee: Thank you.

Chairman Diflo: Any other questions for Shannon? Thank you Shannon.

Shannon Rahming: Great, thank you.

7. DETERMINATION OF DATES FOR FUTURE BOARD-RELATED ACTIVITIES (for discussion and possible action) – Chair, Paul Diflo.

Chairman Diflo: The last item is just a discussion around dates for future board meetings. I’m told that with the upcoming legislative session that it’s difficult if not impossible to book meeting rooms. Having some of the legislators on Board, it may be preferable to hold our next meeting after the close of the 2017 Legislation. Now, having said that, that puts a little pressure on us because we’d be squeezing in, you know, a lot of meetings from June through the end of the year. In those future meetings, we want to start reviewing the strategic plans that Shannon has for the EITS Department. I’d like to put that up for discussion, what’s a realistic timeframe to have the next meeting?

Catherine Krause: Mr. Chair? If it helps, we have, at the Attorney General’s Office, we have some rooms that we—hold public meetings in regularly. They’re not as big or as nice as this, but if—I want to offer that up, if we—you know, to help us meet every three months, as it says we’re supposed to in statute. If we could do that, I mean, I know it might be difficult for some of the legislative members to do that. Three months is in January. I’ll just offer that up if that’s of interest. We could host these meetings. With the size and the number of public that tends to attend, I think we would be able to accommodate that.

Chairman Diflo: Do you have the capabilities to do the [crosstalk]

Catherine Krause: Yeah, we do. We regularly do meetings North and South, public meetings, many, many per week. So, we could accommodate that.

Chairman Diflo: Yes Shannon.

Shannon Rahming: Thank you very much, Catherine Krause, for offering that. Shannon Rahming for the record. So with your rooms, can they actually go through and be able to record and then also—because right now we utilize these rooms because they do recording.

Catherine Krause: We don’t have that so we have staff that do the recording. Yes, that would be a challenge given the lack of staffing for this Committee. Good question.

Shannon Rahming: Right. Thank you.

Chairman Diflo: That’s a good point. Yeah, thank you.

Director Malfabon: Mr. Chairman, NDOT has the ability to host video conferencing and record as well. We just use our service for the keeping of the minutes, as well. We could offer that up. Just have to find an available date, to make sure it’s not on the same day as a Board Meeting for instance for our Transportation Board.

Chairman Diflo: Okay. Well, I thank you for the offer. I know it’s—it’s probably difficult during Legislation for you to get away Assemblyman Anderson?

Paul Anderson: Thank you. Assemblyman Anderson for the record. You know, January would be fine. There’s some new legislative training that goes in this building, but it’s certainly not—you know, not using every single room. So, I think we could probably get a meeting done in January. There may be some new appointees to the Board, however—or the Commission, however that—that just comes with the territory. So, I think both of those offers are advantageous. Whether or not we could use a room here in January, I think that would be easiest enough to do. Certainly during the Legislative Session, I might have a different opinion. Unless we’re—

Chairman Diflo: This is recorded remember.

Paul Anderson: Early morning or late nights, that’s about when it is. Certainly January I think is doable. Certainly—then we get into June before the legislators could probably attend and be participatory.

Chairman Diflo: Okay. Thank you sir. Then I guess what I’d like to do is ask for a motion—I will have Kelly and I will look for a date in January that works for everybody and a room that works for everybody. Maybe I don’t need a motion for that, huh? Probably not. Okay.

8. PUBLIC COMMENTS (for discussion only – Chair, Paul Diflo.

Speaker: Mr. Chairman, last call for comments please.

Paul Anderson: I think you probably need to jump into public comment first.

Chairman Diflo: Oh. Thank you for reminding me. At this time, are there any additional public comments in both Reno and Las Vegas?

Joe Marcella: None down here.

Chairman Diflo: And it doesn’t look like there’s any in Reno. We can close Agenda Item 2 as well.

9. ADJOURNMENT

Chairman Diflo: And it doesn’t look like there’s any in Reno. We can close Agenda Item 2 as well. Now we’ll ask for that motion to adjourn.

Paul Anderson: Ditto, motion to adjourn.

Chairman Diflo: Thank you. Second?

Speaker: Second.

Chairman Diflo: Thank you sir, meeting is adjourned. Thank you everybody.

Notice of this meeting was posted before 9:00 a.m. three working days prior to the meeting pursuant to NRS 241.020, in the following locations:

 Legislative Building, 401 N. Carson St., Carson City, NV 89701  Blasdel Building, 209 E. Musser St., Carson City, NV 89701  Carson City Court Clerk Office, 885 E. Musser, Carson City, NV 89701  Washoe County Courthouse, Second Judicial District Court, 75 Court Street, Reno, NV 89501  Nevada State Library and Archives, 100 Stewart Street, Carson City, NV 89701  Grant Sawyer Building, 555 E. Washington Avenue, Las Vegas, NV 89101  And the following web locations:

o http://it.nv.gov/Governance/dtls/ITAB/Information_Technology_Advisory_Board_(ITAB)/ o http://www.notice.nv.gov

The appearance of the phrase ―for possible action‖ immediately following an agenda item denotes items on which the Board may take action.

We are pleased to make reasonable accommodations for members of the public who are disabled. If special arrangements for the meeting are required, please notify Kelly Kiesow in advance at (775) 684-5849 or you may email your request to [email protected] .