Governments everywhere make IPv6 mandatory

The 'or explain' get-out

The Forum for Standardisation, which is attached to the Ministry of Economic Affairs and the Ministry of the Interior, added IPv6 to the 'use-or-explain' list (ptolu) as far back as 2010. That means IPv6 support must be included in tender specifications for government contracts worth more than 50,000 euros, unless there are good reasons for non-inclusion. Consequently, the implementation of IPv6 should normally be an integral feature of public sector IT infrastructure upgrade projects.

However, the Forum for Standardisation reports that some government organisations are misusing the scope that is allowed for exceptions: "Public sector bodies have had twelve years to prepare their systems for migration to IPv6. There is no longer any reasonable excuse for avoiding the 'use' requirement by falling back on the 'or explain' get-out. The effect of the 'use-or-explain' policy and the scope for delayed implementation has been that a sense of urgency is lacking in certain quarters." Hence, the Forum now believes that adoption should be made mandatory.

Economic superpowers

So far, the main countries to mandate IPv6 support have been the economic superpowers. We previously described how hundreds of millions of mobile users in India and China were being transferred to IPv6-only networks, pushing up IPv6 use in those countries considerably [India, China].

Since last year, US federal agencies have been required to publish IPv6 policies and implementation plans, including IPv4 phase-out strategies. By the end of next year, all government organisations in the US will have to support native IPv6. There will then be a three-year period of migration to IPv6-only environments, which at least 80 per cent must be operating at the end of that period.

The US Army's budget for 2020 (section 1088) originally included an amendment inserted by the House of Representatives, requiring the army to sell its IPv4 address blocks at the going market rate within ten years. (The army has thirteen /8 blocks, sufficient for more than 218 million addresses.) That requirement did not feature in the legislation ultimately passed by Congress (the House and the Senate combined), however.

China: fully IPv6-only by 2030

China's large-scale rollout of IPv6 is part of an industry policy whose initial aim was to get all China's internet users using IPv6 by 2025. China has since revised that target and increased the impetus of migration. In the next few years, the number of (mobile) users and IoT devices using IPv6 is to increase considerably. The goal is now universal IPv6 support and full transition to IPv6-only (at least for domestic traffic) by 2030. That is to be achieved by simply forbidding IPv4 support on new networks from 2024.

India: universal IPv6 support this year

In India, all government organisations are required to enable IPv6 support no later than this summer. And, by the end of the year, all ISPs' customer-premises equipment must support IPv6 as well. In both India and China, therefore, support is mandated not only for public bodies, but also for commercial service providers.

EU: critical situation

Although the European Commission was until recently reluctant to use more forceful measures to promote the adoption of modern internet standards, it changed course at the start of this year. In its EU Strategy on Standardisation, the Commission explicitly addresses the topic of standards for an open and secure internet. It argues that the standardisation of internet protocols has become politicised, and that circumstances have arisen that threaten continued development of the open internet and further global digitisation. The Commission is accordingly seeking to bolster its representation within international political and standardisation bodies, and is creating a portal to monitor and promote the adoption of internet standards. Notably, IPv6 is the only standard that is actually named in the strategy document. The next step will be for the Commission to propose policies on the adoption of IPv6 and other important internet standards.

When it does so, the European Commission is expected to take an approach similar to that used by the Americans and Chinese. In its Cybersecurity Strategy for the Digital Decade published in late 2020, the Commission proposes accelerating the adoption of IPv6 by mandating the phased withdrawal of IPv4 infrastructure from government use and from the market, by means of a so-called 'sunset' regulation. The Commission's IPv6 policies, plus comparable measures to drive the adoption of internet security standards such as BGP, DNSSEC and SPF/DKIM/DMARC, will require the cooperation of member states and the private sector. However, in answer to questions from the European Parliament earlier in 2020, Commissioner for the Internal Market Thierry Breton said that the adoption of IPv6 was best promoted at member-state level.

The Netherlands: looking into mandatory adoption

According to Larissa Zegveld, Chair of the Forum for Standardisation, the era of 'explaining' inaction instead of implementing IPv6 is now over. "Not supporting IPv6 simply isn't an option. The government should be setting an example where the use of modern internet standards such as IPv6 is concerned. After all, we're talking about standards that make the internet safer and more accessible for everyone, everywhere, now and in the future, and thus provide a basis for continued innovation. Widespread support for IPv6 here in the Netherlands is important for our international competitiveness. Adoption will facilitate realisation of the current administration's stated ambition that the Netherlands should become Europe's digital hub, with a robust, ultra-fast and secure internet infrastructure covering the entire country."

The Ministry of Economic Affairs and Climate Policy is positive about going further in terms of requiring government organisations to implement IPv6. "IPv6 has been on the 'use-or-explain' list for twelve years. Its use has therefore been required for a long time already. Unfortunately, however, as OBDO has observed, targets for the use of IPv6 haven't been met. Meanwhile, the importance of widespread IPv6 support has only increased, as the internet has continued to grow and the IPv4 address shortage has consequently intensified. Moreover, the situation is problematic not only for Dutch government bodies, but also for all internet users and service providers all around the world. We are therefore looking into mandating IPv6 support for external access to all levels of government."

"The government of the Netherlands is working to bring about the extensive adoption of modern internet standards, including IPv6, throughout the Dutch economy. Our future depends on global digital accessibility, and IPv6 is vital for ensuring that our accessibility remains of the required standard. The Dutch government can therefore play an important pioneering role in the adoption of IPv6. Not only with a view to improving and extending access to public services, but also as a means of motivating the private sector to follow suit. If IPv6 support becomes mandatory for government bodies, that will hopefully accelerate the adoption of IPv6 and help to tip the economic balance in favour of investment in IPv6."

Cybersecurity: one IP address, one user

Although we welcome any initiative that advances the adoption of IPv6, the source of the initiatives does matter. While the EU Strategy on Standardisation has a geo-economic emphasis, the inclusion of IPv6 in a cybersecurity strategy has a very different basis. Back in 2017, for example, Europol reported that access providers using CGNAT were often no longer able to meet their legal obligation to provide details of the account holder linked to a given connection. As a result, the agency said, it was common for investigations to involve examining and tapping the connections of many more people than really necessary.

Around the same time, the European Commission published a letter entitled Resilience, Deterrence and Defence: Building strong cybersecurity for the EU, describing how it wanted to promote the adoption of IPv6. However, in contrast to the Commission's recently published strategy, the arguments for IPv6 presented in the letter were based not on economic considerations, but on law enforcement considerations. Ultimately, the Commission wanted to see a situation where an IP address only ever has one user, facilitating the accurate targeting of investigative activities by the police and security services. The Commission planned to pursue that aim through procurement policy, research and project funding. Member states would also be required to negotiate (non-mandatory) covenants with their access providers.

Where the European internet infrastructure was concerned, IPv6 was at that time part of the ISA2 programme (Interoperability solutions for public administrations, businesses and citizens). Action point 10.9 involved the development of an IPv6 framework for European governments. However, IPv6 doesn't currently feature in the programme that superseded ISA2, Interoperable Europe.

Law enforcement and compliance

Here in the Netherlands, in 2019 the Ministry of Justice and Security's Research and Documentation Centre (WODC) published the findings of research into the identification of individual IP address users for the purposes of criminal investigation and prosecution (as provided for in the Telecommunications Data Retention Act). Again, the general adoption of IPv6 was recommended as the most obvious solution.

Although end users sometimes voice privacy-based objections to the use of IPv6 – on the grounds that CGNAT unintentionally provides a degree of anonymity not dissimilar to the use of a VPN provider – the authors of the WODC report argue that IPv6 actually enhances privacy. The rationale being that criminal investigations can be targeted better, without large numbers of innocent users falling within their scope. Moreover, aside from the technical and commercial considerations, it is much easier for access providers to fulfil their compliance responsibilities with IPv6 than with IPv4 plus CGNAT.