- anti-abuse-wg - mailman.ripe.net

AA-WG Minutes, RIPE 65
by Brian Nisbet 29 Jan '13

29 Jan '13

Colleagues, Here are the minutes of the WG session at RIPE 65. Please let Tobias or I know if you have any comments or corrections. Thanks, Brian ******************************************** Anti-Abuse Working Group Minutes – RIPE 65 Thursday, 27 September 2012, 14:00-15:30 WG co-Chairs: Brian Nisbet, Tobias Knecht Scribe: Alex le Heux Brian welcomed the audience and introduced himself and Tobias Knecht, Anti-Abuse Working Group co-Chairs. A. Administrative Matters • Welcome • Scribe, Jabber, stenography • Microphone etiquette • Approve minutes from RIPE 64 No comments on RIPE 64 minutes, declared final. Finalise agenda: https://ripe65.ripe.net/presentations/108-AA-WG_RIPE_65.pdf No changes proposed to the agenda. B. Update B1. Recent List Discussion These are all covered by the agenda. B2. CleanIT Project Update - But Klaasen The presentation is available at: https://ripe65.ripe.net/presentations/230Clean_IT_presentatie_27_09_2012.pdf Anto Veldre, Estonian Information System Authority, said it was unclear how is it possible that some club will decide on fundamental rights that must be defined by law. He said he didn’t understand prohibiting the usage of some languages, Arabic or Estonian, or how But succeeded in involving people in making such proposals But Klassen replied that he didn’t understand the question. Brian Nisbet, Anti-Abuse WG co-Chair, replied that he discussed this previously with Anto and will try to help him understand the question. He said they have some examples from brainstorming discussions and that some of them were about enforcing language use on the Internet. Some of the suggestions were on the outer edge of what this community would consider technically feasible. Brian said the question is: how did the people making such suggestions get involved and are these the bulk of the people involved. But Klaassen replied that they don't keep track of who comes up with ideas. This could come from the public or a small discussion group. These are ideas that are under consideration, they came to them and they want to have discussion about them. If it's not legally feasible, it will not get to the end stage. Daniel Karrenberg, RIPE NCC, commented that the problem he has is that on one hand, it's "just ideas", and on the other hand "you are EU". Daniel commented that what he’s hearing from the audience is “first they tried child porn, now they’re trying terrorists”. He added that there was a discussion with someone from Denmark who was explaining how he ran a grassroots thing to help people get around the filtering that has been implemented there. During the discussion someone asked if he wasn't doing something illegal. He was not, the filtering was sort of voluntarily done by the ISPs. He added that in this room, you sometimes have people from the technical community who have successfully resisted things like this in their own countries. He added that it was good But came to engage with them but taking the “it’s all informal” stance doesn’t build confidence. But Klaassen replied that it wasn’t all informal. The issue is that they want to have an open dialog. He said the project proposal states that it’s a process for having a dialogue between different stakeholders in a multi-stakeholder environment and it happens rarely. He said that they’re trying to do this with a balanced group and have an open and constructive dialogue and doesn’t see why that’s a problem. He said he understood there was a lot of misunderstanding around the blue and yellow flag, the document that says they will filter, and this will confuse people so that’s why they didn’t publish it. Arjan Kamphuis, Bits of Freedom, thanked But for coming. He commented that if he would have followed the process and all the steps would have been communicated, that would have been great. He said that many of them had seen stuff like this before, like with ACTA and patents, and that when people first get a hold of documents and get worried, they get answers like “we’re still discussing this” and then suddenly something happens and it gets locked in. This worries many people. He asked But to be proactive about communicating the dates. Arjan then commented about the text. He said he contacted some former intelligence people and got two different responses. The first was that there is no definition of “terrorism”, it could be anything. The second person said that if you took the opening piece of text and replace “Al Qaeda” with “Pentagon”, the sentence still works because the Pentagon killed a hundred times more people over the last ten years. He asked what was the problem that But was trying to solve. But replied that Arjan’s comments are not too late and not too early. He said they ask participants to comment every time they publish it. They get many comments, many useful, and they have a lot of work. It’s been like that from the beginning. He added they were not like ACTA and they have their own process. But said that terrorism websites are not weapons but support terrorists’ daily operations. They are looking for propaganda and radicalisation, that’s what they face in counter-terrorism. They use the EU’s definition in the document. They are trying to take an open approach and make the definition as clear as possible. Jim Reid said they must be careful doing things in this area with the processes in place. Everyone agrees that something needs to be done but wondered how the processes are used on a daily basis. He said there was a concern about mission creep and that noble things like counter-terrorism laws can be deliberately used for other things when the scope and boundary conditions are not clearly laid out. But replied that it was about trust and whether you could trust the government. Jim replied that it’s party about trust, but wondered where the audits and controls were. But said he wanted to change the public image of trust in the government but he can’t. He said that they needed to gain more trust to do the project as openly as they can and publish every two months. Alexander Isavnin, ZAO NetLine, wondered how many terrorism acts have been prevented in the Netherlands. He said he was from a country that But didn’t think was open and free and he was glad to see that slide because it shows an example of counter-terrorism in Russia. He said some students were jailed for preparing a terrorist act against Putin and they were caught on a forum on the Internet. They did make an explosive device. Interestingly, the person pushing them to do it and showing them how was never found. No one believes it. He added that the tradition in Russia is for law enforcement to provoke. He added that people shouldn’t trust the counter-terrorism organisations in Europe that are trying to overrule the Internet. Arjan, XS4ALL, via chat, asked if But could list some of the participants that have been “reached out too” in the creation of the document. But replied that all partners and participants are listed on the website. Brian added that he linked to that page last week. The participants don’t state that they agree with the document. But agreed and said that the process of commitments starts after the last conference. B3. RIPE NCC Data Protection Legal Advice Update – Athina Fragkouli, RIPE NCC The presentation is available at: https://ripe65.ripe.net/presentations/274-Data_Protection_Report.pdf Athina Fragkouli Shane Kerr, ISC, commented on slide 20. He agreed it was a hard problem but wasn’t sure that MNT-BY inputs the data, but he wasn’t sure that person determines the processing. Athina replied that MNT-BY is not the "responsible party", the RIPE NCC is that by default. Denis Walker, RIPE NCC, said by definition the ABUSE-C would not be personal data, that's why they provide bulk access to it. B4. “Requesting feedback about abuse-finder widget in RIPEstat” - Christian Teuschel, RIPE NCC The presentation is available at: https://ripe65.ripe.net/presentations/272-antiabuse_info_ripe65.pdf Christian asked if it would be useful for the RIPEstat team to put more effort into the abuse contact. Three people raised their hands about abuse contact, no one raise their hand about more false positives, about five people raised their hand about more restricted, no one raised their hand about more checks like geolocation and two people raised their hand about distance in RIPE Database objects. Wilfried Woeber, UniVie, commented that the distance only gives an indication about the cluefulness about the people who put in the entries. Leo Vegoda, ICANN, said he looked through the anti-abuse stuff and popped in his private address and it said: "private address, no contact information". He said he looked at what they had in whois.iana.org, and would like to offer to work with you to offer the quality of info to the average user. Christian thanked Leo and said that the abuse widget is very new and they haven’t had much time to improve it yet. Peter Koch, DeNIC, asked for the policy for selecting blacklists. He said you register facts in the RIPE Database and here they extend it to a reputation system. He said the scrutiny is questionable and that the target audience is not qualified to judge this. He added that a line had been crossed and it made him nervous. Daniel Karrenberg replied that this was not their database: it’s RIPEstat. RIPEstat aims to get any data about a resource and present it. He said he shared Peter's concern about presenting it totally unqualified and they’re working on that. Their policy is “anything they can get”. He added that the problem is that most blacklists don't permit re-publication and showing of history. These may not be the greatest ones, but to the knowledgeable person, the current state and history is useful thing to know. He said clearly it’s not part of the registry, but part of the information services that the RIPE NCC provides. They want to put this into context for consumers that aren’t usually geeks. Christian asked the audience to send further feedback by email. Wout de Natris, a consultant, commented that what they’re seeing here is Internet governance how it should be. He advised to gather information from as many independent places as they can. He added that there are a lot of botnet centres and ISPs cooperating with that. There is a lot of data to be gathered of what is going wrong there and they’re making it visible, which is a start. B5. “Re-allocation of address blocks” – Ingrid Wijte, RIPE NCC The presentation is available at: https://ripe65.ripe.net/presentations/264-Reallocation_of_address_blocks.pdf There were no questions. B6. Operation of “Copy Shops” - Peter Forsman, .SE The presentation is available at: https://ripe65.ripe.net/presentations/73-counterfeitwebsites.pdf Daniel Karrenberg asked what the RIPE community could do to help? Peter said he couldn’t say exactly. He was just there to raise awareness because the Swedish law enforcement asked him to help find the websites that target Swedes. He said it couldn’t be done, there are new ones next week. Daniel asked why he thought that the new gTLDs made a difference. It makes no difference what the domain is, they went for the cheapest ones. Peter replied that they go through .cn ones mostly. If ICANN has a problem with registrant data today, there won't be less of a problem with the new TLDs. Daniel replied that the ones listed on his slide were GoDaddy and ENUM, not Chinese. Peter said those were examples. If they see 1,000 new TLDs in the future, the price would be lower than .com today. Daniel added that they would go for the cheapest ones and the ones that are not really good at publishing registrant data. C. Policies RIPE Policy 2011-06 Brian Nisbet announced that 2011-06 has reached consensus. He thanked the task force and Tobias who wrote the bulk of it and push it through. He said they’d speak to the RIPE NCC about implementation. Daniel commented that he loved it and asked how he proposed not having it remain wishful thinking. He added that you can mandate all sorts of things but getting people to populate it is the hard part. Brian said they’d work with the RIPE NCC on the basic information and looking at 2007-01, those are big jobs. He added that they’ve already talked about what’s next in terms of policies such as data verification. He acknowledged that people would continue to do bad things but hoped this would be a first step in creating a framework to improve that. Daniel commented that he’s detecting antagonism about the RIPE NCC doing stuff without asking the community. He added that if they had to make people do something, the community should be directly involved. The community guidance should be very clear. Brian agreed and said that he and Tobias have undertaken that work. He said he did not want the RIPE NCC to get blamed for what’s clearly a community request. D. Interactions Brian Nisbet said there haven’t been many since RIPE 64 but 2011-06 might bring up some so they’ll see what happens. D1. Working Groups D3. RIPE NCC Gov/LEA Interactions Update Brian commented that it’s been a quiet summer and that there’s a certain amount of management by exception done by the LEAs. He said that he’s spoken with Jochem de Ruig, RIPE NCC, and was informed about planned interactions with the LEAs. X. A.O.B. There were no AOBs. Z. Agenda for RIPE 66 Brian Nisbet asked the audience to email input for the RIPE 66 Anti-Abuse Working Group agenda to the mailing list, to Brian and Tobias. Brian thanked the audience and closed the session.

1 0

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 17, Issue 18
by Karl-Josef Ziegler 28 Jan '13

28 Jan '13

> Does anyone knows who is behind this domain, "proberry.de" i.e. who owns it, > and what this German text says on this message. It's a Joe Job against this domain and the owner has informed the police. Best regards, - Karl-Josef Ziegler

1 0

proberry.de
by Reza Farzan 28 Jan '13

28 Jan '13

Hello All, In recent days, I have received numerous Spamvertised messages from this domain, "proberry.de" which is hosted by (STRATO-RZG-KA). Here is a copy of the latest such messages, without its header: ----- From: Rupert Sterling <westport(a)genion.de> To: rezaf(a)mindspring.com Subject: Sicherheit im Beerenanbau Date: Jan 27, 2013 4:25 AM Die Homepage "ProBerry" ist eine branchenbezogene Informationsseite zu einem Fachthema, fur Beerenobstanbauer in der BRD: proberry.de -------- Does anyone knows who is behind this domain, "proberry.de" i.e. who owns it, and what this German text says on this message. So far, and despite my repeated complaints to STRATO-RZG-KA's Abuse Department, 'abuse(a)stratoserver.net' and 'hostmaster(a)strato.de' and 'hostmaster(a)strato-rz.de' this domain remain active, and has not been suspended. To be fair, I have copied Andreas Hartnacke, Provisioning/Hostmaster, so that he would be aware of the this matter. I appreciate any assistance that you may offer in this matter. Thank you, Reza Farzan rezaf(a)mindspring.com

1 0

Please unblock 80.71.128.0/20
by Thilo Bangert 24 Jan '13

24 Jan '13

Hi, we were, a little more than 2 years ago, allocated above subnet and have since struggeled with it, since apparently its previous owner had not treated it well. While it appears that many of the GeoIP issues have been fixed -- its surprising how many sites are out there which NEVER update their maxmind or other databases -- we still have reachability issues, especially into Israeli networks. It has been communicated to us that the past owner had notoriously attacked Israeli websites, which is why the netblok 80.71.128.0/20 had been null routed. One of the websites our customers complain about not being able to view is http://www.english.machonmeir.net/ were we cant get to the DNS server which lives at 62.219.11.42. Trying to reach someone from the other network has thus far not been fruitful. Any help in establishing communication is greatly appreciated. If you null route, could you pleae check whether you are blocking our subnet, and if so kindly reevaluate that decision. Thank you for your help. kind regards Thilo

3 4

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 17, Issue 11
by Karl-Josef Ziegler 21 Jan '13

21 Jan '13

> Thinking about it, just in the last day or two I've realized that > RIPE, ARIN, IANA, ICANN, and all such authorities are in many ways > quite analogous to our Federal Reserve here in the United States. In > both cases, the entities have much authority and are widely perceived > as having charters that somehow commit them to pursuit of the public > good. But in both cases, the reality is rather different... these > entities are in fact merely commercial associations of business > interests that are pledged, if not by law then by contract, to never > reveal even a smidgeon of their commercial member's dirty laundry to > any "outsider", and their iron-clad commitment to this goal always > takes precedence over any other consideration. I agree. The main goal of these organisations for me seems to be not protecting public goods but protecting the commercial interests of their members. So they aren't nonprofit organizations? Best regards, - Karl-Josef Ziegler

3 2

(no subject)
by Dr Michiel de Weger 15 Jan '13

15 Jan '13

2 1

(Long) rant about some LIRs in RIPE region, most likely linked to RFG's earlier email
by Vasile Capdefier 15 Jan '13

15 Jan '13

Disclaimer: this is just my POV, I didn't investigate (too) much/deep. All the information bellow is public, easy to find and Google Translate seems to work most of the times. From what I know, Jump.RO's business model is to *sell* IP space from their ALLOCATED PA ranges received from RIPE. Not *sub-allocate*, not *assign* or similar terms. They don't ask too many questions. They give you IPs faster than other LIRs. They market this as being professional. All of the Jump.RO's sub-allocations (that I've seen in whois) have *ASSIGNED PA* status, which according to ripe-553 [1] is to be used when the range is assigned to an end user for services provided by the issuing LIR. This is probably not the case because except the (new) annual fee for the registration service there are no other services provided by that LIR to the end user. Most of Jump.RO's "end users" are in fact small ISPs that can't afford the RIPE membership fees and bypass the rules of not using PI space for customers by deaggregating Jump's IP space. I don't know about the 12k number, but they have a large client base in the country and neighboring countries. I also think that Jump is aware of their IPs being in use by spammers as they advertise on their website that new and unused IP blocks cost about 2 times more than "used" ones. They also note that the previously "used" PA space is checked with "MxToolBox" in 120 anti-spam lists [2]. Even though Jump.RO's business model isn't exactly in the spirit of the RIPE region rules or following best practices (no prefix aggregation, but their excuse is that they are not the only ones doing it), I don't think that they are willing to risk their LIR status by defending known spam operations, so reporting well documented cases of false information provided during registration first to RIPE and then to them would probably get them to withdraw the PA from that customer. The ranges found by you clearly suggest that fake information has been used. Only "under construction" sites, nobody ever heard of those companies, all using same ISPs. With all this said about ro.registry (Jump.RO's LIR id) i'd like to add the following. There are entire LIRs with very large IP allocations and suspicious activities. I'll just list here a few: (RIPE allocation list publicly available here [3]) The first candidate that pops up is ro.visnet (VisNetwork Media SRL). According to their web page [4] they are a pretty large ISP with over 300 experienced employees and over 30 vehicles used for interventions and installations. They provide no CIF (Romanian for Fiscal Identification Code) or other identifying information, but the company is valid and has CIF 25083281. According to the Romanian Trade Register [5], the company named VisNetwork Media SRL with Fiscal Identification Code 25083281 is registered since February 2009, has no employees (where did those 300 professionals go?) and has registered for the 2011 fiscal year expenses of roughly about 3000 EUR (this value is around the value of the RIPE maintenance fees) and an amazing income of 100 EUR. Also, they are not registerd with ANCOM [6] (Romanian National Agency for Management and Regulation in Communications), so they are not a real ISP. They have received from RIPE the following IP space: 20090624 188.170.0.0/16 ALLOCATED PA 20100713 46.49.128.0/17 ALLOCATED PA 20110404 31.173.0.0/16 ALLOCATED PA 20110707 146.0.128.0/17 ALLOCATED PA 20110707 146.0.32.0/19 ALLOCATED PA 20111012 128.234.0.0/16 ALLOCATED PA 20120113 37.56.0.0/16 ALLOCATED PA 20120405 37.224.0.0/16 ALLOCATED PA 20120730 5.163.0.0/16 ALLOCATED PA 20121113 185.9.244.0/22 ALLOCATED PA 20110331 2a03:4100::/29 With this much IP space I would think they must have at least a few LARGE cities covered, but nobody ever heard of them or their professional employees. Also, because apparently their IPs were not enough and their employees seem that they couldn't handle hosting their main website, their website is hosted on IP ranges from another LIR. visnet.ro has address 77.36.59.10 inetnum: 77.36.59.0 - 77.36.59.255 netname: ROSITE-EQUIPMENTS The second obvious candidate for our small investigation is, as you might have guessed, ro.rosite (RoSite Equipment SRL). Information about their deaggregation habits can be found here [7]. According to the Trade Register, ROSITE EQUIPMENT SRL has CIF 17352052 and is a registered company since march 2005. They are registered as an ISP at ANCOM, but with a different company name (ROSITE NET SRL). Their second company, the one registered as an ISP, ROSITE NET SRL has CIF 13669105 and is a registered company since january 2001. The larger company, not the ISP, received from RIPE a large number of IP addresses: 20090706 188.119.128.0/18 ALLOCATED PA 20090813 188.74.128.0/18 ALLOCATED PA 20091223 188.74.192.0/18 ALLOCATED PA 20100325 62.216.64.0/19 ALLOCATED PA 20100628 178.157.64.0/18 ALLOCATED PA 20110712 146.158.128.0/17 ALLOCATED PA 20110712 146.66.208.0/20 ALLOCATED PA 20120105 37.35.128.0/17 ALLOCATED PA 20120105 37.35.32.0/19 ALLOCATED PA 20120724 5.157.128.0/17 ALLOCATED PA 20101217 2a03:8800::/32 On the third place in our list we have ro.swift (now Media Trend Sistem SRL, formerly using the company Swift Marketing SRL). Swift Marketing SRL (nice name, huh?) was deleted from the Trade Registry in may 2011. During 2010 they had 0 employees. The new company, Media Trend Sistem SRL (CIF 26301830) is registered since december 2009 and was known under another name (not publicly available) until changing it's name to the current one in december 2010. They are also not registered as an ISP with ANCOM and had 0 employees in 2011. This didn't seem to stop them from receiving the following IP ranges from RIPE: 20070730 78.95.0.0/16 ALLOCATED PA 20080319 93.168.0.0/15 ALLOCATED PA 20090303 95.218.0.0/15 ALLOCATED PA 20110518 2a00:aa80::/32 Another interesting Romanian LIR is ro.ssnet (SISTEM SOFT NETWORK SRL). The company is registered with the Trade Register with CIF 24496484 since september 2008, had in 2011 only 1 employee and is not a registered ISP with ANCOM. They became LIR just a few months before the final /8 was reached in RIPE region. They only got from RIPE this /15: 20120719 5.154.0.0/15 ALLOCATED PA They also seem to like deaggregating very much [8], now originating 369 prefixes. Now with all this in sight I suppose the ro.registry issue of about an /14 block seems a rather small issue. [1] https://www.ripe.net/ripe/docs/ripe-553 [2] http://www.ip.ro/ip.html [3] ftp://ftp.ripe.net/pub/stats/ripencc/membership/alloclist.txt [4] http://www.visnet.ro/despre/ [5] http://www.mfinante.ro/agenticod.html [6] http://www.ancom.org.ro/furnizoricomunicatii-electronice_133 [7] http://bgp.he.net/AS49687#_prefixes [8] http://bgp.he.net/AS56465#_prefixes

3 2

hosting with anonymous whois
by Karl-Josef Ziegler 14 Jan '13

14 Jan '13

Hello! Today I go a spam for pillz (CAPRXPHARMACY.RU) 'hosted' at IP 84.22.104.117. This IP is of course listed at Spamhaus: http://www.spamhaus.org/sbl/query/SBL99505 http://www.spamhaus.org/sbl/query/SBL99505 and this 'hoster' has a very long list (118 entries) at Spamhaus: http://www.spamhaus.org/sbl/listings/cb3rob.net and is on place no. 1 at Spamhaus: http://www.spamhaus.org/statistics/networks/ Whois says: address: Customer did not enter their own contact details yet A research says: Ministry of Telecommunications, One CyberBunker Avenue CB-10000 CyberBunker-1 Republic CyberBunker C/O CB3ROB LLTC. Company reg. #8 CyberBunker trade register. One CyberBunker Avenue CB-10000 CyberBunker-1 Republic CyberBunker So is it really possible to get an IP block with anonymous whois entries at RIPE? Best regards, - Karl-Josef Ziegler

3 2

Update - RIPE Database Proxy Service Issues
by Axel Pawlik 04 Jan '13

04 Jan '13

[Apologies for duplicate emails] Dear colleagues, Thank you for your comments on this issue. I would like to point out that the *DRAFT* Activity Plan and Budget is published around September of each year, allowing members ample time to read it before it is discussed at the Autumn General Meeting. The RIPE NCC Executive Board then takes the outcome of the discussions and any new developments into consideration before finalising and approving the definitive Activity Plan and Budget, which is then published before the end of the year. On 13 December 2012, we informed the membership of the definitive Activity Plan and Budget and listed the changes from the draft plan. Please note that the membership does not vote on either the draft or the final Activity Plan and Budget - this is one of the member-elected Executive Board's functions. One of the modifications that took place from the draft to the final Activity Plan was the addition of the RIPE Database Proxy Service as a member-only service. This was a follow-up on an action point that stemmed from the Data Protection Task Force and a need to strengthen our contractual relationship between the current users of the RIPE Database Proxy Service and the RIPE NCC ensuring compliance with Dutch and EU legislation. Partially based on the membership's vote of approval regarding the new Charging Scheme of "one LIR, one fee" and partially based on the fact that the RIPE Database Proxy Service is only actively used by less than a handful of entities (both members and non-members), the Executive Board made the decision, which they felt was in the members' interest, to ask the users of this service to sign both a specific RIPE Database Proxy Service Agreement and the Standard Service Agreement (Membership Agreement) that adheres to both EU and Dutch legislation, which would entail the users of this service paying the annual membership fee. Based on the recent mailing list discussions it seems apparent that this is a contentious issue that requires further membership and community discussion. Therefore, we will keep the RIPE Database Proxy Service running as it was in 2012 (i.e., no fee and no Membership Agreement) until we have completed these discussions. We will prepare a legal analysis of the options at hand for the contractual documentation required to use this service and gauge whether or not the membership feels that we should charge a fee for this service. Regards, Axel Pawlik Managing Director RIPE NCC

1 0

RIPE Database Proxy Service Issues
by Axel Pawlik 03 Jan '13

03 Jan '13

[Apologies for duplicate emails] Dear colleagues, There has been discussion on various mailing lists regarding the status of the RIPE Database Proxy Service. Before I address the issues that arose, I'd like to give you some background information on the service itself that may help with the discussions. Technical Background -------------------- To prevent the automatic harvesting of personal information (real names, email addresses, phone numbers) from the RIPE Database, there are PERSON and ROLE object query limits defined in the RIPE Database Acceptable Use Policy. This is set at 1,000 PERSON or ROLE objects per IP address per day. Queries that result in more than 1,000 objects with personal data being returned result in that IP address being blocked from carrying out queries for that day. Users of the RIPE Database have unlimited access to Network Information Centre (NIC)-related objects. They can use the -r flag in order to filter out personal objects and query NIC objects without any limitations. The RIPE Database Proxy Service allows websites to provide a third party interface to the RIPE Database. Without the proxy service, the third parties would quickly run into the limits set on RIPE Database queries. With the proxy service, we whitelist the third party IP address and ask them to pass their user's IP address to us, so limits are only set on the user's IP address, not the third party's. There is no technical way to ensure that the user IP addresses passed to us by the third party are valid. Potentially, third party users of the proxy service could harvest all personal data in the RIPE Database (approximately 2 million objects) in a matter of hours. To ensure that the RIPE NCC's Terms and Conditions are followed, we require a contract between the third party and the RIPE NCC. Users of the Proxy Service -------------------------- In the past ten years, the RIPE NCC has had 31 requests for the proxy service and over the past year, there have been only four active users of the service. Of these four, one is already a RIPE NCC member. NIC Information --------------- All NIC information is still available without access to the proxy service. In the normal presentation of whois data, there is a redirect system that allows users with a normal whois client to deal directly with the RIPE Database whois service. There is no need for a proxy service in this scenario. The proxy service is only necessary if the data needs to be presented in alternative forms, such as on a third party's website. The limits imposed on RIPE Database queries only apply to personal data. Users can always access NIC data in any form they like if they are happy not to receive personal data. On 6 March 2012, the RIPE NCC proposed to change the default behaviour of the query system to instead return only "ALLOWED" results if a user had reached their daily personal data query limit, but there was disagreement over this on the mailing list so the change was not implemented. The proposal is available at: http://www.ripe.net/ripe/mail/archives/db-wg/2012-March/003885.html Legal Considerations -------------------- The RIPE NCC operates under European Data Protection laws, so to avoid risk in this area we insist on having a contract with third parties who wish to use the proxy service. The RIPE NCC and its Executive Board believes that the proxy service should become a member service because it tightens the contractual relationship between the RIPE NCC and third parties. Currently, no such agreement that meets the EU Data Protection legislation is in place between the RIPE NCC and the proxy service users. In order to tighten the contractual relationship between the RIPE NCC and the Proxy service users, taking into account the recent approval of the Charging Scheme 2013 that caused a simplification of the contractual agreements between the RIPE NCC and its service users, the RIPE NCC offered to conclude the membership agreement for continuation of the service. Next Steps? ------------ The Executive Board approved changes to the draft version of the Activity Plan and Budget 2013, and the RIPE NCC published the final version on 13 December 2012: http://www.ripe.net/internet-coordination/news/announcements/ripe-ncc-activ… We do apologise, however, that the changes regarding the proxy service were not more explicitly communicated to the members and the RIPE community in advance of the final publication of the Activity Plan. The RIPE NCC asks that non-RIPE NCC member proxy service users become members but we propose to waive their membership fee until the discussion of the RIPE NCC Charging Scheme 2014 takes place. This will give the membership and community the opportunity to discuss the best way forward for the proxy service in the coming months while ensuring a strong contractual bond between the RIPE NCC and users of this service. In the meantime, there will be no changes to the proxy service and no loss of functionality for the community. The RIPE NCC and its Executive Board will return to its members with proposals for ways to ensure that their wishes are met with regard to service developments while allowing the RIPE NCC to be operate efficiently and responsively. If you have any comments on this issue, please direct them to the RIPE NCC Services Working Group mailing list <ncc-services-wg(a)ripe.net>. Best regards, Axel Pawlik Managing Director RIPE NCC

5 7