Maybe add some comments in whois output to highlight which fields in which objects are authoritative? Or if there were a page put up on https://trust.ripe.net/ which explains this in more detail? There's a lot of head-boggle going on here, even for people who are familiar with whois output. Nick -------- Forwarded Message -------- Subject: Re: [ripe-list] Re: beIN && RIPE NCC && Notorious Markets Date: Thu, 9 Oct 2025 08:11:57 +0200 From: Daniel Karrenberg <dfk@karrenberg.net> To: Nick Hilliard <nick@foobar.org> CC: Andrew Campling <andrew.campling@419.consulting>, ripe-list@ripe.net Maybe it is finally time to make it *really obvious* even to the most ignorant which RIPE DB objects are authoritative info and which are not? --- Sent from a handheld device.

On 8. Oct 2025, at 19:49, Nick Hilliard <nick@foobar.org> wrote:

Andrew Campling wrote on 06/10/2025 15:27:

...

Irrespective of any view regarding rights holders, the lack of effective KYC procedures is also a problem in combating both malicious and illegal content. For example, you may be surprised that the Internet Watch Foundation finds a large percentage of illegal CSAM images hosted within Europe (here <https://www.iwf.org.uk/annual-data-insights-report-2024/data-and-insights/geographical-hosting-domains/>) – for transparency, I’m an IWF trustee. I am not a lawyer but I understand that KYC is a requirement under the EU’s NIS2 Directive. In my view, extending effective KYC processes across the ecosystem will add friction, making the life of malicious actors more difficult.

the ripe ncc already implements kyc for its members and direct assignment resource holders. You can't get a PI assignment without validating your identity, and there are comparable processes for businesses who wish to become LIRs. These are hard-enforced. If you don't comply, your application will be rejected.

In addition to this, all LIRs are subject to a periodic Assisted Registry Check.

The BEIN letter seems to confuse data about RIPE members / direct assignees with general end users of ISPs.

The confusion may be happening because the RIPE database is a mixture of several different categories of data. Some of the data is authoritative (i.e. RIPE LIR and Direct Assignments) and some is non-authoritative (i.e. LIR assignments). A good deal of the non authoritative data is of very poor quality, but the authoritative data is all subject to RIPE KYC processes and regularly audited. Mixing these two data sets up does not benefit anyone.

It's the job of the ISP to ensure that they have KYC processes with their end users.

Nick ----- To unsubscribe from this mailing list or change your subscription options, please visit: https://mailman.ripe.net/mailman3/lists/ripe-list.ripe.net/ As we have migrated to Mailman 3, you will need to create an account with the email matching your subscription before you can change your settings. More details at: https://www.ripe.net/membership/mail/mailman-3-migration/