- ncc-services-wg - mailman.ripe.net

@EXT: 2018-05 New Policy Proposal (Publication of Legal Address of Internet Number Resource Holder) - updating the proposal?
by Marcolla, Sara Veronica 09 Oct '18

09 Oct '18

Hi everyone, All the comments exchanged in the list made me thinking a lot about the wording of this proposal. I have noticed that the lively discussion around the policy is bringing a lot of attention on the dichotomy between the individual (which I agree completely, should be protected in their fundamental rights, with provisions such as the GDPR and others), and the company/corporation. It seems to me so far that many of us would indeed support the idea of having the legal address published of companies, but having concerns about personal data. The aim of this proposal is indeed to focus on companies, not individuals, and even the smallest company has to be registered as such (if not for other reasons, for tax reasons). Individuals will be anyways protected by a hierarchically higher set of rules: the fundamental rights, such as those championed by GDPR for example. At this point I am asking whether you support a proposal, the clarifies that only the legal address of companies will be published, and that states clearly that individuals information will be protected? After all, the reasoning here is that if a resource holder is registered with a national company registry, they have a legal address which can be published. This legal address is usually publicly available anyhow and can be then validated by the RIPE NCC. Looking forward to hear the feedback to this idea for an amendment to the proposal. Sara ******************* DISCLAIMER : This message is sent in confidence and is only intended for the named recipient. If you receive this message by mistake, you may not use, copy, distribute or forward this message, or any part of its contents or rely upon the information contained in it. Please notify the sender immediately by e-mail and delete the relevant e-mails from any computer. This message does not constitute a commitment by Europol unless otherwise indicated. *******************

4 3

@EXT: RE: 2018-05 New Policy Proposal (Publication of Legal Address of Internet Number Resource Holder) - updating the proposal?
by Marcolla, Sara Veronica 09 Oct '18

09 Oct '18

Hi Carlos, I understand the logic behind the protection of LIRs for competition reasons - however I am positively sure that this right cannot be considered anywhere close to the right to privacy and protection of individuals. Regarding your comment on the company change, I believe that the case of change of holdership should firstly have to pass the existing RIPE NCC due diligence checks for transfers/mergers. It would then still be useful to actually have the legal address of this new company, as it helps to identify the company who is the registered resource holder. Sara -----Original Message----- From: Carlos Friaças [mailto:cfriacas@fccn.pt] Sent: 08 October 2018 23:50 To: Marcolla, Sara Veronica Cc: 'ncc-services-wg(a)ripe.net' Subject: Re: [ncc-services-wg] @EXT: 2018-05 New Policy Proposal (Publication of Legal Address of Internet Number Resource Holder) - updating the proposal? On Mon, 8 Oct 2018, Marcolla, Sara Veronica wrote: > Hi everyone, Greetings, > All the comments exchanged in the list made me thinking a lot about the > wording of this proposal. I have noticed that the lively discussion > around the policy is bringing a lot of attention on the dichotomy > between the individual (which I agree completely, should be protected > in their fundamental rights, with provisions such as the GDPR and > others), and the company/corporation. It seems to me so far that many of > us would indeed support the idea of having the legal address published > of companies, but having concerns about personal data. The aim of this > proposal is indeed to focus on companies, not individuals, and even the > smallest company has to be registered as such (if not for other reasons, > for tax reasons). Individuals will be anyways protected by a > hierarchically higher set of rules: the fundamental rights, such as > those championed by GDPR for example. Well, LIR addresses are already published on the RIPE NCC's website. LIR's customers addresses may not be part of whois.ripe.net... well... i know some LIRs tend to protect their customers identity, to prevent competitors to approach them with better contractual conditions (this is not the case of the LIR i work for, which is a NREN) > At this point I am asking whether you support a proposal, the clarifies > that only the legal address of companies will be published, and that > states clearly that individuals information will be protected? After > all, the reasoning here is that if a resource holder is registered with > a national company registry, they have a legal address which can be > published. This legal address is usually publicly available anyhow and > can be then validated by the RIPE NCC. I see added value in "validation by the RIPE NCC", despite the natural cost this will bring... However, i wonder what should be the procedure if RIPE NCC finds that company X registers a new company Y in a different country/economy resorting to a "virtual office" address. > Looking forward to hear the feedback to this idea for an amendment to the proposal. Good luck! Best Regards, Carlos > Sara > ******************* > > DISCLAIMER : This message is sent in confidence and is only intended for the named recipient. If you receive this message by mistake, you may not use, copy, distribute or forward this message, or any part of its contents or rely upon the information contained in it. > Please notify the sender immediately by e-mail and delete the relevant e-mails from any computer. This message does not constitute a commitment by Europol unless otherwise indicated. > > ******************* > > ******************* DISCLAIMER : This message is sent in confidence and is only intended for the named recipient. If you receive this message by mistake, you may not use, copy, distribute or forward this message, or any part of its contents or rely upon the information contained in it. Please notify the sender immediately by e-mail and delete the relevant e-mails from any computer. This message does not constitute a commitment by Europol unless otherwise indicated. *******************

1 0

@EXT: RE: 2018-05 New Policy Proposal (Publication of Legal Address of Internet Number Resource Holder)
by Marcolla, Sara Veronica 01 Oct '18

01 Oct '18

Hi Nik, I think the car analogy would work better in assuming that if the car is a "company car" and not a private vehicle, then the identity should be publicly available. We are not talking of individual rights, but. For instance a lawyer's business address (or a dentist and so on) is publicly available - on registries, online, basically everywhere, however their home address not, and this without being a threat to a privacy, or individual rights. Does it make sense to you? Kind regards, Sara Veronica -----Original Message----- From: ncc-services-wg [mailto:ncc-services-wg-bounces@ripe.net] On Behalf Of Nik Soggia Sent: 28 September 2018 19:04 To: ncc-services-wg(a)ripe.net Subject: Re: [ncc-services-wg] 2018-05 New Policy Proposal (Publication of Legal Address of Internet Number Resource Holder) Il 28/09/18 17:36, Jeffrey Race ha scritto: >> There must be a way to register the IP addresses to my company (that has >> much less privacy rights than me), still preserving my personal rights. > > If you use a public resource your identity should be publicly available :) Would it be ok for you to write your name and address on the windshield of your car whenever you park it in a public street? Isn't the number plate plenty enough? Yes, to know where you live will require an additional step, and yes, choosing who can access your data and who can't is the very foundation of privacy. In this example cops are ok, passers-by meh... My point is that sole proprietorships may become backdoors to sensitive data. Big companies are not required to register the home address of their legal representative, so why should small ones? Let's just find a mechanism to preserve personal data from becoming public domain. Regards, -- Nik Soggia - TELNET S.r.l. Phone: +39-0382-529751 Via Buozzi, 5 - 27100 Pavia, Italy Fax: +39-0382-528074 ******************* DISCLAIMER : This message is sent in confidence and is only intended for the named recipient. If you receive this message by mistake, you may not use, copy, distribute or forward this message, or any part of its contents or rely upon the information contained in it. Please notify the sender immediately by e-mail and delete the relevant e-mails from any computer. This message does not constitute a commitment by Europol unless otherwise indicated. *******************

3 2

Re: [ncc-services-wg] 2018-05 New Policy Proposal (Publication of Legal Address of Internet Number Resource Holder)
by Nik Soggia 28 Sep '18

28 Sep '18

Il 28/09/18 17:36, Jeffrey Race ha scritto: >> There must be a way to register the IP addresses to my company (that has >> much less privacy rights than me), still preserving my personal rights. > > If you use a public resource your identity should be publicly available :) Would it be ok for you to write your name and address on the windshield of your car whenever you park it in a public street? Isn't the number plate plenty enough? Yes, to know where you live will require an additional step, and yes, choosing who can access your data and who can't is the very foundation of privacy. In this example cops are ok, passers-by meh... My point is that sole proprietorships may become backdoors to sensitive data. Big companies are not required to register the home address of their legal representative, so why should small ones? Let's just find a mechanism to preserve personal data from becoming public domain. Regards, -- Nik Soggia - TELNET S.r.l. Phone: +39-0382-529751 Via Buozzi, 5 - 27100 Pavia, Italy Fax: +39-0382-528074

1 0

VIOLENT OPPOSITION to 2018-05 New Policy Proposal (Publication of Legal Address of Internet Number Resource Holder)
by Peter Hessler 28 Sep '18

28 Sep '18

This will give dangerous details to various violent groups, such as G*mergate, St*rmfr*nt, police officers, "copy""right" "owners", as well as stalkers and people who wish to commit violence against us. If the cops want my home address: get a warrent. Strong strong strong opposition to this.

3 2

Re: [ncc-services-wg] 2018-05 New Policy Proposal (Publication of Legal Address of Internet Number Resource Holder)
by Nik Soggia 28 Sep '18

28 Sep '18

I am one of the thousands of sole proprietorship, and my billing address is also my home address. There must be a way to register the IP addresses to my company (that has much less privacy rights than me), still preserving my personal rights. Big data can correlate ip addresses and companies just using VAT numbers or chamber of commerce registration numbers. Authorities have no trouble obtaining addresses, and people in bad faith can still provide fake addresses. I'm against this backdoor^H^H^H^H^H^H^H^H policy. Regards,

1 0

Re: [ncc-services-wg] [anti-abuse-wg] RIPE Policy Proposal 2018-05 Aims to Publish Legal Address Information
by Carlos Friaças 28 Sep '18

28 Sep '18

Greetings, While this proposal can benefit from some tweaks, i believe it is a step in the right direction, in terms of transparency and the (partial?) cleanup of bogus data in the RIPEdb, thus i support this proposal. I also think that all the impact assessments triggered by this proposal will be very interesting. Best Regards, Carlos On Thu, 27 Sep 2018, Marco Schmidt wrote: > Dear colleagues, > > We just published the RIPE Policy proposal, 2018-05, "Publication of Legal Address of Internet Number Resource Holder", to the RIPE NCC Services Group mailing list. > > The goal of the proposal is for the RIPE NCC to publish the validated legal address information of holders of Internet number resources. > > As the publishing of such data will likely have relevance in fighting abuse, we want to notify the Anti-Abuse Working Group. > > You can find the full proposal at: > https://www.ripe.net/participate/policies/proposals/2018-05 > > We encourage you to review this proposal and send your comments to <ncc-services-wg(a)ripe.net> before 26 October 2018. > > Kind regards, > > Marco Schmidt > Policy Officer > RIPE NCC > > Sent via RIPE Forum -- https://www.ripe.net/participate/mail/forum >

1 0

Re: [ncc-services-wg] 2018-05 New Policy Proposal (Publication of Legal Address of Internet Number Resource Holder)
by Sascha Luck [ml] 28 Sep '18

28 Sep '18

All, On Thu, Sep 27, 2018 at 03:10:46PM +0200, Marco Schmidt wrote: > Dear colleagues, > A new RIPE Policy proposal, 2018-05, "Publication of Legal +Address of > Internet Number Resource Holder", is now available for +discussion. I really wish these announcements included the text of the proposal to make it easier to address it without having to copy&paste the meat of the proposal into the response. as for the proposal: - this proposal ignores completely the fact that not all resource holders are companies. - publishing the "legal" address details of natural persons likely conflicts with the GDPR for the EU and quite possibly with national data protection regs in the non-EU service region. - The "legal registered address" of a company will only rarely have anything to do with the location of their network management. In fact it often is no more than a lawyer's or accountant's office. This is even more true where a business has many locations for network administration. I'll address arguments as they pertain to legal persons exclusively below as I think the civil rights of *natural* +persons override any and all arguments you could make here. specific arguments: > To make it more difficult for malicious actors to hijack block +of > IP addresses and therefore play a preventive role in protecting > the community against malicious actors; Please provide reasoning how this would be achieved. I see no logical route to this assertion. > Assisting businesses, consumer groups, healthcare organizations > and other organisations combating fraud (some of which have > mandates to electronically save records) to comply with +relevant > legal and public safety safeguards; Please provide exactly which legal requirements and public safeguards require a central, PUBLIC, database of all resource holder address details. > Competent authorities to serve legal process to the party > responsible for the resources; Competent authorities already have a route to this information via the RIPE NCC or via national companies' reg offices. > To reduce delays in serving legal process, avoiding lost leads > and evidence. "Delays" such as having to procure a warrant for this data or having to look a business up in the national companies' office databases? > The RIPE Database is made for technical troubleshooting and not > for legal purposes. > Counter-argument: In the wake of large-scale cyber incidents, > there is a strong need to enhance cross-border cooperation > related to preparedness. Responding to cybersecurity incidents > may take many forms, ranging from identifying technical +measures > which may entail two or more entities jointly investigating the > technical causes of the incident (e.g. malware analysis) or > identifying ways through which organisations may assess whether > they have been affected (e.g. indicators of compromise), to > operational decisions on applying such measures and, +ultimately, > to be able to reach out across different jurisdictions in a +fast > fashion. Every national registry has different rules, languages > and formats. The availability of the data clustered in one DB > with one format will help for troubleshooting. Again, I cannot see the logic behind the assertion that a PUBLIC database of legal registered company addresses, insofar as it doesn't already exist in most jurisdictions, solves any problem related to technical troubleshooting. I'm sure in only the tiniest minority of cases will the lawyer or company secretary this address points to be able to, or even know whom to ask for, help with technical troubleshooting. > The information will become out of date if the RIPE NCC can't > ensure current accuracy. > Counter-argument: Information is the lifeblood of organisations > such as the RIPE NCC. Impure data is like impure blood > �\200\223 +not > good for the system. The quality of data held in IT systems +will > deteriorate unless steps are taken to maintain its accuracy and > consistency. This is not an argument, it is merely a re-statement of the position that data quality is important. Also, while everyone who knows me will know that I am the last person to demand political correctness in debate; I do question the need for the language and rhetoric of "Mein Kampf" in a policy proposal. > Therefore, it is of utmost importance to keep data +qualitatively > accurate. Poor data quality can lead to organisations taking > decisions based on inaccurate or out-of-date in-formation, > potentially with expensive consequences. see above, not an argument, just restatement. > The achievements don't justify the needed efforts/costs. > Counter-argument: Network and information systems and services > play a vital role in society. Their reliability and security +are > essential to economic and societal activities and in particular > to the functioning of modern societies and economies. A culture > of security is being shared across sectors which are vital for > our economy and society and will have to comply with the +security > and notification requirements being discussed in the RIPE NCC > service region. Again, the "counter-argument" is a boiler-plate politcal +statement and does not address the the effort/cost argument against. For the avoidance of doubt, the above constitutes opposition to this proposal. Kind Regards, Sascha Luck > We encourage you to review this proposal and send your comments +to > <ncc-services-wg(a)ripe.net> before 26 October 2018. Hereby done.

2 1

Re: [ncc-services-wg] [policy-announce] 2018-05 New Policy Proposal (Publication of Legal Address of Internet Number Resource Holder)
by Jonathan Leroy - Inikup 27 Sep '18

27 Sep '18

Le jeu. 27 sept. 2018 à 15:09, Marco Schmidt <mschmidt(a)ripe.net> a écrit : > A new RIPE Policy proposal, 2018-05, "Publication of Legal Address of > Internet Number Resource Holder", is now available for discussion. > > The goal of the proposal is for the RIPE NCC to publish the validated > legal address information of holders of Internet number resources. > > You can find the full proposal at: > https://www.ripe.net/participate/policies/proposals/2018-05 Is the goal of this proposal to force ressources holders to publish a postal address matching the one specified in public records (e.g. registry of commerce), or to make the RIPE NCC validate the postal address submitted by the ressource holder (by sending a postal mail)? -- Jonathan Leroy

1 0

Draft Agenda RIPE77 - NCC Services Working Group
by Bijal Sanghani 26 Sep '18

26 Sep '18

Dear all, Below and shortly online you can find the NCC Services working group draft agenda, any additions or comments please let us know. Best regards, NCC Services working group chairs === Date: Wednesday 17 October 2018 Time: 16.00 - 17.45 Chair: Kurtis Lindqvist Co-Chair: Bijal Sanghani A. Administrative Matters (5 minutes) Welcome Select a scribe Finalise agenda Approve minutes from RIPE 76 https://www.ripe.net/participate/ripe/wg/services/minutes/ripe-ncc-services… <https://www.ripe.net/participate/ripe/wg/services/minutes/ripe-69-ripe-ncc-…> B. RIPE NCC Update Axel Pawlik, RIPE NCC (20 minutes) C. RIPE Community Project Fund TBC, RIPE NCC (20 minutes) D. RIPE NCC Operational Update Felipe Victolla Silveira, RIPE NCC (20 minutes) E. Training Services Credentialing Initiative Rumy Kanis, RIPE NCC (20 minutes) F. Policy Proposal - Publication of Legal Address of Internet Number Resource Holders Sara Veronica Marcolla, Europol (15 minutes) G. Open Microphone Session (5 minutes) Z. Closing

1 0