Publication of Legal Address of Internet Number Resource Holders

Summary of Proposal

Accurate and validated information in the RIPE Database is essential to establish a trusted and transparent environment in which all network operators can operate and do business safely. It also helps with Internet troubleshooting and supports the attribution of malicious online activities.

The goal of the proposal is for the RIPE NCC to publish the validated legal postal address information of holders of Internet number resources (in addition to the other information that is already published there). The RIPE NCC already collects this legal postal address information as part of its existing processes.

While not mandatory, the proposal also recommends that LIRs publish the legal address of their customers that have administrative responsibility for Internet number resources.

Current postal address information in the RIPE Database is not validated and often refers to where the network engineers are based. This proposal fixes an issue where, for multiple reasons such as tax, costs or regulations, a company might be legally registered at one location while its engineers are in another (or even in a different country).

The publication of a validated legal address in the RIPE Database would allow anyone who needs to engage with a company for business or other purposes to check whether the company actually exists, or if the person they are engaging with is actually an authorised signatory, and would also help with other cross-border legal enquiries.

This proposal is essential for improving legal certainty, public accountability and transparency. It represents a push for greater accuracy in the database that will benefit everyone – especially those who do not have the powers guaranteed to an emissary of the state.

For members, independent resource holders, and legacy resource holders with a contractual relationship, the RIPE NCC already has company registration papers, which will usually include the legal address. It will be possible to get these legal addresses without action being required from the resource holder, though it will require some work by the RIPE NCC to go through all the paperwork manually.

The RIPE Database was developed long time ago, when only network engineers would use it to contact one another when technical issues arose. However, the world is changing and today we need to quickly identify resource holders for other purposes as well, whether it’s resolving incidents, attribution or legal issues. This is a chance for us to collectively improve the accuracy of the RIPE Database and ensure it remains useful in this changing environment.

Policy Text

New policy text

Content

1.0 Introduction
2.0 Policy Text
3.0 Attribution

1.0 Introduction

The RIPE Database is used for providing accurate registration information about Internet number resources. Providing an accurate legal address complements the accuracy of this registration information. Objects in the RIPE Database must reflect the current state of the resources they describe.

2.0 Policy Text

The RIPE NCC will publish the validated legal address of organisations which hold Internet number resources, in addition to the rest of the information already published in the RIPE Database.

This policy should also apply to legacy holders if they have a contractual relationship with the RIPE NCC or a sponsoring LIR.

It is recommended and encouraged that LIRs also publish the legal address of any customers that have administrative responsibility for Internet number resources.

3.0 Attribution

This document is developed by the RIPE community.

Rationale

a. Arguments supporting the proposal

• To make it more difficult for malicious actors to hijack block of IP addresses and therefore play a preventive role in protecting the community against malicious actors;
• Assisting businesses, consumer groups, healthcare organizations and other organisations combating fraud (some of which have mandates to electronically save records) to comply with relevant legal and public safety safeguards;
• Competent authorities to serve legal process to the party responsible for the resources;
• To reduce delays in serving legal process, avoiding lost leads and evidence.

b. Arguments opposing the proposal

• The RIPE Database is made for technical troubleshooting and not for legal purposes.
  Counter-argument: In the wake of large-scale cyber incidents, there is a strong need to enhance cross-border cooperation related to preparedness. Responding to cybersecurity incidents may take many forms, ranging from identifying technical measures which may entail two or more entities jointly investigating the technical causes of the incident (e.g. malware analysis) or identifying ways through which organisations may assess whether they have been affected (e.g. indicators of compromise), to operational decisions on applying such measures and, ultimately, to be able to reach out across different jurisdictions in a fast fashion. Every national registry has different rules, languages and formats. The availability of the data clustered in one DB with one format will help for troubleshooting.
• The information will become out of date if the RIPE NCC can't ensure current accuracy.
  Counter-argument: Information is the lifeblood of organisations such as the RIPE NCC. Impure data is like impure blood – not good for the system. The quality of data held in IT systems will deteriorate unless steps are taken to maintain its accuracy and consistency.
  Therefore, it is of utmost importance to keep data qualitatively accurate.  Poor data quality can lead to organisations taking decisions based on inaccurate or out-of-date in-formation, potentially with expensive consequences.
• The achievements don't justify the needed efforts/costs.
  Counter-argument: Network and information systems and services play a vital role in society. Their reliability and security are essential to economic and societal activities and in particular to the functioning of modern societies and economies. A culture of security is being shared across sectors which are vital for our economy and society and will have to comply with the security and notification requirements being discussed in the RIPE NCC service region.