[anti-abuse-wg] Limited access to personal data in bulk

Russ,

> -The issue of whois access is not specific to an RIR so why isn't the 
> issue elevated to the ASO so the policies are consistent across RIR's?

Any past attempts to normalize WHOIS access has failed miserably (I was
involved with at least one).

The RIR system is designed to have different policies in each region,
so this is not too surprising.

Asking for a global policy seems to mean we would have to take on all
of the WHOIS issues for every region, all at once. For example, in APNIC
they have issues about languages, character sets, and national
sovereignty regarding this kind of information that luckily we don't
have too much of in the RIPE region.

> -Why is the abuse contact fundamentally different than the other
> types of contacts as it relates to the protection of personal
> information?

I think the idea forming in people's heads is that the abuse contact
will be only corporate contact information in the future. Apparently
companies have no privacy protection in the EU. I guess maybe the USA
is the only place where companies have more rights than people instead
of fewer rights than actual human beings. ;)
 
> -Since these mailing lists and meetings are only a tiny fraction of 
> Internet users what initiatives are there to solicit opinions of
> those being affected by the decisions?   In this case spam, abuse,
> and access to the whois data is a universal issue and not limited
> within a region. 

All crime is a universal issue, yet each country has its own laws.
Indeed in many countries there are also state, county, and city laws, as
well as neighborhood ordinances, and even "house rules" for both
businesses and private homes!

Probably submitting to a global policy-making body would result in less
representation for Internet users rather than more, so I'm not so eager
to see this situation change.
 
> -Since the current restriction do little or nothing to stop
> "harvesters" from collecting the information (since they use a
> distributed system of IP's) what is the purpose of IP address
> restrictions (other than cases of DOS attacks which is obvious)?

It's designed to make it more expensive than collecting e-mail
addresses from other sources, not to make it impossible. Anyone who can
set up a distributed cloud to gather e-mail addresses from the RIPE
database could probably save money just by buying a list of spam
targets.

Cheers,

--
Shane