[anti-abuse-wg] WHOIS (AS204224)

In message <m2wptsfv20.wl-Niall.oReilly at ucd.ie>, 
"Niall O'Reilly" <niall.oreilly at ucd.ie> wrote:

>On Sat, 07 Nov 2015 23:24:48 +0000,
>Ronald F. Guilmette wrote:
>>=20
>> However in lieu of that, I feel compelled to (re-)assert that
>> which seems self-evident, i.e. that RIPE is indeed a third-party
>> beneficiary within all LIR/end-user contracts, and that it is
>> explicitly named as such therein.
>
>  If you're prepared to assert that, I expect you to be prepared also
>  to identify what benefit or advantage you understand RIPE (or, as I
>  guess you probably meant, the RIPE NCC) draws from any of these
>  contracts.
>
>  Can you do this?  Will you?

I will try.  You can judge the merits of my effort for yourself.

The one and only thing that I feel that I know for sure about contract
law is something that I freely admit I learned only from the classic
1973 movie "The Paper Chase", i.e. that a contract is not a contract
unless both (or all) parties receive some "consideration", i.e.
something in return for what they are given.

In short, you make an excellent point.  This is, as I understand it,
a bedrock principal of contract law, i.e. that each "party" to a
contract receives some form of "consideration".  (Note however
that there do seem to be some notable exceptions to this general
rule in at least some jurisdictions, e.g. the English "Contracts
Act of 1999".  See also "Beswick v Beswick".)

In the case of RIPE (and, by implication, RIPE NCC) and these contracts
that have been entered into by LIRs and various end-users, the
considerations which RIPE is granted under the terms of these contracts
include, at the very least, the right to store and publish WHOIS data.

This may to some seem like an insignificant (in legal terms "de minimis")
and/or inconsequential right, however I would point out that various
companies all over the world (e.g. phone book companies) make a good
living publishing similar sorts of information.  If anyone wished to
seriously assert that RIPE is _not_ a party to these contracts, e.g.
because of RIPE's de minimis grant of rights relative to the end-users,
then that personal or company would need to attempt to do so in a court
of law.  Someone else (i.e. not me) already offered the observation
in this thread that to date, noone has done so.

Above and beyond the consideration of storage, perusal, and publishing
rights to the end-user's WHOIS information, I do suspect that many,
most, or all of these end-user agreement also contain language which,
either implicitly or expressely, grants RIPE the right to "take back"
all relevant number resources when certain conditions apply, including
but not limited to cases where the contractual relations between the
relevant LIR and RIPE have been terminated for good cause.  This is yet
a second sort of consideration which these LIR/end-user agreements
grant to the explicitly named third party, RIPE.

In short, although there may be, and may have been, over the past many
years, diligent efforts of the part of all concerned (including RIPE,
the LIRs, and the end-users) to attempt to frame LIR/contract language
which might in some way insulate end-users from having an explicit
contractual relationship with RIPE, I, for one, harbor serious doubts
that any of these attempts to legally dance around the obvious reality
have any actual legal merit.  RIPE receives (at least) the two kinds
of consideration I have mentioned above within all LIR/end-user contracts
and thus, despite all (vain) attempts to massage the language of these
contracts to make it apper otherwise, all of these contracts are in fact
tripartite.

(Note that even Sasha Luck, with whom I seem to be at odds regarding
every other aspect of the present discussion, appears to agree with...
or at least not be entirely dismissive of... the view that RIPE is in
fact a legal party to all of these LIR/end-user contracts.)

>  If not, then what you feel compelled to assert is no more than
>  a private hypothesis of yours, and by no means "self-evident".

While I do feel that the tripartite nature of the contracts in question
is in fact self-evident, I can only agree that my opinion on this point
is not informed by either a law degree, a "bar card" (as we say here
in this country), nor even with a personal perusal of any of the
contracts at issue.  This is why I just now proposed that the RIPE NCC
legal team be formally tasked with preparing a definitive report about
what, if anything, RIPE (or RIPE NCC) is either permitted to do, or
conversely, legally required NOT to do when it comes to either verifying
or validating end-user WHOIS contact information.  I, for one, am
perfectly prepared to defer to their judgement on these questions, and
look forward to obtaining such a report from them in writing.

Having said that, let me say also that I rather doubt that there is
anything in any of these contracts that explicitly _forbids_ RIPE (or
RIPE NCC) from making attempts to verify or validate the WHOIS data
entrusted to its care.  *I* am unambiguously *not* a party to your
contract with your LIR.  Nontheless, I would not be breaking either
any laws nor any contractual commitments if I simply called you at
the number listed in your RIPE WHOIS record.  It could be argued that
I should not do so under certain circumstances, e.g. if my intent was
to sell you some Amway products, but the last time I looked, making
a phone call was not illegal.  (If that has changed, then I didn't
get the memo, but I will be ecstatic anyway, because there are a number
of telemarketers who I would very much look forward to seeing behind
bars.)


Regards,
rfg