On Wed, Mar 28, 2012 at 11:27 PM, Florian Weimer <<a href="mailto:fw@deneb.enyo.de">fw@deneb.enyo.de</a>> wrote: <div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> Can RIPE NCC rely on the UK Register of Companies to validate requests which aim to establish a UK business as a LIR? SOCA seems to suggest that the answer is "no". This is disturbing.</blockquote></div> Incorporating an LLC with the address of record being a maildrop location, or even an empty lot, has traditionally taken you a few pounds and less than a day .. How or why should the registrar of companies be an authoritative source to declare anything except that "a registered company by that name exists"? In other words, there's absolutely no useful input into your IP justification process that validates that X is a genuine entity who actually needs a /20 for his new datacenter location, rather than to stuff it with botnet C&Cs or whatever. Now, if RIPE NCC were to get the RBN or whoever as a customer, they wouldn't know because they simply don't validate anything much of this sort at all, and even if they do set up some perfunctory validation like checking that the company presenting IP allocation paperwork is registered, that doesn't mean anything relevant. Andy Auld was probably not particularly diplomatic when he said this - but he was 100% correct. <a href="http://www.zdnet.co.uk/news/security-threats/2009/10/22/soca-russian-cyber-gang-bribed-police-39825939/">http://www.zdnet.co.uk/news/security-threats/2009/10/22/soca-russian-cyber-gang-bribed-police-39825939/</a> "RBN paid Ripe for services," said Auld. "If we were being harsh, we could say that Ripe has received criminal funds and was involved in money-laundering offences. We are not treating it that way, but you could see it like that." "....to which RIPE NCC pointed out that RBN passed a set of checklists."Our checklists include the provision of proof that a prospective LIR has the necessary legal documentation, which proves that a business is bona fide." Now, it is great that you don't like analogies about the banking industry, and don't work in the banking industry (I don't either, but what I did was to phone my bank manager and ask him what'd happen if such a situation arose). Because you see, if this had happened with our putative bank manager, he'd have been arrested for money laundering and the bank would be facing some fairly extensive audits from the banking regulator, getting its records subpoena'd by the police etc -- Suresh Ramasubramanian (<a href="mailto:ops.lists@gmail.com">ops.lists@gmail.com</a>)