<html> <head> <meta http-equiv="Content-Type" content="text/html; charset=Windows-1252"> </head> <body> <div style="/* inherit */" class="main-style-493fc80f19fbc17bcd72"> <div>I agree that it must be possible to identify people who hold resources. Not just for other network operators but also so that organizations such as law enforcement are able to do so in emergency situations where contacting RIPE could be too slow.</div> <div><br> </div> <div>It is worth noting however that there now is a relatively large number of people operating networks as a hobby outside of any business activity.</div> <div><br> </div> <div>At RIPE 84 I mentioned the possibility of publishing a name and city only and having RIPE hold the full address. This would likely be enough to unique identify a person (or at least a small number of potential people in a single city that would be few enough for law enforcement to all check out) while not publishing the full addresses of people who could be at risk for various reasons. It would also be enough information to identify multiple objects belonging to the same person, for example to block traffic from all of their networks. The full address could still be obtained from RIPE with a court order if required.</div> <br> <div class="front-signature"> <div>—</div> <div>Matthias Merkel</div> <div><img style="width: 118px; height: 14.75px;" src="https://cdn.staclar.com/logos/novecore/newlogo.png"></div> </div> </div> <img alt="Sent from Front" aria-hidden="true" style="width: 1px; height: 1px" src="https://app.frontapp.com/api/1/noauth/companies/2fa1142cccd8fdcdb954/seen/msg_yecjyoa/0/b8b029ae.gif"><br> <blockquote type="cite" class="front-blockquote">On June 3, 2022, 10:29 AM GMT+2 <a href="mailto:anti-abuse-wg@ripe.net" target="_blank" rel="noopener noreferrer"> anti-abuse-wg@ripe.net</a> wrote:<br> <br> <div id="fae_yecjyoaoqzkti">Am 31.05.22 um 15:12 schrieb denis walker: <blockquote type="cite" class="front-blockquote"><br> > Colleagues<br> ><br> > I have raised an issue on the DB WG mailing list about publishing in<br> > the database the identity of natural persons holding resources.<br> <br> Hi, this mail triggered the expected avalanche of controversial responses, which quickly devolved into name-calling, so <br> I prefer to respond to the original instead of any of the later responses.<br> <br> There are conflicting interests at work here. In your proposal, you mention the need to contact resource owners, which <br> is probably accepted by most.<br> <br> However, besides wanting to contact someone, there is a legitimate need to identify bad actors and shun them with <br> whatever means at your disposal (SpamAssassin rules, IP blocks, nullroutes, whatever). I do not want to communicate with <br> them, just as I don't want to discuss with burglars about their actions!<br> <br> So, a mere contact database (which could contain fully anonymized forwarding addresses through a "privacy provider", <br> like it's nowadays common for whois entries) would work for the purpose of contacting someone, but it does not work for <br> identifying who can be held accountable for abuse emitted from a network range.<br> <br> For resources allocated to legal entities (companies, organizations, etc.) an identification of the organization should <br> be mandatory. This does not need to include personal data on employees that happen to be responsible for network or <br> abuse issues, I'm fine with role accounts here. So in this case, no objection to eliminate personal data (which often <br> becomes stale anyway after some years).<br> <br> However, resources allocated to private persons are a bit different. I suppose very few private persons hold a /24 <br> network range, and if they do, they probably fall squarely in the area of operating a business or other publicly visible <br> enterprise under their personal name, and in many jurisdictions they are required to do so with identifying information. <br> For example, in Germany you can't even have a web page without an imprint containing the names of people responsible for <br> the content if you address the general public, and if you do business of any kind and you're not a corporation, you must <br> do so under your name.<br> <br> I suppose that RIPE operates mostly on the level of legal entities that can be identified without naming individual <br> persons. As such, it would be proper to clearly state that every database entry pertaining to a resource allocated <br> through RIPE must contain truthful and usable identifying information of the resource holder. In German, that's <br> "Ladungsfähige Anschrift" which was basically required to be an actual place of presence, but it appears that "virtual <br> office" providers have succeeded in letting their addresses count as "Ladungsfähige Anschrift". I'm not a legal expert, <br> I think this is wrong, but jurisprudence isn't always compatible with reason.<br> <br> Since RIPE isn't bound by German law, they may choose contractual wording that provides reasonable value for all parties <br> involved. If all identifying information is lost, the abusers have won, as they have with domain whois already.<br> <br> Cheers,<br> Hans-Martin<br> <br> -- <br> <br> To unsubscribe from this mailing list, get a password reminder, or change your subscription options, please visit: <a rel="noopener noreferrer" href="https://mailman.ripe.net/" target="_blank"> https://mailman.ripe.net/</a><br> </blockquote> </div> </blockquote> </body> </html>