<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body>
<div dir="ltr">
<div></div>
<div style="">
<div dir="ltr">Registered companies have in the past been LLCs or the local country equivalent and in some cases, using the id of random people paid a few euro to allow their name to appear in LLC paperwork, if I remember right.</div>
<div dir="ltr"><br>
</div>
<div dir="ltr">The same thing is quite likely for “natural person” to be “some old drunk I met in a bar who handed over his ID to be used for registering ripe resources”</div>
<div id="ms-outlook-mobile-signature">
<div><br>
</div>
<div style="direction:ltr">--srs</div>
</div>
</div>
</div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> anti-abuse-wg <anti-abuse-wg-bounces@ripe.net> on behalf of denis walker <ripedenis@gmail.com><br>
<b>Sent:</b> Tuesday, June 7, 2022 12:19:43 AM<br>
<b>To:</b> Richard Clayton <richard@highwayman.com><br>
<b>Cc:</b> anti-abuse-wg <anti-abuse-wg@ripe.net><br>
<b>Subject:</b> Re: [anti-abuse-wg] personal data in the RIPE Database</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">On Mon, 6 Jun 2022 at 19:27, Richard Clayton <richard@highwayman.com> wrote:<br>
><br>
> In message <CAKvLzuGDaye7RTgCbS=Y29aDpNViTaZs+9Xpe72yo-<br>
> jGZDA5xw@mail.gmail.com>, denis walker <ripedenis@gmail.com> writes<br>
><br>
> >On Mon, 6 Jun 2022 at 17:57, Suresh Ramasubramanian <ops.lists@gmail.com> wrote:<br>
> >><br>
> >> Always a useful thing to do if you want to block all resources held by a<br>
> >single actor or set of actors.<br>
> ><br>
> >So are you saying that you DO use the ORGANISATION object address to<br>
> >match resources held by different members at the same location? If so<br>
> >there are technical ways to offer that functionality within the<br>
> >database without exposing the full address of natural person members.<br>
><br>
> you're about to suggest hashing ... that doesn't provide what is needed<br>
> because it is far too fragile to be useful given that WHOIS entries are<br>
> not canonicalised and also contain minor errors<br>
<br>
I had something similar in mind.<br>
<br>
><br>
> you can find countless examples of typos, old addresses etc within the<br>
> RIPE data. For a contemporary example check for inconsistent use of<br>
> Kiev/Kyiv for resources held by exactly the same person/organistion.<br>
<br>
OK lets narrow it down a bit. The address of a registered business<br>
will still be publicly available in the database. So if someone has<br>
registered multiple businesses at the same address this data will<br>
still be available, even with any spelling mistakes.<br>
<br>
What we are talking about are the resource holders who are natural<br>
persons. When these people apply to be a member I am sure the RIPE NCC<br>
requires proof of identity and proof of address. (They will correct me<br>
if I am wrong.) So unless a group of natural persons are all living at<br>
the same address and all provide proof of that, then you are not going<br>
to get this address correlation anyway. If a group of natural persons<br>
are all operating from a common commercial address, not a personal<br>
address, then the address will still be publicly available in the<br>
database.<br>
<br>
The only resource holder's addresses that will be restricted are for<br>
natural persons who are operating from their home address. Those<br>
addresses are likely to be unique in the database.<br>
<br>
I will give a balanced argument and point out that there is a<br>
downside. RIPE policy allows multiple LIRs. So a natural person<br>
operating from their home address can become a Member and then set up<br>
multiple LIR accounts. Each of these accounts will be linked to<br>
separate ORGANISATION objects with the same address. Because it is a<br>
natural person and their home address, that address will have<br>
restricted access. Each of these LIRs can get separate, distinct<br>
allocations and the address link between these allocations is lost<br>
publicly. This can be fixed if we modify address policy, requiring the<br>
RIPE NCC to publicly identify the link between multiple LIRs with the<br>
same owner. Relying on the address as the main link between multiple<br>
LIRs is not perfect anyway. A Member may be able to set up multiple<br>
LIR accounts with different addresses. Having an official link would<br>
be far more reliable.<br>
<br>
The bottom line is that there are honest, law abiding people who are,<br>
or would like to be, resource holders but are exposed to considerable<br>
personal danger by making their name and address public. We must take<br>
the personal privacy issue seriously. If this creates problems in<br>
other areas we need to find solutions to those problems.<br>
<br>
cheers<br>
denis<br>
proposal author<br>
<br>
<br>
<br>
<br>
><br>
> --<br>
> richard Richard Clayton<br>
><br>
> Those who would give up essential Liberty, to purchase a little temporary<br>
> Safety, deserve neither Liberty nor Safety. Benjamin Franklin 11 Nov 1755<br>
> --<br>
><br>
> To unsubscribe from this mailing list, get a password reminder, or change your subscription options, please visit:
<a href="https://mailman.ripe.net/">https://mailman.ripe.net/</a><br>
<br>
-- <br>
<br>
To unsubscribe from this mailing list, get a password reminder, or change your subscription options, please visit:
<a href="https://mailman.ripe.net/">https://mailman.ripe.net/</a><br>
</div>
</span></font></div>
</body>
</html>