[db-wg] 2022-01 New Version Policy Proposal (Personal Data in the RIPE Database)

Below I respond to denis' recent points made here regarding the pending
proposal to have RIPE NCC obscure all natural person mailing addresses...
whether those natural persons desire it or not.


In message <CAKvLzuH8UJpJRVeKq5f3OfMLFGffWeoUmq+xvLdBLJ-u25ZZ=A at mail.gmail.com>
denis walker <ripedenis at gmail.com> wrote:

>If you want to 'justify' publishing the home addresses of natural
>persons in this open, public database then propose a change to the
>purposes of the database to argue a case for doing so.

I do not believe that it is in any way incumbant upon me to "justify" what
is, what has been, and what remains common practice in all regions.  Rather,
it is incumbant on those proposing a deviation from a widely-accepted system
that has served the community well for 20+ years to justify a proposed
departure from that existing norm and practice.

In short, the burden of proof is on you, not me.
 
>So you are supporting various means "to obfuscate their actual
>physical location" and then in the very next sentence complaining
>about "inaccurate garbage" in the database. Your own arguments are
>contradictory.

I am opposed to there being an -official- condoning and/or (even worse) an
official -enforcement- of deliberate obfsucation of any fields of the
WHOIS data base.  If there are the occasional rare persons who can make an
objectively supportable claim that they really need to have *both* number
resources *and* also confidentiality of their physical address,  then let
those rare persons use a P.O. box number for their physical address or else
let them apply specially and -individually- to RIPE NCC for some special
dispensation from the default norm of entirely public WHOIS data.

This is the difference in our positions.  You would have secrecy and
deliberate obfsucation be the new default and the new norm.  I would
prefer to maintain the existing and longstanding norm that obfsucation of
contact information is offically -discouraged- rather than being officially
-encouraged- (and perhaps even, as you would have it, universally -enforced-,
whether any individual affected member even wants it or not).

What gives you or anyone the right to take away a member's rights to have
their true and actual mailing address in their own public WHOIS records?
Because that is, after all, what you are proposing, right?  You have not
proposed to -ask- each affected member if they want to have their mailing
address obscured or not, correct?  You just want to impose this on -all-
natural person members, in a top-down and dictatorial fashion, whether any
given affected member likes it or not, right?

>There are contacts referenced in the database that allow contact "for
>any and all issues relating to their RIPE number resources". I doubt
>any member would like Ronald to visit them at their home to rant on
>their doorstep.

OK, so why are you limiting this proposal to only natural person members?
Are you suggesting that natural person members don't want me to visit their
actual physical location, but companies who are RIPE members do?

So now, why don't you re-submit this proposal and instead propose that *all*
mailing address information, including even the country name, be redacted
from the data base for *all* members?  Because that's obviously where you
really want to go with all this.  So let's just cut to the chase and redact
*all* mailing address inormation for *all* members.  What's good for the
goose is good for the gander also, right?  So let's just bite the bullet
and go directly to your real end goal which is to redact *all* physical
address information, from all data base records.  Makes perfect sense,
based on your logic.

And while we are at it, we might as well redact all phone numbers too,
becuse I'm sure that you can make a compelling case that no natural person
member wants to ever receive any phone calls directly from Ron Guilmette
either, any more than they would want to have me visiting their physical
address.

OK, good!  Now we are making real progress!  So you agree that we should
redact all physical address information for all members, regarding of 
whether they are natural persons or not, and likewise and based on the
exact same logic, we should redact all of the phone numbers from all
WHOIS records also, right?

Email addresses should be the next to go, obviously.  I mean who wants to
have random people emailing them anymore, here in 2022?  Because everybody
or almost everybody has a "contact us" form on their web site, right?

OK, good, so we can redact out all of the email addresses also, by your
logic.

Now we are at a point where there is so little left that we might as well
just throw the whole remaining RIPE WHOIS data base behind a paywall and
use it to generate more revenue for RIPE NCC so that annual member fees
can then be reduced accordingly.

This is the inescapable endpoint of the logic and world-view and value system
underlying your proposal.  So why waste time with half-measures?  Are you
just trying to sneak in the totality of the redactions that you really and
ultimately want by proposing them little-by-little...  a tiny step here, a
tiny cut there... until you have achieved the total annihilation of the public
data base via the political expedient of doing it slowly and via a thousand
cuts... so slowly that nobody is even going to notice what's really going on
until it is too late to do anything about it?

>> As I have said on the Anti-Abuse Working Group's mailing list, any
>> member concerned about concealing their mailing address either (a) is
>> up to no good or else (b) may easily and cheaply achieve the desired
>> goal FOR THEMSELVES by renting a cheap P.O. box.
>
>or (c) enter false data into an unverified, unchecked, mandatory field
>they don't want to fill in.

Whose fault is it that even now, the RIPE public WHOIS data base contains
boatloads of unverified garbage?  It is the community's fault, because the
community has failed to adopt any rule requiring the public WHOIS data
reflect known (to NCC) and objective reality.

You can't have it both ways.  You can't on the one hand decry, as I do,
the fact that there are no rules in place which would force public WHOIS
data to be accurate, and then in the same breath say that your "solution"
to the problem of inaccurate data is simply for NCC to stop publishing
-any- data.

No.  The way to fix the problem is to fix the problem.  

I propose, here and now, that upon reciept of any report or query, sent to
RIPE NCC, which suggests that any WHOIS record may contain invalid or
inaccurate data, that RIPE NCC should compare the data in the public WHOIS
to the bona fide documents that NCC has on file for the relevant members, and
if there is any notable discrepancy between the two, then NCC should manually
substitute into the public WHOIS record the accurate and correct information,
as obtained from NCC's own files.

(Of course, I am sure that this proposal will receive the exact same genuine,
fair, even handed, and thoughtful consideration as has every other proposal
that I have put forward here, which is to say absolutely none.  Apparently,
only RIPE WG chairs and/or close friends thereof are allowed to ssuggest or
submit any proposals in any RIPE WG, and if one isn't pals with the Right
People, then one can go pound sand.  This disgusting and blatant favoritism
is, of course, why I mostly don't waste my time in any RIPE WGs anymore.
Because what's the point?  The die has already been cast.)

The bottom line is here that your "solution" for bad published data is simply
to stop publishing the data.  This is the kind of "solution" I'd expect from
a six year old.  And this is the kind of thinking, logic, and world-view that
must -inevitably- lead to taking the whole data base offline and making
only selected excerpts of it available, and only to law enforcement, and
only when they have a warrant issued, specifically, by a Dutch court.

I say that because once you start down this road... the road of deliberately
hiding stuff because of some imagined anti-privacy boogy-man... your appetite
for ever more redactions will be insatiable and it will never be quenched
until literally evrything is secret.

This is quite clearly your vision of how things should evolve into the future.
And your political plan, quite clearly, is to just get the community to go
along with just taking many small steps, redacting more and more and more,
little by little, until the data base has effectively disappeared like some
sort of Cheshire Cat.

My vision, in contrast, is for a future where every field in the WHOIS data
bases of -all- RIRs is accurate and has been verified, where criminals and
miscreants can no longer play silly buggers by deliberately putting garbage
into their public-facing WHOIS records, and where those few and far between
natural persons, if any, who can demonstrate a -legitimate- need for -both-
number resources -and- also privacy of their physical addresses may request
the latter from NCC, which would be emmpowered to grant special dispensation
for any such cases on a case by case basis.

What else can I say?  Our values as well as our ultimate goals are quite
clearly at odds.  I just wish that my world view had at least a fighing
chance, but that's pretty clearly not going to happen.  Not in this WG
and not in this region anyway.


Regards,
rfg