[ncc-services-wg] @EXT: RE: 2018-05 New Policy Proposal (Publication of Legal Address of Internet Number Resource Holder)

Hi Sascha,

I believe there is a bit of confusion on the scope of the proposal in relation to individuals. It is my understanding (also based on the implementation of GDPR at RIPE) that the large majority of resources is composed by companies, which are not subject to the protection of their personal data because, of course, they are not people. It is absolutely true instead that the safeguards put in place by GDPR and other national regulations will be protecting the fundamental rights of  those individuals who are in the scope of this policy. I hope to have clarified this!

Indeed, the policy is not interested in pointing to a location the network management or any technical team of any sort. The aim of this policy is to have an address where a company is registered legally, so to have a juridical location reference in all those cases where the necessity of serving a legal order or engaging in any kind of non purely technical interaction is needed.

A legally registered company is less likely to be a fraud, or criminal. Most countries publish a record of legal entities and companies that anybody can consult, and it helps citizens not to fall victims of fraudsters,

Competent authorities will be facilitated by the existence of such record as if a competent authority has to serve a legal order, or send an official letter, with this DB entry it will be easier and faster to know to which country (and to which legal system). Sending official requests cross border is not as straightforward, and having one specific address to address instead of surfing through several possible addresses is indeed a better use of everyone’s resources.

I hope to have addressed your main concerns, and that we can continue this fruitful discussion. For the political considerations you make, I believe this is not the correct forum - the mention here is to the life-saving dialysis process needed to clean up blood from toxins.

Kind regards,
Sara Marcolla

Typed with a very tiny keyboard this mistakes can occur

From: Sascha Luck [ml] <lists-ripe at c4inet.net<mailto:lists-ripe at c4inet.net>>
Date: Thursday, 27 Sep 2018, 4:29 PM
To: ncc-services-wg at ripe.net <ncc-services-wg at ripe.net<mailto:ncc-services-wg at ripe.net>>
Subject: Re: [ncc-services-wg] 2018-05 New Policy Proposal (Publication of Legal Address of Internet Number Resource Holder)


All,

On Thu, Sep 27, 2018 at 03:10:46PM +0200, Marco Schmidt wrote:
> Dear colleagues,
> A new RIPE Policy proposal, 2018-05, "Publication of Legal
+Address of
> Internet Number Resource Holder", is now available for
+discussion.

I really wish these announcements included the text of the
proposal to make it easier to address it without having to
copy&paste the meat of the proposal into the response.

as for the proposal:

- this proposal ignores completely the fact that not all
  resource holders are companies.

- publishing the "legal" address details of natural persons
  likely conflicts with the GDPR for the EU and quite possibly
with national data protection regs in the non-EU service region.

- The "legal registered address" of a company will only rarely
  have anything to do with the location of their network
management. In fact it often is no more than a lawyer's or
accountant's office. This is even more true where a business has
many locations for network administration.

I'll address arguments as they pertain to legal persons
exclusively below as I think the civil rights of *natural*
+persons
override any and all arguments you could make here.

specific arguments:

> To make it more difficult for malicious actors to hijack block
+of
> IP addresses and therefore play a preventive role in protecting
> the community against malicious actors;

Please provide reasoning how this would be achieved. I see no
logical route to this assertion.

> Assisting businesses, consumer groups, healthcare organizations
> and other organisations combating fraud (some of which have
> mandates to electronically save records) to comply with
+relevant
> legal and public safety safeguards;

Please provide exactly which legal requirements and public
safeguards require a central, PUBLIC, database of all resource
holder address details.

> Competent authorities to serve legal process to the party
> responsible for the resources;

Competent authorities already have a route to this information
via the RIPE NCC or via national companies' reg offices.

> To reduce delays in serving legal process, avoiding lost leads
> and evidence.

"Delays" such as having to procure a warrant for this data or
having to look a business up in the national companies' office
databases?

> The RIPE Database is made for technical troubleshooting and not
> for legal purposes.
> Counter-argument: In the wake of large-scale cyber incidents,
> there is a strong need to enhance cross-border cooperation
> related to preparedness. Responding to cybersecurity incidents
> may take many forms, ranging from identifying technical
+measures
> which may entail two or more entities jointly investigating the
> technical causes of the incident (e.g. malware analysis) or
> identifying ways through which organisations may assess whether
> they have been affected (e.g. indicators of compromise), to
> operational decisions on applying such measures and,
+ultimately,
> to be able to reach out across different jurisdictions in a
+fast
> fashion. Every national registry has different rules, languages
> and formats. The availability of the data clustered in one DB
> with one format will help for troubleshooting.

Again, I cannot see the logic behind the assertion that a PUBLIC
database of legal registered company addresses, insofar as it
doesn't already exist in most jurisdictions, solves any problem
related to technical troubleshooting. I'm sure in only the
tiniest minority of cases will the lawyer or company secretary
this address points to be able to, or even know whom to
ask for, help with technical troubleshooting.

> The information will become out of date if the RIPE NCC can't
> ensure current accuracy.
> Counter-argument: Information is the lifeblood of organisations
> such as the RIPE NCC. Impure data is like impure blood
> �\200\223
+not
> good for the system. The quality of data held in IT systems
+will
> deteriorate unless steps are taken to maintain its accuracy and
> consistency.

This is not an argument, it is merely a re-statement of the
position that data quality is important. Also, while everyone who
knows me will know that I am the last person to demand political
correctness in debate; I do question the need for the language
and rhetoric of "Mein Kampf" in a policy proposal.

> Therefore, it is of utmost importance to keep data
+qualitatively
> accurate.  Poor data quality can lead to organisations taking
> decisions based on inaccurate or out-of-date in-formation,
> potentially with expensive consequences.

see above, not an argument, just restatement.

> The achievements don't justify the needed efforts/costs.
> Counter-argument: Network and information systems and services
> play a vital role in society. Their reliability and security
+are
> essential to economic and societal activities and in particular
> to the functioning of modern societies and economies. A culture
> of security is being shared across sectors which are vital for
> our economy and society and will have to comply with the
+security
> and notification requirements being discussed in the RIPE NCC
> service region.

Again, the "counter-argument" is a boiler-plate politcal
+statement
and does not address the the effort/cost argument against.

For the avoidance of doubt, the above constitutes opposition to
this proposal.

Kind Regards,
Sascha Luck

> We encourage you to review this proposal and send your comments
+to
> <ncc-services-wg at ripe.net> before 26 October 2018.

Hereby done.




*******************

DISCLAIMER : This message is sent in confidence and is only intended for the named recipient. If you receive this message by mistake, you may not use, copy, distribute or forward this message, or any part of its contents or rely upon the information contained in it.
Please notify the sender immediately by e-mail and delete the relevant e-mails from any computer. This message does not constitute a commitment by Europol unless otherwise indicated.

*******************
-------------- next part --------------
An HTML attachment was scrubbed...
URL: </ripe/mail/archives/ncc-services-wg/attachments/20180927/16b4b7b3/attachment.html>