[ripe-list] Confidentiality, or that lack thereof

In message <CAPfiqjaBkBc=fi32EvK1JyCd3seRxFbwVmaNX_FAx7Mz_apL_g at mail.gmail.com>
Leo Vegoda <leo at vegoda.org> wrote:

>I have always understood that the confidentiality requirement was
>intended to apply to any business information supplied to justify an
>allocation of resources...

This has been my (informal) understanding also.  And it seems altogether
reasonable.

>I understood that the goal was to assure
>the businesses operating networks that chatty staff would not gossip
>about what those businesses planned but had not announced.

Yes.  This matches my uinderstanding also, and for whatever it may be
worth let me just say that I am in complete agreement with this rationale.

I quote now from an Internet source describing a once common phrase here
in the U.S., i.e. "Does Macy's tell Gimbels?":

    The rhetorical question "Does Macy's tell Gimbels?" was a popular phrase
    used throughout the 1930s-1960s which meant that business competitors
    are not {going to} share trade secrets with one another. It comes from
    the rivalry between the large upscale New York department stores Macy's
    and Gimbels.

Obviously, -competitive- information of the kind used to request or justify
allocations of number resources is, and quite properly should be entirely
confidential.  I have no question about that.

But that sort of information... information relating to number resource
requests, allocations, or the justifications for those... are -not- the only
information that RIPE NCC holds in relation to any given member.

I refer again bullet point #2 in Section 2.2 of the RSA, which prospective
new members agree to even well before they either request or receive any
number resource allocations:

    *  A recent extract from the Commercial Trade Register or equivalent
       document proving the registration of the Member with the national
       authorities.

I am persuaded that in the specific case(s) where the prospective new member
is *not* a natural person, a document which has been provided, by a prospective
new member, to RIPE NCC and which purports to attest to the mere valid legal
existance of some such corporate non-natural entity cannot reasonably be
classified as "competitive" or "proprietary" information of a type which
would be at all likely to render unfair advantage to some real or even
hypothetical business competitors.

If I am your business competitor, and if I find out that you have incorporated
your business using the name "XYZ Widgets" in the national jurisdiction of
The Duchy of Grand Fenwick (google it) then how does my knowing those two
rather rudimantary bits of information either (a) help me or (b) hurt you?

I do not believe that it can be reasonably argued that it does either, since
your mere legal existance as a legal corporate entity does not provide me
with any notable competitive advantage.  Besides which, if you have been
honest and truthful, then this same information should be appearing also
in your public corporate "ORG" WHOIS record anyway, right?

So, may we agree that there exists "sensitive" competitive information, of the
kind that might be submitted as part of a justification for number resources,
and which must be held in confidence by RIPE NCC, and that there is also 
an additional and separate category of "non-sensitive" non-competitive
information which NCC is -not- obliged to hold in confidence, especially as
it has no bearing on either requests for, or assignments of number resources?

>If you believe there is a need to add clarity, you are welcome to
>start a discussion in the Address Policy WG.

Well, I do thank you for the suggestion, but as I have been at pains to note
above, from where I am sitting this doesn't really bear on address policy
*at all*.

Yes, when a member that has been accepted as a member requests number resources
then they must submit "sensitive" information to NCC and that information must
thenceforth and forever after be held in confidence by NCC.  But what about
the corporate registration document that a prospective member must submit
even well before they even become a member, and also, by implication, well
before they are even in a position to request number resources?


Regards,
rfg