On 13 February 2013, the RIPE NCC received the verdict that the Dutch court had deemed the RIPE NCC's case "inadmissible" and that it had been dismissed.
The RIPE NCC is now considering its options and conducting an analysis of the verdict. The RIPE NCC will communicate its findings to the membership and the RIPE community.
For further background on this story, see: Summons of the RIPE NCC Against the State of the Netherlands.
]]>The history to this case can be followed from the news articles the RIPE NCC posted about this case to keep its members informed.
RIPE NCC Blocks Registration in RIPE Registry Following Order from Dutch Police
RIPE NCC Unlocks Registration in RIPE Registry
Background information (para. 2-3)
The RIPE NCC is an association under Dutch law and its main activity is to distribute and register IP addresses. The distributed IP addresses are registered internally, in a “registration database”, and publicly, through the RIPE Database. These databases serve certain specific purposes and the unavailability of these databases would potentially impact the function of network operators or other users that rely on this data.
The Federal Bureau of Investigation (FBI) was investigating a “DNSChanger” case. The suspects had registered IP addresses with the RIPE NCC. The FBI asked the Dutch police to enforce an order issued by a US court, which would demand that the RIPE NCC take all measures to ensure that the suspect’s IP address registration was not transferred or amended. The Dutch police issued such an order based on Article 2 of the Police Act.
The RIPE NCC initially carried out the police order and immediately sought legal advice. Following from this advice the RIPE NCC is of the opinion that not obeying orders based on Art. 2 would not result in any penalties or liabilities. The prosecutor did not provide any further basis for the order and reserved his right to order the seizure of the “RIPE NCC administration”, without explaining what the “RIPE NCC administration” would include.
Because of the prosecutor’s reservation, the RIPE NCC is in a position of permanent threat. If it does not comply voluntarily with orders against its members, it is threatened of losing the “administration” of its operation.
The legal framework (para. 4)
According to international regulations, an order (a measure) that leads to the restriction of somebody’s fundamental rights, such as the right to property, to communication and the freedom to do business should be based upon a specific law and should be necessary, appropriate and proportional.
No legal basis for ordering the freezing or seizure (paras. 5, 6)
Orders based on Art. 2 of the Police law
According to the Dutch Supreme Court, not obeying orders based only on Art. 2 of the Police law creates no liability. Art. 2 of the Police law provides the legitimate means for the police to interfere if there is a legitimate reason to do so. But it does not provide by itself a legitimate reason to interfere. It is also a tool for the police to make citizens passively undergo a limited restriction of their rights. But it does not give the police the power to order citizens to actively do something. (para. 5.1)
Order to seizure
If “seizure of the RIPE NCC administration” means the seizure of the IP address registration records, such records are not capable of seizure. According to Dutch legislation, data cannot be seized.
Also, in the RIPE NCC’s case, the prosecutor does not have the power to order a seizure. The prosecutor would take this action in order to comply with what was requested by the US court. However, the US court has not asked for seizure but for the freezing of the records. Additionally, requests for cooperation coming from foreign authorities cannot go so far as to demand the seizure of property in the Netherlands. Finally, the prosecutor cannot order seizure based only on a foreign authority’s request. Such requests should be executed upon approval of a Dutch court. (para. 5.2)
Seizure can be ordered only for purposes specifically mentioned in the law. The reasons described by the FBI (to prevent transfers and changes of the records) do not correspond to any of the purposes mentioned in the law.
Furthermore, the seizure must be necessary, appropriate and proportional. If the seizure of the “RIPE NCC administration” means the seizure of the servers on which the various databases are stored, then such seizure would be a disproportional measure, given the cost the RIPE NCC would have to pay to replace them and given the disturbance that this action would (temporarily) cause to the users of the databases. It would also be an inappropriate measure because it would not lead to the desired goal (to prevent transfers and changes of the records). (para. 5.3)
Even if the prosecutor based its freezing order on the applicable provision of the Dutch law, this order would also not be appropriate. The purpose of such an order under Dutch law is to make sure there is a copy of specific data available, even if the data were later amended. Accordingly, the prosecutor cannot order the RIPE NCC to prevent any changes in the publicly available data. (para.5.4)
Finally, an order to freeze records or to seize the “RIPE NCC administration” that is not justified by any law would constitute an infringement of the fundamental rights of the RIPE NCC, its members and Internet users. (para. 6)
]]>The RIPE NCC has a well-defined and stringent procedure that it follows in all cases before a prospective LIR's membership is approved. Part of this procedure is to request legitimate company registration documents from the prospective LIR. In 2006, a member was accepted after presenting the RIPE NCC with legitimate documentation. It is impossible at that stage in the process for the RIPE NCC to determine that a company is involved in illegal activity. The member in question later proved to be a front for RBN.
Subsequent to that acceptance, as part of an audit, the RIPE NCC determined that the resources that had been allocated were being used in violation of our policies. We will work with any organisation unless it fails to follow RIPE NCC procedures or is deemed to be criminal by a Dutch court of law. Following our procedures, the RIPE NCC closed the LIR in question and reclaimed all Internet number resources in May 2008.
We have always cooperated with SOCA, and continue to work very closely with relevant criminal investigation bodies to ensure investigations can be carried out as swiftly and efficiently as possible in order to ensure best practice Internet governance is adhered to and criminal activity is identified and dealt with in the appropriate manner.
Founded in 1992, the RIPE NCC is an independent, not-for-profit membership organisation that supports the infrastructure of the Internet. The most prominent activity of the RIPE NCC is to act as a Regional Internet Registry (RIR) providing global Internet resources and related services to a current membership base of around 5,500 members in over 70 countries. These members consist mainly of Internet Service Providers (ISPs), telecommunication organisations and large corporations located in Europe, the Middle East and parts of Central Asia.
As one of the world's five RIRs, the RIPE NCC performs a range of critical functions including:
The RIPE NCC also provides a range of technical and coordination services for the Internet community. These services include the operation of K-root (one of the 13 root name servers), the Deployment of Internet Security Infrastructure (DISI) and DNS Monitoring (DNSMON).
As a result of its established position in the Internet industry, the RIPE NCC has played an important role in the World Summ