You're viewing an archived page. It is no longer being updated.
Below is a brief summary of the summons the RIPE NCC filed against the state of the Netherlands. This summary was created to provide members and other interested parties with an overview of the summons. The full summons is available only in Dutch and is available as a PDF.
The history to this case can be followed from the news articles the RIPE NCC posted about this case to keep its members informed.
RIPE NCC Blocks Registration in RIPE Registry Following Order from Dutch Police
RIPE NCC Unlocks Registration in RIPE Registry
Background information (para. 2-3)
The RIPE NCC is an association under Dutch law and its main activity is to distribute and register IP addresses. The distributed IP addresses are registered internally, in a “registration database”, and publicly, through the RIPE Database. These databases serve certain specific purposes and the unavailability of these databases would potentially impact the function of network operators or other users that rely on this data.
The Federal Bureau of Investigation (FBI) was investigating a “DNSChanger” case. The suspects had registered IP addresses with the RIPE NCC. The FBI asked the Dutch police to enforce an order issued by a US court, which would demand that the RIPE NCC take all measures to ensure that the suspect's IP address registration was not transferred or amended. The Dutch police issued such an order based on Article 2 of the Police Act.
The RIPE NCC initially carried out the police order and immediately sought legal advice. Following from this advice the RIPE NCC is of the opinion that not obeying orders based on Art. 2 would not result in any penalties or liabilities. The prosecutor did not provide any further basis for the order and reserved his right to order the seizure of the “RIPE NCC administration”, without explaining what the “RIPE NCC administration” would include.
Because of the prosecutor's reservation, the RIPE NCC is in a position of permanent threat. If it does not comply voluntarily with orders against its members, it is threatened of losing the “administration” of its operation.
The legal framework (para. 4)
According to international regulations, an order (a measure) that leads to the restriction of somebody's fundamental rights, such as the right to property, to communication and the freedom to do business should be based upon a specific law and should be necessary, appropriate and proportional.
No legal basis for ordering the freezing or seizure (paras. 5, 6)
Orders based on Art. 2 of the Police law
According to the Dutch Supreme Court, not obeying orders based only on Art. 2 of the Police law creates no liability. Art. 2 of the Police law provides the legitimate means for the police to interfere if there is a legitimate reason to do so. But it does not provide by itself a legitimate reason to interfere. It is also a tool for the police to make citizens passively undergo a limited restriction of their rights. But it does not give the police the power to order citizens to actively do something. (para. 5.1)
Order to seizure
If “seizure of the RIPE NCC administration” means the seizure of the IP address registration records, such records are not capable of seizure. According to Dutch legislation, data cannot be seized.
Also, in the RIPE NCC's case, the prosecutor does not have the power to order a seizure. The prosecutor would take this action in order to comply with what was requested by the US court. However, the US court has not asked for seizure but for the freezing of the records. Additionally, requests for cooperation coming from foreign authorities cannot go so far as to demand the seizure of property in the Netherlands. Finally, the prosecutor cannot order seizure based only on a foreign authority's request. Such requests should be executed upon approval of a Dutch court. (para. 5.2)
Seizure can be ordered only for purposes specifically mentioned in the law. The reasons described by the FBI (to prevent transfers and changes of the records) do not correspond to any of the purposes mentioned in the law.
Furthermore, the seizure must be necessary, appropriate and proportional. If the seizure of the “RIPE NCC administration” means the seizure of the servers on which the various databases are stored, then such seizure would be a disproportional measure, given the cost the RIPE NCC would have to pay to replace them and given the disturbance that this action would (temporarily) cause to the users of the databases. It would also be an inappropriate measure because it would not lead to the desired goal (to prevent transfers and changes of the records). (para. 5.3)
Even if the prosecutor based its freezing order on the applicable provision of the Dutch law, this order would also not be appropriate. The purpose of such an order under Dutch law is to make sure there is a copy of specific data available, even if the data were later amended. Accordingly, the prosecutor cannot order the RIPE NCC to prevent any changes in the publicly available data. (para.5.4)
Finally, an order to freeze records or to seize the “RIPE NCC administration” that is not justified by any law would constitute an infringement of the fundamental rights of the RIPE NCC, its members and Internet users. (para. 6)