Handling Requests for Information, Orders and Investigations from Law Enforcement Agencies

The RIPE NCC, in its role as a Regional Internet Registry (RIR), has a mandate to administer information relating to Internet number resources on behalf of the Internet community. In order to carry out this function, the RIPE NCC maintains both publicly available and confidential information about its members. Law Enforcement Authorities (LEAs) may have an interest in obtaining such information or intervening in the RIPE NCC's services. In such cases, the RIPE NCC strives to protect the interests of its members and will not provide any confidential or private information to LEAs without a court order or other legally enforceable order or request under Dutch law.

Additionally, part of the RIPE NCC's role is to guarantee that no other party aside from the resource holder can modify, delete or add registration information. Therefore, the RIPE NCC will deny any LEA's request to modify, delete or add registration information, or to restrict a resource holder's ability to do so, without a court order or other legally enforceable order or request under Dutch law.

When the RIPE NCC receives any such order or request, the RIPE NCC will examine it on its own merits and will inform those members it relates to, unless the order or request expressly forbids this from happening.

This document outlines the procedure the RIPE NCC will follow with regards to:

• Requests for information about individual members by LEAs
• Requests or orders by LEAs for specific action to be taken by the RIPE NCC
• Seizure of the RIPE NCC's equipment or property as part of an LEA's investigation

1. Requests for Information

The RIPE NCC distinguishes between the following two types of information:

• RIPE NCC member information that is publicly available
• RIPE NCC member information that is not publicly available, including members' personal and organisational information and any other non-public information

1.1. RIPE NCC Member Information that is Publicly Available

RIPE NCC member information that is public can always be accessed by third parties, including LEAs. Such publicly available information may be any information that is accessible through the RIPE NCC website, including information or records that are public on the RIPE Database at the time of the request.

Upon request, an LEA will be directed to this information. In cases where the provision of this information to LEAs is critical for the understanding of the public registry and RIPE NCC operations in general, this information will be given directly by the RIPE NCC to the requesting party.

1.2. RIPE NCC Member Information that is not Publicly Available

The RIPE NCC does not provide member information that is not publicly available to LEAs on a voluntary basis.

Non-publicly available member information will only be provided to LEAs, if a Dutch court order or other legally binding order is presented by a Dutch LEA.

There are other Dutch authorities with the supervisory and investigative powers to request information from the RIPE NCC (such as the Dutch Data Protection Authority, the Netherlands Competition Authority, the Independent Post and Telecommunications Authority, the Public Prosecution Department, the Police, the Fiscal Intelligence and Investigation Service).

LEAs and other organisations operating outside of the Netherlands are required to follow the applicable mutual legal assistance treaties (MLAT) procedures.

The RIPE NCC will evaluate each order on its own merits. If an order is considered illegal or of a non-obligatory nature, the RIPE NCC will not comply with it and will challenge it either before the authority giving the order or before a civil or criminal court, depending on the specific circumstances.

A request may be served by email, fax, in person or by registered mail to the RIPE NCC's legal address:

RIPE NCC
Singel 258
1016 AB Amsterdam
The Netherlands
Email: ncc@ripe.net
Fax: +31 20 535 4445

It is the RIPE NCC's policy to notify members of requests (or other orders) for their data unless it is prohibited from doing so by statute or court order.

2. Requests or Orders for a Specific Action

The RIPE NCC may be asked by LEAs to perform a specific action, for example a modification in the registration of specific Internet number resources. The RIPE NCC will not voluntarily comply with such requests.

The RIPE NCC will only comply with such requests if a Dutch Court order is served by a Dutch LEA, as well as a binding order from law-enforcement or regulatory authorities that are operating as required under Dutch criminal and administrative law (such as the Public Prosecution Department, the Police, the Fiscal Intelligence and Investigation Service).

Both law enforcement and other national authorities operating outside the Netherlands must follow the applicable mutual legal assistance treaties (MLAT) procedures.

Each order will be evaluated on its own merits. If an order is considered illegal or of a non-obligatory nature, the RIPE NCC will not comply with it and will challenge it either before the authority giving the order or before a civil or criminal court, depending on the specific circumstances.

An order may be served by email, fax, in person or by registered mail to the RIPE NCC's legal address (as above).

It is the RIPE NCC's policy to notify members of orders related to their data, unless it is prohibited from doing so by statute or court order.

3. Seizure of RIPE NCC Equipment or Property as Part of an Investigation

LEAs may order the seizure of equipment or property belonging to the RIPE NCC as part of an investigation.

In such cases, the RIPE NCC will examine the legitimacy of the investigation and the authorisation of the persons conducting the investigation or seizure (examining judge, public prosecutor or investigation officers).

The RIPE NCC will strive to ensure that the seizure is conducted in a manner that is the least detrimental to its operations and those of its members.

The RIPE NCC will immediately lodge a complaint with the court and will seek to secure an agreement from the authority ordering the seizure that it will await the outcome of the complaint before carrying out the seizure.