[address-policy-wg] IP Addressing policy on personal contact info (kf)

Pascale Julienne,

Pascal Julienne wrote:
> In France there is such a thing as unlisted phone numbers which
> remain private and unknown.  Further, the RIPE DB is becoming the
> best spam list in the world.  So yes, responsability lays with LIR,
> yes let's clean the DB, yes respect privacy.

I think there are two sides to this issue.


One is what the RIPE NCC can and has done to increase the privacy of 
people who have contact information in the Database.  We have been 
trying to increase the privacy protections in the Database over time:

- person/role objects removed from public FTP site
- DB automatically rate limits access to person/role objects
- mntner/irt objects removed from public FTP site
- .DE person object deletion
- automatic cleanup of unreferenced person/role objects

The Allocation Editor on the LIR Portal should allow LIRs to keep 
their contact data up-to-date.

We have talked with the Dutch Data Protection Authority about the 
Database as well, to make sure that we don't run afoul of the EU 
privacy directives.

There has been some discussion at the last RIPE meeting about how the 
Database both aids and hinders spammers.  Suggestions such as checking 
validity of contact information, as well as possibly putting fake 
entries in the Database and tracking spam they receive were mentioned.


The second issue is deciding on what contact data *should* be in the 
Database.  This is the job of the address-policy-wg, and perhaps the 
db-wg.  A related issue is how the data should be accessed, which is 
also something that can be decided by the same groups.  Katri Forsberg 
  did a service by raising the issue.


As a final issue, I am curious why you say the RIPE Database is 
becoming the best spam list in the world!  I think that it probably 
generates a lot of spam for LIRs, because they have their contact 
information on many objects in the Database.  I don't know any way to 
avoid this if the Database is public.

I hope that for the end users who's information is in the Database for 
only a small number of addresses that they do not get much spam 
originating from the publication in the Database.  The RIPE NCC is 
certainly interested in mechanisms that we can set up to prevent such 
use, as it is explicitly *not* allowed by the license that we provide 
for the Database.

-- 
Shane Kerr
RIPE NCC