Dear RIPE DB-WG, Hope this email finds you in good health! Please find my comment below, inline... Thanks. Le 13/04/2023 à 11:29, denis walker via db-wg a écrit :

Colleagues

A question for the legal team at the RIPE NCC. Would a simple purpose, as suggested below, address all the concerns you had about the use of the "geofeed:" attribute and allow you to remove any restrictions you felt were necessary when it was introduced?

Hi Denis, Many thanks for your email, brother! Hopefully, it would achieve that purpose.

cheers denis co-chair DB-WG

---------- Forwarded message --------- From: denis walker<ripedenis@gmail.com> Date: Tue, 11 Apr 2023 at 10:41 Subject: Geofeed purpose To: Database WG<db-wg@ripe.net>

Colleagues

The conversation on deploying geofeed died shortly after RIPE 85. The last comment was from myself asking if anyone was willing to propose some wording for a new purpose covering the use of the RIPE Database for geolocation information. No one proposed any wording. So below I have made a proposal for a new purpose. Your comments are appreciated.

cheers denis co-chair DB-WG

The RIPE Database contains information for the following purposes:

[...]

Providing information about the geolocation usage of Internet number resources.

...i think i understand a willing to add clarity regarding the 'why' of the purpose; but it seems to me that it could be sufficient to just stick to the 'what' part. Please do consider this alternative version: <alternative-version-purpose> Providing geolocation references with Internet number resources representation(s). </alternative-version-purpose> Hope this makes sense, as i used this [*] reference :-/ If not! please do advise, then ;-) Thanks. __ [*]: RFC 9092 - Finding and Using Geofeed Data <https://datatracker.ietf.org/doc/html/rfc9092/> Shalom, --sb. -- Best Regards ! baya.sylvain [AT cmNOG DOT cm] |cmNOG's Structure <https://www.cmnog.cm/dokuwiki/Structure>|cmNOG's Surveys <https://survey2.cmnog.cm/>|Subscribe to cmNOG's Mailing List <https://lists.cmnog.cm/mailman/listinfo/cmnog>| __ #‎LASAINTEBIBLE‬|‪#‎Romains15‬:33«*Que LE ‪#‎DIEU‬ de ‪#‎Paix‬ soit avec vous tous! ‪#‎Amen‬!*» #‎MaPrière‬ est que tu naisses de nouveau.#Chrétiennement‬ «*Comme une biche soupire après des courants d’eau, ainsi mon âme soupire après TOI, ô DIEU!*» (#Psaumes42:2)

Hi Randy, Sylvain IANAL either but I understood the main legal issue was that there is no defined purpose to use the RIPE Database for geolocation services. So whatever is in that referenced file is not covered by a valid purpose. We have had the "geoloc:" attribute for a long time. The value of this attribute is similar to the data contained in this file. So if that data was the problem we would already have a problem without "geofeed:". Maybe we can cover all this with an appropriate purpose. Suppose we defined it in this way: "Providing geolocation information related to Internet number resources in a format defined by current IETF specifications." This covers having a referenced file as long as the content of that file is as defined in the IETF specs. cheers denis co-chair DB-WG On Thu, 13 Apr 2023 at 20:20, Randy Bush via db-wg <db-wg@ripe.net> wrote:

IANAL and try not to play one on the net. but ...

my reading of why NCC legal has problems with the geofeed: attribute is that they see the NCC as legally liable for the content of the geofeed data file to which it points.

this concern may be based, for example, in the courts finding pirate bay liable for the content to which they pointed, and similar precident.

so the question is not so much the purpose of the database, it is constraining the privacy exposing danger in the geofeed files. i think the authors of RFC 8805 could be of help here.

but again, IANAL. for one, i charge less :)

randy

--

To unsubscribe from this mailing list, get a password reminder, or change your subscription options, please visit: https://lists.ripe.net/mailman/listinfo/db-wg

On Thu, Apr 13, 2023 at 5:34 PM, denis walker <db-wg@ripe.net> wrote:

Hi Randy, Sylvain

IANAL either but I understood the main legal issue was that there is no defined purpose to use the RIPE Database for geolocation services. So whatever is in that referenced file is not covered by a valid purpose. We have had the "geoloc:" attribute for a long time. The value of this attribute is similar to the data contained in this file. So if that data was the problem we would already have a problem without "geofeed:".

Maybe we can cover all this with an appropriate purpose. Suppose we defined it in this way:

"Providing geolocation information related to Internet number resources in a format defined by current IETF specifications."

This covers having a referenced file as long as the content of that file is as defined in the IETF specs.

Seeing as the concerns seem to be legal, and NOUAALNDWPTOTV (None Of Us Are Actual Lawyers Nor Do We Play Them On TeleVision), I suspect that we need some input from the lawyers. If we ask "Would adding 'Providing geolocation information related to Internet number resources in a format defined by current IETF specifications.' alleviate your concerns?" and they nod happily, then job done… ? W

cheers denis co-chair DB-WG

On Thu, 13 Apr 2023 at 20:20, Randy Bush via db-wg <db-wg@ripe.net> wrote:

IANAL and try not to play one on the net. but ...

my reading of why NCC legal has problems with the geofeed: attribute is that they see the NCC as legally liable for the content of the geofeed data file to which it points.

this concern may be based, for example, in the courts finding pirate bay liable for the content to which they pointed, and similar precident.

so the question is not so much the purpose of the database, it is constraining the privacy exposing danger in the geofeed files. i think the authors of RFC 8805 could be of help here.

but again, IANAL. for one, i charge less :)

randy

--

To unsubscribe from this mailing list, get a password reminder, or change your subscription options, please visit: https://lists.ripe.net/mailman/ listinfo/db-wg

--

To unsubscribe from this mailing list, get a password reminder, or change your subscription options, please visit: https://lists.ripe.net/mailman/ listinfo/db-wg

Hi Denis, all This is to confirm that we are already working on our analysis and we will get back to you as soon as possible. Kind regards, Maria Stafyla Senior Legal Counsel RIPE NCC On 13/04/2023 12:29, denis walker wrote:

Colleagues

A question for the legal team at the RIPE NCC. Would a simple purpose, as suggested below, address all the concerns you had about the use of the "geofeed:" attribute and allow you to remove any restrictions you felt were necessary when it was introduced?

cheers denis co-chair DB-WG

---------- Forwarded message --------- From: denis walker <ripedenis@gmail.com> Date: Tue, 11 Apr 2023 at 10:41 Subject: Geofeed purpose To: Database WG <db-wg@ripe.net>

Colleagues

The conversation on deploying geofeed died shortly after RIPE 85. The last comment was from myself asking if anyone was willing to propose some wording for a new purpose covering the use of the RIPE Database for geolocation information. No one proposed any wording. So below I have made a proposal for a new purpose. Your comments are appreciated.

cheers denis co-chair DB-WG

The RIPE Database contains information for the following purposes:

Ensuring the uniqueness of Internet number resource usage through registration of information related to the resources and Registrants Publishing routing policies by network operators (IRR) Facilitating coordination between network operators (network problem resolution, outage notification etc.) Provisioning of Reverse Domain Name System (DNS) and ENUM delegations Providing information about the Registrant and Maintainer of Internet number resources when the resources are suspected of being used for unlawful activities, to parties who are authorised under the law to receive such information. Scientific research into network operations and topology Providing information to parties involved in disputes over Internet number resource registrations to parties who are authorised under the law to receive such information.

Providing information about the geolocation usage of Internet number resources.

Hi Maria "> On the implementation side, we will discuss internally how we can make it explicit when adding a geofeed attribute that the privacy of the users of the related resources is respected." How are these internal discussions progressing? Do you have any suggestions yet? ">We will work on updating the RIPE Database Terms and Conditions in order to specify this. In line with the Adoption Process for RIPE NCC Corporate Documents, the proposed amendments will have to be approved by the RIPE NCC Executive Board." Has the Exec Board considered this yet? cheers denis co-chair DB-WG On Fri, 19 May 2023 at 16:27, Maria Stafyla <mstafyla@ripe.net> wrote:

Hi Denis, all,

To recap the discussion on this topic: after it was first suggested to introduce geofeed as a new attribute in the RIPE Database, we raised some legal concerns related to its implementation and suggested that technical restrictions are required to minimise the associated legal risks. The main concerns arose because providing geolocation information, including geolocation information that might contain personal data, is not covered under the current purposes of the RIPE Database.

From the discussion on the RIPE Database Working Group mailing list prior to RIPE 85, various feedback was provided on the use of geolocation information and the reasons for which this is useful for network and content operators. At the RIPE 85 Database Working Group session, the Working Group chairs declared there was consensus that geolocation is a purpose the RIPE Database has to fulfil. They also asked for input on the process to follow for amending the current RIPE Database Terms and Conditions and working on a draft purpose. A draft purpose has now been suggested, along with the question of whether this addresses all legal concerns and if we can go ahead with the implementation of the geofeed attribute.

Having established that geolocation is a purpose and looking at the proposed text, our advice is to make this more explicit and explain why personal data may be processed for the purpose of geolocation. We will work on updating the RIPE Database Terms and Conditions in order to specify this. In line with the Adoption Process for RIPE NCC Corporate Documents, the proposed amendments will have to be approved by the RIPE NCC Executive Board.

On the implementation side, we will discuss internally how we can make it explicit when adding a geofeed attribute that the privacy of the users of the related resources is respected. This is necessary because, as mentioned in our previous replies, although the RIPE NCC is not the party inserting the data in the csv file, legally we are co-responsible for the information inserted in the RIPE Database (even if it is not hosted there directly). As with all the other personal data in the RIPE Database, the party that enters it has the responsibility to inform the individual to whom the data pertains and to obtain their explicit consent before entering it (Art. 6.3 RIPE Database Terms and Conditions).

Kind regards,

Maria Stafyla Senior Legal Counsel RIPE NCC

On 25/04/2023 11:25, Maria Stafyla wrote:

Hi Denis, all

This is to confirm that we are already working on our analysis and we will get back to you as soon as possible.

Kind regards,

Maria Stafyla Senior Legal Counsel RIPE NCC

On 13/04/2023 12:29, denis walker wrote:

Colleagues

A question for the legal team at the RIPE NCC. Would a simple purpose, as suggested below, address all the concerns you had about the use of the "geofeed:" attribute and allow you to remove any restrictions you felt were necessary when it was introduced?

cheers denis co-chair DB-WG

---------- Forwarded message --------- From: denis walker <ripedenis@gmail.com> Date: Tue, 11 Apr 2023 at 10:41 Subject: Geofeed purpose To: Database WG <db-wg@ripe.net>

Colleagues

The conversation on deploying geofeed died shortly after RIPE 85. The last comment was from myself asking if anyone was willing to propose some wording for a new purpose covering the use of the RIPE Database for geolocation information. No one proposed any wording. So below I have made a proposal for a new purpose. Your comments are appreciated.

cheers denis co-chair DB-WG

The RIPE Database contains information for the following purposes:

Ensuring the uniqueness of Internet number resource usage through registration of information related to the resources and Registrants Publishing routing policies by network operators (IRR) Facilitating coordination between network operators (network problem resolution, outage notification etc.) Provisioning of Reverse Domain Name System (DNS) and ENUM delegations Providing information about the Registrant and Maintainer of Internet number resources when the resources are suspected of being used for unlawful activities, to parties who are authorised under the law to receive such information. Scientific research into network operations and topology Providing information to parties involved in disputes over Internet number resource registrations to parties who are authorised under the law to receive such information.

Providing information about the geolocation usage of Internet number resources.

Hi Maria Thanks for this. Just to remind everyone, can you publish the final proposed amendments that you are going to put to the board. cheers denis co-chair DB-WG On Wed, 26 Jul 2023 at 11:54, Maria Stafyla <mstafyla@ripe.net> wrote:

Hi Denis,

This is still in progress.

Our intention is to submit the proposed amendments to the RIPE Database Terms and Conditions for the Executive Board's review and approval at their next meeting, which is going to take place in October 2023.

Kind regards, Maria

On 19/07/2023 19:54, denis walker wrote:

...

Hi Maria

"> On the implementation side, we will discuss internally how we can make it explicit when adding a geofeed attribute that the privacy of the users of the related resources is respected."

How are these internal discussions progressing? Do you have any suggestions yet?

">We will work on updating the RIPE Database Terms and Conditions in order to specify this. In line with the Adoption Process for RIPE NCC Corporate Documents, the proposed amendments will have to be approved by the RIPE NCC Executive Board."

Has the Exec Board considered this yet?

cheers denis co-chair DB-WG

On Fri, 19 May 2023 at 16:27, Maria Stafyla <mstafyla@ripe.net> wrote:

...

Hi Denis, all,

To recap the discussion on this topic: after it was first suggested to introduce geofeed as a new attribute in the RIPE Database, we raised some legal concerns related to its implementation and suggested that technical restrictions are required to minimise the associated legal risks. The main concerns arose because providing geolocation information, including geolocation information that might contain personal data, is not covered under the current purposes of the RIPE Database.

From the discussion on the RIPE Database Working Group mailing list prior to RIPE 85, various feedback was provided on the use of geolocation information and the reasons for which this is useful for network and content operators. At the RIPE 85 Database Working Group session, the Working Group chairs declared there was consensus that geolocation is a purpose the RIPE Database has to fulfil. They also asked for input on the process to follow for amending the current RIPE Database Terms and Conditions and working on a draft purpose. A draft purpose has now been suggested, along with the question of whether this addresses all legal concerns and if we can go ahead with the implementation of the geofeed attribute.

Having established that geolocation is a purpose and looking at the proposed text, our advice is to make this more explicit and explain why personal data may be processed for the purpose of geolocation. We will work on updating the RIPE Database Terms and Conditions in order to specify this. In line with the Adoption Process for RIPE NCC Corporate Documents, the proposed amendments will have to be approved by the RIPE NCC Executive Board.

On the implementation side, we will discuss internally how we can make it explicit when adding a geofeed attribute that the privacy of the users of the related resources is respected. This is necessary because, as mentioned in our previous replies, although the RIPE NCC is not the party inserting the data in the csv file, legally we are co-responsible for the information inserted in the RIPE Database (even if it is not hosted there directly). As with all the other personal data in the RIPE Database, the party that enters it has the responsibility to inform the individual to whom the data pertains and to obtain their explicit consent before entering it (Art. 6.3 RIPE Database Terms and Conditions).

Kind regards,

Maria Stafyla Senior Legal Counsel RIPE NCC

On 25/04/2023 11:25, Maria Stafyla wrote:

Hi Denis, all

This is to confirm that we are already working on our analysis and we will get back to you as soon as possible.

Kind regards,

Maria Stafyla Senior Legal Counsel RIPE NCC

On 13/04/2023 12:29, denis walker wrote:

Colleagues

A question for the legal team at the RIPE NCC. Would a simple purpose, as suggested below, address all the concerns you had about the use of the "geofeed:" attribute and allow you to remove any restrictions you felt were necessary when it was introduced?

cheers denis co-chair DB-WG

---------- Forwarded message --------- From: denis walker <ripedenis@gmail.com> Date: Tue, 11 Apr 2023 at 10:41 Subject: Geofeed purpose To: Database WG <db-wg@ripe.net>

Colleagues

The conversation on deploying geofeed died shortly after RIPE 85. The last comment was from myself asking if anyone was willing to propose some wording for a new purpose covering the use of the RIPE Database for geolocation information. No one proposed any wording. So below I have made a proposal for a new purpose. Your comments are appreciated.

cheers denis co-chair DB-WG

The RIPE Database contains information for the following purposes:

Ensuring the uniqueness of Internet number resource usage through registration of information related to the resources and Registrants Publishing routing policies by network operators (IRR) Facilitating coordination between network operators (network problem resolution, outage notification etc.) Provisioning of Reverse Domain Name System (DNS) and ENUM delegations Providing information about the Registrant and Maintainer of Internet number resources when the resources are suspected of being used for unlawful activities, to parties who are authorised under the law to receive such information. Scientific research into network operations and topology Providing information to parties involved in disputes over Internet number resource registrations to parties who are authorised under the law to receive such information.

Providing information about the geolocation usage of Internet number resources.

Maria, Colleagues I think there is still some confusion here. I am not questioning the process of updating a legal document. You said "'THE' proposed amendments have to be first presented to the Executive Board". But no one knows what 'the' proposed update is. Let me summarise the last 9 months regarding geofeed. -At RIPE 85 the chairs agreed there is a consensus that using the RIPE Database for geolocation information is an agreed purpose of the RIPE Database. We asked if anyone in the community could suggest some wording for the new purpose definition.[1] -Over the next few months no one suggested anything. I put forward a possible wording in April 2023 to start a conversation.[2] We ended up, after a short discussion, with 3 suggestions for the wording. No consensus was agreed on any final wording. The legal team said you are working on an analysis. -In May 2023 the legal team published their analysis.[3] In that you said: "looking at the proposed text, our advice is to make this more explicit and explain why personal data may be processed for the purpose of geolocation." "we will discuss internally how we can make it explicit when adding a geofeed attribute that the privacy of the users of the related resources is respected." -In July 2023 you said "Our intention is to submit the proposed amendments to the RIPE Database Terms and Conditions for the Executive Board's review and approval at their next meeting".[4] It is not clear now what text you intend to present to the board for their consideration. It depends on which version you started with and if the legal team revised it. So if you can publish the text for a geolocation purpose that you plan to present to the board we can be sure everyone is on the same page. We don't want to wait until the board meeting in October, have a text agreed by the board, then someone in the community says "that's not what I had in mind". Then we are back to square one and another year has gone by. cheers denis co-chair DB-WG [1] https://ripe85.ripe.net/archives/video/966/ [2] https://www.ripe.net/ripe/mail/archives/db-wg/2023-April/007798.html [3] https://www.ripe.net/ripe/mail/archives/db-wg/2023-May/007820.html [4] https://www.ripe.net/ripe/mail/archives/db-wg/2023-July/007870.html On Fri, 28 Jul 2023 at 12:12, Maria Stafyla <mstafyla@ripe.net> wrote:

Hi Denis,

The proposed amendments have to be first presented to the Executive Board.

As per the 'Adoption Process for RIPE NCC Corporate Documents', if the Executive Board decides that feedback from the membership or RIPE community is required, the document will be published as a draft and will be shared with the members or the RIPE community via the appropriate mailing lists.

Maria

On 26/07/2023 15:15, denis walker wrote:

Hi Maria

Thanks for this. Just to remind everyone, can you publish the final proposed amendments that you are going to put to the board.

cheers denis co-chair DB-WG

On Wed, 26 Jul 2023 at 11:54, Maria Stafyla <mstafyla@ripe.net> wrote:

Hi Denis,

This is still in progress.

Our intention is to submit the proposed amendments to the RIPE Database Terms and Conditions for the Executive Board's review and approval at their next meeting, which is going to take place in October 2023.

Kind regards, Maria

On 19/07/2023 19:54, denis walker wrote:

Hi Maria

"> On the implementation side, we will discuss internally how we can make it explicit when adding a geofeed attribute that the privacy of the users of the related resources is respected."

How are these internal discussions progressing? Do you have any suggestions yet?

">We will work on updating the RIPE Database Terms and Conditions in order to specify this. In line with the Adoption Process for RIPE NCC Corporate Documents, the proposed amendments will have to be approved by the RIPE NCC Executive Board."

Has the Exec Board considered this yet?

cheers denis co-chair DB-WG

On Fri, 19 May 2023 at 16:27, Maria Stafyla <mstafyla@ripe.net> wrote:

Hi Denis, all,

To recap the discussion on this topic: after it was first suggested to introduce geofeed as a new attribute in the RIPE Database, we raised some legal concerns related to its implementation and suggested that technical restrictions are required to minimise the associated legal risks. The main concerns arose because providing geolocation information, including geolocation information that might contain personal data, is not covered under the current purposes of the RIPE Database.

From the discussion on the RIPE Database Working Group mailing list prior to RIPE 85, various feedback was provided on the use of geolocation information and the reasons for which this is useful for network and content operators. At the RIPE 85 Database Working Group session, the Working Group chairs declared there was consensus that geolocation is a purpose the RIPE Database has to fulfil. They also asked for input on the process to follow for amending the current RIPE Database Terms and Conditions and working on a draft purpose. A draft purpose has now been suggested, along with the question of whether this addresses all legal concerns and if we can go ahead with the implementation of the geofeed attribute.

Having established that geolocation is a purpose and looking at the proposed text, our advice is to make this more explicit and explain why personal data may be processed for the purpose of geolocation. We will work on updating the RIPE Database Terms and Conditions in order to specify this. In line with the Adoption Process for RIPE NCC Corporate Documents, the proposed amendments will have to be approved by the RIPE NCC Executive Board.

On the implementation side, we will discuss internally how we can make it explicit when adding a geofeed attribute that the privacy of the users of the related resources is respected. This is necessary because, as mentioned in our previous replies, although the RIPE NCC is not the party inserting the data in the csv file, legally we are co-responsible for the information inserted in the RIPE Database (even if it is not hosted there directly). As with all the other personal data in the RIPE Database, the party that enters it has the responsibility to inform the individual to whom the data pertains and to obtain their explicit consent before entering it (Art. 6.3 RIPE Database Terms and Conditions).

Kind regards,

Maria Stafyla Senior Legal Counsel RIPE NCC

On 25/04/2023 11:25, Maria Stafyla wrote:

Hi Denis, all

This is to confirm that we are already working on our analysis and we will get back to you as soon as possible.

Kind regards,

Maria Stafyla Senior Legal Counsel RIPE NCC

On 13/04/2023 12:29, denis walker wrote:

Colleagues

A question for the legal team at the RIPE NCC. Would a simple purpose, as suggested below, address all the concerns you had about the use of the "geofeed:" attribute and allow you to remove any restrictions you felt were necessary when it was introduced?

cheers denis co-chair DB-WG

---------- Forwarded message --------- From: denis walker <ripedenis@gmail.com> Date: Tue, 11 Apr 2023 at 10:41 Subject: Geofeed purpose To: Database WG <db-wg@ripe.net>

Colleagues

The conversation on deploying geofeed died shortly after RIPE 85. The last comment was from myself asking if anyone was willing to propose some wording for a new purpose covering the use of the RIPE Database for geolocation information. No one proposed any wording. So below I have made a proposal for a new purpose. Your comments are appreciated.

cheers denis co-chair DB-WG

The RIPE Database contains information for the following purposes:

Ensuring the uniqueness of Internet number resource usage through registration of information related to the resources and Registrants Publishing routing policies by network operators (IRR) Facilitating coordination between network operators (network problem resolution, outage notification etc.) Provisioning of Reverse Domain Name System (DNS) and ENUM delegations Providing information about the Registrant and Maintainer of Internet number resources when the resources are suspected of being used for unlawful activities, to parties who are authorised under the law to receive such information. Scientific research into network operations and topology Providing information to parties involved in disputes over Internet number resource registrations to parties who are authorised under the law to receive such information.

Providing information about the geolocation usage of Internet number resources.