[Community-Discuss] Community-Discuss Digest, Vol 547, Issue 1

[Ronald F. Guilmette]

In message <280EBC89-783C-48DF-A93E-D8A539A9D25C at delong.com>, 
Owen DeLong <owen at delong.com> wrote:


> On Dec 6, 2019, at 07:46 , Caleb Olumuyiwa Ogundele <muyiwacaleb at gmail.com> wrote:

>>Even if you are not familiar with Mauritius law, the EU GDPR which is 

>>more popular should tell you the implication of revealing a WHOIS 

>>database to a non-state prosecutorial actor like yourself who does not 

>>have a court warrant to see the redacted sections you seek. Please 

>>correct me if I'm wrong in my legal analysis of your request.

>

>Whois is data that is published generally, so your comments here about 

>DPR don't really apply.

>

>Such WHOIS dumps are available from RIPE, so I don't think it is 

>a GDPR issue at all.


I am in agreement with Owen on this.  The argument regarding the denial
of access to unredacted copies of the WHOIS data base based on some
alleged legal privacy issues is quite obviously not a reasonable or
plausible one, not only because RIPE does not impose such a restriction
but also, and more obviously, the argument makes no sense on the face
of it because individual unredacted records may be obtained by anyone
any time, just by querying the AFRINIC WHOIS data base using the -B
option.

If there were any serious legal problem with AFRINIC revealing unredacted
contact information for resources holders, then even WHOIS queries for
individual unredacted records (-B) would necessarily be disallowed.  And
they aren't, so obviously, there is not a serious legal issue here.

On that basis, I stand by my assertion that Jan Vermeulen and myself
have been stonewalled by AFRINIC staff, based on nothing at all, when
we requested researcher access to the unredacted AFRINIC data base.
And I say again, we were given no reason for the refusal to provide
this information.  Neither any legal reason nor any community-ratified
policy for this refusal was cited as the basis for the refusal at the
time.

To make matters even more bizzarely comical, as is the case with all
of the other RIRs, AFRINC has on its web site a special form that
must be filled out in order to obtain unredacted copies of the entire
WHOIS data base:

https://afrinic.net/support/general-queries/how-can-i-request-for-bulk-whois-data

Researchers must fill out this form, giving a lot of personal data,
and then must FAX or email it to AFRINIC, which we did.  (Essentially
the same procedure is used by all five of the RIRs for any party wishing
to obtain access to unredacted copies of their respective WHOIS data
bases.)

Note that access to a *redacted* copy of the WHOIS data base for any one
of the five RIRs generally requires none of this fooling around.  Anyone
who wants redacted copies of these data bases can just use anonymous
FTP and fetch them directly from the five RIR FTP servers.  (We have
done that also.)  One only needs to fill out the form and go through
all of this extra rigamorole if one specifically wants to obtain an
unredacted copy of the WHOIS data base.

Given that, you can readily imagine our shock and surprise when we filled
out the form, and then FAXed it back to AFRINIC HQ, only to be told that
despite our having jumped through ALL of the required procedural hoops,
we would only be given the exact same (redacted) copy of the data base
that we had already downloaded previously, via anonymous FTP.

Any random party from anywhere in the world can, with no special prior
arrangements, fetch a copy of the redacted AFRINIC WHOIS data base from
ftp.afrinic.net.  Given that fact, and given that this is all that AFRINC
will give you, no matter what you do, someone is going to have to explain
to me the reasons for the existance of the official AFRINIC web page
linked to above.  Why even have a complicated special procedure if the
people who do all of the steps of that procedure just end up with the
exact same un-special access privileges as they had before they did any
of this?  It makes no sense on the face of it, unless...

I assert again that we have been very deliberately stonewalled by AFRINIC
when we requested an unredacted copy of the data base.  We do not know
if we were selectively targeted for this stonewalling by one or more
AFRINIC staff members, perhaps including but not limited to Mr. Byaruhanga
and/or those working in collusion with him, or if there is, nowadays
a general stonewalling, by AFRINIC staff, of all requests for any and
all information where staff members feel that they can get away with it.
But I can definitely say that, as of this moment, we still do not have
access to the unredacted AFRINIC WHOIS data base and we also still have
no explanation whatsoever for *why* we don't.  And I still do need that
access in order to fully complete my research.

The proper response here is as simple as it is obvious.  I call on the
new CEO, Mr. Eddy Kayihura, to take command of the situation, and to
immediately grant reasonable and confidential researcher access to the
entire unredacted AFRINIC WHOIS data base to myself and Jan Vermeulen.
We have already filed out and returned to AFRINIC HQ all of the necessary
paperwork in order to qualify for such access.


Regards,
rfg