Hello,
Why should the RIPE Database be required to enable users to uniquely
identify specific legal entities?
The purpose of the RIPE Database, as defined in long-standing RIPE
policies, is operational coordination, facilitating contact between
network operators, and supporting incident response — not acting as a
corporate registry or providing legally unambiguous identification of
companies.
1. The proposal expands the RIPE Database beyond its intended purpose
The RIPE Database was never designed to be:
a business registry
a KYC system
a tool for legal verification of corporate identity
Adding national registration numbers pushes the database into an area
that was explicitly avoided for decades and introduces duties and
expectations that RIPE NCC should not carry.
2. Security and operational risks for resource holders
A verified company registration number is a powerful OSINT key that
enables:
precise mapping between IP resources and corporate structures
targeted attacks against specific businesses
easier identification of operators in sensitive jurisdictions
expanded attack surface for ransomware, DDoS extortion, and other
threats
Many operators understandably prefer not to expose more legal
identifiers than strictly necessary.
3. The proposed benefit is marginal compared to the risks
The argument about identical organisation names, transliteration issues,
or address discrepancies describes edge cases, while the risks of
publishing registration numbers are systemic and permanent.
Existing attributes already allow for operational identification:
org-name
country
address
abuse-c / role-c
LIR identifier
verified contact details
If further clarification is needed, users can directly contact the LIR
or the RIPE NCC.
4. Risk of harming organisations in politically sensitive environments
In some countries, linking IP resources to a precise legal entity
through a government-issued ID number can expose businesses to:
political pressure
regulatory targeting
unlawful interference
censorship attempts
The RIPE Database should remain a tool for technical coordination, not a
legally authoritative directory of corporate identities.
I therefore believe this proposal requires much deeper consideration of
its broader implications, and in its current form I do not support the
introduction of a mandatory reg-nr: attribute.
Andrejs Guba
Marco Schmidt wrote:
Dear colleagues,
Following my presentation at the RIPE 91 Address Policy Working Group
session, I’d like to propose adding a company registration number to
the
organisation object type.
Problem Statement:
The RIPE Database should allow users to uniquely identify Internet
Number Resource holders. Today, organisation objects linked to RIPE NCC
co-maintained inetnum, inet6num, and aut-num objects include the
validated legal organisation name and country code where the resource
holder is legally registered. However, these attributes alone are not
always sufficient to uniquely identify a legal entity, for three main
reasons:
1. Identical names: In some jurisdictions, different companies can
legally register with the same or very similar names.
2. Transliteration issues: In countries using non-Latin scripts,
converting names from and into Latin characters can produce
inconsistent
or inaccurate results.
3. Data discrepancies: Differences between the validated legal
information (org-name and country) and the contact details maintained
by
the resource holder (for example, a postal address in another country)
can create confusion and make identification more difficult.
Solution Definition:
Introduce a new reg-nr: attribute for RIPE NCC co-maintained
organisation objects, containing verified company registration numbers
issued by national authorities. The RIPE NCC already holds this
information for ~99% of resource holders that are legal entities.
Publishing a unique and verifiable registration number will
significantly improve the ability of RIPE Database users to accurately
identify resource holders and cross-check them in national company
registries.
Only publicly available registration numbers of legal entities will be
published. Natural persons remain explicitly out of scope.
Please let me know your feedback. Questions and comments are welcome.
Regards
Marco Schmidt
Manager Registration Services
RIPE NCC
-----
To unsubscribe from this mailing list or change your subscription options,
please visit: https://mailman.ripe.net/mailman3/lists/db-wg.ripe.net/
As we have migrated to Mailman 3, you will need to create an account with the email matching your subscription before you can change your settings.
More details at: https://www.ripe.net/membership/mail/mailman-3-migration/
