<html><head></head><body><div class="ydpede5e269yahoo-style-wrap" style=""><div style="font-family: Helvetica Neue, Helvetica, Arial, sans-serif; font-size: 16px;"></div> <div dir="ltr" data-setdir="false" style="font-family: Helvetica Neue, Helvetica, Arial, sans-serif; font-size: 16px;">Hi Ronald</div><div dir="ltr" data-setdir="false" style="font-family: Helvetica Neue, Helvetica, Arial, sans-serif; font-size: 16px;"><br></div><div dir="ltr" data-setdir="false" style="">"<span style="font-family: Helvetica Neue, Helvetica, Arial, sans-serif; font-size: 16px; color: rgb(38, 40, 42);">If ARIN doesn't vet WHOIS -modifications- then I rather doubt that RIPE</span><div style="font-family: Helvetica Neue, Helvetica, Arial, sans-serif; font-size: 16px;"><span style="color: rgb(38, 40, 42); font-family: Helvetica Neue, Helvetica, Arial, sans-serif;">does so."</span></div><div style="font-family: Helvetica Neue, Helvetica, Arial, sans-serif; font-size: 16px;"><span style="color: rgb(38, 40, 42); font-family: Helvetica Neue, Helvetica, Arial, sans-serif;"><br></span></div><div dir="ltr" data-setdir="false" style=""><font color="#26282a">I think it is a little presumptuous to think if America doesn't do something then no one does it :) </font></div><div dir="ltr" data-setdir="false" style=""><font color="#26282a"><br></font></div><div dir="ltr" data-setdir="false" style=""><font color="#26282a">Whilst changes to whois records in the RIPE Database are not all monitored there are some parts of some objects that users cannot change. One of these is the "org-name:" attribute in the ORGANISATION object for resource holders. It is possible for the user to change the address in the ORGANISATION object. But if the address shown in the public RIPE Database no longer matches the address details held by the RIPE Registry then I am sure it would be questioned during an Assisted Registry Check, which is periodically conducted by the RIPE NCC.</font></div><div dir="ltr" data-setdir="false" style=""><font color="#26282a"><br></font></div><div dir="ltr" data-setdir="false" style=""><font color="#26282a">cheers</font></div><div dir="ltr" data-setdir="false" style=""><font color="#26282a">denis</font></div><div dir="ltr" data-setdir="false" style=""><font color="#26282a"><br></font></div><div dir="ltr" data-setdir="false" style=""><font color="#26282a">co-chair DB-WG</font></div><div dir="ltr" data-setdir="false" style=""><font color="#26282a"><br></font></div></div><div style="font-family: Helvetica Neue, Helvetica, Arial, sans-serif; font-size: 16px;"><br></div> </div><div id="ydp72625421yahoo_quoted_5182961542" class="ydp72625421yahoo_quoted"> <div style="font-family:'Helvetica Neue', Helvetica, Arial, sans-serif;font-size:13px;color:#26282a;"> <div> On Monday, 29 July 2019, 22:52:02 CEST, Ronald F. Guilmette via db-wg <db-wg@ripe.net> wrote: </div> <div><br></div> <div><br></div> <div><div dir="ltr">In message <<a shape="rect" href="mailto:c59c9c14-521e-e7f8-fb9f-51a1dcb3f757@foobar.org" rel="nofollow" target="_blank">c59c9c14-521e-e7f8-fb9f-51a1dcb3f757@foobar.org</a>>, <br clear="none">Nick Hilliard <<a shape="rect" href="mailto:nick@foobar.org" rel="nofollow" target="_blank">nick@foobar.org</a>> wrote:<br clear="none"><br clear="none">>Would it be feasible for the RIPE NCC to add a read-only record to org: <br clear="none">>objects which provided the date of the last due diligence check? E.g. <br clear="none">>something like<br clear="none">><br clear="none">>organisation: ORG-FNL99-RIPE<br clear="none">>org-name: Foo Networks Limited<br clear="none">>org-type: LIR<br clear="none">>[...]<br clear="none">>mnt-ref: RIPE-NCC-HM-MNT<br clear="none">>mnt-by: RIPE-NCC-HM-MNT<br clear="none">>abuse-c: FOO2000-RIPE<br clear="none">>created: 2019-01-01T01:01:01Z<br clear="none">>last-modified: 2019-01-01T01:01:01Z<br clear="none">>due-diligence: 2019-07-01T12:00:00Z<br clear="none">>source: RIPE<br clear="none">><br clear="none">>Otherwise it doesn't look like it's easy to heuristically work out <br clear="none">>whether due diligence has been carried out on a particular object or not.<br clear="none"><br clear="none">I can't answer Nick's question, but I did just want to offer my take<div class="ydp72625421yqt5256339360" id="ydp72625421yqtfd97708"><br clear="none">on this.</div><br clear="none"><br clear="none">Personally, my own inference/assumption when looking at records like the<br clear="none">one above is that "vetting", however that is defined, took place on this<br clear="none">ORG on or about the created: date and NEVER thereafter.<br clear="none"><br clear="none">This seems to be the way things are done in the ARIN region, as I learned<br clear="none">the hard way.<br clear="none"><br clear="none">I made a fool out of myself awhile back on the ARIN Public Policy Mailing<br clear="none">List (PPML) when I endlessly harangued John Curran (ARIN CEO) about how it<br clear="none">came to pass that one tricky scoundrel (whose primary business name was/is<br clear="none">"Micfo") somehow managed to create a lot of companies, each of which was...<br clear="none">according to the relevant WHOIS records... located in a different U.S. state<br clear="none">within which each such company had NEVER been registered.<br clear="none"><br clear="none">So, as I learned, according to Curran, at the time these different (fradulent)<br clear="none">companies were initially granted (IPv4) resources, they -were- each vetted<br clear="none">to make sure that they each existed and that they each were registered in<br clear="none">the states they claimed to be in AT THAT TIME.<br clear="none"><br clear="none">If I understood Curran correctly, sometime AFTER that the WHOIS records<br clear="none">for each of the IPv4 allocations that had been granted to each of these<br clear="none">fake corporate entities has been FIDDLED (by the crook at the heart of<br clear="none">this matter) to make it appear that the entities themselves were located<br clear="none">in and/or operating in various other states where in fact, they had<br clear="none">neither any operations nor any actual legal existance in those states.<br clear="none"><br clear="none">ARIN does NOT vet any of the changes that a registrant may make to his/her/its<br clear="none">own pre-existing WHOIS records. I believe that is an accurate characterization<br clear="none">of what Curran said on the PPML.<br clear="none"><br clear="none">If ARIN doesn't vet WHOIS -modifications- then I rather doubt that RIPE<br clear="none">does so.<br clear="none"><br clear="none">So, except in very rare cases, I would assume that the "last vetting date"<br clear="none">for any given RIPE WHOIS record is going to be approximately equal to the<br clear="none">created: date.<br clear="none"><br clear="none"><br clear="none">Regards,<br clear="none">rfg<div class="ydp72625421yqt5256339360" id="ydp72625421yqtfd33831"><br clear="none"></div></div></div> </div> </div></body></html>