Summary

  • Eighty-one of RIPE NCC’s 99 law-enforcement requests in 2025 sought identification of Internet users behind particular IP addresses; the registry says it did not hold those identities.
  • The report separates that missing information from ten requests for non-public information, six for public information, one unrelated request and one demand for a specific action.

An IP address looks like a clue. It is not a customer record. In 2025, law-enforcement agencies asked RIPE NCC 81 times to identify Internet users associated with particular addresses. The registry’s annual report says it could not supply those identities. It instead explained its role as a Regional Internet Registry and showed how public RIPE Database records identify the resource holder responsible for an address block.

That distinction is easy to miss because the same number appears in both questions. “Who used this address at 14:03?” and “Which organisation holds the registration for this block?” may begin with an IP address. They do not end in the same database.

An RIR administers Internet number resources and registration records. The public record can point to a resource holder. It does not turn RIPE NCC into every access provider’s subscriber system, nor does a block registration identify the person behind a particular session. The address is a pointer; the record has a boundary.

RIPE NCC’s 2025 figures make the boundary unusually visible. It received 99 requests from law-enforcement authorities. Eighty-one concerned information the organisation did not have: identification of Internet users for particular IP addresses. Ten sought non-public information. Six asked for public information. One concerned a matter unrelated to RIPE NCC. One asked the organisation to take a specific action.

The ten non-public-information requests split by legal force and jurisdiction. Dutch authorities submitted eight binding requests; RIPE NCC complied with all eight. They concerned one End User sponsored by a member, five current members and two former members. Two non-Dutch authorities made non-binding requests. RIPE NCC did not provide the non-public material; it supplied public information and explained the Dutch-order route.

The six public-information requests were procedural or institutional. Four asked how to seek non-public information. Two concerned RIPE NCC’s sanctions processes. Those are questions the registry could answer from its own published procedures and public records. The request for a specific action was different: a non-Dutch authority wanted RIPE NCC to change a member’s country in public records. RIPE NCC said that action required a Dutch court order or another legally enforceable order under Dutch law, and that the public information it had did not support the authority’s claim.

The annual totals have their own plot. From 2016 through 2021, no year exceeded 60 requests. The count rose to 187 in 2022, reached 200 in 2023, then fell to 115 in 2024 and 99 in 2025. The requests did not simply rise and keep rising. The report’s categories show what remained after the peak: a large stream of questions about data held elsewhere, alongside a smaller set that reached RIPE NCC’s own records and legal process.

France accounted for 32 requests in 2025, the largest country total. RIPE NCC says those requests concerned information it did not have. The figure says where the requests originated; it does not tell us how many cases, people or investigations they represented. The report counts requests. That is the unit on the page.

In July 2026, RIPE NCC published RIPE-865, its current procedure for law-enforcement requests and orders. It describes public and confidential member information as separate categories. Dutch authorities can receive non-public member information under a binding Dutch order; EU authorities can use the eEvidence Regulation. Orders under that regulation carry confidentiality rules, so RIPE NCC cannot notify members. For other orders, notification remains the policy unless law or a court order forbids it. This is the procedure RIPE NCC published in 2026. The 2025 report remains the record of requests from that earlier year.

The practical point is less dramatic than a crime-show database and more useful. A registry can establish what its records say about a resource. A subscriber identity tied to an address at a particular time belongs to a different record-holder. Legal authority does not move data from one organisation’s systems into another’s. The request must reach the institution that actually keeps the requested record, through the process that applies to it.

RIPE NCC’s report counts requests; it publishes no total for users identified or investigations completed. It establishes a sharper fact: 81 requests sought a kind of identity the RIR says it did not hold. That is enough to map the boundary between the Internet’s address book and customer files elsewhere.

Sources: RIPE NCC, Report: Law Enforcement Authorities Requests 2025 (RIPE-854); RIPE NCC, Handling Requests for Information, Orders and Investigations from Law Enforcement Authorities (RIPE-865).