Tim Salo just pointed out to me some flaws in my reading of Karls NSF letter, and some history I was unaware of or at least forgotten: The key being that it was SRI who actually created the database under contract from NSF. Meaning the database might not be subject to the FOIA or Privacy acts, and in fact might be property of SRI/NSI. He points out that NSF *probably* directed the SRI to give the database to NSI, and so the NSF in fact may never have actually handled the database at all. Of course, the NSF letter to Karl still claims that the DB was created by NSI, which still isn't correct. In light of that, I suppose one can still argue that if the NSF directed the SRI to give the database to NSI, then the database wasn't property of the SRI, and that its creation was part of the contract. So it would still be property of the NSF. On the otherhand, I suppose that SRI could state it originally owned the DB, and gave it to NSI under private arrangements not related to NSF.... So perhaps one should look for such a directive from the NSF to the SRI, and whether SRI thought the database belonged to it or to the NSF. It seems to me that given these rules, a federal agency could trivially avoid both the FOIA and Privacy Act merely by outsourcing the creation and administration of its records. I don't think that it was the intention for either of these acts to allow that, so perhaps that might be an argument, too. --Dean At 02:14 PM 9/3/98 -0400, Dean Anderson wrote:

...

o Is focused on whether the whois database is within the purview of the Privacy Act of 1974, but doesn't directly address the ownership of the whois database;

o Doesn't discuss the relevance of the FARs, which explicitly talk about the ownership rights of government contractors; and

o Says that the NSF asserts that NSI owns the whois database.

Actually, I just read Karls page. The NSF just says it doesn't maintain the database and that the database Karl refers to is maintained by NSI, and therefore NSF isn't subject to or can't respond to Privacy Act requests on this particular database. (The implication here being that NSI might still be) Perhaps that is true.

But where the NSF says the database is created by NSI I think is factually incorrect. "The so-called domain name database to which you refer consists of information collected, maintained and used by NSI pursuant to that cooperative.." NSI did not collect or create the database. It was transferred to them from the NSF, which formerly maintained the database. According the NSF letter, there apparently weren't any domain registrations prior to the formation of NSI, which we know is incorrect.

Indeed, as the NSF states "the FOIA applies to records which have been in fact obtained...". The database, having been created by the NSF, was "in fact obtained" by the NSF.

Perhaps what Karl should do is write another letter to ask if on say, December 1st, 1989, did the NSF maintain such a database, and did his name appear in it.

I suspect the answer to that question would be in the affirmative, or at least to the effect that "NSF did maintain such a database at that time, but we can't determine if your name appeared..."

Then he should ask NSI the same question, since while the FOIA and privacy act wouldn't apply to databases CREATED by NSI, it would apply to databases RECEIVED from the NSF, and subsequently maintained by NSI. And see what their answer is. I think he could also point out that the database would be given back to the NSF in the event of contract termination, or to another subcontractor if the contract were re-assigned to someone else, so the database is really "materials belonging the the NSF", and subject to the Privacy and FOIA Acts.

--Dean ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean@av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean@av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++