- anti-abuse-wg - mailman.ripe.net

Re: [anti-abuse-wg] Discussion on 2011-06
by James Davis 22 Jun '12

22 Jun '12

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 On 22/06/2012 12:57, Gilles Massen wrote: > May I ask where or when (as I obviously missed that)? > > This said, even of the TI community is probably the most efficient > creator of IRT objects, I'm not sure that they are the only > creator, and not the only consumer. This morning via the accredited teams list. James - -- James Davis 0300 999 2340 (+44 1235 822340) Senior CSIRT Member Lumen House, Library Avenue, Didcot, Oxfordshire, OX11 0SG -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iF4EAREIAAYFAk/kXpUACgkQjsS2Y6D6yLwyMAD/fGA+fyO/SMh0ykYVZNM1/gXu oXhfO40KX9GGINK4wQgA/jaJuqBwB1hUtyK/oPhNIKKgdEHl0Ts9qNk3y3ZAKYre =XmX0 -----END PGP SIGNATURE----- Janet is a trading name of The JNT Association, a company limited by guarantee which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Oxford, Didcot, Oxfordshire. OX11 0SG

1 0

Re: [anti-abuse-wg] Discussion on 2011-06
by James Davis 22 Jun '12

22 Jun '12

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 On 21/06/2012 17:28, Tobias Knecht wrote: > I think this is not a completely undiscussed topic at all. We have > already talked about the future of the IRT Object I've passed on the feedback from the NCC to the TI community. James - -- James Davis 0300 999 2340 (+44 1235 822340) Senior CSIRT Member Lumen House, Library Avenue, Didcot, Oxfordshire, OX11 0SG -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iF4EAREIAAYFAk/kO7IACgkQjsS2Y6D6yLyjfwEAshrgM8Br3DlaZ/+wMWUzfUya XZwtPdE7Cxstl3DV9ZUBAML8iOLxVdp17ljQhzoZCHUsvC1gbuGGJVXr6S1at+f4 =gJPZ -----END PGP SIGNATURE----- Janet is a trading name of The JNT Association, a company limited by guarantee which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Oxford, Didcot, Oxfordshire. OX11 0SG

2 1

Re: [anti-abuse-wg] meeting minutes
by James Davis 19 Jun '12

19 Jun '12

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 On 12/06/2012 16:38, lists(a)help.org wrote: > they also claim "copyrights" on the data even though copyrights do > not cover lists of facts like whois data. IANA(EU)L, but I believe you are correct in that within the EU objective collections of data should not automatically obtain copyright protection. Entirely separate to copyright there do appear to be 'database rights' that allow the owner of a database to object to things like copying of the database to protect the effort that went into creating it. I expect there are a large number of harmless explanations for what you've seen, including: - - RoTLD believe that they've done something to confer copyright protection. - - Their notice is simply mistranslated into English - - Romania is a new member of the EU and hasn't yet harmonized this aspect of it's copyright law If you haven't done so already it'd be worth writing to them and asking. Regards, James - -- James Davis 0300 999 2340 (+44 1235 822340) Senior CSIRT Member Lumen House, Library Avenue, Didcot, Oxfordshire, OX11 0SG -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iF4EAREIAAYFAk/YWUIACgkQjsS2Y6D6yLxA4AD/Srca7GMOXWqGFB4xdm37Qoc9 eOuENSISnaNXw3KK97IA/i3YjIsGf5H3SB/tN/SQ9Nv2bnZMgGzjjkSBiqNONvqw =lgfj -----END PGP SIGNATURE----- Janet is a trading name of The JNT Association, a company limited by guarantee which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Oxford, Didcot, Oxfordshire. OX11 0SG

11 22

Proposal 2011-06: some mailing list solicitation
by Emilio Madaio 13 Jun '12

13 Jun '12

Hi Brian and Tobias, we moved to Review Phase the proposal 2011-06 last Friday. Although Kaveh and I were expecting input at any time, nothing much has happened. Just as a heads up, I'd suggest to be ready if the situation does not change this and/or the next week. It might be necessary to solicit and invite for more input and feedback in the mailing list. It is something that one of the WG co-chair and/or the proposer can do. Usually the timing I suggest is after one week and a half (19-20 June) but it is actually arbitrary. Anyway, this is just to let you know. Regards Emilio

2 1

meeting minutes
by lists＠help.org 12 Jun '12

12 Jun '12

Hi, the meeting minutes are so vague and unclear that most people would have no idea what is discussed or what the issues are. For instance, the issues include that there is no linkage between the EU privacy laws and the actions taken by RIPE. The same goes for the so-called consensus process. it is so vague and the issues are not spelled out so anyone can claim a "consensus" even though the issues were never really identified. Also, there is a proposal to change the way abuse contacts are listed in the database. however, there is no description as to what makes those contacts fundamentally different from other contacts as it relates to the law and the claimed "consensus". The minutes seemed designed to make sure outsiders have no idea what is going on. It is interesting to note the ".ro" database that claims technical contacts cannot be revealed because it is protected by a specific privacy law. they also claim "copyrights" on the data even though copyrights do not cover lists of facts like whois data. Thank You

2 2

2011-06 New Draft Document Published (Abuse Contact Management in the RIPE NCC Database)
by Emilio Madaio 08 Jun '12

08 Jun '12

Dear Colleagues, The text of RIPE Policy Proposal, 2011-06, "Abuse Contact management in the RIPE NCC Database", has been revised. We have published the new version (version 3.0) today. Highlights of the changes in version 3.0 are: -Rewording of the RIPE Database in title and in the Abstract; -updated the format of database attribute and objects; -reworded more simply the attribution section. As per RIPE document ripe-500, "Policy Development Process in RIPE", the suggested changes were not considered significant to require a new Discussion Phase. Hence the proposal moves to the Review Phase of the RIPE Policy Development Process. The draft document for the proposal has been published. The impact analysis that was conducted for this proposal has also been published. You can find the full proposal at: https://www.ripe.net/ripe/policies/proposals/2011-06 and the draft document at: https://www.ripe.net/ripe/policies/proposals/2011-06/draft We encourage you to read the draft document text and send any comments to anti-abuse-wg(a)ripe.net before 6 July. Regards Emilio Madaio Policy Development Officer RIPE NCC

1 0

Draft Minutes - RIPE 64
by Brian Nisbet 08 Jun '12

08 Jun '12

Colleagues, Here are the draft minutes from the AA-WG meeting at RIPE 64 in Ljubljana. If you have any comments or corrections, please do let us know. https://www.ripe.net/ripe/groups/wg/anti-abuse/minutes/ripe-64 Draft RIPE Anti-Abuse Working Group Minutes -- RIPE 64 Thursday, 19 April 2012, 11:00-12:30, Ljubljana Co-Chairs: Brian Nisbet and Tobias Knecht Scribe: Fergal Cunningham Chat Monitor: Robert Kisteleki A. Administrative Matters Welcome The Anti-Abuse Working Group Co-Chair Brian Nisbet opened the session and welcomed the attendees. He thanked the scribe, chat monitor and stenographers and then introduced his co-chair, Tobias Knecht. Approve Minutes from RIPE 63 Brian noted that there was one comment on the posted minutes but it was not a request for a content change. There were no further comments so he declared that the RIPE 63 minutes were approved. Finalise Agenda There were no additions to the agenda. The agenda is available at: https://ripe64.ripe.net/presentations/189-AA-WG_RIPE_64.pdf B. Update B1: Recent List Discussion Brian noted that there was a lot of discussion on the mailing list since RIPE 63, and he encouraged people who had not subscribed to the mailing list to do so and participate in the discussions. He proposed to run through the main topics that emerged in the previous months. Abuse Reports/Allegations Brian said that a lot of the list discussion over the past months related to allegations of specific incidents of abuse. He said this can be a good thing and often highlights the working group's facility for exchange of information. He pointed out, however, that the mailing list was not the place to actually report abuse and that no direct action would come of that. He advised people to instead look at the hacking FAQs, see the new RIPE NCC reporting procedure and be careful about any language used to accuse people of wrongdoing. RIPE Database Bulk Access and Data Protection Task Force Legal Analysis Brian noted that there had been a lot of discussion on the mailing list about bulk access to the RIPE Database, what constituted public and private data, and what should be considered acceptable bulk access to the database. He said the rules on this matter were decided by the RIPE Data Protection Task Force. He said the RIPE NCC published the legal advice given to the task force and he said the working group would like to see more precise legal analysis containing reference to specific relevant legislation. Jochem de Ruig, Chief Financial Officer of the RIPE NCC, clarified that the report came from the Data Protection Task Force. Brian acknowledged this and said the working group would like to see the more detailed legal analysis. Peter Koch, DENIC, asked what the outcome of performing this more in-depth legal analysis would be. Brian said that the citation was requested and the working group was trying to provide it. He said the Data Protection Task Force did not arise out of the Anti-Abuse Working Group and he saw no reason for it to be formed again. He said this matter concerned the provision of information that was requested and, although he did not see the working group mailing list as the place to discuss this matter, he could not control what people talked about on the list. Peter thanked Brian for the clarification and noted that the RIPE NCC and operators work in an environment where consensus in a working group is not in a position to take precedence over the legal environment. Wilfried Woeber, ACOnet, said that in the RIPE framework, the task forces act in an advisory role and does not make a decision regarding what should be implemented. He said he appreciated the decision to improve the documentation but that task force is closed and it should not be half-heartedly resurrected. He recommended that if there were a justifiable need to cover this ground again, then it would be better to create a new task force or raise the issue in the RIPE NCC Services Working Group or the Anti-Abuse Working Group. ACTION: The RIPE NCC to provide more detailed legal analysis on the report of Data Protection Task Force. RIPE Policy Proposal 2011-06 Brian noted that this was a separate agenda item and Tobias would lead the discussion on this at the appropriate point. Community Self-help/Reputation Brian noted that there was some discussion on this matter on the working group mailing list but it seems to have died down after some useful responses were posted on the list. Spam FAQs and Community Interaction Brian noted with regard to the Spam FAQs that this was evidence that when the community feels that the RIPE NCC does something that is not good enough then it will react to feedback given and improve matters in consultation with people who are experts on the subject. He thanked the RIPE NCC for improving the documentation relating to spam. He said that, despite some comments on the mailing list, there is a dialogue going on and the RIPE NCC will be responsive. He noted that the updated Spam FAQs were now online. The RIPE NCC Reporting Procedure Brian noted that Laura Cobley from the RIPE NCC would present on the RIPE NCC Reporting Procedure later in the agenda so discussion could take place at that point. Data Verification Brian noted that the subject of data verification has popped up on the mailing list intermittently for some time. He said there was a relevant policy proposal in 2010 but this was withdrawn for a number of reasons, one of which was the establishment of the Abuse Management Task Force. He said the increased discussion about data verification recently indicates that there could be a relevant policy proposal put forward at some stage. He said the proposal could come out of the task force or it could come from an individual, but as chair of the task force he will work with the rest of the task force on this. B2: Updates CleanIT Project But Klaasen from the Ministry of Security and Justice in the Netherlands gave a presentation on the CleanIT Project. The presentation is available at: https://ripe64.ripe.net/presentations/199-Ljubiljana.pdf Max Tuleyev, NetAssist, asked for the definition of terrorism that the project uses because it is a very broad term. But said the definition being used was the legal definition as used by the European Commission, which is available on the European Commission website. He added that the main concentration was currently on Al Qaeda-influenced matters because that was where they identified the main threat as coming from. He said this threat was mainly to disrupt society using ideological methods. Pascal Gloor, Finecom Telecommunications, asked about Facebook's real identity policy. But said he knew Facebook was in favour of a real name identity policy because it feels that Facebook works properly if the person whose profile you see is actually a real person, so they have a policy to enforce this. Pascal said that in Switzerland, there was a website where people could report illegal activity to the police and if it's interesting, the police can investigate further. But said that a number of countries had set up websites such as this and sometimes it proved successful and sometimes it did not. He said this was something countries should look to develop and he noted that France has a useful way of allowing people to make these notifications. He said it was difficult to evaluate if the activity reported is really illegal and there are also language problems that can prevent the information from getting to the authorities in the proper manner. Patrick Tarpey, OFCOM, asked But if he saw a conflict between the aims of the CleanIT Project and proposed draft regulations on privacy, particularly the notion of privacy by design for websites and also the idea of the right to be forgotten online. But confirmed that he thought such a conflict did exist, and he said this is why he wanted people to participate in the discussions to find solutions. He added that the main challenge of the project was to establish a correct border between freedom on the Internet on one side and effective law enforcement on the other side. Brian said he was encouraged to hear But's comments that website blocking is not effective at a company or state level. He lamented the fact that the Irish state was lagging somewhat in this regard as it thought website blocking would solve many of its problems. But concluded by noting that further information was available on the CleanIT website, which also included relevant definitions regarding terrorism: http://www.cleanitproject.eu/ Wilfried Woeber, ACOnet, said Austria was also involved in similar activities to some degree but the governments across the EU were not acting in an entirely consistent way. He said he hoped projects such as this one would have a trickle-up effect to governments because the methods used to fight terrorism can then be applied to fight something such as child pornography and then copyright violations and then other things. He said the presenter should not expect support with one particular goal if you punish that community using the same methods. But said this comment underlined the main challenge of the project. He said they were trying to position their work between the public and private sectors, and this is one of the reasons the project has its own website separate from any ministry. He said they could receive recommendations for the private sector and for governments, and he is aware that governments don't always work so efficiently. He said it is a non-legislative process, but if industry as well as governments support it, he believes it is a project that can grow. He agreed with Wilfried that what works for anti-terrorism might not be applicable to other areas. Patrick Tarpey, OFCOM, said that the project used the European Commission definition of terrorism, and he asked whether it might be more useful to use a United Nations definition, for example, as the Internet community covered a much larger area that the European Union. But said this was a valid point but that they had to be pragmatic. He said the project began in the Netherlands and it was not possible to introduce it on a worldwide level. He said the next obvious step was to move to a European Union level, but he agreed that moving to a more global level should be the next logical step. RIPE NCC Reporting Procedure Laura Cobley, RIPE NCC Customer Services Manager, presented on the RIPE NCC Reporting Procedure. The presentation is available at: https://ripe64.ripe.net/presentations/197-lauracobley.pdf Peter Koch, DENIC, asked if the maintainer of the object or the sponsoring LIR was the responsible party when incorrect data in the RIPE Database was reported. Laura said this depended on whether the resource was directly assigned by the RIPE NCC or it was a direct assignment via a sponsoring LIR. She said in all cases either the member or the DAU was contacted. Peter said some of the objects are maintained by people who are not members, so this channel is not available in those cases. He said that sometimes the person who is maintaining the object is the one who has entered incorrect data, so this leads to a deadlock. Laura said there was a contractual requirement for members to maintain the data and to make sure that End Users keep the data up to date. She said this was the proper channel to begin with and if this does not work, then the RIPE NCC would have to look at alternative means of communicating. Peter asked if this meant that the RIPE NCC used information that was not available publicly in the RIPE Database in order to contact people. Laura said they would first use the public data contained in the organisation object, for example, but sometimes the RIPE NCC had more specific contact information that could be used if necessary. Kaveh Ranjbar, RIPE NCC Database Manager, said that if a member does not directly maintain a resource, the RIPE NCC would go to the hierarchy to find the responsible party. He said this should work in the majority of cases but obviously not all cases. C. Policies Discussion on RIPE Policy Proposal 2011-06 Tobias Knecht, Anti-Abuse Working Group co-Chair, gave an update on RIPE Policy Proposal 2011-06, Abuse Contact Management in the RIPE NCC Database. He said the proposal to introduce an "abuse-c:" contact attribute in the RIPE Database was made about a year ago and following some good discussion on the mailing list a second version was posted before the RIPE 64 Meeting. He said the new proposal concentrates on the creation of the "abuse-c:" attribute in the RIPE Database and the implementation details can be proposed by the RIPE NCC in the next step. Tobias said the proposal was more or less for a role object with a mandatory "abuse-c:" attribute that should be available without query restrictions on all systems. He said there was discussion on the mailing list about data accuracy and it was proposed to include data accuracy provisions in the proposal, but it was felt by Brian, Tobias and the Abuse Management Task Force that this would be too complicated and it would be better to concentrate on the "abuse-c:" attribute for the moment. He said the data accuracy issue should cover the entire RIPE Database and not just the "abuse-c:" attribute. He noted that the proposal was still some way from the Final Phase but good progress had been made. Emilio Madaio, Policy Development Officer for the RIPE NCC, said that the proposal would go through the RIPE Policy Development Process in the standard way. He said the RIPE NCC would provide and impact analysis and he asked that as many people as possible contribute to the discussion on the mailing list so the RIPE NCC could provide a comprehensive analysis. Tobias said that even if people had no objections to the proposal, they should voice their support on the mailing list to help achieve broad consensus. Brian noted that he would act as the relevant working group chair regarding the proposal because Tobias was involved in drafting the proposal. D. Interactions Working Groups Brian said there was welcome interaction with the RIPE Database Working Group concerning RIPE Policy Proposal 2011-06. He noted that if a data verification proposal were made, it would be wide reaching and would necessarily involve the RIPE NCC Services, DNS and RIPE Database Working Groups. He said such a policy would probably not arise out of the Anti-Abuse Working Group but there would be a lot of interaction across a number of working groups. Legal Enforcement Agency (LEA) Interactions Brian said the RIPE NCC Roundtable Meeting for LEAs took place in March and he said he represented the Anti-Abuse Working Group at that meeting. He said it was a very productive meeting that showed good awareness from LEAs of the role of the RIRs and their communities. He thanked the UK's Serious Organised Crime Agency for its work in this area. He said LEAs were not as concerned about IPv6 issues as they were a year ago but there was a lot of concern expressed over technical issues such carrier grade NATs. He said, whatever people think about lawful interception and issues like that, this is another problem highlighted by technology moves towards using carrier grade NATs. He reiterated the advice to configure IPv6 as soon as possible. Brian said the desire to interact was demonstrated in issues such as the DNS changer conversation, which was largely covered in the DNS Working Group and RIPE NCC Services Working Group. He said the freezing of resources in the RIPE Database on the back of the Dutch police order means that the RIPE NCC is taking the Dutch state to court to clarify what exactly the procedure should be in the future. He said he was encouraged by comments from the RIPE NCC that it would not react in the same way if there were a similar occurrence or request again without first being fully aware of the implications and receiving a Dutch court order. He said the DNS changer issue was overall a positive thing for both RIPE and ARIN and should improve the way law enforcement works with the RIRs. Brian noted that the Cyber Crime Working Party (CCWP) also had some interactions in London and the CCWP continues to be a place where law enforcement and the RIR communities can come together to discuss issues of common concern. Pascal Gloor, Finecom Telecommunications, asked in relation to RPKI and the DNS changer issue whether it would be useful to diversify the source under different authorities. Brian said this was a big question and this working group might not be the correct forum to discuss it. He said, speaking personally, that he trusted the RIPE NCC to do the right thing. Pascal said he proposed that, with RPKI, the five RIRs would be independent authorities giving the advantage that you could use a majority system so it would be more difficult for authorities to invalidate a certificate. Brian thanked Pascal for the comment and said this issue could not be fully discussed at this point. X. A.O.B. There was no other business to discuss. Z. Agenda for RIPE 65 Brian noted that with the dynamic RIPE Programme Committee, items for the RIPE Meeting agendas were being received earlier each meeting. He asked attendees to consider if they might have something to present in Amsterdam in September 2012. He asked that people mail the list with suggestions or contact himself or Tobias. Brian thanked everyone for attending and he closed the session at 12:28 (UTC +2). The webcast recording and stenography transcripts from this session are available at: https://ripe64.ripe.net/archives/#Thursday

1 0

2011-06 Moving to Review Phase
by Brian Nisbet 04 Jun '12

04 Jun '12

Colleagues, The Discussion Phase for 2011-06 (Abuse Contact Management in the RIPE NCC Database) has ended and thank you all for your input so far. The next step is to move to Review Phase and to ask the NCC to provide an Impact Analysis for the policy. This has been requested and while we don't have an estimated delivery date for this report, I hope to be able to set expectations soon. The move to Review Phase does not mean that discussion should stop, indeed I encourage you to continue to discuss the policy and certainly I hope that the input from the NCC will answer some of the questions that have already been raised. Thanks, Brian, Co-Chair, AA-WG

4 11

Whois final report
by lists＠help.org 04 Jun '12

04 Jun '12

initial Comments end June 10 report http://www.icann.org/en/about/aoc-review/whois/final-report-11may12-en.pdf comment filing: http://www.icann.org/en/news/public-comment/whois-rt-final-report-11may12-e…

1 0

Re: [anti-abuse-wg] WhoisSecurity.com
by Reza Farzan 01 Jun '12

01 Jun '12

By sending such a message, it appears that you only want to promote your domain, "WhoisSecurity.com" and nothing else. Anti-abuse-wg is not the right forum for you to promote your domain, or to attract visitors to your site. In case you do not know, Anti-abuse-wg is a forum within RIPE. The RIPE NCC is one of five Regional Internet Registries (RIRs) providing Internet resource allocations, registration services and coordination activities that support the operation of the Internet globally. As representatives from the RIPE NCC can confirm, "ripe.net" is not like other websites that you visit and have no contacts. You can easily find go to RIPE contact page, http://www.ripe.net/contact, and contact them. The issue here is not about knowing anyone at RIPE personally, but it is about not promoting "WhoisSecurity.com" domain in this forum. This does not mean that "WhoisSecurity.com" is bad. Reza Farzan ========= -----Original Message----- >From: "lists(a)help.org" <lists(a)help.org> >Sent: Jun 1, 2012 12:49 PM >To: >Cc: anti-abuse-wg(a)ripe.net >Subject: Re: [anti-abuse-wg] WhoisSecurity.com > > >By hiding behind "Help.Org" and "whoissecurity.com" domains, > >Well, I don't know the names of the people running most of the web sites >I visit. Even if I knew their names I wouldn't know them personally >anyway so I don't understand what your point is. If you don't like >http://WhoisSecurity.com then you are free not to use it. If you have >any suggestions for additional information that can be posted there send >it along. If it is a good link to information I will use it (even if it >were from someone convicted of assault in NJ). > >Thank You

2 1