- anti-abuse-wg - mailman.ripe.net

Re: [anti-abuse-wg] Analysis of the Legal Framework and Procedures Proposed by the Data Protection Task Force
by lists＠help.org 13 Apr '12

13 Apr '12

There are companies now that download the various whois databases and repackage and resell the data. One company DomainTools.com has their parent company in the EU in Luxembourg. How is it that they download all this data and resell it apparently without a problem. If it was illegal why they don't get prosecuted? This "legal framework" doesn't address any of that. DomainTool.com has filed a lawsuit in the US federal courts asking them to rule that downloading and selling whois data is illegal. the lawsuit in question involves data from Tucows in Canada so it is unclear how a US court can rule on that. In any case none of this stuff in discussed in the legal framework paper. Are there plans to take legal action against DomainTools.com for selling this data? If not, why not? Why are there restrictions on others if some companies are downloading and selling this data anyway? Just like you can't force people to answer their abuse mailboxes I don't see how you can force people to use (or not to use) data in a certain way after it is made public. http://domainnamewire.com/2012/04/06/domain-tools-files-preemptive-lawsuit/

3 6

Analysis of the Legal Framework and Procedures Proposed by the Data Protection Task Force
by Athina Fragkouli 12 Apr '12

12 Apr '12

Dear colleagues, Current rules regarding bulk access to the data held in the RIPE Database were set based on the work of the Data Protection Task Force, which concluded its work in 2011. At that time, the DPTF published a report on it's activities and outcomes, which was published here: https://www.ripe.net/ripe/groups/tf/dp/report-of-the-ripe-data-protection-t… Recent discussion on this list has suggested that a clear overview of the legal background to the framework and procedures proposed by the DPTF may help foster better community understanding of the RIPE Database rules and the justification behind them. In the interests of transparency and understanding, the RIPE NCC has produced a report that provides the legal analysis and background of all proposals made by the DPTF. This report, which is intended to complement the original DPTF report, is available now at: https://www.ripe.net/data-tools/support/documentation/legal-framework-and-p… Kind regards, Athina Fragkouli Legal Counsel RIPE NCC

2 1

Re: [anti-abuse-wg] Introducing the RIPE NCC Report Form
by Joe St Sauver 12 Apr '12

12 Apr '12

Chris commented: #1) if you have a legal problem, go to a legal organisation ("police"), not #ripe. clarify your legal issues there. ripe isn't the place for this. Errors in registration details are not a police matter. Errors in registration details ARE directly germane to RIPE's remit as administrator of number resources, a function it provides for those in its region on behalf of the worldwide Internet community. #2) i generally appreciate ripe ncc's efforts to provide adequate aid in case of #any problems - nevertheless it has it's functions and tasks to stick to, #letting sbdy use it to mess with ripe-external stuff Maintenance of the database documenting who's been allocated/assigned space is *core* to RIPE's mission. #non-ripe-charged 'ripe-extraterritorials' creating lengthy flamey #threats as to what kind of services they "demand" from ripe, i btw #find - err - "curious"... Note that by RIPE policy, participation in RIPE Working Groups (including the Anti-Abuse Working Group) is open to all, which is, I believe, an appropriate reflection of the fact that RIPE-allocated resources can and do have an impact on users worldwide. Of course, if you take issue with that policy, you're free to propose a new policy that would change that. #3) if the complainant isn't prepared, able, or willing to express his complaint #against the alleged suspect, this probably already says it all... (ok so much: #then ncc shouldn't play bully for some troll) The question on the table was a simple one: what should be required of a party notifying RIPE of a data inaccuracy in the existing database. Should the notifying party be required to demonstrate exhaustion of all possible self-notification channels before referring the matter to RIPE as a "last resort?" No. A good Samaritan volunteer reporters has no obligation to do RIPE's work for them, and any attempt to impose arbitrary additional obligations on voluntary reporters is misplaced and inappropriate, and shows a lack of respect for the community member making that report. I see nothing wrong or inappropriate about expecting a RIR to maintain accurate records concerning the resouces it oversees, nor do I see how that makes anyone a "troll." Regards, Joe

11 18

Re: [anti-abuse-wg] Introducing the RIPE NCC Report Form
by Leo Vegoda 12 Apr '12

12 Apr '12

Hi Frank, This message is copied to the list, as requested. Frank Gadegast wrote: [...] > Lets ask me one thing (simply because you have an iconn email address): > is ICANN forcing the RIRs to have a public whois database by CONTRACT > and are the registries forced to have up-to-date and validated data in it ? > > Could you please point that out on the list ? I do not believe there is currently a contract between ICANN and the NRO or individual RIRs. In 2007, ICANN and the NRO agreed an exchange of letters. In ICANN's letter to the NRO it stated that it seeks "to further enhance our relationship for the mutual benefit of our organizations and respective communities. For that matter we wish and will seek to establish an appropriate legal arrangement within one (1) year from the date of this letter." I do not believe that arrangement has been established. You can find the announcement about the exchange of letters on the ICANN web site, here: http://www.icann.org/en/news/announcements/announcement-09nov07-en.htm The letters themselves are published on the correspondence pages but that announcement places them in a single page, which is more convenient to read. I expect the "Review of the ASO" document, which is currently in the second half of the public comment period, will have a fuller description of the relationship between the NRO and ICANN: http://www.icann.org/en/news/public-comment/aso-review-16mar12-en.htm Kind regards, Leo Vegoda

1 0

Re: [anti-abuse-wg] Introducing the RIPE NCC Report Form
by Joe St Sauver 11 Apr '12

11 Apr '12

Florian commented: #I looked at "Incorrect contact information in the RIPE Database", and #"I confirm that I have reported the incorrect information to all of #the contacts listed in the relevant object" is a required checkbox. # #This seems to require that complainants try postal addresses, phone #and fax numbers before reporting errors in email addresses. Is this #really your goal? Isn't this a step backwards? I agree. >From my POV, each data element should be treated independently. The existence of a valid FAX number, for example, should not offset or eliminate the importance (or the reportability) of working to correct an invalid/non-deliverable email address. Similarly, having found an invalid field in the whois, the reporter's "responsibility" should be considered discharged upon their identifying and reporting that data to RIPE. They should not be expected to exhaust all potential contact methods, or to make multiple attempts to the broken contact channel, or to hypothetically attempt to visit the listed address in person, :-), just in order to be eligible to report a problem with data of record. The goal should be correcting potentially bad data, not making it hard to report bad data or shifting work back upon public spirited community volunteers. Regards, Joe

5 6

Re: [anti-abuse-wg] current business practices
by Frank Gadegast 11 Apr '12

11 Apr '12

V >> subpoena by deleting the wrong AS object from the database > >> ;o) > > > > Heh. ACK on the role. But I was thinking towards urging the ISP itself to take action (once you HAVE contacted them) on the abuse complaints. That's where the pressure of a lea agency can come in handy, if such a regulator is available. > > Well, the only possibility would be the police. They do care here in Germany are kind of technical disadvanced :o( There is some organizations this ISP is a member of (like the ECO), and they have also a abuse clearing board, but that one isnt really useful because it never did anything against their members ... And why should they do something, they are not responsible for the resources ... Kind regards, Frank > > Pepijn > > +++++++++++++++++++++++++++++++++++++++++++++ > > Disclaimer > > Dit e-mailbericht kan vertrouwelijke informatie bevatten of informatie die is beschermd door een beroepsgeheim. > > Indien dit bericht niet voor u is bestemd, wijzen wij u erop dat elke vorm van verspreiding, vermenigvuldiging > > of ander gebruik ervan niet is toegestaan. > > Indien dit bericht blijkbaar bij vergissing bij u terecht is gekomen, verzoeken wij u ons daarvan > > direct op de hoogte te stellen via tel.nr 070 315 3500 of e-mail mailto:mail@opta.nl en het bericht te vernietigen. > > Dit e-mailbericht is uitsluitend gecontroleerd op virussen. > > OPTA aanvaardt geen enkele aansprakelijkheid voor de feitelijke inhoud en juistheid van dit bericht en er kunnen > > geen rechten aan worden ontleend. > > > > > > This e-mail message may contain confidential information or information protected by professional privilege. > > If it is not intended for you, you should be aware that any distribution, copying or other form of use of > > this message is not permitted. > > If it has apparently reached you by mistake, we urge you to notify us by phone +31 70 315 3500 > > or e-mail mailto:mail@opta.nl and destroy the message immediately. > > This e-mail message has only been checked for viruses. > > The accuracy, relevance, timeliness or completeness of the information provided cannot be guaranteed. > > OPTA expressly disclaims any responsibility in relation to the information in this e-mail message. > > No rights can be derived from this message. > > > > > -- Mit freundlichen Gruessen, -- MOTD: "have you enabled SSL on a website or mailbox today ?" -- PHADE Software - PowerWeb http://www.powerweb.de Inh. Dipl.-Inform. Frank Gadegast mailto:frank@powerweb.de Schinkelstrasse 17 fon: +49 33200 52920 14558 Nuthetal OT Rehbruecke, Germany fax: +49 33200 52921 ======================================================================

1 0

Re: [anti-abuse-wg] current business practices
by Frank Gadegast 11 Apr '12

11 Apr '12

Vissers, Pepijn wrote: > Hi Frank, Hi, > > > > Interesting story. Here in NL, we act as LEA towards an ISP if the abuse we see is related to spam and/or malware (because that is our (OPTA) function as telco regulator). In most cases, abuse reports from a law enforcement agency tend to be picked up with a little more urgency so the strategy is quite effective. > > > > If the ISP is non-cooperative, we might choose to apply a little more pressure by a subpoena of some kind. Usually applying such pressure results in a positively correlated attitude towards handling said abuse tickets. The strategy is derived from the theory of 'responsive regulation' by Braithwait. > > > > Do you have such a regulator (with investigative capabilities) who you could team up with in DE? Surely not. Its the role of RIPE NCC (too my understanding) to keep their database up-to-date. subpoena by deleting the wrong AS object from the database ;o) Pretty simple ... Kind regards, Frank > > > > Kind regards, > > Pepijn > > > >> -----Oorspronkelijk bericht----- > >> Van: anti-abuse-wg-bounces(a)ripe.net [mailto:anti-abuse-wg- > >> bounces(a)ripe.net] Namens Frank Gadegast > >> Verzonden: woensdag 11 april 2012 15:18 > >> Aan: anti-abuse-wg(a)ripe.net > >> Onderwerp: Re: [anti-abuse-wg] current business practices > >> > >> Laura Cobley wrote: > >>> Dear Florian and all, > >> > >> Hi, > >> > >> (some details from our current experiences with RIPE NCC and accuracy > >> of the RIPE objects) > >> > >> we currently have one case where a really big German cablenet ISP is > >> having exacly one abuse-eMail address for their tech-c, abuse-mailbox > >> and admin-c, for all their objects. > >> > >> And this one email has a domain, what does not belong to the ISP > >> anymore, since November 2011, its currently owned by a domain grabber, > >> because the ISP deleted the domain on purpose (on behalf of a change in > >> the company name years ago). > >> There is no other working contact information (phone lets you end up at > >> their hotline where they have absolutly no idea about abuse), snail > >> mail is no option, fax number is not supplied. > >> > >> We tried mailing there peering contact, their normal customer email > >> from their website, filled their online feedback form and then opened a > >> normal ticket at RIPE NCC, were just told to open another ticket at > >> RIPE NCC and invested about 5 hours already describing the problem at > >> RIPE NCC. > >> Simply no chance, RIPE NCC is responding to tickets on a daily basis, > >> even during business hours (jesus, we will respond in about 5 minutes > >> if something serious like that will happen to our networks). > >> The interest at the RIPE NCC to fix database problems does not seem to > >> have any priority. > >> > >> Ah, I forgot: > >> the maillist server mamba.ripe.net has technical problems during the > >> last 3 weeks, we opened tickets for that as well and even got a > >> response once, still not fixed, the maillist server is probably not > >> reacheable for 90% of the members ... whoever will receives this could > >> please make a telnet mamba.ripe.net 25 from some IPs he own (best would > >> be not using his or her usual IP, if he or she likes, lets see how big > >> that problem really is, thats why I have to mail the most active people > >> directly). > >> > >> -------- > >> Little update: seems like RIPE NCC changed the maillist server to > >> postgirl.ripe.net and that one works. > >> Looks like they had to change this in a hurry, because the old server > >> did hang in the nameserver caches quite long (great, that I have to > >> find that out myself, instead that > >> somebody from the RIPE NCC is simply telling me that or posting > >> to the list). > >> -------- > >> Sorry, if nearly the same email comes twice now ... have to test it. > >> > >> So: abuse does not have priority in a lot of peoples heads those days, > >> even when they tell you that daily ... > >> > >> (we have about 100 abuse incidents with that ISP monthly and the ISP > >> even resides in the same country than we are, but its still, if they > >> reside on the other side of the moon, maybe I should demonstrate > >> if front of the office building with a big sign saying: > >> "you dont have a working abuse appartment") > >> > >> > >> Kind regards, Frank > >>> > >>> Over time, contact information in the RIPE Database can become > >>> outdated due to staffing changes, oversight and lack of knowledge on > >>> the part of the maintainer. Bringing the irregularity directly to the > >>> attention of this maintainer can be the quickest way to get it fixed. > >>> > >>> If you subsequently experience difficulties with this, we can help > >> you > >>> to get in touch with the maintainer by forwarding your report to the > >>> person responsible for the Internet number resource registration. > >>> Handling reports is a normal part of our operations within the RIPE > >>> NCC and the report form makes it easier to get in touch with us. > >>> > >>> We ask you to include information such as mail delivery failure > >>> notices and copies of emails with headers, which clearly show the > >>> problem and the subsequent difficulties you are having. These help to > >>> substantiate the report. Our aim is to work together with you to > >>> further improve the quality of the data in the Internet number > >> resource registry. > >>> > >>> Best regards, > >>> > >>> Laura Cobley > >>> RIPE NCC > >>> > >>> On 4/6/12 8:45 PM, Florian Weimer wrote: > >>>> * Laura Cobley: > >>>> > >>>>> Using this form, you can now easily report various issues, > >> including > >>>>> abnormalities in Internet number resource registrations, to us for > >>>>> further investigation. > >>>> > >>>> I looked at "Incorrect contact information in the RIPE Database", > >> and > >>>> "I confirm that I have reported the incorrect information to all of > >>>> the contacts listed in the relevant object" is a required checkbox. > >>>> > >>>> This seems to require that complainants try postal addresses, phone > >>>> and fax numbers before reporting errors in email addresses. Is this > >>>> really your goal? Isn't this a step backwards? > >>>> > >>> > >>> > >>> > >> > >> > >> -- > >> > >> Mit freundlichen Gruessen, > >> -- > >> MOTD: "have you enabled SSL on a website or mailbox today ?" > >> -- > >> PHADE Software - PowerWeb http://www.powerweb.de > >> Inh. Dipl.-Inform. Frank Gadegast mailto:frank@powerweb.de > >> Schinkelstrasse 17 fon: +49 33200 52920 > >> 14558 Nuthetal OT Rehbruecke, Germany fax: +49 33200 52921 > >> ====================================================================== > >> > >> > > > > +++++++++++++++++++++++++++++++++++++++++++++ > > Disclaimer > > Dit e-mailbericht kan vertrouwelijke informatie bevatten of informatie die is beschermd door een beroepsgeheim. > > Indien dit bericht niet voor u is bestemd, wijzen wij u erop dat elke vorm van verspreiding, vermenigvuldiging > > of ander gebruik ervan niet is toegestaan. > > Indien dit bericht blijkbaar bij vergissing bij u terecht is gekomen, verzoeken wij u ons daarvan > > direct op de hoogte te stellen via tel.nr 070 315 3500 of e-mail mailto:mail@opta.nl en het bericht te vernietigen. > > Dit e-mailbericht is uitsluitend gecontroleerd op virussen. > > OPTA aanvaardt geen enkele aansprakelijkheid voor de feitelijke inhoud en juistheid van dit bericht en er kunnen > > geen rechten aan worden ontleend. > > > > > > This e-mail message may contain confidential information or information protected by professional privilege. > > If it is not intended for you, you should be aware that any distribution, copying or other form of use of > > this message is not permitted. > > If it has apparently reached you by mistake, we urge you to notify us by phone +31 70 315 3500 > > or e-mail mailto:mail@opta.nl and destroy the message immediately. > > This e-mail message has only been checked for viruses. > > The accuracy, relevance, timeliness or completeness of the information provided cannot be guaranteed. > > OPTA expressly disclaims any responsibility in relation to the information in this e-mail message. > > No rights can be derived from this message. > > > > > -- Mit freundlichen Gruessen, -- MOTD: "have you enabled SSL on a website or mailbox today ?" -- PHADE Software - PowerWeb http://www.powerweb.de Inh. Dipl.-Inform. Frank Gadegast mailto:frank@powerweb.de Schinkelstrasse 17 fon: +49 33200 52920 14558 Nuthetal OT Rehbruecke, Germany fax: +49 33200 52921 ======================================================================

1 0

Enabling community self-help?
by Shane Kerr 08 Apr '12

08 Apr '12

All, warning: crazy idea time Does it seem like a good idea to provide a way to attach "user comments" to network information? Background... Some people want someone to force ISP's to take responsibility for fixing abuse originating in their networks. The natural place for this enforcement appears to them to be the RIPE NCC (*). Contrariwise, the RIPE NCC is unable to unwilling to change its role from a fundamentally administrative to one that involves setting network usage policies. This involves risks in terms of anti-trust regulators, need to carefully define the limits of control, and setting up what amounts to a industry legal system (with both judges and police). Plus it is hard to get the RIPE NCC membership to support mechanisms which cost them money and limit their freedoms. On the 3rd hand, some people in the RIPE community (including me) also feel that it is very, very difficult to define what the required actions would be in the case of reported abuse. This reporting mechanism itself might indeed be a source of abuse (rivalries between companies could be fought by each accusing the other of hosting criminal activity). Crazy Idea... Lets crowd-source it. Maybe it makes sense to make something like a web forum for each allocated resource, or perhaps for the organization responsible for each. It could be something like a blog article with the contact and other information about each resource, and then a way to post comments about it. So, you might see that ISP ShaNet has working e-mail for abuse, but nobody ever sees any action beyond automated response. Such reports could be useful for people who *can* investigate and do something, such as law enforcement or regulators. A few decades of Internet forums have given us best practices in terms of policing forums for spam and abuse, for evaluating user trustworthiness and helpfulness, and for evaluating the value of individual comments or replies (+1). I think something like this would be within the realm of things that the RIPE NCC could provide. We could link to these pages from the WHOIS results (or go straight there for web queries perhaps). There are lots of web sites which publish consumer evaluations of various companies and products, so this really is not so different. -- Shane (*) Well, normally confused with RIPE (or Ripe). But the RIPE NCC is what they mean.

10 30

Re: [anti-abuse-wg] 2011-06 New Policy Proposal (Abuse Contact Management in the RIPE NCC Database)
by Gilles Massen 30 Mar '12

30 Mar '12

Hello, This policy proposal seems a bit incomplete to, as it fails to address the problem statement from the summary. >From the summary: "...it is not clear whether to use the "abuse-mailbox:" attribute, the "remark:" attribute or an irt object.". What is supposed to happen to IRT objects, or data from them? For existing records: at the very least it should be explicit which tags should no longer be used or would be deprecated / removed in order to give clear guidance. Another point: if the general idea of the policy is acceptable, wouldn't it be nice to have 2 abuse mailboxes: one for humans, one for bots? Best, Gilles -- Fondation RESTENA - DNS-LU 6, rue Coudenhove-Kalergi L-1359 Luxembourg tel: (+352) 424409 fax: (+352) 422473

25 73

List Behaviour & Tone
by Brian Nisbet 29 Mar '12

29 Mar '12

Folks, Can I please remind you that there is no place on this list for ad hominem attacks. There has been a veering today towards very impolite behaviour and it hasn't been all that long since I'd last sent a mail about this. If you have a disagreement with someone, please express it in a polite and reasoned manner, as the vast majority of people here do. Brian.

1 0