- anti-abuse-wg - mailman.ripe.net

Re: [anti-abuse-wg] 2019-03 and over-reach
by Lu Heng 23 Mar '19

23 Mar '19

Emm...so if someone steal your house you will take your staff back from his home without police and court? Because you “admin” your staff? Try that next time and try your best explain to the judge why you think he took your staff give you rights to become police. On Sat, Mar 23, 2019 at 18:50 ac <ac(a)main.me> wrote: > On Sat, 23 Mar 2019 18:29:55 +0800 > Lu Heng <h.lu(a)anytimechinese.com> wrote: > > When you stealing electricity the electricity company will not cut > > your electricity at home but report you to the policy. > > > > No one saying stealing is ok, but no one agrees electricity company > > should have policing power. > > > > bottom line: you can do what you like with your electricity but the > electricity company cannot allow you to just take any electricity as > the electricity company is responsible for the administration of the > electricity. > > not stopping you from taking someone else's electricity is not a > "policing" or "judicial" thing - it is an administrative power as this > is the primary job of the electricity company: administer the > electricity. > > otherwise why have an electricity company at all? > > just let anyone use any electricity they like. > > this is a stupid thread. > > > > > > > > On Sat, Mar 23, 2019 at 18:27 ac <ac(a)main.me> wrote: > > > > > On Sat, 23 Mar 2019 18:04:22 +0800 > > > Lu Heng <h.lu(a)anytimechinese.com> wrote: > > > > > > > > It’s very much like electricity company tell you if you do > > > > something bad we will cut you off and stop supply electricity.and > > > > yes, they will cut you if you stop paying them, but that doesn’t > > > > mean they can > > > > > > they also cut if you cheat by stealing electricity. > > > > > > you not talk about stealing but you and Nick talk about how use > > > electricity. > > > > > > use any way you like, ripe not internet police, but you no steal, > > > okay? > > > > make themselve self juridical court in any bad thing happen in > > > > this world. > > > > > > > not every bad thing, just administrative duty to say stealing is > > > stealing. > > > > > > stealing not the same as using electricity to fry naughty neighbor > > > in chair. > > > > > > stealing is when you no pay for electricity you use to fry > > > neighbor, see? > > > > > > you use for anything bad, this your business, ripe not judicial > > > court, administrative authority. > > > > > > but you no hijack, okay? > > > > > > > Internet, or registry, are starting if not already is, become > > > > part of base infrastructure of the society, but that does not > > > > give us any rights in the society to become the supreme court of > > > > the society, just like your water company or electricity company > > > > won’t judge you for what you use water or electricity for. > > > > > > > > > > > > > > > > On Sat, Mar 23, 2019 at 16:54 ac <ac(a)main.me> wrote: > > > > > > > > > > > > > > ugh, english. I do not mean external as in outside I meant > > > > > external as in not > > > > > allocated. > > > > > > > > > > for example: complaint received about 147g8oobra912cx47.com > > > > > > > > > > versus a HIJACKING complaint received about apple.com > > > > > > > > > > my argument would be that; as 147Goobra912cX.com is not > > > > > allocated, any complaints about such a resource is outside the > > > > > scope of any administrative authority - and ianal, but, some of > > > > > what Nick Hilliard said, may apply. Same as abuse BY a > > > > > resource, when what Nick Hilliard said, may also apply. > > > > > > > > > > The main point is that; > > > > > > > > > > Because: "hijacking" of a domain name (or any resource) is a > > > > > direct administrative issue (this is factual - as per my > > > > > previous post) > > > > > > > > > > BUT > > > > > > > > > > abuse BY a domain name (or any resource) is not necessarily an > > > > > administrative issue at all (this is debatable/opinion) - as you > > > > > said "some" TLD responds some do not...and RIPE NCC is not the > > > > > Internet Police.... > > > > > > > > > > So, anyway, as 2019-03 deals with hijacking, this entire over > > > > > reach argument is factually not relevant at all > > > > > > > > > > and, more so: 2019-03 not proceeding would be counter to the > > > > > ethical administration of resources, a dereliction of > > > > > responsibility and a breach of trust implied in any such > > > > > administration (as well as administrative authority) > > > > > > > > > > > > > > > On Sat, 23 Mar 2019 08:20:01 +0000 > > > > > Suresh Ramasubramanian <ops.lists(a)gmail.com> wrote: > > > > > > > > > > > They either find out for themselves or someone else points it > > > > > > out to them. In either case their responsibility continues if > > > > > > what you say holds good > > > > > > > > > > > > --srs > > > > > > > > > > > > ________________________________ > > > > > > From: anti-abuse-wg <anti-abuse-wg-bounces(a)ripe.net> on > > > > > > behalf of ac <ac(a)main.me> Sent: Saturday, March 23, 2019 1:44 > > > > > > PM To: anti-abuse-wg(a)ripe.net > > > > > > Subject: Re: [anti-abuse-wg] 2019-03 and over-reach > > > > > > > > > > > > > > > > > > some of what the wg discusses are opinions and some things are > > > > > > scientific facts. > > > > > > > > > > > > scientific facts may change as environments and other > > > > > > variables change, but currently it is so that; > > > > > > > > > > > > there is NO TLD registry that will allow the ongoing random > > > > > > hijacking of domain names (under that TLD of course) > > > > > > > > > > > > as, this would mean that the TLD does not need to exist at all > > > > > > and/or it will not have any trust/value. > > > > > > > > > > > > RIPE NCC though, is factually a resource administrative > > > > > > authority. > > > > > > > > > > > > As such, it does need to administer resources and an integral > > > > > > part of that resource administration is the core > > > > > > responsibility implied by such administration itself and the > > > > > > balance of exercising such authority with the implied and > > > > > > direct responsibility of any such administration. > > > > > > > > > > > > Factually, the authority to allocate (or not) is > > > > > > administrative. > > > > > > > > > > > > I think (my opinion) is that the confusion arises due to > > > > > > whether a resource (whether it be a domain name, ip number, > > > > > > etc) is allocated, or not. When resources are allocated the > > > > > > administrative responsibility is not degraded, in fact a very > > > > > > strong argument could be made that the inverse is true: > > > > > > Allocated resources increases the level of administrative > > > > > > authority, responsibility and all of the administration > > > > > > aspects themselves. > > > > > > > > > > > > Now, TLD (or RIPE NCC) managing **"external"** complaints > > > > > > about direct abuse, is, imho, outside the scope of an > > > > > > administrative authority and would be the scenario Nick > > > > > > Hilliard refers to. Then again, this is my opinion, so I may > > > > > > be completely wrong (or not) :) > > > > > > > > > > > > On Sat, 23 Mar 2019 07:27:40 +0000 > > > > > > Suresh Ramasubramanian <ops.lists(a)gmail.com> wrote: > > > > > > > > > > > > > There's also the interesting comparison of how some TLD > > > > > > > registries - many of them - act on canceling spam and phish > > > > > > > domains while others go to every extreme not to do so. > > > > > > > > > > > > > > --srs > > > > > > > > > > > > > > ________________________________ > > > > > > > From: anti-abuse-wg <anti-abuse-wg-bounces(a)ripe.net> on > > > > > > > behalf of ac <ac(a)main.me> Sent: Saturday, March 23, 2019 > > > > > > > 11:16 AM To: anti-abuse-wg(a)ripe.net > > > > > > > Subject: Re: [anti-abuse-wg] 2019-03 and over-reach > > > > > > > > > > > > > > On Fri, 22 Mar 2019 17:13:20 +0000 > > > > > > > Nick Hilliard <nick(a)foobar.org> wrote: > > > > > > > > Regarding over-reach, the RIPE NCC was instituted as a > > > > > > > > numbering registry and as a supporting organisation for > > > > > > > > the RIPE Community, whose terms of reference are > > > > > > > > described in the RIPE-1 document. The terms of reference > > > > > > > > make it clear that the purpose of the RIPE Community and > > > > > > > > the RIPE NCC is internet co-ordination and - pointedly > > > > > > > > - not enforcement. Proposal 2019-03 goes well outside the > > > > > > > > scope of what the RIPE Community and the RIPE NCC were > > > > > > > > constituted to do, and I do not believe that the Anti > > > > > > > > Abuse working group has the authority to override this. > > > > > > > > > > > > > > > the wg is not overriding anything. 2019-03 is about removing > > > > > > > resources, in much the same way as same resources would have > > > > > > > been removed for payment. (RIPE NCC accounts person would > > > > > > > "judge" that there was no payment and resources would be > > > > > > > affected) > > > > > > > > > > > > > > Just because there is a decision it does not mean that such > > > > > > > a decision > > > > > > > > > > > > > > is "law enforcement" or judicial. > > > > > > > > > > > > > > 2019-03 is administrative > > > > > > > > > > > > > > and not legal/law/judicial > > > > > > > > > > > > > > > The second point relates to the long term consequences of > > > > > > > > the proposal. If the RIPE Community were to pass this > > > > > > > > policy, then it would direct the RIPE NCC to act as both > > > > > > > > a judiciary and policing agency for internet abuse. > > > > > > > > Judgement and enforcement of behaviour are the competence > > > > > > > > of national governments, courts and law > > > > > > > > > > > > > > No. You are saying the same thing, though eloquently, in a > > > > > > > different way and trying to link it to some future potential > > > > > > > hijacking by gov of RIR. > > > > > > > > > > > > > > It is not much of a decision that RIPE NCC has to make > > > > > > > either as: > > > > > > > > > > > > > > 1. There was hijacking > > > > > > > > > > > > > > OR > > > > > > > > > > > > > > 2. There was no hijacking > > > > > > > > > > > > > > Whether it was accidental, ongoing for long period of time > > > > > > > and all the other technical and scientific facts, this may > > > > > > > require some sort of interpretation of facts. > > > > > > > > > > > > > > But, not whether it actually happened or not. > > > > > > > > > > > > > > > > > > > > > > > But, this is not how to handle the problem of BGP > > > > > > > > hijacking. Even if it had the slightest possibility of > > > > > > > > making any difference at a technical level (which it > > > > > > > > won't), the proposal would set the RIPE Community and the > > > > > > > > RIPE NCC down a road which I believe would be extremely > > > > > > > > unwise to take from a legal and political point of view, > > > > > > > > and which would be difficult, if not impossible to > > > > > > > > manoeuver out of. > > > > > > > ianal, NCC legal will surely evaluate the legal aspects, but > > > > > > > practically every new shell company that has to deal with > > > > > > > compliance and other issues is just another layer in the > > > > > > > onion. > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > -- > > > > -- > > > > Kind regards. > > > > Lu > > > > > > -- > > -- > > Kind regards. > > Lu > > -- -- Kind regards. Lu

3 2

Re: [anti-abuse-wg] 2019-03 and over-reach
by Lu Heng 23 Mar '19

23 Mar '19

Nick are making good point. How about murder is a policy violation? How about rape is a policy violation? Putting RIPE NCC in a juridical position just not what RIPE NCC is. And start using the threat “if you do bad thing(whatever that is) we will take your IP number back” just simply a bad thing both for community as well as for the registry. It’s very much like electricity company tell you if you do something bad we will cut you off and stop supply electricity.and yes, they will cut you if you stop paying them, but that doesn’t mean they can make themselve self juridical court in any bad thing happen in this world. Internet, or registry, are starting if not already is, become part of base infrastructure of the society, but that does not give us any rights in the society to become the supreme court of the society, just like your water company or electricity company won’t judge you for what you use water or electricity for. On Sat, Mar 23, 2019 at 16:54 ac <ac(a)main.me> wrote: > > ugh, english. I do not mean external as in outside I meant external as in > not > allocated. > > for example: complaint received about 147g8oobra912cx47.com > > versus a HIJACKING complaint received about apple.com > > my argument would be that; as 147Goobra912cX.com is not allocated, any > complaints about such a resource is outside the scope of any > administrative authority - and ianal, but, some of what Nick Hilliard > said, may apply. Same as abuse BY a resource, when what Nick Hilliard > said, may also apply. > > The main point is that; > > Because: "hijacking" of a domain name (or any resource) is a direct > administrative issue (this is factual - as per my previous post) > > BUT > > abuse BY a domain name (or any resource) is not necessarily an > administrative issue at all (this is debatable/opinion) - as you said > "some" TLD responds some do not...and RIPE NCC is not the Internet > Police.... > > So, anyway, as 2019-03 deals with hijacking, this entire over reach > argument is factually not relevant at all > > and, more so: 2019-03 not proceeding would be counter to the ethical > administration of resources, a dereliction of responsibility and a breach > of trust implied in any such administration (as well as administrative > authority) > > > On Sat, 23 Mar 2019 08:20:01 +0000 > Suresh Ramasubramanian <ops.lists(a)gmail.com> wrote: > > > They either find out for themselves or someone else points it out to > > them. In either case their responsibility continues if what you say > > holds good > > > > --srs > > > > ________________________________ > > From: anti-abuse-wg <anti-abuse-wg-bounces(a)ripe.net> on behalf of ac > > <ac(a)main.me> Sent: Saturday, March 23, 2019 1:44 PM > > To: anti-abuse-wg(a)ripe.net > > Subject: Re: [anti-abuse-wg] 2019-03 and over-reach > > > > > > some of what the wg discusses are opinions and some things are > > scientific facts. > > > > scientific facts may change as environments and other variables > > change, but currently it is so that; > > > > there is NO TLD registry that will allow the ongoing random hijacking > > of domain names (under that TLD of course) > > > > as, this would mean that the TLD does not need to exist at all and/or > > it will not have any trust/value. > > > > RIPE NCC though, is factually a resource administrative authority. > > > > As such, it does need to administer resources and an integral part of > > that resource administration is the core responsibility implied by > > such administration itself and the balance of exercising such > > authority with the implied and direct responsibility of any such > > administration. > > > > Factually, the authority to allocate (or not) is administrative. > > > > I think (my opinion) is that the confusion arises due to whether a > > resource (whether it be a domain name, ip number, etc) is allocated, > > or not. When resources are allocated the administrative responsibility > > is not degraded, in fact a very strong argument could be made that the > > inverse is true: Allocated resources increases the level of > > administrative authority, responsibility and all of the administration > > aspects themselves. > > > > Now, TLD (or RIPE NCC) managing **"external"** complaints about direct > > abuse, is, imho, outside the scope of an administrative authority and > > would be the scenario Nick Hilliard refers to. Then again, this is my > > opinion, so I may be completely wrong (or not) :) > > > > On Sat, 23 Mar 2019 07:27:40 +0000 > > Suresh Ramasubramanian <ops.lists(a)gmail.com> wrote: > > > > > There's also the interesting comparison of how some TLD registries - > > > many of them - act on canceling spam and phish domains while others > > > go to every extreme not to do so. > > > > > > --srs > > > > > > ________________________________ > > > From: anti-abuse-wg <anti-abuse-wg-bounces(a)ripe.net> on behalf of ac > > > <ac(a)main.me> Sent: Saturday, March 23, 2019 11:16 AM > > > To: anti-abuse-wg(a)ripe.net > > > Subject: Re: [anti-abuse-wg] 2019-03 and over-reach > > > > > > On Fri, 22 Mar 2019 17:13:20 +0000 > > > Nick Hilliard <nick(a)foobar.org> wrote: > > > > Regarding over-reach, the RIPE NCC was instituted as a numbering > > > > registry and as a supporting organisation for the RIPE Community, > > > > whose terms of reference are described in the RIPE-1 document. The > > > > terms of reference make it clear that the purpose of the RIPE > > > > Community and the RIPE NCC is internet co-ordination and - > > > > pointedly > > > > - not enforcement. Proposal 2019-03 goes well outside the scope of > > > > what the RIPE Community and the RIPE NCC were constituted to do, > > > > and I do not believe that the Anti Abuse working group has the > > > > authority to override this. > > > > > > > the wg is not overriding anything. 2019-03 is about removing > > > resources, in much the same way as same resources would have been > > > removed for payment. (RIPE NCC accounts person would "judge" that > > > there was no payment and resources would be affected) > > > > > > Just because there is a decision it does not mean that such a > > > decision > > > > > > is "law enforcement" or judicial. > > > > > > 2019-03 is administrative > > > > > > and not legal/law/judicial > > > > > > > The second point relates to the long term consequences of the > > > > proposal. If the RIPE Community were to pass this policy, then it > > > > would direct the RIPE NCC to act as both a judiciary and policing > > > > agency for internet abuse. Judgement and enforcement of behaviour > > > > are the competence of national governments, courts and law > > > > > > No. You are saying the same thing, though eloquently, in a different > > > way and trying to link it to some future potential hijacking by gov > > > of RIR. > > > > > > It is not much of a decision that RIPE NCC has to make either as: > > > > > > 1. There was hijacking > > > > > > OR > > > > > > 2. There was no hijacking > > > > > > Whether it was accidental, ongoing for long period of time and all > > > the other technical and scientific facts, this may require some > > > sort of interpretation of facts. > > > > > > But, not whether it actually happened or not. > > > > > > > > > > > But, this is not how to handle the problem of BGP hijacking. Even > > > > if it had the slightest possibility of making any difference at a > > > > technical level (which it won't), the proposal would set the RIPE > > > > Community and the RIPE NCC down a road which I believe would be > > > > extremely unwise to take from a legal and political point of view, > > > > and which would be difficult, if not impossible to manoeuver out > > > > of. > > > ianal, NCC legal will surely evaluate the legal aspects, but > > > practically every new shell company that has to deal with compliance > > > and other issues is just another layer in the onion. > > > > > > > > > > > > > > > > > > > > > > -- -- Kind regards. Lu

4 3

Re: [anti-abuse-wg] 2019-03 and over-reach
by Suresh Ramasubramanian 23 Mar '19

23 Mar '19

They either find out for themselves or someone else points it out to them. In either case their responsibility continues if what you say holds good --srs ________________________________ From: anti-abuse-wg <anti-abuse-wg-bounces(a)ripe.net> on behalf of ac <ac(a)main.me> Sent: Saturday, March 23, 2019 1:44 PM To: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] 2019-03 and over-reach some of what the wg discusses are opinions and some things are scientific facts. scientific facts may change as environments and other variables change, but currently it is so that; there is NO TLD registry that will allow the ongoing random hijacking of domain names (under that TLD of course) as, this would mean that the TLD does not need to exist at all and/or it will not have any trust/value. RIPE NCC though, is factually a resource administrative authority. As such, it does need to administer resources and an integral part of that resource administration is the core responsibility implied by such administration itself and the balance of exercising such authority with the implied and direct responsibility of any such administration. Factually, the authority to allocate (or not) is administrative. I think (my opinion) is that the confusion arises due to whether a resource (whether it be a domain name, ip number, etc) is allocated, or not. When resources are allocated the administrative responsibility is not degraded, in fact a very strong argument could be made that the inverse is true: Allocated resources increases the level of administrative authority, responsibility and all of the administration aspects themselves. Now, TLD (or RIPE NCC) managing **"external"** complaints about direct abuse, is, imho, outside the scope of an administrative authority and would be the scenario Nick Hilliard refers to. Then again, this is my opinion, so I may be completely wrong (or not) :) On Sat, 23 Mar 2019 07:27:40 +0000 Suresh Ramasubramanian <ops.lists(a)gmail.com> wrote: > There's also the interesting comparison of how some TLD registries - > many of them - act on canceling spam and phish domains while others > go to every extreme not to do so. > > --srs > > ________________________________ > From: anti-abuse-wg <anti-abuse-wg-bounces(a)ripe.net> on behalf of ac > <ac(a)main.me> Sent: Saturday, March 23, 2019 11:16 AM > To: anti-abuse-wg(a)ripe.net > Subject: Re: [anti-abuse-wg] 2019-03 and over-reach > > On Fri, 22 Mar 2019 17:13:20 +0000 > Nick Hilliard <nick(a)foobar.org> wrote: > > Regarding over-reach, the RIPE NCC was instituted as a numbering > > registry and as a supporting organisation for the RIPE Community, > > whose terms of reference are described in the RIPE-1 document. The > > terms of reference make it clear that the purpose of the RIPE > > Community and the RIPE NCC is internet co-ordination and - pointedly > > - not enforcement. Proposal 2019-03 goes well outside the scope of > > what the RIPE Community and the RIPE NCC were constituted to do, and > > I do not believe that the Anti Abuse working group has the authority > > to override this. > > > the wg is not overriding anything. 2019-03 is about removing > resources, in much the same way as same resources would have been > removed for payment. (RIPE NCC accounts person would "judge" that > there was no payment and resources would be affected) > > Just because there is a decision it does not mean that such a decision > > is "law enforcement" or judicial. > > 2019-03 is administrative > > and not legal/law/judicial > > > The second point relates to the long term consequences of the > > proposal. If the RIPE Community were to pass this policy, then it > > would direct the RIPE NCC to act as both a judiciary and policing > > agency for internet abuse. Judgement and enforcement of behaviour > > are the competence of national governments, courts and law > > No. You are saying the same thing, though eloquently, in a different > way and trying to link it to some future potential hijacking by gov > of RIR. > > It is not much of a decision that RIPE NCC has to make either as: > > 1. There was hijacking > > OR > > 2. There was no hijacking > > Whether it was accidental, ongoing for long period of time and all the > other technical and scientific facts, this may require some sort of > interpretation of facts. > > But, not whether it actually happened or not. > > > > > But, this is not how to handle the problem of BGP hijacking. Even > > if it had the slightest possibility of making any difference at a > > technical level (which it won't), the proposal would set the RIPE > > Community and the RIPE NCC down a road which I believe would be > > extremely unwise to take from a legal and political point of view, > > and which would be difficult, if not impossible to manoeuver out of. > > > ianal, NCC legal will surely evaluate the legal aspects, but > practically every new shell company that has to deal with compliance > and other issues is just another layer in the onion. > > > > >

2 1

Re: [anti-abuse-wg] 2019-03 and over-reach
by Suresh Ramasubramanian 23 Mar '19

23 Mar '19

There's also the interesting comparison of how some TLD registries - many of them - act on canceling spam and phish domains while others go to every extreme not to do so. --srs ________________________________ From: anti-abuse-wg <anti-abuse-wg-bounces(a)ripe.net> on behalf of ac <ac(a)main.me> Sent: Saturday, March 23, 2019 11:16 AM To: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] 2019-03 and over-reach On Fri, 22 Mar 2019 17:13:20 +0000 Nick Hilliard <nick(a)foobar.org> wrote: > Regarding over-reach, the RIPE NCC was instituted as a numbering > registry and as a supporting organisation for the RIPE Community, > whose terms of reference are described in the RIPE-1 document. The > terms of reference make it clear that the purpose of the RIPE > Community and the RIPE NCC is internet co-ordination and - pointedly > - not enforcement. Proposal 2019-03 goes well outside the scope of > what the RIPE Community and the RIPE NCC were constituted to do, and > I do not believe that the Anti Abuse working group has the authority > to override this. > the wg is not overriding anything. 2019-03 is about removing resources, in much the same way as same resources would have been removed for payment. (RIPE NCC accounts person would "judge" that there was no payment and resources would be affected) Just because there is a decision it does not mean that such a decision is "law enforcement" or judicial. 2019-03 is administrative and not legal/law/judicial > The second point relates to the long term consequences of the > proposal. If the RIPE Community were to pass this policy, then it > would direct the RIPE NCC to act as both a judiciary and policing > agency for internet abuse. Judgement and enforcement of behaviour > are the competence of national governments, courts and law No. You are saying the same thing, though eloquently, in a different way and trying to link it to some future potential hijacking by gov of RIR. It is not much of a decision that RIPE NCC has to make either as: 1. There was hijacking OR 2. There was no hijacking Whether it was accidental, ongoing for long period of time and all the other technical and scientific facts, this may require some sort of interpretation of facts. But, not whether it actually happened or not. > > But, this is not how to handle the problem of BGP hijacking. Even if > it had the slightest possibility of making any difference at a > technical level (which it won't), the proposal would set the RIPE > Community and the RIPE NCC down a road which I believe would be > extremely unwise to take from a legal and political point of view, > and which would be difficult, if not impossible to manoeuver out of. > ianal, NCC legal will surely evaluate the legal aspects, but practically every new shell company that has to deal with compliance and other issues is just another layer in the onion.

2 1

Re: [anti-abuse-wg] 2019-03 New Policy Proposal (BGP Hijacking is a RIPE Policy Violation)
by Carlos Friaças 23 Mar '19

23 Mar '19

Hi Erik, All, Thanks for your input. Your message was quite long, so i'll try to answer several aspects of it below, after quoting what you wrote. ======= > 1. "The official reaction to Dutch parliament was, that it was too hard > to prosecute or even find the actual people behind the hijack and they > decided not to go after them." This means they decided this time, it doesn't mean they wouldn't decide differently in a subsequent timeframe. The hijackers could easily repeat their wrongdoings? Yes, they could, with the same set of resources (same ASN and same other legitimate prefixes to support the 'operation'). It's important also to state that a different victim might feel differently and it could value extra tools in fighting this. Remember, a non-dutch victim will have some extra difficulty engaging with dutch courts because those victims will lack in knowledge about dutch law. This is also a case which involved #politics. A private company (as a victim), would probably in the first place defend their own interests and their shareholders, regardless of its country's politics. ======= > 2. "Even IF they would have proceeded .. under Dutch law, BGP Hijacking > isn't a criminal offence and as a result, not directly illegal or > criminal.. Performing a (D)DOS or breaking into a computer system is.. > but BGP hijacking as such isn't. Especially if the IP space wasn't in > use.. so nothing broke or stopped working .." So, acting at RIR level could be seen as actually filling in for a gap in Dutch law? If this is the case, good, as this gap affects people well beyond dutch (and EU) borders. Again, i think we are dismissing the relevance of the other type of victims involved... those who *receive* the hijacked routes announcements and can be easily tricked by "oh, this is the dutch parliament's space, so this should be fine" and then their packets go towards the hijacker's network/systems. That's a clear path to enable "impersonation", "fraud", and so on... ======= > 3. "So even if they would get the Bulgarian spammer/hijackers in front > of a Dutch judge .. the change was that ... they would walk, because there > was no harm done .. No law was broken, no system invaded and nothing > stopped working..." I think 2019-03's goal is not to bring more people from around the world in front of Dutch judges. :-) With this self-regulatory framework in place hijackers (and everyone) will have in writing that their actions are not tolerated by the community, and if it comes to that, their 'business model' will be somewhat affected if they need to gather/find new numbers to resume their line of 'business'. ======= > 4. "So in this case, the Italian Police (ROS) used (forced??) an Italian > ISP to hijack some IP space to regain control of their lost RAT C&C > server.. (endpoint for RAT infected machines.) This wasn't an accident > .. but was it criminal by the ISP to assist their local police ? And > what would have been the impact if they didn't... ?" While this might be indifferent for the average Internet User in Kazakhstan, Malaysia, Chile, Canada, Seychelles or Belize, and any of them might argue this line of action should have a consequence, the best way 2019-03 tries to accomodate this type of corner cases is the ratification phase. Those who will have to ratify a 2nd instance report can be provided with enough evidence (an Italian court order?) so that ratification doesn't occur. Even if this isn't the case (and no evidence is provided) or the report even disputed, the ISP can only get a warning (and the concrete consequence is out of 2019-03's scope). ======= > 5. "These are your/our tax dollars at work ... They either don't care > or are the bad actor themselves." It depends on the viewpoint and the available set of evidence. In this case it can also be argued that it was a good actor. :-) Additionally, nothing guarantees that a report/complaint is going to be issued against _every_ hijack. Also, admissible evidence (from historical routing data) will have an expiration timeframe in version 2.0. ======= > 6. "So the customers that hold an SSA or End-User Agreement (PI Holders > for IP space and AS number) look to be the 'target' of the policy, > however that leaves out the legacy resource holders.." That is unaccurate. The 'target' is everyone who intentionally performs an hijack. About the legacy resource holders, if they violate RIPE policies, i don't see why their access to NCC's Services can't be denied (permanently or temporarily?) -- that's my interpretation, but we can also have a line about that in version 2.0. If RPKI is not available for legacy resources, that might have some impact. ======= > 7. "And with the current transfer policies in place, yes it is possible > to obtain a legacy AS number and a legacy IPv4 prefix ...for yourself .. > and those can't be 'retrieved' with this policy .. And even with the > policy, it isn't the RIPE NCC that COULD de-register them as they are > not allocated by the RIPE NCC in the first place ..." Exactly. Here we agree. The only possible consequence/effect (imho) is denying access to services, based on non-compliance with RIPE policies. Anyway, 2019-03 doesn't have the "recovering" of resources back to the NCC as a goal. ======= > 8. "So Legacy holders (resources with a legacy status) are for obvious > reasons, excluded for penalties and out of reach. Also according to the > policy that specifies services to Legacy holders, as this policy doesn't > state that it wants to include and impact legacy holders." I don't agree. If you check i was one of the co-authors of 2012-07 :-) In my initial drafts for 2019-03, there was a line about legacy holders. It seems now clear it needs to be recovered for version 2.0 :-) ======= > 9. "The biggest issue what I see in this policy, is that the RIPE NCC ( > either themselves or the Exec Board. ) is desired / aimed to pull the > trigger on a membership or contractual relationship." And they could (the Exec Board) decide not to do it, due to the ratification section. But *today*, it's a tool they don't have. If you are uncomfortable with the Exec Board, would the RIPE Chair/Vice-Chair be an acceptable alternative? Or should a different set of people be selected to have control over the ratification knob? ======= > 10. "These kind of actions or decisions should be kept out of the RIPE > NCC office and the actual case and decision should be made by a court > and court order." I fully agree the NCC staff should be completely kept out of this process. I'm not entirely sure about the Exec Board, but would easily agree on an independent set of people. As you already stated, Dutch law has a loophole (ok, you might not see it as a loophole) where a BGP hijack is not illegal, so saying "come back with a court order" is something that obviously won't happen and hijacks can happily proceed without any major disturbance. ======= > 11. "If someone likes to make the case that someone is in violation, > there should be a neutral judge that should review the case and the > accuser can go to the RIPE NCC with the result .. And the RIPE NCC will > just execute based on the outcome." That's what we tried to design with 2019-03, where the "neutral judge" is a set of experts -- i.e. more than one. ======= > 12. "I can understand the sentiment or intent of the policy, but I'm > against any form of policy where the RIPE NCC or the Exec Board will be > involved in the actual decision like this as it will impact their > neutral status and the fact they are opening themselves for liability > claims." As i've written above, i'm open to suggestions about how to take the Exec Board out of the picture, so that could be incorporated in version 2.0 (please see #9 above). ======= Best Regards, Carlos

5 5

2019-03 New Policy Proposal (BGP Hijacking is a RIPE Policy Violation)
by António Manuel Araújo Da Silva Rio Costa 22 Mar '19

22 Mar '19

Hi, I express my support to the 2019-03 proposal Best Regards; António Rio Costa UTAD ICT email: acosta(a)utad.pt sip: acosta(a)voip.utad.pt ext: 4668 Tlf: +351 259350668 ___________________________________________ I do not fear computers. I fear the lack of them. "Isaac Asimov" __________________________________________________________ ---Nota de Confidencialidade--- Os dados constantes da presente mensagem são destinados apenas à(s) pessoa(s) ou entidade(s) acima referida(s), podendo conter informação CONFIDENCIAL, cuja divulgação está expressamente vedada nos termos da lei. Se não é o destinatário da mensagem, ou se ela lhe foi enviada por engano, por favor informe de imediato enviando um email para acosta(a)utad.pt e apague a mesma. --- Confidentiality Note --- The data contained in this message is intended only for the person (s) or entity (s) referred to above, and may contain CONFIDENTIAL information whose disclosure is expressly prohibited under the law. If you are not the recipient of the message, or if it was sent to you in error, please inform immediately by sending an email to acosta(a)utad.pt and delete it.

1 0

Re: [anti-abuse-wg] 2019-03 New Policy Proposal (BGP Hijacking is a RIPE Policy Violation)
by Gert Doering 22 Mar '19

22 Mar '19

Hi, On Thu, Mar 21, 2019 at 07:38:34AM +0000, Suresh Ramasubramanian wrote: > Ah that way. Then - > > Do we have rough consensus? If not at what point is it reached? Now this is left to the AA WG chairs to decide :-) As per the RIPE PDP, we're in "discussion phase", which is run to the end date Marco announced (too lazy to look it up). Then, the proposers decide together with the relevant WG chairs if they think it makes sense to go ahead (it does not have to have consensus, but should have some amount of support, and no counter arguments that are compelling enough to outright kill the proposal). If yes, the RIPE NCC does the Impact Analysis, and the proposal moves to review phase. At the end of the review phase, the WG chairs determine rough consensus. Here's a nice video about the phases https://www.ripe.net/participate/policies plus the link to the formal document https://www.ripe.net/publications/docs/ripe-710 Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279

4 4

2019-03 New Policy Proposal (BGP Hijacking is a RIPE Policy Violation)
by CSIRT.UMINHO Jose Ramada 21 Mar '19

21 Mar '19

Hello all. I support the 2019-03 proposal. Cumprimentos, Jose Ramada ---------------------------------------------------------------------------- --------------------------------------------------------------- CSIRT.UMINHO - Universidade do Minho Serviços de Comunicações - Campus de Gualtar, 4710-057 Braga - Portugal Tel.: + <callto:351%20253%2060%2010%2020> 351 253 60 10 20, Fax: <callto:+351%20253%2060%2010%2029> +351 253 60 10 29 <https://csirt.uminho.pt/> https://csirt.uminho.pt | <mailto:report@csirt.uminho.pt> report(a)csirt.uminho.pt | <mailto:info@csirt.uminho.pt> info(a)csirt.uminho.pt ---------------------------------------------------------------------------- --------------------------------------------------------------- This email is confidential. If you are not the intended recipient, you must not disclose or use the information contained in it. If you have received this mail in error, please tell us immediately by return email and delete the document --- Este e-mail foi verificado em termos de vírus pelo software antivírus Avast. https://www.avast.com/antivirus

1 0

Re: [anti-abuse-wg] 2019-03 New Policy Proposal (BGP
by CSIRT.UMINHO Amandio Antunes 21 Mar '19

21 Mar '19

Hi all! I support the 2019-03 proposal. Cumprimentos, Amândio Antunes ----------------------------------------------------------------- CSIRT.UMINHO Universidade do Minho Serviços de Comunicações Campus de Gualtar, 4710-057 Braga - Portugal Tel.: + 351 253 60 40 20, Fax: +351 253 60 40 21 email: amandio(a)csirt.uminho.pt | http://www.csirt.uminho.pt ----------------------------------------------------------------- This email is confidential. If you are not the intended recipient, you must not disclose or use the information contained in it. If you have received this mail in error, please tell us immediately by return email and delete the document. -- Este email é confidêncial. Se não é o destinatário do mesmo, não deve nem revelar, nem usar o seu conteúdo. Se recebeu esta mensagem por engano, por favor informe-nos Imediatamente, devolvendo e apagando este email.

1 0

2019-03 New Policy Proposal (BGP Hijacking is a RIPE Policy Violation)
by Filipe Manuel Rebelo 21 Mar '19

21 Mar '19

Hi, I would like to express my support to the 2019-03 proposal. Regards. ________________________________ AVISO - Esta mensagem e quaisquer documentos anexos seus podem conter informa??o confidencial sujeita a sigilo profissional para uso exclusivo do(s) seu(s) destinat?rio(s). Cabe ao destinat?rio assegurar a verifica??o da exist?ncia de v?rus ou erros, uma vez que a informa??o contida pode ser intercetada ou corrompida. Se n?o for o destinat?rio, n?o dever? usar, distribuir ou copiar este e-mail, devendo proceder ? sua elimina??o e informar o emissor. ? estritamente proibido o uso, a distribui??o, c?pia ou qualquer forma de dissemina??o n?o autorizada do conte?do desta mensagem. DISCLAIMER - This message, as well as any attachments to it, may contain confidential information for exclusive use of the intended recipients. The recipients are responsible for the verification of the existence of viruses or errors, since the information transmitted could have been intercepted or in any way corrupted. If you?re not the intended recipient, you cannot use, distribute or copy this message, and you should destroy it and inform the originator of it. It?s strictly prohibited the use, distribution copy or any other form of unauthorized dissemination of this message?s content.

1 0