January 2012 - anti-abuse-wg - mailman.ripe.net

Re: [anti-abuse-wg] 2011-06 New Policy Proposal (Abuse Contact Management in the RIPE NCC Database)
by Gilles Massen 29 Mar '12

29 Mar '12

Hello, This policy proposal seems a bit incomplete to, as it fails to address the problem statement from the summary. >From the summary: "...it is not clear whether to use the "abuse-mailbox:" attribute, the "remark:" attribute or an irt object.". What is supposed to happen to IRT objects, or data from them? For existing records: at the very least it should be explicit which tags should no longer be used or would be deprecated / removed in order to give clear guidance. Another point: if the general idea of the policy is acceptable, wouldn't it be nice to have 2 abuse mailboxes: one for humans, one for bots? Best, Gilles -- Fondation RESTENA - DNS-LU 6, rue Coudenhove-Kalergi L-1359 Luxembourg tel: (+352) 424409 fax: (+352) 422473

25 73

no whois record for another crappy ISP
by U.Mutlu 01 Feb '12

01 Feb '12

Hi, does anybody know why there is no whois record for the so-called ISP named "jazztel.es" ? It just says: "This TLD has no whois server" How is such possible?

6 12

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 5, Issue 7 Re: What is Personal information?
by Wout de Natris 30 Jan '12

30 Jan '12

All, The Dutch DPA does not, by way of policy, respond to requests to look into policies upfront. No exceptions allowed. This is how the policy was explained to me last year by the DPA. So even if RIPE NCC wants to have a ruling this way, she will not get one. So it's of no use to keep discussing this part here. The DPA may look into complaints though. In this it should not matter where a complaint comes from. Whether or not she does, is at her discretion. So if you've filed a complaint, you need to go through that channel and follow it up with a call, e.g. There's nothing that this WG could do to alter this. Regards, Wout de Natris - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - De Natris Consult Raaphorst 33 Tel: +31 648388813 2352 KJ Leiderdorp Skype: wout.de.natris denatrisconsult(a)hotmail.nl http://www.denatrisconsult.nl Blog http://woutdenatris.wordpress.com > Message: 1 > Date: Tue, 17 Jan 2012 08:20:06 -0500 > From: "russ(a)consumer.net" <russ(a)consumer.net> > Subject: Re: [anti-abuse-wg] What is Personal information? > To: "anti-abuse-wg(a)ripe.net" <anti-abuse-wg(a)ripe.net> > Message-ID: <4F157586.5030108(a)consumer.net> > Content-Type: text/plain; charset=UTF-8; format=flowed > > >In other words, Russ could probably approach the Dutch privacy > regulator with a query, cc RIPE NCC legal, and then accept whatever > ruling applies? I seriously doubt if anybody on this list >other than > the three parties above is qualified to comment definitely on this > issue. So - Russ, please take it offlist, and do come back to let us > know what ruling you get. I personally would be >interested in what you > learn. > > > >Under Dutch (and European) privacy directives, any information that > can uniquely distinguish a natural person (ie. NOT 'a business'...) is > to be considered 'personal information'. So, an IP >address CAN be > personal information, if the data collector can link it to a person > without too much hassle. Think webshops who log your IP at logon, they > can connect that to your account >data, so in *that* case an IP address > is logged by the shop is indeed considered 'personal information' and > must be protected by the shop accordingly. In your case with RIPE, your > IP address is >probably not considered 'personal information'. IANAL. > Check out http://en.wikipedia.org/wiki/Data_Protection_Directive. > > > The same reasoning that says RIPE database information is "personal > information" can be applied to IP addresses (in some cases). > If the IP is registered you would get those contacts by running a whois > (or doing a reverse lookup would identify a domain which > can bee looked up). It seems to me if the RIPE database entries are > "personal information" then so it the IP address associated > with that record. Even if is is personal information the issue is then > whether they gave permission to have it posted in a public database. > > If the RIPE NCC legal department had an answer it would have been put on > the public reports and/or they would answer the inquiries > put forth my me and others. I have sent an inquiry to the Dutch > privacy office but, while these offices sound good in theory, > they are usually a bureaucratic nightmare. Since I dot live within the > region I think it is unlikely I would get an answer. If the process > is legitimate I would have thought RIPE would have gone to the office > for a ruling before they changed the access policy. the fact is > RIPE won't supply their legal department's analysis and they won't > respond to my request to have the Dutch privacy office review the > matter. There would be a much better chance of getting a ruling if RIPE > would ask them ... but they don't seem to want to do that > so I can only speculate why they would not want to do the obvious thing. > > Thank You > > > >

13 35

Re: [anti-abuse-wg] 2011-06 New Policy Proposal (Abuse Contact Management in the RIPE NCC Database)
by Leo Vegoda 30 Jan '12

30 Jan '12

Hi, The proposed policy text includes: "The role objects used for abuse contact information will be required to contain a single "abuse-mailbox:" attribute which is intended for receiving automatic and manual reports about abusive behavior originating the resource holders' networks." Do the proposers intend the requirement for the "abuse-mailbox:" attribute to be enforced in any way and if so, how? Thanks, Leo

11 35

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 5, Issue 13 RE: 1. Response from Dutch DPA (russ@consumer.net)
by Wout de Natris 25 Jan '12

25 Jan '12

1. Response from Dutch DPA (russ(a)consumer.net) Stating up front that I agree with Brian latest response, as I tried to bring subtly to you last week, to close my part to this conversation: No, the DPS does accept e-mails, they have stopped responding to them directly. They refer to their website for referencing and future answers. Russ, there will be no more response from me, as I can't help you further than refering you to the DPA and then it's up to the Commissioner. Regards, Wout - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - De Natris Consult Raaphorst 33 Tel: +31 648388813 2352 KJ Leiderdorp Skype: wout.de.natris denatrisconsult(a)hotmail.nl http://www.denatrisconsult.nl Blog http://woutdenatris.wordpress.com > From: anti-abuse-wg-request(a)ripe.net > Subject: anti-abuse-wg Digest, Vol 5, Issue 13 > To: anti-abuse-wg(a)ripe.net > Date: Tue, 24 Jan 2012 22:00:16 +0100 > > Send anti-abuse-wg mailing list submissions to > anti-abuse-wg(a)ripe.net > > To subscribe or unsubscribe via the World Wide Web, visit > https://www.ripe.net/mailman/listinfo/anti-abuse-wg > or, via email, send a message with subject or body 'help' to > anti-abuse-wg-request(a)ripe.net > > You can reach the person managing the list at > anti-abuse-wg-owner(a)ripe.net > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of anti-abuse-wg digest..." > > > Today's Topics: > > 1. Response from Dutch DPA (russ(a)consumer.net) > 2. Re: Response from Dutch DPA (Brian Nisbet) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 24 Jan 2012 12:45:32 -0500 > From: "russ(a)consumer.net" <russ(a)consumer.net> > Subject: [anti-abuse-wg] Response from Dutch DPA > To: anti-abuse-wg(a)ripe.net > Message-ID: <4F1EEE3C.5000904(a)consumer.net> > Content-Type: text/plain; charset="iso-8859-1" > > Below is the response from the Ducth DPA to my inquiry. From what I > gather from the translation > the Ducth DPA has decided to refuse to accept e-mail inquiries! I need > to translate so I can't call > and I need electronic copies to copy and paste. > > This is why people should not put faith into these regulatory bodies. > Can you image a profit-making > company telling their customers that they will no longer accept e-mail > communications? This is what > happens when you set up all these feel-good regulations with regulatory > bodies who answer to no one. > This is also why RIPE gives all kinds of evasive, contradictory, and > incomplete answers. They know there is > no recourse for the average person so they just say "screw you" and let > you waste your time with these useless > regulatory bodies. Once all the regulatory bodies (like RIPE and the > Dutch DPA) destroy all the > profit-making businesses that support them then they go crying to the > people making money to bail them out. > > Thank You > > Dutch DPA response: > > U heeft het College bescherming persoonsgegevens (CBP) om zijn > emailadres gevraagd om een vraag voor te leggen. > > *_Nieuwe werkwijze CBP_* > > Vanaf 1 juli 2011 beantwoordt het College bescherming persoonsgegevens > (CBP) geen vragen meer per e-mail. Daarom krijgt u geen inhoudelijk > antwoord op uw mail. Wij verwijzen u graag naar onze websites of het > telefonisch spreekuur. U kunt ook een signaal doorgeven aan het CBP. > > *_Informatie op websites CBP_* > > Op MijnPrivacy.nl en CBPweb.nl vindt u veel informatie over privacy en > de bescherming van uw persoonsgegevens. Wellicht staat het antwoord op > uw vraag hier al tussen. Mocht u er toch niet uitkomen, dan kunt u > altijd terecht op het speciale spreekuur voor privacyvragen. > > *_Telefonisch spreekuur voor privacyvragen_* > > Tijdens het spreekuur zijn de publieksvoorlichters van het CBP > rechtstreeks telefonisch bereikbaar. U kunt bellen op werkdagen van 9:30 > uur tot 12:30 uur via 0900-2001 201 (vijf cent per minuut). De > voorlichters helpen u dan verder door het geven van algemene informatie > die van toepassing is op uw vragen. > > *_Signaal geven over privacy_* > > Twijfelt u of er wel zorgvuldig met uw persoonsgegevens wordt omgegaan? > Denkt u dat een bedrijf of organisatie de privacywetgeving overtreedt? > Geef dan een signaal door aan het CBP via het signaalformulier op > MijnPrivacy.nl. > > Het CBP vertrouwt erop u hiermee voldoende te hebben ge?nformeerd. > > Hoogachtend, > > Namens het College bescherming persoonsgegevens, > > Mw. Z. Maazouzi-Makhloufi > > Medewerker Frontoffice Antwoord op uw privacyvragen Heeft u een vraag > over de bescherming van uw persoonsgegevens? U vindt algemene informatie > op de websites www.mijnprivacy.nl en www.cbpweb.nl. Is uw vraag daarmee > niet beantwoord, dan kunt u bellen met het telefonisch spreekuur via > 0900-2001 201 (vijf cent per minuut). Dit spreekuur is bereikbaar op > werkdagen van 09.30 tot 12.30 uur. > >

4 3

Limited access to personal data in bulk
by Kaveh Ranjbar 24 Jan '12

24 Jan '12

Dear colleagues, Following recent discussions on this mailing list regarding personal data, the RIPE NCC would like to clarify a few points. The main issue is the limited access to what is considered personal data. One of the consequences of this limit is our access control system. That system automatically bans IP addresses that hit the daily limit of queries with personal data several times. There are some important points to bear in mind here: - The EU Directive sets minimum requirements for protecting personal data - The RIPE NCC is the secretariat for the RIPE community and as such implements the policies and wishes of the RIPE community - The RIPE NCC does not make any policies - The RIPE NCC itself is neutral regarding the choice of allowing either full or restricted public access to that information in bulk - As part of the RIPE Policy Development Process, the RIPE NCC may recommend a legal review of a policy proposal A few years ago, the RIPE Data Protection Task Force was formed to consider the whole issue of data protection for the data contained within the RIPE Database. After discussing different scenarios and analysing their impacts, the Task Force reported back to the RIPE Database Working Group. It was recognised by the Task Force that all the personal data contained within the RIPE Database must remain publicly available. Each individual personal data set can be queried by using the interfaces made available to the RIPE Database. The RIPE Database Working Group placed a number of action points on the RIPE NCC to implement some features, including restricting access to *bulk* personal data. The current policies impose restrictions on accessing *bulk* personal data to prevent possible abuse of the personal data contained within the database. Imposing any restrictions will have consequences. One of the consequences is restricted access to abuse contacts as currently stored in the RIPE Database. RIPE Policy Proposal 2011-06 is being discussed by the Anti-Abuse Working Group to address this specific issue. This policy will require an abuse contact related to Internet resources. This contact can be clearly marked and documented as a public field that, from the beginning, will not be regarded as personal data and will not be subject to any access restrictions, even bulk access. I would like to emphasise that the RIPE NCC executes the wishes of the RIPE community. When the community reaches consensus for a certain functionality or process, the RIPE NCC will implement and/or execute the functionality or process. In case of legal limitations, the RIPE NCC will strive for a solution that is as close as possible to the original community wishes. The RIPE NCC always reports back on this implementation and its details. There has been a suggestion that what is considered personal data should be publicly available in bulk, without any restrictions. If the community has any concerns about this restriction, perhaps this can be discussed as a specific issue on the Anti-Abuse or RIPE Database Working Group mailing list to determine if there is any consensus within the community to amend this restriction. As always, the RIPE NCC will follow all discussions and will do its best to implement the wishes of the community. The RIPE NCC always welcomes direct feedback from its members and the community. However for issues such as this, addressing concerns directly to the RIPE NCC has little effect because the RIPE NCC does not have the authority to make such a decision on behalf of the community. I hope this has helped explain some background to the concerns and ways to move forward if the issues are not resolved. Please let me know if there are any further questions, or put them to the community using the mailing lists. Kind Regards, Kaveh. --- Kaveh Ranjbar RIPE NCC Database Group Manager

4 6

Regarding distinguish different type of claims into different mail box.
by Lu Heng 19 Jan '12

19 Jan '12

Hi Colleagues: One question very much brother me is that we have setup different mailbox for different kind of abuse claims. But the claim reporter still sending everything to our main abuse mailbox. We want to use abuse(a)outsideheaven.com as network-related abuse mailbox, and copyrightclaims(a)outsideheaven.com as well as trademarkclaims(a)outsideheaven.com for its related issues. And legal(a)outsideheaven.com for crime activity claim that need attention immediately. By that way I can give only the copyright claim and trademark claim mailbox access rights to my lawyers, and they don't have to have the access to the abuse mailbox which contain lot of network abuse report as well(which often related to the detailed sensitive IP information). Vise-versa, my network engineer can focus on take down network abuse but not getting bothered with all the content-related claims. And my partner and I can focus only the most urgent claim but don't have to look every copyright/network abuse claims. We believe this idea can save us a lot of work load in the abuse related issues, and we have see all the other major provider such as godaddy taking the same actions. However, the claim reporter still tend to send everything to abuse(a)outsideheaven.com, even though we had made it very clear in our IP's whois information that all the other claim send to "abuse(a)outsideheaven.com" will be ignored. So I would appreciated if one of you have any knowledge to my following questions: 1. Can we ignore all the other claims sent to abuse(a)outsideheaven.com mailbox since we have made it clear in the whois? Will that make us a big legal trouble afterwards(my lawyer said we can not ignore the copy right claims send to network abuse mail box, but I want to hear your advice as well)? 2. How your guys deal with this problem? If all the abuse report send to single Email address, do your guys have someone just for clear up the mailbox and forward the Email to the right person? 3. Anyone have better idea to this problem other than this distinguish mail box way? I would thank if anyone can help in this issue, even just 2 cents of your thought will be very much appreciated. -- Kind regards. Lu This transmission is intended solely for the addressee(s) shown above. It may contain information that is privileged, confidential or otherwise protected from disclosure. Any review, dissemination or use of this transmission or its contents by persons other than the intended addressee(s) is strictly prohibited. If you have received this transmission in error, please notify this office immediately and e-mail the original at the sender's address above by replying to this message and including the text of the transmission received.

3 2

Wrong AS-SET by LIR
by Астров Николай 18 Jan '12

18 Jan '12

Wrong AS-SET by LIR (inscribed clients long ushedshie from this ISP). Lir not responding to any requests (effectively bankrupt). Where to write for correct? (Not built right routes from some providers - delays and losses). On export / import this AS records should not be in the AS-SET of LIR.

1 0

Status of 2011-06
by Brian Nisbet 17 Jan '12

17 Jan '12

Colleagues, I just wanted to update you all on the current status of 2011-06, as those of you paying close attention to timings may have realised that there should have been some update over the recent Christmas period. Obviously there has been a lot of conversation about the proposal, some positive, some negative and many excellent points have been raised. I've been speaking to the NCC and Tobias about all of this and a course of action has been decided. It is our intent, as WG Chair and proposer, to sit down with the good folks from the NCC in early February and discuss a number of the topics and questions that have been raised by the WG. Out of this discussion will, I suspect and hope, come some revisions to the proposal and answers to some of the queries that have been raised. We hope that any updates to 2011-06 and any responses from the NCC should be with the WG during February. Thanks and a Happy New Year to you all, Brian. Co-Chair, RIPE AA-WG

7 15

Mandate from the RIPE community
by U.Mutlu 17 Jan '12

17 Jan '12

Hi everbody, what do you say to the answer below I got from RIPE? Doesn't RIPE already have a mandate for keeping the whois database uptodate with all the vital public data like contact email address for abuse reporting etc? Normally its just a simple database scan to find the records with such missing vital data, ie. one can even automate this job to periodically request from the owners the missing data. BTW, is the RIPE community somehow organized? Any speaker/contact person etc.? U.Mutlu mutluit.com -------- Original Message -------- Subject: Re: NCC#2012010449 Missing contact data for Abuse Reporting for IP 84.240.196.128 and 84.240.197.0 Date: Wed, 04 Jan 2012 14:38:31 +0100 From: RIPE NCC <ncc(a)ripe.net> Reply-To: RIPE NCC <ncc(a)ripe.net> To: U.Mutlu <security(a)mutluit.com> Dear Mr. Mutlu, Thank you for your email. Indeed there is no email contact but there are some phone contact details that you can find on our DB query page. There may be options we could pursue to check the validity of the contact data in the objects in the RIPE Database. Where we have a direct relationship with the owners of these objects we could request that they update this information. But we do not have a mandate from the RIPE community to allocate any resources to this activity. If you feel this should have a higher priority then you may raise the issue on the Database Working Group or Anti Abuse Working Group or Address Policy Working Group mailing lists. You can find information about the mailing lists here http://www.ripe.net/ripe/groups/wg These are open working groups and views are welcomed from anyone who wishes to discuss relevant issues. Best regards, Natasa Mojsilovic ------------------ Customer Services RIPE NCC ============================================================ Visit www.IPv6ActNow.org, the one-stop website that explains everything you need to know about IPv6. ============================================================ On Wed, 04 Jan 2012 12:56:43 +0100, U.Mutlu wrote: > I want to point you to some missing data in the RIPE DB: > > Your webpage below says about RIPE queries: 'Please do not use the email address in the âchangedâ line.' > ( https://www.ripe.net/data-tools/db/faq/faq-hacking-spamming/what-can-i-do-a… ) > > But the following IP's have no other email contact specified > except those marked as "changed" and "upd-to" (yes I used the "-B" switch): > 84.240.196.128 > 84.240.197.0 > > And also the Abuse Finder page at https://apps.db.ripe.net/search/abuse-finder.html > doesn't find any abuse contact for these IPs. > > Regards, > > U.Mutlu > SysAdm mutluit.com

7 11