August 2016 - anti-abuse-wg - mailman.ripe.net

Re: [anti-abuse-wg] Definition of Abuse
by Dave Crocker 19 Aug '16

19 Aug '16

On 8/16/2016 6:08 AM, ox wrote: > unfortunately, I do not know what abuse is, yet. An exercise that might help, but which is certain to have a poor signal-to-noice, is to ask everyone to post examples of what they think is abuse, or rather to post every example they think /might/ be abuse. The group then looks at the resulting compendium of examples and formulates an agreement of what examples are, and what examples are not, abuse. Then there is an attempt to formulate a concise description of what is in. It's likely that the examples will be pretty diverse, so that some sub-categorization might produce a more coherent labeling. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net

9 15

Re: [anti-abuse-wg] Definition of Abuse - Terminology used in the definition
by ox 18 Aug '16

18 Aug '16

On Thu, 18 Aug 2016 13:14:53 +0200 ox <andre(a)ox.co.za> wrote: > ================= > Definition of abuse > ================= > > "The non sanctioned use of a resource to infringe upon the usage > rights of another resource" > > ----------------------------------------------- > Terminology used in the definition > ----------------------------------------------- > > (1) Sanctioned > An action, event or situation that specifically or expressly gives > permission, or permission is granted by direct implication, which > authorises that situation, event or action > > (2) Resource > Any Internet Resource > > (3) Use and Usage > Any direct or indirect action involving a resource > > (4) Infringe > An action, event or situation which limits, reduces, undermines or > encroaches upon the fair use of a resource > > (5) Rights > All sanctioned allocation or assignment of any resource > Maybe rather : The sanctioned entitlement to use an allocated or assigned resource > > Andre > >

1 0

Definition of Abuse - Terminology used in the definition
by ox 18 Aug '16

18 Aug '16

================= Definition of abuse ================= "The non sanctioned use of a resource to infringe upon the usage rights of another resource" ----------------------------------------------- Terminology used in the definition ----------------------------------------------- (1) Sanctioned An action, event or situation that specifically or expressly gives permission, or permission is granted by direct implication, which authorises that situation, event or action (2) Resource Any Internet Resource (3) Use and Usage Any direct or indirect action involving a resource (4) Infringe An action, event or situation which limits, reduces, undermines or encroaches upon the fair use of a resource (5) Rights All sanctioned allocation or assignment of any resource Andre

1 0

Re: [anti-abuse-wg] Definition of Abuse
by Ronald F. Guilmette 18 Aug '16

18 Aug '16

ox <andre(a)ox.co.za> wrote: >Okay, just to be clear and precise: You agree that the definition of >abuse is: > >"The non sanctioned use of a resource to infringe upon the usage rights >of another resource" You're not hearing me. The answer is "No, I neither agree nor disagree with your formulation for the simple reason that it is amost entirely ambiguous, and thus meaningless, because you haven't defined _any_ of the terms used. Thus, your formulation could mean almost anything that either the writer or the reader wishes it to mean, and thus, it has no real meaning at all." Examples: If by "sanctioned" you mean "agreed to, explicity, and in writing, by Ronald F. Guilmette, regardless of the sentiments or opinions of others" then yea! That will work great for me! I'll accept that! I have a funny feeling however that when and if we were to make this simple and innocuous "clarification" to the definition of "abuse" you are proposing, some other people might possibly object however. Similarly, if by "another resource" you mean "only the Bratsk Hydroelectric Power Station in Irkutsk and no other resources" then no, that isn't quite broad enough for me, nor is it likely to be for anybody else. You're trying to get everyone to agree to a set of words strung together to form a sentence, even though nobody, including you, even has a clear notion of what any of the individual words mean, or are intended to mean. It is a silly and pointless exercise, absent definitions of the terms on reference. Anybody can vote in favor of the proposition that "All God's children should be happy." The devil is in the details. Ask any lawyer. Regards, rfg

2 1

Re: [anti-abuse-wg] Definition of Abuse
by Ronald F. Guilmette 18 Aug '16

18 Aug '16

ox <andre(a)ox.co.za> wrote: >Making a fraudulent representation to RIPE in order to obtain >resource(s) - is/are abuse Yes. >and then, that five other definitions may be required for those >people that are not as technical. No. Five other definitions are required for your general statement of general principal to have any meaning *at all* to *anyone*. >"The non sanctioned use of a resource to infringe upon the usage rights >of another resource" This is swell, as a general statement of general principal, but in the utter absence of definitions of the terms of reference, it is functionally equivalent to the following statement of general principal: All God's childern should be happy. That's an admirable sentiment, and one which most folks would be happy to agree with, but absent a clear statement of who the writer means to include in the term "God's children" and/or a specification of what any of us are being asked or expected to do in order to achieve this general outcome, it is a statement devoid of actual meaning, and is thus just a political slogan. >My position is as follows regarding fake WHOIS information: > >It is clearly fraud to submit fake information in order to obtain a resource > >Fraud is clearly a criminal act > >Either way, using a resource to infringe upon the usage rights of >another resource, which was obtained by fake information, would fit into >the above definition as the use of that resource would not be sanctioned. > >It is important to mention though, that the resource would have had to >be used though, for there to have been abuse in the first place. Defined "use". If I announce a route to an IP block, e.g. one that isn't actually assigned to me, but then I never put anything in that block, have I "used" it? Some what say "yes". Others would say "no". >I think in the further definitions this could be fleshed out for the >non technical or not as technical people You've missed the point entirely. The additional definitions are not simply necessary to satisfy pointy-headed geeks. The additional definitions are necessary for your general statement of general principal to have any actual meaning AT ALL to anybody. Who are "God's children"? Do you mean only the children of His Chosen People? It makes a difference. You need to define terms.

2 1

Re: [anti-abuse-wg] Definition of Abuse
by Ronald F. Guilmette 18 Aug '16

18 Aug '16

ox <andre(a)ox.co.za> wrote: >The above definition DOES include spamming - You say it does not, etc >etc etc. etc. That is a complete misreading of what I wrote. My only comment what was to say that I disagree with your formulation of the definition (of "abuse"). I did not specifically pick out or mention what thing or things I disagreed with. (However since you made an issue of it, now I will. See my P.S. below.) What I did do instead was to formulate, from scratch, my own definition of "internet abuse", then presented it, and the rationale for it, totally without any reference of any kind, either positive or negative, to anybody else's preferred definition. Regards, rfg P.S. If specifically asked however, I would critique your current working definition as follows: "The non sanctioned use of a resource to infringe upon the usage rights of another resource" This does not cover AT ALL cases where fradulent data has been deliberately entered into the WHOIS data base. You attempt to ignore this entire problem area... to just sweep the whole thing under the rug as if it doesn't exist... kinda makes me wonder if you are just shilling for Sasha Luck, who doesn't want to see there be a WHOIS data base AT ALL because, you know, god forbid that anybody or any company should ever actually be held, you know, accountable. No no no! We can't have THAT now can we? So? Are you shilling for the "pro-privacy" and "anti-transparency" lobby, or what? It's not like you could have missed the fact that bogus WHOIS data has been a topic here recently. Further critique: Your "definition" will require five additional definitions of its own before it will even mean a blasted thing, actually, to anybody: Define "sanctioned". (Sanction by whom? Sanctioned by what? The law?) Define "use". (If I send a packet to you, did I just "use" you?) Define "resource". (Do resources include WHOIS records? If not, why not?) Define "infringe". (If I make a copy of your webpage, have I infringed?) Define "rights". (Which rights, in particular? Who or what grants these "rights" you speak of? God? IANA? RIPE? My local city council?) Until you define those additional five things, your definition doesn't even MEAN anything. Not in any real, meaningful, or concrete sense at least. That's why I didn't even think the whole thing was even worth commenting on, quite frankly, i.e. because it seems so tenuous and incomplete. So I just got out a fresh blank sheet of paper and started writing my own version, which I posted, explained, and provided necessary definitions for, so that readers would have a prayer in hell of being able to at least understand what it means.

2 1

Re: [anti-abuse-wg] Definition of Abuse
by Ronald F. Guilmette 18 Aug '16

18 Aug '16

ox <andre(a)ox.co.za> wrote: >So, If you do not agree with the final definition, please contribute? I don't. The bottom line here is that "abuse" should probably be all of the crap that there is universal or near universal agreeent is "bad" *and* that *fails* to rise to the level of being SOOOOOOOOO terrifically awfully bad that we acually want to risk calling in the already exceptionally busy (and notoriously ham-fisted) LE people to deal with it. This would include, at the low end, just for example, spamming. You're *not* going to run down to your local police station screaming "Mommy! Mommy! He spammed me! Make him stop!" You're not going to do that because (a) it would be silly and because (b) when you got there, even the cops would tell you how silly you were, and how much "real" work they have to do, e.g. monitoring terrorists and catching bank robbers. So basically, all the stuff that we, as rational adult experienced Internet users agree that we *would* want to call LE in on is called "crime". Meanwhile, everything else that we can all agree is "bad" and that "shouldn't happen on the civilized internet" but that *DOES NOT* quite rise to the level where it makes any sense to call in the LE people (e.g. route squatting, spamming) is "abuse". We call this stuff "abuse" rather than "crime" because everybody agrees that it shouldn't happen, but 99.9% of all governments, all around the world, are too stupid to understand any of this stuff, and as a result, you won't find a single country, anywhere in the world, that has formally made route squatting a crime, and also, even my own idiotic country has actually *legalized* spamming. So spamming is not a "crime"... at least not here in the United States, and at least not ACCORDING TO OUR MORONIC LAWS. Spamming *is* however "abuse" on and of the Internet, and most of us, being adult experienced Internet usesrs would and do agree on that, *regardless* of what the law might say in any given meatspace geographical jurisdiction. We know that certain things are "abuse" (e.g. spamming), even if the moronic bribed luddites in our respective national legislatatures do not. So, to review: crime -- Defined as whatever the dumbass meatspace legislators in various dumbass meatspace jurisdictions say it is Internet abuse - Defined as whatever most or all of *us* (actual experienced Internet users with a technical clue) say it is. You can draw a simple Venn diagram, consisting of two circles, each representing the above two things. And there is and will be some overlap, the amount or exact edges of which will be different in each different meatspace jurisdiction. But to the extent that there is overlap, we agree that FOR OUR PURPOSES we prefer that for all those things that might qualify as being -both- "abuse" -and- "crime" we make a judgement call and say that we would prefer LE to just butt out and let us handle it, because if THEY do it, they will either phuck it up (a la Aaron Swartz) or they will waste their precious resources which should be used elsewhere. Regards, rfg

2 1

Re: [anti-abuse-wg] Definition of Abuse
by Ronald F. Guilmette 18 Aug '16

18 Aug '16

ox <andre(a)ox.co.za> wrote: >On Wed, 17 Aug 2016 03:31:49 -0700 >"Ronald F. Guilmette" <rfg(a)tristatelogic.com> wrote: >> I've made three simple points, none of which should really be all that >> difficult to understand. These three points are as follows: >> >> 1) In practice, law enforcement *can't* deal with these things. >> They don't have the resources or, in general, the technical >> competence to even understand them. (See link below.) >> > >They can, and they do. > >an example from two emails ago: >http://www.pcworld.com/article/174651/article.html No. I really can't fathom how you managed to so throughly mis-read that article. You need to go back and read your own reference again. Read the PCWorld article. This time try to comprehend what it actually says. Note that when I said "law enforcement *can't* deal with these things" the specific "things" I was referring to were simple deceptions, perpetrated upon RIPE by various parties in order to obtain number resources. As the PCWorld article makes abundantly clear the police were *already* looking into the various *other* criminal activities of the Russian Business Network, well before there was any interaction between law enforcement and RIPE. And further, by the time that there *was* some interaction between law enforcement and RIPE, it *did not* occur because RIPE had called the police to say "Oh help us! These evil RBN people have tricked us!" Rather, in this case, it was entirely the other way around: Law enforcement came to RIPE to tell RIPE that RIPE was, in effect, guilty of money laundering. That, of course, is yet another example of the generallized "Aaron Swartz principal" which states that *in general* when law enforcement becomes involved in any "cybercrime" matter which *does not* involve some really straightforward crookedness (i.e. a large sum of money being effectively or actually stolen) they routinely screw it up, go overboard, and start blaming all the wrong people. Regards, rfg

2 1

verio.de
by Reza Farzan 18 Aug '16

18 Aug '16

Hello All, Does anyone knows as to what has happened to this domain, "verio.de" [213.198.86.0 - 213.198.86.151]? Sorbs has listed their IPs as unsafe for sending Spam, yet Verio Deutschland GmbH, and their US partner NTT America IP Addressing do not take any action against these violations. Thank you, Reza Farzan

2 1

Re: [anti-abuse-wg] Definition of Abuse
by Ronald F. Guilmette 17 Aug '16

17 Aug '16

ox <andre(a)ox.co.za> wrote: >So, to be clear - I am not saying that I THINK ripe should file >criminal charges (THEY MUST) Well, OK, I did miscounstrue your comments, so for that I apologize. But for all the reasons I've already noted, RIPE NCC actually DO NOT do what you think "THEY MUST". They do not call in the police each time some clever forger flim-flams them. If you think you can change that, by all means, you're free to try. But for all the reasons I've already noted, I do not think that will change, nor do I think it should. I would really rather that law enforcement spend their limited time and resources chasing down terrorists, bank robbers, child molesters, child pornographers, and all such other scum-of-the-earth as deserve their special attention. Regards, rfg

2 1

Current Discussion & List Behaviour
by Brian Nisbet 17 Aug '16

17 Aug '16

Colleagues, I'm on holidays right now, so I haven't been reading the list discussion as assiduously as I otherwise might. However I have noticed that things haven't gotten, in places, less professional than we might otherwise wish. Can I remind you all to please remain civil and to assume good intent on the part of all participants. We are all passionate about this subject, but that doesn't mean we can't discuss it in the best manner. My email reading will continue to be sporadic, at best, at least until next week and probably for another couple of weeks, so please bear this email in mind whenever you are putting finger to keyboard. Thanks, Brian Co-Chair RIPE AA-WG Brian Nisbet Network Operations Manager, HEAnet

1 0

Re: [anti-abuse-wg] Definition of Abuse
by Ronald F. Guilmette 17 Aug '16

17 Aug '16

ox <andre(a)ox.co.za> wrote: >When anyone commits fraud to obtain a resource from RIPE, RIPE has the >responsibility to file criminal charges against that criminal. > >I am not saying that I think RIPE should file criminal charges... I would suggest that you consider running for President of the United States, but we've already got another guy in the race who routinely manages to contradict himself within the space of two consecutive sentences. Regards, rfg

2 1

Re: [anti-abuse-wg] Definition of Abuse
by Ronald F. Guilmette 17 Aug '16

17 Aug '16

ox <andre(a)ox.co.za> wrote: >> Yes, by all means, let's take a violation of contractual terms between >> two private parties and turn it into a law enforcement matter. And > >I am not sure what you mean, maybe you can explain it to me better? I'm not sure what it is that you're not sure about. I've made three simple points, none of which should really be all that difficult to understand. These three points are as follows: 1) In practice, law enforcement *can't* deal with these things. They don't have the resources or, in general, the technical competence to even understand them. (See link below.) 2) In practice, in those rare instances when law enforcement stupidly injects itself into civil contractual disputes, claiming that they have criminal jurisdiction, they usually do so in a ham-fisted way that does more harm than good. (See link below.) 3) Even RIPE NCC legal staff recognize that it would be the height of silly absurdity for them to call in the Dutch police, or Interpol whenever they get snookered by some clever Russian or Egyptian, which happens these days with disturbing regularity due to the fact that RIPE NCC never actually checks anybody's bona fides themselves until *after* some schmo like me raises a stink, by which time it's too late, the number resources have already been allocated, the overt criminality has already begun, and RIPE's own rules require a laborious, lengthy, tedious, and exceptionally time-consuming multi-month process just for them to be able to take back what they should never have handed out in the first place. In effect, RIPE NCC is walking around with a billboard-sized sign on its back saying "CHEAT ME!" and criminals from all over the world, eager to make an illegal buck, are only too happy to oblige them. The following two links support the first two points above: 1) http://www.bbc.com/news/uk-36731694 2) https://en.wikipedia.org/wiki/Aaron_Swartz Regarding point #3, I've suggested... although perhaps not clearly enough... that if you have trouble understanding it, you should do some simple research, i.e.: a) Ask RIPE NCC Legal yourself how many times they have taken a contract breach and gone to law enforcement and filed a criminal complaint on account of that. (Hint: Never.... because they are not stupid, and because they understand points #1 and #2 above.) b) Ask RIPE NCC Legal yourself how they were magically able to verify the bona fides of ORG-IL351-RIPE aka "Icenetworks Ltd." aka "OrangeWebsite.Com", even though there is simply is no way for _any_ mere mortal to verify either the existance of, or, conversely, the non-existance of _any_ Belize company, let alone verifying which human individuals are or are not empowered to enter into legally binding contracts on behalf of such a company. If they give you an answer to that last one, please do let me know. Whatever it is, it is quite likely to be either (a) facinating or (b) laughable, or perhaps (c) both facinating -and- laughable. Regards, rfg

3 2

Re: [anti-abuse-wg] Definition of Abuse
by Sergey 17 Aug '16

17 Aug '16

That's easy. The analogy is weak. Don't mess the Internet with real world things. The Internet has been self-regulated since its birth. Otherwise we'd have govts and not RIRs controlling the number resources. And I hear it all the time that it's specifically RIPE's problem of dealing with rogue sign-ups. 17 августа 2016 г. 11:24:44 GMT+03:00, ox <andre(a)ox.co.za> пишет: >On Wed, 17 Aug 2016 01:11:44 -0700 >"Ronald F. Guilmette" <rfg(a)tristatelogic.com> wrote: >> ox <andre(a)ox.co.za> you wrote: >> >Are fake whois records abuse? I think this is an excellent question >> >and requires discussion. >> >Personally I think filing fake information to a resource is actually >> >a crime called fraud. I am sure that this is also a crime under >> >Dutch law and that the Dutch Law enforcement should investigate >this? >> >> Why yes! (Now why didn't *I* think of that?) >> Yes, by all means, let's take a violation of contractual terms >between >> two private parties and turn it into a law enforcement matter. And > >I am not sure what you mean, maybe you can explain it to me better? > >When one private person/organization steals another private >person/organization's car, it is not theft? > >When one private party lies, cheats and fraudulently obtains something >from another party, it is not fraud? > >Because why? > >Because they are "private parties" ? > >I am so sorry that I am slow in understanding this and than you so much >for taking the time to explain this to me > >Andre -- Простите за краткость, создано в K-9 Mail.

5 8

Re: [anti-abuse-wg] Definition of Abuse
by Suresh Ramasubramanian 17 Aug '16

17 Aug '16

Yes that is what I said about a legal obligation versus good citizenship --srs > On 17-Aug-2016, at 2:46 PM, ox <andre(a)ox.co.za> wrote: > > On Wed, 17 Aug 2016 14:38:09 +0530 > Suresh Ramasubramanian <ops.lists(a)gmail.com> wrote: >> I think the term that's being collectively groped for is whether >> ripe ncc has a reporting obligation in case it discovers criminal >> activity >> >> The number of cases where such reporting is mandatory in law and not >> simply a matter of good citizenship is rather limited - threat to >> life, kidnap, etc. >> > No, not so much... > > It is not a "point of view" whether RIPE has the obligation to file > criminal complaints when there is fraud committed against RIPE > > Under Dutch Law, We have already heard how RIPE is registered... > > In fact, if it was a public company, it would not be much different either.. > > Speaking generally, in most places in the world where you are working > or operating the assets of someone other than yourself their are many > additional things that become relevant to your own operation... > > I think that we may want to hear from RIPE legal in that regard > > But, what I am also saying is that socially, civil society and simple > ethics and good custodial management, basic decency and so very very > many other things demand that RIPE files criminal complaints when there > is crime. > > For example: Should an official of RIPE steal money at RIPE there is an > obligation to file a criminal complaint. > > Same principles apply all throughout > > Andre > > > > >> --srs >> >> On 17-Aug-2016, at 2:26 PM, Rob Evans <rhe(a)nosc.ja.net> wrote: >> >>>> When anyone commits fraud to obtain a resource from RIPE, RIPE has >>>> the responsibility to file criminal charges against that criminal. >>>> >>>> I am not saying that I think RIPE should file criminal charges, I >>>> am saying that not doing so is in itself a questionable action. >>> >>> Well, to be pedantic, *criminal* charges are filed by the police >>> or other law-enforcment body, not by companies. :) >>> >>> Rob >>> > >

2 1

Re: [anti-abuse-wg] Definition of Abuse
by Ronald F. Guilmette 17 Aug '16

17 Aug '16

ox <andre(a)ox.co.za> you wrote: >Are fake whois records abuse? I think this is an excellent question and >requires discussion. > >Personally I think filing fake information to a resource is actually a >crime called fraud. I am sure that this is also a crime under Dutch law >and that the Dutch Law enforcement should investigate this? Why yes! (Now why didn't *I* think of that?) Yes, by all means, let's take a violation of contractual terms between two private parties and turn it into a law enforcement matter. And while we're at it, let's have Interpol come out to your house and cuff you for those rental DVDs you returned 2 days late. Yes, that's obviously the best choice, and the best possible use of limited law enforcement resources. And look at how well it worked out in the Aaron Swartz case! So I'm sure your're right. But you shouldn't rely on just _my_ humble opinion. Why not ask the RIPE NCC legal team how many of those 7 cases of non-financial contract breaches in 2015 and 2016 they called in law enforcement on. I'm sure they'll tell you they did so in all 7 cases... ... or maybe not. >But, imho, fake whois records and/or incorrect whois records, is not >abuse. Yes. What the hell! Let's just turn off the RIPE WHOIS server and then everything will be so much simpler and straightforward. At least then we won't have to wonder anymore. Instead we will be SURE that none of us has the least clue who is actually using which IP ranges, or who takes responsibility for any of them. A rational choice, if ever there was one. Regards, rfg

2 1

82.221.130.64/26
by Ronald F. Guilmette 17 Aug '16

17 Aug '16

Additional information about security issues relating to the 82.221.130.64/26 IP address block: https://forum.eset.com/topic/2121-what-is-this-exactly/

1 0

Re: [anti-abuse-wg] Definition of Abuse
by ox 16 Aug '16

16 Aug '16

On Tue, 16 Aug 2016 14:23:21 +0000 David Hilario <fransossen(a)hotmail.com> wrote: > Hi Andre, > Thank you so much David That is a very complete, informed and direct answer I also do not foresee anything changing anytime soon, or that there is even a need for anything to change, for that matter. We do really need a definition of "abuse" though, as some actions may, or may not be abuse and/or crimes - and when there are general discussions about "abuse" it would be good to know the definition and/or parameters. It would be within the scope of an operational abuse list, to define what abuse is. So, we are still at this last definition: "The non sanctioned use of a resource to infringe upon the usage rights of another resource" Current discussions about what needs to be added still? (add if I am missing anyone or anything please) (1) Gert Doering suggested that "there are legal reason why someone could infringe on someon else's use rights" - added the 'non sanctioned' - seems fine now, Gert? (2) unauthorized access / hacking / and/or breaking in ( Dave Crocker - abuse concerns unauthorized access ) (Andre - breaking in is crime, abuse is use something for bad purpose ) (3) causing damage to others ( Dave Crocker - "and to actions that inflict damage on others" ) ( Michele Neylon - I like the idea of “damage” or “harm” on others The “infringe on usage .. “ thing didn’t seem very clear to me and I don’t see how that would apply to spam etc) (Andre - damage is a result of an action or result of abuse? crime?) > > >Maybe you can help, David? > > > >When RIPE investigates "abuse" what are they investigating? Crimes? > >Criminal activity? Fraud? or actual abuse? > > Short version: > RIPE NCC can only investigate and take actions against resource > holders based on RIPE policy violations and contractual agreement > violations. (With the exception of legal requirements such as court > orders enforceable under dutch law, embargo that apply to Dutch based > organisation, RIPE NCC functions under Dutch law and has to comply at > that level...but those things are outside of the scope of the RIPE > policies) > > Long version: > This is the document you are looking for: > https://www.ripe.net/publications/docs/ripe-640 > > It lists the reasons for being under violations and the eventual > consequences (de-registration of resources, closure of LIR). > > Anything else is actually sort of irrelevant, unless a RIPE policy is > to be put in place against something that would be defined as > "abuse". This would be decided here within the WG and not by the RIPE > NCC. > > The RIPE NCC will then be able to enforce the policy that has been > decided here. > > I don't really foresee any of that changing anytime soon though. > But actions are taken, where actions can be taken by the RIPE NCC, > based on the current set of policies. > > Cheers, > David

1 0

Re: [anti-abuse-wg] Definition of Abuse
by David Hilario 16 Aug '16

16 Aug '16

Hi Andre, >Maybe you can help, David? > >When RIPE investigates "abuse" what are they investigating? Crimes? >Criminal activity? Fraud? or actual abuse? Short version: RIPE NCC can only investigate and take actions against resource holders based on RIPE policy violations and contractual agreement violations. (With the exception of legal requirements such as court orders enforceable under dutch law, embargo that apply to Dutch based organisation, RIPE NCC functions under Dutch law and has to comply at that level...but those things are outside of the scope of the RIPE policies) Long version: This is the document you are looking for: https://www.ripe.net/publications/docs/ripe-640 It lists the reasons for being under violations and the eventual consequences (de-registration of resources, closure of LIR). Anything else is actually sort of irrelevant, unless a RIPE policy is to be put in place against something that would be defined as "abuse". This would be decided here within the WG and not by the RIPE NCC. The RIPE NCC will then be able to enforce the policy that has been decided here. I don't really foresee any of that changing anytime soon though. But actions are taken, where actions can be taken by the RIPE NCC, based on the current set of policies. Cheers, David

1 0

Re: [anti-abuse-wg] Definition of Abuse
by Suresh Ramasubramanian 16 Aug '16

16 Aug '16

Easier to ask – why do other RIRs not have nearly the same high quantum of such issues? What do they do to prevent these, and reclaim resources allocated to bogus entities? --srs On 15/08/16, 8:56 PM, "anti-abuse-wg on behalf of ox" <anti-abuse-wg-bounces(a)ripe.net on behalf of andre(a)ox.co.za> wrote: Unauthorized access is NOT ABUSE, in terms of the current definition: "The non sanctioned use of a resource to infringe upon the usage rights of another resource" And, this is the crux of it all, this defining of "abuse" is exactly why we require a definition.

4 6

Re: [anti-abuse-wg] Definition of Abuse
by Gert Doering 16 Aug '16

16 Aug '16

Hi, On Sun, Aug 14, 2016 at 07:55:01AM +0200, andre(a)ox.co.za wrote: > Definition of Abuse as it should be defined by RIPE > --------------------------------------------------------------------- > > The use of a resource to infringe upon the usage rights of another resource I like this. I'm not sure if there are "false positives", but the general idea feels good, and thinking about it a bit, it seems to match what I consider "abuse" and does not match "non-abuse" - of course, this is now tied to what someone would consider as "infringe upon usage rights". Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279

7 8

Re: [anti-abuse-wg] Definition of Abuse
by Marilson 15 Aug '16

15 Aug '16

“Define abuse” Are you kidding? In this WG? “Complicated” Only for those who feed with the practice of abuse. “meaningless political expression” Are you with nefarious intent? (using Andre words) “it should be defined by RIPE” This just keeps getting better than stand-up comic. Until... Marilson From: anti-abuse-wg-request(a)ripe.net Sent: Monday, August 15, 2016 5:37 AM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 58, Issue 21 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://lists.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Re: Definition of Abuse (Gert Doering) 2. Re: Definition of Abuse (Gert Doering) 3. Re: Definition of Abuse (Sascha Luck [ml]) 4. Re: Definition of Abuse (andre(a)ox.co.za) 5. Re: Definition of Abuse (andre(a)ox.co.za) 6. Unsubscribe (Eoin C. Bair?ad) ---------------------------------------------------------------------- Message: 1 Date: Sun, 14 Aug 2016 21:15:19 +0200 From: Gert Doering <gert(a)space.net> To: andre(a)ox.co.za Cc: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] Definition of Abuse Message-ID: <20160814191519.GM79185(a)Space.Net> Content-Type: text/plain; charset="us-ascii" Hi, On Sun, Aug 14, 2016 at 07:55:01AM +0200, andre(a)ox.co.za wrote: > Definition of Abuse as it should be defined by RIPE > --------------------------------------------------------------------- > > The use of a resource to infringe upon the usage rights of another resource I like this. I'm not sure if there are "false positives", but the general idea feels good, and thinking about it a bit, it seems to match what I consider "abuse" and does not match "non-abuse" - of course, this is now tied to what someone would consider as "infringe upon usage rights". Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279

1 0

Re: [anti-abuse-wg] Definition of Abuse
by Erik Bais 15 Aug '16

15 Aug '16

Hi Andre, > Definition of Abuse as it should be defined by RIPE > --------------------------------------------------------------------- > The use of a resource to infringe upon the usage rights of another resource The core of the problem of a good definition of abuse, is the intend of the action ... And intend is in the eye of the beholder ... I'll give an example : BGP Hijacking ... BGP Leaks ... If someone is doing a BGP Hijacks in order to knowingly divert traffic to harm others, while either the AS or the prefix is not rightfully under their control, it could be considered a Hijack. ( similar as carjacking. ) If those prefixes are used in order to : deny service to the original legitimate owner of the prefix, or an un-used prefix is abused for spewing out spam .. or to regain control of a Command and Control server/infrastructure ( Hacking Team action after Santrex was closing and they stopped announcing their prefixes ... ) there is clear intent to take something that wasn't yours in order to benefit from the outcome. However .. when some Bulgarian dude hijacked a prefix from the Ministry of Foreign Affairs 1.5 years ago, with the intent to spam on it ( Domains were pointed to it and other space they hijacked was also quickly spammed on and abused before released..) it was interesting to learn that hijacking as an Act, isn’t a crime .. (the law doesn't mention it.. it isn't illegal.. hence .. it is legal..) There could be made a case that the wrongful intent is and if they would actually spammed on the space, it is directly a crime.. But they didn't (yet) and they stopped the hijack before spamming on it.. So nothing happened, as if your neighbor borrowed your bike and returned it to your doorstep before you knew it was missing. In the same pristine condition .. It could have been said, this is a denial of service, but as the particular ministry wasn't using the space, nothing was denied ... they didn't even noticed it for a complete week. ((!! ) But that is another topic..) Now let's do a similar thing .. but with Cyber Crime fighting or Anti-Abuse in mind .. here comes the DMCA lobby or TRA (Telecom Regulator Agency in some Middle East country..) or some similar organization that is fond of protecting digital content rights.. And they are going to inject routes in a network, fiddle with BGP routing, in order to take down : Dreambox Key Servers on the internet (useful for free satellite decoding without subscriptions.. ) or phishing sites or command and control servers in $country .. or hell, why not take down the complete /21 of North Korea in the process while we talk about it ... Just because we can.. Who defines the greater good ... who is defining the wrongful intent of party X or party Y. Is the DMCA lobby correct if they want to shutdown some hosters torrent site customer.. or if the hoster correct that they don't take action on it and are not disclosing any information unless they are forced by a court order. There have been BGP injections in the past, to see if that could help in TRA compliance .. just in a subset of AS's. If those actions would have had a larger effect ... ( so large that it would have been noticed outside the region and into (this?) community perhaps.. or in the media.. ) ... who are we going to investigate .. The TRA that would like to enforce their local / regional laws and compliance .. or the violators that are facilitating the dreambox key servers that are sharing satellite subscriptions cards over the internet ... or the actual users of the dreambox in various countries ... In either of these scenario's .. the actual hoster or ISP that is hosting the 'service' on their IP space, is most likely outside the local jurisdiction and might not even be aware ... ( they are naughty/ignorant, that is different from being bad. ) In the near future, we will see a lot of grey actions, done by people that in their own mind and under their local laws, stand in their right to fiddle with your routing, if that means they can enforce local censorship or re-gain access to certain infrastructure or deny $party to their infrastructure when they will have a tactical benefit in this.. ( think Turkey during a coup.. or Syria being completely removed from the internet during attacks in Aleppo.. ) Our community covers a huge set of countries and there are quite a lot of political issues ( there are several countries that are real warzones today in our region.) .. and some of those political issues are corruption ( people getting paid to look the other way .. ) and some are just not dealing with the Spam Source because $investigator is blown out of his mind in the US or France Riviera ... RIPE isn't the internet police and this working group isn't either .. I think we should educate each other on what is going on, keep reporting on the issues we see, specifically around certain rotten area's .. We should refrain from forcing the RIPE NCC in becoming an internet police .. as they are an impartial party (like the Red Cross). They provide resources to those that need/request it.. and register who are using it. The same as the Red Cross, they hand out food to all people. Some of them might pick up a rifle 15 minutes later and shoot someone or sell that food .. but you can't blame the Red Cross for handing out food in certain areas or tell them to change their mission. Disciplinary actions (like de-registration due to abuse for instance) should not be up to the NCC, unless the information provided for registration isn´t correct. Everything else is not within the scope of the NCC imho. It should be taken up to the local law enforcement if things are not in compliance with the law ... And that could be different in each country of this huge service region... Moving into any other direction might be a very slippery slope we are getting ourselves into ... Ambition is good, but we shouldn't outreach our place in this delicate environment ... Regards, Erik Bais

2 3

Unsubscribe
by Eoin C. Bairéad 15 Aug '16

15 Aug '16

Unsubscribe me please Eoin C. Bairéad IT Mazars Block 3 The Harcourt Centre Charlotte Street Dublin 2 phone: +353 (1) 4494490 fax: +353 (1) 4750089 mobile: +353 (87) 2311357 ##################################################################################### Internet communications are not secure and the firm does not accept legal responsibility for the contents of this message. Any views or opinions presented are solely those of the author and do not necessarily represent those of the firm. This message is for the named person's use only. It may contain confidential, proprietary or legally privileged information. You must not, directly or indirectly, use, disclose, distribute, print, or copy any part of this message if you are not the intended recipient. ##################################################################################### ##################################################################################### This e-mail message has been scanned for Viruses and Content and cleared by NetIQ MailMarshal #####################################################################################

1 0

Definition of Abuse
by andre＠ox.co.za 14 Aug '16

14 Aug '16

Definition of Abuse as it should be defined by RIPE --------------------------------------------------------------------- The use of a resource to infringe upon the usage rights of another resource Reasoning: ---------------- The above covers all abuse scenarios and it does not tell anyone what to do or what not to do. It is fair and reasonable and includes everything

1 0