- anti-abuse-wg - mailman.ripe.net

Re: [anti-abuse-wg] 2011-06 New Policy Proposal (Abuse Contact Management in the RIPE NCC Database)
by Leo Vegoda 31 Jan '12

31 Jan '12

Hi, The proposed policy text includes: "The role objects used for abuse contact information will be required to contain a single "abuse-mailbox:" attribute which is intended for receiving automatic and manual reports about abusive behavior originating the resource holders' networks." Do the proposers intend the requirement for the "abuse-mailbox:" attribute to be enforced in any way and if so, how? Thanks, Leo

11 35

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 5, Issue 13 RE: 1. Response from Dutch DPA (russ@consumer.net)
by Wout de Natris 25 Jan '12

25 Jan '12

1. Response from Dutch DPA (russ(a)consumer.net) Stating up front that I agree with Brian latest response, as I tried to bring subtly to you last week, to close my part to this conversation: No, the DPS does accept e-mails, they have stopped responding to them directly. They refer to their website for referencing and future answers. Russ, there will be no more response from me, as I can't help you further than refering you to the DPA and then it's up to the Commissioner. Regards, Wout - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - De Natris Consult Raaphorst 33 Tel: +31 648388813 2352 KJ Leiderdorp Skype: wout.de.natris denatrisconsult(a)hotmail.nl http://www.denatrisconsult.nl Blog http://woutdenatris.wordpress.com > From: anti-abuse-wg-request(a)ripe.net > Subject: anti-abuse-wg Digest, Vol 5, Issue 13 > To: anti-abuse-wg(a)ripe.net > Date: Tue, 24 Jan 2012 22:00:16 +0100 > > Send anti-abuse-wg mailing list submissions to > anti-abuse-wg(a)ripe.net > > To subscribe or unsubscribe via the World Wide Web, visit > https://www.ripe.net/mailman/listinfo/anti-abuse-wg > or, via email, send a message with subject or body 'help' to > anti-abuse-wg-request(a)ripe.net > > You can reach the person managing the list at > anti-abuse-wg-owner(a)ripe.net > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of anti-abuse-wg digest..." > > > Today's Topics: > > 1. Response from Dutch DPA (russ(a)consumer.net) > 2. Re: Response from Dutch DPA (Brian Nisbet) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 24 Jan 2012 12:45:32 -0500 > From: "russ(a)consumer.net" <russ(a)consumer.net> > Subject: [anti-abuse-wg] Response from Dutch DPA > To: anti-abuse-wg(a)ripe.net > Message-ID: <4F1EEE3C.5000904(a)consumer.net> > Content-Type: text/plain; charset="iso-8859-1" > > Below is the response from the Ducth DPA to my inquiry. From what I > gather from the translation > the Ducth DPA has decided to refuse to accept e-mail inquiries! I need > to translate so I can't call > and I need electronic copies to copy and paste. > > This is why people should not put faith into these regulatory bodies. > Can you image a profit-making > company telling their customers that they will no longer accept e-mail > communications? This is what > happens when you set up all these feel-good regulations with regulatory > bodies who answer to no one. > This is also why RIPE gives all kinds of evasive, contradictory, and > incomplete answers. They know there is > no recourse for the average person so they just say "screw you" and let > you waste your time with these useless > regulatory bodies. Once all the regulatory bodies (like RIPE and the > Dutch DPA) destroy all the > profit-making businesses that support them then they go crying to the > people making money to bail them out. > > Thank You > > Dutch DPA response: > > U heeft het College bescherming persoonsgegevens (CBP) om zijn > emailadres gevraagd om een vraag voor te leggen. > > *_Nieuwe werkwijze CBP_* > > Vanaf 1 juli 2011 beantwoordt het College bescherming persoonsgegevens > (CBP) geen vragen meer per e-mail. Daarom krijgt u geen inhoudelijk > antwoord op uw mail. Wij verwijzen u graag naar onze websites of het > telefonisch spreekuur. U kunt ook een signaal doorgeven aan het CBP. > > *_Informatie op websites CBP_* > > Op MijnPrivacy.nl en CBPweb.nl vindt u veel informatie over privacy en > de bescherming van uw persoonsgegevens. Wellicht staat het antwoord op > uw vraag hier al tussen. Mocht u er toch niet uitkomen, dan kunt u > altijd terecht op het speciale spreekuur voor privacyvragen. > > *_Telefonisch spreekuur voor privacyvragen_* > > Tijdens het spreekuur zijn de publieksvoorlichters van het CBP > rechtstreeks telefonisch bereikbaar. U kunt bellen op werkdagen van 9:30 > uur tot 12:30 uur via 0900-2001 201 (vijf cent per minuut). De > voorlichters helpen u dan verder door het geven van algemene informatie > die van toepassing is op uw vragen. > > *_Signaal geven over privacy_* > > Twijfelt u of er wel zorgvuldig met uw persoonsgegevens wordt omgegaan? > Denkt u dat een bedrijf of organisatie de privacywetgeving overtreedt? > Geef dan een signaal door aan het CBP via het signaalformulier op > MijnPrivacy.nl. > > Het CBP vertrouwt erop u hiermee voldoende te hebben ge?nformeerd. > > Hoogachtend, > > Namens het College bescherming persoonsgegevens, > > Mw. Z. Maazouzi-Makhloufi > > Medewerker Frontoffice Antwoord op uw privacyvragen Heeft u een vraag > over de bescherming van uw persoonsgegevens? U vindt algemene informatie > op de websites www.mijnprivacy.nl en www.cbpweb.nl. Is uw vraag daarmee > niet beantwoord, dan kunt u bellen met het telefonisch spreekuur via > 0900-2001 201 (vijf cent per minuut). Dit spreekuur is bereikbaar op > werkdagen van 09.30 tot 12.30 uur. > >

4 3

Limited access to personal data in bulk
by Kaveh Ranjbar 25 Jan '12

25 Jan '12

Dear colleagues, Following recent discussions on this mailing list regarding personal data, the RIPE NCC would like to clarify a few points. The main issue is the limited access to what is considered personal data. One of the consequences of this limit is our access control system. That system automatically bans IP addresses that hit the daily limit of queries with personal data several times. There are some important points to bear in mind here: - The EU Directive sets minimum requirements for protecting personal data - The RIPE NCC is the secretariat for the RIPE community and as such implements the policies and wishes of the RIPE community - The RIPE NCC does not make any policies - The RIPE NCC itself is neutral regarding the choice of allowing either full or restricted public access to that information in bulk - As part of the RIPE Policy Development Process, the RIPE NCC may recommend a legal review of a policy proposal A few years ago, the RIPE Data Protection Task Force was formed to consider the whole issue of data protection for the data contained within the RIPE Database. After discussing different scenarios and analysing their impacts, the Task Force reported back to the RIPE Database Working Group. It was recognised by the Task Force that all the personal data contained within the RIPE Database must remain publicly available. Each individual personal data set can be queried by using the interfaces made available to the RIPE Database. The RIPE Database Working Group placed a number of action points on the RIPE NCC to implement some features, including restricting access to *bulk* personal data. The current policies impose restrictions on accessing *bulk* personal data to prevent possible abuse of the personal data contained within the database. Imposing any restrictions will have consequences. One of the consequences is restricted access to abuse contacts as currently stored in the RIPE Database. RIPE Policy Proposal 2011-06 is being discussed by the Anti-Abuse Working Group to address this specific issue. This policy will require an abuse contact related to Internet resources. This contact can be clearly marked and documented as a public field that, from the beginning, will not be regarded as personal data and will not be subject to any access restrictions, even bulk access. I would like to emphasise that the RIPE NCC executes the wishes of the RIPE community. When the community reaches consensus for a certain functionality or process, the RIPE NCC will implement and/or execute the functionality or process. In case of legal limitations, the RIPE NCC will strive for a solution that is as close as possible to the original community wishes. The RIPE NCC always reports back on this implementation and its details. There has been a suggestion that what is considered personal data should be publicly available in bulk, without any restrictions. If the community has any concerns about this restriction, perhaps this can be discussed as a specific issue on the Anti-Abuse or RIPE Database Working Group mailing list to determine if there is any consensus within the community to amend this restriction. As always, the RIPE NCC will follow all discussions and will do its best to implement the wishes of the community. The RIPE NCC always welcomes direct feedback from its members and the community. However for issues such as this, addressing concerns directly to the RIPE NCC has little effect because the RIPE NCC does not have the authority to make such a decision on behalf of the community. I hope this has helped explain some background to the concerns and ways to move forward if the issues are not resolved. Please let me know if there are any further questions, or put them to the community using the mailing lists. Kind Regards, Kaveh. --- Kaveh Ranjbar RIPE NCC Database Group Manager

4 6

Regarding distinguish different type of claims into different mail box.
by Lu Heng 20 Jan '12

20 Jan '12

Hi Colleagues: One question very much brother me is that we have setup different mailbox for different kind of abuse claims. But the claim reporter still sending everything to our main abuse mailbox. We want to use abuse(a)outsideheaven.com as network-related abuse mailbox, and copyrightclaims(a)outsideheaven.com as well as trademarkclaims(a)outsideheaven.com for its related issues. And legal(a)outsideheaven.com for crime activity claim that need attention immediately. By that way I can give only the copyright claim and trademark claim mailbox access rights to my lawyers, and they don't have to have the access to the abuse mailbox which contain lot of network abuse report as well(which often related to the detailed sensitive IP information). Vise-versa, my network engineer can focus on take down network abuse but not getting bothered with all the content-related claims. And my partner and I can focus only the most urgent claim but don't have to look every copyright/network abuse claims. We believe this idea can save us a lot of work load in the abuse related issues, and we have see all the other major provider such as godaddy taking the same actions. However, the claim reporter still tend to send everything to abuse(a)outsideheaven.com, even though we had made it very clear in our IP's whois information that all the other claim send to "abuse(a)outsideheaven.com" will be ignored. So I would appreciated if one of you have any knowledge to my following questions: 1. Can we ignore all the other claims sent to abuse(a)outsideheaven.com mailbox since we have made it clear in the whois? Will that make us a big legal trouble afterwards(my lawyer said we can not ignore the copy right claims send to network abuse mail box, but I want to hear your advice as well)? 2. How your guys deal with this problem? If all the abuse report send to single Email address, do your guys have someone just for clear up the mailbox and forward the Email to the right person? 3. Anyone have better idea to this problem other than this distinguish mail box way? I would thank if anyone can help in this issue, even just 2 cents of your thought will be very much appreciated. -- Kind regards. Lu This transmission is intended solely for the addressee(s) shown above. It may contain information that is privileged, confidential or otherwise protected from disclosure. Any review, dissemination or use of this transmission or its contents by persons other than the intended addressee(s) is strictly prohibited. If you have received this transmission in error, please notify this office immediately and e-mail the original at the sender's address above by replying to this message and including the text of the transmission received.

3 2

Wrong AS-SET by LIR
by Астров Николай 18 Jan '12

18 Jan '12

Wrong AS-SET by LIR (inscribed clients long ushedshie from this ISP). Lir not responding to any requests (effectively bankrupt). Where to write for correct? (Not built right routes from some providers - delays and losses). On export / import this AS records should not be in the AS-SET of LIR.

1 0

Status of 2011-06
by Brian Nisbet 18 Jan '12

18 Jan '12

Colleagues, I just wanted to update you all on the current status of 2011-06, as those of you paying close attention to timings may have realised that there should have been some update over the recent Christmas period. Obviously there has been a lot of conversation about the proposal, some positive, some negative and many excellent points have been raised. I've been speaking to the NCC and Tobias about all of this and a course of action has been decided. It is our intent, as WG Chair and proposer, to sit down with the good folks from the NCC in early February and discuss a number of the topics and questions that have been raised by the WG. Out of this discussion will, I suspect and hope, come some revisions to the proposal and answers to some of the queries that have been raised. We hope that any updates to 2011-06 and any responses from the NCC should be with the WG during February. Thanks and a Happy New Year to you all, Brian. Co-Chair, RIPE AA-WG

7 15

Mandate from the RIPE community
by U.Mutlu 17 Jan '12

17 Jan '12

Hi everbody, what do you say to the answer below I got from RIPE? Doesn't RIPE already have a mandate for keeping the whois database uptodate with all the vital public data like contact email address for abuse reporting etc? Normally its just a simple database scan to find the records with such missing vital data, ie. one can even automate this job to periodically request from the owners the missing data. BTW, is the RIPE community somehow organized? Any speaker/contact person etc.? U.Mutlu mutluit.com -------- Original Message -------- Subject: Re: NCC#2012010449 Missing contact data for Abuse Reporting for IP 84.240.196.128 and 84.240.197.0 Date: Wed, 04 Jan 2012 14:38:31 +0100 From: RIPE NCC <ncc(a)ripe.net> Reply-To: RIPE NCC <ncc(a)ripe.net> To: U.Mutlu <security(a)mutluit.com> Dear Mr. Mutlu, Thank you for your email. Indeed there is no email contact but there are some phone contact details that you can find on our DB query page. There may be options we could pursue to check the validity of the contact data in the objects in the RIPE Database. Where we have a direct relationship with the owners of these objects we could request that they update this information. But we do not have a mandate from the RIPE community to allocate any resources to this activity. If you feel this should have a higher priority then you may raise the issue on the Database Working Group or Anti Abuse Working Group or Address Policy Working Group mailing lists. You can find information about the mailing lists here http://www.ripe.net/ripe/groups/wg These are open working groups and views are welcomed from anyone who wishes to discuss relevant issues. Best regards, Natasa Mojsilovic ------------------ Customer Services RIPE NCC ============================================================ Visit www.IPv6ActNow.org, the one-stop website that explains everything you need to know about IPv6. ============================================================ On Wed, 04 Jan 2012 12:56:43 +0100, U.Mutlu wrote: > I want to point you to some missing data in the RIPE DB: > > Your webpage below says about RIPE queries: 'Please do not use the email address in the âchangedâ line.' > ( https://www.ripe.net/data-tools/db/faq/faq-hacking-spamming/what-can-i-do-a… ) > > But the following IP's have no other email contact specified > except those marked as "changed" and "upd-to" (yes I used the "-B" switch): > 84.240.196.128 > 84.240.197.0 > > And also the Abuse Finder page at https://apps.db.ripe.net/search/abuse-finder.html > doesn't find any abuse contact for these IPs. > > Regards, > > U.Mutlu > SysAdm mutluit.com

7 11

What to do if ISP rejects Abuse Reports?
by U.Mutlu 15 Jan '12

15 Jan '12

Hello, my systems get attacked from several IPs from Georgia (Countrycode=GE, RIR=RIPE). My Abuse Reports to the abuse address (ib(a)caucasus.net) of the responsible ISP for the attacker IPs (caucasus.net) just bounce: #ID: <SCC9B> #Mail From: <security(a)mutluit.com> #Rcpt To: <ib(a)caucasus.net> #Server: <mail.caucasus.net> [62.168.168.131] # #[<02>] The reason of the delivery failure was: # #550 5.7.1 <security(a)mutluit.com>: Sender address rejected: Blocked by postmaster What to do in this case?

2 1

Re: [anti-abuse-wg] Spam FAQs need revision, was 2011-06 New Policy
by Joe St Sauver 29 Dec '11

29 Dec '11

Hi Laura, You mentioned: #We have published new FAQs on spam/hacking. You can find them online at: # http://www.ripe.net/data-tools/db/faq/faq-hacking-spamming Tremendous improvement, thank you! One suggestion for the last item ("Where can I find out more about spam/hacking?"), which currently only has two items, would be to add additional resources, perhaps: -- Messaging Anti-Abuse Working Group (http://www.maawg.org/) -- Spamhaus (http://www.spamhaus.org/) -- Spamwiki (http://spamtrackers.eu/wiki/index.php/Main_Page) Thanks for all the work on this, Merry Christmas/Happy New Year! Regards, Joe

14 41

Spam FAQs, Whois Query Restrictions etc
by Brian Nisbet 20 Dec '11

20 Dec '11

Morning, There's been an amount of useful discussion recently, but I think it might be all getting a little circular at this point. I'd like to thank the NCC, as others have done, for their work in updating the FAQs and I'm very glad the overall response has been positive. On the matter of network-tools.com and the whois restrictions, I think the point has been presented and argued, but it has also been argued against and I don't think we're getting anywhere. Russ, if you want to take this any further you have the option of lobbying the NCC directly either as or via a member, or seeing what's possible via the policy route. The Chairs of the working group (aa-wg-chairs(a)ripe.net) are happy to help you with the latter. I don't think that claims about other companies, especially those that involve judicial proceedings, are useful, and they are even less useful if they cannot be backed up, so let's not have any of that on the list please. Thanks, Brian.

1 0