- anti-abuse-wg - mailman.ripe.net

fake abuse lists
by ox 25 May '17

25 May '17

Hello, Can anyone share any experiences with: http://spfbl.net/en/dnsbl/ It seems that they list servers that are used to file complaints with Spamcop and other blacklists - as "spam" servers... They do not de-list these servers, ever, and it seems like a criminal enterprise or services designed to 'punish' or list complainants or victims? there are of course other 'fake' / non maintained and worthless blacklists, like abuse-att.net etc etc. but these generally do not go out of their way to punish victims... What is the best way to fight criminal enterprises that enter data streams and 'hide' / market etc as ethical service providers? Andre

1 0

WannaCry Ransomware
by Richard Leaning 23 May '17

23 May '17

Dear Colleagues, The European cybercrime centre at Europol have asked us to circulate the below. I hope you find it useful and please forward it on to anyone who you may think will benefit from it. Kind regards Richard Leaning External Relations RIPE NCC > Begin forwarded message: > > From: "O3 - European Cybercrime Centre (EC3)" <o3(a)europol.europa.eu> > Subject: @EXT: WannaCry Ransomware > Date: 14 May 2017 at 19:06:20 BST > Cc: "Amann, Philipp" <Philipp.Amann(a)europol.europa.eu>, Mounier, Grégory <gregory.mounier(a)europol.europa.eu>, "Sanchez, Maria" <maria.sanchez(a)europol.europa.eu>, "O372 Advisory Groups Support" <O372(a)europol.europa.eu> > > Dear AG members, > > As you are no doubt aware, we are currently experiencing an unprecedented ransomware attack at a global scale. The malware was detected on 12 May 2017 and has the capability to spread across networks taking advantage of a critical exploit in a popular communication protocol used by Windows systems. > > Many of you have already reached out and are actively involved in containing this threat. However, since we believe that the infection and propagation rate may go up on Monday when people return to their workplaces, we would like to ask you to please help us distribute information that can help contain this threat. To this end, we have compiled a list of recommendations and also prepared an infographic (see attachment). Please feel free to use this information for reaching out to your network and to complement your advice, if and where useful. > > Also, the No More Ransom (NMR) initiative, actively supported by many of you already, remains an essential source of information. Together with you and other partners, we will continue to update the information available via the NMR portal, so it is important to watch this space as well. > > If you want to share any other prevention, protection or awareness information with us, please do not hesitate to contact us. > > Thank you again for your continued support. > > Kind regards, > EC3 Outreach & Support > > -------------------------------- > > If you are a victim or have reason to believe that you could be a victim > > This is link provides some practical advice on how to contain the propagation of this type of ransomware: https://www.ncsc.gov.uk/guidance/ransomware-latest-ncsc-guidance <https://www.ncsc.gov.uk/guidance/ransomware-latest-ncsc-guidance> > > The most important step involves patching the Microsoft vulnerability (MS17-010): > https://technet.microsoft.com/en-us/library/security/ms17-010.aspx <https://technet.microsoft.com/en-us/library/security/ms17-010.aspx> > > A patch for legacy platforms is available here: > https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-w… <https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-w…> > > In instances where it is not possible to install the patch, manage the vulnerability becomes key. One way of doing this would be to disable the SMBv1 (Server Message Block) protocol: > https://support.microsoft.com/en-us/help/2696547 <https://support.microsoft.com/en-us/help/2696547> > and/or block SMBv1 ports on network devices [UDP 137, 138 and TCP 139, 445]. > > Another step would be to update endpoint security and AV solutions with the relevant hashes of the ransomware (e.g. via VirusTotal). > > If these steps are not possible, not starting up and/or shutting down vulnerable systems can also prevent the propagation of this threat. > > How to prevent a ransomware attack? > > Back-up! Back-up! Back-up! Have a backup and recovery system in place so a ransomware infection can’t destroy your personal data forever. It’s best to create at least two back-up copies on a regular basis: one to be stored in the cloud (remember to use a service that makes an automatic backup of your files) and one stored locally (portable hard drive, thumb drive, etc.). Disconnect these when you are done and store them separately from your computer. Your back-up copies will also come in handy should you accidentally delete a critical file or experience a hard drive failure. > Use robust antivirus software to protect your system from ransomware. Always use the latest virus definition/database and do not switch off the ‘heuristic’ functions as these help the solution to catch samples of ransomware (and other type of malware) that have not yet been formally detected. > Keep all the software on your computer up to date. When your operating system (OS) or applications release a new version, install it. If the software you use offers the option of automatic updating, enable it. > Trust no one. Literally. Any account can be compromised and malicious links can be sent from the accounts of friends on social media, colleagues or an online gaming <https://blog.kaspersky.com/teslacrypt-20-ransomware/9314/> partner. Never open attachments in emails from someone you don’t know. Similarly, don’t open attachments in emails from somebody you know but from whom you would not expect to receive such as message. Cybercriminals often distribute fake email messages that look very much like email notifications from an online store, a bank, the police, a court or a tax collection agency, luring recipients into clicking on a malicious link and releasing the malware into their system. If in doubt, call the sender at a trusted phone number to confirm the legitimacy of the message received. > Enable the ‘Show file extensions’ option in the Windows settings on your computer. This will make it much easier to spot potentially malicious files. Stay away from file extensions like ‘.exe’, ‘.com’, ‘.vbs’ or ‘.scr’. Cybercriminals can use several extensions to disguise a malicious file as a video, photo, or document (like hot-chics.avi.exe or report.doc.scr). > If you discover a rogue or unknown process on your machine, disconnect it immediately from the internet or other network connections (such as home Wi-Fi) — this will prevent the infection from spreading. > > > > > ******************* > > DISCLAIMER : This message is sent in confidence and is only intended for the named recipient. If you receive this message by mistake, you may not use, copy, distribute or forward this message, or any part of its contents or rely upon the information contained in it. > Please notify the sender immediately by e-mail and delete the relevant e-mails from any computer. This message does not constitute a commitment by Europol unless otherwise indicated. > > *******************

8 8

First RIPE NCC webinar for law enforcement
by Richard Leaning 17 May '17

17 May '17

Hi all, As many of you know, the RIPE NCC has been actively engaging with law enforcement across Europe to help them gain a better understanding of RIPE NCC tools and services that might be of use in cybercrime investigations. As part of this initiative, on 15 May we held the first in a series of six webinars tailored specifically to police, law enforcement and judiciary working in the area of cybercrime, in collaboration with Europol and CEPOL (the European Union Agency for Law Enforcement Training). You can read more in the news announcement: https://www.ripe.net/publications/news/ripe-ncc-webinars-for-law-enforcement We’ll also publish a more detailed article on RIPE Labs when the webinar series concludes next month. Kind regards, Richard Leaning External Relations RIPE NCC

1 0

Re: [anti-abuse-wg] WannaCry Ransomware
by Marilson 16 May '17

16 May '17

Olaf, You forgot to comment on the real reason for this unending and weekly update for 10 years. These OSs have more holes than Swiss cheese and spying runs wild. Deliberate holes or not they should pay for us to use these tools. But when you say that this product is bad "to spare a few cents on proper development" you are underestimating them. The product is made according to a predetermined purpose. Olaf, read what Phillip Misner, principal security group manager at the Microsoft Security Response Center, wrote: "Seeing businesses and individuals affected by cyberattacks, such as the ones reported today, was painful. Microsoft worked throughout the day to ensure we understood the attack and were taking all possible actions to protect our customers." What moving words! It makes you want to cry ... of anger! They have made Volkswagen pay a high price for a fraud that looks more like a child's play than Microsoft and the NSA do. Oh yes! I forgot that they do what they do to protect us from terrorists ... That's why they read Mutti Merkel's emails and the strategies of competing companies. I would like to know what the Europol EC3 will do. Will pursue a hacker or those who created the virus and the port? Marilson From: HRH Prince Sven Olaf von CyberBunker Sent: Monday, May 15, 2017 4:17 PM To: Marilson ; anti-abuse-wg(a)ripe.net ; rleaning(a)ripe.net Cc: Philipp.Amann(a)europol.europa.eu ; o3(a)europol.europa.eu ; O372(a)europol.europa.eu Subject: Re: [anti-abuse-wg] WannaCry Ransomware Microsoft inc. most definately has been deliberately putting their customers AND third parties at risk with it's "it kinda works - ship it!" business mentality. They have deliberately sold, and are currently selling un-finished premature software and didn't bother to seriously look at their own code for at least 15 years. Until problems started popping up because others did. Their most recent remote execution exploit was discovered by some guy linked to Google, without even having access to the source code. One would say that Microsoft itself could have reviewed their code years ago already, and didn't. In fact microsoft maintains a 'telemetry' (basically espionage) system within windows that reports crashes to them when they occur from customer computers, unknown to those customers. the legal aspects of that too, require investigation. It facilitates tracking of customer activity and ip address data/location. Apperantly they did find time to build in a few 1000 'telemetry points' but not to fix their implementation of a 30 year old IBM network file sharing protocol. By the time they became (officially) aware of the bug, they refused to halt their sales, did not do a recall on systems and install media in the retail chain, and happily continued to deliberately sell their broken product while they were working on some patch. Most likely install media (cds/dvds) and systems containing pre-installed broken versions are still for sale in retail stores now. Then presenting themselves (microsoft) providing a patch for their self-declared 'unsupported' windows xp as being something 'generous' ignoring the fact that their users, which have paid for a working product, have been shipped off with a broken product, endangering them for 15 years. Note that they never even mentioned the words 'REFUND' or 'RECALL' - asking the customer to apply a patch in their own manhours and at their own cost, to fix something that was sold broken to them and is endangering them and others is highly arrogant to say the least. Some of microsoft's customers getting some files encrypted is not a real problem. The real problems with microsoft's business tactics lie in the dangers that come with other possible uses of the same vulnerabilities. Using a wormable remote code execution vulnerability such as the one used by wannacry, one can make laptop batteries explode, ventilators halt and cpus catch fire. (and the buildings they are in shortly afterwards) Using a wormable remote code execution vulnerability such as the one used by wannacry, considering microsoft's installed base and market penetration, one can easily ddos the entire internet down for quite some time. When a few million microsoft machines start to ddos random other ips there won't be any 'downloading patches' anymore, there won't be any downloading of anything anymore for quite a while, as the internet will be completely down, and not just for microsoft customers. Now, I suggest, a certain party with slightly wider-established diplomatic immunity than ours, just hacks and permanently disables all remaining vulnerable nodes with a text display routine in the bootsector telling them how to 1: restore the bootsector and 2: apply the patch or (preferably) install a different operating system. A more proactive approach, such as hacking into and shutting down or force-patching all remaining vulnerable boxes is desired, as well as a criminal investigation into microsoft itself and the way they do product development and bugfixing. Bothering chasing whomever made wannacry and whomever will make the no-doubt 1000s of other worms and virusses exploiting this vulnerability is of no use whatsoever, the -real- problem, is microsoft's way of product development and release. This is not a matter of selling a car without seatbelts, this is a matter of deliberately selling a car where the wheels break off and hit bystanders in the head, to spare a few cents on proper development. Typical american garbage which does not belong on the EU market. Pull them off the road. On 15 ماي, 2017 م 06:35, Marilson wrote: On May 14, 2017 EC3 wrote: > If you want to share any other prevention, protection or awareness information with us, please do not hesitate to contact us. Yeah! I do. Thank you. To prevent, protect and raise awareness, it is necessary to estimate the damage that this virus will cause and to charge this amount from the US Government and Microsoft. Microsoft has created a "flaw", a port for the NSA to spy on governments and businesses around the world. When the "software", created by the NSA, to use that port was hacked, the NSA informed Microsoft that it released a patch to "fix the flaw". And did it quietly, not to arouse suspicion. This distinguished company still tried to get high gains with the misfortune of others by selling patch to OS prior to the W7. Until a young Englishman created a key to unlock hijacked computers. And this patch became free. Do you want to criminalize the hacker who is hijacking computers? Wrong! Be grateful to him as you should be to Snowden. Marilson By honest competition and true capitalism.

1 0

Re: [anti-abuse-wg] WannaCry Ransomware
by Marilson 15 May '17

15 May '17

Peter H wrote: > Why is noone doing something effective against SPAM ? Are you kidding? Do you know what was the AVERAGE DAILY SPAM VOLUME FOR APRIL 2017 ? 394.39 BILLION PER DAY. May 10 2017: Total Email Volume: 505.28 Spam Volume: 430.2 - 85% are spam Be careful what you wish for! Have you tired of living? Marilson

1 0

Re: [anti-abuse-wg] WannaCry Ransomware
by Marilson 15 May '17

15 May '17

On May 14, 2017 EC3 wrote: > If you want to share any other prevention, protection or awareness information with us, please do not hesitate to contact us. Yeah! I do. Thank you. To prevent, protect and raise awareness, it is necessary to estimate the damage that this virus will cause and to charge this amount from the US Government and Microsoft. Microsoft has created a "flaw", a port for the NSA to spy on governments and businesses around the world. When the "software", created by the NSA, to use that port was hacked, the NSA informed Microsoft that it released a patch to "fix the flaw". And did it quietly, not to arouse suspicion. This distinguished company still tried to get high gains with the misfortune of others by selling patch to OS prior to the W7. Until a young Englishman created a key to unlock hijacked computers. And this patch became free. Do you want to criminalize the hacker who is hijacking computers? Wrong! Be grateful to him as you should be to Snowden. Marilson By honest competition and true capitalism. From: anti-abuse-wg-request(a)ripe.net Sent: Monday, May 15, 2017 8:20 AM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 66, Issue 2 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://lists.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. WannaCry Ransomware (Richard Leaning) ---------------------------------------------------------------------- Message: 1 Date: Mon, 15 May 2017 06:57:23 +0100 From: Richard Leaning <rleaning(a)ripe.net> To: "cooperation-wg(a)ripe.net" <cooperation-wg(a)ripe.net>, "anti-abuse-wg(a)ripe.net" <anti-abuse-wg(a)ripe.net> Subject: [anti-abuse-wg] WannaCry Ransomware Message-ID: <5961E790-4494-46F4-A71C-6C34B4DDA8D0(a)ripe.net> Content-Type: text/plain; charset="utf-8" Dear Colleagues, The European cybercrime centre at Europol have asked us to circulate the below. I hope you find it useful and please forward it on to anyone who you may think will benefit from it. Kind regards Richard Leaning External Relations RIPE NCC > Begin forwarded message: > > From: "O3 - European Cybercrime Centre (EC3)" <o3(a)europol.europa.eu> > Subject: @EXT: WannaCry Ransomware > Date: 14 May 2017 at 19:06:20 BST > Cc: "Amann, Philipp" <Philipp.Amann(a)europol.europa.eu>, Mounier, Gr?gory <gregory.mounier(a)europol.europa.eu>, "Sanchez, Maria" <maria.sanchez(a)europol.europa.eu>, "O372 Advisory Groups Support" <O372(a)europol.europa.eu> > > Dear AG members, > > As you are no doubt aware, we are currently experiencing an unprecedented ransomware attack at a global scale. The malware was detected on 12 May 2017 and has the capability to spread across networks taking advantage of a critical exploit in a popular communication protocol used by Windows systems. > > Many of you have already reached out and are actively involved in containing this threat. However, since we believe that the infection and propagation rate may go up on Monday when people return to their workplaces, we would like to ask you to please help us distribute information that can help contain this threat. To this end, we have compiled a list of recommendations and also prepared an infographic (see attachment). Please feel free to use this information for reaching out to your network and to complement your advice, if and where useful. > > Also, the No More Ransom (NMR) initiative, actively supported by many of you already, remains an essential source of information. Together with you and other partners, we will continue to update the information available via the NMR portal, so it is important to watch this space as well. > > If you want to share any other prevention, protection or awareness information with us, please do not hesitate to contact us. > > Thank you again for your continued support. > > Kind regards, > EC3 Outreach & Support > > -------------------------------- > > If you are a victim or have reason to believe that you could be a victim > > This is link provides some practical advice on how to contain the propagation of this type of ransomware: https://www.ncsc.gov.uk/guidance/ransomware-latest-ncsc-guidance <https://www.ncsc.gov.uk/guidance/ransomware-latest-ncsc-guidance> > > The most important step involves patching the Microsoft vulnerability (MS17-010): > https://technet.microsoft.com/en-us/library/security/ms17-010.aspx <https://technet.microsoft.com/en-us/library/security/ms17-010.aspx> > > A patch for legacy platforms is available here: > https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-w… <https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-w…> > > In instances where it is not possible to install the patch, manage the vulnerability becomes key. One way of doing this would be to disable the SMBv1 (Server Message Block) protocol: > https://support.microsoft.com/en-us/help/2696547 <https://support.microsoft.com/en-us/help/2696547> > and/or block SMBv1 ports on network devices [UDP 137, 138 and TCP 139, 445]. > > Another step would be to update endpoint security and AV solutions with the relevant hashes of the ransomware (e.g. via VirusTotal). > > If these steps are not possible, not starting up and/or shutting down vulnerable systems can also prevent the propagation of this threat. > > How to prevent a ransomware attack? > > Back-up! Back-up! Back-up! Have a backup and recovery system in place so a ransomware infection can?t destroy your personal data forever. It?s best to create at least two back-up copies on a regular basis: one to be stored in the cloud (remember to use a service that makes an automatic backup of your files) and one stored locally (portable hard drive, thumb drive, etc.). Disconnect these when you are done and store them separately from your computer. Your back-up copies will also come in handy should you accidentally delete a critical file or experience a hard drive failure. > Use robust antivirus software to protect your system from ransomware. Always use the latest virus definition/database and do not switch off the ?heuristic? functions as these help the solution to catch samples of ransomware (and other type of malware) that have not yet been formally detected. > Keep all the software on your computer up to date. When your operating system (OS) or applications release a new version, install it. If the software you use offers the option of automatic updating, enable it. > Trust no one. Literally. Any account can be compromised and malicious links can be sent from the accounts of friends on social media, colleagues or an online gaming <https://blog.kaspersky.com/teslacrypt-20-ransomware/9314/> partner. Never open attachments in emails from someone you don?t know. Similarly, don?t open attachments in emails from somebody you know but from whom you would not expect to receive such as message. Cybercriminals often distribute fake email messages that look very much like email notifications from an online store, a bank, the police, a court or a tax collection agency, luring recipients into clicking on a malicious link and releasing the malware into their system. If in doubt, call the sender at a trusted phone number to confirm the legitimacy of the message received. > Enable the ?Show file extensions? option in the Windows settings on your computer. This will make it much easier to spot potentially malicious files. Stay away from file extensions like ?.exe?, ?.com?, ?.vbs? or ?.scr?. Cybercriminals can use several extensions to disguise a malicious file as a video, photo, or document (like hot-chics.avi.exe or report.doc.scr). > If you discover a rogue or unknown process on your machine, disconnect it immediately from the internet or other network connections (such as home Wi-Fi) ? this will prevent the infection from spreading. > > > > > ******************* > > DISCLAIMER : This message is sent in confidence and is only intended for the named recipient. If you receive this message by mistake, you may not use, copy, distribute or forward this message, or any part of its contents or rely upon the information contained in it. > Please notify the sender immediately by e-mail and delete the relevant e-mails from any computer. This message does not constitute a commitment by Europol unless otherwise indicated. > > *******************

1 0

Agenda Update - AA-WG Meeting at RIPE 74
by Brian Nisbet 10 May '17

10 May '17

Colleagues, Here is the draft agenda for RIPE 74. The WG meeting is to take place at 11:00CEST on Thursday 11th May. We've added an update from the RIPE NCC in relation to LEA interactions. If there is something else you'd like to discuss, please let me know. A. Administrative Matters * Welcome * Scribe, Jabber, Stenography * Microphone Etiquette * Approve Minutes from RIPE 73 * Finalise agenda B. Update * B1. Recent List Discussion? * B2. C. Policies - * C1. D. Interactions - * D1. Working Groups - DB & Implementation of "abuse-c" * D2. RIPE NCC LEA Interactions Update E. Presentation - * E1. Network & Information Security Directive, Nathalie Falot, NCSC-NL X. A.O.B. Z. Agenda for RIPE 75 -- Brian Nisbet Network Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 0

survey on BGP prefix hijacking
by Alberto Dainotti 25 Apr '17

25 Apr '17

Dear anti-abuse working group, BGP prefix hijacking remains a problem for Internet routing, despite the (partial) use of RPKI or detection services. We would like to hear your opinions on BGP prefix hijacking (concerns, existing defenses, needs, etc.) that would help us research new defense mechanisms both for its detection and mitigation. Please help us by answering this short (< 10min, 21 questions) and anonymous survey. Survey URL: http://tinyurl.com/hijack-survey <http://tinyurl.com/hijack-survey> *** The survey *** This survey is part of a joint research effort by CAIDA (www.caida.org <http://www.caida.org/>) and the ICS-FORTH (www.ics.forth.gr <http://www.ics.forth.gr/>) research institute, to study (a) operator awareness of BGP prefix hijacking attacks/incidents, (b) presently used defenses against BGP prefix hijacking, (c) the willingness to adopt new defense mechanisms, and (d) reasons that may hinder the deployment of BGP prefix hijacking defenses. We expect the findings of this survey to increase the understanding of existing BGP hijacking defenses and the needs of network operators, as well as help us design and implement new defense mechanisms that we will present to the operator and scientific communities. A summary of the aggregate results will be published as a part of an article/conference paper. Thank you in advance, and we look forward to your responses! Alberto (CAIDA) and Pavlos (ICS-FORTH)

1 0

Proposal for fixing "abuse-c:"
by denis walker 18 Apr '17

18 Apr '17

Colleagues I have just sent a proposal to the DB-WG for fixing the issues with "abuse-c:". If you are not subscribed to the DB-WG you can find the proposal:https://www.ripe.net/ripe/mail/archives/db-wg/2017-April/005520.ht… cheers denis co-chair DB-WG

1 0

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 65, Issue 2
by Marilson 18 Apr '17

18 Apr '17

Hi Prince Olaf Thank you so much for taking the time to send me so much information about the potential of governments. As a layman in this subject, this information helped me better to assess the real effects of a policy proposal anti-shutdown which provides for punishment. So I must agree with your point of view: "i don't think this method will have 'sufficient impact' to 'make them think twice'..." Sorry for not posting your text which were banned by the RIPE censors. It is an old habit of the colonizing lords. One day they will learn to live with the contradictory, by hook or by crook. Although I do not agree with your truth about spam, I must respect the way you expose your truth without hypocrisy, without subterfuge, with honesty. I can not say the same about your detractors in this group. Marilson From: anti-abuse-wg-request(a)ripe.net Sent: Sunday, April 16, 2017 7:00 AM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 65, Issue 2 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://lists.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. About introduction of punishments in AFRINIC's policy (Marilson) ---------------------------------------------------------------------- Message: 1 Date: Sat, 15 Apr 2017 19:37:18 -0300 From: "Marilson" <marilson.mapa(a)gmail.com> To: <anti-abuse-wg(a)ripe.net> Subject: [anti-abuse-wg] About introduction of punishments in AFRINIC's policy Message-ID: <CC24BC5A92B14DF59394BDA9F957A7AE@xPC> Content-Type: text/plain; charset="iso-8859-1" Abuse: shut down Internet access for political reasons Abuse authorship: autocratic governments Objective: punishment The RIPE policy list commented and it is under discussion on AFRINIC a policy proposal anti-shutdown which provides for punishment. https://afrinic.net/en/community/policy-development/policy-proposals/2061-a… https://www.theregister.co.uk/2017/04/12/no_ip_addresses_for_countries/ On the ARIN Public Policy Mailing List, a member commented: >Doesn't seem like the most workable policy to my novice eyes. >Is it really a good idea to convert RIRs into the internet police? >if we think it is a good idea, who decides what's a proper case for implementation? That is what I wrote there: To my novice eyes, but tired and disappointed, I find it rather appropriate that the entity responsible for the management and allocation of IP address blocks adopt punitive measures against those who interfere in the free internet or in the inappropriate use of those services. Who decides? The evidence. And the Internet community seems to be the only one capable of putting punitive measures into practice. No matter who we are or what we do, commitment to democracy should always be part of our activities. The owners of these resources is the population of the planet. RIRs manage these resources on behalf of this population and should effectively manage without omitting and transferring that responsibility to governments or to their ISP customers. I say this because, just as there are autocratic governments, there are bad ISPs who arrogantly refuse to punish clients with illicit activities even in the face of evidence. And in the face of these bad providers, governments, without exception, turn a blind eye. They are more concerned about employment within their territory even at the expense of the population being the victim of spammers and scammers. This situation explains and does not justify the 420 billion spam and scam per day (Cisco). Never so few done so much harm to so many. No more shutdowns. No more denying access to information and knowledge. No more bad ISPs. Even with Trump! Marilson

1 0