Update on police order of 8 November
Dear all, In the interest of transparency, I'd like to update you on the Dutch police order issued to the RIPE NCC on 8 November 2011 to temporarily lock a registration of four IP address blocks in the RIPE Registry until 22 March 2012. As mentioned earlier, we are working on full disclosure of the background documents. You can read a copy of the police order here: https://www.ripe.net/lir-services/member-support/police-order-8-november-201... We will update you if and when any other publishable materials become available. We have received independent legal advice and are in discussion with the appropriate authorities. We intend to pursue this matter further in Dutch court to establish a precedent so that we are certain of our rights regarding such orders. The RIPE NCC is committed to acting in the best interest of its membership and we will continue to inform you and the Internet community on this matter as it progresses. I'd also like to take this opportunity to clarify that we have not withdrawn, removed or reclaimed the address blocks in question. kind regards, Axel
Hi Axel, Thanks for the copy of the police order. I'll do a quick translation of the document for those that are not so into Dutch. (Probably within the next 2 days. Depending on the workload in the office) For the people that didn't read the security fora and want to see how those frozen prefixes look in the www.ripe.net/whois. https://apps.db.ripe.net/whois/lookup/ripe/inetnum/85.255.112.0-85.255.127.2... https://apps.db.ripe.net/whois/lookup/ripe/inetnum/213.109.64.0-213.109.79.2... https://apps.db.ripe.net/whois/lookup/ripe/inetnum/93.188.160.0-93.188.167.2... https://apps.db.ripe.net/whois/lookup/ripe/inetnum/77.67.83.0-77.67.83.255.h... The above mentioned details can also be found in the FBI file found at : http://www.fbi.gov/news/stories/2011/november/malware_110911/DNS-changer-mal... ( Source : http://isc.sans.edu/diary/Operation+Ghost+Click+FBI+bags+crime+ring+responsi... ) Regards, Erik Bais
See below the rough translation of the Dutch order from the Police. Please keep in mind, I'm not a laywer or a legal Dutch English translator, so there might be some specific wording used that isn't 100%. It will however give a good indication of the overall intention of the document handed to RIPE. Regards, Erik Bais You can read an original Dutch copy of the police order here: https://www.ripe.net/lir-services/member-support/police-order-8-november-201... My English translation: Order based on article 2 of the police law. To protect the public order and maintain order Signed by G.A. Wind, Inspector of the Police, active at the team High Tech Crime of the Dienst National Recherche of the Korps Landelijke Politiediensten, Considering that: - By the authorized authorities of the United States of America, a criminal investigation is started to investigate the un-authorized installations of malware software on several million computer systems in the US and abroad, including the laundry of criminal profits. - These facts are punishable by Dutch law, based on (among others) the articles 138ab, 139B, 140, 350a and 420bis of the Dutch Wetboek van Strafrecht (Dutch Law book for criminal Law) - These punishable facts are an immediate threat to the Dutch public order. - On December 14th 2010 by the authorized authorities of the USA, the Dutch authorities received a request for assistance to assist in the investigation of the US case. - On November 3th, 2011, by the authorized authorities of the USA, an additional request was done to the Dutch authorities, based on a decree by Honorable William H. Pauley III, US district judge, Southern District of New York, on Nov. 3th 2011. - The US court order has impact on the activities of all Regional Internet Registrars (RIR) in the world, of which Resaux IP European Network Coordination Center (RIPE NCC) has their office (seat) in Amsterdam. Page 2 The US judge (??**) (*probably judge was intended, as it was poorly translated into Dutch*) orders every RIR to take the following measurements to prevent: o The suspects in the US investigation will transfer the control of the relevant registrations of a couple specific IP ranges in the public register. o The suspects in the US investigations will alter the relevant registration(s) of a specific set of IP ranges in the public register, unless specifically approved by the FBI of the US attorney's office for the Southern District of New York. o The suspects in the US investigation a specific set IP address registration (IP address records) transfer to someone else, unless specifically approved by the FBI of the US attorney's office in the Southern District of New York. Ordered by the (Officier van Justitie) (the Dutch) Public Prosecutor of the Public Office, mr. L.J.A. van Zwieten, Hereby orders: RIPE NCC with offices in Amsterdam To protect the public order and maintain the order to act accordingly to the US court order for the following IP ranges: XXXXXXXXXXXXXX XXXXXXXXXXXXXX XXXXXXXXXXXXXX XXXXXXXXXXXXXX For the compliance to the order, it is expected to report compliance to the person who signed this order no later than November 8th 2011. In case it is technically not possible to execute the order, it is expected that you, no later than November 8th 2011, notify the person who signed this order. This measurement should be in place for the period November 8th 2011 up to and including March 22nd, 2012. This order is signed and handed over on the November 8th, 2011 G.A. Wind <insert Signature / stamp > For receipts: RIPE NCC
participants (2)
-
Axel Pawlik -
Erik Bais