- RIRs-LEA - mailman.ripe.net

FW: Framework for GDPR Fines Published by the Dutch Authorities
by Leslie Nobile 09 Apr '19

09 Apr '19

Thought you guys might be interested in the information below. It is a blog from a US based attorney who we used to work with. Best, Leslie From: Melise Blakeslee <melise(a)achievedcompliance.com> Reply-To: "melise(a)achievedcompliance.com" <melise(a)achievedcompliance.com> Date: Tuesday, April 9, 2019 at 10:32 AM To: Leslie Nobile <leslie(a)arin.net> Subject: Framework for GDPR Fines Published by the Dutch Authorities [Image removed by sender. This is my logo]<https://t.e2ma.net/click/cfnmv/sfy354/wucc3c> PRIVACY BLOG Updates and Analysis on GDPR, Global Privacy, Cybersecurity, Compliance and the Law. [Image removed by sender.] Framework for GDPR Fines Published by the Dutch Authorities The Dutch Data Protection Authority (AP) has announced a new policy for determining the fines to be imposed for violations of the General Data Protection Regulation (GDPR) and its national implementing act. The AP’s assessment will first take into account the maximum amounts specified by the European Regulation: either 10 million euros or 2% of the annual worldwide turnover, or 20 million euros or 4% of the annual worldwide turnover, depending on the violation incurred. Violations that are subject to fines are divided into three or four categories designed by the data protection authority to take into account the weight of the breached requirements, with each assigned a minimum-maximum fine range. According to the policy regarding cases of violations subject to a maximum fine of 10 million euros or 2% of the annual worldwide turnover, the failure to appropriately record processing activities in accordance with GDPR’s Article 30 would fall in categories I or II and be subject to fines of € 0 - € 200,000 or € 120,000 - € 500,000 respectively. Failure to cooperate with the Supervisory Authority or to notify it of an incident falls within category III and results in fines of € 300,000 - € 750,000. When violations give rise to the maximum fine of 20 million euros or 4% of the annual turnover, failure to comply with the rights of access, rectification or erasure fall within category III, while non-compliance with an order from the supervisory authority falls within category IV and can result in fines of € 450,000 - € 1,000,000. Within the ranges, the AP will adjust the level of fines based on many relevant factors, including: • the nature, seriousness and duration of the infringement; • the number of affected data subjects and the extent of the damage • the nature and extent of the data compromised; • whether the infringement was intentional or the result of negligence; • the measures taken by the controller or processor to limit the damage suffered by affected individuals; • the extent to which the controller or processor is responsible in view of the technical and organizational measures that it has implemented; • previous relevant breaches by the controller or processor; • the extent to which the offending party has cooperated with the supervisory authority; • the categories of personal data involved; • the manner in which the supervisory authority became aware of the infringement, in particular whether, and if so to what extent, the controller or processor has reported the infringement. The policy reaffirms the importance given by the GDPR to the Principle of Accountability. It states clearly that fines may be reduced if an offender is able to prove that it has taken appropriate steps to comply with the regulation, to limit the damage to Data Subjects, and to cooperate with the Data Protection Authority. Both the original policy in Dutch and Achieved Compliance’s English translation are available to read here<https://t.e2ma.net/click/cfnmv/sfy354/cndc3c>. READ MORE BLOGS<https://t.e2ma.net/click/cfnmv/sfy354/sfec3c> Before any tool can be useful, GDPR demands a combination of review, risk analysis and thoughtful decision-making on the part of your company. The PRIVACY BLOG<https://t.e2ma.net/click/cfnmv/sfy354/87ec3c> by Achieved Compliance can help you stay on top of compliance and regulators’ expectations in the complex world of data compliance. [Image removed by sender.] [Image removed by sender.] Achieved Compliance brings together experience and innovation, breaking new ground in data privacy compliance. With combined 60 years of experience in data protection in client counseling, government, and Fortune 100 companies, Achieved Compliance provides companies with a software-guided, team-oriented solution that helps them easily and cost-effectively comply with complex privacy requirements around the globe. +1-571-366-1784 info(a)achievedcompliance.com<mailto:info@achievedcompliance.com?subject=Privacy%20Blog> Share this email: [Image removed by sender. Email]<https://t.e2ma.net/share/outbound/e/cfnmv/sfy354> [Image removed by sender. Twitter]<https://t.e2ma.net/share/outbound/t/cfnmv/sfy354> [Image removed by sender. Facebook]<https://t.e2ma.net/share/outbound/f/cfnmv/sfy354> [Image removed by sender. LinkedIn]<https://t.e2ma.net/share/outbound/l/cfnmv/sfy354> Manage<https://app.e2ma.net/app2/audience/signup/1877171/1888902/1867437702/?s=mNi…> your preferences | Opt out<https://t.e2ma.net/optout/cfnmv/sfy354?s=n5ElB5IaSriOvSDWwfSbvkOEbvhGZ4WM0v…> using TrueRemove™ Got this as a forward? Sign up<https://app.e2ma.net/app2/audience/signup/1877171/1888902.35848838/> to receive our future emails. View this email online<https://t.e2ma.net/message/cfnmv/sfy354>. 1800 Diagonal Road Suite 600 Alexandria, VA | 22314 US This email was sent to leslie(a)arin.net. To continue receiving our emails, add us to your address book. <leslie(a)arin.net>

1 0

LEA side event @ICANN62
by Carlos M. Martinez 20 Sep '18

20 Sep '18

Folks, sorry for the delay. Here is a brief report of the LEA side event at ICANN 62 in Panama City. Also attached you will find a scan of the event's agenda and a PDF file with the slides I used. The deck is in Spanish, but I have a slightly older version in English as well. Just let me know if you need/want it. cheers! /Carlos

3 3

Fwd: @EXT: Invitation 6th edition of the INTERPOL-Europol Cybercrime Conference (Singapore, 18-20 Sept 2018)
by Richard Leaning 18 Jun '18

18 Jun '18

Dear All, I know we haven’t been using this mailing list much but i would like to change that. I think this year (2018), that we need more than ever to reconnect and speak to each other often. Theres a lot happen in all our regions and i thinks its important that we keep each other up to date. I have added Jaime Gillespie from APNIC, who is an Internet security specialist, so will be a valuable addition to this group. So firstly please see the invitation to the Interpol/Europol conference in Singapore in September. Am reaching out to Europol to see if they would like us to present. I think it would be beneficial if we had a monthly conference call, what do people think? If there are members on this list that wish to be removed please let me know and if there are others that need to be added, then also let me know. Cheers Dick Richard Leaning External Relations RIPE NCC > Begin forwarded message: > > From: O372 Advisory Groups Support <O372(a)europol.europa.eu> > Subject: @EXT: Invitation 6th edition of the INTERPOL-Europol Cybercrime Conference (Singapore, 18-20 Sept 2018) > Date: 5 March 2018 at 08:05:06 GMT > To: O372 Advisory Groups Support <O372(a)europol.europa.eu> > Cc: Mounier, Grégory <gregory.mounier(a)europol.europa.eu>, "Wittfoth, Mark" <Mark.Wittfoth(a)europol.europa.eu>, "Rivera Prieto, Patricia" <Patricia.Rivera-Prieto(a)europol.europa.eu>, "Sanchez, Maria" <maria.sanchez(a)europol.europa.eu> > > Dear AG Members, > > Please find below the save the date letter for the 6th edition of the INTERPOL-Europol Cybercrime Conference, which will take place at the headquarters of the INTERPOL Global Complex for Innovation (IGCI) in Singapore from 18 to 20 September 2018. > Official invitations and draft agenda will follow in due time (June). > > For now, mark your calendars so you don’t miss it! > > Kind Regards, > > O372 Advisory Group Secretariat > EUROPOL – European Cybercrime Centre (EC3) > > E- mail: O372(a)europol.europa.eu <mailto:O372@europol.europa.eu> > Twitter: @EC3 Europol > www.europol.europa.eu/ec3 <http://www.europol.europa.eu/ec3> > > > > > > > > > ******************* > > DISCLAIMER : This message is sent in confidence and is only intended for the named recipient. If you receive this message by mistake, you may not use, copy, distribute or forward this message, or any part of its contents or rely upon the information contained in it. > Please notify the sender immediately by e-mail and delete the relevant e-mails from any computer. This message does not constitute a commitment by Europol unless otherwise indicated. > > *******************

5 9

Fwd: @EXT: IPOL-EPOL Cybercrime Conference – call for speakers
by Richard Leaning 09 May '18

09 May '18

Dear All, As you probably all know am i member of Europol’s Advisory group on communication’s and have received this email as part of that group. Basically they are looking for speakers that can present on one of the 4 ‘blocks’ described below. I have thought about this and feel that we cant add any substantial value as a proposer/speaker etc. We can of course contribute to the discussion from the floor. At these type's of Global LE conferences, its important to be seen as ‘one’, therefore i would like your views/comments on what you think. Cheers Dick Richard Leaning External Relations RIPE NCC > Begin forwarded message: > > From: O372 Advisory Groups Support <O372(a)europol.europa.eu> > Subject: @EXT: IPOL-EPOL Cybercrime Conference – call for speakers > Date: 27 April 2018 at 15:32:21 BST > Cc: O372 Advisory Groups Support <O372(a)europol.europa.eu>, "Sanchez, Maria" <maria.sanchez(a)europol.europa.eu>, "Wittfoth, Mark" <Mark.Wittfoth(a)europol.europa.eu>, "Merletti, Francesca" <Francesca.Merletti(a)europol.europa.eu>, Mounier, Grégory <gregory.mounier(a)europol.europa.eu> > > Dear AG members, > > As you know, the 5th edition of the IPOL-EPOL Cybercrime Conference will take place from 18 to 20 September in Singapore. > > We have started defining the agenda and the initial outline is expected to reflect 4 main very broad blocks: > > Cyber Criminals and their Networks > Applications of Holistic Approach against Cybercrime > Urgent Response against High Impact Cyber Dependent Threats > Intelligence-led Coordinated Action against Globalized Cybercrime > > > Each block is to last half a day, combining individual presentations with a panel discussion (per block). > > We would like to open the opportunity to all our closer partners to express their interest in participating as speakers during the event. > To this end, please send us an email with the name of the potential speaker, the topic suggested (with an explanation of what is about) and the block. > > Due to the space/time limitation we cannot guarantee that all proposals will be taken on board, but we will do our best to allocate time slots in a balanced manner among the 3 AGs. > > Please submit your proposals by 8th of May the latest. > > Many thanks. > > > Kind regards, > > Patricia Rivera Prieto > > on behalf of > EC3 O372 Advisory Group Secretariat > European Cybercrime Centre (EC3) > > > > www.europol.europa.eu/ec3 <http://www.europol.europa.eu/ec3> > > > > ******************* > > DISCLAIMER : This message is sent in confidence and is only intended for the named recipient. If you receive this message by mistake, you may not use, copy, distribute or forward this message, or any part of its contents or rely upon the information contained in it. > Please notify the sender immediately by e-mail and delete the relevant e-mails from any computer. This message does not constitute a commitment by Europol unless otherwise indicated. > > *******************

2 1

OAS, Interpol and ICANN Join Forces Again to Train Law Enforcement Agencies in Latin America - ICANN
by Richard Leaning 09 May '18

09 May '18

FYI https://www.icann.org/news/blog/oas-interpol-and-icann-join-forces-again-to… OAS, Interpol and ICANN Join Forces Again to Train Law Enforcement Agencies in Latin America Internationalized Domain Name ,IDN,"IDNs are domain names that include characters used in the local representation of languages that are not written with the twenty-six letters of the basic Latin alphabet ""a-z"". An IDN can contain Latin letters with diacritical marks, as required by many European languages, or may consist of characters from non-Latin scripts such as Arabic or Chinese. Many languages also use other types of digits than the European ""0-9"". The basic Latin alphabet together with the European-Arabic digits are, for the purpose of domain names, termed ""ASCII characters"" (ASCII = American Standard Code for Information Interchange). These are also included in the broader range of ""Unicode characters"" that provides the basis for IDNs. The ""hostname rule"" requires that all domain names of the type under consideration here are stored in the DNS using only the ASCII characters listed above, with the one further addition of the hyphen ""-"". The Unicode form of an IDN therefore requires special encoding before it is entered into the DNS. The following terminology is used when distinguishing between these forms: A domain name consists of a series of ""labels"" (separated by ""dots""). The ASCII form of an IDN label is termed an ""A-label"". All operations defined in the DNS protocol use A-labels exclusively. The Unicode form, which a user expects to be displayed, is termed a ""U-label"". The difference may be illustrated with the Hindi word for ""test"" — परीका — appearing here as a U-label would (in the Devanagari script). A special form of ""ASCII compatible encoding"" (abbreviated ACE) is applied to this to produce the corresponding A-label: xn--11b5bs1di. A domain name that only includes ASCII letters, digits, and hyphens is termed an ""LDH label"". Although the definitions of A-labels and LDH-labels overlap, a name consisting exclusively of LDH labels, such as""icann.org"" is not an IDN." Richard Leaning RIPE NCC External Relations (Sent by iPhone)

1 0

Fwd: Invitation to Contribute to IGF Best Practice Forum on Cybersecurity
by Richard Leaning 14 Sep '17

14 Sep '17

Dear All, Am forwarding this on behalf of the IGF - if you could please have a look and if you have time complete and send back :-) The end date of 15th September (tomorrow) is a very soft end date. Cheers Dick Richard Leaning External Relations RIPE NCC > Begin forwarded message: > > From: IGF <IGF(a)unog.ch> > Subject: Invitation to Contribute to IGF Best Practice Forum on Cybersecurity > Date: 15 August 2017 at 18:49:24 BST > To: rleaning(a)ripe.net > > Dear Mr. Leaning, > > As an individual/organization with relevant expertise, the 2017 Internet Governance Forum (IGF) Best Practice Forum (BPF) on Cybersecurity would like to kindly invite you to contribute to its output document this year. Contributions are made within 15 September 2017 using the questionnaire provided below, which has also been posted as a public call on the IGF’s website <https://www.intgovforum.org/multilingual/content/bpf-on-cybersecurity-2017-…>. > > The BPF on Cybersecurity, a mulitstakeholder and bottom-up group of experts and practitioners, is now in its second cycle. Its work builds on its discussions and output document in 2016 <http://www.intgovforum.org/multilingual/content/bpf-cybersecurity-2016>, which explored improved collaboration and cooperation among stakeholders on cybersecurity matters, to identify in 2017 the potential cybersecurity implications of policies for universal access and achieving the Sustainable Development Goals (SDGs). More details on this are available in the Overview below, as is a list of Relevant Reading and all instructions related to submissions. > > In the hope that you will respond positively to this request, we thank you in advance for your valuable inputs. > > Should you have any questions, please do not hesitate to reach out to the Secretariat, lead expert Mr. Maarten van Horenbeeck (maarten(a)first.org), and/or the BPF’s co-facilitators, Mr. Olusegun Olugbile (solugbile(a)gmail.com) and Mr. Markus Kummer (kummer.markus(a)gmail.com). > > With kind regards, > > Eleonora Mazzucchi > IGF Secretariat > > > > > > > BPF on Cybersecurity 2017 - Call for Contributions > > > All stakeholders are invited to submit written contributions addressing the below questions and issues to the 2017 IGF <https://www.intgovforum.org/multilingual/lexicon/8> BPF <https://www.intgovforum.org/multilingual/lexicon/8> on Cybersecurity mailing list (subscribe: https://www.intgovforum.org/mailman/listinfo/bp_cybersec_2016_intgovforum.o… <http://www.intgovforum.org/mailman/listinfo/bp_cybersec_2016_intgovforum.org>) by 15 September 2017. While it is envisioned that initial drafting of the output document will begin on 15 September, this should be considered a soft deadline as contributions will be welcome after the 15th of September, particularly contributions from IGF National and Regional Initiatives (NRIs) and from other relevant entities or organisations who may be holding meetings relating to cybersecurity prior to the IGF annual meeting in December. > > > Contributions will then be compiled and synthesized by the Secretariat, and further circulated to the community for comment and further work towards an output document for the BPF to be presented at the 12th IGF in Geneva, Switzerland from 18-21 December. > > > All individuals and organizations are asked to kindly try to keep their contributions to no more than 2-3 pages, and are encouraged to include URLs/Links to relevant information/examples/best practices as applicable. When including specific examples or detailed proposals, those may be included as an Appendix to the document. Please attach contributions as Word Documents (or other applicable non-PDF text). > > > Overview: > > > During 2015 and 2016, the Policy Options for Connecting and Enabling the Next Billion(s) (CENB) activity within the Internet Governance Forum identified two major elements: > > · Which policy options are effective at creating an enabling environment, including deploying infrastructure, increasing usability, enabling users and ensuring affordability; > · How Connecting and Enabling the Next Billion(s) contributes to reaching the new Sustainable Development Goals (SDGs). > > > > The Best Practice Forum on Cybersecurity realizes that making Internet access more universal, and thus it supporting the SDGs, has significant cybersecurity implications. Well-developed cybersecurity helps contribute to meeting the SDGs. Poor cybersecurity can reduce the effectiveness of these technologies, and thus limit our opportunities to helping achieve the SDGs. > > > BPF participants have conducted an initial study of how the policy proposals compiled as part of CENB Phase I and II may affect, or be affected by, cybersecurity implications. > > > As part of this ongoing effort, the IGF is now calling for public input to collect additional risks and cybersecurity policy recommendations that can help mitigate security impacts, and help ensure ICTs and the Internet continue to help contribute to achieving the SDGs. > > > Relevant reading: > > > Summary Records of the BPF > https://www.intgovforum.org/multilingual/content/bpf-cybersecurity-1 <https://www.intgovforum.org/multilingual/content/bpf-cybersecurity-1> > > > UN Sustainable Development Goals - http://www.un.org/sustainabledevelopment/sustainable-development-goals/ <http://www.un.org/sustainabledevelopment/sustainable-development-goals/> > > > Policy Options for Connecting & Enabling the Next Billion(s) - Phase II > https://www.intgovforum.org/multilingual/index.php?q=filedepot_download/341… <https://www.intgovforum.org/multilingual/index.php?q=filedepot_download/341…> > > > Security focused reading of CENB Phase I - > https://www.intgovforum.org/[link to be completed] <https://www.intgovforum.org/%5blink%20to%20be%20completed%5d> > > > Security focused analysis of CENB Phase II - > https://www.intgovforum.org/[link to be completed] <https://www.intgovforum.org/%5blink%20to%20be%20completed%5d> > > > Questions: > > · How does good cybersecurity contribute to the growth of and trust in ICTs and Internet Technologies, and their ability to support the Sustainable Development Goals (SDGs)? > · How does poor cybersecurity hinder the growth of and trust in ICTs and Internet Technologies, and their ability to support the Sustainable Development Goals (SDGs)? > > · Assessment of the CENB Phase II policy recommendations identified a few clear threats. Do you see particular policy options to help address, with particular attention to the multi-stakeholder environment, the following cybersecurity challenges: > > > o Denial of Service attacks and other cybersecurity issues that impact the reliability and access to Internet services > o Security of mobile devices, which are the vehicle of Internet growth in many countries, and fulfill critical goals such as payments > > o Potential abuse by authorities, including surveillance of Internet usage, or the use of user-provided data for different purposes than intended > > o Confidentiality and availability of sensitive information, in particular in medical and health services > > o Online abuse and gender-based violence > > o Security risks of shared critical services that support Internet access, such as the Domain Name System (DNS), and Internet Exchange Point (IXP) communities > > o Vulnerabilities in the technologies supporting industrial control systems > > o Use of information collected for a particular purpose, being repurposed for other, inappropriate purposes. For instance, theft of information from smart meters, smart grids and Internet of Things devices for competitive reasons, or the de-anonymization of improperly anonymized citizen data > > o The lack of Secure Development Processes combined with an immense growth in the technologies being created and used on a daily basis > > o Unauthorized access to devices that take an increasing role in people’s daily lives > > o Other: describe a cybersecurity issue critical to developing the SDGs in ways not listed above relevant to your stakeholder community (100 words or less) > > > · Many Internet developments do not happen in a highly coordinated way - a technology may be developed in the technical community or private sector, and used by other communities and interact in unexpected ways. Stakeholders are managing complexity. > This both shows the strength and opportunities of ICTs and Internet Technologies, but also the potential risks. New technologies may be insufficiently secure, resulting in harms when they are deployed: conversely we may adopt security requirements or measures that prevent the development, deployment, or widespread use of technologies that would generate unforeseen benefits. Where do you think lies the responsibility of each stakeholder community in helping ensure cybersecurity does not hinder future Internet development? > · Where do you think lies the responsibility of each stakeholder community in helping ensure cybersecurity does not hinder future Internet development? > > > · What is for you the most critical cybersecurity issue that needs solving and would benefit most from a multi-stakeholder approach within this BPF? Should any stakeholders be specifically invited in order for this issue to be addressed?

1 0

Europol PDP: Abuse-c
by Richard Leaning 06 Sep '17

06 Sep '17

Dear All, This Thursday, 7th September. Europol will publish their first PDP (a second one will be published in a couple of weeks) on our AA-WG mailing list. The PDP as discussed before is around the Abuse-c validation. Cheers Dick Richard Leaning External Relations RIPE NCC

1 0

FBI/LE policy proposal to ARIN
by Richard Leaning 29 Mar '17

29 Mar '17

Dear All, The FBI’s policy proposal to ARIN has made it through the first stage and will be presented Monday afternoon of the ARIN meeting. The link to the proposal is below. https://www.arin.net/policy/proposals/2017_3.html <https://www.arin.net/policy/proposals/2017_3.html> I have not yet seen the final draft proposal to RIPE from Europol, am at Europol next week and will try and find out what is happening. Cheers Dick Richard Leaning External Relations RIPE NCC

4 4

Cyber update from Europol
by Richard Leaning 16 Jan '17

16 Jan '17

Dear All, A quick cyber predictions for 2017 from EC3 (Europol) Cheers Dick Richard Leaning External Relations RIPE NCC

1 0

EC3 (Europol) Bulletin
by Richard Leaning 23 Dec '16

23 Dec '16

Dear All, Please find the latest EC3 (Europol) bulletin - a very interesting read, especially if you have had enough food and drink over the festive period. Of particular interest to us is on page 20 and 21. Have a Merry Christmas and a Happy New Year. Cheers Dick Richard Leaning External Relations RIPE NCC

1 0