- RIRs-LEA - mailman.ripe.net

News item on www.ripe.net
by Richard Leaning 15 Dec '16

15 Dec '16

Dear All, FYI Cheers Dick Richard Leaning External Relations RIPE NCC > Begin forwarded message: > > From: comms(a)ripe.net > Subject: [staff] News item on www.ripe.net > Date: 15 December 2016 at 14:28:20 CET > To: staff(a)ripe.net > > Dear colleagues, > > A news announcement has been posted on ripe.net - RIPE NCC and Europol Enhance Cooperation to Tackle Cybercrime and Internet Security: > https://www.ripe.net/publications/news/about-ripe-ncc-and-ripe/europol-mou > > Cheers, > > Nick Hyrka > Communications Manager >

2 1

Quick ICANN57 update.
by Richard Leaning 09 Nov '16

09 Nov '16

Dear All, This is just a very quick update on the highlights from ICANN57. GAC leadership team - The GAC leadership was up for re-election and the results were - Chair - Mr. Thomas Schneider - Switzerland Vice Chairs - Mr GUO Feng, China Ms Manal ISMAIL, Egypt Mr Ghislain DE SALINS, France Ms Milagros CASTAÑÓN SEOANE, Peru Mr Mark CARVELL, United Kingdom So our relationship with the GAC has been further enhanced. ASO NRO and RIR issues Well this is in my opinion was a really interesting shift in attitude. Am summarising but basically when the RIRs met ICANN staff it was suggested by ICANN staff, that we should consider if we need to formalise our relationship with the GAC PSWG. This was again mentioned by the ICANN Board when we met with them. The board were also interested in the recent LEA engagement with the RIRs and they were updated. What they were really wanting to know was is this a Gobal ASO NRO engagement or a regional engagement. This was again explained thats its not a GAC PSWG driven engagement but by regional LEA. During the PSWG open session - the PSWG reached out to the ASO to consider becoming an Liaison/observer to the GAC which would allow the ASO to be a Liaison/observer to the PSWG. Of course this caused a lot of discussion amongst our-selves here at ICANN57 with the general view being positive. Of course there will now have to be a lot of conversation and refection by all. There is no time pressure, in fact, we don’t even have to respond. Happy to take questions ;-) Cheers Dick Richard Leaning External Relations RIPE NCC

3 2

LEA talk presented during LACNIC 26
by Carlos M. Martinez 19 Oct '16

19 Oct '16

Hello all, (Please do not distribute this email) We had a LEA presentation during LACNIC 26 in Costa Rica. I helped coordinate the talk acting as liaison for a representative of the DEA, Mr. Thomas Walden and our staff. The plan all along was that the DEA would try to have two LEA agencies from the region deliver the actual presentation. In the end this proved difficult to achieve and Mr. Walden attended the event with a Costa Rican Police representative. Fine so far. However, the actual delivery of the talk was, in my opinion, quite poor and the overall message was definitely lost. The Costa Rican representative spoke little or no English at all. Mr. Walden did not speak Spanish. Both seemed quite frustrated with the whole situation. A colleague of mine and myself tried to interpret for them, but since we became aware of this situation less than 45 minutes before the slot’s time it didn’t make much of a difference. Mr. Walden’s presentation was clear and well prepared. However, the presentation from the CR police was mostly a generic description of a kidnapping case they had worked on, which, while interesting from a True Crime TV series perspective, failed to connect the dots with Mr. Walden’s presentation. The conclusions from this kidnapping case presentation were mostly ‘run of the mill’, in the sense of highlighting how important it is for LEAs to be ICT-literate and how collaboration among LEAs is important. No mention was made about how IP addresses or domains or WHOiS lookups either helped or hindered their investigation. So, a few takeaways from this experience: - When helping LEAs coordinating these talks, we need to stress to them that they need to explicitly highlight what they expect from these communities. Accurate WHOIS? Bulk access? simpler automation of queries? please say so. Only mentioning a global policy about WHOIS is just not good enough. - When they designate their speakers, we need to ensure that they will be able to work together. From what I saw in APNIC42, the result was a lot better, but even in that case I believe the message could have been delivered more clearly. I am convinced that we need to work together with LEAs and help them do their job. I appreciate that they took the initiative and approached our community. It’s just that we also need to help them be more effective. I hope you find these notes helpful. Thanks! -Carlos

3 2

LEA prenstations
by Richard Leaning 18 Oct '16

18 Oct '16

Hi All, Just a quick update on where we are on the LEA presentations at our meetings. LEA have so far presented at LACNIC and APNIC, i was only able to remotely cover the APNIC presentation and from what i could see/hear it went down pretty well. How did everyone else think it went? am particular interested in the views of people who were actually there. This week LEA will be presenting at ARIN - Leslie could you confirm when that is please? (i think its Friday) Next week LEA will be presenting at RIPE73, they have two slots, one at the plenary (Thursday 25/10 15:00 - 16:30 CET) and one at the AAWG (Thurs 27/10 12:00 - 13:30 CET). Due to a complete mind melt i won’t be there, have doubled booked myself and will be in the USA) Vy - Could you let us know what is happening at AFRINIC, in particular when the Government WG is meeting and also if LE have a slot during the conference. Cheers Dick Richard Leaning External Relations RIPE NCC

4 8

Update
by Leslie Nobile 27 Aug '16

27 Aug '16

Hi All- I hope that everyone is well! I just wanted to follow up with all of you on the topic we last discussed regarding getting the LEAs onto our respective meeting agendas this fall to make a presentation on the importance of Whois accuracy. This is being done in advance of them submitting an actual globally coordinated policy proposal as a way to "socialize" the idea and educate our respective communities on how LEAs use Whois. I have attached the abstract that the FBI and DEA have submitted to ARIN for their talk. From what I understand, they have been working closely with other LEAs around the world on this effort including the following: Europol (maybe with Spanish National Police) · Sri Lanka Police · Korean National Police · Costa Rica Police · Panama Police · Public Safety Canada (unique to Canada) I think we stand a good chance of getting them approved on our ARIN agenda for our Dallas meeting in October. They have asked for ~30 minutes, which seems fair. Have any of you had the chance to work on this with your respective LEAs? The last time we spoke, I believe that Dick said that Ripe would likely approve a presentation by the Europol folks at their fall meeting, similar to the one they did at the spring meeting in Copenhagen. Bobby Flaim has also indicated that they have been working closely with Carlos from Lacnic on this, but not sure of any other RIRs. Hopefully, we are all making progress on this and can help to move this forward as it is an important topic and one that will likely become more important as the Internet evolves. Thanks! Best, Leslie

3 4

RIPE NCC Update
by Richard Leaning 25 Aug '16

25 Aug '16

Dear All, I know this list has been a bit quite over the last month - i put that down to the holidays. I would like to take this opportunity to update you all on what is happening with RIPE NCC and where we will be over the next couple of months. Training Our Training department have been holding meetings with Europol - EC3. We are scoping to see if we can develop a bespoke training course for LEA and also Governments, rather than trying to make our existing ones work - which they don’t really as they were designed for a completely different audience. We are looking at how they can get more information out of the public records and how we can help them by teaching them how to interpret the objects in the RIPE Database and their relationships, the resource transfer records and basically how the IR system works. This will be by an online course such as webinars etc. We and EC3 are very keen to make this work - plus EC3 are happy that they are being involved in the development of the course and their unique needs are been listened to. Ill keep you all updated on how this progresses and of course share with you all what we are doing, so you can see if it its fits into your own regions. Interpol Interpol Global Cybercrime expert group (IGCEG) Marco H and I are attending the Interpol Global Cybercrime expert group (IGCEG) 2nd meeting in Lyon from the 6-8 September. The purpose of the Group is to advise the INTERPOL General Secretariat in policy formulation and project implementation, regarding programmes and operations related to the cyber arena. The objectives of the Group is to serve as a forum for exchange of information and good practices, to assist the General Secretariat in developing strategy on cyber issues and to serve as an advisory body to the General Secretariat on projects related to cyber matters. Is anyone else going to this? We will share our mission report when we return. Interpol - Europol Conference I am also attending the annual Interpol - Europol Conference which will be held at the INTERPOL Global Complex for Innovation (IGCI) in Singapore from 28-30 September 2016. The conference is intended to bring together law enforcement officials, private sector, academia, international organizations and other key entities from across the world to strengthen cooperation on preventing and combatting cybercrime. I know that Leslie and Craig are also attending, anyone else? AOB We are in discussions with Interpol about how we can formalise our relationship with them. Europol Europol’s Advisory Group on Communication Providers I have been selected to sit on the Europol’s Advisory Group on Communication Providers which is an advisory group to the Programme Board of the European Cybercrime Centre (EC3), established by and reporting to the Programme Board of EC3, this group is set up for an initial period of two years. The purpose of the group - - bring knowledge and expertise to the Programme Board on matters related to internet communications, in particular in regard to cybercrime; - update and share all relevant information and expertise on developments in the area of internet communications; - assist the Programme Board in defining priorities for the work of EC3 in this area, including by advising on the cooperation the with ISPs, Telcos, including mobile operators, CERTs and other relevant partners and on developing concepts for enhanced prevention of cybercrime; The first meeting of this group will be held on the 9th September. Ill report back on how it went. AOB We are in discussions with Europol - EC3 about how to formalise our relationship with them. PSWG i think that we should arrange a meeting with them in India - just to check on our relationship and if we need to formalise it in some way - not sure what that would look like and it even can be done - so thoughts please. Regarding the PDP discussion we had in Finland - as anyone got an update of what is happening in their region? I have spoken to EC3 and they are still working on this but i haven’t seen anything official yet. I know they are intending to present during the next RIPE meeting in Madrid in the end of October but believe that will be an "Problem statement” to air there concerns with the community and see what reaction they receive. Cheers Dick Richard Leaning External Relations RIPE NCC

1 0

RIR/LEA Mailing list
by Richard Leaning 12 Jul '16

12 Jul '16

Hi Cesar, Welcome to the mailing list. Cheers Dick Richard Leaning External Relations RIPE NCC > On 11 Jul 2016, at 21:20, Kevon Swift <kevon(a)lacnic.net> wrote: > > Hi Richard, > > One last inclusion on our end - my colleague Cesar Díaz (cesar(a)lacnic.net <mailto:cesar@lacnic.net>) who also has default responsibility for Central America and engagement in some processes in which LEA interaction may be prime. I hope this could also be accommodated! > > Kind regards, > Kevon > > On 10/07/2016 7:49 AM, Richard Leaning wrote: >> Dear Carlos, >> >> Welcome to the list. >> >> Kind Regards >> >> Dick >> >> >> Richard Leaning >> External Relations >> RIPE NCC >> >> >> >> >>> On 8 Jul 2016, at 08:31, Oscar A. Robles-Garay <oscar(a)lacnic.net> <mailto:oscar@lacnic.net> wrote: >>> >>> Richard, >>> >>> Could you include Carlos Martínez, our CTO to this ML? >>> >>> Thanks! >>> >>> Oscar >>> >>> >>> On 7/2/16 11:54, Richard Leaning wrote: >>>> Dear All, >>>> >>>> I have opened this mailing list after the feedback I had during ICANN56 last week. This mailing list is a private list for RIR staff only, who engage with LEA on a regular basis or who are looking to do so. >>>> >>>> The members at present are >>>> >>>> Dick >>>> Chris B >>>> Marco H >>>> Leslie >>>> Craig >>>> Allen >>>> Kevon >>>> Oscar >>>> Vymala >>>> >>>> I am the administrator for the list, so can you please let me know who else I need to add. >>>> >>>> I would like this list to be used for the following. But please suggest more. >>>> >>>> 1. Update each other on what's happening in our regions with regards LEA, including invites we receive to attend LEA meetings and who is going to what. >>>> 2. Coordinate LEA training and share ideas on what works and what doesn't, even share training materials and presentations. >>>> 3. Coordinate the latest PDP proposal from LEAs, which I know Leslie will circulate the minutes of that meeting very soon. >>>> >>>> As I said this is just my suggestions - but the list can be basically used for anything to do with LEAs but please feel free to add anything. >>>> >>>> Can you all just bing me back a quick reply so I know it's working. >>>> >>>> Cheers >>>> >>>> Dick >>>> >>>> Richard Leaning >>>> RIPE NCC >>>> External Relations >>>> >>>> _______________________________________________ >>>> RIRs-LEA mailing list >>>> RIRs-LEA(a)ripe.net <mailto:RIRs-LEA@ripe.net> >>>> https://lists.ripe.net/mailman/listinfo/rirs-lea <https://lists.ripe.net/mailman/listinfo/rirs-lea> >> >> >> _______________________________________________ >> RIRs-LEA mailing list >> RIRs-LEA(a)ripe.net <mailto:RIRs-LEA@ripe.net> >> https://lists.ripe.net/mailman/listinfo/rirs-lea <https://lists.ripe.net/mailman/listinfo/rirs-lea> >

1 0

Re: [RIRs-LEA] RIR/LEA Mailing list
by Richard Leaning 11 Jul '16

11 Jul '16

Dear Carlos, Welcome to the list. Kind Regards Dick Richard Leaning External Relations RIPE NCC > On 8 Jul 2016, at 08:31, Oscar A. Robles-Garay <oscar(a)lacnic.net> wrote: > > Richard, > > Could you include Carlos Martínez, our CTO to this ML? > > Thanks! > > Oscar > > > On 7/2/16 11:54, Richard Leaning wrote: >> Dear All, >> >> I have opened this mailing list after the feedback I had during ICANN56 last week. This mailing list is a private list for RIR staff only, who engage with LEA on a regular basis or who are looking to do so. >> >> The members at present are >> >> Dick >> Chris B >> Marco H >> Leslie >> Craig >> Allen >> Kevon >> Oscar >> Vymala >> >> I am the administrator for the list, so can you please let me know who else I need to add. >> >> I would like this list to be used for the following. But please suggest more. >> >> 1. Update each other on what's happening in our regions with regards LEA, including invites we receive to attend LEA meetings and who is going to what. >> 2. Coordinate LEA training and share ideas on what works and what doesn't, even share training materials and presentations. >> 3. Coordinate the latest PDP proposal from LEAs, which I know Leslie will circulate the minutes of that meeting very soon. >> >> As I said this is just my suggestions - but the list can be basically used for anything to do with LEAs but please feel free to add anything. >> >> Can you all just bing me back a quick reply so I know it's working. >> >> Cheers >> >> Dick >> >> Richard Leaning >> RIPE NCC >> External Relations >> >> _______________________________________________ >> RIRs-LEA mailing list >> RIRs-LEA(a)ripe.net >> https://lists.ripe.net/mailman/listinfo/rirs-lea >

2 1

RIPE Meeting Oct.
by Richard Leaning 08 Jul '16

08 Jul '16

Hi All, Thanks Leslie and Kevon for the update. Yes, Greg Mounier, EC3 (Europol) with our help as already presented on this topic at the last RIPE meeting at the AAWG. He is intending to present again at the meeting in October in Madrid - (24th - 28th Oct). He has the support of the Chair of the AAWG to present and we will make sure he submits it through the right channels - i.e - The RIPE Programme Committee (PC) who are responsible for ensuring that the RIPE Meeting programme consists of interesting, relevant and inspiring content. Cheers Dick Richard Leaning External Relations RIPE NCC > On 6 Jul 2016, at 15:23, mailman-bounces(a)ripe.net wrote: > > The attached message was received as a bounce, but either the bounce > format was not recognized, or no member addresses could be extracted > from it. This mailing list has been configured to send all > unrecognized bounce messages to the list administrator(s). > > For more information see: > https://lists.ripe.net/mailman/admin/rirs-lea/bounce > > > From: Leslie Nobile <leslien(a)arin.net> > Subject: Following up > Date: 6 July 2016 at 15:20:58 GMT-5 > To: RIRs-LEA <rirs-lea-bounces(a)ripe.net> > > > Hi All- > > I just wanted to send a quick email to let you know that I had a call today with FBI folks (Bobby and Iranga) to discuss next steps. They are still working on the policy text based on input they received last week from various community members, ASO reps, and RIR staff. Our discussion today centered on how the LEAs should go about getting added to the agendas of our upcoming fall RIR meetings in order to introduce the topic of the importance of Whois accuracy from a LEA perspective. I advised them to write a short abstract introducing their intended topic and to send it to me. I will work on getting this added to the agenda for the ARIN fall meeting. > > They asked how this would happen in the other regions, which is why I am bringing this to your attention. I believe that they have already identified LEA counterparts for the Ripe region (Greg Mounier) and for the APNIC region (Jeremy from South Korea?), but they are still working on finding someone in the Lacnic and Afrinic regions. In any event, do you all have any advice as to how they should approach getting on to your fall meeting agendas? And are there any particular deadlines they need to be aware of right now with regards to getting added to your meeting agendas? > > Thanks. > > Best, > Leslie > > > >

1 0

Re: [RIRs-LEA] Fwd: Following up
by Kevon Swift 08 Jul '16

08 Jul '16

Hi all, We can assign them a Topics of Interest slot during our Policy Forum at LACNIC26 (Sept 26-30). Re the counterpart, our Policy Officer Gianina (cc'd) can put Bobby or Iranga in touch with someone from our community to take the proposal from there. If it's a question of submitting text for the meeting the usual 4wk lead time would apply but from what I recall, the policy submissions/consensus building will be for our early year Policy Forums in 2017, correct? Regards, Kevon Swift Líder de Relaciones Estratégicas e IntegraciónHead of Strategic Relations and Integration LACNIC - www.lacnic.netLatin American and Caribbean Internet Addresses Registry-------- Original message --------From: Richard Leaning <rleaning(a)ripe.net> Date: 06/07/2016 5:16 pm (GMT-04:00) To: RIRs-LEA <RIRs-LEA(a)ripe.net> Subject: [RIRs-LEA] Fwd: Following up Richard LeaningRIPE NCCExternal Relations Begin forwarded message: From: Leslie Nobile <leslien(a)arin.net> Date: 6 July 2016 at 21:20:58 BST To: RIRs-LEA <rirs-lea-bounces(a)ripe.net> Subject: Following up Hi All- I just wanted to send a quick email to let you know that I had a call today with FBI folks (Bobby and Iranga) to discuss next steps. They are still working on the policy text based on input they received last week from various community members, ASO reps, and RIR staff. Our discussion today centered on how the LEAs should go about getting added to the agendas of our upcoming fall RIR meetings in order to introduce the topic of the importance of Whois accuracy from a LEA perspective. I advised them to write a short abstract introducing their intended topic and to send it to me. I will work on getting this added to the agenda for the ARIN fall meeting. They asked how this would happen in the other regions, which is why I am bringing this to your attention. I believe that they have already identified LEA counterparts for the Ripe region (Greg Mounier) and for the APNIC region (Jeremy from South Korea?), but they are still working on finding someone in the Lacnic and Afrinic regions. In any event, do you all have any advice as to how they should approach getting on to your fall meeting agendas? And are there any particular deadlines they need to be aware of right now with regards to getting added to your meeting agendas? Thanks. Best, Leslie

8 12