- NANOG - lists.nanog.org

Re: How to Handle ISPs Who Turn a Blind Eye to Criminal Activity?
by Paul Ferguson 15 Oct '07

15 Oct '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Mike Lewinski <mike(a)rockynet.com> wrote: >On a side note, now that I've gotten back on -post.... I will say that I've had pretty dismal experiences working with Law Enforcement over the years as a service provider. When you have to explain to the Feds just what IRC (for example) is, you've lost the battle :( After repeated attempts at getting what seems to be blatant criminal activity investigated, a provider might start to think "If Law Enforcement doesn't care, why should I?" (I've avoided falling into that trap, but it is frustrating to boot someone for illegal activities and see them go on to pull the same thing at another provider even after providing evidence to authorities.). > Exactly. Sometimes I think to myself that "...ISPs have Terms of Service and Acceptable Use Policies, so they have the scope and tools they need to boot a 'customer" who break the rules." But all too often, it would appear, the potential loss of revenue seems to win out over enforcing those policies. And as you say, if the ISP boots them, they just set up shop elsewhere. So, back to my original question: If you alert an ISP that "bad and possibly criminal" activity is taking place by one of their customer, and they do not take corrective action (even after a year), what do you do? - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFHD+XAq1pz9mNUZTMRAub9AKDGpuf2fwYYS2Q1rF/v4EtB76wr5wCcDSFY Ya7MTzjQcUJ+qL5UfSe5gw0= =2pba -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

5 4

Re: Researchers ping through first full 'Internet census' in 25 years
by Tim Franklin 15 Oct '07

15 Oct '07

On Fri, October 12, 2007 10:08 pm, Mark Foster wrote: > Its all very well for those that know better to carry on like this, but I > would suggest that those sortsa complaints only come from people who > don't know better. They don't know how to interpret their Firewall > warnings. And they don't know whats genuine and whats not. You're right, they don't. My complaint is with those who *think* they do. > Suggest that rather than knocking those who genuinely think that its a > warzone out there (and isn't it?) efforts of ISPs to educate clients as > to what is genuine abuse (and what isn't) should be rewarded. Absolutely. I've always been happy to try and educate those who come with even the slightest inclination towards education. It's the ones who are convinced that either any error message from their firewall or OS is the Word of God, or that because they're skilled in some other field, any attempt to educate them about networking or computers is a direct attack on their mental prowess - they bug me. It seems that neither group is getting smaller :( Regards, Tim.

1 0

Re: How to Handle ISPs Who Turn a Blind Eye to Criminal Activity?
by Paul Ferguson 14 Oct '07

14 Oct '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Gadi Evron <ge(a)linuxbox.org> wrote: >That's a different question all together, not about criminal ISPs, which >[...] No, not necessarily. Given that there are Tier 1 ISPs, Tier 2, etc., so you can certainly have some small-ish ISP colluding with criminal activity, in effect, by ignoring it or claiming ignorance. However, it's kind of hard to plead ignorance when, say, people continually alert them to the issues and they persist. That's just one example... I can come up with more. :-) - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFHD/N0q1pz9mNUZTMRAqtkAKCLJifYupBbpjmqVfVGUND95NVGNwCdFYp8 SM37ObYbO88K2iCkd99fp7c= =DjDg -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

3 3

How to Handle ISPs Who Turn a Blind Eye to Criminal Activity?
by Paul Ferguson 14 Oct '07

14 Oct '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 This question is part reality, part surreality. Let me ask you this: What would you do when you have alerted (via abuse@ contacts) a notable ISP in the U.S. (not a tier one, and not just one of them) about KNOWN, VERIFIABLE, and RECURRING criminal activity in their customer downstreams? And the downstream(s) do not respond? And the criminal activity continues? The most obvious answer is: Gather evidence, contact law enforcement. Right? I just wanted to reach out the NANOG on this and see what you thought... How would you handle it? - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFHDx/Uq1pz9mNUZTMRAiUSAJ94uQvlaBLWb7gxkxz0I/448reBZwCeKSTb ibBQj5TSBlr0utNar9tD60Q= =NIhs -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

8 16

RE: How to Handle ISPs Who Turn a Blind Eye to Criminal Activity?
by Paul Ferguson 13 Oct '07

13 Oct '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- "Eric Van Tol" <eric(a)atlantech.net> wrote: >> We did exactly that with a similar incident and the local FBI Cyber >> Crimes folks told us that they couldn't help us because they were >> entirely dedicated to potential terrorist activities. So, I would >> say "contact local authorities and play it up as a terrorist act" if >> you want any help at all. > >Or, you can somehow work into your complaint about how you are just >trying to "protect the children". Ah, yes -- One of the Four Horsemen of the Information Apocalypse: terrorists, drug dealers, kidnappers, and child pornographers. http://www.schneier.com/blog/archives/2005/12/computer_crime_1.html :-) - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFHEQanq1pz9mNUZTMRAtOVAJ9ZoCVN1JMiGImA2Fis9MQr0/RSzwCg25pC DU6jQhjlTj8z7TtTQkXICW8= =F9xe -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1

Re: Why do some ISP's have bandwidth quotas?
by Joe Greco 13 Oct '07

13 Oct '07

> > > Comparative to Milwaukee, I'd be guessing delivering high performance > > > internet and making enough money to fund expansion and eat is harder at > > > a non US ISP. It's harder, but there's nothing wrong with it. It compels > > > you to get inventive. > > > > The costs to provide DSL up here in Milwaukee are kind of insane, > > Insanity is a relative term :-) Try to deliver Internet outside of the > US in countries that share western culture and you'll start to > understand why caps are seen as an excusable form of treatment for the > insanity. Okay, so, let's pretend that today I'm sitting in Sweden. Go. Extremely high speed connectivity, uncapped, well in excess of what is delivered in most parts of the US. I was just informed that Road Runner upgraded locally from 5 to 7Mbps a month ago, and has a premium 15Mbps offering now, but there are folks with 100Mbps over there. So, your point is, what, that it's easier to deliver Internet outside of the US in countries that share western culture? That could be true, we're tied up by some large communications companies who don't want carrier- neutral networks to the residence. If we just want to start making up claims that fit the observed facts, I would say that the amount that a user can download from the Internet in countries that share western culture tends to decrease with distance from Sweden, though not linearly. AU gets placed on the far end of that. :-) (That's both a joke AND roughly true!) > Clearly they're not something we'd prefer, but they are useful > to manage demand in the context of high costs with customers who > benchmark against global consumer pricing (or those who think that the > Internet is a homogeneous thing) > > ...Hmm, that's a good idea, perhaps you should do that (get out of the > US) before you start saying what we're doing is "wrong with your > business" or "insane" or perhaps unreasonable. > > And I agree with Mark Newton's sentiments. It's completely delusional of > you to insist that the rest of the world follow the same definition of > "reasonable". We're not the same. Which is good in some respects as it > does create some diversity. And I'm quite pleased about that :-) Well, since I didn't insist that you follow any definition of "reasonable", and in fact I started out by saying : Continued reliance on broadband users using tiny percentages of their : broadband connection certainly makes the ISP business model easier, but : in the long term, isn't going to work out well for the Internet's : continuing evolution. it would seem clear that I'm not particularly interested in your local economics, no matter how sucky you've allowed them to be, but was more interested in talking about the problem in general. I *am* interested in the impact that it has on the evolution of the Internet. That you're so pleased to be "diverse" in a way that makes it more difficult for your users to join the modern era and use modern apps is sufficient to make me wonder. There's certainly some "delusional" going on there. ... JG -- Joe Greco - sol.net Network Services - Milwaukee, WI - http://www.sol.net "We call it the 'one bite at the apple' rule. Give me one chance [and] then I won't contact you again." - Direct Marketing Ass'n position on e-mail spam(CNN) With 24 million small businesses in the US alone, that's way too many apples.

12 19

Re: Researchers ping through first full 'Internet census' in 25 years
by Tim Franklin 13 Oct '07

13 Oct '07

On Fri, October 12, 2007 2:49 pm, Justin M. Streiner wrote: > "HOST x.x.x.x ON YOUR NETWORK PINGED ME!!!! I TAKE MY SECURITY > SERIOUSLY!! I'M CALLING THE FBI!!!" That I can *sort* of understand - it's the flaming zealotry of "ALL ICMP IS EEEVIL!" trickling down from 99% of firewall admins working in enterprises to end users who just heard it from "someone in IT". It's the "Your server www.whatever.com is attacking me from port 80!" ones that leave me torn between laughing, crying, and seriously thinking about a cull...

4 3

*Revised* Discounted Internet Access at Hyatt Regency Albuquerque for NANOG Guests
by Carol Wadsworth 13 Oct '07

13 Oct '07

*Note* in order to receive the discounted rate, you will need to purchase one-day passes from the front desk.

1 0

Re: How to Handle ISPs Who Turn a Blind Eye to Criminal Activity?
by Paul Ferguson 13 Oct '07

13 Oct '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Not intentionally trying to be retarded, but I've received an enormous number of private responses. Many thanks. It is odd, however, why folks felt the need to reply privately, and although I'm glad you did reply, it is somewhat of a statement, in and of itself, on the issues involved that things happen the way they do. Maybe. In any event, I did want to mention that some people involved in the aforementioned "activities" may be getting their feelings hurt real soon now due to "looking the other way" and pretending they didn't know what was going on. Or maybe not. It should be pretty fun to to see what happens. Thanks for everyone who responded. Cheers! - - ferg - -- "Paul Ferguson" <fergdawg(a)netzero.net> wrote: This question is part reality, part surreality. Let me ask you this: What would you do when you have alerted (via abuse@ contacts) a notable ISP in the U.S. (not a tier one, and not just one of them) about KNOWN, VERIFIABLE, and RECURRING criminal activity in their customer downstreams? And the downstream(s) do not respond? And the criminal activity continues? The most obvious answer is: Gather evidence, contact law enforcement. Right? I just wanted to reach out the NANOG on this and see what you thought... How would you handle it? - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFHDymoq1pz9mNUZTMRAi9JAKChOP+omJT+B08zY6/apubGPIV9ZQCgsr3F 1BcKzW2DrEte2Q/KS4I5de4= =RxGD -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

5 5

Re: How to Handle ISPs Who Turn a Blind Eye to Criminal Activity?
by Robert Bonomi 13 Oct '07

13 Oct '07

> From owner-nanog(a)merit.edu Fri Oct 12 16:26:36 2007 > Date: Fri, 12 Oct 2007 21:23:15 GMT > Subject: Re: How to Handle ISPs Who Turn a Blind Eye to Criminal Activity? > > So, back to my original question: If you alert an ISP that "bad and > possibly criminal" activity is taking place by one of their customer, > and they do not take corrective action (even after a year), what do > you do? This is straying somewhat afield from 'network operations', but it is at least tangentially relevant, so.... 'What do you do?' conceals a raft of other issues that have to be identified and answered before the 'obvious' quesiton cn be addressed. First off -- not to belabor (well, not too much, anyway) the obvious -- you have to identify what your 'goals' are. Both tactical (short term), and strategic (long term). And what level of resources you are willing to commit toward supporting those goals. A "desirable" state of affairs is that every network operator _does_ actively police its user base, and makes 'former customers' out of anyone who egages in activities deemed "not acceptable" by a large portion of the "rest of the 'net world". Unfortuntely, commercial providers are driven by 'economic self-interest', rather than "the good of the 'community'" as their _primary_ motivation. They _will_ consider the 'good of the community' when it is not in conflict (or at _most_, represents a *minor* conflict) with their self-interest, but if the two are diametrically opposed, there is no doubt as to which viewpoint _will_ prevail. So, when you ask them to _do_something_, quote "for the good of the community" unquote, and 'nothing happens' it is reasonable to conclude that 'economic self interest' is controlling -- either it is 'not worth the effort/expense', or it would cost revenues that they're not willing to give up. I'm sure this is no surprise to anyone. In fact, Isuspect everybody has seen these exact sysmptoms in _their_own_ management, in varying degree. There are only two things one can change to influence that decision -- either one 'somehow' makes 'the good of the community' more inportant, *or* one finds a way to invoke their 'economic self-interest' on the 'right' side of the issue. One possible way to do the latter is to look or 'sensitive' departments, *other* than the 'abuse' contacts, who have 'hot buttons' that can be pushed. Some possiilities for this approach include "legal", "investor relations", and "Public Relations". All the folks who have to 'deal with the mess' when something 'embarassing' becomes public knowledge. contacting such departments, with an 'early warning' about what could become 'very messy' public attention to policies/practices that "could easily be mis-understood", if done carefully, can be very effetive. And, as a final alternative, there is "public embarrassment", to shame them into taking action. One 'option' that has *never* been successfully employed would be to organize 'the community' for co-operative action in 'shunning' those provider who do not keep a clean house. I'd _love_ to see such an approach implemented, but it requires ignoring short-term self-interest for the long-term 'good of the community' -- even though the long-term good of the community _is_ in the self- interest of each and every provider. Back to original "what do you do?" 'Viable' options are rather limited -- If you have _hard_ evidence, reporting to law enforcement, *WITH* notice of 'apparent provider compliciy' -- including 'what was given to the provider _when_' to establish their 'actual knowledge' of the criminal activity and hence provider liability for allowing it to continue. You can try 'public humiliation' -- calling in the press. And, of course, you *DO* -- if you haven't already (comment: if not, _why_ not?) -- take 'defensive measures' to block communications in either direction involving those 'bad guys' and your customers.

1 0