- NANOG - lists.nanog.org

CDT Calls on Internet Activists to Urge Support for Feingold Amendments to Anti-Terrorism Bills
by William Allen Simpson 11 Oct '01

11 Oct '01

More.... I haven't seen the proposed amendments yet. But this is a broader call than just our Internet Engineering groups. -------- Original Message -------- Date: Wed, 10 Oct 2001 17:31:05 -0400 From: Ari Schwartz <ari(a)cdt.org> To: update(a)cdt.org Subject: CDT Calls on Internet Activists to Urge Support for Feingold Amendments to Anti-Terrorism Bills Sender: owner-cdt-adv(a)cdt.org Reply-To: Ari Schwartz <ari(a)cdt.org> CDT has sent out a message to Internet activists across the country asking them to urge their Senators to support Senator Russell Feingold's (D-WI) amendments to the Senate Anti-Terrorism Bill. Sen. Feingold is planning to offer amendments Thursday morning that will address some of the privacy concerns raised by the pending bills, by requiring government surveillance to be more focused and subject to meaningful judicial controls. The message sent to CDT's lists of activists; is available below; and is posted on the CDT site. ----- Dear Activist: Things are moving very fast on Capitol Hill. Legislation to expand government surveillance will be considered by the Senate (and maybe the House) on Thursday, October 11. In the Senate, Sen. Russ Feingold is planning to offer amendments Thursday morning that will address some of the privacy concerns raised by the pending bills, by requiring government surveillance to be more focused and subject to meaningful judicial controls. CDT supports the Feingold amendments. You can make a difference. Call your Senators in Washington right away and let them know that you think civil liberties should be part of the balance as we move forward to protect our country from terrorism. Urge them to support the Feingold privacy amendments BACKGROUND Following the horrendous attacks of September 11, it is clear that US anti- terrorism efforts need to be improved. Unfortunately, there has been little time to develop a response that is effective and does not unnecessarily infringe civil liberties. Legislation moving quickly through Congress involves some fundamental changes in the surveillance laws. Most of the changes are not limited to terrorism cases, but concern all crimes and all intelligence investigations. Among other things, the bills would: * Allow FBI to seize any and all stored records (medical records, educational records, stored e-mail) in intelligence cases without a search warrant. * Allow computer system operators to authorize government surveillance without a court order (the computer trespasser provision). * Authorize roving taps in intelligence cases without clear guidelines, allowing government to monitor pay phones, library computers, cell phones without first determining who is using the device. * Allow secret searches (searches without notice at the time of the search) in all criminal cases. * Extend government surveillance under minimal standards to broad categories of Internet data - all "routing, addressing and signaling information" (the "pen register" provision). For full background the current civil liberties issues with the bill, please see CDT's latest policy post -- http://www.cdt.org/publications/pp_7.10.shtml Also, the New York Times on October 10 explained the current situation in the Senate and Sen Feingold's concerns-- http://www.nytimes.com/2001/10/10/national/10RIGH.html WHAT YOU CAN DO--MAKE YOUR VOICE HEARD 1. Call your your Senators - Sen. XXX at (202) 224-3121 Tell the person who answers the phone that you hope your Senator will support the Feingold privacy amendment to the terrorism bill, so that it adequately protects civil liberties when giving the government new surveillance powers. Use these words if you feel tongue-tied: Staffer: Hello, Sen. XXX's office. You: Hello. I'm a constituent calling to urge the Senator to support the Feingold privacy amendments to the anti-terrorism bill. Government needs to fight terrorism, but the bill fails to protect privacy. I'm concerned about the provisions on Internet surveillance and roving wiretaps. I support the Feingold amendments setting clear limits on government surveillance. Staffer: I'll tell the Senator. Thanks, bye! 2. Let CDT know how it went! Go to http://www.cdt.org/action/feedback.cgi?membid=wijr, and use the feedback form to tell us what happened. Or you can send an email back to me at mclark(a)cdt.org. 3. Lastly, please forward this message to other individuals interested in protecting privacy and free expression on the Internet . They can find information about their Senators at http://www.cdt.org/action/. But they need to act right away. PLEASE NOTE: We are asking you to call your Representatives in Washington because studies have shown that this is the most effective way to make a difference over a short period of time. By the time the office reads your email or letter it will probably be too late and a call into the district office does not have the same impact when the Senator is in Washington. -- To subscribe to CDT's Activist Network, sign up at: http://www.cdt.org/join/ If you ever wish to remove yourself from the list, unsubscribe at: http://www.cdt.org/action/unsubscribe.shtml If you just want to change your address, you should unsubscribe yourself and then sign up again or contact: mclark(a)cdt.org --- ---------------------------------- CDT Update Subscription Information E-mail questions, comments, or requests to subscribe or unsubscribe to ari(a)cdt.org or call (202) 637-9800. Detailed information about online civil liberties issues may be found at http://www.cdt.org/ ----------------------------------- Ari Schwartz Center for Democracy and Technology 1634 Eye Street NW, Suite 1100 Washington, DC 20006 202 637 9800 fax 202 637 0968 ari(a)cdt.org http://www.cdt.org -----------------------------------

1 0

PATRIOT/USA technical problems, call to action
by William Allen Simpson 10 Oct '01

10 Oct '01

Democracy is not a spectator sport. The US House (hr.2975 PATRIOT) and US Senate (s.1510 USA) have introduced bills that will cost ISPs a lot of money -- potentially tens of thousands of dollars -- even for small ISPs. Unlike CALEA, there is no requirement that ISPs be reimbursed. This happened because the legislators are clueless about technical requirements. It is up to you to educate them! With the bombing started, it is thought that the bills will be pushed through this week, without going through the normal committee review. Each and every one of you MUST call your legislators, where you work and again where you live. Call your Senator, and then call your Representative. Do not send email, it won't get read soon enough! Since Monday is a legal holiday of sorts, you may have to wait until Tuesday morning, but try on Monday anyway. -- Urge your representatives in Congress to hold full hearings, and fix technical problems. 1. Call the White House switchboard at 202-224-3121, and ask to be connected to the office of your Congressional representative. -or- Look up the office numbers on the web at www.house.gov and www.senate.gov. 2. When you are put through, say "May I please speak to the staff member who is working on the anti-terrorism legislation?" If that person is not available to speak with you, say "May I please leave a message?" 3. Briefly explain that you work for an Internet Service Provider, and although you appreciate the efforts of your representative to address the challenges brought about by the September 11th tragedy, it would be a mistake to make any changes in the federal wiretap statute that do not respond to "the immediate threat of investigating or preventing terrorist acts." -- If they want to talk details, here they are: Both bills add "addressing" and "routing" to the list of activities that can be requested without a specific court order. So, just like call setup for the phone companies, every single address that you assign, via DHCP or otherwise, and every ARP, RIP, OSPF, and BGP routing table change, must be recorded for posterity -- just in case any state or federal agents want to review it someday. No time limits, and no statute of limitations. Some lawyers read this to extend to tracking every URL accessed through your POPs, and every email To: and From: transmitted over your networks, since they both can be considered "addressing" and your activity "routing". Obviously, the legislators don't quite understand what a dynamic packet connectionless Internet means! -- My solution, after talking to several Representatives and Senators staffs, is to add clarification to the definitions section 3127: (7) the term "addressing" means a numeric identifier that assists the delivery of electronic communications over a specific link, attached to the outermost encapsulation of the communication (but not including the contents of such communication). (8) the term "routing" means the numeric internetwork locator associated with a communication that facilitates its carriage between electronic communication services, contained within the internetwork communication encapsulation (but not including the contents of such communication). -- As you can see, my solution means you can do it with standard tools, like tcpdump or snort, and unlike phone call setup, there's nothing in the definitions that indicates the information has to be recorded for future requests.... -- William Allen Simpson Key fingerprint = 17 40 5E 67 15 6F 31 26 DD 0D B9 9B 6A 15 2C 32

6 7

RE: Filtering Best Practices, et al (Was Verio Peering, Gordon's Knot)
by Hallgren, Michael 10 Oct '01

10 Oct '01

> > On Wed, Oct 10, 2001 at 10:54:03AM +0200, Stephane Bortzmeyer wrote: > > > > > I'm currently in the process of setting up a new border > router, and the > > > recent debate on the above topic got me wondering what > the best practice > > > filtering policy is? Is there one? > > > > I'm interested to see if people filter route anouncements > on the basis > > of registered routes in an Internet Routing Registry. In our area > > (Europe), the RIPE database typically contains less than half of the > > routes which are actually announced. I assume it is not better in > > ARINland. > > When I worked at Tiscali (World Online) Denmark, we did prefix > filtering on our peers, the results of that can be seen on > http://as8807.net/dixirrstats.txt (Though that is old, january this > year) > I believe that TeleDanmark also still do IRR filtering, and I know of > several providers in Denmark who are ready to follow suit as soon as > some of the "worst IRR-offenders" have updated their IRR > records (which > actually has happened already) > > If you decide to implement IRR filtering you may want to see how your > peers perform in the IRR area by using a small utility, which can be > downloaded from http://noc.tele.dk/util.html. This is the utility that > was used to produce the stats for Tiscali's router. Thanks. (Yes, successfully filtering peers wrt IRR sometimes require human interaction - asking peer not up-to-date to become so.) mh > > -- > Andreas Plesner Jacobsen >

1 0

RE: Filtering Best Practices, et al (Was Verio Peering, Gordon's Knot)
by Hallgren, Michael 10 Oct '01

10 Oct '01

Hi/Bonjour Stephane, > > > On Wed, Oct 10, 2001 at 10:22:09AM +0100, > Hallgren, Michael <michael.hallgren(a)Teleglobe.com> wrote > a message of 50 lines which said: > > > we - Teleglobe, that is - filter our customers wrt. as-path > and prefix... > > also in the RIPE area. If a customer isn't up-to-date with IRR, we > > Well, your customers, OK, but your peers (the ones without transit > traffic, which are supposed to announce only their networks) at > exchange points? In general, currently, yes, peers as well. mh >

1 0

RE: Filtering Best Practices, et al (Was Verio Peering, Gordon's Knot)
by Hallgren, Michael 10 Oct '01

10 Oct '01

Hi, we - Teleglobe, that is - filter our customers wrt. as-path and prefix... also in the RIPE area. If a customer isn't up-to-date with IRR, we advice/help him to become so. (The idea is, keeping filters on our customers is also of benefit to our peers, etc, etc.) mh > -----Message d'origine----- > De : Stephane Bortzmeyer [mailto:bortzmeyer@gitoyen.net] > Envoyé : mercredi 10 octobre 2001 10:54 > À : Grant A. Kirkwood > Cc : nanog(a)merit.edu > Objet : Re: Filtering Best Practices, et al (Was Verio > Peering, Gordon's > Knot) > > > > On Tue, Oct 09, 2001 at 07:58:19AM -0700, > Grant A. Kirkwood <grant(a)virtical.net> wrote > a message of 18 lines which said: > > > I'm currently in the process of setting up a new border > router, and the > > recent debate on the above topic got me wondering what the > best practice > > filtering policy is? Is there one? > > I'm interested to see if people filter route anouncements on the basis > of registered routes in an Internet Routing Registry. In our area > (Europe), the RIPE database typically contains less than half of the > routes which are actually announced. I assume it is not better in > ARINland. > > On the basis of inetnum objects (network addresses, not routes), it is > a bit better in coverage but you cannot use inetnum directly in a > comparison, you have to check that a BGP announce *includes* at least > one registered inetnum. > > To summary, I dropped the idea. Does anyone implemented it? > > >

2 1

Re: BGP noise tonight? (fwd)
by jlewis＠lewis.org 10 Oct '01

10 Oct '01

So who do you blame...the RFC or the vendor that ignores it? Dropping the session seems to break the "be conservative in what you send and liberal in what you accept" suggestion. If you know someone else will ignore the rules (there's always someone) breaking due to their error kind of sucks. -- ---------------------------------------------------------------------- Jon Lewis *jlewis(a)lewis.org*| I route System Administrator | therefore you are Atlantic Net | _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________ ---------- Forwarded message ---------- Return-Path: <if(a)sil.at> Received: from mailhost.mmaero.com (mailhost.mmaero.com [208.152.224.3]) by redhat1.mmaero.com (8.11.6/8.9.3) with ESMTP id f984S0Z24869 for <jlewis(a)redhat1.mmaero.com>; Mon, 8 Oct 2001 00:28:00 -0400 Received: from waste.silverserver.co.at (waste.silverserver.co.at [194.152.178.7]) by mailhost.mmaero.com (8.11.2/8.11.2) with ESMTP id f984Rxp20147 for <jlewis(a)lewis.org>; Mon, 8 Oct 2001 00:28:00 -0400 Received: from ikarus (ikarus.sil.at [194.152.178.41]) by waste.silverserver.co.at (8.11.6/8.11.6) with ESMTP id f984Roi31471 for <jlewis(a)lewis.org>; Mon, 8 Oct 2001 06:27:50 +0200 Date: Mon, 8 Oct 2001 06:27:51 +0200 (MEST) From: Ingo Flaschberger <if(a)sil.at> X-Sender: chaoztc@ikarus To: jlewis(a)lewis.org Subject: Re: BGP noise tonight? In-Reply-To: <Pine.LNX.4.30.0110080010050.1854-100000(a)redhat1.mmaero.com> Message-ID: <Pine.SOL.4.21.0110080627120.15412-100000@ikarus> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Hi i could not post to nanog directly.. perhaps you could do it for me? our 2 uplinks, ebone and carrier1 went down (flapping routes at the borders). the problem was a malformed as-path (with a private confederation in it), which was distributed from netherland over the network... (over routers VendorX). rfc-compliant routers dropped the peering session after receiving this malformed route ebone has contaced the provider and he has already fixed this announcement. thnx & bye, Ingo -- "I worry about my child and the Internet all the time, even though she's too young to have logged on yet. Here's what I worry about. I worry that 10 or 15 years from now, she will come to me and say 'Daddy, where were you when they took freedom of the press away from the Internet?'" --Mike Godwin

10 14

Re: Equinix, AboveNet, Broadwing?
by woody＠zocalo.net 10 Oct '01

10 Oct '01

Equinix doesn't sell transit, unless they've had a sudden and drastic change of business model. ----Original Message---- From: Timothy Brown <timothy.brown(a)pobox.com.pager.zocalo.net> Subject: Equinix, AboveNet, Broadwing? Can those of you with equipment in the above facilities that are also using those providers for transit please contact me privately? I have a few questions. Tim

2 1

FBI warning to infrastructure owners
by Sean Donelan 09 Oct '01

09 Oct '01

According to news reports Attorney General Ashcroft, the FBI issued warnings to law enforcement agencies, corporate security officers and private-sector Information Sharing and Analysis Centers this week. As some of you may know, the Internet is not currently covered by any ISAC. So you may not receive these warnings. It is up to the private sector if, and under what terms, they want to participate in any information sharing activity.

2 3

Equinix, AboveNet, Broadwing?
by Timothy Brown 09 Oct '01

09 Oct '01

Can those of you with equipment in the above facilities that are also using those providers for transit please contact me privately? I have a few questions. Tim

1 0

wanted: 'beacon' hosts ?
by Peter Galbavy 08 Oct '01

08 Oct '01

I don't really know what to ask for or who, so redirection is welcome. I am setting up some monitoring from within our AS to a handful of sites scattered around the UK and the rest of the world. Now, I get annoyed when someone reads the same file off my web server evey five minutes, so I am not going to do it to anyone else without permission. Can anyone help (reciprocally would be fine) by providing permission to use ICMP Echo and HTTP GET requests against something on their network (that is well connected and reliable) so that I can build SLA-targetted averages for performance and packet loss ? I *DO NOT* want to get involved in buying this data from anyone please. I am very happy to provide this service in return, or even just for the sake of it without anything back. What I evisage is the 5-miutely 'GET'ing of a 20k-ish text file from a web server and a group of 5 ICMP Echos at about the same intervals... PS I know this is NANOG, but I am even more interested in hearing from UK and European networks. PPS If people are willing to offer this as a 'public' service, I will happily summarise back to the list and/or build a web site with details. Peter

8 11