- NANOG - lists.nanog.org

Re: Monitoring, Flow Stats (Re: spam whore, norcal-systems)
by Phil Howard 04 Feb '99

04 Feb '99

Bob Allisat wrote: > Technicians have no right to scan any mail for > contents that does not violate the more important > civil rights of citizens to privacy and precious > freedoms of expression. What Mr. Howard is, in fact, > proposing is the computer systems equivalent of that > staff of thousands in the form of software that scans > and then junks anything the programmers decide is > unacceptable. Which is totally egregious. The programmers would not get to make those decisions. They would instead be made, in effect, by my customers through their choice of service provider. > Instead of designing systems and software that can > handle the modern volume of electronic communications > (the good the bad and the ugly) these allegedly capable The volume of mail isn't the issue. It's the annoyance factor that my customers face. I already get complaints from customers just because I have not actually implemented/deployed any of the blocking facilities I speak of. I want to, and I suspect I will have to. > professionals advocate choking off what "We the People" > can or cannot send each other and call it a public > service. When in fact the public would be served far > more by recieiving all of the mail from systems that > didin't choke at every silly cyber-flyer, dumb make > money scheme or wedding/birth announcement. I have no plans to block by content. My current plans are to block known open relays and dialup ports. I won't need to look inside the mail (by program) at all to make the blocking decision. -- -- *-----------------------------* Phil Howard KA9WGN * -- -- | Inturnet, Inc. | Director of Internet Services | -- -- | Business Internet Solutions | eng at intur.net | -- -- *-----------------------------* phil at intur.net * --

1 0

Re: OUTAGE: MCI Worldcom nationwide ATM network
by Sean Donelan 04 Feb '99

04 Feb '99

The source of the report was MCI Worldcom customer service. Due to the number of mergers, it is sometimes hard to keep who has what where straight. Even the employees of the companies involved have trouble. As an outsider, I have no hope of getting everything correct. But here goes. As I understand this, the ATM problem is affecting Worldcom's original ATM backbone, which uses Stratacom ATM switches. Perhaps the reason why worldcom CSC said they were escalating the matter with Cisco is Stratacom is now owned by Cisco. MCI Worldcom CSC only told us the vendor involved was Cisco, not anything about specific equipment models affected. I believe the other ATM networks owned by MCI Worldcom, such as MCI and UUNET are still seperate and aren't directly impacted. I don't know where MFS's network was rolled into. To fix the problem, MCI Worldcom customer service reports they will have to reload all the Worldcom ATM switches this evening between Midnight and 2:00am. >This is interesting. I don't recall their "entire" ATM network being Cisco .. >or much of it at all for that matter. What was the source of this report? > > >> MCI Worldcom had a circuit outage in Indianapolis at about 11:30 CST >> 3-Feb-1999. Since then the MCI Worldcom ATM network has been FUBARed. >> MCI Worldcom believes the problem is in some Cisco equipment, and >> cisco has issued a patch. MCI Worldcom will be reloading their entire >> nationwide ATM network between midnight and 2:00am hoping to fix the >> problem. >> >> I don't know if MCI Worldcom has filed a FCC outage report like AT&T >> did when their frame-relay network had problem. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

1 0

Re: OUTAGE: MCI Worldcom nationwide ATM network
by Danny McPherson 04 Feb '99

04 Feb '99

This is interesting. I don't recall their "entire" ATM network being Cisco .. or much of it at all for that matter. What was the source of this report? -danny > MCI Worldcom had a circuit outage in Indianapolis at about 11:30 CST > 3-Feb-1999. Since then the MCI Worldcom ATM network has been FUBARed. > MCI Worldcom believes the problem is in some Cisco equipment, and > cisco has issued a patch. MCI Worldcom will be reloading their entire > nationwide ATM network between midnight and 2:00am hoping to fix the > problem. > > I don't know if MCI Worldcom has filed a FCC outage report like AT&T > did when their frame-relay network had problem. > -- > Sean Donelan, Data Research Associates, Inc, St. Louis, MO > Affiliation given for identification not representation >

1 0

Re: Monitoring, Flow Stats (Re: spam whore, norcal-systems)
by Dean Anderson 04 Feb '99

04 Feb '99

At 06:16 PM 2/1/1999 -0500, Jared Mauch wrote: > Interesting coroloary, > > Is it illegal for me to do flow-stats, as that examines packets >(in the same way one would filter), causing this data to be stored on >my flow stats server? If you read the statute, it permits monitoring for quality control purposes, which your flowstats are. There is no exception in 2511 for what Ravi did. Does Verio often reveal confidential information about their customers' customers traffic? I wonder how Verio's ISP customers/peers feel about that. I know I wouldn't be happy if UUnet or BBN thought they could capture and publish my customers packets. My customers include insurance and health care (privacy intensive) companies. They would be very unhappy if we used someone who had this attitude. The anti-spammers usually claim the abuse exception as justification for instituting a block. Its their best (though still flimsy) argument. Its flimsy since the congress has the authority to regulate or ban spam, and the congress did pass laws banning junk faxes, and limiting calls to cell phones, yet they have not yet banned spam. Nor has any court found spam by itself to be an abuse. The one spam related law that was before the congress would have placed some requirements on spammers, but would have made it specifically not an abuse for 2511. In other words, the congress doesn't agree with the anti-spammers. --Dean ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

4 3

OUTAGE: MCI Worldcom nationwide ATM network
by Sean Donelan 03 Feb '99

03 Feb '99

MCI Worldcom had a circuit outage in Indianapolis at about 11:30 CST 3-Feb-1999. Since then the MCI Worldcom ATM network has been FUBARed. MCI Worldcom believes the problem is in some Cisco equipment, and cisco has issued a patch. MCI Worldcom will be reloading their entire nationwide ATM network between midnight and 2:00am hoping to fix the problem. I don't know if MCI Worldcom has filed a FCC outage report like AT&T did when their frame-relay network had problem. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

1 0

Re: Monitoring, Flow Stats (Re: spam whore, norcal-systems)
by Dean Anderson 03 Feb '99

03 Feb '99

At 01:08 PM 2/3/1999 -0800, Dan Hollis wrote: >On Wed, 3 Feb 1999, Dean Anderson wrote: >> One doesn't lose privacy protections merely because they are or might >> be doing something you don't approve of. > >In regards to electronic communication and undesirable activity (or in >violation of a signed AUP), the privacy protection defense is an extremely >weak one, and has been rejected by judges. Basically if what youre doing >is in violation of an AUP that you signed, judges have ruled that >the privacy protection claim is no defense. You voluntarily waived those >rights by signing them away. This is true for online service dialup users who send or get mail from a service. The service can boot them. Your direct users signed agreements which give you permission to block or filter. They gave you permission. Now, the ECPA still applies, but you are now *authorized* to do what would otherwise be illegal. ECPA makes *unauthorized* accesses illegal. That doesn't make it true for transit providers. Your boss at a transit provider for someone else 3 providers away isn't a party, and can't authorize you to read the communication. Ask yourself the following question: Am I a party (sender or recipient) to the communication? Am I authorized by someone who is? **thanks to Dean Robb, the Attorneys manual says it must be "specifically authorized" If you can answer either of these affirmatively, you're OK. But remember, if the sender comes back and says "You aren't a party to the communication, I didn't give you permission", you could be in big trouble. You can't be fired for refusing to violate a law. (well, you could be, but you'd have a wrongful termination case) But you are still responsible for a criminal violation even if your boss tells you to do it. Owen DeLong in private communication points up that he thinks that this permission is transitive. That has the problem that it trivially obviates all privacy. Every provider is automatically authorized, no one is not authorized. Privacy is in the eyes of the provider. The ECPA was intended to prevent communications providers from looking at things they shouldn't and don't need to. So I'm not convinced. **thanks to Dean Robb, the Attorneys manual says it must be "specifically authorized" I note that none of the big providers do any of this. They don't block. They don't monitor for more than their service quality. Other than canceling service if they get complaints, they don't do anything except perhaps refer complaints to others. >Also, the privacy protection defense is almost always rejected if it >involves outright criminal activity eg smurfs, theft, etc. True. Thats where the abuse clause presumably applies. But it has to be criminal. UCE isn't criminal. --Dean ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

2 2

18USC2511 - Please stop
by Steve Sobol 03 Feb '99

03 Feb '99

I know I'm going to get flamed by *someone* for posting this and contributing to the signal degradation on the group, but... The applicability of 18USC2511 to spam is offtopic, spam is offtopic, and I'll be happy to create a mailing list for Dean and the people who would like to argue with him on this point if such a list is desired. Please drop the thread. -- Steve Sobol sjsobol(a)nacs.net (AKA support(a)nacs.net and abuse(a)nacs.net) "And my heaven will be a big heaven/And I will walk through the front door" --Peter Gabriel - "Big Time"

1 0

Re: Hawaii Exchange Point?
by scott w 03 Feb '99

03 Feb '99

Digital Island is not an "exchange point / common meet" as was first posted. > Closest thing I know of is digital island. > >>Is there any type of exchange point / common meet in Honolulu or >>elsewhere? Looks like you've found info/contacts on HIX, reported it to the list, and this thread is at its end... scott On Wed, 3 Feb 1999, Ivan Kotcher wrote: > I'm confused...then what is the statistics page at > http://spike.uhcc.hawaii.edu/traffic/hix.html ? > > And whatever happened to the IX the government of Hawaii passed a bill to > fund and have the University manage? > > Just curious...I remember talking with somebody at LavaNet about the > Hawaiian Internet Exchange while ago, and I thought it was up for general > peering as a common meet point. > > Ivan > > > At 09:51 AM 2/3/99 -1000, you wrote: > > > > > >nope. see: http://www.digisle.net/products/ > > > >scott > > ----------------------------- > Ivan Kotcher - Manager, Strategic Consulting > Dimension Enterprises > 205 Van Buren Street, Suite 180 Herndon, VA 20170 > +1.703.709.7500 (v) +1.703.709.7699 (f) ikotcher(a)dimension.net > PGP Public Key available on request.... >

1 0

InterNIC / ARIN record loss/error stories needed
by Ehud Gavron 03 Feb '99

03 Feb '99

Our organization is in need of real occurrences that people have had with InterNIC/ARIN's database and record-keeping. What we're specifically looking for is some case histories where InterNIC/ARIN has (1) Modified a record without authorization of an owner (2) Deleted a record without authorization of an owner (3) Lost a record without authorization of an owner (4) Failed to correctly record ownership of a record or anything else of a similar nature. CONFIDENCE: If you request, we will keep these responses confidential. NANOG: If you're interested in a summary of responses, email and tell me, and I'll email a summary to the list. Ehud Gavron gavron(a)aces.com

1 0

Re: Monitoring, Flow Stats (Re: spam whore, norcal-systems)
by Dean Anderson 03 Feb '99

03 Feb '99

At 11:28 AM 2/2/1999 -0500, John Fraizer wrote: >(i) It shall not be unlawful under this chapter for an operator of a >switchboard, or an officer, employee, or agent of a provider of wire or >electronic communication service, whose facilities are used in the >transmission of a wire or electronic communication, to intercept, disclose, >or use that communication in the normal course of his employment while >engaged in any activity which is a necessary incident to the rendition of >his service or to the protection of the rights or property of the provider >of that service, except that a provider of wire communication service to >the public shall not utilize service observing or random monitoring except >for mechanical or service quality control checks. > > >It would seem to me that blocking UCE to clients who have signed off on our >policy of doing so would fall under the auspices of "normal course of his >employment while engaged in any activity which is a necessary incident to >the rendition of his service or to the protection of the rights or property >of the provider of that service". It has to be a "necessary incident". Routing is an example of something thats necessary incident to rendition of service. Or it could be for the protection of rights or property (the oft-used abuse clause). In this case, it says at the the end that service providers "shall not utilize service observing or random monitoring except for mechanical or service quality control checks" Of course, this is all moot with mutual consent. But then you have to show where Norcal signed off on Verio's policy. Since they aren't Verio's customer, it doesn't seem likely they agreed to Verio's policy. And of course, if Norcal claims they didn't agree to allow Verio to monitor and publish their traffic, and Verio has no paper that Norcal did agree, it seems difficult for Verio to prove that Norcal did agree. Which adds up to something called "exposure". --Dean [Though, I suppose we have progressed from two years ago when people were certain that 2511 "only applied to telcos".] ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

4 3