We started announcing /24s, combined with the shorter path it seems to be fine. Still jumping through hoops upstream. On Jan 31, 2012 8:26 PM, "PC" <paul4004@gmail.com> wrote:

Curious, What was the outcome of this?

In any case, I'm hoping the major Tier-1s do the right thing and filter the rogue annoucements, while allowing the OP's. Hopefully after enough pressure and dysfunction, they will give it up.

On Tue, Jan 31, 2012 at 6:15 PM, David Conrad <drc@virtualized.org> wrote:

...

...

I hope none of you ever get hijacked by a spammer housed at Phoenix NAP. :)

In the dim past, I had a somewhat similar situation:

- A largish (national telco of a small country) ISP started announcing address space a customer of theirs provided. Unfortunately, the address space wasn't the ISP's customer's to provide. - When the ISP was notified by both their RIR and the organization to which the address space was rightfully delegated, the ISP's response was:

"We have a contractual relationship with our customer to announce that space. We have neither a contractual relationship (in this context) with the RIR nor the RIR's customer. The RIR and/or the RIR's customer should resolve this issue with our customer."

It as an eye-opening experience.

Regards, -drc

On Jan 31, 2012, at 4:49 PM, Kelvin Williams wrote:

...

We're still not out of the woods, announcing /24s and working with upper tier carriers to filter out our lists. However, I just got this

...

from Phoenix NAP and found it funny. The "thief" is a former customer, whom we terminated their agreement with. They then forged an LOA, submitted it to CWIE.net and Phoenix NAP and resumed using space above and beyond their terminated agreement. So now any request for assistance to stop our networks from being announced is now responded to with an instruction to contact the thief's lawyer.

kw

---------- Forwarded message ---------- From: Kelvin Williams <kwilliams@altuscgi.com> Date: Tue, Jan 31, 2012 at 7:43 PM Subject: Re: [#135346] Unauthorized BGP Announcements To: noc@phoenixnap.com

We'll be forwarding this to our peers in the industry--rather funny that Phoenix NAP would rather send us to the attorney of the people stealing our space than bothering to perform an ARIN WHOIS search, or querying any of the IRRs.

Interesting... Very interesting... So, who all do you have there--spammers and child pornographers? Is this level of protection what you give to them all?

On Tue, Jan 31, 2012 at 7:30 PM, Brandon S <BrandonS@phoenixnap.com> wrote:

...

Hello,

Thank you for your email. Please direct any further questions regarding this issue to the following contact.

Bennet Kelley 100 Wilshire Blvd. Suite 950 Santa Monica, CA 90401 bkelley@internetlawcenter.net

Telephone 310-452-0401

Facsimile 702-924-8740

-- Brandon S. NOC Services Technician

** We want to hear from you!** We care about the quality of our service. If you’ve received anything less than a prompt response or exceptional service or would

response like

...

...

to share any feedback regarding your experience, please let us know by sending an email to management: supportfeedback@phoenixnap.com

-- Kelvin Williams Sr. Service Delivery Engineer Broadband & Carrier Services Altus Communications Group, Inc.

"If you only have a hammer, you tend to see every problem as a nail." -- Abraham Maslow

On Jan 31, 2012, at 5:52 PM, Mark Andrews wrote:

...

"We have a contractual relationship with our customer to announce that = space. We have neither a contractual relationship (in this context) = with the RIR nor the RIR's customer. The RIR and/or the RIR's customer = should resolve this issue with our customer."

And if I have a contract to commit murder that doesn't mean that it is right nor legal. A contract can't get you out of dealing with the law of the land and in most place in the world "aiding and abetting" is illegal.

You appear to be making a large number of assumptions on limited evidence. In the case I'm familiar with, I can assure you that no laws were being broken (even if all the parties were in the same country, which they weren't). However, this is getting off-topic and I don't want to hijack the thread. The issue of route hijacking is quite serious and it will be interesting to see how this all works out. Regards, -drc

On Jan 31, 2012, at 5:52 PM, Mark Andrews wrote:

In message <7B85F9D8-BA9E-4341-9242-5EB514895B4C@virtualized.org>, David Conrad writes:

...

...

I hope none of you ever get hijacked by a spammer housed at Phoenix = NAP. :)

In the dim past, I had a somewhat similar situation:

- A largish (national telco of a small country) ISP started announcing = address space a customer of theirs provided. Unfortunately, the address = space wasn't the ISP's customer's to provide. - When the ISP was notified by both their RIR and the organization to = which the address space was rightfully delegated, the ISP's response = was:

"We have a contractual relationship with our customer to announce that = space. We have neither a contractual relationship (in this context) = with the RIR nor the RIR's customer. The RIR and/or the RIR's customer = should resolve this issue with our customer."

It as an eye-opening experience.

Regards, -drc

And if I have a contract to commit murder that doesn't mean that it is right nor legal. A contract can't get you out of dealing with the law of the land and in most place in the world "aiding and abetting" is illegal.

Mark -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org

Not to put a damper on things, but, is there actually any law that precludes use of integers as internet addresses contrary to the registration data contained in RIR databases? I can see how a case might be made for tortious interference, but I think it's quite nebulous and I believe a civil matter at best. IANAL, but, I actually wonder if there is any way to construe the behavior in question as criminal and if so, under what statute(s). Owen

On Jan 31, 2012, at 9:03 PM, Owen DeLong wrote:

Not to put a damper on things, but, is there actually any law that precludes use of integers as internet addresses contrary to the registration data contained in RIR databases?

ARIN spends a bit of time on these types of questions. The right to exclusive use a particular block Internet addresses is indeed provided by contract with ARIN, but the context is within the registration system itself. We are not aware of any law in ARIN's service region which would preclude other parties from configuring equipment with any numbers they wish. Note also - if someone thinks that they have a right of exclusive use of a particular block Internet addresses because of convictions that the addresses themselves are "property" (whatever that means), the outcome still doesn't change; i.e. there is still no law or regulation as best we can determine which prevents someone from configuring their own equipment with any particular block of IP addresses... (and I would advise some very careful thought before advocating that such be changed.[*]) In the end, the registry simple reflects a set of numbers managed for uniqueness by the policies set by the community. Since the Internet relies on unique host identifiers, it's a pretty useful database, but that usefulness is predicated on people actually making use of it... One would think that ISP's wouldn't accept routes accept from the parties not listed on an address block, but that is not universally the case, and correcting that other than at the point of injection is rather problematic unless we have some relatively easy way to build, propagate, and verify routing assertions by the address holder (e.g. RPKI, as noted by Danny and Randy) ARIN is slowly but steadily working on getting RPKI rolled out in production this year... folks interested in gaining some hands-on RPKI experience in the meantime can participate in ARIN's RPKI Pilot; we have more than 50 organizations participating at this time - <https://www.arin.net/resources/rpki.html> FYI, /John John Curran President and CEO ARIN p.s. [*] As previously noted in this discussion, address blocks may sometimes be hijacked based on acts that _are_ violation of law (e.g fraud), but the mechanisms for dealing with such are quite slow by default (at least in the US.) That doesn't mean that they can't work faster, but only that timeliness increases when there are numerous harmed parties are plainly evident to the law enforcement folks. Given the potential impact from abuse or even human error for any orders affecting the Internet, the delay may even be an important feature of the present system.

On Feb 2, 2012, at 9:57 PM, Randy Bush wrote:

my arin email addy and password work on the arin main web site. they do not work on https://rpki-pilot.arin.net/, pita

Randy - That's correct for the pilot - follow the link at the top of the page which says: "If you don't have a log in and want to take part in this pilot, click [here]. Thanks, /John John Curran President and CEO ARIN

On Wed, 01 Feb 2012 12:52:57 +1100, Mark Andrews said:

...

- A largish (national telco of a small country) ISP started announcing national telco. oooh kayyyy...

And if I have a contract to commit murder that doesn't mean that it is right nor legal. A contract can't get you out of dealing with the law of the land and in most place in the world "aiding and abetting" is illegal.

Vercotti ..... andd one night Dinsdale walked in with a couple of big lads, one of whom was carrying a tactical nuclear missile. They said I'd bought one of their fruit machines and would I pay for it. Interviewer How much did they want? Vercotti Three quarters of a million pounds. Then they went out. Interviewer Why didn't you call the police? Vercotti Well I had noticed that the lad with the thermo-nuclear device was the Chief Constable for the area.

On Wed, 1 Feb 2012, Mark Andrews wrote:

And if I have a contract to commit murder that doesn't mean that it is right nor legal. A contract can't get you out of dealing with the law of the land and in most place in the world "aiding and abetting" is illegal.

the topic at hand would appear to be more 'willful negligence' than 'aiding and abetting'. punitive damages could apply. -Dan

On Tue, 31 Jan 2012, David Conrad wrote:

In the dim past, I had a somewhat similar situation:

- A largish (national telco of a small country) ISP started announcing address space a customer of theirs provided. Unfortunately, the address space wasn't the ISP's customer's to provide. - When the ISP was notified by both their RIR and the organization to which the address space was rightfully delegated, the ISP's response was:

"We have a contractual relationship with our customer to announce that space. We have neither a contractual relationship (in this context) with the RIR nor the RIR's customer. The RIR and/or the RIR's customer should resolve this issue with our customer."

It as an eye-opening experience.

Contracts are generally not a valid reason to be breaking laws. Antonio Querubin e-mail: tony@lavanauts.org xmpp: antonioquerubin@gmail.com

On Wed, 1 Feb 2012, David Conrad wrote:

On Jan 31, 2012, at 8:53 PM, Antonio Querubin wrote:

...

...

"We have a contractual relationship with our customer to announce that space. We have neither a contractual relationship (in this context) with the RIR nor the RIR's customer. The RIR and/or the RIR's customer should resolve this issue with our customer." Contracts are generally not a valid reason to be breaking laws.

Which law?

I think if you provided more specific details of your example, I suspect some of us could probably come up with some specific laws that may have been broken :) Antonio Querubin e-mail: tony@lavanauts.org xmpp: antonioquerubin@gmail.com

On Feb 1, 2012, at 10:16 AM, George Bonser wrote:

...

...

...

"We have a contractual relationship with our customer to announce that space. We have neither a contractual relationship (in this context) with the RIR nor the RIR's customer. The RIR and/or the RIR's customer should resolve this issue with our customer." Contracts are generally not a valid reason to be breaking laws. Which law? Let's say I had a business in space in a building I was leasing at 100 Main Street, Podunk, USA.

I'm told IP addresses aren't property.

Or let's say I operated a TV station

As I understand it, radio frequencies are subject to international treaties. In signatory countries, laws can be enacted to enforce the provisions of those treaties. As far as I'm aware, there are no treaties dealing with IP addresses or how those addresses are announced.

It might be civil rather than criminal but the rightful owner of the resource would have a good case.

"Owner"? Long ago, Mitch Kapor (I believe) described the Internet addressing system working because of the "Tinkerbelle Effect", that is (to paraphase), it works because everyone believes it is in their best interests that it works. However, as we've seen when push comes to shove, the Tinkerbelle Effect can break down. Thus, you get perfectly justifiable arguments for stuff like RPKI/BGPSEC and the equivalent of the Protocol Police. This does have the potential for unintended (and intended) consequences... Regards, -drc

Once upon a time, George Bonser <gbonser@seven.com> said:

Let's say I had a business in space in a building I was leasing at 100 Main Street, Podunk, USA. Now let's say you didn't renew the lease so I moved to a building up the block but put the 100 Main Street address on my new location and continued to use that address for my business.

That's covered under trespassing laws.

Or let's say I operated a TV station on channel 37 that was allocated to you but you terminate my operating contract. So I lease/erect a new transmitter and continue broadcasting on channel 37.

That's covered under FCC regulations on use of public spectrum. AFAIK there's no law covering the use of what party X considers their 32 bit numbers (assigned by party A) by party Y. -- Chris Adams <cmadams@hiwaay.net> Systems and Network Administrator - HiWAAY Internet Services I don't speak for anybody but myself - that's enough trouble.

Once upon a time, Nathan Eisenberg <nathan@atlasnetworks.us> said:

...

AFAIK there's no law covering the use of what party X considers their 32 bit numbers (assigned by party A) by party Y.

So, to pose the obvious question: Should there be?

(I honestly don't know the answer is to this question, and am asking in earnest for opinions on the subject)

Personally, I'd rather see the networking community work it out internally, rather than invite government intervention (I hardly think it would stop at regulating 32/128 bit numbers). Besides, how would that work? Say ARIN assigns US company X (operating only in the US) a block, but German company Y (with no US operations) starts announcing the same block. How are US or German laws going to help, when the parties have no common jurisdiction? There need to be better ways to notify (and get action from) upstreams, upstreams/peers of upstreams, etc. Since not all peering is public knowledge, it can be difficult to know who needs notification, so some type of clearinghouse would be good. Maybe a mailing list, made up of network operators, in some type of group, ... :-) -- Chris Adams <cmadams@hiwaay.net> Systems and Network Administrator - HiWAAY Internet Services I don't speak for anybody but myself - that's enough trouble.

On Wed, Feb 1, 2012 at 15:00, George Bonser <gbonser@seven.com> wrote:

...

So, to pose the obvious question: Should there be?

(I honestly don't know the answer is to this question, and am asking in earnest for opinions on the subject)

Nathan

Well, calling the law on someone is kind of the whiner's way out anyway. It would seem that the community could agree on a set of standards for dealing with such problems and if you don't agree to those standards, nobody routes your traffic. In other words, if network A finds network B announcing allocated space belonging to network A and network A makes them (network B) and their upstream provider(s) aware and they refuse to stop the announcement, there should be a mechanism by which the community can agree to filter Network B's AS *and* the AS of the upstream(s) until the situation is rectified. That's a pretty big hammer but verifying someone's legitimate claim on address space isn't that hard, in most cases.

The problem is no one will actually blacklist a big ASN because its not in the individual best interest, which scales greatly with size. RPKI is pretty much the only real fix for this if the chain until the major carrier refuses to delist, and RPKI has it's own issues. -Blake

On Wed, Feb 1, 2012 at 15:21, George Bonser <gbonser@seven.com> wrote:

...

The problem is no one will actually blacklist a big ASN because its not in the individual best interest, which scales greatly with size. RPKI is pretty much the only real fix for this if the chain until the major carrier refuses to delist, and RPKI has it's own issues.

-Blake

Sadly, you're right. But my guess is that such a blacklisting would have to be done for only a very short period of time and once it is done once or twice, it would never need to be done again. But it probably is too big a hammer.

Until there is some sort of registry that is the source of truth and is easy to use (distributed?), we're going to keep repeating this process.

The issue isn't getting the AS blacklisted, the issue is getting people to use the blacklist. Would you trust your router accepting entire ASNs to someone else's list? Would your boss agree to allow others to shut down access to a potentially major entity on the internet for something that doesn't directly impact you? I just don't see it ever happening, and anything short of that is no deterrent for the above. If you can't target the enablers with any kind of stick, then the only other option is RPKI which prevents the actual hijack, but that has it's own issues, due to the same benefits. -Blake

...

So, to pose the obvious question: Should there be [a law against prefix hijacking]?

While I'm certain that's largely rooted in lawmakers who are not technically savvy, I wonder if we-as-an-industry couldn't (or, shouldn't) be doing more to move internal values and policies into defensible legal standards.

So far the track record of the US government trying to make laws regarding technology and the Internet has been less than stellar.

The DMCA is already bad enough, but we continue to see things like PROTECT IP and SOPA pop up in attempts to hand over even more control of the Internet to those with enough money to buy the votes; at great cost to service providers and universities, mind you.

The best we-as-an-industry seem to be able to contribute to the problem is strongly worded and expertly backed petitions to Congress. We're in permanent legislative fire-fighting mode, and we seem to be losing ground at an alarming pace.

Over the past few years it has become blatantly obvious that entire industries are trying to gain special control over the Internet. The RIAA and the MPAA both being openly guilty:

"Candidly, those who count on quote 'Hollywood' for support need to understand that this industry is watching very carefully who's going to stand up for them when their job is at stake, don't ask me to write a check for you when you think your job is at risk and then don't pay any attention to me when my job is at stake."

Chris Dodd, CEO MPAA in response to Obama position on SOPA.

You and I agree that this is a disturbing concept - I doubt there are many dissenting opinions on this list (which is its own monoculture issue for another day).

With attempts at government control of DNS already underway, I think handing over control of BGP would be a dream come true for these guys.

Indeed - and I don't think anyone is suggesting that we hand operational control of BGP to the courts. I'm more curious about legally codifying RIR allocations (obviously, this is a complex and regional issue, but since the two parties in the OP were both US based companies, we can at least begin to have this conversation). Again, I don't know what the right answer is. I'm just turning this over in my brain, and it seems to me that the current state of affairs is too fragile. There is no 'drivers test' before you get your AS number. There are few consequences for hijackers and the service providers who support them - especially if those providers are very large. There is historical precedent for government regulation in non-virtual industries helping to curb the chaos. Hypothesis: If operators could recover their damages via the legal system from a service provider for aiding and abetting the hijacking of their ARIN assigned space, it would encourage a great deal more due-diligence in the service provider space. With nothing to gain, and money to lose, companies will expect their netops people to behave as good netizens. Thoughts? Nathan

So, new law? I don't think its necessary.

YMMV, Eric

The problems are manifold. First of all, a nation's laws only extend to the borders of that nation. The UN is not a government, it is a diplomatic body so it really can't enact anything either. The Internet community is global and if we agree to a certain standard of behavior and consequences for violating that standard, we can police it ourselves just fine. The fundamental problem is there is no absolute "source of truth" in who is entitled to use which resource. So there is little people can really do with any certainty until such a place exists. What we need is a registry that we all agree is valid and agree to go by what it says and if you announce a route that belongs to someone else without their permission and you are made aware of that fact and continue to announce the route, you are subject to having your traffic shunned until you are in compliance. That resource (the registry) should absolutely not be maintained by the UN or any government entity as that will make it unusable. It is something the community has the technology to do, it just requires the resources and the will to do it.

On Feb 1, 2012, at 3:10 PM, Chris Adams wrote:

AFAIK there's no law covering the use of what party X considers their 32 bit numbers (assigned by party A) by party Y.

The US bankruptcy courts have treated these as property that can be sold/transferred comparable to other assets. (See threads re: borders, microsoft, etc in 2011). This does have the effect of being at least a cite in any further litigation, even if the position is not upheld on appeal. - Jared

In message <20120201201012.GE10680@hiwaay.net>, Chris Adams writes:

Once upon a time, George Bonser <gbonser@seven.com> said:

...

Let's say I had a business in space in a building I was leasing at 100 Main Street, Podunk, USA. Now let's say you didn't renew the lease so I moved to a building up the block but put the 100 Main Street address on my new locati on and continued to use that address for my business.

That's covered under trespassing laws.

...

Or let's say I operated a TV station on channel 37 that was allocated to yo u but you terminate my operating contract. So I lease/erect a new transmitte r and continue broadcasting on channel 37.

That's covered under FCC regulations on use of public spectrum.

AFAIK there's no law covering the use of what party X considers their 32 bit numbers (assigned by party A) by party Y.

If you present a false letter of authority you are committing fraud. If you continue to use address after the lease is up it is trespass / theft / breach of contract. I'm sure there are lots more laws that can apply. Counterfieting, wire fraud. Breaches of various Telecommunication Acts, etc. You might have juristictional issues. In the case of the Internet we have a authority for handing out numbers for use on the Internet (IANA). Courts all over the world do recognise that authority directly or indirectly by recognising the RIRs. There are enough analogs in common law to almost everything that happens on the Internet for there to no be the need for specific "Internet" laws. It's just that having a "Internet" law makes it easier to prosecute. Mark

-- Chris Adams <cmadams@hiwaay.net> Systems and Network Administrator - HiWAAY Internet Services I don't speak for anybody but myself - that's enough trouble.

-- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org

On Wed, Feb 1, 2012 at 4:43 PM, Seth Mattinen <sethm@rollernet.us> wrote:

Phoenix NAP colluding to hijack address space and then balking when it was brought to their attention is a perfect example someone could use to say why "we" need to be regulated. And I'm sure it will eventually

There are always going to be some bad actors, and some negligent participants who get taken advantage of by bad actors. There's no way to guarantee a service provider capable of hijacking space does not fall into the category of negligent facilitator. Simple government regulation is of limited value, since the problem network may be overseas. Also, separate networks that adhere to different rules should not have to follow the internet's conventions -- if they want to implement their own local variant of TCP/IP on their computers connected over private connections but not connect to the internet, and therefore follow their own address management system, in a free society, people should be free to do this with their computers; the last thing we ever need are governments mandating global uniqueness of IP addresses, ASN numbers, Port numbers, or other aspects of the engineering of private computer networks. I would say a service provider entering into a contractual relationship with any other network that does not allow the service provider to make and enforce their own network access TOS and routing policies and disconnect downstream networks as necessary to protect network stability or comply with upstream routing policies and what the RFCs and IANA say regarding internet address management, is negligent, from the community's point of view, in that they are not taking the reasonable care that is expected and necessary of service providers participating in the internet. Agreement to implement RPKI by RIRs and the RIR community would solve the problem but has other drawbacks. What the internet really needs is Tier1 and Tier2 providers participating in the internet who "care", regardless of the popularity or size of netblocks or issues involved. And by "care", I mean, providers efficiently investigating reports of hijacking or rogue announcement, and taking switft responsible actions, without bureaucratic processes requiring years and reams of paperwork, or any attempt to shrug off responsibility they have as intermediary. -- -JH

On Wed, 1 Feb 2012, Jimmy Hess wrote:

What the internet really needs is Tier1 and Tier2 providers participating in the internet who "care", regardless of the popularity or size of netblocks or issues involved. And by "care", I mean, providers efficiently investigating reports of hijacking or rogue announcement, and taking switft responsible actions, without bureaucratic processes requiring years and reams of paperwork, or any attempt to shrug off responsibility they have as intermediary.

caring doesn't make money. terminating abusive customers is lost revenue. what needs to happen is retaining abusive customers needs to be more expensive than letting them go. -Dan

On Thu, 2 Feb 2012, Dave Pooser wrote:

...and all we need is for billion-dollar corporations to start putting moral rectitude ahead of profits.

Well, heck, that should start happening any day now! And then FedEx will deliver my unicorn! </snark>

Your unicorn has been impounded by Customs. jms

On Wed, Feb 1, 2012 at 12:37 PM, David Conrad <drc@virtualized.org> wrote:

On Jan 31, 2012, at 8:53 PM, Antonio Querubin wrote:

...

...

"We have a contractual relationship with our customer to announce that space.  We have neither a contractual relationship (in this context) with the RIR nor the RIR's customer.  The RIR and/or the RIR's customer should resolve this issue with our customer." Contracts are generally not a valid reason to be breaking laws.

Which law?

Tortious interference at the very least. Or did you mean criminal law as opposed to common law? Regards, Bill Herrin -- William D. Herrin ................ herrin@dirtside.com  bill@herrin.us 3005 Crane Dr. ...................... Web: <http://bill.herrin.us/> Falls Church, VA 22042-3004

Internet number resource certification and origin validation sure would be nice here ;-)

this is arin address space. arin is the only rir which has not deployed and there is running code randy