- Test - lists.nanog.org

Re: Warrants for email and backup tapes
by Karl Denninger 29 Jul '98

29 Jul '98

On Wed, Jul 29, 1998 at 04:10:07AM -0500, Phil Howard wrote: > Karl Denninger wrote... > > [regarding what William Allen Simpson wrote] > > > Talk to a lawyer who understands this. > > Most definitely. > > > > IN GENERAL - a state-based subpoena out of jurisdiction does not have to be > > complied with. HOWEVER, the issuer can then turn around and get it served > > out of your state (if they want to). > > > > Its a pain in the ass for them to do this, but they certainly CAN. > > > > If you have what's in the subpoena, and the subpoena is valid, you either > > comply or risk a contempt citation from the judge who signed it. You don't > > have to produce what you don't have, obviously (you can't invent things that > > don't exist!) > > > > You CAN fight a subpoena (and you might even be able to get it quashed). > > You really need a good attorney to look this situation over. > > I'm not a lawyer, so I can't specifically comment about law with competence, > but without it, my feeling here is that asking for backup tapes of e-mail is > no different than asking for copies of the e-mail itself. AND, my feeling > is that the e-mail box is effectively the property of the person or business > to whom it is delivered. It is not different, IMHO, than a court ordering > your mailman to go back to your home, retrieve the mail from the mailbox he > put it in (which you have not yet removed), open it, photocopy it, re-seal it, > put it back, and deliver the copies to the party specified in the order. Thus > it is also my opinion that for a court to properly order the contents of the > mail to be delivered to it, it must issue the subpoena naming the specific > person, persons, business, or businesses for which it wants the mail, and it > must deliver that subpoena to said parties first, ordering you to deliver only > upon failure of the mail owner's to comply with the order of the court. Any > less is a violation of the 4th Amendment of the United States (IMHO). Uh, no. The point of the 4th Amendment is that it protects against *warrantless* searches and seizures. Now you can *challenge the subpoena* on those grounds (that the warrant is improper according to the 4th Amendment). What you can't do is pocket-veto the subpoena. It is exceedingly dangerous to ignore a subpoena under ANY set of circumstances. The appropriate choices of action are to either comply with it or fight it, but you must NEVER ignore it. If you DO ignore it, you risk the judge who signed the subpoena issuing a bench warrant for your arrest on either civil or criminal contempt charges. The cute part about contempt of court is that you can be locked up for what basically amounts to an indefinite period (until you comply with the court's orders) or fined hideous amounts of money with essentially no recourse. As a rule of thumb, do not screw around with men and women in black robes behind a bench! If you don't have what they want you still have to respond. Let's say you get a subpoena for (A), (B) and (C). You have (A), but not (B) or (C). You produce (A), and for (B) and (C) you instead produce an affidavit which says that no responsive reply is possible as the materials and/or documents you have been asked for do not exist. Note that lying about (B) or (C) constitutes perjury, a felony, so don't do that! Subpoenas are no big deal. We get them with some regularity (probably two or three a year) around here. Usually it is the result of some investigation that is being done on either a civil or criminal matter where someone did something that another party or the government doesn't like (ie: forgery of a purchase order or check, etc). We're on a good enough basis with the local Federales that when they're going to send one of these over they usually call first asking for what they want; we point out that our policies and contract prohibit disclosing what they want, and they very politely say "thank you very much". An hour later a nice man appears with papers in hand, signed by a judge - at which point we give them exactly what they asked for. :-) I've yet to fight one that we've received at MCSNet, but if I felt there was good cause to do it, I would. Unless you have a contractual duty to your customers not to comply with a subpoena (not unheard of in a contract, but also unusual) you do NOT have to notify them that you were served or give them the opportunity to quash the subpoena. If you EVER get one of these and suspect, for any reason, that it is aimed at *you*, don't do a thing until you talk to a GOOD lawyer - and do that RIGHT AWAY. Most subpoenas have to be complied with or fought quickly - if you're lucky you have five business days. Sitting on it for any length of time is a very bad idea. The kind of thing being talked about here though, where someone wants copies of *backup tapes*, could easily be aimed at *YOU*. It also might not be though - generally, when you get one of these and its aimed at a third party, the reason for that kind of request is that in order to be admissible the records must be produced in the "ordinary course of business". Ergo, if a customer is doing something "bad", and they think you have a copy of it on a backup tape, they can't ask you to extract the contents of THEIR directory, because doing that is not an ordinary record - and further, it leads to questions about the custody and control of the information. Instead, they'll ask for the whole tape and have one of their forensics people dissect it to get the information they want. Note that, as others have noted, if the subpoena is from a grand jury, you won't be told much when you inquire as to what's going on (other than that it is from a grand jury). The reason is that grand jury proceedings are held in secret, and it is a crime to disclose the proceedings in the grand jury room until they are concluded. None of this is legal advice, since I ain't a lawyer :-) -- -- Karl Denninger (karl(a)MCS.Net)| MCSNet - Serving Chicagoland and Wisconsin http://www.mcs.net/ | T1's from $600 monthly / All Lines K56Flex/DOV | NEW! Corporate ISDN Prices dropped by up to 50%! Voice: [+1 312 803-MCS1 x219]| EXCLUSIVE NEW FEATURE ON ALL PERSONAL ACCOUNTS Fax: [+1 312 803-4929] | *SPAMBLOCK* Technology now included at no cost

1 0

Re: MCI [encore]
by Sean Donelan 29 Jul '98

29 Jul '98

>How did they do (measured by your mailbox) today? :-( Not a peep today. There does still seem to be some fall out from Monday's events, but I'm having difficulty correlating all of Tuesday's weirdness with Monday's. People may have been re-routing around MCI on monday, and the extra traffic overloaded other lines; the backlog (mail, news, etc) started flowing when MCI did a rolling BGP reset overnight and it took most of the day to clear up; everyone checking the Powerball lottery web sites for their lucky numbers; or something completely different. I didn't see any large 'outages' on Tuesday, but there did seem to be a higher level of variability in all types of service. I'm interested in hearing what some of the professional and academic Internet measurement projects showed. I looked from many different vantage points, but I'm always worried there may be something unusual my customer population. >No ETR today AFAIK... I'm still seeing some of my routes re-presented to >the vbns, et al Water, electrons, and ip packets all want to follow the path of least resistance. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

1 0

Warrants for email and backup tapes
by William Allen Simpson 29 Jul '98

29 Jul '98

Our ISP was just served a warrant (out of California) demanding our dialup logs and email backup tapes. So far, the warrant is probably invalid, as it mis-named the company. And as far as we can tell, we are not being charged with anything -- or at least we have not been told so. We only have our usual contracts attorney, and he seems a bit out of his depth. This is pretty invasive to our customers. We'll have a dickens of a time complying, as we don't back up client email, except at odd intervals backing up entire systems. And we only keep dialing logs around for a few months at a time, since we don't use them for billing. Is anyone else having this experience? If so, what have you done? WSimpson(a)UMich.edu Key fingerprint = 17 40 5E 67 15 6F 31 26 DD 0D B9 9B 6A 15 2C 32

5 4

Re: MCI [encore]
by Joe Provo - Network Architect 28 Jul '98

28 Jul '98

Sean Donelan sez: >Not too bad. NANOG outage reporting beat MCI informing customers >by 52 minutes. All times measured at my mailbox :-) MCI did better >than most providers do. Although there was still a rather lengthy >delay between the start of the outage and the first responses to >customers. How did they do (measured by your mailbox) today? :-( No ETR today AFAIK... I'm still seeing some of my routes re-presented to the vbns, et al Joe -- Joe Provo, Network Architect 508.229.8400 x3006 Commercial Internet Services Group Fax 508.229.2375 UltraNet Communications, Inc., an RCN Company <jprovo(a)ultra.net>

1 0

Re: MCI
by Sean Donelan 28 Jul '98

28 Jul '98

Not too bad. NANOG outage reporting beat MCI informing customers by 52 minutes. All times measured at my mailbox :-) MCI did better than most providers do. Although there was still a rather lengthy delay between the start of the outage and the first responses to customers. Overall a pretty crudy day for the Internet, but no reports on CNN which I saw. I guess that means it was a successful day. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

1 0

MCI
by Bradley Reynolds 27 Jul '98

27 Jul '98

forwarded>> From: "Brent E. Taylor" <btaylor(a)MCI.NET> To our customers, The MCI iNOC is reporting a network-wide BGP (border gateway protocol) access list deployment failure. Internet MCI's 4th level engineering is working to re-deploy these access lists at this time. Only those customers peering with MCI via BGP should be effected. We apologies for any inconveniences that this incident may have caused. << Obviously english was not his native tongue. BR Bradley Reynolds QualNet

1 0

Re: MCI
by sob＠academ.com 27 Jul '98

27 Jul '98

1 0

MCI
by Joe Shaw 27 Jul '98

27 Jul '98

Anyone know what's going on with Internet MCI? I've talked to a few people local (Houston, TX area) who are MCI only customers and it appears that none of them are capable of announcing their routes via BGP. What gives? Joe Shaw - jshaw(a)insync.net NetAdmin - Insync Internet Services "Backhoes never sleep." - Patrick Greenwell

1 0

Re: IS-IS or OSPF as BGP IGP
by Paul Ferguson 27 Jul '98

27 Jul '98

My recommendation is not to redistribute BGP into any IGP at all. I personally consider that to be a very dangerous thing to do. - paul At 06:26 PM 7/17/98 -0400, Martin, Christian wrote: >All, > >Does anyone have any information on redistributing BGP traffic into OSPF >versus ISIS? What about just carrying IBGP sessions? My OSPF database >is growing, and I'd rather not carry LSAs with BGP routes as well as >private routes, etc. Too messy. By introducing ISIS and using it only >as a BGP IGP, what can I expect? Experiences with Cisco gear preffered. > >-Christian > >

3 2

Re:Worldcom Fiber Cut
by Mike Trest (Yokohama Office) 27 Jul '98

27 Jul '98

Martin, SONET redundancy is an option which not all SONET/SDH circuit providers are able to deploy. Even when it is deployed, the alternate strands are frequently inside the same fiber bundle (collapsed backbone) which makes primary circuit and the backup circuit subject to simultaneous back-hoe fade. Request "DLR" approval on your circuit orders to confirm diverse path . . . but do not hold your breath. My experience indicates that very few providers have truly diverse routed backup fiber between more than a few of their major circuit nodes. Most truly diverse routes involve "fiber swaps" among fiber owners with non-contiguous fiber routes. ..mike.. At 05:17 PM 7/22/98 -0400, you wrote: >600 DS3s affected. ETR 19:30-20:00. This is the second major cut in as >many weeks. Whatver happened to SONET redundancy, hmmm???? > >-Chris >

2 1