One of the issues I've been discussing as part of various critical infrastructure protection forums is the need for "all hazard" outage information. Treating Internet security as just a law-enforcement issue can warp your perception. Unless you have a good view into all the other things which can wreck Internet availability, it is difficult to gauge the impact of a malicious activity versus "normal" outages. I don't completely understand the data. The impact of the Baltimore train wreck shows up very clearly. Traffic returns to nearly normal by 6am the next morning. But then degrades again the following the day (i.e. "Worm day"). I don't have access to the raw data, so I can't tell if there are differences between carriers with fiber in the Howard tunnel and other carriers. Did congestion increase the following day due to the reduced bandwith the following day, or was it consumed by the worms propagation. http://www.keynote.com/press/html/special_worm_update.html One of the unique things IOPS/Kelly Cooper have been trying to include in the ISP-ISAC, which the other ISAC are lacking, is an outage reporting component. Currently the Internet does have a clear point of contact for dealing with these events. Even if your company is already joining other ISACs, if you are an Internet provider, I hope you look into and consider working with the ISP-ISAC. See the last NANOG conference web page for a copy of the proposal. The "all hazard" aspect makes things more complicated, but I think it significantly enhances the usefullness of the ISP-ISAC.