[anti-abuse-wg] New Abuse Information on RIPE NCC Website

In message <51C0783C.7010708 at heanet.ie>, 
Brian Nisbet <brian.nisbet at heanet.ie> wrote:

>There is no question in my mind that there is a massive problem in the 
>RIPE NCC service region, just as there is elsewhere. I'm not convinced 
>that there's any good in comparing them, rather we should admit that 
>there is such a problem.

As noted in my prior post, I agree entirely with Brian on this.

>I remain to be convinced that we will ever reach an agreed definition of 
>network abuse...

Please excuse me for stating the obvious, but the most certain way to
insure that we will never succeed in such an effort is never to even try.

>I *do* believe that there should be more rigour involved in obtaining 
>addresses, but there you also have a problem of national law. If a state 
>says "this company is a legitimate company" does the NCC have any right 
>to argue?

An excellent question if ever there was one.  Please allow me two responses.

Firstly, this sort-of reminds me of various classic and generally archetypal
discussions/disagreements/confrontations that I had with various adult
authority figures when I was growing up, in particular, my mother.  I would
begin by saying something like "Gee, ma, but all of the other kids are
having fun, sniffing the fumes from felt-tip pens and then skateboarding
down Lombard Street!  So why can't I??" to which she would provide the
stock pre-canned stadard adult response "So, if Johnny jumped off a cliff
would you do the same thing?"

If a given nation, or even a given municipality within the admirably
diverse RIPE region decided to make criminality a virtue, would RIPE be
in any sense, either legally, morally, or ethically obliged to follow
suit?  I don't think so.  Would it be wise to do so?  Again, I don't
think so.  If Upper Volta decides tomorrow to diversify its flagging
economy by making it 100% legal, within that jurisdiction, to offer
DDoS-for-hire services, then should (or must) all nations and munici-
palities within the RIPE region then automatically ascent to that lowest
common denominator of sanity?  (We have a saying that covers exactly
such self-destructive outcomes in this country... "The Constitution is
NOT a suicide pact.")

Secondly, although not probable, it is certainly possible that at some
point the express laws of some nation or municipality within the RIPE
region might come into direct conflict with what _already_ seems to be
against the rules... or at the very least seriously frowned upon... within
RIPE's jurisdiction, i.e. spamming.  In such a case, whose rules should
give way to whose?

Here in the United States, there are many who advocate for, and take the
view that society would be safer if each and every last one of us owned and
carried a gun around all of the time.  This is certainly a debatable
point, but every now and again some small municipality, usually somewhere
in Texas, passes or tries to pass a law _requiring_ all citizens to own
firearms.

Now, imagine for a moment that The Duchy of Grand Fenwick (google it) has
just passed a law _requiring_ all of its citizens to spam.  What is RIPE
going to do?  Issue each citizen of Grand Fenwick his or her own /24?
In short, at what point does respect for the individuality and authority
of the constituent nations and municipalities of the entire RIPE region
cross over into unambiguous lunacy?

At the birth of my own nation, there existed 13 totally independent colonies,
none of which could even stand to be in the same room with any of the others
for any length of time.  They all hated each other and each had their own
preferred ways of doing things.  In the end, they found a sufficently
motivating external threat that was enough to force them at least into a
loose confederation.  I suggest that the kinds of threats to network
stability and usefulness that we all know exist on the Internet today,
and which we can reasonably anticipate are only likely to worsen in the
future, are and should be enough for the RIPE membership to assert, at
least to some minimal resonable extent, its own independent authority,
at least within that very limited jurisdiction which is, by all rights,
more the property and province of RIPE than it is of any nation state,
i.e. that portion of "cyberspace" which hovers like an unseen aether at
all times over the RIPE geographic region.  This portion of cyberspace
is in some ways more important than any of the individual nation states
that happen to lie under it, and its continued stability and usefulness
is most definitely _not_ the primary responsibility of any of those
individual nation states, nor even all of them put together.  As it is
not their responsibility, what sense would it make (or what sense does
it make) to defer exclusively to _their_ authority?  The answer is simple.
It makes no sense at all.  RIPE must have its own rules for the protection
and stability of what is, after all, its own special dominion.

(Notwithstanding all of the above having being said, I want to be clear
that I am not fundamentally an "internationalist".  Nor would I by any
means or on any occasion make any attempt to defend the so-called "Euro
Project", let alone its now evident tragic consequences.  I am an advocate
only of pragmatism, of what makes sense, and of what works.  The Euro
does not.  The Internet must.)

>Ronald, I ask this sincerely, and I apologise if I missed it before, but 
>what is your definition of 'network abuse'?

Everything I don't like that goes on every day on the Internet.  I could
drag out the whole list, but I don't want to bore you.  It's as long as
your arm, and most definitely includes a LOT more than spamming.

But my own views on this are neither here nor there.  I think that you and
I agree that only that set of things that the community as a whole says
are "network abuse" should be construed, for any practical purpose, to be
such, and in this crowd I'm only one... or, as I myself would advocate,
perhaps only 1/2 or 1/4 vote, as I neither reside in RIPE-land, nor do
any substantial business there, nor, most importantly, do I operate an
Internet-connected network there.

>I'm not asking this to call you out, I'm genuinely interested.

I am not offended and wll be happy to give you a more detailed expose of
my personal defintion of "network abuse" off list.

>I know why definitions are important, 
>but I also know how hard they can be and given the limitations of what 
>the NCC can do (and what I, as an operator, want it to do) I'm not sure 
>how much use it will actually be to pursue such a thing.

See above.

What is RIPE going to do when Grand Fenwick starts _encouraging_ its
citizens to spam, hack, and DDoS?

All things considered, it would be Better if RIPE had an answer to this
question well _before_ it comes to this, because I can assure you that
eventually it _will_ come to this.  It will be an inevitable result of
the fact that money is involved, and lots of it.

>Are there other ways of looking at this, of tackling it, that have more 
>chance of success?

None whatsoever.

It is always politically expedient not to decide anything, but as I said
earlier, not to decide is to decide.


Regards,
rfg


P.S.   In the early 1970's, somehow and for some reason I cannot even
remember now, I aquired a thin little paperback book that described
what I dimly remember was probably the instruction set of the early PDP-11's.
(This was before I had even touched any actual computer, let alone any PDP.)
Anyway, in the first few pages, probably just after the title page of the
book, I think, DEC had inserted a small quote from a poem.  I have thought
about that many times since.  I don't know if I can even quote it accurately
anymore... I somehow lost the book decades ago... but I'll try.

          He took the wheel in a lashing raging storm.

          "My plan is to have no plan!" he said.

          And six months later, "I have been driven by events."


                             --  The People, Yes
                                 Carl Sandburg