[anti-abuse-wg] Hijack Factory: AS201640 / AS200002

There are two or three things here.

RIPE is under dutch law and the Netherlands does have a law against spam,
and other cybercrime legislation as well that has historically been
actively enforced.

The LIR is under romanian law and that does appear to have some laws
against spam on their books but none of it appears to have been tested in
court.

As a LE organization, Europol, like Interpol, deals with coordination and
clearinghouse work between national LE and neither is an international
police force.

This simply means that LE or the appropriate regulator in either country
where the different parts of this contract exist (the Netherlands - opta or
dutch high tech crime police, and whoever are their peers in Romania)
should be able to act on this information.

U.S. LE as well given that the actual perpetrators are there.

Whether dutch, romanian or US law are able to take cognizance of publicly
available information to open an investigation, or they need a local victim
of IP hijacking (or an international victim through the normal LE channels)
remains to be seen.

In either case we do need to see how much RIPE NCC can do to exercise its
fiduciary duty over v4 space.

A bank manager who loaned money on the same slapdash implementation of
criteria that NCC allocates IP space on (due diligence being interpreted as
'internet policing' might explain that) would be fired and/or prosecuted in
very short order indeed.
On Fri, 7 Nov 2014 at 02:21 Reza Mahmoudi <R.mahmoudi at mobinnet.net> wrote:

> I was wondering if this kind of hijacking falls into the category of
> Cybercrime and authorities like Europol (https://www.europol.europa.eu/ )
> can help?
>
> Reza Mahmoudi
> ________________________________________
> From: anti-abuse-wg-bounces at ripe.net [anti-abuse-wg-bounces at ripe.net] on
> behalf of Ronald F. Guilmette [rfg at tristatelogic.com]
> Sent: Friday, November 07, 2014 12:02 AM
> To: anti-abuse-wg at ripe.net
> Subject: Re: [anti-abuse-wg] Hijack Factory: AS201640 / AS200002
>
> In message <20141106150814.GX31092 at Space.Net>,
> Gert Doering <gert at space.net> wrote:
>
> >In this particular case, I wonder why nobody is yelling at the upstream
> >who is happily forward packets for that AS...  due dilligence at
> >accepting customer prefixes would have easily caught the announcements.
>
> I personally would be ``yelling at the upstream'' right now, but someone
> made a comment on the NANOG mailing list which sort-of hinted that this
> would be entirely futile in the case of AS200002.  I don't know, but I
> suspect that he already knows something that I don't know, so I'm not
> wasting my time on sending comlaints to an entity that, it seems, may
> perhaps not give a damn.
>
> >(Yes, I understand that I'm now officially part of the problem, as
> >I'm obviously not willing to do everything technically possible to
> >stop particular sorts of badness)
>
> To the extent that you might be able to avoid forwarding route
> announcements which originate from AS201640, allow me to express
> my personal opinion that doing so would be admirable.
>
>
> Regards,
> rfg
>
>
> --
> This email was Virus checked by Juniper Security Gateway.
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: </ripe/mail/archives/anti-abuse-wg/attachments/20141107/f7e8bb8c/attachment.html>