There are two or three things here. RIPE is under dutch law and the Netherlands does have a law against spam, and other cybercrime legislation as well that has historically been actively enforced. The LIR is under romanian law and that does appear to have some laws against spam on their books but none of it appears to have been tested in court. As a LE organization, Europol, like Interpol, deals with coordination and clearinghouse work between national LE and neither is an international police force. This simply means that LE or the appropriate regulator in either country where the different parts of this contract exist (the Netherlands - opta or dutch high tech crime police, and whoever are their peers in Romania) should be able to act on this information. U.S. LE as well given that the actual perpetrators are there. Whether dutch, romanian or US law are able to take cognizance of publicly available information to open an investigation, or they need a local victim of IP hijacking (or an international victim through the normal LE channels) remains to be seen. In either case we do need to see how much RIPE NCC can do to exercise its fiduciary duty over v4 space. A bank manager who loaned money on the same slapdash implementation of criteria that NCC allocates IP space on (due diligence being interpreted as 'internet policing' might explain that) would be fired and/or prosecuted in very short order indeed. <div class="gmail_quote">On Fri, 7 Nov 2014 at 02:21 Reza Mahmoudi <<a href="mailto:R.mahmoudi@mobinnet.net">R.mahmoudi@mobinnet.net</a>> wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">I was wondering if this kind of hijacking falls into the category of Cybercrime and authorities like Europol (<a href="https://www.europol.europa.eu/" target="_blank">https://www.europol.europa.eu/</a> ) can help? Reza Mahmoudi ________________________________________ From: <a href="mailto:anti-abuse-wg-bounces@ripe.net" target="_blank">anti-abuse-wg-bounces@ripe.net</a> [<a href="mailto:anti-abuse-wg-bounces@ripe.net" target="_blank">anti-abuse-wg-bounces@ripe.net</a>] on behalf of Ronald F. Guilmette [<a href="mailto:rfg@tristatelogic.com" target="_blank">rfg@tristatelogic.com</a>] Sent: Friday, November 07, 2014 12:02 AM To: <a href="mailto:anti-abuse-wg@ripe.net" target="_blank">anti-abuse-wg@ripe.net</a> Subject: Re: [anti-abuse-wg] Hijack Factory: AS201640 / AS200002 In message <20141106150814.GX31092@Space.Net>, Gert Doering <<a href="mailto:gert@space.net" target="_blank">gert@space.net</a>> wrote: >In this particular case, I wonder why nobody is yelling at the upstream >who is happily forward packets for that AS... due dilligence at >accepting customer prefixes would have easily caught the announcements. I personally would be ``yelling at the upstream'' right now, but someone made a comment on the NANOG mailing list which sort-of hinted that this would be entirely futile in the case of AS200002. I don't know, but I suspect that he already knows something that I don't know, so I'm not wasting my time on sending comlaints to an entity that, it seems, may perhaps not give a damn. >(Yes, I understand that I'm now officially part of the problem, as >I'm obviously not willing to do everything technically possible to >stop particular sorts of badness) To the extent that you might be able to avoid forwarding route announcements which originate from AS201640, allow me to express my personal opinion that doing so would be admirable. Regards, rfg -- This email was Virus checked by Juniper Security Gateway. </blockquote></div>