<html><body><span style="font-family:Verdana; color:#000; font-size:12pt;"><div>-The establishment of core rules, that apply irrespective of the laws of the ISP's country. For example, Russian ISP's are quick to show that spam isn't illegal in Russia. These rules must be enforced by AS, and an enforcement action be reviewable by RIPE.</div><div><br></div><div>-These are rules applicable to end users, but enforced by the AS.</div><div><br></div><div>eg:</div><div><br></div><div>Rule 1: No port scanning: description of port scanning.</div><div>Rule 2: No spamming: description of spamming.</div><div><br></div><div>-RIPE does not enforce the rules, but ensures that they are enforced by the AS.<br></div><div><br></div><div>- all members should be required to maintain a ticket based, web-browser based complaint system (similar to ZENDESK or CUSTHELP), so that the complainer can view their ticket in the database.<br></div><div><br></div><div>- The complaint system should be maintained by the AS.</div><div><br></div><div>- The ability to escalate a complaint to RIPE/AFRINIC/APNIC, including the ability to complain about the complaint system not working properly.</div><div><br></div><div>- RIPE/AFRINIC/APNIC to issue final ruling.</div><div><br></div><div>- Direction to upstream to providers to block traffic until compliance occurs - enforcement action similar to ICANN.<br></div><div><br></div><div><i>Anything</i> would be better than the <i>nothing</i> that currently exists.</div><div><br></div><div><br></div> <blockquote id="replyBlockquote" style="border-left: 2px solid blue; margin-left: 8px; padding-left: 8px; font-size:10pt; color:black; font-family:verdana;" webmail="1"> <div id="wmQuoteWrapper"> -------- Original Message --------<br> Subject: Straw-man abuse reporting system (was: New on RIPE Labs:<br> Botnets: As We See Them in 2017)<br> From: Shane Kerr <<a href="mailto:shane@time-travellers.org">shane@time-travellers.org</a>><br> Date: Fri, August 04, 2017 5:49 pm<br> To: <a href="mailto:phishing@storey.xxx">phishing@storey.xxx</a><br> Cc: <a href="mailto:anti-abuse-wg@ripe.net">anti-abuse-wg@ripe.net</a><br> <br> Hello Phishing,<br> <br> The RIPE NCC cannot "suspend" anyone. There is no "ISP License", at<br> least not from the RIPE NCC. They could, however, revoke resources<br> (address space and ASN) or increase fees.<br> <br> In order for such a system to be effective, you would need to define<br> what "respond appropriately" means. Also, one would need a way to<br> verify that the complaints were valid, to prevent evil or ignorant<br> people from using the complaint system against responsible ISP's.<br> <br> These things are tricky to get correct. They are expensive, and make<br> both the RIPE NCC and the abuse reporter potentially legally liable for<br> damages. They also tend to be hard to change once in place (notice that<br> phone number is still required on RIPE person objects in the RIPE<br> Whois database, while e-mail address is optional).<br> <br> In the past that this has come up, nobody who wants a system of<br> accountability has produced workable, concrete proposals. As my first<br> boss told me long, long ago: "It's easy to criticize, but hard to<br> create."<br> <br> I can imagine a relatively simple system though. Here's a straw-man<br> proposal:<br> <br> * RIPE NCC members can report abuse by other RIPE NCC members via a web<br> portal. The abuse report identifies both members, and is visible to<br> both of them. RIPE NCC staff may access reports if either member<br> requests it, but reports are otherwise confidential. Abuse reports are<br> kept for 12 months and then deleted.<br> <br> * Abuse reports must be responded to within 72 hours using the web<br> portal. Every late response results in a warning.<br> <br> * After 3 calendar months where warnings are received each month, the<br> member is put on notice. No new resources can be allocated or<br> transferred to or from the member until a month has passed without<br> late responses. The member is given a list of abuse reports for the 3<br> month period.<br> <br> * After a year where warnings are received each month, the membership<br> is revoked, and their resources returned to the RIPE NCC for<br> allocation. The former member is given a list of abuse reports for<br> the 12 month period.<br> <br> * The RIPE NCC Arbiters Panel resolves any disputes.<br> <br> Note that this does nothing to prevent ISP's from just clicking "abuse<br> report handled", but it does require ISP's take some action. It also<br> requires that non-members convince a member to make a complaint on<br> their behalf.<br> <br> It is somewhat resistant against people making false claims, since both<br> parties know who made the complaint. It preserves privacy since claims<br> are not published. It gives some time for ISP's to sort things out, but<br> has hard limits. It also has the drawback (or benefit) of not defining<br> abuse.<br> <br> This proposal is flawed and thrown out here when I'm cutting back on<br> caffeine. But I think it shows that maybe a system can be put in place.<br> <br> Cheers,<br> <br> --<br> Shane<br> <br> At 2017-08-03 20:51:15 -0700<br> " " <<a href="mailto:phishing@storey.xxx">phishing@storey.xxx</a>> wrote:<br> <br> > Well it would help if RIPE introduced a policy of accountability, that saw ISP's suspended if they don't respond appropriately to abuse complaints regarding said botnet infections............<br> > <br> > <br> > -------- Original Message --------<br> > > Subject: [anti-abuse-wg] New on RIPE Labs: Botnets: As We See Them in<br> > > 2017<br> > > From: Vesna Manojlovic <<a href="mailto:BECHA@ripe.net">BECHA@ripe.net</a>><br> > > Date: Thu, August 03, 2017 3:54 am<br> > > To: RIPE Anti-Abuse WG <<a href="mailto:anti-abuse-wg@ripe.net">anti-abuse-wg@ripe.net</a>><br> > > <br> > > Dear colleagues,<br> > > <br> > > As a part of his research into detecting malicious network activities,<br> > > Alireza Vaziri is sharing his network/system engineer experiences on<br> > > defend network's infrastructure from outages.<br> > > <br> > > Please read about it in this new article on RIPE Labs:<br> > > <a href="https://labs.ripe.net/Members/alireza_vaziri/botnet">https://labs.ripe.net/Members/alireza_vaziri/botnet</a><br> > > <br> > > Regards,<br> > > Vesna Manojlovic<br> > > Community Builder<br> > > RIPE NCC<br> > > <br> > > <br> > > <br> </div> </blockquote></span></body></html>