<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
RIPE does not handle abuse matters like this, that would be up to the connectivity and hosting providers involved. RIPE only enforces that each IP allocation and assignment has a valid abuse contact email.
<span id="ms-outlook-android-cursor"></span></div>
<div><br>
</div>
<div id="ms-outlook-mobile-signature">Get <a href="https://aka.ms/AAb9ysg">Outlook for Android</a></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> anti-abuse-wg <anti-abuse-wg-bounces@ripe.net> on behalf of Jeremy Malcolm <jeremy@prostasia.org><br>
<b>Sent:</b> Tuesday, September 28, 2021 8:56:44 PM<br>
<b>To:</b> anti-abuse-wg@ripe.net <anti-abuse-wg@ripe.net><br>
<b>Subject:</b> [anti-abuse-wg] False positive CSAM blocking attributed to RIPE</font>
<div> </div>
</div>
<div>
<div dir="ltr">Dear all,
<div><br>
</div>
<div>I am new to this list, although I am not completely new to the Internet technical community, as I am a long-time IGF (and occasionally ICANN) participant.</div>
<div><br>
</div>
<div>I am writing about a case that has been referred to my organization involving global blocking (packet dropping, apparently) of IP addresses that have been reported as hosting CSAM by the Canadian Center for Child Protection (C3P). According to public information,
the C3P runs a web crawler called Project Arachnid which searches for instances of CSAM on the clearweb, and sends automated takedown notices to providers.</div>
<br>
<div>However, in the case that was reported to me, rather than allowing the hosting provider to take down the offending image, the takedown notice was followed by global packet dropping of the hosting IP address, which took down the entire server and other
websites along with it: the hosting provider has attributed this censorship to RIPE, although I cannot verify whether or not this is true. If I am able to obtain more details from RIPE staff, I will follow up with them.</div>
<div><br>
</div>
<div>
<div>Moreover the website in question was not a CSAM website, and neither was the image reported by the C3P a CSAM image. It was a scan of a 1960s postcard of an indigenous family, sent through the mail, which was included in a detailed ethnographic blog article
about indigenous women and girls. In other words, this is an obvious false positive, and it should never have been reported as CSAM at all.</div>
<div></div>
</div>
<div>
<div><br>
</div>
<div>I'm writing to find out if anyone has more information that they can share about how this might have happened, and how it can be prevented from happening in the future. Many thanks in advance for any help that you can offer. Not sure if I should include
the RIPE Cooperation ML on this, given that it relates to the actions of the C3P? </div>
<div><br>
</div>
-- <br>
<div dir="ltr" class="x_gmail_signature">
<div dir="ltr">
<div>
<div dir="ltr">Jeremy Malcolm PhD LLB (Hons) B Com
<div>Executive Director, Prostasia Foundation</div>
<div><a href="https://prostasia.org" target="_blank">https://prostasia.org</a> - +1 415 650 2557</div>
</div>
</div>
</div>
</div>
</div>
</div>
<div hspace="streak-pt-mark" style="max-height:1px"><img alt="" src="https://mailfoogae.appspot.com/t?sender=aamVyZW15QHByb3N0YXNpYS5vcmc%3D&type=zerocontent&guid=6da5a3c0-b605-489c-a914-49bb037aca56" style="width:0px; max-height:0px; overflow:hidden"><font color="#ffffff" size="1">ᐧ</font></div>
</div>
</body>
</html>