[db-wg] Abuse Complaint procedures

Sir or Madam,

jrfoleyjr at comcast.net wrote:

> After some searching, it appears that RIPE has no actual abuse policy 
> but that everything is still hanging in limbo.
>
> I was looking for an address to report hacker activity to and it 
> appears that you are a) not in the business b) not equipped to handle 
> it c) barely qualified to assign blocks of IP addresses so that the 
> addressee can self-police, unless they are hacker/spammer 
> organizations. In which case the rest of the worlds choice is to ban 
> RIPE assigned addresses. Hopefully RIPE will mature soon!
>
> If in fact you DO have a group assigned for the purpose of 
> investigating hackers, please make it available on you web page.
>  
>
You should have already received the information off-list, but I think 
it is probably worth it to explain to the rest of the Database Working 
Group subscribers how we (the RIPE NCC) handle such complaints.

Generally, we hope that people see the link that says "Spam and Hacking 
Help" on the www.ripe.net web page:

http://www.ripe.net/info/faq/abuse/index.html

Despite our best efforts to keep it simple, the front page has a lot of 
information, and this link can easily get overlooked. Also, a lot of 
abuse reports come to RIPE NCC by people who find RIPE NCC e-mail 
addresses in the database or other places that do not have enough 
information about finding the best e-mail address to contact.

Whenever anyone working at the RIPE NCC gets an abuse complaint now, we 
send the following e-mail:

------------------------------------------------------------------------

    Dear Sir/Madam,
                                                                                   

    You have sent a complaint regarding some type of abuse (i.e. hacking,
    spam).
                                                                                   

    The RIPE NCC allocates address space to ISPs and other organisations.
    These organisations are responsible for the activities originating
    from the address space allocated to them. Since the RIPE NCC is NOT
    the organisation using or responsible for activities originating from
    the address space, any concerns or responses should be directed to
    them.
                                                                                   

    We would like to help you find the appropriate party responsible for
    the address space and therefore have created the following web page:
                                                                                   

    http://www.ripe.net/abuse.html
                                                                                   

    Please also see our FAQ for further information:
                                                                                   

    http://www.ripe.net/info/faq/abuse/index.html
                                                                                   

    If you still believe that the abuse originates from the RIPE NCC's
    network please send your complaint within seven days to
                                                                                   

    abuse+51574a0be8765eecf9dd5ef5e75bb20005fd1644 at ripe.net
                                                                                   

                                                                                   

    Kind Regards,
                                                                                   

    RIPE NCC
    www.ripe.net

------------------------------------------------------------------------

The strange e-mail address there is a temporary address that gets 
forwarded to a human. The idea here is that if there is actually abuse 
that we can do something about, then people will bypass the automated 
responder and get a human. While do try to follow best practices 
regarding security, it is possible that one of our computers gets 
compromised and used for bad things! Also sometimes people really, 
really think that the RIPE NCC should be responsible for abuse 
originating in the RIPE region, and want to communicate with a human 
about it.

We do /not/ have any plans to set up a group to investigate hackers, and 
it would probably be something for the RIPE NCC Services Working Group 
to recommend, rather than the Database Working Group. I do not think it 
is likely that the RIPE community will support such a service, as there 
are several organisations in the RIPE region that are already dedicated 
to this activity. But if you think it is worth doing, please have a look 
at the RIPE Policy Development pages:

http://www.ripe.net/ripe/policies/

The RIPE community is actually very open and willing to discuss good ideas.

--
Shane Kerr
Software Engineering Department Manager
RIPE NCC
-------------- next part --------------
An HTML attachment was scrubbed...
URL: </ripe/mail/archives/db-wg/attachments/20051108/7dfd9929/attachment.html>