Your email presumes that an "ombudsman" model would resolve an issue.
 
If a person has dedicated themselves to controlling a 200,000 strong botnet and 
sending spam emails through unauthorised access etc. what is sending them a 
fancy piece of paper or an email "asking them to be nice" going to do?
 
For example, there are 3 types of phishing websites:
 
1) Outright false domain name,
2) hacked server, using legitimate domain name,
3) free website sign-up
 
Which of these would it be appropriate to ask the criminal to behave through a 
letter or email?
 
In reality, none of them, because the phisher has hacked the server, dumped the 
phishing website template and left, never to return.
 
The service needs to be suspended, as the server owner cannot expect:
 
1) a customer to know how to fix the security vulnerability,
2) the customer to log in to their email within the next day, week or even 
month, it might take them years to log in.
3) the criminal not to control the customers email also etc.
 
 
Often when reporting phishing websites, the response from ISP is "I have 
notified the customer to investigate."
 
The question then is, in which instance would it be appropriate to ask nicely 
of a customer? I can't think of any examples.
 
You are like the United Nations... "North Korea, you are killing 2 million 
people in concentration camps, so we are asking nicely and going to send you a 
piece of paper expressing how bad it is."
 
I'm sure North Korea really cares!
 
 
 
 
 
 
 
--------- Original Message --------- Subject: Re: [anti-abuse-wg] @EXT: RE: 
working in new version of 2019-04 (Validation of "abuse-mailbox")
From: "Volker Greimann" <vgreim...@key-systems.net>
Date: 1/17/20 2:03 am
To: "anti-abuse-wg@ripe.net" <anti-abuse-wg@ripe.net>

 Hi Jordi, 
 your example seems a bit off though. If your contract is with your ISP and you 
need to complain to them, why would you complain to another ISP you have no 
contract with?
 I agree that current GDPR implementations may impact the contactibility of the 
customer, but that can be improved in GDPR-compliant manners that do not 
require playing chinese whispers down the chain. 
 Not objecting to your 3. but you need to consider it may not be the 
contractual partner acting against the contract. They may be a victim as well, 
and therefore enforcing any actions against them may be unproductive. Would you 
shut down Google.com because of one link to a site violating third party rights?
 Best,
 Volker
 Am 16.01.2020 um 15:52 schrieb JORDI PALET MARTINEZ via anti-abuse-wg:
  Hi Volker,
  
 I don't agree with that, because:
  I believe the electricity sample I provided proves otherwise. My contract is 
with the electricity provider (the Internet provider), so I need to complain to 
them and they need to follow the chain. For a victim, to complain directly to 
the customer (not the operator), will need to know the data of the “abuser” 
which may be protected by GDPR. Customers sign a contract with the operator. 
The contract must have clear conditions (AUP) about the appropriate use of the 
network. If you act against that contract, the problem is with the operator, 
not victims. 

  
  By the way, if an operator has a badly designed AUP, either they are doing a 
bad job, or they have *no interest* in acting against abuses.
  
 Regards,
 Jordi
 @jordipalet
  
 
 
  
   El 16/1/20 15:44, "anti-abuse-wg en nombre de Volker Greimann" 
<anti-abuse-wg-boun...@ripe.net en nombre de vgreim...@key-systems.net> 
escribi&oacute;:
 


 
Obviously every user should lock their doors / protect themselves against 
fraud. I am just saying that the ability of many service providers to curtail 
abuse of their system (without impacting legitimate uses) is very limited as it 
may not their customers doing the abusing and any targeted action against those 
customers themselvesd would be inappropriate and affect many legitimate users 
of their services.
 At what point should a network service provider remove privileges from a 
customer that is himself being abused but is technically unable to deal with it 
properly? Would the complaint not be better directed at that customer, not the 
provider, since they are the ones that can resolve this issue in a more 
targetted and appropriate manner? How does the service provider differentiate 
between a customer that is abusing vs one that is being abused?  Deputising the 
service providers will not necessarily solve the problems, and possibly create 
many new ones.
 In the domain industry, we were required to provide an abuse contact, however 
the reports we get to that address usually deal with issues we cannot do much 
about other than pulling or deactivating the domain name, which is usually the 
nuclear option. So we spend our time forwarding abuse mails to our customers 
that the complainant should have sent to the customer directly.
 Best,
 volker
 
  Am 16.01.2020 um 15:16 schrieb Serge Droz via anti-abuse-wg:
 
 Hi Volker   On 16/01/2020 15:03, Volker Greimann wrote:  isn't making the 
world (and the internet) first and foremost a job of law enforcement agencies 
like the police and Europol?  Law enforcement's job primarily is arresting 
criminals. And yes they do prevention. But you can't stop locking your door or 
walk by fight just ignoring it, because it's LEA's job.   This is even more 
true on the internet, where CERT's have long been working together fighting 
cybercrime etc.   While there obviously is an appeal to the notion of "The best 
problems are some one else's problem" my believe is we don't want to have an 
internet or a world, for that matter, where this is how things run. The 
internet is a bottom up thing, it is so cool because people follow protocols, 
that are not law.   There was a time whn this wasn't a given: During the 
"Browser wars" different producer leveraged ambiguities in the HTML standard, 
and the end result was horrible.   We don't want this. If we delegate the 
problem, we've already lost.   Best Serge         -- 
 Volker A. Greimann
 General Counsel and Policy Manager
 KEY-SYSTEMS GMBH
 
 T: +49 6894 9396901
 M: +49 6894 9396851
 F: +49 6894 9396851
 W: www.key-systems.net
 
 Key-Systems GmbH is a company registered at the local court of Saarbruecken, 
Germany with the registration no. HR B 18835
 CEO: Alexander Siffrin
 
 Part of the CentralNic Group PLC (LON: CNIC) a company registered in England 
and Wales with company number 8576358.
 


 **********************************************
 IPv4 is over
 Are you ready for the new Internet ?
 http://www.theipv6company.com
 The IPv6 Company
 
 This electronic message contains information which may be privileged or 
confidential. The information is intended to be for the exclusive use of the 
individual(s) named above and further non-explicilty authorized disclosure, 
copying, distribution or use of the contents of this information, even if 
partially, including attached files, is strictly prohibited and will be 
considered a criminal offense. If you are not the intended recipient be aware 
that any disclosure, copying, distribution or use of the contents of this 
information, even if partially, including attached files, is strictly 
prohibited, will be considered a criminal offense, so you must reply to the 
original sender to inform about this communication and delete it.
  -- 
 Volker A. Greimann
 General Counsel and Policy Manager
 KEY-SYSTEMS GMBH
 
 T: +49 6894 9396901
 M: +49 6894 9396851
 F: +49 6894 9396851
 W: www.key-systems.net
 
 Key-Systems GmbH is a company registered at the local court of Saarbruecken, 
Germany with the registration no. HR B 18835
 CEO: Alexander Siffrin
 
 Part of the CentralNic Group PLC (LON: CNIC) a company registered in England 
and Wales with company number 8576358.

Reply via email to