Re: ISP CALEA compliance

2007-05-23 Thread Joe Abley
On 11-May-2007, at 13:55, Chris L. Morrow wrote: On Fri, 11 May 2007, Jared Mauch wrote: If there is interest, perhaps I can make a call to DoJ and see if someone can present on CALEA at nanog in a few weeks? (incase the PC can accomodate them). that seems like a great idea,

Re: ISP CALEA compliance

2007-05-23 Thread Joe Abley
On 23-May-2007, at 14:56, Joe Abley wrote: On 11-May-2007, at 13:55, Chris L. Morrow wrote: On Fri, 11 May 2007, Jared Mauch wrote: If there is interest, perhaps I can make a call to DoJ and see if someone can present on CALEA at nanog in a few weeks? (incase the PC can

Re: ISP CALEA compliance

2007-05-23 Thread Chris L. Morrow
On Wed, 23 May 2007, Joe Abley wrote: Oh! That was a really old message I just replied to. Mail got kidnapped in a rogue barracuda, it seems, and someone just paid the ransom. Sorry about the noise :-) don't swim with them and bait... Was there a final disposition on this? (I suppose

Re: ISP CALEA compliance

2007-05-23 Thread Jared Mauch
On Wed, May 23, 2007 at 07:08:21PM +, Chris L. Morrow wrote: On Wed, 23 May 2007, Joe Abley wrote: Oh! That was a really old message I just replied to. Mail got kidnapped in a rogue barracuda, it seems, and someone just paid the ransom. Sorry about the noise :-) don't swim

Re: ISP CALEA compliance

2007-05-23 Thread Steven M. Bellovin
On Wed, 23 May 2007 16:02:35 -0400 Jared Mauch [EMAIL PROTECTED] wrote: On Wed, May 23, 2007 at 07:08:21PM +, Chris L. Morrow wrote: On Wed, 23 May 2007, Joe Abley wrote: Oh! That was a really old message I just replied to. Mail got kidnapped in a rogue barracuda, it

Re: ISP CALEA compliance

2007-05-23 Thread Randy Bush
I do have a volunteer from EFF... excellent! steve, can we get this in? randy

Re: ISP CALEA compliance

2007-05-23 Thread Steve Feldman
On May 23, 2007, at 1:14 PM, Randy Bush wrote: I do have a volunteer from EFF... excellent! steve, can we get this in? Unfortunately, not in the general session. We've filled the available time, and it looks like we will be running until 12:30 Monday and Tuesday, and 13:00 Wednesday.

Re: ISP CALEA compliance

2007-05-23 Thread Martin Hannigan
I do have a volunteer from EFF... I had mentioned that both VeriSign and Neustar have people that are fluent in the technical and general legal issues as well as the legal aspects. It would seem to make more sense to solicit one of those organizations since NANOG is about operations, and not

Re: ISP CALEA compliance

2007-05-11 Thread Jason Frisvold
On 5/10/07, Jack Bates [EMAIL PROTECTED] wrote: I think what he meant was My DSL has been broke for 3 months now, and I haven't not be able to use it. You can't charge me for something which wasn't working! Question #1 - Did you bother to call our technical support hotline? No? Well then it

Re: ISP CALEA compliance

2007-05-11 Thread Jack Bates
Donald Stahl wrote: Working hard to defend privacy does not automatically equal protecting people who exploit children- and I'm getting sick and tired of people screaming Think of the children! It's a stupid, fear mongering tactic- and hopefully one day people will think of it in the same way

Re: ISP CALEA compliance

2007-05-11 Thread William Allen Simpson
David Lesher wrote: Speaking on Deep Background, the Press Secretary whispered: You work so hard to defend people that exploit children? Interesting. We are talking LEA here and not the latest in piracy law suits. The #1 request from a LEA in my experience concerns child exploitation.

Re: ISP CALEA compliance

2007-05-11 Thread Jason Frisvold
On 5/11/07, Brandon Galbraith [EMAIL PROTECTED] wrote: My understanding was data you had needed to be turned over when requested, but CALEA provides no specification/guidance on log retention. Agreed. My understanding, to date, is that the data to be turned over is data collected from the

Re: ISP CALEA compliance

2007-05-11 Thread Jared Mauch
On Fri, May 11, 2007 at 10:42:14AM -0400, Jason Frisvold wrote: On 5/11/07, Brandon Galbraith [EMAIL PROTECTED] wrote: My understanding was data you had needed to be turned over when requested, but CALEA provides no specification/guidance on log retention. Agreed. My understanding,

Re: ISP CALEA compliance

2007-05-11 Thread Chris L. Morrow
On Fri, 11 May 2007, Jared Mauch wrote: If there is interest, perhaps I can make a call to DoJ and see if someone can present on CALEA at nanog in a few weeks? (incase the PC can accomodate them). that seems like a great idea, atleast a lightning talk would be nice.

Re: ISP CALEA compliance

2007-05-11 Thread Steven M. Bellovin
On Fri, 11 May 2007 10:42:14 -0400 Jason Frisvold [EMAIL PROTECTED] wrote: On 5/11/07, Brandon Galbraith [EMAIL PROTECTED] wrote: My understanding was data you had needed to be turned over when requested, but CALEA provides no specification/guidance on log retention. Agreed. My

Re: ISP CALEA compliance

2007-05-11 Thread Donald Stahl
A _much_ longer version of this was sent privately- but I had to take public exception to the following comment: I'm not surprised that when they are dealing with companies that delete all evidence they might need or push as much red tape as possible, that the LEA turns around and

Re: ISP CALEA compliance

2007-05-11 Thread Steven M. Bellovin
On Fri, 11 May 2007 10:52:21 -0400 William Allen Simpson [EMAIL PROTECTED] wrote: David Lesher wrote: Speaking on Deep Background, the Press Secretary whispered: You work so hard to defend people that exploit children? Interesting. We are talking LEA here and not the latest in

Re: ISP CALEA compliance

2007-05-11 Thread Steven M. Bellovin
On Fri, 11 May 2007 12:17:04 -0400 Jared Mauch [EMAIL PROTECTED] wrote: If there is interest, perhaps I can make a call to DoJ and see if someone can present on CALEA at nanog in a few weeks? (incase the PC can accomodate them). And perhaps someone from CDT? I mean that in all

Re: ISP CALEA compliance

2007-05-11 Thread Jason Frisvold
On 5/11/07, Todd Glassey [EMAIL PROTECTED] wrote: Gee Steven, that's what everyone thought prior to a Federal Judge ordering Microsoft to produce seven years of Email... I believe that was because they knew MS *had* that email. Of course, any missing email can probably be tossed together

Re: ISP CALEA compliance

2007-05-11 Thread Steven M. Bellovin
On Fri, 11 May 2007 12:47:56 -0700 (GMT-07:00) Todd Glassey [EMAIL PROTECTED] wrote: Gee Steven, that's what everyone thought prior to a Federal Judge ordering Microsoft to produce seven years of Email... We're getting off-topic here, but I'll respond. First -- the context of the

Re: ISP CALEA compliance

2007-05-10 Thread Chris L. Morrow
On Thu, 10 May 2007, Nikos Mouat wrote: I have interpretted CALEA to apply only to providers of VOICE service, be it VOIP or traditional, however I was told this morning point blank by the FCC that CALEA most definitely applies to all ISPs that provide internet access at speeds over

Re: ISP CALEA compliance

2007-05-10 Thread David E. Smith
Nikos Mouat wrote: I have interpretted CALEA to apply only to providers of VOICE service, be it VOIP or traditional, however I was told this morning point blank by the FCC that CALEA most definitely applies to all ISPs that provide internet access at speeds over 200k. That, and the

Re: ISP CALEA compliance

2007-05-10 Thread Jared Mauch
On Thu, May 10, 2007 at 08:44:00AM -0700, Nikos Mouat wrote: I have interpretted CALEA to apply only to providers of VOICE service, be it VOIP or traditional, however I was told this morning point blank by the FCC that CALEA most definitely applies to all ISPs that provide internet

Re: ISP CALEA compliance

2007-05-10 Thread Jason Frisvold
On 5/10/07, Jared Mauch [EMAIL PROTECTED] wrote: If you're not offering VoIP services, your life may be easier as you will only need to intercept the data. Depending on your environment you could do this with something like port-mirroring, or something more advanced. There are a

Re: ISP CALEA compliance

2007-05-10 Thread Jeff Shultz
Jason Frisvold wrote: On 5/10/07, Jared Mauch [EMAIL PROTECTED] wrote: If you're not offering VoIP services, your life may be easier as you will only need to intercept the data. Depending on your environment you could do this with something like port-mirroring, or something more

Re: ISP CALEA compliance

2007-05-10 Thread Patrick Muldoon
On May 10, 2007, at 2:03 PM, Jason Frisvold wrote: Here's a question that's come up around here. Does a CALEA intercept include hairpining or is it *only* traffic leaving your network? I'm of the opinion that a CALEA intercept request includes every bit of traffic being sent or received by

Re: ISP CALEA compliance

2007-05-10 Thread Jason Frisvold
On 5/10/07, Patrick Muldoon [EMAIL PROTECTED] wrote: We've been under the impression that is *all* data. So for us, things like PPPoE Sessions, just putting a tap/span port upstream of the aggregation router will not work as you would miss any traffic going from USER A - USER B, if they where

Re: ISP CALEA compliance

2007-05-10 Thread Sean Donelan
On Thu, 10 May 2007, Jason Frisvold wrote: Here's a question that's come up around here. Does a CALEA intercept include hairpining or is it *only* traffic leaving your network? I'm of the opinion that a CALEA intercept request includes every bit of traffic being sent or received by the

Re: ISP CALEA compliance

2007-05-10 Thread Sean Donelan
On Thu, 10 May 2007, Patrick Muldoon wrote: We've been under the impression that is *all* data. So for us, things like PPPoE Sessions, just putting a tap/span port upstream of the aggregation router will not work as you would miss any traffic going from USER A - USER B, if they where on the

Re: ISP CALEA compliance

2007-05-10 Thread William Allen Simpson
Jared Mauch wrote: You need to have a router or some appliances that will assist you in the required lawful-intercept capabilities that are necessary. But anything whatsoever is OK. Since you don't know of the capabilities required in advance, there's no reason that it be a fast

Re: ISP CALEA compliance

2007-05-10 Thread Daniel Senie
At 03:23 PM 5/10/2007, Sean Donelan wrote: On Thu, 10 May 2007, Patrick Muldoon wrote: We've been under the impression that is *all* data. So for us, things like PPPoE Sessions, just putting a tap/span port upstream of the aggregation router will not work as you would miss any traffic

Re: ISP CALEA compliance

2007-05-10 Thread Patrick Muldoon
On May 10, 2007, at 3:23 PM, Sean Donelan wrote: If you are doing PPPOE over another carrier's ATM network, are you really a facilities-based provider? Or is the CALEA compliance the responsibility of the underlying ATM network provider to give LEA access to the ATM VC of the subscriber

Re: ISP CALEA compliance

2007-05-10 Thread Sean Donelan
On Thu, 10 May 2007, Daniel Senie wrote: Just had this conversation with one of my clients, and it's a good question. Seems like the telco providing the ATM (or other) access cloud might be the responsible party. The ISP reselling that DSL is too far upstream anyway to capture traffic between

Re: ISP CALEA compliance

2007-05-10 Thread Jon Lewis
On Thu, 10 May 2007, William Allen Simpson wrote: Follow the usual best practices, and you may save time and money. 1. Ensure that your DHCP, RADIUS, SMTP, and other logs are always, ALWAYS, *ALWAYS* rolled over and deleted within 7 days without backup. I'd recommend 3 days, but operational

Re: ISP CALEA compliance

2007-05-10 Thread William Allen Simpson
Sean Donelan wrote: The DOJ/FBI has been pretty consistent. They want it all and if there is a technicality in the law that doesn't give it to them they have consistently tried to expand the laws, regulations and court cases to give it to them. ... Very true! But its also important to

Re: ISP CALEA compliance

2007-05-10 Thread Jack Bates
Jason Frisvold wrote: Here's a question that's come up around here. Does a CALEA intercept include hairpining or is it *only* traffic leaving your network? I'm of the opinion that a CALEA intercept request includes every bit of traffic being sent or received by the targeted individual, but

Re: ISP CALEA compliance

2007-05-10 Thread William Allen Simpson
Jon Lewis wrote: On Thu, 10 May 2007, William Allen Simpson wrote: Follow the usual best practices, and you may save time and money. 1. Ensure that your DHCP, RADIUS, SMTP, and other logs are always, ALWAYS, *ALWAYS* rolled over and deleted within 7 days without backup. I'd recommend 3 days,

Re: ISP CALEA compliance

2007-05-10 Thread Mike Hammett
Subject: Re: ISP CALEA compliance On 5/10/07, Jared Mauch [EMAIL PROTECTED] wrote: If you're not offering VoIP services, your life may be easier as you will only need to intercept the data. Depending on your environment you could do this with something like port-mirroring, or something

Re: ISP CALEA compliance

2007-05-10 Thread Mike Hammett
I recommend Kris Twomey... lokt.net - Mike Hammett Intelligent Computing Solutions http://www.ics-il.com - Original Message - From: David E. Smith [EMAIL PROTECTED] To: nanog@merit.edu Sent: Thursday, May 10, 2007 11:36 AM Subject: Re: ISP CALEA compliance Nikos Mouat

Re: ISP CALEA compliance

2007-05-10 Thread Mike Hammett
Join the wireless list at wispa.org and the wisp list at part-15.org They've been discussing it quite a bit. There's also a FAQ at wispa.org - Mike Hammett Intelligent Computing Solutions http://www.ics-il.com - Original Message - From: Nikos Mouat [EMAIL PROTECTED] To:

Re: ISP CALEA compliance

2007-05-10 Thread Mike Hammett
Subject: Re: ISP CALEA compliance On Thu, 10 May 2007, Patrick Muldoon wrote: We've been under the impression that is *all* data. So for us, things like PPPoE Sessions, just putting a tap/span port upstream of the aggregation router will not work as you would miss any traffic going from USER

Re: ISP CALEA compliance

2007-05-10 Thread Jack Bates
William Allen Simpson wrote: Speaking from experience, that's very likely -- a lot of negotiation trouble. No matter what happens, you'll pay some attorney fees. Also, the gag order was ruled unconstitutional, so always inform your customer! They may be willing to work out attorney fees,

Re: ISP CALEA compliance

2007-05-10 Thread Jack Bates
William Allen Simpson wrote: We've never charged on a usage model. We always charged on a fixed tier bandwidth model, payable in advance. I think what he meant was My DSL has been broke for 3 months now, and I haven't not be able to use it. You can't charge me for something which wasn't

Re: ISP CALEA compliance

2007-05-10 Thread Donald Stahl
You work so hard to defend people that exploit children? Interesting. We are talking LEA here and not the latest in piracy law suits. The #1 request from a LEA in my experience concerns child exploitation. ?? ??? Working hard to defend privacy does not automatically equal protecting people

Re: ISP CALEA compliance

2007-05-10 Thread Joe Provo
On Thu, May 10, 2007 at 03:42:27PM -0500, Jack Bates wrote: [snip] You work so hard to defend people that exploit children? Interesting. We are talking LEA here and not the latest in piracy law suits. The #1 request from a LEA in my experience concerns child exploitation. Highly likely for

Re: ISP CALEA compliance

2007-05-10 Thread Stephen Sprunk
Thus spake Donald Stahl [EMAIL PROTECTED] Working hard to defend privacy does not automatically equal protecting people who exploit children- and I'm getting sick and tired of people screaming Think of the children! It's a stupid, fear mongering tactic- and hopefully one day people will think

Re: ISP CALEA compliance

2007-05-10 Thread David Lesher
Speaking on Deep Background, the Press Secretary whispered: You work so hard to defend people that exploit children? Interesting. We are talking LEA here and not the latest in piracy law suits. The #1 request from a LEA in my experience concerns child exploitation. I think you'll find

Re: ISP CALEA compliance

2007-05-10 Thread Stephen Satchell
David Lesher wrote: Speaking on Deep Background, the Press Secretary whispered: You work so hard to defend people that exploit children? Interesting. We are talking LEA here and not the latest in piracy law suits. The #1 request from a LEA in my experience concerns child exploitation. I

Re: ISP CALEA compliance

2007-05-10 Thread Steven M. Bellovin
On Thu, 10 May 2007 16:03:49 -0400 William Allen Simpson [EMAIL PROTECTED] wrote: Congress authorized CALEA (and there is also argument about whether the recent expansion to ISPs was authorized at all), it cannot be required of the public until Congress *appropriates* the funds, and they

Re: ISP CALEA compliance

2007-05-10 Thread Chris L. Morrow
On Thu, 10 May 2007, Jon Lewis wrote: On Thu, 10 May 2007, William Allen Simpson wrote: Follow the usual best practices, and you may save time and money. 1. Ensure that your DHCP, RADIUS, SMTP, and other logs are always, ALWAYS, *ALWAYS* rolled over and deleted within 7 days without

Re: ISP CALEA compliance

2007-05-10 Thread Brandon Galbraith
On 5/10/07, Chris L. Morrow [EMAIL PROTECTED] wrote: Jon, there is no way this fellow is serious, nor is there anyway this fellow's advice should be taken without some serious legal discussions with in-house counsel... the penalties for non-compliance for CALEA are very steep (100k/day while an

Re: ISP CALEA compliance

2007-05-10 Thread Sean Donelan
On Thu, 10 May 2007, Joe Provo wrote: Highly likely for most old requests. Your voice folks can tell you the #1 CALEA request is neither kiddie pron nor terrrists, but rather DEA. Remember, CALEA compliance is separate from any intercept orders you receive. If you ask your voice folks,

RE: ISP CALEA compliance

2007-05-10 Thread Stasiniewicz, Adam
use the Internet to help them in their crimes. My $0.02, Adam Stasiniewicz -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Chris L. Morrow Sent: Thursday, May 10, 2007 10:50 PM To: Jon Lewis Cc: William Allen Simpson; nanog@merit.edu Subject: Re: ISP

RE: ISP CALEA compliance

2007-05-10 Thread Sean Donelan
On Thu, 10 May 2007, Stasiniewicz, Adam wrote: Anyway, here is what I have learned from my experience with our friends in law enforcement (be it local, state, or federal). First and foremost, they like us are only humans trying to make a living. They are not out to get us The troublemakers