[113421] in North American Network Operators' Group
Re: SIP - perhaps botnet? anyone else seeing this?
daemon@ATHENA.MIT.EDU (Steven M. Bellovin)
Sat Apr 11 12:23:53 2009
Date: Sat, 11 Apr 2009 12:14:47 -0400
From: "Steven M. Bellovin" <smb@cs.columbia.edu>
To: "Leland E. Vandervort" <leland@taranta.discpro.org>
In-Reply-To: <Pine.LNX.4.44.0904101015290.1394-100000@taranta.discpro.org>
Cc: NANOG list <nanog@nanog.org>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
On Fri, 10 Apr 2009 10:20:35 +0000 (GMT)
"Leland E. Vandervort" <leland@taranta.discpro.org> wrote:
>
>
>
> On Fri, 10 Apr 2009, Roland Dobbins wrote:
>
> >
> > IANAL, but I suggest you check again with your legal department - I
> > doubt this is actually the case (your jurisdiction may vary, but in
> > most Western nations, you can grab packets for diagnostic/
> > troubleshooting/forensics purposes).
>
> Already did check... we can't grab packets except in response to
> judicial order or specific abuse case with a valid ID of the
> end-user, or of course for general technical diagnostics -- if for
> diagnostics, we cannot use such collected data in the context of only
> a suspicion of abuse at all as it would constitute an infringement on
> the individual's privacy. So in short, we can do it REACTIVELY in
> response to a complaint.. but if we do it PROACTIVELY, then it cannot
> be used and is of "educational" value only (with caveats surrounding
> confidentiality, non-disclosure, and destruction,, etc.)
>
You can if it the volume is interfering with your own service, I
believe (though IANAL, either) -- see this text from
http://www4.law.cornell.edu/uscode/18/2511.html
It shall not be unlawful under this chapter for an operator of
a switchboard, or an officer, employee, or agent of a provider
of wire or electronic communication service, whose facilities
are used in the transmission of a wire or electronic
communication, to intercept, disclose, or use that
communication in the normal course of his employment while
engaged in any activity which is a necessary incident to the
rendition of his service or to the protection of the rights or
property of the provider of that service, except that a
provider of wire communication service to the public shall not
utilize service observing or random monitoring except for
mechanical or service quality control checks.
Note carefully that the second part applies to a "provider of wire
communication service", which is a phone company, not an ISP -- ISPs
are providers of "electronic communication service". (Just to make
life fun -- if you're a VoIP *provider*, you probably fall under both
sections, but if you're just carrying VoIP traffic I don't think you
are).
--Steve Bellovin, http://www.cs.columbia.edu/~smb
