On Wednesday 16 March the Serious Organised Crime Agency organised a meeting in London with the RIPE NCC. For the second time law enforcers from the whole world met with the RIPE NCC and RIPE community representatives to discuss cooperation.
RIPE NCC staged several very interesting presentations that showed the LEAs the importance of the work done within RIPE and ARIN and the information RIPE NCC has. Also issues were addressed that can potentially be harmful to future investigations.
An invitation to cooperate
If the law enforcement agencies got one message in London to take home, it was as SOCA’s senior manager e-crime Lee Miles formulated it: “the door is open at RIPE NCC to cooperate”. (In an off-conference remark a police officer said: “We are not used to the fact that a door is open. It is the opposite, we always have to break in the door. This is a new situation”.)
There are many issues at present or in the near future that are of interest to or will effect law enforcement (investigations). RIPE NCC presented freely on this, thus showing her willingness to build a serious and in depth relationship with law enforcement. All presentations were of excellent quality and made it quite clear to LEAs what the state of play concerning RIPE policy making is, which information RIPE NCC has available and where in the case of technical problems around IPv4 depletion and (the lack of) transition to IPv6 a role for governments is necessary. This was a very stark message the police officers present got to take home: only governments can regulate or promote IPv6 transition!
LEAs were clearly made to understand that RIPE policy is formed in a bottom up process and that to have influence on this participation is necessary. Why is this important?
IP-addresses and the Internet
I am not going to explain how the Internet works here. Wikipedia can help you there. However, IP addresses are disseminated by the RIPE NCC. The members of the RIPE NCC, mostly ISPs but also universities, governments, the military, major companies, set the policy around the dissemination. Without an IP address a computer, smart phone, lap top, etc., can not access the Internet. Criminals make use of IP addresses to do harm. Sometimes they get hold of these addresses on false pretences or through hijacking (dormant) resources. If these IP resources would become more difficult to acquire for cyber criminals or if RIPE NCC had a more stringent policy for reclaiming the addresses, the Internet would become safer at one of its front doors. Hence the importance for LEAs to work with the RIPE community in shaping policy together, policy RIPE NCC will execute.
Cyber Crime Working Party
Cooperation with RIPE NCC and the RIPE community is foreseen to go through the CCWP. From this body RIPE policy can be monitored and influenced, trainings coordinated, war games staged for all parties, knowledge exchanged and trust build. SOCA showed quite keenly what she stands to gain through cooperation. All LEAs were invited to either join or support the initiative.
The fact that ARIN has now joined the CCWP is a strong sign that both RIRs think this initiative is of significant importance. The work ARIN does in the field of LEA cooperation and self regulation in the U.S. and Canada is seen as an example by RIPE NCC.
Standardised information exchange
One of the goals of the CCWP is providing LEAs with a template that standardises information requests to RIPE NCC. This would make the work of the RIPE NCC substantially easier. On the spot it was decided to start work on the template. A breakthrough and success to be for the CCWP.
21st Century cooperation
Should this cooperation take off further in the near future, it will give a good example how public – private cooperation takes shape. Two entities not used to work together are forced to take each other’s stock and pull resources to mend an acute problem. The moment they pull this off, the world is changed. Can LEAs afford not to be present as this unfolds? I don’t think so.
Wout de Natris, De Natris Consult
Leiderdorp, 18 March 2011