<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=utf-8">
<meta name=Generator content="Microsoft Word 12 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page Section1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=EN-US link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal><span style='font-family:"Calibri","sans-serif";color:#1F497D'>Just
something I thought of with regards to putting data on disc for collection - Just
be mindful if you are going beyond providing end user/billing info and actually
capturing traffic going to the subscriber, you will most definitely need to at
least sight the warrant. Don't be shy about telling them to provide their own
box if you want.<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-family:"Calibri","sans-serif";color:#1F497D'>Also,
generally for all this type of stuff you a entitled to bill them to recoup your
time if you want, some agencies (eg most state police) will have cost codes on
the s282 request and its just a matter of invoicing their accounts dept. If
you're just getting the odd one here and there probably not a worry, but
something to bear in mind if it starts getting out of hand.<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-family:"Calibri","sans-serif";color:#1F497D'>--matt<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-family:"Calibri","sans-serif";color:#1F497D'> <o:p></o:p></span></p>
<p class=MsoNormal><span style='font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p>
<div style='border:none;border-left:solid blue 1.5pt;padding:0cm 0cm 0cm 4.0pt'>
<div>
<div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'>
<p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span
style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>
ausnog-bounces@lists.ausnog.net [mailto:ausnog-bounces@lists.ausnog.net] <b>On
Behalf Of </b>Noel Butler<br>
<b>Sent:</b> Tuesday 25 August 2009 8:54 PM<br>
<b>To:</b> Andrew Cox<br>
<b>Cc:</b> ausnog@ausnog.net<br>
<b>Subject:</b> Re: [AusNOG] Handover of information and/or monitoring for
authorities.<o:p></o:p></span></p>
</div>
</div>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>Andrew,<br>
<br>
On Tue, 2009-08-25 at 18:23 +1000, Andrew Cox wrote: <o:p></o:p></p>
<pre><o:p> </o:p></pre><pre>Hey Guys,<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>Just wondering if anyone from an ISP here has previously had to deal <o:p></o:p></pre><pre>with AFP assisting in capturing and/or providing data about an end user?<o:p></o:p></pre>
<p class=MsoNormal><br>
Hundreds of them :)<br>
<br>
<br>
<o:p></o:p></p>
<pre><o:p> </o:p></pre><pre>If so I'm interested to hear just exactly what sort of process they had <o:p></o:p></pre><pre>to go through to get the data (I know we are legally required to provide <o:p></o:p></pre><pre>it and I don't see an issue with that) but just wondering what if anyone <o:p></o:p></pre><pre>knows what exactly they are supposed to give us in terms of a warrant <o:p></o:p></pre><pre>and/or proof of identity etc etc.<o:p></o:p></pre><pre><o:p> </o:p></pre>
<p class=MsoNormal><br>
They don't need a warrant, but it must be a s282 request, it is also normally
(co) signed by a commissioned officer, <br>
they will indicate exactly what they want from you, be complete and generous in
the information, supply all details of the user, <br>
often they want proof it was that user at said times, give them a paste from
radius as well showing such.<br>
The same applies to other Australian Police Services, and the ATO, which you
are also legally obligated to furnish details of users to. Normally you can
email a copy of the data to them, or fax it back, sometimes in cases of very
serious nature, they may also request you put data onto a CD and it will be
collected from you.<br>
<br>
<br>
<br>
<o:p></o:p></p>
<pre><o:p> </o:p></pre><pre>Been asking around and I've also been told that they should normally <o:p></o:p></pre><pre>provide contact details of a supervisor or higher authority we can refer <o:p></o:p></pre><pre>to if needed.<o:p></o:p></pre><pre><o:p> </o:p></pre>
<p class=MsoNormal style='margin-bottom:12.0pt'><br>
Yes normally they will want these details, and an a/h contact in case they need
to action a request outside normal hours (very rare), but mostly it's so they
have a common point of contact, doesn't need to be a manager, your senior
sysadmin is good enough.<br>
<br>
<o:p></o:p></p>
</div>
</div>
</body>
</html>