<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:x="urn:schemas-microsoft-com:office:excel" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 12 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0cm;
margin-right:0cm;
margin-bottom:0cm;
margin-left:36.0pt;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:378558937;
mso-list-type:hybrid;
mso-list-template-ids:324709754 -1224959610 201916419 201916421 201916417 201916419 201916421 201916417 201916419 201916421;}
@list l0:level1
{mso-level-number-format:bullet;
mso-level-text:-;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-font-family:Calibri;
mso-bidi-font-family:"Times New Roman";}
@list l1
{mso-list-id:944966041;
mso-list-type:hybrid;
mso-list-template-ids:1136931912 201916433 201916441 201916443 201916431 201916441 201916443 201916431 201916441 201916443;}
@list l1:level1
{mso-level-text:"%1\)";
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
ol
{margin-bottom:0cm;}
ul
{margin-bottom:0cm;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-AU link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Coming in a bit late here, natural disaster and what not </span><span style='font-size:11.0pt;font-family:Wingdings;color:#1F497D'>J</span><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><br><br><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>...I can appreciate this started as a request for legal advice, which I cannot offer and i’ve read the “off-topic” remarks and weighed up heavily whether to even contribute to keeping this thread alive, however I think it needs to be stated that almost always the task of processing law enforcement requests falls upon the shoulders of a designated “law enforcement liaison unit”. Those people certainly have experience in this field, and can provide “input” (as requested) , despite being unable to provide specific “legal advice” . The point being, although LELU people aren’t lawyers, they _<i>are</i>_ the front line for making an assessment as to what is a satisfactory request and what isn’t, and what needs to be sighted by legal counsel in the first place, so there is a degree of understanding which comes along with that. IMHO, processing these requests _<i>IS</i>_ an operational network activity of any reasonable sized SP .<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoListParagraph style='text-indent:-18.0pt;mso-list:l1 level1 lfo1'><![if !supportLists]><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><span style='mso-list:Ignore'>1)<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>The topics of active data collection versus “request for information” come with two completely different requirements and frequency of use, RFI’s are commonplace, data collection not so much. RFI’s do not require warrants or security clearances as per collection of data. One is a single form, the other involves a lot of work and establishment if not already set up at a technical and personal level.<o:p></o:p></span></p><p class=MsoListParagraph style='text-indent:-18.0pt;mso-list:l1 level1 lfo1'><![if !supportLists]><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><span style='mso-list:Ignore'>2)<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>If you are involve in any data collection there is going to be an exchange of information (including a warrant & probably security clearances) between the requestor and the requested which will no doubt elaborate on the specifics of who/where/how, (to address your question about pcaps etc) . basically, If you get that stage, you will be informed of what you need to do.. <o:p></o:p></span></p><p class=MsoListParagraph style='text-indent:-18.0pt;mso-list:l1 level1 lfo1'><![if !supportLists]><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><span style='mso-list:Ignore'>3)<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Consider the technical flow of information per se with these two vastly different operations. If there is a person on your network doing something nasty, to get that persons name from an IP via an RFI the agency is going to have to come to you to look in your billing database. If they want to collect data, that can be done anywhere along the path. To this end, you may process hundreds of RFI’s and never perform a collection, because its a lot easier for agency to deal with <big carrier> above you who already have clearances and intercept technologies in place, they don’t need to talk to the ISP at the end of the chain unless its an RFI and they want to poke into the ISP’s billing db, which is a simple fax request and wait for reply.<o:p></o:p></span></p><p class=MsoListParagraph style='text-indent:-18.0pt;mso-list:l1 level1 lfo1'><![if !supportLists]><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><span style='mso-list:Ignore'>4)<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>With regards to the subject of receiving faxes from NSW Police and the authenticity of the origin, with the potential for faxing information to incorrect parties through social engineering, typically most of the requests come from a core group of departments/teams so a degree of familiarity will be offered over time. Also, most agencies now have electronic systems of exchange so you don’t have to fall back to faxing things. (eg in the case of NSW Police “iASK” ) or return path via .gov.au hosts satisfying the return path authenticity off the bat.<o:p></o:p></span></p><p class=MsoListParagraph style='text-indent:-18.0pt;mso-list:l1 level1 lfo1'><![if !supportLists]><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><span style='mso-list:Ignore'>5)<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Depending on the agency making the request, the Act’s involved can vary, Usually telecommunications (interception and access) Act 1979 S178 or S179, but not always (eg S175 )<o:p></o:p></span></p><p class=MsoListParagraph><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>For an RFI, it should contain 4 components, authorised office, authorisation, notification, disclosure <o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><u><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Authorised office<o:p></o:p></span></u></p><p class=MsoNormal><i><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><AGENCY> is an enforcement agency within the definition of an authorised agency in subsection <SECTION> of act <ACT><o:p></o:p></span></i></p><p class=MsoNormal><i><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>I <OFFICERS NAME, POSITION> is an authorised officer within the definition of authorised officer in subsection <SECTION> of act <ACT><o:p></o:p></span></i></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><u><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Authorisation<o:p></o:p></span></u></p><p class=MsoNormal><i><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Acting under subsection <SECTION> of the Act, I authorise the disclosure of the following specified information or documents, being information or documents that came into existence before the time the person from whom the disclosure is sought, being <YOU>, receives the notification of the authorisation;<o:p></o:p></span></i></p><p class=MsoNormal><i><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><DETAILS OF INFORMATION SOUGHT><br>I am satisfied that the disclosure is reasonably necessary for <CAUSE> <o:p></o:p></span></i></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><u><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Notification <o:p></o:p></span></u></p><p class=MsoNormal><i><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Acting under subsection <SECTION> of the Act, I notify the person listed above of this authorization. <o:p></o:p></span></i></p><p class=MsoNormal><i><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></i></p><p class=MsoNormal><u><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Disclosure<o:p></o:p></span></u></p><p class=MsoNormal><i><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>The information to be disclosed by this authorization should be delivered to <CONTACT> via <MEANS><o:p></o:p></span></i></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> <br>There may be some variances eg some agencies like to put the Notification at the top, others group the Notification and Disclosure part into one portion at the bottom, horses for courses so long as its all there. Some agencies will provide specifics on the level of detail surrounding the subscriber information they are seeking, eg maybe just address/phone number for a given IP, they may want to know is the IP dynamic/static, what is the date of signup, POP/call catchment area, billing details etc, possibly even a complete log of all dates & times of access . (logon/logoff records). These are all “historical” requests which can all be satisfied without a warrant upon receipt of a correctly formatted RFI from an authorised officer within an authorised agency.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Kind regards,<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><br><br><o:p></o:p></span></p><p class=MsoListParagraph><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><br><br><o:p></o:p></span></p><div style='border:none;border-left:solid blue 1.5pt;padding:0cm 0cm 0cm 4.0pt'><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> ausnog-bounces@lists.ausnog.net [mailto:ausnog-bounces@lists.ausnog.net] <b>On Behalf Of </b>Noel Butler<br><b>Sent:</b> Saturday 15 January 2011 4:55 PM<br><b>To:</b> ausnog@lists.ausnog.net<br><b>Subject:</b> Re: [AusNOG] Law Enforcement requests for data<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>On Sat, 2011-01-15 at 13:30 +1100, Nick Brown wrote: <o:p></o:p></p><pre><o:p> </o:p></pre><pre>Afternoon all,<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>While this is likely better suited for our solicitor I'd very much <o:p></o:p></pre><pre>appreciate any input from the industry or from those who have had <o:p></o:p></pre><pre>requests in regards to capture of data for a specific customer from <o:p></o:p></pre><pre>Police or similar.<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>It is my understanding that under the Telecommunications Act any such <o:p></o:p></pre><pre>request must be accompanied with a warrant, however the Surveillance <o:p></o:p></pre><pre>Devices Act suggests that perhaps this can be overcome should permission <o:p></o:p></pre><pre>be granted (Our AUP implies explicit permission is granted for us to <o:p></o:p></pre><pre>comply with any request from a law enforcement agency).<o:p></o:p></pre><pre><o:p> </o:p></pre><p class=MsoNormal style='margin-bottom:12.0pt'><br>For Police and ATO, no court orders are needed, the requirement is satisfied if made as a request under section 262 (bugger... is it 263? not had to deal with one for a few years) and it should by signed by an inspector (or above). <br><br>You are then required to furnish what they ask for, and return it to them in the format they ask for, basic details on a customer is usually email or fax, but live data usually hard disk (and you are entitled to reimbursement for the cost of the hard disk as well). <br><br><o:p></o:p></p></div></div></body></html>