[AusNOG] Warrant-less Info Requests / Cost Recovery

Wed Mar 18 15:44:30 EST 2015

You forgot a step. 2, verify the requester has the right to ask for what they're asking for, to catch both errors and overreach.
In fact, as you're unlikely to be a lawyer, it'd other be best to pass all the requests through a lawyer, or get a lawyer to define a strict set of common request definitions and who can ask for them, and then punt every non-matching request to your lawyer.

      From: James Hodgkinson <yaleman at ricetek.net>
 To: ausnog at lists.ausnog.net 
 Sent: Wednesday, 18 March 2015, 15:24
 Subject: Re: [AusNOG] Warrant-less Info Requests / Cost Recovery

#yiv6201497886 body {padding:1em;margin:auto;background:#fefefe;}#yiv6201497886 h1, #yiv6201497886 h2, #yiv6201497886 h3, #yiv6201497886 h4, #yiv6201497886 h5, #yiv6201497886 h6 {font-weight:bold;}#yiv6201497886 h1 {color:#000000;font-size:28pt;}#yiv6201497886 h2 {border-bottom:1px solid #CCCCCC;color:#000000;font-size:24px;}#yiv6201497886 h3 {font-size:18px;}#yiv6201497886 h4 {font-size:16px;}#yiv6201497886 h5 {font-size:14px;}#yiv6201497886 h6 {color:#777777;background-color:inherit;font-size:14px;}#yiv6201497886 hr {height:0.2em;border:0;color:#CCCCCC;background-color:#CCCCCC;display:inherit;}#yiv6201497886 p, #yiv6201497886 blockquote, #yiv6201497886 ul, #yiv6201497886 ol, #yiv6201497886 dl, #yiv6201497886 li, #yiv6201497886 table, #yiv6201497886 pre {margin:15px 0;}#yiv6201497886 a, #yiv6201497886 a:visited {color:#4183C4;background-color:inherit;text-decoration:none;}#yiv6201497886 #yiv6201497886message {border:1px solid #ccc;display:block;width:100%;height:60px;margin:6px 0px;}#yiv6201497886 button, #yiv6201497886 #yiv6201497886ws {font-size:12 pt;padding:4px 6px;border:1px solid #bbb;background-color:#eee;}#yiv6201497886 code, #yiv6201497886 pre, #yiv6201497886 #yiv6201497886ws, #yiv6201497886 #yiv6201497886message {font-family:Monaco;font-size:10pt;background-color:#F8F8F8;color:inherit;}#yiv6201497886 code {border:1px solid #EAEAEA;margin:0 2px;padding:0 5px;}#yiv6201497886 pre {border:1px solid #CCCCCC;overflow:auto;padding:4px 8px;}#yiv6201497886 #yiv6201497886 code {border:0;margin:0;padding:0;}#yiv6201497886 #yiv6201497886ws {background-color:#f8f8f8;}#yiv6201497886 .yiv6201497886bloop_markdown table {border-collapse:collapse;font-family:Helvetica, arial, freesans, clean, sans-serif;color:rgb(51, 51, 51);font-size:15px;line-height:25px;padding:0;}#yiv6201497886 .yiv6201497886bloop_markdown table tr {border-top:1px solid #cccccc;background-color:white;margin:0;padding:0;}#yiv6201497886 .yiv6201497886bloop_markdown table tr:nth-child {background-color:#f8f8f8;}#yiv6201497886 .yiv6201497886bloop_markdown table tr th {font-weight:bold;border:1px solid #cccccc;margin:0;padding:6px 13px;}#yiv6201497886 .yiv6201497886bloop_markdown table tr td {border:1px solid #cccccc;margin:0;padding:6px 13px;}#yiv6201497886 .yiv6201497886bloop_markdown table tr th :first-child, #yiv6201497886 table tr td :first-child {margin-top:0;}#yiv6201497886 .yiv6201497886bloop_markdown table tr th :last-child, #yiv6201497886 table tr td :last-child {margin-bottom:0;}#yiv6201497886 .yiv6201497886bloop_markdown blockquote{border-left:4px solid #dddddd;padding:0 15px;color:#777777;}#yiv6201497886 #yiv6201497886 :first-child {margin-top:0;}#yiv6201497886 #yiv6201497886 :last-child {margin-bottom:0;}#yiv6201497886 code, #yiv6201497886 pre, #yiv6201497886 #yiv6201497886ws, #yiv6201497886 #yiv6201497886message {word-wrap:normal;}#yiv6201497886 hr {display:inherit;}#yiv6201497886 .yiv6201497886bloop_markdown :first-child {}#yiv6201497886 code, #yiv6201497886 pre, #yiv6201497886 #yiv6201497886ws, #yiv6201497886 #yiv6201497886message {font-family:Menlo, Consolas, Liberation Mono, Courier, monospace;}#yiv6201497886 .yiv6201497886send {color:#77bb77;}#yiv6201497886 .yiv6201497886server {color:#7799bb;}#yiv6201497886 .yiv6201497886error {color:#AA0000;}It WILL take much more than 60 seconds to:   
   - verify the requestor’s identity,
   - the parameters of the request,
   - do the lookup,
   - format it appropriately
   - send it
   - generate the bill
   - manage payment receipt, when it inevitably goes wrong
… should I go on? This doesn’t include the sunk costs of the infrastructure to host it on, and recovering that cost.Is there mention of penalties for when your $system goes bye bye (fire/flood/hacker/MTBF of hdd’s) and you can’t respond?James#yiv6201497886 body{font-family:Source Code Pro, Arial;font-size:12px;}

On 18 March 2015 at 2:17:21 pm, Paul Brooks (pbrooks-ausnog at layer10.com.au) wrote: 

They'll tell you you'redreaming.

counter-view...

Remembering that Telstra recently announced they'll charge $25 toprocess a simple request - the same amount they charge a LEO.

If you've built even a dodgy lookup system, should it really takemore than 60 seconds to type in an IP address, a start date/time,an end date/time, and have the lookup system (that the Gov willhelp contribute to your reasonable costs to build *cough*) decryptthe RADIUS database for the time window, and extract a dump ofrecords for that IP address?

If you think you'll be able to charge $500 - $1000, you'd better beprepared to explain to the CAC why you have to have a live personruffling through a set of filing-cabinet of printed-out A4 sheetsof paper with your records printed on them. They might be theGov't, but even they know we have computers do do this sort ofdatabase lookup these days.

On 18/03/2015 1:27 PM, Andrew Yager wrote:

Hi Terry,
We are taking the view that this is an exercise thatis equivalent of up to 2 hours technical services, and given thecosts of verifying and ensuring compliance, our standard cost for arequest will be $500 per request.
For greater time periods (e.g. reporting on twoyears), our charging rate will extend to $15 000 for thisservice.
More complicated requests (such as access logs from aweb server) will also attract higher rates.
I’d encourage everyone to ensure that their costs arereasonable relating to the amount of work - and the opportunitycost associated with complying with this daft legislation.
Andrew
--Andrew Yager, ManagingDirector   (MACS Snr CP BCompSc MCPJNCIA-Junos)
Real World Technology Solutions Pty Ltd  - IT peopleyou can trust
ph: 1300 798 718 or (02) 9037 0500
fax: (02) 9037 0591
http://www.rwts.com.au/

On 18 Mar 2015, at 1:11 pm, Terry Sweetser<terry+AusNOG at skymesh.net.au> wrote:
Hello Noggers,

I'm wondering what policies and pricing any/all of yourorganisations have in place to "recover" costs when asked for(meta-)data about ip addresses, customers and so on?

Given the transition for 2-year retention and the expansion of the(meta-)dataset to be retained, what plans are in place to chargereasonable fees to state and federal LEOs for the data?

Is $200 a fair sum of money for an ip address match up?

Is $20,000 a fair sum of money for a dump of the (up to) 2 years ofdata for an ip address or customer?

--
http://about.me/terry.sweetser

_______________________________________________
AusNOG mailing list
AusNOG at lists.ausnog.net
http://lists.ausnog.net/mailman/listinfo/ausnog

_______________________________________________
AusNOG mailing list
AusNOG at lists.ausnog.net
http://lists.ausnog.net/mailman/listinfo/ausnog

_______________________________________________
AusNOG mailing list
AusNOG at lists.ausnog.net
http://lists.ausnog.net/mailman/listinfo/ausnog

_______________________________________________
AusNOG mailing list
AusNOG at lists.ausnog.net
http://lists.ausnog.net/mailman/listinfo/ausnog

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.ausnog.net/pipermail/ausnog/attachments/20150318/85232ea8/attachment.html>