[consume-thenet] Priorities for nodes and services..

[Richard Clayton]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

In article <3A9E8A12.B146B9A0@algroup.co.uk>, Ben Laurie
<ben@algroup.co.uk> writes

>> > Stephen Summerfield wrote:
>> > >
>> > > > -----Original Message-----
>> > > > From: Kim Hawtin [mailto:ryjkavik@yahoo.com.au]
>> > > > Sent: 01 March 2001 13:13
>> > > >
>> > > > After the talk I had with James and Matt ther other
>> > > > evening, we came to the conclusion that there are
>> > > > a few problems with offering an open connection
>> > > > into the consume network, especially if those
>> > > > people using that access are unknown and not
>> > > > trustworthy ...(spamming mail servers, etc)
>> > >
>> > > I see that as a pretty important issue, particularly as the person who 
>owns
>> > > the Internet link will most likely be liable for any users of the link.

that is the usual scheme operated by those who grant access to the
Internet - at whatever speed.

>It is not clear to me that I am liable for packets that pass through my
>network. Certainly ISPs aren't, are they? It would be pretty difficult
>to run the Internet at all if they were!

ISPs take responsibility, in their peering relationships with others,
for their downstream customers...

... this is not to say that it is right to prosecute them for abuse
committed by their downstream customers, but rather that if such abuse
does originate there then the ISP is seen, by their peers, to be
responsible for preventing further abuse.

For example, I know of one occasion when failure to act upon abuse led
to an ISP being (briefly) disconnected from the Internet by their UK
based upstream provider. It was widely seen as being very much the
correct action to take, and prevented the upstream provider suffering by
its peers taking action.

>I'd be interested to know what my legal obligations would actually be,
>really, rather than mere speculation, berore I worry about how to
>achieve them. I'm copying UKCrypto in case one of the many legal types
>there can enlighten us!

this is hardly encryption policy ... cyber-rights might be a better
list; but to answer anyway [remembering IANAL, but know something of ISP
policies]....

If you purchase a connection from an ISP then you will need to look at
the contractual conditions that are imposed upon you:

Some ISPs will set restrictions on who else may use that connection. If
there are no such restrictions [and there often are] then you can
consider connecting your friends/neighbours/street through your machine.

However, the ISP will treat it as your responsibility if _anyone_ uses
the connection for abuse (of whatever kind - sending UBM, hacking, mail
bombing or whatever). They are likely to disconnect you either
immediately or (if they feel that it's a lack of education or control of
an individual user on your part) if they fail to be satisfied that
further abuse is likely to occur.

If abuse occurs and it becomes clear that your entire neighbourhood is
connected through your machine then an ISP may treat protestations from
you that further abuse will not occur as unlikely to be accurate :( They
may, if you are lucky, look at the formal agreement you have with these
neighbours as providing some sort of guarantee - but that's to look on
the bright side.

To get this (vaguely) back on topic, this is at the heart of the problem
that law enforcement has with "traceability". What traceability there is
on the Internet works down to the account level - because that is what
ISPs disconnect. There is little traceability down to the level of
individuals - which does not inconvenience ISPs, but rather stymies the
police officer who is considering locking someone up.

- -- 
richard @ highwayman . com                       "Nothing seems the same
                          Still you never see the change from day to day
                                And no-one notices the customs slip away"

-----BEGIN PGP SIGNATURE-----
Version: PGPsdk version 1.7.1

iQA/AwUBOp8BhhfnRQV/feRLEQKsvQCg7oB6dQQ6QPsHQLc8K6aFcEyON7kAn07r
8Tn5As1QgYv3c2fqg5lUlCEL
=bTAP
-----END PGP SIGNATURE-----