North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: clued/interested LEO list

  • From: Hank Nussbacher
  • Date: Mon Apr 11 01:35:37 2005

At 02:12 PM 10-04-05 -0700, william(at)elan.net wrote:

What is different about this then your current botnet tracking lists?

If its anti-spam & anti-phishing, there are several closed mail lists
discussing preventetive measures and tracking down those responsible
for abuse.
Yes, us geeks have many lists to go to to find others who have common interests and goals. What I have found out is that there is close to zero interaction between the various LEOs when it comes to bots, phishing, spam, pron, threats, fraud and anything else you can find in the online world. We take for granted that within a few hours you can contact some netadmin in California, Mexico, Germany, Israel, Japan, Greece, Australia or any other country that is connected to what the press terms the "Information Superhighway".

If the threat is a $100M international bank fraud then the LEOs all play nice and have tools to communicate with each other. But we here all know that all threats are not Defcon I and many are Defcon IV or III. The LEOs don't get involved in online/cyber incidents of the lower levels. And trying to get them to play with each other can take weeks of nudging and often leads to nothing.

I therefore think a list where motivated and clued-in LEOs from many countries can chat among themselves is something sorely lacking. For evidence and subpoenas, they will always have their own internal methods.

-Hank