Subject: Re: [hrpc] Fwd: draft-andersdotter (was RE: [Int-area] WG adoption call: Availability of Information in Criminal Investigations Involving Large-Scale IP Address Sharing Technologies

From: Mallory Knodel <[email-masked]>
Date: Wed, 2 May 2018 11:52:42 +0300

Hi Amelia,

I'm watching the discussion unfold and while I'm not on the list, I
thought I would share two thoughts about the security argument folks
have made:

On 23/04/18 11:52, Amelia Andersdotter wrote:
>       SHOULD only store entire incoming IP addresses for as long as is
>       necessary to provide the specific service requested by the user.
> 
> Med: This is implementation and deployment-specific. Not sure we can mandate a server how to service users.  

If there is a particular security service that is being provided to the
user, then this recommendation is still sound-- if you have DDoS
mitigation then analyses or other logging might go beyond three days. It
fits.

There was also another blunt question from Med about DDoS-- What about DDoS?

First, analyses doesn't need the entire IP address. One could log
attacks without retaining the full IP address and lots of other information.

Second, adding IP addresses to black or grey lists is not logging.

-Mallory

-- 
Mallory Knodel
Head of Digital :: article19.org
gpg fingerprint :: E3EB 63E0 65A3 B240 BCD9  B071 0C32 A271 BD3C C780