[ncc-services-wg] Incident Response Service (IRS) [was: Unneeded RIPE tasks]

On 22.08 19:39, Wilfried Woeber, UniVie/ACOnet wrote:
>   Questions:
>   1) can we have a more elaborate description from the NCC of what
>      activities are expected to be performed under this headline?

ripe-271 says:
"We will respond to Internet incidents and events that generate 
a lot of public interest, such as the Sapphire worm of 25.01.03, 
by providing objective and comprehensive data for use by the membership 
and the general public.  http://www.ripe.net/ttm/worm/index.html"

In other words: When something that generates interest happens we will
expeditiously look at our measurement data, check what we see there, 
and publish a first analysis.  We will keep doing this until the event is
over and publish a final analysis. 

First examples of such reports are on the NCC web site.  The most recent
one being http://www.ripe.net/ttm/worm/nyc.html which is really 
a statement of "We saw nothing". 

This activity is triggered by numerous blatantly false guesses, often on
the nanog list, which get wide press coverage and start to lead their
own life.  The one that pushed me to propose this was the one that made
at least the NYT, Washington Post and "Der Spiegel" which said: 
"All root name servers were unreachable due to Sapphire"; 
this was based on a NANOG posting by someone doing pings to the roots
from one location that was, lets say, neither well hardened nor well
connected.

I think it is in the Interest of the RIPE community to publish objective
and verifyable data on such events and to develop confidence in it by
journalists and public policy people in this data.  I hope the RIPE
community and the NCC membership agree. 

>   2) is there any WG which could be polled or which has "adopted" this
>      activity for definition and development (or is expected to do so)?

Not yet. This needs to be hashed out between ncc-services, ttm and tech-sec.

>   Answers to these Qs would make it much easier for me to be in favor or
>   against :-)

Let me know if there are further questions.

Daniel