<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><blockquote type="cite"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><div>On 23/02/2013, at 2:53 AM, Jo Rhett <<a href="mailto:jrhett@netconsonance.com">jrhett@netconsonance.com</a>> wrote:</div><blockquote type="cite"><span style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; display: inline !important; float: none; ">No. I've had this conversation many times and employees of big companies feel that it's impossible, and don't even raise the issue with their management. In two different occasions I arranged a meeting with their management and made the case for it, at which point the managers told the unbelieving employee to make it happen.</span></blockquote></div></div></blockquote><br>On Feb 23, 2013, at 8:36 PM, Daniel Griggs wrote:<blockquote type="cite"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div>If you have a presentation that you can share with the class, that would be great.</div><div>It would make a useful addition to any security workshops or discussions I have with providers around security.</div></div></blockquote></div><div><br></div>This topic really is so much simpler than most people put it out there. Completely ignore any topic of "being a good person". There are a group of related legal terms that come into play:<div><br></div><div>1. Gross Negligence</div><div></div><div>2. Good Faith Business Judgement</div><div>3. Commercially Reasonable Effort</div><div>...a few others, it's been a while since I had this discussion.</div><div><div><br></div><div>But the long and short is that for a person or company suing the provider to prove gross negligence, they must prove that this particular provider (1) knew that the damage it would cause and (2) failed to provide reasonable effort to prevent the damage.</div><div><br></div><div>It's a very short trip for a lawyer to convince even the most ignorant jury what the IETF is, and what BCP38 is, and that there is no reasonable way that the commercial entity was unaware of BCP38. Last time I was in court the lawyer threw three other RFCs into the mix but I have forgotten offhand what they are. Tail that together with the extensive promotion efforts by others, and a company would have to claim that they had never heard of the IETF and never went to any conferences and never participated any forums or mailing lists. That's a very easy bit of information to gather to prove they did.</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Note: I have always entered the conversation having this exact information in hand, to show just how easy it was to prove.</div><div><br></div><div>Then the lawyer must prove that it was "commercially reasonable", ie, their competition does it. In the lawsuits that I was involved in, the lawyer didn't bother making a case for the industry as a whole but instead made a case for the providers "just down the street". In particular, the fact that the customer who initiated the attack moved from a provider who was BCP38 compliant to them just days before the attack was used as evidence that the provider was directly to blame.</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Note: I don't bring this up, but several providers have asked if implementing BCP38 would make it more likely their competitors would face this lawsuit. I plead off being a lawyer but I acknowledge that it seems entirely reasonable. I do point out that if a competitor's failure to implement BCP38 was involved in an outage in their network, all of the same facters are involved. (and vice versa)</div><div><br></div><div>Then, the lawyer must simply provide evidence that the attacks came from the provider's network (wouldn't be a lawsuit without that part) and voila, you have a clear judgement for gross negligence.</div><div><br></div><div>The last bit of information that I bring is a round-up of what awards juries toss at large corporations convicted of gross negligence. Given the current anti-big-business mindset in this country, it is always ridiculously high numbers.</div><div><br></div><div>note 1: not a lawyer and I make it clear. In fact, I express clearly that this is something they should discuss with their own lawyer(s).</div><div><br></div><div>note 2: I've only done this with US companies, or companies with US divisions. Legal terms and expectations may differ elsewhere.</div><div><br><div>
<span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><span class="Apple-style-span" style="font-size: 12px; "><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><font face="Helvetica" size="3" style="font: normal normal normal 12px/normal Helvetica; ">-- </font></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><font face="Helvetica" size="3" style="font: normal normal normal 12px/normal Helvetica; ">Jo Rhett</font></div></span><span class="Apple-style-span" style="font-size: 12px; ">Net Consonance : </span><span class="Apple-style-span" style="font-size: 12px; ">net philanthropy to improve open source and internet projects.</span><br><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><div><span class="Apple-style-span" style="font-size: 12px; "><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><br></div></span></div></div></div></span></span><br class="Apple-interchange-newline">
</div>
<br></div></div></body></html>