Security Incidents: Re: big increase in ftp scanning

[Jan Muenther <jan () RADIO HUNDERT6 DE>]

Hi,

> Here in germany there are also some legal problems which sometimes
> prevent identifying who was doing the scans. An ISP is only allowed to
> keep his logs of who had which IP address at which time as long as he
> needs it to bill the customer. At T-Online this is typically up to 4
> or 6 weeks, so if you report an incident later, it is not possible for
> T-Online to identify the customer.
According to the TKG (Telekommunikationsgesetz -
telecommunications act) every ISP has to keep the customer's
connection logs for 100 days and after that has to delete the
entries. At the same time he is obliged to provide an interface
for the the state's crime prosecution organs which enables them
to access the data without the ISP noticing (...which of course
is absolutely unconstitutional, but hey... they made it that
way).

Just a sidenote.

Bye, Jan
--
Radio HUNDERT,6 Medien GmbH Berlin
- EDV -
j.muenther () radio hundert6 de