If you equate the disconnection of McColo to a “lynch mob”, then you are ignorant of the facts & issues at hand here.

Hurricane Electric and Global Crossing (and any other ISP for that matter) is perfectly within their contractual (and legal) rights to disconnect any customer for violating their contractual terms of service (ToS).

Given that law enforcement had every opportunity to interceded in this issue, I would posit that this is exactly the kind of community policing that we want, instead of the problem spiraling out of control and some knee-jerk suggestions of additional (and utterly useless) toothless legislation that hurts no one but legitimate Internet users.

Again, to suggest that this was somehow a “lynch mob” indicates a lack of understanding in the facts of this particular issue, and the overall issues of dealing with organized cyber crime overall.

– ferg

I used to admin web/mail/dns services for an ISP. When some one was violating TOS or we received complaints from peering partners, whether a colo or website we shut them down and not just cut off. They were warned, mentored ( yea this setting makes your server an open relay) then last thing was to shut them down the process normally took about 3 to 5 days start to disconnnect. Most admins don’t want to chase away customers but they balance that with the need to have loyal customers. I’m positive that there are a few bad providers/whatever. but I’m more sure that this wasnt lynch mob mentality but more a quorum of admins and was defined and had a lot of thought behind it before it actually happened.
Since the beginning the web has been a place of give and take and mostly the geeks want to keep it up and free flowing, I feel the actions taken were appropriate considering the offense

First, I’d like to express agreement in general with the sentiments of Paul Ferguson. He’s a long-time veteran (as am I; I released the first anti-spam program about 25 years ago) of the struggle against what I’ll broadly label as Internet abuse.

Second, the use of loaded language like “lynch mob” or the often-seen “vigilante” needs to be dropped immediately. It’s inapplicable. Nobody went to McColo’s building, dragged the principals outside, and hung them from the nearest tree. THAT would be a lynch mob engaged in vigilante action. But that’s not what happened — not even remotely close.

Third, “collateral damage” is another loaded term that almost never applies. Among many other problems with it (see copious discussion on the IRTF-ASRG mailing list this spring in the realm of anti-spam measures) it ignores the due diligence responsibilities of those choosing Internet services. For example, anyone who chose to host their web site with McColo without performing at least a few minutes’ worth of online research — a quite trivial task for anyone with a web browser and access to a search engine — really must bear considerable responsibility for their own negligence.

Fourth, as I’ve pointed out elsewhere, law enforcement IS NOT COMING. Except in quite rare cases, they have now accrued a decades-long track record of passivity. Quoting
myself (sorry, but it’s apropos):

“Law enforcement is almost a complete non-factor in dealing with
online abuse.

Action is erratic, slow and incompetent at best; it tends to only
happen when one of four things is true: (a) someone’s running
for office (b) positive PR is needed (c) a government has been
publicly embarrrassed and needs a scapegoat or (d) someone with
sufficient political connections, money, and/or power wants it.
And even when it happens, it’s ineffective: for example, token
prosecutions of spammers have done nothing to make the spam
problem any better. Multiple spyware vendors have settled their
cases for pitifully small sums and then gone right back to work.”

Which means that it remains the responsibility of the online community to police itself — starting with its own operations. After all, abuse does not magically fall out of the sky and land on someone’s network: it comes from someone else’s network, and it is of course the first and highest responsibility of that someone else to see that abuse is not systemic and persistent. Those who have failed to discharge this basic obligation that’s part of the implied social contract of the entire Internet are providing evidence that they are (variously) incompetent, lazy, stupid, greedy or the root cause of the abuse. Why should anyone continue to generously extend the privilege of access to their networks and services to such people?

The solution to the problem remains the same now as it was back in the early 80’s when I first started observing and thinking about abuse issue: cut off the source until the abuse stops. This not only has immediate tactical effect (it stops the abuse) but it also has the important strategic effect of making the issue the sole responsibility of the originator. Any anti-abuse methdology which fails to do this is doomed — as we have seen over and over again in the interim as a dazzling array of pre-failed ideas have been brought forth and — surprise! shock! — failed.