Re: How do you handle the P2P problem?

[Dan Updegrove <updegrove () MAIL UTEXAS EDU>]

Colleagues,

I'm not an attorney, but I think we need to challenge some of the
assumptions in these posts:

* "Illegal peer-to-peer file sharing" is a problematic concept. In May 2003
a federal judge ruled that P2P software was not illegal, although some uses
of it may be. This suggests to me the only way to detect *illegal* P2P file
sharing is to sniff the content itself, which most campuses are loathe to do.

* The notion that a *campus* could face legal liability for P2P traffic
appears to me to violate the basic premises of the Digital Millennium
Copyright Act (DMCA), which provides a "safe harbor" for Internet Service
Providers, including campuses providing network services to non-employees.

This is not to suggest that use of P2P software on campus is harmless.
Rather I think we need to understand that P2P traffic, per se, is not
illegal. The fact that a campus administration chooses to ban P2P -- which
it might do to manage its bandwidth or to discourage illegal behavior --
should not, in my view, expose it to legal liability for student use.
Faculty and staff use is another matter, as is the case of an institution
that does not abide by the DMCA regs protecting the safe harbor.

Regards,
Dan Updegrove

At 06:42 AM 11/13/2003, Peter Charbonneau wrote:
> We are a fully switched Cisco campus.  We have been using CiscoWorks to
> locate people (CampusManager); given that polling takes place every 2
> hours, this is not a good solution for mobility.  We have created a
> "home-grown" Perl and PHP poller that polls all 350 switches every 15
> minutes; we use the dynamic arp cache in the core 6509's to map MAC to
> IP address - voila - instant locator.
>
> We also use Snort.  WE DO get quite a number of false positives; however,
> I have NEVER seen false positives for the P2P users.  If you turn on the
> P2P rules, I think you will find the IPs of the violators.
>
> Out legal counsel has told us that if we ban P2P, and anything "slips"
> through, then we are liable AS A CAMPUS.
>
> HTH,
>
> PeteC
>
> *************************************************************************
> Peter Charbonneau                       Williams College
> Sr. Network and Systems Administrator   Office for Information Technology
> Jesup Hall Room 112                     22 Lab Campus Drive
> (413) 597-3408 (Phone)                  Williamstown, MA 01267
> (413) 597-4103 (Fax)                    Peter.Charbonneau () williams edu
> *************************************************************************
>
> -----Original Message-----
> From: The EDUCAUSE Security Discussion Group Listserv
> [mailto:SECURITY () LISTSERV EDUCAUSE EDU]On Behalf Of Clyde Hoadley
> Sent: Wednesday, November 12, 2003 1:54 PM
> To: SECURITY () LISTSERV EDUCAUSE EDU
> Subject: [SECURITY] How do you handle the P2P problem?
>
>
> I'm looking for simple and low cost solutions to some difficult problems.
>
> How do you accurately detect illegal peer-to-peer file sharing activity?
>
> How do you accurately identify and locate a user who is engaging in illegal
> peer-to-peer file sharing?
>
> Metro State does have some problems with illegal peer-to-peer file sharing
> however, we are solely a commuter campus.  We do not have dormitories etc...
> to support.  So, our P2P problem probably isn't as big as some other
> institutions P2P problems.
>
> Most of our network uses DHCP addresses.  We are not using MAC address
> authorization at this time.  We have a single Internet gateway.  We are
> doing Ingress filtering - permitting incoming connections for specific
> port/protocols to specific hosts.  We do limited Egress filtering -
> permitting
> almost any outgoing connection.  We also have SNORT watching the gateway
> traffic but have most of the rules turned off due to the high volume of
> false positives.  We could deny high port to high port connections but that
> would also stop a lot of very legitimate traffic.
>
> We have not received any subpoenas but we do occasionally receive an Email
> notice of Copyright infringement.  How are the rest of you dealing with
> the illegal peer-to-peer file sharing problem?
>
> --
> Clyde Hoadley
> Security & Disaster Recovery Coordinator
> Division of Information Technology
> Metropolitan State College of Denver
> hoadleyc () mscd edu
> http://clem.mscd.edu/~hoadleyc/
> (303) 556-5074
>
> **********
> Participation and subscription information for this EDUCAUSE Discussion
> Group discussion list can be found at http://www.educause.edu/cg/.
>
> **********
> Participation and subscription information for this EDUCAUSE Discussion
> Group discussion list can be found at http://www.educause.edu/cg/.


VP  for Information Technology          Phone (512) 232-9610
The University of Texas at Austin       Fax (512) 232-9607
FAC 248 (Mail code: G9800)              d.updegrove () its utexas edu
P.O. Box 7407                                   http://wnt.utexas.edu/~danu/
Austin, TX 78713-7407

**********
Participation and subscription information for this EDUCAUSE Discussion Group discussion list can be found at 
http://www.educause.edu/cg/.