<html>
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
  </head>
  <body>
    <div class="moz-cite-prefix">Response from Clario (private email):</div>
    <div class="moz-cite-prefix"><br>
    </div>
    <div class="moz-cite-prefix">
      <blockquote type="cite">Thanks for getting in touch!<br>
        <br>
        The instance in question was indexed by Grayhat Warfare search
        engine. <br>
        We hope you liked the article and found it useful. <br>
      </blockquote>
    </div>
    <div class="moz-cite-prefix"><br>
    </div>
    <div class="moz-cite-prefix">Additions to <a moz-do-not-send="true"
        href="https://updates.internetsociety.org/faq/">ISoc's FAQ</a>
      on this:</div>
    <div class="moz-cite-prefix"><br>
    </div>
    <div class="moz-cite-prefix">
      <blockquote type="cite">Due to the nature of the configuration as
        a public container, the logs do not contain sufficient
        information to provide us with a complete record of data access.</blockquote>
      Quite how this is possible is not clear to me (they're using a
      hosting provider which loses logs constantly?).</div>
    <div class="moz-cite-prefix"><br>
    </div>
    <div class="moz-cite-prefix">
      <blockquote type="cite">
        <h5 class="has-text-color"
id="do-internet-society-chapter-leaders-have-any-legal-obligations-to-formally-notify-chapter-members-about-this-issue-or-provide-additional-information"
          style="color:#085856">Do Internet Society chapter leaders have
          any legal obligations to formally notify chapter members about
          this issue or provide additional information?</h5>
        <p>Given the nature of this issue, we can confirm that the
          Internet Society is the data owner/data controller for any
          member data that may have been publicly accessible. Because
          the Internet Society is the data owner/data controller, any
          legal obligations to provide notice would belong to the
          Internet Society, as opposed to any chapters. We also notified
          individual members directly of the issue.</p>
      </blockquote>
    </div>
    <div class="moz-cite-prefix">This is an interesting claim,
      particularly given that chapters are or can be separate legal
      entities. I'm not yet sure what to make of it.</div>
    <div class="moz-cite-prefix"><br>
    </div>
    <div class="moz-cite-prefix">- Roland</div>
    <div class="moz-cite-prefix"><br>
    </div>
    <div class="moz-cite-prefix">
      <hr width="100%" size="2"><br>
    </div>
    <div class="moz-cite-prefix"><br>
    </div>
    <div class="moz-cite-prefix">On 17/2/22 18:23, Roland Turner wrote:<br>
    </div>
    <blockquote type="cite"
      cite="mid:3923f962-9632-c189-74d8-f0265cd1244b@rolandturner.com">
      <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
      <div class="moz-cite-prefix">On 17/2/22 17:29, Joly MacFie wrote:</div>
      <div class="moz-cite-prefix"><br>
        <blockquote type="cite">I can't quite grasp how something can be
          both public and unknown.. Sounds like speculation to me. <br>
        </blockquote>
        Sure, but as presented the report also appears speculative. We
        simply don't know at this point whether there was or was not
        unauthorised access other than by Clario and neither does
        Clario. ISoc presumably does either:</div>
      <div class="moz-cite-prefix">
        <ul>
          <li> know, because either all or not all accesses were
            authorised or Clario's; or</li>
          <li>know that this is unknowable (because logging was turned
            off)</li>
        </ul>
        but hasn't at this point shared this information. This is a
        problematic situation for dozens of chapters, whether or not
        anyone happens also to have information indicating active
        exploitation.<br>
      </div>
      <div class="moz-cite-prefix"><br>
      </div>
      <div class="moz-cite-prefix">- Roland</div>
      <div class="moz-cite-prefix"><br>
      </div>
      <div class="moz-cite-prefix">
        <hr width="100%" size="2"><br>
      </div>
      <div class="moz-cite-prefix">On 17/2/22 17:29, Joly MacFie wrote:<br>
      </div>
      <blockquote type="cite"
cite="mid:CAM9VJk1Ek4kY-4X9UCPk5+GsE--1M9ZOjsy4JaOvjUN=5jv6pA@mail.gmail.com">
        <meta http-equiv="content-type" content="text/html;
          charset=UTF-8">
        <div dir="ltr">
          <div class="gmail_default" style="font-size:small">> It
            states that it was publicly indexed, </div>
          <div class="gmail_default" style="font-size:small"><br>
          </div>
          <div class="gmail_default" style="font-size:small">by an
            "Unknown public search engine" </div>
          <div class="gmail_default" style="font-size:small"><br>
          </div>
          <div class="gmail_default" style="font-size:small">I can't
            quite grasp how something can be both public and unknown..
            Sounds like speculation to me. </div>
          <div class="gmail_default" style="font-size:small"><br>
          </div>
          <div class="gmail_default" style="font-size:small">What is
            more likely is that Clario were methodically running pen
            tests on AWS blobs, and got lucky.</div>
          <div class="gmail_default" style="font-size:small"><br>
          </div>
          <div class="gmail_default" style="font-size:small">joly</div>
        </div>
        <br>
        <div class="gmail_quote">
          <div dir="ltr" class="gmail_attr">On Thu, Feb 17, 2022 at 4:07
            AM Roland Turner via Chapter-delegates <<a
              href="mailto:chapter-delegates@elists.isoc.org"
              moz-do-not-send="true" class="moz-txt-link-freetext">chapter-delegates@elists.isoc.org</a>>
            wrote:<br>
          </div>
          <blockquote class="gmail_quote" style="margin:0px 0px 0px
            0.8ex;border-left:1px solid
            rgb(204,204,204);padding-left:1ex">
            <div>
              <div>On 17/2/22 16:39, Joly MacFie via Chapter-delegates
                wrote:</div>
              <div><br>
              </div>
              <blockquote type="cite">
                <div dir="ltr">
                  <div dir="ltr">
                    <div class="gmail_default" style="font-size:small">As
                      reported by which 3rd parties? The <a
                        href="https://clario.co/blog/internet-society-member-data-breach/"
                        target="_blank" moz-do-not-send="true">Clario
                        statement</a> only says the data was
                      unprotected, not that it was exploited.</div>
                  </div>
                </div>
              </blockquote>
              <p>It states that it was publicly indexed, which would
                require very substantial unauthorised access, vs. merely
                the potential exposure which has been reported so far.<br>
              </p>
              <p>Granted, it states somewhat confusingly that it was
                publicly indexed by an "unknown" public search engine.
                (How would they know that?)<br>
              </p>
              <p>- Roland</p>
              <p><br>
              </p>
              <hr width="100%" size="2">
              <p><br>
              </p>
              <blockquote type="cite">
                <div dir="ltr">
                  <div dir="ltr">
                    <div class="gmail_default" style="font-size:small"><br>
                    </div>
                    <div class="gmail_default" style="font-size:small">j</div>
                  </div>
                  <br>
                  <div class="gmail_quote">
                    <div dir="ltr" class="gmail_attr">On Thu, Feb 17,
                      2022 at 3:33 AM Winthrop Yu via Chapter-delegates
                      <<a
                        href="mailto:chapter-delegates@elists.isoc.org"
                        target="_blank" moz-do-not-send="true"
                        class="moz-txt-link-freetext">chapter-delegates@elists.isoc.org</a>>
                      wrote:<br>
                    </div>
                    <blockquote class="gmail_quote" style="margin:0px
                      0px 0px 0.8ex;border-left:1px solid
                      rgb(204,204,204);padding-left:1ex">
                      <div>
                        <p>On 17 Feb 2022 10:13 am, Joly MacFie wrote:<br>
                        </p>
                        <blockquote type="cite">
                          <div dir="ltr">
                            <div style="font-size:small">While I concur
                              with concerns about the transparency, I
                              will just say that there is a difference
                              between a breach and a detected
                              vulnerability, so let's not get ahead of
                              ourselves.</div>
                            <div style="font-size:small"><br>
                            </div>
                          </div>
                        </blockquote>
                        <p>If the vulnerability were unexploited that
                          distinction may hold. If, as reported by 3rd
                          parties, there is ISOC member data out there,
                          then clearly there was a breach. In any case,
                          i believe notification requirements apply,
                          here in our jurisdiction if not in yours. <br>
                          <br>
                        </p>
                        <blockquote type="cite">
                          <div dir="ltr">
                            <div style="font-size:small">What does seem
                              odd is the length of time between the
                              discovery and the reaction.</div>
                            <div style="font-size:small"><br>
                            </div>
                          </div>
                        </blockquote>
                        <p>ISOC HQ told us to expect more information
                          (clarification, details, etc.), we waited
                          patiently as is proper. Should chapters have
                          done otherwise -- speak now or forever hold
                          your peace? :) <br>
                        </p>
                        <p><br>
                          WYn<br>
                        </p>
                        <br>
                        <blockquote type="cite">
                          <div class="gmail_quote">
                            <div dir="ltr" class="gmail_attr">On Wed,
                              Feb 16, 2022 at 7:35 PM Winthrop Yu via
                              Chapter-delegates <<a
                                href="mailto:chapter-delegates@elists.isoc.org"
                                target="_blank" moz-do-not-send="true"
                                class="moz-txt-link-freetext">chapter-delegates@elists.isoc.org</a>>
                              wrote:<br>
                            </div>
                            <blockquote class="gmail_quote"
                              style="margin:0px 0px 0px
                              0.8ex;border-left:1px solid
                              rgb(204,204,204);padding-left:1ex">
                              <div>
                                <p>Olivier, we don't need press releases
                                  or "updates". <br>
                                </p>
                                <p>At the very least, we need: <br>
                                </p>
                                <p>a)  a clear, comprehensive yet
                                  concise official statement from ISOC
                                  HQ regarding the breach. <br>
                                </p>
                                <p>b)  including whether ISOC HQ has
                                  notified <b>all</b> its global
                                  members (which would include the
                                  individual members of chapters).</p>
                                <p>That above is a bare minimum. Then we
                                  will have to check that against any
                                  obligations the chapter itself may
                                  have under local law. And we may
                                  subsequently need further
                                  clarification / statements from ISOC
                                  HQ. <br>
                                </p>
                                <p>WYn<br>
                                </p>
                                <p><br>
                                </p>
                                <div>On 17 Feb 2022 1:45 am, Olivier MJ
                                  Crépin-Leblond via Chapter-delegates
                                  wrote:<br>
                                </div>
                                <blockquote type="cite"> Am I the only
                                  one in Chapter Delegates mailing list
                                  who received and read the email from
                                  Christine Saegesser explaining the
                                  problem with MemberNova and referring
                                  to:<br>
                                  <br>
                                  "As we noted in our prior email, after
                                  we learned of the issue, we launched
                                  an investigation. The investigation
                                  is continuing, and we will provide
                                  more details when we have
                                  more information to share. Going
                                  forward, updates will be posted at <a
href="http://updates.internetsociety.org" target="_blank"
                                    moz-do-not-send="true">updates.internetsociety.org</a>,
                                  and we encourage you to check
                                  there for additional information. The
                                  membership password to access
                                  this website is ISOC-AMS-Updates (case
                                  sensitive)."<br>
                                  <br>
                                  Or is the problem that there does not
                                  appear to have been any updates since
                                  21st January 2021?<br>
                                  <br>
                                  Kindest regards,<br>
                                  <br>
                                  Olivier<br>
                                  <br>
                                  <br>
                                  <div>On 16/02/2022 14:54, Veni
                                    Markovski via Chapter-delegates
                                    wrote:<br>
                                  </div>
                                  <blockquote type="cite"> <font
                                      face="Helvetica, Arial,
                                      sans-serif">+1 to the request for
                                      more clarity; our members need to
                                      be informed, and I don't want to
                                      share on social media a link to an
                                      article on some website. There
                                      should be something at <a
                                        href="http://isoc.org"
                                        target="_blank"
                                        moz-do-not-send="true">isoc.org</a>,
                                      and in the news section there's
                                      only one press release from 2022 -
                                      on February 4.  <br>
                                      <br>
                                      Also, it's not a good thing to
                                      find out from a publication about
                                      some of the details (I assume not
                                      all of them)...<br>
                                      <br>
                                      v/<br>
                                    </font><br>
                                    <div>On 2/16/22 04:19, Roland Turner
                                      via Chapter-delegates wrote:<br>
                                    </div>
                                    <blockquote type="cite">
                                      <div>Andrew,</div>
                                      <div><br>
                                      </div>
                                      <div>Could we have a little more
                                        clarity on this please? Chapter
                                        members in multiple
                                        jurisdictions may have
                                        notification obligations arising
                                        from this.</div>
                                      <div><br>
                                      </div>
                                      <div><br>
                                      </div>
                                      <div>The <a
                                          href="https://updates.internetsociety.org/"
                                          target="_blank"
                                          moz-do-not-send="true">Jan 21</a>
                                        update states:</div>
                                      <div>
                                        <blockquote type="cite">Fortunately,
                                          we have still not seen any
                                          instances of malicious access
                                          to member data as a result of
                                          this issue.</blockquote>
                                      </div>
                                      <div><br>
                                      </div>
                                      <div>This appears a little unclear
                                        to me on two important fronts:</div>
                                      <div><br>
                                      </div>
                                      <div><b>"have not seen"</b></div>
                                      <div><br>
                                      </div>
                                      <div>An adversarial read of this
                                        is the rather horrifying idea
                                        that access logging was not
                                        turned on, so you (and
                                        MemberNet) haven't the faintest
                                        idea whether there were any
                                        unauthorised accesses, which
                                        would certainly allow you say
                                        that you hadn't seen any
                                        unauthorised accesses but
                                        wouldn't mean that there weren't
                                        any, even at a reasonable level
                                        of confidence. Hopefully this is
                                        not the case!</div>
                                      <br>
                                      <div><b>"malicious access"</b></div>
                                      <div><br>
                                      </div>
                                      <div>The relevant question is not
                                        whether any accesses could be
                                        described as malicious, but
                                        simply whether they were
                                        unauthorised. An adversarial
                                        read of this is that there were
                                        unauthorised accesses, but
                                        because you don't have much
                                        information about the
                                        unauthorised accessers you not
                                        in a position to say that they
                                        were acting maliciously, however
                                        this would tell us nothing about
                                        whether there had been
                                        unauthorised access. Again,
                                        hopefully this is not the case!</div>
                                      <div><br>
                                      </div>
                                      <div><br>
                                      </div>
                                      <div>To address both concerns, are
                                        you able to confirm that:</div>
                                      <div>
                                        <div>
                                          <ol>
                                            <li>access logging was
                                              turned on and the logs
                                              were successfully secured;<br>
                                            </li>
                                            <li>the logs appear to be
                                              complete (in this case
                                              "appear to" is fine; the
                                              requirement is simply that
                                              there are no unexplained
                                              gaps); and<br>
                                            </li>
                                            <li>all logged accesses are
                                              authorised (i.e. because
                                              they were made by the
                                              application server, not
                                              random external IP
                                              addresses)</li>
                                          </ol>
                                          ?<br>
                                        </div>
                                        <div><br>
                                        </div>
                                      </div>
                                      <p><br>
                                      </p>
                                      <p>- Roland</p>
                                      <p><br>
                                      </p>
                                      <hr width="100%" size="2"><br>
                                      <div>On 16/2/22 15:41, Hank
                                        Nussbacher via Chapter-delegates
                                        wrote:<br>
                                      </div>
                                      <blockquote type="cite">
                                        <pre>In case you missed it:

<a href="https://www.infosecurity-magazine.com/news/internet-society-data-leaked/" target="_blank" moz-do-not-send="true" class="moz-txt-link-freetext">https://www.infosecurity-magazine.com/news/internet-society-data-leaked/</a>


Regards,

Hank

_______________________________________________</pre>
                                      </blockquote>
                                    </blockquote>
                                  </blockquote>
                                </blockquote>
                              </div>
                            </blockquote>
                          </div>
                        </blockquote>
                      </div>
                      _______________________________________________<br>
                      As an Internet Society Chapter Officer you are
                      automatically subscribed<br>
                      to this list, which is regularly synchronized with
                      the Internet Society Chapter Portal (AMS):<br>
                      <a
                        href="https://admin.internetsociety.org/622619/User/Login"
                        rel="noreferrer" target="_blank"
                        moz-do-not-send="true"
                        class="moz-txt-link-freetext">https://admin.internetsociety.org/622619/User/Login</a><br>
                      View the Internet Society Code of Conduct: <a
                        href="https://www.internetsociety.org/become-a-member/code-of-conduct/"
                        rel="noreferrer" target="_blank"
                        moz-do-not-send="true"
                        class="moz-txt-link-freetext">https://www.internetsociety.org/become-a-member/code-of-conduct/</a><br>
                    </blockquote>
                  </div>
                  <br clear="all">
                  <div><br>
                  </div>
                  -- <br>
                  <div dir="ltr">
                    <div dir="ltr">
                      <div>
                        <div dir="ltr">
                          <div>
                            <div>--------------------------------------<br>
                              Joly MacFie  +1<span title="Call with
                                Google Voice">2185659365</span> </div>
                            <div>--------------------------------------</div>
                            -</div>
                        </div>
                      </div>
                    </div>
                  </div>
                </div>
                <br>
                <fieldset></fieldset>
                <pre>_______________________________________________
As an Internet Society Chapter Officer you are automatically subscribed
to this list, which is regularly synchronized with the Internet Society Chapter Portal (AMS):
<a href="https://admin.internetsociety.org/622619/User/Login" target="_blank" moz-do-not-send="true" class="moz-txt-link-freetext">https://admin.internetsociety.org/622619/User/Login</a>
View the Internet Society Code of Conduct: <a href="https://www.internetsociety.org/become-a-member/code-of-conduct/" target="_blank" moz-do-not-send="true" class="moz-txt-link-freetext">https://www.internetsociety.org/become-a-member/code-of-conduct/</a>
</pre>
              </blockquote>
              <p><br>
              </p>
            </div>
            _______________________________________________<br>
            As an Internet Society Chapter Officer you are automatically
            subscribed<br>
            to this list, which is regularly synchronized with the
            Internet Society Chapter Portal (AMS):<br>
            <a
              href="https://admin.internetsociety.org/622619/User/Login"
              rel="noreferrer" target="_blank" moz-do-not-send="true"
              class="moz-txt-link-freetext">https://admin.internetsociety.org/622619/User/Login</a><br>
            View the Internet Society Code of Conduct: <a
              href="https://www.internetsociety.org/become-a-member/code-of-conduct/"
              rel="noreferrer" target="_blank" moz-do-not-send="true"
              class="moz-txt-link-freetext">https://www.internetsociety.org/become-a-member/code-of-conduct/</a><br>
          </blockquote>
        </div>
        <br clear="all">
        <div><br>
        </div>
        -- <br>
        <div dir="ltr" class="gmail_signature">
          <div dir="ltr">
            <div>
              <div dir="ltr">
                <div>
                  <div>--------------------------------------<br>
                    Joly MacFie  +1<span title="Call with Google Voice">2185659365</span> </div>
                  <div>--------------------------------------</div>
                  -</div>
              </div>
            </div>
          </div>
        </div>
      </blockquote>
      <p><br>
      </p>
    </blockquote>
    <p><br>
    </p>
  </body>
</html>