Re: RIAA Notices

["Stanclift, Michael" <michael.stanclift () ROCKHURST EDU>]

We typically track down the user with DHCP/translation logs and Cisco Clean Access system. We block almost most P2P 
traffic, otherwise our pipe would be so saturated no one would be able to use it. We've never turned any information to 
the RIAA/MPAA folks, we typically just disable their Internet access. We then request that they come speak to someone 
from our office and sign the Computer Usage Agreement, then we scare them into submission by talking about all the 
virus and security/privacy threats they expose themselves to. They're typically warned if they're caught again we'll 
turn them over to the Dean of Students office. Never had a repeat offender yet.

We don't really get many notices, although around this time last year we got a flood, other than that it's really only 
a handful a year.

Michael Stanclift
Network Analyst
Rockhurst University

http://help.rockhurst.edu
(816) 501-4231


-----Original Message-----
From: The EDUCAUSE Security Constituent Group Listserv [mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Anand S 
Malwade
Sent: Monday, January 26, 2009 9:02 AM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: [SECURITY] RIAA Notices

All,

I was wondering how other Universities deal with RIAA notices ? Do you really invest the time and effort to track down 
? what methodology and tools do you use for investigation ? Do you block all peer-peer traffic ?

Thanks,
Anand

Anand Malwade
Information Security Officer,
Seton Hall University
malwadan () shu edu