1. TF-CSIRT outside Europe How to act ?

2. Are the TF-CSIRT ToR limiting the geographical scope? "1.1 The Task Force is established to promote collaboration betweenComputer Security Incident Response Teams (CSIRTs) in Europe and neighbouring regions. It shall be known as TF- CSIRT (Collaboration of Computer Security Incident Response Teams)." "2.1 The Task Force is open to all recognised CSIRTs situated in Europe and neighbouring regions, as well as other organisations and individuals with bona- fide interest in computer security incident handling.” No, the ToR do not limit our geographical scope.

3. Is the TI contract limited in geographical scope? No, the CfT already took this into account. The TI can extend their service worldwide. The only issues are the cost of the certification site visit (already taken care of with a higher tariff), and “language” - for the latter we should demand English documents or translations for not- supported languages. The TI members don’t read Thai, Swahili or Mandarin (and not even Finnish or Hungarian).

4. 3 regions 1.Europe – RIPE NCC constituency 2.Countries around the Mediterranean (not in Europe) 3.The rest of the planet Suggestion: - for Europe continue as usual - treat regions 2 and 3 alike: to be defined >>>>

5. But we’re European? TF-CSIRT’s home base is indeed Europe TF-CSIRT focus should stay on Europe APCERT and others serve their own regions, FIRST acts worldwide We do have some unique selling points - and - a few teams outside Europe find reason to join us. There seems no good argument to say “no” to them. Suggestion: outside Europe (regions 2 & 3) do not act behind the backs of our regional colleagues and FIRST.

6. What to do then? Suppose team X outside Europe asks to join : When X is a member of their regional CSIRT cooperation and of FIRST: inform both and proceed (also inform X that this is the procedure). SC is informed but need not intervene. When X is not: discuss in SC. Involve regional forum and/or FIRST. Keep X posted. No fixed rule. TF-CSIRT reserves the right to refuse a team’s listing or accreditation.

7. Cases CARICERT, Curacao (part of Kingdom of The Netherlands). Accredited. Member of AMPARO and FIRST. ThaiCERT, Thailand. Listed. Want to go for accreditation AND certification. Waiting for us to set our policy. Member of APCERT and FIRST. TechCERT, Sri Lanka. Want to go for at least listing. Waiting for us to set our policy. Member of APCERT and FIRST.

8. Talk with FIRST president Baiba and Don discussed this issue with Maarten Van Horenbeeck, FIRST president Maarten sees no real issue here but very much appreciates our open approach Basically he said: go ahead, we are very happy that you want to keep us posted

9. Drawbacks? Expanding outside Europe may decrease the level of trust TF-CSIRT will become too big and suffer from the FIRST size problem Both may be true with a big expansion. However such an expansion is not expected right now. European focus should stay: no watering down e.g. of meeting attendance demands for certification.

10. Conclusion Europe = RIPE NCC served area CSIRTs outside Europe: If members of FIRST and regional forum – can join TI/TF-CSIRT easily If not members of FIRST and regional forum – discussion/individual decision by TF-CSIRT SC

11. Thank you!

12. 46 th TF-CSIRT Meeting 24 - 25 September 2015,Tallinn, Estonia, Mektory Center