FAQ

What is SIE Europe?

SIE Europe is a European-based community of Internet defenders who want to make the European digital economy safer. SIE Europe provides a platform for the collection, aggregation, and sharing of passive DNS data, within Europe, that is relevant in the fight against cybercrime. SIE Europe forms cooperative working relationships with participating organizations, who contribute data ("Data Participants”).

SIE Europe operates a sharing hub, to accept real-time passive DNS data from Data Participants, who each have the right to receive the full real-time channel they and others contribute to ("give a little, get a lot").

Is SIE Europe a non-profit?

Data Participants receive data at no cost. Today SIE Europe is registered as a UG located in Karlsruhe, Germany. Paul Vixie (Farsight), Christoph Fischer (BFK), Peter Kruse (CSIS) are the cofounders of the UG.

What is the data governance model?

SIE Europe activities will be conducted in strict compliance with the privacy laws and regulations of Germany and the European Union, including the General Data Protection Regulations ("GDPR"). 

What is passive DNS?

Passive DNS uses observed cache miss traffic collected from above recursive resolvers to illuminate the relationships between domain names, IP addresses, and name servers. Passive DNS also captures other types of DNS data including DKIM/DMARC records, SPF records, etc. Passive DNS data is often used to identify:

• - Domains that have been seen associated with a particular IP or IP range
• - IPs that have been seen associated with a particular domain name
• - Domain names known to be using a particular authoritative nameserver, etc.
• - The date and time range associated with associations and changes

Why is sharing passive DNS important?

By sharing passive DNS data, SIE Europe participants enable the community to gain timely access to changes that are taking place on the internet, that may indicate malicious activity. The more organizations that participate, the greater the opportunity to: mitigate potential harm to systems, networks, and infrastructure; prevent data loss; and, thwart fraudulent activities and other cybercrimes. 

What about Privacy?

Passive DNS sensors sit above the recursive DNS of a nameserver, and therefore only have visibility of aggregated "cache-miss" DNS traffic which does not include information identifying individual users. In addition, the aggregation of traffic from multiple data contributor organizations prior to distribution obfuscates the contributing source.

What are the permitted uses for the data?

Participants can use data from the exchange to protect their networks, systems and infrastructure as well as enhance cybersecurity products and services.  With SIE Europe data, they can create derivative works for use by others in real time.  Unmodified data may not be redistributed.  For more details please contact community@sie-europe.net.

What is the SIE Europe data sharing hub, and where is it located?

The SIE Europe node is a relay and sensor support system, with a front-end network, for data ingestion, filtering, deduplication and distribution of data channel feeds to data participants. The node is housed in Karlsruhe, Germany.  

How will data be available to Data Participants?  

Data is accessible by streaming downloads (SIE Remote Access open source software developed by Farsight).  A time-delimited database updated in near-real-time will be available and accessible via a RESTful API. Current plans call for two months of historical data to be accessible via a database.  

How much does SIE Europe Data cost?

Today there is no cost to participate in SIE Europe. The venture operates a sharing hub, to accept real-time passive DNS data from Data Participants who each gain the right to receive the full real-time channel they and others contribute to ("give a little, get a lot") at no cost. 

Who can participate in SIE-Europe?

Commercial, government and higher education organizations within Europe with data to contribute can apply to participate in SIE Europe.

Is there an agreement required?

A signed "Data Participant Agreement" between SIE Europe and participating organizations is required for participation. The term for the Data Participant Agreement will be for one (1) year and will automatically renew if not terminated otherwise. For more details, please contact community@sie-europe.net