Subject: [Ecrit] To trust or not to trust. Is that the question?

From: John Lange <[email-masked]>
Date: Tue, 24 Nov 2009 12:29:38 -0600

Recently I've been following the debate on this list regarding veracity
of location which loosely translates into a larger debate about
security.

If I'm understanding all of this correctly, one position is that PSAPs
will be resistant to solutions where the identity and location of the
caller can't be assured and that this necessarily requires a trust
relationship between VSPs and PSAPs and/or ISPs and PSAPs.

The other position is that the requirement for a trust relationship
prevents nomadic VOIP users from accessing PSAPs when out of their home
areas. Furthermore, these trusts can be circumvented so they provide
only a false sense of security.

Is this a fair characterization of the two positions?

-- 
John Lange
http://www.johnlange.ca

---

From: Marc Linsner <[email-masked]>
Date: Tue, 24 Nov 2009 14:19:48 -0500

Why would a person requesting emergency assistance knowingly provide a false
location?

-Marc-

---

From: Francois Menard <[email-masked]>
Date: Tue, 24 Nov 2009 14:24:38 -0500

I think the issue of trust is between the ILEC as an agent of the PSAP and the end-user as a subscriber to the VISP service provider.

i.e. ILECs are not willing to trust that VISPs will relay calls unless ILECs go ahead and countervalidate with the ISP providing the service, and then countervalidate with their own internal systems feeding the wholesale service to the ISPs.

I think that PSAPs should be mandated to trust end-points which obtain their location from the ISPs.

We could have end-points cerfied for this behaviour.

It would be better than to have this weird call flow I referred to in my previous email, which is not on the public Internet and thus out of reach of the IETF to sanctify.

F.

On 2009-11-24, at 13:29, John Lange wrote:

> _______________________________________________
> Ecrit mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ecrit

---

From: Francois Menard <[email-masked]>
Date: Tue, 24 Nov 2009 14:25:07 -0500

my point exactly!

f.

---

From: Brian Rosen <[email-masked]>
Date: Tue, 24 Nov 2009 14:50:15 -0500

To be fair, I think the concern is an illegitimate caller falsifying
location.

These issues are discussed in: draft-tschofenig-ecrit-trustworthy-location,
although I don't agree with its conclusions which follow a line of thinking
that because we can't stop all attacks we shouldn't try to stop some.
Location signing, in particular, can stop a whole class of attacks, although
there are still some cut/paste and other substitution attacks it won't stop.
I believe we should make attempts to falsify location hard enough that it
takes a determined attacker, and forces them to use mechanisms that are
infrequently used otherwise, so that we can instruct call takers when to
take extra precautions.  Today, for example, there are roughly no devices
that would reasonably be used to make emergency calls that have completely
self supported GPS.  The real devices use network assisted GPS, where we
have ways to check reasonability.

Brian

---

From: <[email-masked]>
Date: Tue, 24 Nov 2009 19:53:28 -0000

Marc, Francois,

Without getting involved in the technical debate, I thought you may be interested to see some figures about what we in UK term hoax calls, ie people who report a non-existent incident.  The information in " " below is 3.5 years old but still illustrates the problem.   
 
" Hoax calls are costing the UK Fire and Rescue Service a massive £230,000 a day - £84 million a year - and the problem is potentially putting lives in danger.  

Approximately 50,000  hoax fire calls are responded to every year, 135 per day, by the Fire and Rescue Service in England and Wales, whose role includes providing emergency response to fires, road traffic incidents and terrorism.  The Economic Cost of Fire report estimates that each hoax call costs £1,700.  This equates to a disturbing £84 million per year. A significant cost for the Fire and Rescue Service to absorb. 

London Fire Brigade has the highest hoax call rate in the UK, attending nearly twice as many call outs (9,686) as the second worse affected brigade, Greater Manchester (5,268) and the West Midlands (4,074).  

Sir Graham Meldrum, head of Her Majesty's Fire Service Inspectorate, said: "Young people in particular need to be aware what can happen if the fire brigade is called out under false pretences.  The danger to others involved in a real emergency and the financial drain that they impose on a service that is there to save people's lives. " "

UK emergency services use the location as one of the tests of how reliable is the report from a caller - if the "network provided" location (circuit switched wireline and GSM) differs appreciably from the incident location that a caller is reporting, then it influences the PSAP's response and questionning of the caller.

It is often children who make these hoax calls in the UK - it's difficult to understand why so I can't really answer Marc's question directly : we need a good psychiatrist/psychologist to answer that, but such calls are a very real problem and having reliable location information is an important weapon in tackling these as well as for speeding-up the handling of genuine calls.

Regards 

John

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Francois Menard
Sent: 24 November 2009 19:25
To: Marc Linsner
Cc: ecrit
Subject: Re: [Ecrit] To trust or not to trust. Is that the question?

my point exactly!

f.

On 2009-11-24, at 14:19, Marc Linsner wrote:

> Why would a person requesting emergency assistance knowingly provide a 
> false location?
> 
> -Marc-
> 
>> Recently I've been following the debate on this list regarding 
>> veracity of location which loosely translates into a larger debate 
>> about security.
>> 
>> If I'm understanding all of this correctly, one position is that 
>> PSAPs will be resistant to solutions where the identity and location 
>> of the caller can't be assured and that this necessarily requires a 
>> trust relationship between VSPs and PSAPs and/or ISPs and PSAPs.
>> 
>> prevents nomadic VOIP users from accessing PSAPs when out of their 
>> home areas. Furthermore, these trusts can be circumvented so they 
>> provide only a false sense of security.
>>

---

From: "Winterbottom, James" <[email-masked]>
Date: Wed, 25 Nov 2009 04:14:23 +0800

Marc,

I am not worried about the person that actually requires assistance doing this.
I am VERY worried that the proposed solution has no bar whatsoever to entry of someone that wants to send all responders to the wrong end of town for a thrill, or worse make it hard for them to reach a real emergency on the other end of town, or as was the case in, I think New York, a few years back snipe them on their way to the final destination.

This has nothing to do with a business model, it is about eliminating or reducing a fundamental problem that you seem to be unwilling to accept exists.

Cheers
James

________________________________________
From: [email-masked] [[email-masked]] On Behalf Of Marc Linsner [[email-masked]]
Sent: Tuesday, November 24, 2009 1:19 PM
To: John Lange; ecrit
Subject: Re: [Ecrit] To trust or not to trust. Is that the question?

-Marc-

---

From: John Lange <[email-masked]>
Date: Tue, 24 Nov 2009 14:51:13 -0600

My questions about security and trust are with regard to mounting a
large scale DOS attack on the 911 system.

In a world where the line between computers and phones continues to
blur, how long will it be before we see the first "bot network" on these
devices? (there is a story about an iPhone worm today).

In a scenario where tens of thousands of these end-points suddenly start
dialling 911, being able to validate their location isn't going to help
much in preventing the PSAP from being overwhelmed.

So the question I'm left with is, would adding trust to this scenario
prevent or mitigate the attack?

Lets imagine that in the future there is a particular brand of
"softphone" that becomes very popular and is running on a very large
proportion of devices subscribed to a wide variety of VSPs (imagine
something like skype but not tied to any specific back-end provider).

A worm compromises this software (or the OS that it runs on) which
allows the attacker to secretly control the softphone.

Would trust be of any use? Personally I have no answer to that question
which is why I pose it here on this list.

The only thing I can think of is that the trust relationship might allow
you to block emergency calls from these callers and mitigate the
problem. That assumes you have some way of identifying the compromised
hosts.

I recall that nearly this exact scenario took place in the early part of
this decade where compromised computers were dialing 911 using modems.
Fortunately, as far as I'm aware there was never enough machines
compromised at any one time to cause much of a problem. (as a side note,
there is actually a patent for preventing this:
http://www.freepatentsonline.com/y2006/0039540.html)

My assumption would be, just like DDOS and spam, there will be no way to
completely prevent it. But just like DDOS and spam, there will be enough
ways to mitigate it that the world won't come crashing down. And in the
meantime, the media will over-hype it and scare the crap out of
everyone...

-- 
John Lange
http://www.johnlange.ca

---

From: Brian Rosen <[email-masked]>
Date: Tue, 24 Nov 2009 16:01:29 -0500

No, there are a couple of attacks. One is a classic DoS attack.  It doesn't
matter what the location is in a DoS attack.  The point is to overwhelm the
system with signaling messages.  There are mitigation strategies for this
kind of attack, but they aren't germane to this discussion.

The other attack is a misdirection of responder attack.  This is not "large
scale".  It's a call that sends responders to somewhere that there is no
emergency.  The call appears to be legitimate, and there aren't a huge
number of them at once.  Here, a bad location is harmful.

Brian

---

From: "Bernard Aboba" <[email-masked]>
Date: Tue, 24 Nov 2009 13:49:36 -0800

Brian said: 

"The other attack is a misdirection of responder attack.  This is not "large
scale".  It's a call that sends responders to somewhere that there is no
emergency.  The call appears to be legitimate, and there aren't a huge
number of them at once.  Here, a bad location is harmful."

[BA] The FBI recently issued a warning over the rapid growth in "SWATTING"
attacks on the 911 system:
http://www.networkworld.com/community/node/24714

So while the numbers may not be huge, the consequences are serious enough to
have gotten attention. 

Overall, I wonder whether in a decade SWATTING will be as big an issue as
SPAM is today.

---

From: Brian Rosen <[email-masked]>
Date: Tue, 24 Nov 2009 17:37:39 -0500

Depends on how easy we make it I suppose.  Today, because you can call from
a "sim-less" phone which doesn't send location, or falsely enter self
reported location for a VoIP phone, it's very easy.

Brian

---

From: "Winterbottom, James" <[email-masked]>
Date: Wed, 25 Nov 2009 06:38:48 +0800

sim-less phones can be located. Self-reported system however are a completely different kettle of fish.

________________________________________
From: [email-masked] [[email-masked]] On Behalf Of Brian Rosen [[email-masked]]
Sent: Tuesday, November 24, 2009 4:37 PM
To: Bernard Aboba; 'John Lange'; 'ecrit'
Subject: Re: [Ecrit] To trust or not to trust. Is that the question?

Brian

---

From: Marc Linsner <[email-masked]>
Date: Wed, 25 Nov 2009 08:52:35 -0500

John,

This begs the question, "Is *trusted*, *reliable* location the right tool to
thwart hoax emergency calls?"  It seems that *trusted* location doesn't work
in what is described below.

When emergency calling moves to the Internet, *trusted* location can/will be
spoofed.

I'm trying to get everyone to understand that putting too much emphasis on
trusted location will get you in trouble.  Sure, it's a tool, it has some
value, but it also opens up more attack vectors.

I also have a problem with the notion that network derived location is the
most accurate.  This is not always the case.

Also, the point below is made that responders are dispatched to where the
caller states the emergency is located, not where the *trusted* location
dictates.  So, the human already overrides the *trusted* location.

Is the value derived from *trusted* worth the cost?  As Francios has
reported, the cost is exponentially more that the cost of the actual VoIP
service.  Is this due to it's perceived (marketed) value?

-Marc-

On 11/24/09 2:53 PM, "[email-masked]" <[email-masked]> wrote:

> Marc, Francois,
> 
> Without getting involved in the technical debate, I thought you may be
> interested to see some figures about what we in UK term hoax calls, ie people
> who report a non-existent incident.  The information in " " below is 3.5 years
> old but still illustrates the problem.
>  
> " Hoax calls are costing the UK Fire and Rescue Service a massive £230,000 a
> day - £84 million a year - and the problem is potentially putting lives in
> danger.  
> 
> Approximately 50,000  hoax fire calls are responded to every year, 135 per
> day, by the Fire and Rescue Service in England and Wales, whose role includes
> providing emergency response to fires, road traffic incidents and terrorism.
> The Economic Cost of Fire report estimates that each hoax call costs £1,700.
> This equates to a disturbing £84 million per year. A significant cost for the
> Fire and Rescue Service to absorb.
> 
> London Fire Brigade has the highest hoax call rate in the UK, attending nearly
> twice as many call outs (9,686) as the second worse affected brigade, Greater
> Manchester (5,268) and the West Midlands (4,074).
> 
> Sir Graham Meldrum, head of Her Majesty's Fire Service Inspectorate, said:
> "Young people in particular need to be aware what can happen if the fire
> brigade is called out under false pretences.  The danger to others involved in
> a real emergency and the financial drain that they impose on a service that is
> there to save people's lives. " "
> 
> 
> UK emergency services use the location as one of the tests of how reliable is
> the report from a caller - if the "network provided" location (circuit
> switched wireline and GSM) differs appreciably from the incident location that
> a caller is reporting, then it influences the PSAP's response and questionning
> of the caller.
> 
> It is often children who make these hoax calls in the UK - it's difficult to
> understand why so I can't really answer Marc's question directly : we need a
> good psychiatrist/psychologist to answer that, but such calls are a very real
> problem and having reliable location information is an important weapon in
> tackling these as well as for speeding-up the handling of genuine calls.
> 
> 
> Regards 
> 
> John
>

---

From: "Dawson, Martin" <[email-masked]>
Date: Wed, 25 Nov 2009 23:08:32 +0800

Marc,

You make two points:

1. There is the possibility of "spoofing" the mechanisms associated with trusted location.
2. "Network determined" location isn't necessarily the best.

With respect to the first, I would genuinely appreciate your elaboration of what this "attack vector" actually looks like. I'm not talking about the alleged bot net out there generating emergency service calls. That's a horse of a completely different color. Please don't invoke any scenarios that involve a "remotely controlled" point of access within the PSAP jurisdiction. That's possible today on the PSTN; it's not something a casual, foreign, caller can do. I'm talking about a user connected to the Internet in a completely different state/country/jurisdiction initiating an emergency call that manages to be routed to the local PSAP with a location reported as being local. If the mechanism used to validate location is dereference to a local Internet provider LIS, how does the attacker actually achieve this?

With respect to the claim that network determined location isn't necessarily the best, I disagree. Location is determined by virtue of taking measurements. Measurements can be made by the device and/or by the network. A purely device-based approach to determining location is not able to take advantage of whatever additional measurements the network takes (e.g. uplink timing). All decent network based location service architectures include the ability for measurements taken by the device to be provided to the server as well - including any actual location determination that the device might make. That is, the network can have access to everything the device has plus the measurements only it can make. In principle, then, a network determined location can always be at least as good as what the device can do on its own. This is why SUPL has ULP pos protocols, it is why GSM has RRLP, it is why UMTS has RRC, it is why LPP is being defined for LTE and it's why our own IP location se
 rvice protocols need the capabilities in the measurements draft.

By the same token, and tying the two points together, it's the public network operator that offers the best assurance for the emergency network operator that the information presented by the device really is valid, sane, and representative of the real location from which the call is originating. I'd challenge you to come up with a better or more recognisable third party to provide that assurance to the recipient of location information.

Your, by now chronic, counsel that nothing can be perfect therefore nothing should be done makes no more sense now than it did four years ago. No, it won't be perfect; there can't be guarantees - any more than you can guarantee that somebody isn't monitoring your cell phone call despite it having state of the art encryption, or any more than you can guarantee that the bank account site your logging onto isn't actually a spoofed site. However, I believe we can raise the level of assurance for location information to be as good as it is for these services. And that's a significant level of assurance compared to your advice of "don't bother".

Regards,
Martin
________________________________________
From: [email-masked] [[email-masked]] On Behalf Of Marc Linsner [[email-masked]]
Sent: Thursday, 26 November 2009 12:52 AM
To: [email-masked]; [email-masked]
Cc: [email-masked]
Subject: Re: [Ecrit] To trust or not to trust. Is that the question?

John,

-Marc-

---

From: Marc Linsner <[email-masked]>
Date: Wed, 25 Nov 2009 11:59:31 -0500

Martin,

You conveniently ignored a couple more points I made.

- If trusted location is utopia, why are "Hoax calls are costing the UK Fire
and Rescue Service a massive £230,000 a day - £84 million a year" ???

- The promotion of trusted location *could* include some marketing.

To answer your questions.

Trusted Location attack vector.  Even after excluding all the use cases, you
forgot the replay attack.

Network determined location.  Example: Would an emergency responder in
Chicago be able to provide a quicker response with location:

1) from the network - 41 52.735N, 87 38.168W
or
2) from the caller - NW corner of the 105th floor of the Willis Tower

Oh, another point you missed. I do/did admit that trusted location has
value, but it must be put into the context of *ALL* attacks on a PSAP and
it's value determined in accordance with it's cost.  That cost includes the
business case of the Internet access provider (IAP).  Forcing the IAP to
implement mechanisms/devices that don't add value to their business model
does not bode well for a future where accessing the Internet is suppose to
get easier, not harder.  The IAP providing location is cost delta 2,
providing trusted location is 2 to the Nth power.

"Trusted" location vs location adds zero value to a normal/legitimate caller
requesting emergency assistance.  Hence trusted location is a tool to
mitigate attacks, but given the big picture cost delta between location and
trusted location, is it worth the cost?

-Marc-

On 11/25/09 10:08 AM, "Dawson, Martin" <[email-masked]> wrote:

> With respect to the first, I would genuinely appreciate your elaboration of
> what this "attack vector" actually looks like. I'm not talking about the
> alleged bot net out there generating emergency service calls. That's a horse
> of a completely different color. Please don't invoke any scenarios that
> involve a "remotely controlled" point of access within the PSAP jurisdiction.
> That's possible today on the PSTN; it's not something a casual, foreign,
> caller can do. I'm talking about a user connected to the Internet in a
> completely different state/country/jurisdiction initiating an emergency call
> that manages to be routed to the local PSAP with a location reported as being
> local. If the mechanism used to validate location is dereference to a local
> Internet provider LIS, how does the attacker actually achieve this?
> 
> With respect to the claim that network determined location isn't necessarily
> the best, I disagree. Location is determined by virtue of taking measurements.
> Measurements can be made by the device and/or by the network. A purely
> device-based approach to determining location is not able to take advantage of
> whatever additional measurements the network takes (e.g. uplink timing). All
> decent network based location service architectures include the ability for
> measurements taken by the device to be provided to the server as well -
> including any actual location determination that the device might make. That
> is, the network can have access to everything the device has plus the
> measurements only it can make. In principle, then, a network determined
> location can always be at least as good as what the device can do on its own.
> This is why SUPL has ULP pos protocols, it is why GSM has RRLP, it is why UMTS
> has RRC, it is why LPP is being defined for LTE and it's why our own IP
> location service protocols need the capabilities in the measurements draft.
> 
> By the same token, and tying the two points together, it's the public network
> operator that offers the best assurance for the emergency network operator
> that the information presented by the device really is valid, sane, and
> representative of the real location from which the call is originating. I'd
> challenge you to come up with a better or more recognisable third party to
> provide that assurance to the recipient of location information.
> 
> Your, by now chronic, counsel that nothing can be perfect therefore nothing
> should be done makes no more sense now than it did four years ago. No, it
> won't be perfect; there can't be guarantees - any more than you can guarantee
> that somebody isn't monitoring your cell phone call despite it having state of
> the art encryption, or any more than you can guarantee that the bank account
> site your logging onto isn't actually a spoofed site. However, I believe we
> can raise the level of assurance for location information to be as good as it
> is for these services. And that's a significant level of assurance compared to
> your advice of "don't bother".
> 
> Regards,
> Martin

---

From: Bernard Aboba <[email-masked]>
Date: Wed, 25 Nov 2009 10:48:11 -0800

> and Rescue Service a massive £230,000 a day - £84 million a year" ???

[BA] This demonstrates that "trusted location" by itself isn't enough.  As noted in the article,
many false fire alarms are triggered by children who lack the sophistication
to forge location.  In those cases, the location and perhaps the identity of the device
are trustworthy -- but the assertion of a fire emergency in progress is false. 

The situation with "swatting" incidents appears to be somewhat different.  Here, the
perpetrators are often technically sophisticated adults and the location, the identity
assertion and the emergency assertion all can be false. 

> The IAP providing location is cost delta 2,

If we accept the NENA i2.5 definition of "trusted location" I agree.  NENA i2.5
proposes a TLS-based certificate-based mutual authentication model for
interfaces v2-v9, with the certificate hierarchy rooted in the VESA. 

While securing elements internal to the emergency services network with
a certificate hierarchy might be achievable, attempting to establish
trust with every VSP and LIS on the planet through issuance of VESA-rooted
certificates doesn't seem like a reasonable strategy to me.   For one thing,
a VSP could conceivably need to communicate with emergency service 
networks anywhere on the planet.  Does this mean that they will need to
acquire and manage certificates from all the potential emergency service
networks they will need to deal with?

> trusted location, is it worth the cost?

It seems to me that the fundamental issue here is quite similar to the problem
we have had with SPAM.  Today email is a commodity that is increasingly offered
free or at very low prices.  While the IETF has developed a certificate-based
approach to the problem (e.g. DKIM), so far I'm not aware that it has been
widely deployed.   The bottom line is that most systems today are still using
techniques based on various heuristics.  As Mark Handley has noted 
(see http://www.cs.ucl.ac.uk/staff/m.handley/papers/only-just-works.pdf), 
these technologies "only just work", but they remain very popular. 

Given this experience, my question is what level of security will "only just work"
to address this problem.  One approach would be to incorporate "911 fraud" detection 
capabilities into the SBCs deployed at the edges of the emergency services network. 
These SBCs could compare the location assertions in the PIDF-LO to the SIP headers
in an effort to ferret out fraudulent location assertions.  

If that is the way things ultimately end up going, then the most important question
to ask is whether we're providing the fraud detection systems with enough input data
to do their job.

---

From: Marc Linsner <[email-masked]>
Date: Wed, 25 Nov 2009 14:45:06 -0500

Bernard,

I obviously agree, hence my assertion that 'trusted' location:

1) As proposed, is very expensive.
2) Gets trumped by the 'human' location, so the attack proceeds.
3) Since non-trusted location will still be accepted, too much emphasis on
'trusted' location could lead to a disastrous result in failing to respond
to a legitimate emergency.
4) Exposes the attack vector to the community that builds attacks.

As you state, the best place to defend against attacks is at the border of
the ES network.  As the cited experiences dictate, the best methodology is
to control how you respond to packets received, not in trying to control the
packets someone sends towards you, even a Government can't pull that one
off.

-Marc-

---

From: "Dawson, Martin" <[email-masked]>
Date: Thu, 26 Nov 2009 06:22:56 +0800

> From: Marc Linsner [[email-masked]]
> Sent: Thursday, 26 November 2009 3:59 AM
> To: Dawson, Martin; [email-masked]; [email-masked]
> Cc: [email-masked]

That's a non-point. It's also somewhat perverse to take the evidence that this can be an issue and argue from that point that it's therefore worth doing even less. Where did anyone say utopia? This is more evidence that you aren't capable of seeing things as a matter of degree; you will forever make perfect the enemy of good.
> - The promotion of trusted location *could* include some marketing.

Don't understand that.

> forgot the replay attack.

How does the replay work given that a location URI is dynamically generated and transient? So you acknowledge the only actual use cases are ones that involve the attacker having some sort of real physical presence either directly or via remote controlled device in the network?

> 2) from the caller - NW corner of the 105th floor of the Willis Tower

That would be up to the call taker and PSAP policy to determine would it not? Not either of us. However, perhaps you've missed the point that this is about establishing policy on how calls are answered. Once the caller is actually talking to someone then the important PSAP resources are already being consumed. This is about establishing policy around how calls are managed on arrival to the emergency network - and particularly in congestion situations.

> providing trusted location is 2 to the Nth power.

Nice to see you can be concerned about the need for access providers to actually have a viable business; your point is somewhat counter to your position in the location hiding discussion and your recent ad hominem post. Where does this pseudo-math you cite above originate? Have you got a reference to this cost modelling? It looks wrong to me.

> trusted location, is it worth the cost?

IMO - absolutely and we actually have a responsibility to ensure the mechanism is defined and available for those jurisdictions that want to take advantage of it.

---

From: <[email-masked]>
Date: Wed, 25 Nov 2009 22:25:35 -0000

Marc,

I've inserted a few comments below that may help clarify the limits to which we can use the figures I provided on hoax calls in the UK.  

My main point was that hoax calls do occur (original question being why would a person provide a false location) and cost a lot to manage, so well worth considering all possible ways to minimise their impact.

Regards

John

_____________________________________________ 
From: 	Marc Linsner [mailto:[email-masked]] 
Sent:	25 November 2009 13:53
To:	Medland,JD,John,MLC12 R; [email-masked]
Cc:	[email-masked]
Subject:	Re: [Ecrit] To trust or not to trust. Is that the question?

John,

This begs the question, "Is *trusted*, *reliable* location the right tool to thwart hoax emergency calls?"  It seems that *trusted* location doesn't work in what is described below.
[John Medland]  No, we can't draw that conclusion from what is said below as we just don't have the information to judge and I should have made that clear when I posted the comment on the list - my apologies.   For various reasons not all Fire Services in the UK yet use the automatically provided location - even though the benefits are clear from extensive use by Police, Ambulance, Coastguard and those Fire Services that do use it..........  At the time these numbers were gathered only a third of Fire Services were using the automated location facility (more are now doing so, driven partly by the desire to tackle hoax calls).

The figures below simply show that there are many people (often children in the UK)  who do make hoax calls and that these are expensive to manage, and therefore it is well worth considering all possible ways to help minimise their impact. 

Increasing use of automatically provided location is helping to drive these figures down - it allows the PSAP call-takers to challenge suspected hoax callers about location information they are providing verbally, and change their questionning and response accordingly, for example they may only send one vehicle or a different type of vehicle if some doubt remains.  

When emergency calling moves to the Internet, *trusted* location can/will be spoofed.

I'm trying to get everyone to understand that putting too much emphasis on trusted location will get you in trouble.  Sure, it's a tool, it has some value, but it also opens up more attack vectors.
[John Medland]  I'd agree that automatically provided, trusted location is only one of a set of tools needed to tackle hoax calls, but it is a useful one, and if we can continue to try to find ways to provide it at a reasonable cost that would be welcomed by PSAPs.    

I also have a problem with the notion that network derived location is the most accurate.  This is not always the case.
[John Medland]  In the UK at present we only have automatically provided locations from the networks - cell coverage for GSM and installation address for fixed/wireline.

Also, the point below is made that responders are dispatched to where the caller states the emergency is located, not where the *trusted* location dictates.  So, the human already overrides the *trusted* location.
[John Medland]  As mentioned above most Fire Services in the UK did not have the automated location facility at the time these figures were provided. So, in most of these cases all they would have would be a verbally provided location.  If a call-taker has both a verbal and an automatically provided location and the two locations do not align, it changes the questionning and nature of response.   My understanding is that if there was doubt, the PSAP may still send a response to the verbally reported location but would degrade the response as mentioned above.  In some cases - verbal location remote from trusted automatic location - they would not send a response at all.

Although the thread is mainly about hoax calls, worth mentioning that the Police send many responses to calls where caller has not been able to provide a clear location entirely on the basis of a trusted, automatically provided location. 
 
Is the value derived from *trusted* worth the cost?  As Francios has reported, the cost is exponentially more that the cost of the actual VoIP service.  Is this due to it's perceived (marketed) value?
[John Medland]  PSAPs do find it helpful to be able to trust location for both genuine calls and the reduction of the impact of hoax calls - cost has to be reasonable and proportionate though as it is at present.  I need to go and look at why the cost is so much in Canadian model.  

-Marc-

On 11/24/09 2:53 PM, "[email-masked]" <[email-masked]> wrote:

> interested to see some figures about what we in UK term hoax calls, ie 
> people who report a non-existent incident.  The information in " " 
> below is 3.5 years old but still illustrates the problem.
>  
> " Hoax calls are costing the UK Fire and Rescue Service a massive 
> £230,000 a day - £84 million a year - and the problem is potentially 
> putting lives in danger.
> 
> Approximately 50,000  hoax fire calls are responded to every year, 135 
> per day, by the Fire and Rescue Service in England and Wales, whose 
> role includes providing emergency response to fires, road traffic incidents and terrorism.
> This equates to a disturbing £84 million per year. A significant cost 
> for the Fire and Rescue Service to absorb.
> 
> London Fire Brigade has the highest hoax call rate in the UK, 
> attending nearly twice as many call outs (9,686) as the second worse 
> affected brigade, Greater Manchester (5,268) and the West Midlands (4,074).
> 
> "Young people in particular need to be aware what can happen if the 
> fire brigade is called out under false pretences.  The danger to 
> others involved in a real emergency and the financial drain that they 
> impose on a service that is there to save people's lives. " "
> 
> 
> UK emergency services use the location as one of the tests of how 
> reliable is the report from a caller - if the "network provided" 
> location (circuit switched wireline and GSM) differs appreciably from 
> the incident location that a caller is reporting, then it influences 
> the PSAP's response and questionning of the caller.
> 
> It is often children who make these hoax calls in the UK - it's 
> difficult to understand why so I can't really answer Marc's question 
> directly : we need a good psychiatrist/psychologist to answer that, 
> but such calls are a very real problem and having reliable location 
> information is an important weapon in tackling these as well as for speeding-up the handling of genuine calls.
> 
> 
> Regards
> 
> John
> 
>> Why would a person requesting emergency assistance knowingly provide 
>> a false location?
>> 
>> -Marc-
>>

---

From: John Lange <[email-masked]>
Date: Wed, 25 Nov 2009 17:02:35 -0600

With regard to casual hoax calls or calls where the person can not
speak (or doesn't know their location), it would seem unquestionable
that device determined location is a valuable tool. The only question
would be cost effectiveness, an issue that remains unresolved largely
because at this time the number of users that would benefit is a small
percentage. This may change in the future.

That being said, I started this thread asking about a specific
scenario which was a DDOS attach on PSAPs using remotely controlled
devices. These calls will come from devices that are both location and
user "trusted" (to the standard I've seen mentioned in this thread).

Does anyone have any theories on how this scenario can be mitigated?

Perhaps it would be important to mandate that user-agent information
be passed from end-to-end? At least then you could filter a given type
of attacker.

-- 
John Lange
www.johnlange.ca

---

From: "Winterbottom, James" <[email-masked]>
Date: Thu, 26 Nov 2009 07:08:26 +0800

Hi John,

I hoped you meant "automatic location" and not specifically device determined location. In many cases a network provided or determined location is better than a device determined one.

That aside, in the scenario you describe below the attacker must have some form of presence in the network, albeit via a zombie in the case you describe. At a minimum having trusted location information means that you can locate the zombie PC, this is something that you can't do today.

Cheers
James

James Winterbottom
Global Product Manager
Andrew GeoLENs
IP Location Product Portfolio
Email: [email-masked]
Mobile: +61-448-266004
 
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> John Lange
> Sent: Thursday, 26 November 2009 10:03 AM
> To: [email-masked]

---

From: "Dawson, Martin" <[email-masked]>
Date: Thu, 26 Nov 2009 07:26:55 +0800

More information is better. Location is one parameter that can be used to as part of a traffic signature. Information provided by the UA, however, needs to have some basis for trustability if it's to be used as part of a signature analysis.

I think a large number of calls coming from remotely controlled devices needs to be addressed in the same way that a DDOS attack is normally mitigated. From what I see, the capacity of the service under attack is typically impacted during the interval of a DDOS attack and I'd expect that the same would occur to the emergency service. It would diminish the ability of the PSAP to handle real calls. Fewer real calls could be serviced - and the real extent of the impact would depend on exactly what this auto-bot did once the call was answered.

It should certainly be considered a serious crime to mount a DDOS on the emergency services.

The operators of botnets see their "asset" of a network of compromised hosts as a genuine business. They sell this capacity to spammers, scammers, and hoaxers... typically. They would not want their "asset" compromised.

Consider the course of events should the botnet be used to mount a DDOS on PSAPs while using genuine trusted location to bypass the congestion control mechanism. The calls would have to arrive with a real carrier provided location URI for the location dereference. There's no point in the calls sharing one or a subset of URIs because that creates a traffic signature that can be used for automatic policy. So - we have a bunch of calls arriving at PSAPs with genuine location URIs that reveal genuine locations of the source of the calls.

This fact alone runs strongly counter to the business interests of the botnet owners. Bring it on; it would provide a boon in forensic detail.

Indeed an appealing grey hat operation when there are established carrier LIS capabilities in the Internet access networks would be for the authorities to solicit a package from the botnet operator and plant a binary whose sole purpose is to obtain location from the carrier LIS and send it to the authorities. How could they be confident their drone wasn't compromised by the botnet operator? By using trusted location mechanisms to validate the location information returned.

Cheers,
Martin
________________________________________
From: [email-masked] [[email-masked]] On Behalf Of John Lange [[email-masked]]
Sent: Thursday, 26 November 2009 10:02 AM
To: [email-masked]
Subject: Re: [Ecrit] To trust or not to trust. Is that the question?

---

From: Bernard Aboba <[email-masked]>
Date: Wed, 25 Nov 2009 15:35:48 -0800

> Does anyone have any theories on how this scenario can be mitigated?

Assuming that the calls otherwise appear to be perfectly legitimate (e.g. SIP 
headers match the enclosed PIDF-LO & RFC 4474 signatures if present, etc.)
one might need to look at the media.  It would take a pretty cleaver bot to 
be able to deliver credible media to a PSAP dispatcher, so that characteristics
of the media might be useful in differentiating bot-originated emergency calls 
from authentic calls. 

Unfortunately, that kind of heuristic isn't helpful until *after* the call has been
answered.  What you really need in that kind of situation is to be able to 
prioritize incoming calls so that the SBCs protecting the emergency services
network don't have to burn cycles on signaling with bot-controlled UAs.