Subject: Should IETF do more to fight computer crime?

From: Jacob Palme <[email-masked]>
Date: Sun, 21 May 2000 03:18:11 +0200

Should IETF do anything to fight the increasing incidences
of net criminality? Can we do anything? Can the protocols,
which IETF manages, be modified so as to make it easier
to fight virus distribution, mail bombing, ping attacks
and the other ways in which people are harassing the
Internet?

Or would such changes to the Internet protocols mean
more invasion of privacy, in a way which is even less
acceptable than letting the criminals continue? It seems
that there is a strong group in IETF which likes the
freedom of the net and believes that changes to stop
criminal usage would also remove this freedom? Is this
true, or can we fight net criminaltiy without risking
the freedom of the net?

Crime prevention outside the net      Crime prevention in the net
--------------------------------      ---------------------------

Surveillance, video cameras,          Is it possible to allow surveillance on
wiretapping, bugging                  the net in such ways, that it will not be
                                      misused? IETF did apparently not think
                                      so, when this was discussed at the IETF
                                      meeting in December 1999, where a very
                                      large majority voted against any kind of
                                      help from IETF in this area.

Making crime difficult by locks       We have rather little locks, and what we
walls and crime-safe houses.          have is not used very much. Why?

video cameras, black boxes and other  Is this also not acceptable? Could we log
tools to investigate "after the fact" what happens on the net in ways which
what happended.                       makes it possible to track the criminals,
                                      without risking misuse which threatens
                                      the freedom of the net?

Laws, detectives, prosecution,        Are also applied to net criminals, if
penalties                             they are caught.

Controlling access to dangerous       This method is probably not useful
tools and weapons, like explosives,   against computer terrorism. Computers,
etc.                                  like hammers, are the same whether
                                      used for good or bad acts.

Police on the streets.                Do we have police on the nets? Do we
                                      accept them? Help them?

International police cooperation.     This is essential, computer criminals
                                      often run their crimes over national
                                      borders to make them more difficult to
                                      find and prosecute.

Harmonized laws across countries.     Can te laws, as they apply to computers,
                                      be internationally harmonized in ways
                                      which makes it less easy for criminals to
                                      find safe harbours in countries which do
                                      not have the necessary laws?

-- 
Jacob Palme <[email-masked]> (Stockholm University and KTH)
for more info see URL: http://www.dsv.su.se/jpalme/

---

From: Harald Tveit Alvestrand <[email-masked]>
Date: Sun, 21 May 2000 22:52:38 +0200

At 03:18 21.05.2000 +0200, Jacob Palme wrote:
>of net criminality?

Yes - make sure we have tools to establish trust.
Make it less necessary to "trust everyone to be nice".

>  Can we do anything? Can the protocols,

Highly contentious also outside the Net.

>walls and crime-safe houses.          have is not used very much. Why?

Crypto.

>                                       without risking misuse which threatens

Signatures.

More work needed, especially thinking about deploying the more esoteric 
variants
of signatures, such as "you can only find out who I am if I try to cheat you",
or "I have left proof of my identity in this box, which you cannot open without
accusing me in public of trying to cheat you".

One reason the digital paper trail is so awfully wide is simply because it's
so simple to "just" record the plaintext identities.

------------- below this line, I think it's not IETF business ----------------

>penalties                             they are caught.

Not the IETF's business.

>                                       used for good or bad acts.

Agree. Not something we want to do anything about.

>Police on the streets.                Do we have police on the nets? Do we

We have them. Not an IETF problem.

>                                       borders to make them more difficult to

They're making cooperation, whether we want it or not.
Not an IETF problem.

>                                       not have the necessary laws?

They are being harmonized, whether for good or bad remains to be seen.
Not an IETF problem.

--
Harald Tveit Alvestrand, EDB Maxware, Norway
[email-masked]

---

From: R A Lichtensteiger <[email-masked]>
Date: Sun, 21 May 2000 17:43:08 -0400 (EDT)

Jacob Palme said:

<> Should IETF do anything to fight the increasing incidences
<> of net criminality? Can we do anything? Can the protocols,
<> which IETF manages, be modified so as to make it easier
<> to fight virus distribution, mail bombing, ping attacks
<> and the other ways in which people are harassing the
<> Internet?

Harald pointed to crypto and signatures.  I'd add that there
really are a fair number of tools out there already to do
Intrusion Detection and/or post mortem analysis.  There is
also a great deal of knowledge about how to "lock down the
house."

However, just as you can't make the horse drink, you can't
make all of the end networks install or use the existing tools
properly. I'm not sure if this is an argument for pushing the
work off onto IETF wg, or whether it's an argument for "throwing
up ones hands" ...

I think a  lot of the work can and OUGHT to be done by the
various vendors --  for examples, routers should, by default,
reject broadcast pings (you could always turn it on if needed)
and mail clients and web browsers should automagically refuse
to run executable content (other than inside a "container").

Reto L.
-- 
R A Lichtensteiger		[email-masked]
				781 276 4500

        Could not open /usr/bin/fortune. Lid on cookie jar sealed

---

From: Gordon Lennox <[email-masked]> (Tel +32-2-29.6-3546)
Date: Mon, 22 May 2000 10:43:21 +0200

One current international position on "Crime in Cyberspace" can be found in the draft Council of Europe Convention. This was released for public comment towards the end of April. See:

 conventions.coe.int/treaty/en/projets/cybercrime.htm

Information on the Council of Europe can be found at:

 www.coe.fr/eng/present/about.htm

Scott Bradner gave a presentation at the G8 hi-tech crime event in Paris last week. (This was the invitation Fred Baker mentioned during the plenary in Adelaide.) It would be very interesting to get Scott's views, an IETF view, on how it went in Paris and on what the G8 is doing...

Gordon

------------------------
European Commission
Information Society DG
Office Bu33 5-80
rue de la Loi 200
B-1049 Bruxelles

Tel: +32-2-29.6-3546

[email-masked]
========================

---

From: Jacob Palme <[email-masked]>
Date: Mon, 22 May 2000 20:14:55 +0200

> They're making cooperation, whether we want it or not.

Maybe not an IETF problem, but the way we act when the
police come should be discussed either in IETF or in
ISOC.

A well-known example from some years ago. A very popular
so-called anonymity server was running in Helsinki.
(I would rather designate it as a pseuodynymity server.)
Its data base know who was behind each pseudonym,
and used this to allow the forwarding of e-mail to
pseudonyms. The anonymity server sent such messages
along to the real e-mail address, but without divulging
what that address was.

Now came the scientology church. They are very against
all kinds of discussions and divulging of information
about them to outsiders. Someone had used the anonymity
server in Helsinki to distribute, on a usenet group,
information which the scientologists did not like.

They went to the police (in the USA) saying that this
person had infringed on their copyright by publishing
their secret documents on Usenet. The police in the
USA contacted the police in Finland. The police in
Finland went to the anonymity server and gave him
to choices: Either we take the whole server, or you
tell us who is behind this pseudonym. He told them
under duress who it was. But shortly after that, he
shut down the server.

Should the Finnish police really have done this?

Should he have accepted their requests, or should
he have called a lawyer and tried to move the issue
of whehter to divulge this information into the
courts in Finland?
-- 
Jacob Palme <[email-masked]> (Stockholm University and KTH)
for more info see URL: http://www.dsv.su.se/jpalme/

---

From: "Theodore Y. Ts'o" <[email-masked]>
Date: Mon, 22 May 2000 17:29:33 -0400

Date: Mon, 22 May 2000 20:14:55 +0200
   From: Jacob Palme <[email-masked]>

This is a social issue, and not a technical issue.  You might want to
consider asking this question in an EFF forum, instead of the IETF
mailing list.

						- Ted