Subject: [Int-area] Logging Recommendations for Internet-Facing Servers

From: S Moonesamy <[email-masked]>
Date: Mon, 16 Jun 2014 02:47:57 -0700

Hello,

In the wake of the revelations about surveillance there has been some 
concerns about RFC 6302.  I would be grateful if the authors of RFC 
6302 could review the comments at 
http://www.ietf.org/mail-archive/web/ietf-privacy/current/msg00454.html 
and provide some feedback.

Regards,
S. Moonesamy

---

From: S Moonesamy <[email-masked]>
Date: Mon, 16 Jun 2014 08:21:44 -0700

Hi Scott,
At 06:49 16-06-2014, SHEPPARD, SCOTT wrote:
>Can you be more specific in your concern?
>" there has been some  concerns about RFC 6302"
>
>I am willing to have a go but more focused guidance is needed here.

There was a thread at 
http://www.ietf.org/mail-archive/web/perpass/current/msg00212.html

My interpretation of the BCP is that it recommends saving information 
so that users can be tracked without taking into consideration the 
privacy implications.  The BCP states that "data-retention policies 
are out of scope for [the] document".  It can be argued that the IETF 
is recommending a best practice which is surveillance-friendly.

My suggestion would be to give some thought to the privacy 
implications, get some (public) discussion about the matter and 
decide about the next steps.

Regards,
S. Moonesamy

---

From: <[email-masked]>
Date: Tue, 17 Jun 2014 12:57:48 +0000

Hi SM,

RFC6302 should be positioned in its context: i.e., how to meet regulatory requirements in some countries when address sharing is in use. A discussion on the background (with a concise discussion on solution flavors and some hints on time duration to store log data) is available at: http://tools.ietf.org/html/rfc6269#section-12 and http://tools.ietf.org/html/rfc6269#section-13.1.

The reco in RFC6302 aims to ease handling abuse claims and avoid revealing the identity of a large number of subscribers. FYI, the penal procedure in France has been updated in August 2013 to take into account address sharing in particular, see for instance http://www.legifrance.gouv.fr/affichCodeArticle.do?idArticle=LEGIARTI000028053220&cidTexte=LEGITEXT000006071154 where "additional information" should be provided in addition to the IP address for abuse claims).

Privacy-related considerations and other side effects of storing IP addresses (including IP tracking) should be discussed IMHO independently of RFC6302. For example, the concrete case led by the CNIL in France: http://www.cnil.fr/linstitution/actualite/article/article/ip-tracking-conclusions-de-lenquete-conjointe-menee-par-la-cnil-et-la-dgccrf/?tx_ttnews[backPid]=91&cHash=6c52ebf7fc988c0c7fe49410c4e69342. 

Cheers,
Med

>-----Message d'origine-----
>De : Int-area [mailto:[email-masked]] De la part de S Moonesamy
>Envoyé : lundi 16 juin 2014 11:48
>À : Alain Durand; Igor Gashinsky; Donn Lee; Scott Sheppard
>Cc : Linus Nordberg; [email-masked]
>Objet : [Int-area] Logging Recommendations for Internet-Facing Servers
>
>Hello,
>
>_______________________________________________
>Int-area mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/int-area

---

From: "SHEPPARD, SCOTT" <[email-masked]>
Date: Mon, 16 Jun 2014 13:49:20 +0000

Hello

Peace

Scott Sheppard
LMTS AT&T ATS
IPNSG 
404 499 5539 desk
732 861 3383 cell
[email-masked] email

Two messages
Authentic power is service - Pope Francis 
Sillyness is Essential - The Three Stooges
Both are important 

This e-mail and any files transmitted with it are the property
Of the AT&T companies, are confidential, and are intended solely
For the use of the individual or entity to whom this e-mail is 
Addressed. If you are not the one of the named recipients or 
Otherwise have reason to believe that you have received this
Message in error, please notify the sender at (732) 420-0965 and 
Delete this message immediately from your computer. Any other
Use, retention, dissemination, forwarding, printing, or copying
Of this e-mail is strictly prohibited.

-----Original Message-----
From: S Moonesamy [mailto:[email-masked]] 
Sent: Monday, June 16, 2014 5:48 AM
To: Alain Durand; Igor Gashinsky; Donn Lee; Scott Sheppard
Cc: [email-masked]; Linus Nordberg
Subject: Logging Recommendations for Internet-Facing Servers

Hello,

Regards,
S. Moonesamy

---

From: "SHEPPARD, SCOTT" <[email-masked]>
Date: Tue, 17 Jun 2014 14:36:50 +0000

Folks 

To close this for now. 

I see no compelling reason to change the BCP RFC 6302. 

Privacy is important. But equally so is the need to protect our customers, ourselves and the population against cyber criminals and they are legion. There is a compelling need for Law Enforcement Agencies and Governments to know some information about traffic as it relates to criminal and military acts (state sponsored cyber espionage etc.,). It is up to the civil authorities to define what is "acceptable reach" for the above agencies actions. It is up to us as citizens to then hold the civil authorities accountable at least in the US. 

This is far beyond an IETF discussion. 

Peace

Scott Sheppard
LMTS AT&T ATS
IPNSG 
404 499 5539 desk
732 861 3383 cell
[email-masked] email

Two messages

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] 
Sent: Tuesday, June 17, 2014 8:58 AM
To: S Moonesamy; Alain Durand; Igor Gashinsky; Donn Lee; Scott Sheppard
Cc: Linus Nordberg; [email-masked]
Subject: RE: [Int-area] Logging Recommendations for Internet-Facing Servers

Hi SM,

Cheers,
Med

---

From: S Moonesamy <[email-masked]>
Date: Tue, 17 Jun 2014 11:58:40 -0700

Hi Suresh, Juan-Carlos,
At 07:36 17-06-2014, SHEPPARD, SCOTT wrote:
>Privacy is important. But equally so is the need to protect our 
>customers, ourselves and the population against cyber criminals and 
>they are legion. There is a compelling need for Law Enforcement 
>Agencies and Governments to know some information about traffic as 
>it relates to criminal and military acts (state sponsored cyber 
>espionage etc.,). It is up to the civil authorities to define what 
>is "acceptable reach" for the above agencies actions. It is up to us 
>as citizens to then hold the civil authorities accountable at least in the US.
>

The following in an excerpt of a message posted by the IAB Chair to 
[email-masked] in 2013:

  "1.  The IETF is willing to respond to the pervasive surveillance attack?

       Overwhelming YES.  Silence for NO.

   2. Pervasive surveillance is an attack, and the IETF needs to 
adjust our threat model
      to consider it when developing standards track specifications.

      Very strong YES.  Silence for NO."

Some persons raised concerns about those hums.  I would not ignore 
the concerns of those persons or argue that they have to agree to the 
excerpt quoted above.  There was a four-weeks Last Call for RFC 
7258.  Several persons raised concerns about the document.  I would 
not argue that they have to agree to RFC 7258.

I would like to have your opinion about which points (see quoted 
message) are appropriate or inappropriate for INTAREA discussion.

Regards,
S. Moonesamy

---

From: Joe Touch <[email-masked]>
Date: Tue, 17 Jun 2014 13:27:09 -0700

On 6/17/2014 11:58 AM, S Moonesamy wrote:
...
> Some persons raised concerns about those hums.

Hums aren't votes. It might represent those in attendance - but not
everyone attends meetings in general or plenaries in specific.

The key to understanding a BCP is its 2119-language. Because there
wasn't any in RFC 7258 (2119 isn't even cited), there was nothing to 
really object to.

Joe

---

From: "SHEPPARD, SCOTT" <[email-masked]>
Date: Tue, 17 Jun 2014 20:33:47 +0000

S. Moonesamy

I am not going to debate with you. "Pervasive surveillance is an attack". To me this is a debate : Resolved: Pervasive surveillance is an attack.

I will read and, if needed, comment where appropriate with interest RFC 7258 with a technical not political view.   

I thank you for bringing this to my attention. 

As I am work, I will not respond any further from my work address. I will create an email alias for this discussion and distribute it. I do welcome the discussion. 

Peace

Scott Sheppard
LMTS AT&T ATS
IPNSG 
404 499 5539 desk
732 861 3383 cell
[email-masked] email

Two messages

-----Original Message-----
From: S Moonesamy [mailto:[email-masked]] 
Sent: Tuesday, June 17, 2014 2:59 PM
To: Suresh Krishnan; Juan-Carlos Zúñiga
Cc: [email-masked]; Scott Sheppard
Subject: RE: [Int-area] Logging Recommendations for Internet-Facing Servers

Hi Suresh, Juan-Carlos,

Regards,
S. Moonesamy

---

From: Suresh Krishnan <[email-masked]>
Date: Tue, 17 Jun 2014 16:47:42 -0400

Hi Scott,
(with Chair hat on)

> I see no compelling reason to change the BCP RFC 6302.

Thanks for providing your opinion. I think opinions from operators are 
extremely useful and helpful.

> This is far beyond an IETF discussion.

I think there is a delicate balance between protecting the users' 
privacy and implementing the operators' requirements for traceability. 
If by "far beyond an IETF discussion" you mean that recommendations from 
the IETF are only one consideration among many for real life 
deployments, I fully agree with you. But what the IETF publishes as a 
BCP is within the purview of the IETF, and it is entirely reasonable for 
people to initiate discussion on whether the recommendations in RFC6302 
are current in light of RFC7258.

Thanks
Suresh

---

From: Suresh Krishnan <[email-masked]>
Date: Tue, 17 Jun 2014 17:17:32 -0400

Hi SM,

On 06/17/2014 02:58 PM, S Moonesamy wrote:
>> Agencies and Governments to know some information about traffic as it
>> relates to criminal and military acts (state sponsored cyber espionage
>> etc.,). It is up to the civil authorities to define what is
>> "acceptable reach" for the above agencies actions. It is up to us as
>> citizens to then hold the civil authorities accountable at least in
>> the US.
>>
>    2. Pervasive surveillance is an attack, and the IETF needs to adjust
> our threat model
> Some persons raised concerns about those hums.  I would not ignore the
> concerns of those persons or argue that they have to agree to the
> excerpt quoted above.  There was a four-weeks Last Call for RFC 7258.
> Several persons raised concerns about the document.  I would not argue
> that they have to agree to RFC 7258.
>

As intarea was the wg that produced RFC6302, any discussions regarding 
issues you want to bring up regarding that document are perfectly 
appropriate on this mailing list. Please go ahead and continue the 
discussion.

Thanks
Suresh

---

From: Peter Koch <[email-masked]>
Date: Tue, 17 Jun 2014 23:24:24 +0200

SM,

> and provide some feedback.

not one of the authors, but still: the document basically says that _if_ you log,
you ought to log port numbers (and timestamps) in addition to IP addresses.
The question whether to log (the _if_ above) is, in my reading, and hindsight,
addressed (by way of abstention) by the paragraph starting:

   Discussions about data-retention policies are out of scope for this
   document. [...]

Of course, RFC 6302 is easily read as the IETF recommending "full" logging.
I doubt that it is in the best interest of the IETF to be misinterpreted
that lightly, but that was already the fact in June 2011.  Changing the
message to "IP address and timestamp might not be sufficient to identify
a system or user" and not calling it a "BCP" has an odd chance of mitigating
the misunderstandings. An IETF position on "do or do not log" is likely
irrelevant given (competing, conflicting) regulatory requirements and
legislation/court rulings on data protection.

-Peter