Subject: Re: Proposal to fix NSEC

From: Alex Bligh <[email-masked]>
Date: Fri, 21 May 2004 20:42:46 +0100

--On 21 May 2004 20:38 +0200 Jaap Akkerhuis <[email-masked]> wrote:

> For a zone file you can claim
> this probably as well. That gives you a handle to whack people
> making copies.

The (expensive, uncertain) legal "handle to whack people" doing something
unlawful is no substitute for stopping them doing it in the first place.
That's the same reason you have a lock on your front door despite laws
against theft, and (bring this back to a protocol level) the same reason we
promote strong encryption in protocols such as DNSSEC despite computer
crime and fraud laws. If we said in a more general case "we'll leave this
out the protocol and let them sort out the consequences in court" we might
as well not do DNSSEC, and just pay investigators and lawyers to go verify
whether DNS records are accurate and sue if not.

Whilst the legal point is interesting, my main argument is from a
functionality point of view.

Alex

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Mark Andrews <[email-masked]>
Date: Sat, 22 May 2004 09:40:23 +1000

> I see a some of arguments being made about EU concerns over privacy.
> The subject whether DNSSEC would be run into EU privacy concerns
> pops up on a regular base in various places.
> 
> Therefore, SIDN, the Dutch registry, asked for an opinion of the
> faculty of law of the University of Brabant. These people, all
> lawyers, are specialized in privacy and the influence of crypto
> technology on the law (and vice versa). They don't have no specialist
> knowledge of the DNS, but know the role it has in the proper working
> of the Internet.
> 
> I explained them the situation:
> 
> 	Lots of ccTLDs are preventing zone transfers to be done by
> 	the public in general often using privacy concerns as the
> 	primary motif. I also explained that DNSSEC has this back
> 	door where you can get the names out of the zone by walking
> 	the NXT records. So the basic question was, is there really
> 	a concern that this backdoor might prevent the deployment
> 	of DNSSEC in Europe because of privacy regulation?
> 
> Note, this was before NSEC records existed. I'm sticking here to
> the term NXT records to stay close to the original conversation.
> 
> They were willing to do an small study, and, if they thought that
> there might be any problems, they would raise that and then we would
> decide whether a larger study was necessary.
> 
> It resulted in:
> 	Tilburg University (B.J. Koops & E. Schreuders), Quickscan
> 	DNSsec/NXT and privacy, March 2003 (unpublished).
> 
> It is not really big, I give here a translation from the Dutch,
> leaving out some of the details.
> 
> 	We don't think that there is a special privacy problem with
> 	the deployment of DNSSEC caused by the NXT walking which
> 	would give you a list of names which might be used to query
> 	the whois service.  The privacy rules are already in force
> 	by the Wbp (Dutch privacy law, fully implementing the EU
> 	directives --j) and the regulation of the registry.  (I'm
> 	skipping the details they quote from court cases and articles
> 	in our regulations --j).
> 
> 	DNSsec only offers something new by the capability to get
> 	a list of domain names. This list is irrelevant from a
> 	privacy point of view, only the combination with the whois
> 	database gives the list personal sensitive information (with
> 	the exception that of domain names such as michaeljfox.com,
> 	vix.com and jaap-akkerhuis.nl).  Possible problems occur
> 	when the list is used for interrogating the whois database.
> 	But for that, there are already existing rules so DNSsec
> 	doesn't add any problems.
> 
>         In short, the back door can give personal data but only
>         in combination with whois for which is existing regulation.
> 
> Although they don't claim that they didn't do "fundamental research",
> We (SIDN) would have been happy to pay for such a study as well,
> but they refused, since they thought that such a study would have
> a very similar outcome.
> 
> So, we concluded that the NXT walking (now NSEC) and (EU) privacy
> concerns would not be a show stopper for introducing DNSSEC in the
> NL zone.
> 
> On this list in this context I noticed that also concernsabout the
> IP-rights (Intellectual Property rights) popped up, like one had
> on a telephone directory. (There the data is also meant to be public,
> but on how it is organized there are IP rights). You cannot just
> copy a directory because of that.

	But you can compile your own.  I seem to remember a court case
	here where OCR scanning of a existing directory was illegal but
	getting a team of typists to re-enter all the data in a
	existing directory was legal.

> making copies. We discussed this internally somewhat.  We think
> that IP-rights on a zone file is an interesting idea, but doesn't
> prevent zone enumeration. It has more juridical aspects then
> technical.
> 
> Back to (EU and other) pivacy concerns. Given the fact that there
> are multiple ways to do data mining for domain names in a zone as
> pointed out by Paul Vixie and Robert Elz, one really must take steps
> to limit access to "whois data".
> 
> 	jaap
> 
> --
--
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: Roy Badami <[email-masked]>
Date: Sat, 22 May 2004 01:00:16 +0100

>>>>> "Mark" == Mark Andrews <[email-masked]> writes:

    Mark> 	But you can compile your own.  I seem to remember a
    Mark> court case here where OCR scanning of a existing directory
    Mark> was illegal but getting a team of typists to re-enter all
    Mark> the data in a existing directory was legal.

Hmm, I'm kind of surprised that even OCR was illegal in the US.  But
there is a significant difference between UK and US copyright law in
this area.  AIUI in US copyright law there is an exclusion from
copyright for a unique, canonical representation of a set of data.  A
consistently formatted alphabeticised list of names and phone numbers
of all telephone users would hence fall into this category, since it
is not regarded as a creative work.

Many other jurisditions (certainly the UK) do not draw this
distinction.

	-roy

---

From: [email-masked]
Date: Fri, 21 May 2004 19:18:23 +0000

> copy a directory because of that. For a zone file you can claim

	the one concern here is that the process of signing the
	data sorts the zone into a "normal" form.  this is a two-edged
	sword :)  in the singed case, I can unambigiously prove
	that the zone contents were sorted and signed by me. e.g.
	the compilation is mine.

> to limit access to "whois data".

	There are otheres that called out the ability to either
	"slow-scan" the replies & build up a copy of the DB over time,
	or "brute-force" the effort. Both take time, both are known
	tools (and some of us have used them!)  

> 	jaap

--bill