Subject: How security could benefit from high volume spam

From: Hadmut Danisch <[email-masked]>
Date: Wed, 14 Dec 2005 15:03:55 +0100

How security could benefit from high volume spam

The parliament of the European Union today has passed a law that
electronical call detail records, such as phone numbers, e-mail addresses,
web accesses of all 450 million EU citizens are to be recorded and
stored for 6 to 24 months. So everyone will be subject of
complete surveillance of telecommunication. No place to hide.

The given reasons are the need to investigate and prosecute terrorism
and severe crime. But there is no evidence that this law
actually has this effect, and that it is worth to sacrifice democracy
and civil rights. Our constitution protects the right to communicate
confidentially, for all citizens, and especially for lawyers,
journalists, priests, etc. So terrorists finally begin to
succeed in destructing our european, modern, democratic, and free way
of life and civil rights. It is ridiculous that the modern world has
not been attacked by a large army, but by just about 30-40 people with
knives and a few bombs. The attack is not the primary attack
itself. The main attack is to provocate overextended counter
measures. Technically spoken, a denial-of-civil-rights-attack. And the
EU proved to be vulnerable to this kind of attack. A patch is not
available yet.

Another threat to privacy and civil rights is the intellectual
property industry. We have seen Sony attacking and sabotaging private
computers, revealing private data, taking secretly control over
people's communication and working equipment. We have seen a mother of
five been sued into bankruptcy in the USA just for listening to music.
This is perverse. We currently see governments considering to outlaw
open source software or any kind of data processing or communication
device without a digital rights management. There are good reasons to
assume, that the European Union's collection of all telecommunication
details will be abused to allow the intellectual property industry to
completely track every communication. Just having received any e-mail
from someone who had illegally downloaded music could be enough to have
your home searched, your computer confiscated, and find yourself sued
or prosecuted. 

The art and science of communication security will have to realign and
focus on new goals. When designing telecommunication protocols we have
to take much more care about what communication could reveal about the
communication parties and the contents. It is not enough to just put
some kind of simple encryption on a message body. We need to protect
against traffic analysis, in particular the one without democratic
legitimation. 

What does that mean?

When designing a protocol we should take more care than we did to
describe its vulnerability for and resistance against traffic
analysis. Not just whether the contents are encrypted, but what an
eavesdropper can tell about the communicating parties.  We need to
incorporate techniques like oblivious transfer and traffic hiding.

An important component of such protection methods is noise. Plenty of
noise. Something to hide in, to cover, to overload recording of call
details. We should think about and research how to produce noise. 

We already have some noise. Its called spam. 

Some of you might know that I am one of the early days fighters
against spam. I tried to eliminate as much spam as possible. 

But now, there could be a positive aspect about spam, virus mails, and
other mass mails. Maybe it could become an advantage to receive a
million mails per day from any senders. Maybe that is what is needed
to hide my personal e-mails. Maybe that's the answer I have to give
when someone blames me to have received e-mail from the wrong person:
"I have no idea what you are talking about. I received about 150,000
virus and spam e-mails that day from arbitrary addresses, and didn't
read a single one of them. I have just deleted them." When designing
measures against spam, we should take this into consideration.

Maybe in near future the advantages of that noise produced by millions
of bots will outweigh the disadvantages?

Comments are welcome.

Hadmut Danisch

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Peter Dambier <[email-masked]>
Date: Wed, 14 Dec 2005 16:18:11 +0100

> We already have some noise. Its called spam. 

I would not call this SPAM. It is potentially sensitive information.
Secret messages of Al Kaida could be in there - without our service
people even beeing aware of it :)

> of bots will outweigh the disadvantages?

I see. No more need to hide my email address. :>

Next I will switch my spam filter off, at gmx. It was counterproductive anyhow.

How can I convince them to get rid of sorbs? I filters my own emails but it does
not filter spam.

Cheers
Peter and Karin

-- 
Peter and Karin Dambier
The Public-Root Consortium
Graeffstrasse 14
D-64646 Heppenheim
+49(6252)671-788 (Telekom)
+49(179)108-3978 (O2 Genion)
+49(6252)750-308 (VoIP: sipgate.de)
mail: [email-masked]
mail: [email-masked]
http://iason.site.voila.fr

---

From: Frank Ellermann <[email-masked]>
Date: Wed, 14 Dec 2005 16:46:42 +0100

> Comments are welcome.

The best way to hide a signal is noise, is that's your idea ?
Makes sense from my POV.  My personal anti-phishing strategy:

They just don't manage to find the one and only one local part
where I'd be tempted to believe it.  They either hit the wrong
local part or more than one local part so far.

                            Bye, Frank

---

From: "JFC (Jefsey) Morfin" <[email-masked]>
Date: Wed, 14 Dec 2005 17:54:27 +0100

Dear Hadmut,
thank you for this mail. Comment interspread.

>complete surveillance of telecommunication. No place to hide.

The main issue is not so much the record, but who records, and who 
has access to records and how. See below.

>EU proved to be vulnerable to this kind of attack. A patch is not

This is entirely true. But there are alliances. The true terrorism is 
the one you quote below. Because it is simpler in many cases (we 
documented this in France during the last months due to the DADVSI 
law we are to vote [DMCA equivalent]) to use this information for IPR 
reasons than for Defense reasons.

>your home searched, your computer confiscated, and find yourself sued

The technical problem here is that the US DMCA is not so "good". So 
they went to Europe. And each time a new European country votes the 
local DMCA treaty application, the law is worse. We are to rush it in 
France under Brussels penalty. We are globally opposed, so we delayed 
and are unprepared. This will lead to a vary bad law (publicity of 
formats can be illegal -> you can go to jail for 30 years to have 
pubished the HTML format if the Judge does not understand).

The target is then to come back in the USA and tell: look at what 
these French did: do you really want the French to be the best? To 
influence the Congress, etc.

>against traffic analysis, in particular the one without democratic

This is why I oppose RFC 3066 bis which immensely simplify language 
filtering (the WG-ltru is working on that and banned me for still a 
few days for ... BTW I do not even recall why this time :-))  It will 
permit mass Google based cultural, racial, religious profiling ... or 
censoring.

>incorporate techniques like oblivious transfer and traffic hiding.

You describe the danger of what I call "meta-spam", using the 
protocol data to send people data - they will most probably reply to 
without knowing it - which will permit to profile them.

>details. We should think about and research how to produce noise.

YES!
Chaff is a basic military solution.

>measures against spam, we should take this into consideration.

YES.
But you have to organise yourself in changing (transition is simple) 
the way we use mail. To use send and retrieve. To permit increasing 
noise, but reducing traffic. You also have to build you own secure 
stronghold: your calls are not submitted by you but through an 
anonymizer. Without losing control. You want to "chaff" yourself, 
sending thousand of decoy mails to yourself from random mutual 
security friends.

BTW I suppose that this is the solution to mobiles. By nature calling 
a mobile ask for it to be localized and everything about it to be 
known. Is that what we really want?

>of bots will outweigh the disadvantages?

Spam is an architectural disease. Noise is a natural component 
permitting to transmit data over broad band. Digital Warfare is an 
interesting issue, quite limited by the current Internet 
architecture. May be not for the IETF?
jfc

---

From: Hadmut Danisch <[email-masked]>
Date: Wed, 14 Dec 2005 23:10:01 +0100

On Wed, Dec 14, 2005 at 04:46:42PM +0100, Frank Ellermann wrote:
> Makes sense from my POV. 

Not necessarily the _best_ way, but one that works under many
circumstances. 

Some questions are: 

How do we deal with the total surveillance?
Do anti-spam measures make surveillance easier?

regards
Hadmut

---

From: "JFC (Jefsey) Morfin" <[email-masked]>
Date: Fri, 16 Dec 2005 01:24:36 +0100

>Do anti-spam measures make surveillance easier?

Hadmut,
not much success with your suggestion! Too much European centric at 
the moment. Your proposition is of real interest as part of a picture 
to study the noise as a general protection (conflicting information, 
spam, revamping web sites 1000 times a day, meta-spam, tags, EUCD, 
civilrights protection, bandwidth cost, site legal registration, 
multiligualism, debate orientation, etc.). The French law related 
debate make it very interesting, and important, however too complex 
for current users at this time. This fits the interests I have in the 
emergence of an "over the ISO layers" Internet through a grassroots 
process. How to use the Internet? But the IAB discuss list leads to nothing.

Why not to try to shape a WG Charter on this? I do not believe the 
IESG is able to follow. But when I see all the ICANN, IETF, Unicode, 
etc. meetings, publications, etc. etc. about "internationalization", 
partly to oppose my long enough opposition which permitted me to 
reach Tunis. One could expect that Brussels could be interested at 
the end of the day. And if the IESG does not follow, we will have 
made our duty, before going elsewhere? I do not think that the 
balkanization they impose on us is a good thing.

jfc

---

From: Peter Dambier <[email-masked]>
Date: Fri, 16 Dec 2005 11:31:35 +0100

A WG?

Karin and me are interested.

>> Do anti-spam measures make surveillance easier?

No, I dont want to bash the one and only root again, but never did I
receive any SPAM an my [email-masked] address.

This too could improve our position. Which root does the guy use - or
has he simply freaked his /etc/hosts?

Hadmut, I agree with your idea and I switched my spam filter off from all
my GMX mail accounts. They are worthless anyhow, because I permanently
have to read the spam folder to find lost emails. I still have to fight
sorbs, because they dont even accept my own emails from my host
echnaton.serveftp.com wich has a dynamic ip.

> 
> 
> Hadmut,
> not much success with your suggestion! Too much European centric at the 
> moment. Your proposition is of real interest as part of a picture to 
> study the noise as a general protection (conflicting information, spam, 
> revamping web sites 1000 times a day, meta-spam, tags, EUCD, civilrights 
> protection, bandwidth cost, site legal registration, multiligualism, 
> debate orientation, etc.). The French law related debate make it very 
> interesting, and important, however too complex for current users at 
> this time. This fits the interests I have in the emergence of an "over 
> the ISO layers" Internet through a grassroots process. How to use the 
> Internet? But the IAB discuss list leads to nothing.

The French law made me move the sources from IASON

http://iason.site.voila.fr/
http://www.kokoom.com/iason/

to sourceforge. I dont want to fight the music industry with a law I dont
even understand. IASON has nothing to do with music but it has to do with
copyright.

> 
> Why not to try to shape a WG Charter on this? I do not believe the IESG 
> is able to follow. But when I see all the ICANN, IETF, Unicode, etc. 
> meetings, publications, etc. etc. about "internationalization", partly 
> to oppose my long enough opposition which permitted me to reach Tunis. 
> One could expect that Brussels could be interested at the end of the 
> day. And if the IESG does not follow, we will have made our duty, before 
> going elsewhere? I do not think that the balkanization they impose on us 
> is a good thing.
> 
> jfc
> 

Karin and me helped building two balkan DNS roots. Why not do something
serious now :)

Cheers
Peter and Karin

-- 
Peter and Karin Dambier
The Public-Root Consortium
Graeffstrasse 14
D-64646 Heppenheim
+49(6252)671-788 (Telekom)
+49(179)108-3978 (O2 Genion)
mail: [email-masked]
mail: [email-masked]
http://iason.site.voila.fr
http://www.peter-dambier.de
http://peter-dambier.site.voila.fr

---

From: "JFC (Jefsey) Morfin" <[email-masked]>
Date: Fri, 16 Dec 2005 16:58:40 +0100

Peter,
the first step in creating a WG (RFC 2418/BCP 25) is to discuss it 
with an AD. The problem is that one can consider different approaches:

1. chaffing as a Security Area issue. But there are much more 
environment as it is the remote global user protection (and not only 
his machine).
2. transmitting in the noise. This seems to be then an Application Area issue.
3. the way an individual persons may use the Internet. This is usage 
architecture. Then in Operations and Management Area.
4. this may lead to a battery of practical ways to extend and 
organise the internet and to new protocols, hence in the Internet Area.
5. there is an obvious need to authoritatively document Govs and Law 
makers and to negociate with them. The IETF is not suitable for that. 
The IAB can document, but not negociate. The place for negociations 
is the IGF, but not here yet and no interface with the IETF either.

As you point it out, every sector of the Internet technology is 
concerned and the concepts of the internet and of its economy may be 
totally changed. I saw your site and I understand your concerns about 
the French DADVSI law. But understand that DMCA is a lenient version 
of the treaty. EUCD is a step further (how is its German version?). 
DADVSI is an absurd step further. But next will be DMCA II, based on 
the DADVSI "success". So, transmitting in the noise may become the 
usual way the Internet functions, with a necessary opposition from 
Governments and an economical big difficuly. Areas of the Internet 
will be cut-off. We will get a "noise divide".

I suggest that everyone can comment on this WG-"user protection 
strategies" project, so we may have more elements to document our 
question to the IESG to know which area to chose.

jfc

At 11:31 16/12/2005, Peter Dambier wrote:
>>the moment. Your proposition is of real interest as part of a 
>>picture to study the noise as a general protection (conflicting 
>>information, spam, revamping web sites 1000 times a day, meta-spam, 
>>tags, EUCD, civilrights protection, bandwidth cost, site legal 
>>registration, multiligualism, debate orientation, etc.). The French 
>>law related debate make it very interesting, and important, however 
>>too complex for current users at this time. This fits the interests 
>>I have in the emergence of an "over the ISO layers" Internet 
>>through a grassroots process. How to use the Internet? But the IAB 
>>discuss list leads to nothing.
>
>>IESG is able to follow. But when I see all the ICANN, IETF, 
>>Unicode, etc. meetings, publications, etc. etc. about 
>>"internationalization", partly to oppose my long enough opposition 
>>which permitted me to reach Tunis. One could expect that Brussels 
>>could be interested at the end of the day. And if the IESG does not 
>>follow, we will have made our duty, before going elsewhere? I do 
>>not think that the balkanization they impose on us is a good thing.
>>jfc
>