Subject: Policy and regulator connections (Was: Re: Thoughts from IETF-92)

From: Jari Arkko <[email-masked]>
Date: Wed, 1 Apr 2015 14:48:36 +0300

Fred said:

> Be careful what you wish for. You may discover that you already have it.
> 
> ISOC brings on the order of 12-15 “policy fellows” to IETF meetings regularly, introduces them to the IETF, and has a series of talks given by technical folks to help them understand the Internet better. I suspect that the thing most of them walk away with is the business cards of a few people they think might be able to answer questions for them in the future, and the fact that we don’t bite - at least not outsiders.
> 
> And yes, I suspect they will do so in Prague, Yokohama, Buenos Aires, and in the meetings that follow.

Indeed. This has been and continues to be a very useful program. And more often than not, we meet these people around the world in other contexts, and having established some connections beforehand is a big help.

Note that this is a bidirectional relationship - both sides have a lot to learn. There are many topics where we are learning that technology and other aspects overlap. Or that information and education is needed to let us understand each other better.

And Christian said:

> What I am saying I suppose is that there are a lot of threads in the
> policy space and complexity is not just in the technical demarcations
> between subject matter areas but in who to engage with and the level of
> clue and opinion and interests on all sides.
> 
> This work really does need commitment across our communities to support it.
> 
> But if one starts off by saying "idiots ...." because they don't get
> "xxx " then you are really saying you don't get why they think "yyy".
> 
> In some senses that may be the larger challenge. I am not saying you are
> wrong about the analysis but that it is not a policy objective or
> analysis that is usable.

Fully agree.

Jari

---

From: Jari Arkko <[email-masked]>
Date: Wed, 1 Apr 2015 15:43:32 +0300

> We can do better in telling the secretariat just how good they are!

Yes. They really are very good.

Jari

---

From: Joseph Lorenzo Hall <[email-masked]>
Date: Wed, 1 Apr 2015 08:47:08 -0400

On Mon, Mar 30, 2015 at 11:20 PM, Richard Shockey <[email-masked]> wrote:
> 2. Public policy advocates.. A bit tricker but still the same principal.
> If Consumers Union could figure out how to find us to deal with Caller ID
> spoofing in Dallas then lets find them on security privacy issues.  Again
> my issue with ISOC. Outreach is what they are charged to do so let them
> bring people to the table to see what real multi stakeholder consensus is
> about.

Some of us are out here... perhaps just interested in different
strains of work at IETF. Maybe in Prague we can have a bar BOF (that's
not the right term... just a time with drinks) for those of us with
one foot in technology and the other in policy. best, Joe

-- 
Joseph Lorenzo Hall
Chief Technologist
Center for Democracy & Technology
1634 I ST NW STE 1100
Washington DC 20006-4011
(p) 202-407-8825
(f) 202-637-0968
[email-masked]
PGP: https://josephhall.org/gpg-key
fingerprint: 3CA2 8D7B 9F6D DBD3 4B10  1607 5F86 6987 40A9 A871

---

From: Richard Shockey <[email-masked]>
Date: Wed, 01 Apr 2015 10:27:08 -0400

I know.  

IMHO a Pilsner beer fest along these lines would a pretty good idea. There
are certainly a number of hot button items to review.

Even in Dallas we had the FCC and OFFCOM folks and I¹ve certainly seen
folks from the EU Commission and FINERA ( Finland ).

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Wed, 1 Apr 2015 12:35:58 -0400

A meet up on general policy related stuff or the robocall scams?

I think it is absolutely clear that we can apply many of the
techniques used to control email spam to block robocalls in principle.
But the problem is that the telephone system architecture only gives
us stupid boxes with no APIs or ability to customize their function.

I suspect a large part of the problem is that most of the folk who
could work on this problem are cord cutters who use mobiles. Robocalls
are an increasing problem there as well but it is much smaller. I get
maybe one mobile robocall a month while there are six a day on the
home phone.

By telephone service, I mean the voice communication service I can
access from any of the 12 handsets in the house and allows me to call
anyone with a telephone number.

Now this is not where I want to be. I want to add more handsets for a
start and I would like the handsets to have effective encryption
between the handset and the base station.

Some things that I think would help (in no particular order).

1) State laws that require products with defective security (e.g. car
door keys, garage door openers, DECT6.0 phones) to be sold with large
stickers saying 'Defective Security'.

2) Someone producing a clear, easy to understand guide specifying the
hardware and service requirements for setting up an Internet telephony
system that provides an API allowing intelligent control

3) Hardware vendors who provide VOIP access points could provide API hooks.

4) A Web service protocol specification allowing the API to be
activated remotely.

For example, I would like to be able to program my telephone system to
add the following features:

* Direct voicemail to my own systems that NEVER EVER delete a message
or make me w-a-i-t w-h-i-l-e a v-e-r-y s-l-o-o-o-o-o-w s-p-e-a-k-e-r
t-e-l-l-s me stuff I already know.

* While in a call, I dial a code on the handset to white list that caller
* While in a call, I dial a code to black list that caller

* Control which incoming calls can cause the ringer to sound and at
which times of the day.

* Route calls to certain numbers end to end without going through the
PSTN at all.

* Place calls on Skype etc. directly.

Yes, I know, Asterix. But the ability to hack someone else's code is
not the same as being able to make one device talk to another over a
defined interface.

Apple, Cisco, Google and Microsoft are all players in this game right
now but none will deliver what the market needs. And they all could
with just a little willingness to make the system open.

The problem is that the telco people do not understand open systems
and don't think of opening up the system as a possible solution. It
simply isn't in their mid set.

---

From: Richard Shockey <[email-masked]>
Date: Wed, 01 Apr 2015 14:30:46 -0400

In line ..

>A meet up on general policy related stuff or the robocall scams?

Both there are a lot of issues cropping up.

>techniques used to control email spam to block robocalls in principle.

Well not so fast.  They are not the same. Real time is essentially a
symmetrical service while email is fundamentally asymmetrical and I have
Not seen a Baysian filter for voice yet.

>us stupid boxes with no APIs or ability to customize their function.

The new architecture is different. SIP IMS is actually more functional
that way. Its the legacy TDM gear that you can¹t really touch and that is
part of the problem.  The operators of the PSTN/PSN correctly will not
spend one cent on trying to modify the legacy gear. You can¹t. Go try and
find line cards for 5ESS, DMS and Siemens platforms these days much less
try and find anyone that could modify the switch code.  In the US and CA
35% of all voice is now IP end to end is some way and with VoLTE starting
to roll that will push the total to 75% or more in 3 years. The FCC and
other regulators are just starting to sort through the PSTN transition
issues.  

>maybe one mobile robocall a month while there are six a day on the

Personally its 1 to 4 but milage can vary.  There is no about the
contagion is spreading even to mobile. ITU ran a workshop on this last
year and even the 
Chinese regulators are getting grey hair about it. Which is why STIR was
formed to see if you could apply SIDR principals to the E.164 plan.

>anyone with a telephone number.

Right. The any to any model of E.164 named realtime communications still
works and works well and is still a great business. About 14 Billion in
the US BTW. You buy a lot with E.164 including the Emergency Services
networks 911 999 etc. I have had to listen to the naysayers in the IETF
hallways whine endlessly ..phone numbers are stupid the PSTN is toast etc.
 <yawn>  Now its SIP sucks WEBRTC is the future .. <snore>

>stickers saying 'Defective Security'.

Good luck with that.

>3) Hardware vendors who provide VOIP access points could provide API

People are working on that especially for the enterprise markets.

>4) A Web service protocol specification allowing the API to be

Talk to the WEBRTC folks ..

>* While in a call, I dial a code to black list that caller

That has been in the PSTN for a long time.

€The PSTN already has User Directed Selective Call Acceptance (SCA- the
white list) and its twin Selective Call Rejection (SCR 
black list)

€The other alternative is Network Directed Rejection is sometimes referred
to as ³Do Not Originate² or ³Super
Do Not Call² In particular the Do Not Originate would potentially allow
the carrier to block any call that is using a non-allocated E 164 number.
The problem there is nearly all national regulations have ³the call must
go through² language.

Signalling codes are well understood as well.

http://www.nanpa.com/number_resource_info/vsc_definitions.html

Its just no one uses them.

I have very little confidence in any of the known anti-spam measures
having any relevance to the real time communications problems.  They are
all subject to the same potential for malicious abuse we¹ve seen in email.
How do you get OFF the list if your ex girlfriend puts you on it.
Of course you can try but the evidence so far is not that good and we¹ve
had a bunch of meetings at MAAWG about this.

>* Place calls on Skype etc. directly.

You can do all of now if you are not on the legacy switch plafforms.

>not the same as being able to make one device talk to another over a

OMG Asterix totally sucks its THE ABSOLUTE WORST in security. The stories
of small business having hacked asterisk servers and having 100 thousand
dollar call bills to the Sudan are legion.

>with just a little willingness to make the system open.

To be sure but one of the issues we were looking at in DISPATCH was the
CNIT concept or Calling Name Idenity Trust or the notion that SIP/IMS user
agents aka Apple Google Microsoft could display better identity data ( you
can still set for Anonymous  still supported ) but allow
for some more verbose data on who is calling you and does the network
trust the source from STIR data. I have called it CNAM+. I think 3GPP is
starting to look at that stuff in SA1 and 3 but we still need to define
how the SIP headers transport the data.

>simply isn't in their mid set.

There is a lot the legacy teleco people don¹t understand especially what
business there are in and some of the insane tariff structures they insist
on operating under. ³Money is the answer what is the question?²  At least
in North America we are pretty close to a full bill and keep model which
has completely blunted the effect of Skype and the OTT folks on domestic
call minutes.  International call arbitrage and OTT is now totally off the
charts. 40% or more by some data I¹ve seen.

---

From: Joseph Lorenzo Hall <[email-masked]>
Date: Wed, 1 Apr 2015 16:28:50 -0400

> A meet up on general policy related stuff or the robocall scams?

In my case I meant the more general intersection of policy and IETF
issues... I realize that's a vast set of things, but I suspect we can
self-select a bit. best, Joe

---

From: "Mukom Akong T." <[email-masked]>
Date: Mon, 6 Apr 2015 04:13:10 -0700

On Mon, Mar 30, 2015 at 7:06 PM, Dave Crocker <[email-masked]> wrote:

> In concrete terms, what does this mean?  Within the bounds of our
> skillsets and time and deliverables, what should the IETF and
> participants /do/ to accommodate policy folk?
>

This was my first IETF meeting (*pls go easy on me :-) *) and I had a
chance to discuss with one of the chairs about the policy folks.  I see two
ways to address this:

a) ISOC/IETF just have some money and want to spread it around
b) ISOC/IETF has some specific problem to solve and wants to ensure that
this policy program is actually effective

Going with mentality (a), anything ISOC/IETF does to bring any one that is
policy is going to be ok even if of dubious value.
Going with b) is more difficult, will take a lot of work/investment on the
part of ISOC/IETF and yield the best results. Here's how this policy
program **might** be fully developed (simply a variation of PDCA):

The Goal
***********
Get governments to help drive IPv6 deployment in their respective countries

How will we know we've achieved the goal?
**************************************************

- A clear national IPv6 action plan with a scoreboard that is updated
annually
- Government websites are reachable over IPv6

Lead measures that may be indicative of success in the above measures are

- Number of policy fellows that go back and engage their constituents on
IPv6 (public presentations, action plan proposals, support for local
networking fora to train on IPv6 etc

- Engagement in a relevant working group (this would be mostly asking
questions ?

The Plan
***********

- pre-select policy guys at the appropriate level of authority (the more
powerful the individual (formal or expert power) the more effective s/he is
going to be as a fellow

- provide specific training on how a government would go about encouraging
IPv6 at a national level

- create and work on case studies of how other gov'ts did it

- give them templates for various aspects of the endeavour (making the
business case to a minister of ICT for example, stakeholder analysis for
deployment teams, examples of strategies that work/don't work

- have some kind of helpline where these people can ask for help with their
endevours

- invite policy fellows showing some success to come share with others

If the measures aren't moving in the right direction, then the plan needs
to change

-- 

Mukom Akong T.

http://about.me/perfexcellence |  twitter: @perfexcellent
------------------------------------------------------------------------------------------------------------------------------------------
“When you work, you are the FLUTE through whose lungs the whispering of the
hours turns to MUSIC" - Kahlil Gibran
-------------------------------------------------------------------------------------------------------------------------------------------