Subject: [Raven] what is wiretapping

From: Ed Stone <[email-masked]>
Date: Wed, 02 Feb 2000 11:26:54 -0500

I criticized the ietf draft definition of wiretapping.

I was challenged to do better. Here is my attempt. Obviously, a civil 
liberties lawyer is need to do this properly:

Wiretapping is what occurs when

1. information passed across the Internet (including but not limited to 
wire-bound signals, wireless communications, microwave segments, and 
incidental RF emanations from equipment on the Internet or intervening 
communications carriers traversed by the information anywhere from origin 
point to any reception point, including but not limited to systems that 
connect to the Internet to enter, convey, or effect receipt of Internet 
communications [such as a user's PC, for example]) from one party to one or 
more other parties

2. is delivered to or intercepted by a third party

3. for purposes of manually or programmatically inspecting or analyzing or 
classification, or storing for subsequent possible or certain manual or 
programmatic inspection or analyzing or classification of that information,

4. including but not limited to non-aggregated traffic analysis, any of 
which may be isolated to a specific IP, specific machine or processor 
(including network card, interface or modem device or processor), specific 
instance or class of an application, sender or recipient

5.When the sending party does not fully voluntarily and overtly cause 
and/or authorize such delivery or interception for each specific event and 
for each specific usage applied thereto

or

6. When any of the recipient parties do not fully voluntarily and overtly 
cause and/or authorize such delivery or interception for each specific event

and

7.When each specific disclosure of information applied thereto is not 
within the legitimate authority of one or more of the intended recipients 
to provide such voluntary and open disclosure in the absence of any legal 
(criminal or civl) process that compels such disclosure or which provides 
duress to induce such disclosure

8. With the expectation of privacy and confidentiality between sender and 
recipients as the default assumption in all cases, voided only by an overt 
and knowledgeable fully voluntary declaration by sender or intended recipient

9.When the third party acts
a.  deliberately to intercept and/or collect, or in a manner which may 
reasonably be expected to intercept and/or collect (whether intentionally 
or as a by-product of another process)

b. at any point via any technical or other methodology

c. the information, regardless of whether the collection or interception is 
based on a general or broad collection or a targeted collection of information

d.  and regardless of whether the information is encrypted, compressed, or 
plaintext

e.  and regrdless whether the information is selected manually or 
programmatically or because of certain programmatically or manually 
determined characteristics or "profiling", frequency, orgin, destination, 
size, entropy of content, headers, specific instance or class of initiating 
application, specific instance or class of network interface or device or 
other machine or processor,or any other characteristics that may from time 
to time become discernable by technology or persons.
--
--------------------------
Ed Stone
[email-masked]
--------------------------

_______________________________________________
raven mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/raven

---

From: "Lyal Collins" <[email-masked]>
Date: Thu, 3 Feb 2000 07:01:42 +1100

Great - now all system administrators are wiretappers.

Why restrict this view to "internet"?
Why not all data transfer networks - LANs, sneakernet, dedicated
leased/dial-up lines etc?

re 5 - this seems to define all email as automatically wiretapped.

re 6 ignores the fact of machines recieving data. How does a machine
'authorise" an abstract concept such as network quality monitoring, let
alone wiretapping.

7 - is broadly similar to what telco and LE workers are required to obey,
but not system administrators, in many countries

Regards,
Lyal

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On Behalf Of Ed
> Stone
> Sent: Thursday, 3 February 2000 3:27
> To: [email-masked]
> Subject: [Raven] what is wiretapping
>
>

---

From: "Brian Raney" <[email-masked]>
Date: Wed, 2 Feb 2000 12:06:51 -7

> I criticized the ietf draft definition of wiretapping.

I, too, find the definition of wire tapping lacking.  Delivery 
to third parties unknown both to the sender and receiver is 
fundamental to the operation of the Internet.  When I send 
mail to someone it travels across many machines over which I 
have no control or knowledge.  

Also, as has been pointed out to B*b A**isat many times, the 
machines that make up the Internet are by and large owned by 
private companies that have every right to monitor all the 
traffic that goes through them.  For example, Paul Vixie's 
spam black hole which delivers traffic to /dev/null is 
perfectly acceptable because the machine it runs on is 
privately held.

There can be no expectation of privacy of non-encrypted IP 
traffic as long as that traffic traverses the networks owned 
by private entities with no legal requirement to maintain that 
privacy.  

I suggest eliminating most of the latter part of the document 
and stick with the first few points: wrong forum, multiple 
jurisdictions, and security.  

brianr

---

From: Ed Stone <[email-masked]>
Date: Wed, 02 Feb 2000 15:27:12 -0500

>Great - now all system administrators are wiretappers.

Great! Thanks for volunteering to improve it!
When can we see your revisions?

---

From: "Lyal Collins" <[email-masked]>
Date: Thu, 3 Feb 2000 07:51:10 +1100

I apologise for my sarcasm.

The IETF version seems to fit the needs somewhat better.

I'm not entirely comfortable with the "random vs intent" clause - but
recognise it may be the best compromise that does not inhibit Web site
statistics monitoring, Intrusion Detecion Systems, Firewalls, and network
performance monitoring, and probably a hundred other legitimate uses to have
some form of network oriented monitoring (rather than human oriented).

Regards,
Lyal

> Sent: Thursday, 3 February 2000 7:27
> To: [email-masked]
> Subject: RE: [Raven] what is wiretapping
>
>