Subject: Re: [Raven] Fwd: I-D ACTION:draft-ietf-iab-raven-00.txt

From: Peter Greenwood <[email-masked]>
Date: Thu, 03 Feb 2000 01:48:48 +0000

[email-masked] said:
>  I really suggest that the wording of the definition of  wiretapping
> get some scholarly civil liberties lawyer attention.

IMHO the legalese is best left to legal documents (the usual problem of
dealing with multiple jurisdictions applies here too). What is needed here
is a definition sufficient for the purposes of this document.

By my reading of the draft, the intent is pretty much what most people here
are after, but the wording could do with a little clarification.  Specifically
the phrase "random monitoring is not wiretapping (condition 4 violated)"
could be rephrased to something like "monitoring to gather network statistics
with no user identification included is not wiretapping (condition 4
violated)"

Condition 4 could be expanded specifically to cover large-scale monitoring 
operations, perhaps as follows:

4.   When the third party acts deliberately to monitor the transmission of
  the first party, because he is of interest, because the second party's
  reception is of interest, or because all or many transmissions are of
  interest.
-- 
	Peter Greenwood		[email-masked]

_______________________________________________
raven mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/raven

---

From: "chefren" <[email-masked]>
Date: Fri, 4 Feb 2000 01:23:53 +0100

On 2 Feb 00, at 9:00, Richard Payne wrote:

> > >http://www.ietf.org/internet-drafts/draft-ietf-iab-raven-00.txt
> > >
> 
> The draft is eminently reasonable. Kudos to the authors.
> 

Ah?

> - The IETF, being a standards body for communications that
> pass across
>   networks that may be owned, operated and maintained by
>   people from numerous jurisdictions with numerous
>   requirements for privacy, believes that the operation of
>   the Internet and the needs of its users are best served by
>   making sure the security properties of connections across
>   the Internet are as well known as possible. At the present
>   stage of our ignorance this means making them as free from
>   security loopholes as possible.
> 
> - Adding a requirement for wiretapping will make the designs
>   considerably more complex, thereby jeopardizing the
>   security of communications even when it is not being
>   tapped by any legal means; there are also obvious risks
>   raised by having to protect the access to the wiretap.
>   This is in conflict with the goal above.

IETF wishes to forget that tapping IS required that tapping 
WILL be added and if not fully integrated in IETF standards 
will undoubtly jeopardize security of communications.

That might well be by force: making use of IETF standards 
that prevent wiretapping illegal.

This is no solution...

+++chefren

---

From: Chris Savage <[email-masked]>
Date: Fri, 4 Feb 2000 06:21:25 -0500

-----Original Message-----
From: chefren
To: [email-masked]
Sent: 2/3/00 7:46 PM
Subject: Re: [Raven] Fwd: I-D ACTION:draft-ietf-iab-raven-00.txt

On 2 Feb 00, at 11:20, Fred Baker wrote:

>At 09:42 AM 2/2/00 -0500, Ed Stone wrote:
>>Thus, for instance, ... random monitoring is not wiretapping
>>(condition 4 violated)..."
> 
>>maybe you can offer some better text. What we were trying to say was
>>that when one puts a sniffer on an Ethernet for network management
>>purposes for a purpose unrelated to capturing a user's content (say,
>>finding out what percentage of traffic is HTTP vs how much is SMTP,
>>example at http://www.vbns.net/stats/flows/html), this was not
>>wiretapping. The key feature of wiretapping is not the capture of
>>traffic, but the capture of the content of traffic for the purpose of
>>revealing that content in some way.

>Capture of traffic and thus analysing who is communicating 
>with who is a very important use of taps.

>In The Netherlands law enforcement often chooses only 
>traffic analysis first for organised crime. Since they are 
>required to report =everything= they tap and that's costly 
>even for simple telephone calls, they try to avoid that.

>p.s. As Declan said: shorter is better / more effective

>p.p.s. Typo: regrdless 

I personally thought the draft was a nice job.

As to traffic analysis, etc., IIRC a very early pair of observations on the
list consisted of (a) today, right now, all sorts of ways exist to
read/track traffic on the 'net (typically, I thought, as a result of network
management tools) and therefore (b) anybody who really, really wants to
communicate securely needs to be using end-to-end encryption anyway.

So that if a LEA needs certain information that is obtainable by means of
some existing technology that some 'net-related entity has already deployed
for some purpose (network management, say), and the LEA can obtain
appropriate authorization from the government (in the US, a warrant), then
the 'net is already "tappable" to that extent.

This is analogous to noting that houses typically have doors; that doors
have locks; but locksmith tools (which can be used to change the setting on
the lock, or get a locked-out homeowner in) can be used to facilitate a
physical, clandestine search by a LEA

I can certainly imagine a debate about whether Internet protocols should be
changed/redesigned to make it harder than it now is to obtain data about the
flow and content of traffic on the net.  That would be analogous to the
"Lock Engineering Task Force" debating whether to set new lock protocols
that made them harder for locksmiths to pick.

But I thought the debate we were having was the quite different one of
whether the IETF should be taking affirmative steps to make the 'net *more*
tappable than it already is.

Chris S.
All opinions my own...

*************************************************************************** 
This electronic mail transmission may contain confidential or 
privileged information.  If you believe that you have received the 
message in error, please notify the sender by reply transmission 
and delete the message without copying or disclosing it. 
***************************************************************************