Subject: [Raven] Fwd: I-D ACTION:draft-ietf-iab-raven-00.txt

From: Paul Ferguson <[email-masked]>
Date: Wed, 02 Feb 2000 08:04:12 -0500

FYI.

- paul

>To: IETF-Announce:;
>Cc: [email-masked]
>From: [email-masked]
>Reply-to: [email-masked]
>Subject: I-D ACTION:draft-ietf-iab-raven-00.txt
>Date: Wed, 02 Feb 2000 06:35:51 -0500
>Sender: [email-masked]
>X-SPAM: Yes
>X-SPAM-REASON: Suspicious TO Address
>X-SMTP-HELO: loki.ietf.org
>X-SMTP-MAIL-FROM: [email-masked]
>X-SMAP-Received-From: outside
>X-SMTP-PEER-INFO: loki.ietf.org [132.151.1.177]
>
>A New Internet-Draft is available from the on-line Internet-Drafts 
>directories.
>This draft is a work item of the Internet Architecture Board Working Group 
>of the IETF.
>
>         Title           : IETF Policy on Wiretapping
>         Author(s)       : B. Carpenter, F. Baker
>         Filename        : draft-ietf-iab-raven-00.txt
>         Pages           : 8
>         Date            : 01-Feb-00
>
>The IETF has been asked to take a position on the inclusion into IETF
>standards-track documents of functionality designed to facilitate
>wiretapping.
>
>This memo explains what the IETF thinks the question means, why its
>answer is 'no', and what that answer means.
>
>A URL for this Internet-Draft is:
>http://www.ietf.org/internet-drafts/draft-ietf-iab-raven-00.txt
>
>Internet-Drafts are also available by anonymous FTP. Login with the username
>"anonymous" and a password of your e-mail address. After logging in,
>type "cd internet-drafts" and then
>         "get draft-ietf-iab-raven-00.txt".
>
>A list of Internet-Drafts directories can be found in
>http://www.ietf.org/shadow.html
>or ftp://ftp.ietf.org/ietf/1shadow-sites.txt
>
>
>Internet-Drafts can also be obtained by e-mail.
>
>Send a message to:
>         [email-masked].
>In the body type:
>         "FILE /internet-drafts/draft-ietf-iab-raven-00.txt".
>
>NOTE:   The mail server at ietf.org can return the document in
>         MIME-encoded form by using the "mpack" utility.  To use this
>         feature, insert the command "ENCODING mime" before the "FILE"
>         command.  To decode the response(s), you will need "munpack" or
>         a MIME-compliant mail reader.  Different MIME-compliant mail readers
>         exhibit different behavior, especially when dealing with
>         "multipart" MIME messages (i.e. documents which have been split
>         up into multiple messages), so check your local documentation on
>         how to manipulate these messages.
>
>
>Below is the data which will enable a MIME compliant mail reader
>implementation to automatically retrieve the ASCII version of the
>Internet-Draft.
>Content-Type: text/plain
>Content-ID:     <[email-masked]>
>
>ENCODING mime
>FILE /internet-drafts/draft-ietf-iab-raven-00.txt
>
><ftp://ftp.ietf.org/internet-drafts/draft-ietf-iab-raven-00.txt>

_______________________________________________
raven mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/raven

---

From: "Richard Payne" <[email-masked]>
Date: Wed, 2 Feb 2000 09:00:47 -0500

> >http://www.ietf.org/internet-drafts/draft-ietf-iab-raven-00.txt

The draft is eminently reasonable. Kudos to the authors.

Richard Payne

---

From: Ed Stone <[email-masked]>
Date: Wed, 02 Feb 2000 09:42:05 -0500

"Wiretapping is what occurs when information passed across the
Internet from one party to one or more other parties is delivered to
a third party:

1.   Without the sending party knowing about the third party

2.   Without any of the recipient parties knowing about the delivery
to the third party

3.   When the normal expectation of the sender is that his
information will only be seen by the recipient parties or parties
obliged to keep the information in confidence

4.   When the third party acts deliberately to target the
transmission of the first party, either because he is of interest,
or because the second party's reception is of interest.

<snip>

Thus, for instance, ... random monitoring is not wiretapping
(condition 4 violated)..."

Source: http://www.ietf.org/internet-drafts/draft-ietf-iab-raven-
00.txt

This is outrageous.

A third party taps a communication in secret, but the selection is
NOT targeted to a SPECIFIC person, so it is not "wiretapping". This
is simply incredible!

Example: Monitoring equipment is set to randomly monitor a
proportion of traffic through a specific device (say, Mae West).

No person or IP is targeted for monitoring, rather a machine selects
random IPs that meet the "proportion of traffic" setting. So the
"proportion of traffic" setting is set to .002% on Monday. Any
problem? The monitoring is not wiretapping because no one is
"targeted", right?

On Tuesday, the setting is set to 64.2%. Still no one is targeted,
right?

On Wednesday, the setting is set to 92.6%. No one is targeted,
right? The machine is picking IPs at random, right? So it's not
wiretapping, right?

So we are to understand that IETF thinks that it's not wiretapping
if you just tap damn near everyone, but don't target anyone?

We need a little rework here, I'd say.

And conspicuously absent is the description of the portion of the vote at 
the meeting that voted NO. Only the votes for and abstentions are 
subjectively quantified....
--
--------------------------
Ed Stone
[email-masked]
--------------------------

---

From: Christian Price <[email-masked]>
Date: Wed, 02 Feb 2000 10:48:33 -0700

Hear Hear!  This loophole is egriegious!

(still, my utmost respect to the people who drafted this)

-- 
--------.--------------------------------------.
 ------/     Christian Price                   /
  ----/     Assistant Technical Analyst       /
  ---/     Four Corners Area ITOT/OSA        /
  --/     SprintParanet, Phoenix Office     /
  -/     602-266-9242                      /
   '--------------------------------------'

---

From: Fred Baker <[email-masked]>
Date: Wed, 02 Feb 2000 11:20:04 -0800

>(condition 4 violated)..."

maybe you can offer some better text. What we were trying to say was that
when one puts a sniffer on an Ethernet for network management purposes for
a purpose unrelated to capturing a user's content (say, finding out what
percentage of traffic is HTTP vs how much is SMTP, example at
http://www.vbns.net/stats/flows/html), this was not wiretapping. The key
feature of wiretapping is not the capture of traffic, but the capture of
the content of traffic for the purpose of revealing that content in some way.

---

From: Ed Stone <[email-masked]>
Date: Wed, 02 Feb 2000 14:34:36 -0500

>the content of traffic for the purpose of revealing that content in some way.

I understand. I really suggest that the wording of the definition of 
wiretapping get some scholarly civil liberties lawyer attention.

For example, while capturing content for one purpose may be benign, that 
information is now available to secondary, possibly unintended usages. 
Examples are legion.

My suggested very rough first pass is along these lines:

Wiretapping is what occurs when

1. information passed across the Internet (including but not limited to 
wire-bound signals, wireless communications, microwave segments, and 
incidental RF emanations from equipment on the Internet or intervening 
communications carriers traversed by the information anywhere from origin 
point to any reception point, including but not limited to systems that 
connect to the Internet to enter, convey, or effect receipt of Internet 
communications [such as a user's PC, for example]) from one party to one or 
more other parties

2. is delivered to or intercepted by a third party

3. for purposes of manually or programmatically inspecting or analyzing or 
classification, or storing for subsequent possible or certain manual or 
programmatic inspection or analyzing or classification of that information,

4. including but not limited to non-aggregated traffic analysis, any of 
which may be isolated to a specific IP, specific machine or processor 
(including network card, interface or modem device or processor), specific 
instance or class of an application, sender or recipient

5.When the sending party does not fully voluntarily and overtly cause 
and/or authorize such delivery or interception for each specific event and 
for each specific usage applied thereto

or

6. When any of the recipient parties do not fully voluntarily and overtly 
cause and/or authorize such delivery or interception for each specific event

and

7.When each specific disclosure of information applied thereto is not 
within the legitimate authority of one or more of the intended recipients 
to provide such voluntary and open disclosure in the absence of any legal 
(criminal or civl) process that compels such disclosure or which provides 
duress to induce such disclosure

8. With the expectation of privacy and confidentiality between sender and 
recipients as the default assumption in all cases, voided only by an overt 
and knowledgeable fully voluntary declaration by sender or intended recipient

9.When the third party acts
a.  deliberately to intercept and/or collect, or in a manner which may 
reasonably be expected to intercept and/or collect (whether intentionally 
or as a by-product of another process)

b. at any point via any technical or other methodology

c. the information, regardless of whether the collection or interception is 
based on a general or broad collection or a targeted collection of information

d.  and regardless of whether the information is encrypted, compressed, or 
plaintext

e.  and regrdless whether the information is selected manually or 
programmatically or because of certain programmatically or manually 
determined characteristics or "profiling", frequency, orgin, destination, 
size, entropy of content, headers, specific instance or class of initiating 
application, specific instance or class of network interface or device or 
other machine or processor,or any other characteristics that may from time 
to time become discernable by technology or persons.

---

From: Declan McCullagh <[email-masked]>
Date: Wed, 02 Feb 2000 15:09:34 -0500

My own personal take (not as a journalist, just as a longtime Net user and 
observer of politics) is that shorter definitions are better. Nine clauses, 
with subsections a-e, are not necessarily going to make a document more 
clear and precise than something more succinct.

-Declan

At 14:34 2/2/2000 -0500, Ed Stone wrote:
>communications [such as a user's PC, for example]) from one party to one 
>or more other parties
>
>c. the information, regardless of whether the collection or interception 
>is based on a general or broad collection or a targeted collection of 
>information
>
>size, entropy of content, headers, specific instance or class of 
>initiating application, specific instance or class of network interface or 
>device or other machine or processor,or any other characteristics that may 
>from time to time become discernable by technology or persons.
>
>
>--

---

From: Harald Tveit Alvestrand <[email-masked]>
Date: Wed, 02 Feb 2000 23:22:01 +0100

>proportion of traffic through a specific device (say, Mae West).

.....

>right? The machine is picking IPs at random, right? So it's not

good - now you have 92.6% of the traffic going through Mae West on Wednesday.
Should be somewhere in the gigabyte to terabyte range - others might know.

Now attempt to get useful information about a specific person out of that, 
without targeting anyone.

The text attempts to differentiate between statistics and wiretaps by the 
"targeting" criteria, and includes the 3 phases of a wiretap:

- Capture
- Filtering
- Delivery

All phases must be considered before deciding whether a specific action
is a wiretap or not - if you capture the traffic, keep it for a while, and 
then do the filtering and delivery, I would consider the total process a 
wiretap.

                      Harald

--
Harald Tveit Alvestrand, EDB Maxware, Norway
[email-masked]

---

From: "chefren" <[email-masked]>
Date: Fri, 4 Feb 2000 01:46:22 +0100

> the content of traffic for the purpose of revealing that content in some way.

Capture of traffic and thus analysing who is communicating 
with who is a very important use of taps.

In The Netherlands law enforcement often chooses only 
traffic analysis first for organised crime. Since they are 
required to report =everything= they tap and that's costly 
even for simple telephone calls, they try to avoid that.

+++chefren

p.s. As Declan said: shorter is better / more effective

p.p.s. Typo: regrdless