Subject: RE: [Raven] Comments on Draft -- Take 2

From: Chris Savage <[email-masked]>
Date: Mon, 7 Feb 2000 15:22:05 -0500

>-----Original Message-----
>From: chefren [mailto:[email-masked]]
>Sent: Monday, February 07, 2000 1:35 PM
>To: [email-masked]
>Subject: RE: [Raven] Comments on Draft -- Take 2
>
>
>On 7 Feb 00, at 12:13, Chris Savage wrote:
>
>> Some time ago I pointed out that to actually determine the degree of
>> difference/overlap between the legal requirements of various 
>countries
>> would entail a non-trivial amount of lawyer time and effort. 
> That said,
>> due to various quirkiness-es of US law, I would suspect that 
>what CALEA
>> will require for particular carriers/manufacturers will be 
>different from
>> what other countries will require.
>
>IETF should look primarily at technical side of the 
>problem, that's pretty simple: pass al information to and 
>from an IP address without changing the information. The 
>information should be encapsulated in a timestamped package 
>with details like who had set the tap, which warrant, 
>checksums against modifications and so on. Not that 
>difficult.

You can't avoid the legal problems, unfortunately.

The solution you just described -- ship all the data to someone (LEA?) who
will agree to only look at the stuff they are entitled to -- would probably
affirmatively violate CALEA in the US, which requires (lots of glossing over
of details here) giving the LEAs what they are entitled to, but not more
than they are entitled to.  In the case of IP addresses, most consumers here
(targets of taps) access the 'net via dial-up, and ISPs typically
dynamically assign IP addresses to dial-up users.  So I don't see how your
proposal would give the LEAs either (a) all the information regarding
someone they are legitimately tapping (different IP addresses for different
sessions) or (b) only the information they are entitled to (since different
users would have the same IP address over time).

The discussion above has at least met, and probably exceeded, my actual
technical knowledge.  But if it is even remotely right, your solution might
be okay under Dutch law, or some other country's law, but I don't think it
would cut it in the US.  Here the FCC is in court defending a decision to
approve, on what amounts to an interim (and probably
never-to-be-implemented) basis, a system where the LEA gets full packets
to/from a target when their authorization extends only to address
information, not content.  So you can imagine what would happen with a
system that gave full packets from lots of people in order to allow the
capture of data relating only to one or a few...

>> So, to answer your question directly, no, AFAIK my 
>>proposition has not
>> been "tested" -- the "testing" is what would take a bunch of 
>>lawyers a
>> bunch of (high-cost) hours to confirm.  But it strikes me as 
>>having a very
>> high likelihood of being true.
>
>I don't see the necessity of a bunch of lawyers. This can 
>and should be handled strictly as a technical problem.

This is probably where you experience the greatest disconnect with a lot of
other people on the list, IMHO.  I suppose if we define the problem as,
"What's the most technically efficient way to ensure that LEAs get all the
data they need to find any Bad Guy they need to find?" that's (largely) a
technical problem. But it assumes that the goal of the exercise is as
stated, i.e., that LEAs' data needs are captured by: "getting them all the
data they need..."  In fact, LEAs' data needs (in practical terms) are
constrained by what their respective national laws authorize them to
collect.  Hence the need to know what the laws are.  Hence the need for
lawyers.  (Hey, don't feel so bad.  Most lawyers acknowledge that they need
engineers...)

>> >I see a strong kind of "not invented here" resistance.
>> >
>> >There is no will to think about what wiretap standard could 
>> >be there is only an "against".
>> 
>> It seems to me that the predominant opinion on the list is that
>> wiretapping by LEAs is a (maybe) necessary evil, but plainly 
>> an evil that
>> the IETF should not facilitate.
>
>"Maybe necessary" or "necessary"? That's no question. It is 
>necessary and not up to IETF to decide. It's up to 
>governments and important ones have decided.

My earlier posting was trying to summarize what I think is the consensus of
the list.  You, obviously, disagree (as is your right).  But I think my
summary is more or less an accurate description of what people have stated
here, your disagreement with those statements notwithstanding.

>> Also, that any "legal" wiretapping regime
>> could be abused by either oppressive authorities (insert 
>>your favorite
>> villainous regime here) or by out-of-sanction LEAs (the LAPD 
>>example), not
>> to mention random Bad Guys who somehow get in a position to use the
>> capability.
>
>Since when is the IETF interested in the message? Or in 
>this case specific use of the Internet?

Interesting question.  I think that the Internet community writ large has
long been interested in various uses of the Internet.  As to the IETF's
interest, I think that is explained in the draft...

>> This leads to a consensus that on the whole facilitating the
>> process from a technical perspective is, net-net-net, a Bad Thing, as
>> opposed to a Good Thing.
>
>That's not upon IETF, IETF shouldn't be a political 
>organization.

But it has been asked, in essence, a political question, to which it is, in
its own techie-oriented way, crafting a political response.  That doesn't
make it "a political organization."  That simply means that politics has
impinged on what it does.  In the grand scheme of things, I take this as an
indicator that the 'net is, indeed, continuing to "grow up."

>> The point at this late stage of the discussion 
>
>Late? The proposed text has nothing to do with a solution 
>for the real problem. We still have to start...

Here again, I think there is a disconnect between the problem you see (see
above for my attempt to capture it) and the problem the IETF sees.

>> is not to claim that your
>> counter-arguments have zero persuasive power.  Perhaps by 
>virtue my own
>> (lawyer) training (every issue has at least two sides), it 
>seems clear to
>> me that the persuasive power of your arguments is well above 
>zero.  Even
>> so, those arguments have failed, in this forum, to persuade very many
>> people. Again, maybe due to my training, the notion that 
>good, sensible
>> arguments might lose (and, yes, I know some on the list 
>would not credit
>> yours in that way) is not shocking -- it happens every day.
>
>No problems with that here...
>
>> Either because better, more sensible arguments prevail,
>> or because the decision-maker perceives the actual issue
>> to be one as to which the arguments are not quite as
>> strong or relevant as their proponent would like. 
>
>The decision-maker, IETF, has made standards for a long 
>time happily with little or even no interference with laws. 
>Unfortunately(!) that has ended. The current stuborness of 
>IETF may well be described as childish...

Actually, I think it shows considerable restraint and maturity.

It would have been a different matter if (say) ARPA had originally conceived
of the network it was supporting/inventing as primarily a communications
tool for governments.  If ARPA had demanded that the requisite protocols
being developed (more or less) on its nickel included tappability, and the
ARPA-funded researchers had said "no," that would probably have been
childish.  But the days are long past when the 'net and its protocols could
remotely be considered to be under government "control" or "ownership."  The
guts of the 'net -- the routers, the servers, the pipes -- are owned and
controlled by private parties.

So all the normal concerns attendant on government trying to get private
parties to do things -- is this legal?  who will bear the cost?  -- applies
to making the (current) 'net more easily tappable.

<snip>

Chris S.
All views/opinions my own

*************************************************************************** 
This electronic mail transmission may contain confidential or 
privileged information.  If you believe that you have received the 
message in error, please notify the sender by reply transmission 
and delete the message without copying or disclosing it. 
***************************************************************************

_______________________________________________
raven mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/raven

---

From: "chefren" <[email-masked]>
Date: Mon, 7 Feb 2000 23:12:43 +0100

> than they are entitled to.

That's important basics for serious tapping, not tapping 
streams or data of other channels. "Sleepnet fishing" is 
out of the question.

> In the case of IP addresses, most consumers here

Right!!!

So this is why central, IETF, standards are necessary.

Take your example, the equiment that receives a dial-in-
call and checks name and password has to program the 
routers dynamically. Not very difficult but definitely 
needs standards.

> would cut it in the US.

True for here too. And the worst part is: The law states 
the providers have to serve all this around December, after 
a 2 year "grace" period.

Without good standards it's impossible so what happens: A 
very bad kludge of solutions will appear that definitely do 
nothing good for privacy.

> Here the FCC is in court defending a decision to

That should be prevented.

Now the access providers, typically more or less low-tech 
guys that buy high end hardware and software, have the law 
that presses them to do it good and the industry that 
doesn't deliver because lacking standards.

..

> other people on the list, IMHO.

  Probably "the other people on the list" were never
  involved in design for tapping before. My company met
  telephone tapping by accident 10 years ago because our
  digital recording machines had better sound reproduction
  quality than other machines with 2 times compression and
  the SCSI storage technology was flexible enough to store
  so much on a tape that lots of things could be automated
  in a way that prevented recording errors, exchange of
  data between different cases, editing of tapes and more. 

> I suppose if we define the problem as,

As I mentioned earlier, often Law Enforcement only wants 
traffic data, just because it's too costly to make reports 
of more.

..

> the list.  You, obviously, disagree (as is your right).

It makes little or no sence in a discussion to write was 
already written...

> But I think my summary is more or less an accurate
> description of what people have stated here, your
> disagreement with those statements notwithstanding. 

No problem... I think lots of people here do their best in 
their own way.

..

> interest, I think that is explained in the draft...

I have to give in that I haven't read even 50% of RFC's but 
this seems one of the most =political= pieces ever to me...

> its own techie-oriented way, crafting a political response.

I think it is =made= a political question.

..

> to making the (current) 'net more easily tappable.

Long ago solved here, costs will go to the industry. Like 
with chemical factories: One that creates a problem pays 
for it. (uh oh...)

+++chefren

---

From: Ed Stone <[email-masked]>
Date: Mon, 07 Feb 2000 18:15:45 -0500

"Half of that money, $120 million, will come
from the Department of Defense's
"national security" budget -- a move that
alarms privacy groups.

"The proposal to use thinly disguised
intelligence agency money to fund CALEA
confirms what we have suspected all
along: the National Security Agency is a
silent partner in the government's
campaign to make our entire
telecommunications system, including the
Net, wiretap ready," says Barry
Steinhardt, associate director of the
American Civil Liberties Union."

Source: http://www.wired.com/news/politics/0,1283,34164,00.html

--
--------------------------
Ed Stone
[email-masked]
--------------------------

---

From: "chefren" <[email-masked]>
Date: Tue, 8 Feb 2000 01:07:23 +0100

On 7 Feb 00, at 18:15, Ed Stone wrote:

> "Half of that money, $120 million, will come from the
> Department of Defense's "national security" budget -- a
> move that alarms privacy groups. 
> 
> "The proposal to use thinly disguised intelligence agency
> money to fund CALEA confirms what we have suspected all
> along: the National Security Agency is a silent partner
> in the government's campaign to make our entire
> telecommunications system, including the Net, wiretap
> ready," says Barry Steinhardt, associate director of the

Thanks Ed!

  IETF: please help get this all out of the dark as soon
  as possible by OPEN STANDARDS!!! 

  =THINK=!!! 

+++chefren