Subject: RE: [Sipping] calling number blocking at sip/isup gateway

From: "Christian Huitema" <[email-masked]>
Date: Fri, 25 Jan 2002 09:07:13 -0800

Judging me naïve, Mark Watson wrote:

> I have to say I am amazed too. But by the idea that the privacy 
> regulations we see in the PSTN/ISDN may not apply in the SIP world. These 
> stem from technology-neutral Data Protection legislation which applies as > much to SIP as to ISUP or TUP.

In fact, Mark's message contains a number of hidden assumptions that are well worth debunking.

A first assumption is that there is a "SIP world". With all due respect to this working group, this is by no means obvious. SIP is an Internet protocol that, in its simplest form, can be used directly between two Internet hosts, providing host names are registered in the DNS. The world there is the Internet, not SIP.

A second assumption is that the technology neutral doctrine applies, i.e. if I perform operation X over the Internet, then surely I am subject to the same rules as if I performed operation X over the telephone network. There are two problems with that rule, the fact that technology actually matters to legislation, and then the fact that that the regulation is generally tied to some form of public licensing, which actually varies with the technology.

If you thing that technology does not apply, then please consider the different regulations of postal services, telephony, broadcast TV, cable TV, press, and book publishing. SIP is in some aspects close to ISUP, since you can indeed gateway a phone call to the Internet using SIP; SIP is also in many ways closely related to e-mail, since a SIP header is pretty darn close to a mail header. Which regulation should we apply? That of telephone companies that are requested to provide law enforcement with facilities such as pen register or intercept, or that of postal services that definitely do not keep track of who sends mail to whom, and in which intercept is only practiced by dictatorships or war-time exceptions?

The laws regulating phone services are aimed at telephone service providers, not users. They do not apply, for example, to citizen band radios or private phone services. Assuming that the same laws apply is also assuming that the same structure applies, i.e. that the SIP calls are only possible through some kind of "SIP service" that would be provided by modern days equivalent of phone companies. This is not the way the Internet is organized today: SIP or VoIP packets are just some packets among many that are facilitated by the packet level service provided by an ISP. If a regulation targeted the third party, then it could indeed target those ASP that specifically set up to organize SIP proxies, but it would also have to target the generic ISPs that just carry IP traffic. This is going to be an interesting debate.

If we want to make anonymous SIP calls today, we must either use an "anonymizer" service, or use UA and network tricks. The cypherpunk and anon.fi experience leaves me quite skeptical with anonymizer relays: they tend to be abuse, or to become a magnet for law enforcement. If we really want anonymity, we should start at the UA, and allow it to make up some form of phony "From" line. We must also make sure that we use an anonymous IP address, possibly using the privacy extensions to IPv6.

-- Christian Huitema

_______________________________________________
Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP
Use [email-masked] for questions on current sip
Use [email-masked] for new developments of core SIP

---

From: [email-masked]
Date: Fri, 25 Jan 2002 12:38:22 -0500

From:  Tom Gray@MITEL on 01/25/2002 12:38 PM

In Canada at least the postal service can and does monitor who sends mail to
whom for law enforcement purposes. Indeed they can open letters which weigh more
than 30 grams to look for contraband such as false immigration documents. Canada
is not a dictatorship and these regulations are not war time exceptions. From
reports deriving from the controversy that this has caused in Canada, I gather
that this is not an atypical national system of mail monitoring.

What you are saying is that multiple sets of regulations could potentially apply
and that we cannot know aforehand how regulations would be adapted to a
multimedia world (not the Internet world). It is probably true that legislatures
will have to work on the problem of privacy for a system that can foster a
variety of media types (synchronous, semi-synchronous, asynchronous,
distributive etc.) However this is a problem for parliamentarians who I expect
will have little interest in ideas that service offerings on the Internet are
somehow different than all others and should not be subject to privacy
regulations.

"Christian Huitema" <[email-masked]> on 01/25/2002 12:07:13 PM

To:   "Mark Watson" <[email-masked]>, "Juha Heinanen"
      <[email-masked]>, "Dean Willis" <[email-masked]>
cc:   [email-masked] (bcc: Tom Gray/Kan/Mitel)

Subject:  RE: [Sipping] calling number blocking at sip/isup gateway

> stem from technology-neutral Data Protection legislation which applies as >
much to SIP as to ISUP or TUP.

In fact, Mark's message contains a number of hidden assumptions that are well
worth debunking.

A first assumption is that there is a "SIP world". With all due respect to this
working group, this is by no means obvious. SIP is an Internet protocol that, in
its simplest form, can be used directly between two Internet hosts, providing
host names are registered in the DNS. The world there is the Internet, not SIP.

A second assumption is that the technology neutral doctrine applies, i.e. if I
perform operation X over the Internet, then surely I am subject to the same
rules as if I performed operation X over the telephone network. There are two
problems with that rule, the fact that technology actually matters to
legislation, and then the fact that that the regulation is generally tied to
some form of public licensing, which actually varies with the technology.

If you thing that technology does not apply, then please consider the different
regulations of postal services, telephony, broadcast TV, cable TV, press, and
book publishing. SIP is in some aspects close to ISUP, since you can indeed
gateway a phone call to the Internet using SIP; SIP is also in many ways closely
related to e-mail, since a SIP header is pretty darn close to a mail header.
Which regulation should we apply? That of telephone companies that are requested
to provide law enforcement with facilities such as pen register or intercept, or
that of postal services that definitely do not keep track of who sends mail to
whom, and in which intercept is only practiced by dictatorships or war-time
exceptions?

The laws regulating phone services are aimed at telephone service providers, not
users. They do not apply, for example, to citizen band radios or private phone
services. Assuming that the same laws apply is also assuming that the same
structure applies, i.e. that the SIP calls are only possible through some kind
of "SIP service" that would be provided by modern days equivalent of phone
companies. This is not the way the Internet is organized today: SIP or VoIP
packets are just some packets among many that are facilitated by the packet
level service provided by an ISP. If a regulation targeted the third party, then
it could indeed target those ASP that specifically set up to organize SIP
proxies, but it would also have to target the generic ISPs that just carry IP
traffic. This is going to be an interesting debate.

If we want to make anonymous SIP calls today, we must either use an "anonymizer"
service, or use UA and network tricks. The cypherpunk and anon.fi experience
leaves me quite skeptical with anonymizer relays: they tend to be abuse, or to
become a magnet for law enforcement. If we really want anonymity, we should
start at the UA, and allow it to make up some form of phony "From" line. We must
also make sure that we use an anonymous IP address, possibly using the privacy
extensions to IPv6.

-- Christian Huitema

---

From: William Marshall <[email-masked]>
Date: Mon, 28 Jan 2002 09:20:07 -0500 (EST)

At least some aspects of this discussion seem to belong on the
sip list, instead of sipping.

The coded secret and the decoder ring is certainly appropriate
in many cases. However, we need to recognize that there will be deployments
of SIP proxies in managed networks where request routing is tightly
controlled, IPsec or TLS is used between proxies, and the additional
overhead of encryption and key management is not warranted.

As such, the specification needs to describe two techniques for
passing identity information, both the wisper and the decoder ring.
The provider operating the proxies should be the one to decide which
mechanism is appropriate.

Bill Marshall
[email-masked]

-----original message-----
From: Dean Willis <[email-masked]>
Subject: Re: [Sipping] calling number blocking at sip/isup gateway
Date: Fri, 25 Jan 2002 13:57:33 -0600
Cc: <[email-masked]>

On Friday 25 January 2002 12:08 pm, Matt Holdrege wrote:
> So the result is that if a call comes from the PSTN to a SIP phone
> and the caller requests privacy, then the SIP service provider must
> honor the request. Equally it may apply that if a SIP user calls the
> PSTN and requests privacy, the PSTN must honor it.

The problem here is that both of these scenarios imply transitive trust 
"into the next world", and personally, my left brain doesn't have 
transitive trust with my right brain so I'm likely to be suspicious of 
the trusting . . .

How about: 

"If a call comes from the PSTN to a SIP phone and the caller requests 
privacy, then the PSTN gateway provider must honor the request.   
Equally it may apply that if a SIP user calls the PSTN and requests 
privacy, the SIP to PSTN gateway must honor it."

This is subtly different from Matt's  wording. It more precisely 
allocates the responsibility.

It's like the old kids game of telling a secret to a friend, then 
saying "don't tell anybody". Of course they tell somebody, then 
immediately tell that person "don't tell anybody", and the secret 
propapgates outward at the speed of voice relay, still carrying it's 
"privacy request" until the signal has degraded to the point where the 
always-useles privacy request fades away and is dropped from the 
message.

Consider instead the model of "Here's a coded secret, and a decoder 
ring". The receiver can pass the message on, but unless they take steps 
to also distribute the decoder ring, the information is not 
compromised. People being fundamentally lazy, they're less likely to 
make a copy of the decoder ring to send along too.

The PSTN to SIP gateway case may pass the confidential information on 
openly (since it's a trusting "closed" network, haha), but as soon as 
weg get to a potentially open network (i. e., IP) the information must 
be restricted to the privileged few who know the code. 

--
dean

---

From: "Tom-PT Taylor"<[email-masked]>
Date: Tue, 29 Jan 2002 13:42:45 -0500

Well, the overall requirement is clear, but I think it breaks down into two
different sets of requirements, on SIP and on the SIP-PSTN gateway.

For SIP:

(1) A requirement to provide some means whereby a PSTN gateway can obtain
the authenticated identity of the SIP host.  I say host rather than user
because I can't see regulators requiring SIP to provide more than the PSTN
does now.  

(2) Another requirement to provide the means whereby a PSTN gateway can
determine if the SIP user wishes to restrict the presentation of his/her SIP
identity.

At the gateway the requirements will be the same whether the signalling
protocol is SIP, H.323, or something else. 

(1) A requirement on the gateway to provide the information within the PSTN
signalling which satisfies regulatory requirements.

(2) A requirement to report the authenticated identity of the IP host in
specific cases e.g. for malicious call trace.

(3) A requirement to support billing arrangements.

(4) A requirement to extract appropriate display information and pass it in
ISUP signalling if the user has not requested privacy.

-----Original Message-----
From: Juha Heinanen [mailto:[email-masked]]
Sent: Tuesday, January 29, 2002 11:17 AM
To: Taylor, Tom-PT [CAR:B800:EXCH]
Cc: [email-masked]'; [email-masked]
Subject: [Sipping] RE: calling number blocking at sip/isup gateway

Tom-PT Taylor writes:

 > What about UACs
 > which do not have telephone numbers assigned?  Will they be barred from
PSTN
 > access, or should we mandate that the gateway assign some sort of number
 > which it alone can cross-correlate to the original user@domain if need be
 > for malicious call trace, etc.?

yes, either way.  in finland we are not allowed to gateway any call to
pstn unless it has a valid from number (either of the user or the
gateway) and if we place the gw's number there, we must be able to
answer the question, which of the gw's subscribers actually made the
call.  in addition, the law requires the gw to mark the presentation of
the from number of all calls from the subscriber as "restricted" if
asked so by the subscriber.

if sip doesn't have means to implement the above, then there is no
gatewaying of sip calls to pstn in finland and there is no business case
for us until sip starts to take over the world, which will take a few
years at least.  all i want is for a proxy a way to mark the from number
of the invite as "restricted" without touching the from header AND i
want the chosen way to be clearly documented in the sip-isup i-d so that
i don't have to tell each sip/ss7/proxy vendor separately, how it is
done.

what method you choose to do it, is not my business, since i'm just
a stupid user of the sip protocol.

-- juha

---

From: Michael Hammer <[email-masked]>
Date: Tue, 29 Jan 2002 14:09:04 -0500

Tom,

Given the wireless world and the possibility that there is a distinction 
between the host platform and the subscriber/user, wouldn't it be better to 
identify the subscriber?  There is also technology that allows a user to 
log into and personalize terminals for their use.  Or in some cases, the 
user, the subscriber, and the terminal could all be different.

Presumably, the SIP UA that originates the call has an identity and a 
subscription with a service provider that authorizes the call.  Could we 
focus terminology on the subscriber as that may be all that is known to the 
network?

Mike

---

From: "Peterson, Jon" <[email-masked]>
Date: Tue, 29 Jan 2002 13:22:40 -0600

Moved to SIPPING...

My overall point was that I don't believe the current text of
draft-ietf-sipping-isup-00 requires any modification for a privacy
mechanism. I think that Dean's example amply illustrates the fact that one
can use the mapping as it stands - there are real telephone providers today
that can and will interface with gateways that implement roughly those
SIP-ISUP mappings. 

The document acknowledges the need for a general privacy mechanism for SIP.
However, I think it would be mistake to attempt to solve that problem (or a
more limited-scope telephony problem) in sipping-isup-00. I also don't think
it's necessary to block the progress of sipping-isup-00 until the general
privacy mechanism is complete. As is the case with early media, a separate
draft could later detail the implications of a proposed general privacy
mechanism to the SIP-ISUP mapping problem.

IMHO, the existing text is sufficient to interwork with the PSTN, and down
the line, we'll develop a generic privacy mechanism that will add the
privacy feature to SIP's vocabulary not just for ISUP interworking but for
session initation in general.

Jon Peterson
NeuStar, Inc.

> From: [email-masked] [mailto:[email-masked]]
> Sent: Tuesday, January 29, 2002 5:28 AM
> To: [email-masked]; [email-masked]
> Subject: Re: [Sip] calling number blocking at sip/isup gateway
> 
> 
> In a message dated 1/27/02 4:56:48 PM Eastern Standard Time, 
> [email-masked] writes:
> 
> > What a long thread.
> 
> > etc.
> 
> Jon,
> 
> Great summary of what is needed and what is not. There have 
> been a lot of 
> protocol hacks mentioned in the last week, including putting 
> a "bogus url" in 
> the From header or having the gateway replace the real 
> calling party number 
> with some "gateway number". Also there have been suggestions 
> that, somehow, 
> encryption was part of the solution for privacy of calling 
> party ID and that 
> a "coded secret and a decoder ring" could be used. But 
> encryption would only 
> address the issue of preventing someone in the middle from 
> seeing the ID, 
> which is not the issue here. In the general case, we're 
> talking about a 
> calling line ID capability for which the calling and called 
> party have 
> nothing in common, certainly not a shared secret.
> 
> I agree, there is certainly the case in which there is simply 
> no Calling 
> party number in the signaling (e.g., From=anonymous in the 
> INVITE) when one 
> element doesn't trust the next to preserve privacy. But there 
> is the other 
> case in which it trusts the next network element and includes 
> the ID (maybe 
> because the law or the network policy requires it) and it 
> also includes an 
> indicator of what privacy procedures apply. If every network 
> portion is 
> trusted, the ID can be passed to the final "switch" which 
> then doesn't 
> deliver it to the called party. So just because you get 
> "unavailable" on your 
> Caller-ID screen doesn't mean that it wasn't in the IAM, but 
> it could. Of 
> course, the problem for SIP is the possible absence of any 
> trusted device 
> that functions as the final "switch".
> 
> However, because of other security concerns, a real IP 
> telephone service 
> provider would require that it knows the identity of the 
> calling party and 
> the model for this service must be based on a presumption 
> that the calling 
> party can trust the service provider. Therefore, in this 
> case, the From must 
> contain a correct number, and the gateway may remove it 
> (after verifying it).
> 
> The case of the calling party leaving out the From can not be 
> used in a 
> "tariffed" (if I can use that term) telephone service. While 
> the SIP protocol 
> may allow it to be left out, the service provider may require 
> it before 
> allowing call setup.
> 
> I think this whole discussion should be taken to the SIPPING 
> list until there 
> is an agreement on the functional requirements.
> 
> Mike
> 
> 
>

---

From: "Tom-PT Taylor"<[email-masked]>
Date: Tue, 29 Jan 2002 15:43:19 -0500

"Subscriber" implies that the SIP user has subscribed to some service
somewhere.  I suppose this is a reasonable assumption for SIP-ISUP
interworking, though I could imagine scenarios where it might not apply.
Very well, the first SIP requirement becomes:

(1) SIP must provide a way for the gateway to determine the authenticated
identity of the SIP subscriber in whose name the call is being made.

-----Original Message-----
From: Michael Hammer [mailto:[email-masked]]
Sent: Tuesday, January 29, 2002 2:09 PM
To: Taylor, Tom-PT [CAR:B800:EXCH]
Cc: 'Juha Heinanen'; [email-masked]'; [email-masked]
Subject: RE: [Sipping] RE: calling number blocking at sip/isup gateway

Tom,

Mike