Subject: [sipping] comment on draft-polk-sipping-location-requirements-01.txt

From: PROUVOST Sébastien FTRD/DAC/ISS <[email-masked]>
Date: Mon, 8 Dec 2003 16:09:31 +0100

Hi,

I fully support the idea of having location information conveyed in SIP.

However, I fail to see in the draft a requirement for a proxy to be able to insert the location object on behalf of the UA. 
It is likely that in some cases terminals may not have this information. In some architectures, an outbound proxy may be able to retrieve this information (eg. Through a MIDCOM or COPS interface with an entity in the transport plane) and it is useful to allow such an outbound proxy to insert this location object.  

As stated in requirement E-3 regarding emergency calls, it may be a regulatory obligation for an operator to make this location information available to certain users. Operators may therefore be mandated to have this information inserted by proxies if the terminal does not insert it.

Regards,

Sébastien Prouvost
France Télécom R&D/DAC/CAR
http://www.francetelecom.com/rd

_______________________________________________
Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP
Use [email-masked] for questions on current sip
Use [email-masked] for new developments of core SIP

---

From: Michael Hammer <[email-masked]>
Date: Tue, 16 Dec 2003 11:02:18 -0500

Dick,

Not sure how it is in the UK or elsewhere, but in the US court cases have 
already  established that a caller to a 911 number has no right to privacy 
by the very nature of who they called.  In other words the act of calling 
911 waives those privacy rights.

But, to clarify an important point you bring out below, there may be 
multiple sources of the location information with varying degrees of 
accuracy.  A network based solution may be less accurate than say a GPS 
built into a mobile phone.  The network could be providing location service 
to the phone, which in turn reflects that location back in a 911/112 
call.  So, depending on circumstance there could be 2 measurements, with 
different degrees or accuracy due to tampering or just the difficulty of 
measuring.

I think it would be a mistake if the proxy over-wrote the location provided 
by the handset, if in fact the handset had better accuracy, or if the proxy 
had faulty data.  Best to provide both measurements to the emergency 
center.  If the locations agree, then they have a higher degree of 
confidence in the data.  If they disagree severely, then they could suspect 
tampering.  But, it could just be the odd canyon-effects some mobiles 
experience in cities with tall smooth symmetrically-aligned buildings (i.e. 
the canyon).  Legal consequences must deal with the former.

It would be bad if the network had a bad location measurement, the phone 
had a correct one, and the network suppressed it.  Could present liability 
problems for that network operator.

Mike

At 01:56 PM 12/16/2003 +0000, [email-masked] wrote:
>I think there is a mix up here.
>
>Location is needed for two reasons:
>Firstly to determine the correct emergency answering operator.
>Secondly to determine where to send the emergency response.
>
>If we don't get the first one right then there is no chance of even being 
>close on the second.
>
>But there is another requirement: avoiding abuse.
>
>It is well known that calling the fire brigade and claiming there is a 
>fire at the cremetorium is a supposedly funny gag that puts lives at risk 
>(as the emergency services must respond).
>Security is important in authorisation and location determination to 
>ensure that the information given is consistent.
>
>There are times when the terminal knows that it is not where the Proxy 
>thinks it is, but verification by the first proxy is an important factor 
>in verifying that this looks as though it is a genuine emergency call.
>
>Hence I conclude that the Proxy SHOULD be allowed to insert location 
>information (suitably protected) in order to assist in the verification 
>process. Also the teminal needs to be able to indicate that the proxy is 
>probably wrong (e.g. connected via a secure VPN tunnel to corporate intranet).
>
>Privacy is important to outsiders but not to a genuine emergency caller 
>wanting to share their location with an emergency operator (clearly a 
>trusted entity), and there are advantages in having a proxy verify that 
>the information is correct. This provides a real improvement to response 
>times (in the UK) by the emergency services (fire police ambulance etc.).
>
>Dick Knight
>
>-----Original Message-----
>From: [email-masked] [mailto:[email-masked]]On Behalf Of
>Rosen, Brian
>Sent: 12 December 2003 13:03
>To: 'PROUVOST Sébastien FTRD/DAC/ISS'
>Cc: [email-masked]; [email-masked]
>Subject: RE: [sipping] comment on
>draft-polk-sipping-location-requirements-01.txt
>
>
>I think that the issue is one of privacy control.  If some
>intermediary puts your location on the message without your
>consent, there is a significant breach of privacy.
>
>The emergency case is somewhat different, and we are looking
>into how best to accommodate it.  In general, our approach
>is to get the UA to know its location and report it with
>the call.  We understand the issue of authentication of
>location, and will need to assure that the location is accurate
>when a carrier knows what it is.   If the location is
>provided to the UA, and it chooses to NOT send it, I believe
>he should be allowed to do so.  There are several ways the UA
>could learn its location from some other entity.  One of them
>is DHCP (for a non-mobile UA).
>
>Do you see any problem with that approach?
>
>Brian
>
> > -----Original Message-----
> > From: PROUVOST Sébastien FTRD/DAC/ISS
> > [mailto:[email-masked]]
> > Sent: Monday, December 08, 2003 10:10 AM
> > To: [email-masked]; [email-masked]
> > Cc: [email-masked]
> > Subject: [sipping] comment on
> > draft-polk-sipping-location-requirements-01.txt
> >
> >
> > Hi,
> >
> > However, I fail to see in the draft a requirement for a proxy
> > to be able to insert the location object on behalf of the UA.
> > It is likely that in some cases terminals may not have this
> > information. In some architectures, an outbound proxy may be
> > able to retrieve this information (eg. Through a MIDCOM or
> > COPS interface with an entity in the transport plane) and it
> > is useful to allow such an outbound proxy to insert this
> > location object.
> >
> > As stated in requirement E-3 regarding emergency calls, it
> > may be a regulatory obligation for an operator to make this
> > location information available to certain users. Operators
> > may therefore be mandated to have this information inserted
> > by proxies if the terminal does not insert it.
> >
> > Regards,
> >
> > Sébastien Prouvost