Subject: [v6ops] IPv6 and 5G will make life hell for spooks and cops say Australia's spooks and cops • The Register

From: Brian E Carpenter <[email-masked]>
Date: Mon, 5 Mar 2018 14:19:27 +1300

Success at last :-)

http://www.theregister.co.uk/2018/02/27/ipv6_5g_complicate_gathering_evidence_and_surveillance/

Regards
   Brian

---

From: Ca By <[email-masked]>
Date: Mon, 05 Mar 2018 01:58:54 +0000

> http://www.theregister.co.uk/2018/02/27/ipv6_5g_complicate_gathering_evidence_and_surveillance/

Sad the Australian government is subject to this level of missinformation.
  They essentially copied some ill conceived dogmas from 2003 and ignored
practical deployments.

1. Encryption has nothing to do with ipv6, full stop. As a practical
matter, ipv6 means nothing for crypto.  Modern day consumer crypto is a
layer 7 matter (https)

2.  The idea that ipv6 reduces attribution is literally ludicris. No
elaboration needed. I have first hand knowledge in this space.

Also sad that El Reg progates this misinformation.

> _______________________________________________
> v6ops mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/v6ops
>

---

From: Mark Andrews <[email-masked]>
Date: Mon, 5 Mar 2018 13:15:07 +1100

You missed the point.  Technically illiterate government bodies are now paying attention to IPv6.  It’s gone mainstream. The AGD repeatedly demonstrates this level of technical illiteracy.

Now if they were to mandate that ISP’s had to hand out /48’s to customers to reduce the processing load that might be a good thing overall (there are pros and cons).  It’s this mis-mash of prefix sizes that makes attributing a IPv6 address to a customer harder, not the number of addresses.

Mark

> On 5 Mar 2018, at 12:58 pm, Ca By <[email-masked]> wrote:
> 
> 
> On Sun, Mar 4, 2018 at 5:19 PM Brian E Carpenter <[email-masked]> wrote:
> Success at last :-)
> 
> Sad the Australian government is subject to this level of missinformation.   They essentially copied some ill conceived dogmas from 2003 and ignored practical deployments. 
> 
> 1. Encryption has nothing to do with ipv6, full stop. As a practical matter, ipv6 means nothing for crypto.  Modern day consumer crypto is a layer 7 matter (https)
> 
> 2.  The idea that ipv6 reduces attribution is literally ludicris. No elaboration needed. I have first hand knowledge in this space. 
> 

-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742              INTERNET: [email-masked]

---

From: Tom Herbert <[email-masked]>
Date: Sun, 4 Mar 2018 19:29:47 -0800

> http://www.theregister.co.uk/2018/02/27/ipv6_5g_complicate_gathering_evidence_and_surveillance/
Brian,

With current address assignment techniques I believe the opposite
true. It is easier to track individuals when IPv6 is used than when
CGNAT is used (Europol has acknowledged that). The problem with it
being easy for law enforcement to track individuals is that its also
going to be easy for bad guys to do it also-- so there is a privacy
issue. We raise this issue in
draft-herbert-ipv6-prefix-address-privacy-00 and will probably talk
about the draft in int-area meeting in London if you're interested.

Tom

---

From: Ca By <[email-masked]>
Date: Mon, 05 Mar 2018 03:53:25 +0000

> about the draft in int-area meeting in London if you're interested.

There are 2 specific issues at play here.

One is traceability. With ipv6, it is possible for LEA to issue a warrant
to facebook to find out which address accessed the account, and then with
that address, issue a warrant to the isp to get an account / identity /
location.

I am fine with all that above.

The accounting of all connections is a different issue i am not ok with,
and these accounting are likely in any central NAT box.

With CGNAT, the isp has a full session log of every outbound connection you
make. The isp may sell this session log to advertisers or worse that may
want to understand your “digital life”.

Also, the session log is discoverable with warrant for all your activity,
not just as a subsequent investigation of an identity.

And, hackers may have access to that session log.

So, CGNAT / ILA is much much more dangerous, in my experience.

That said Aussies know what they have and know what they are giving up.

---

From: Tom Herbert <[email-masked]>
Date: Sun, 4 Mar 2018 20:11:18 -0800

On Sun, Mar 4, 2018 at 7:53 PM, Ca By <[email-masked]> wrote:
> One is traceability. With ipv6, it is possible for LEA to issue a warrant to
> facebook to find out which address accessed the account, and then with that
> address, issue a warrant to the isp to get an account / identity / location.
>
> The accounting of all connections is a different issue i am not ok with, and
> these accounting are likely in any central NAT box.
>

Ca,

A provider has all the information about users and addresses they are
assigned as well as packet log traces if they wish. That's in the
nature of their operations. There's not much we can do protocol wise
if they are carelessly or maliciously divulging information about
users, that is more in the realm of contracts and legalities. However,
we can address the issue of third parties being able to make
inferences when they don't have access to the data.

Also, the Europol bulletin seems to indicate that ISPs aren't
necessarily providing all the data needed for their investigations.
There seems to be a gap here with the idea that ISPs are already
giving law enforcement everything they need.

Tom

---

From: Ted Lemon <[email-masked]>
Date: Sun, 4 Mar 2018 23:14:28 -0500

On Mar 4, 2018, at 11:11 PM, Tom Herbert <[email-masked]> wrote:
> assigned as well as packet log traces if they wish.

This is true, but of course if you have a CGN in place, then it _has_ to track this information, and you've already spent the money, so getting the logs is "free."   If you don't have a CGN in place, tracking all of the connections made through a particular customer's connection requires you to spend money.   ISPs tend not to do that if there's nothing in it for them.

---

From: Alexandre Petrescu <[email-masked]>
Date: Mon, 5 Mar 2018 14:16:32 +0100

Well, if 5G IPv6 is a hell for spooks and cops then 4G IPv4 was a hell 
too: nobody tracks people by IP addresses in cellular networks.

In cellular networks people are tracked by their phone numbers, 
basestation id and good timestamps.  These stay the same in 5G.

Cops may want to use IP addresses to track DDoS sources but that's not 
issued from a mobile network(?)

I am not even sure that 5G will use IPv6 :-)

Alex

---

From: Mikael Abrahamsson <[email-masked]>
Date: Wed, 7 Mar 2018 08:33:17 +0100 (CET)

> too: nobody tracks people by IP addresses in cellular networks.

The information about who had what address at what time is typically kept, 
so that an IP address can be tracked back to a subscription. In IPv6, this 
is done by prefix and not by address in a 3GPP network (since a /64 is 
used per PDP).

-- 
Mikael Abrahamsson    email: [email-masked]

---

From: Alexandre Petrescu <[email-masked]>
Date: Thu, 8 Mar 2018 11:45:05 +0100

Le 07/03/2018 à 08:33, Mikael Abrahamsson a écrit :
>> Well, if 5G IPv6 is a hell for spooks and cops then 4G IPv4 was a
>> hell too: nobody tracks people by IP addresses in cellular
>> networks.
> 
> The information about who had what address at what time is typically
>  kept, so that an IP address can be tracked back to a subscription.

YEs that information is typically kept, but it's complex to use to track
someone because it changes all the time at each handover or re-connection.

> In IPv6, this is done by prefix and not by address in a 3GPP network
> (since a /64 is used per PDP).

YEs, I agree.  YEt the certainty that IP prefix gives is fuzzy.

(IP address privacy technology _is_ good but little relevant in mobile
networks)

Alex