Subject: [93attendees] Network experiment during the meeting

From: Rolf Winter <[email-masked]>
Date: Mon, 13 Jul 2015 22:13:31 +0200

Hello everyone,

during the meeting we plan to conduct an experiment on the IETF wireless 
network. We will record the broadcast traffic sent over the network with 
the goal of analyzing current applications' use of IP broadcasts. We 
have conducted this experiment previously on another large wireless 
campus network with interesting results and will repeat the experiment 
on the IETF wireless network as a second data point. We collect the data 
and aggregate it to statistics which will not reveal data about 
individual users of the network and once that is done, we will delete 
all packet traces we collected. More information on the experiment can 
be found here:

http://net.hs-augsburg.de/projects/2015/07/09/ietf-broadcast-analysis.html

If you have questions regarding the experiment, please drop me an Email.

See you in Prague,

Rolf

---

From: Dave Crocker <[email-masked]>
Date: Mon, 13 Jul 2015 13:30:15 -0700

On 7/13/2015 1:13 PM, Rolf Winter wrote:
> the goal of analyzing current applications' use of IP broadcasts. 
...
> http://net.hs-augsburg.de/projects/2015/07/09/ietf-broadcast-analysis.html

Hmmm.  Assurances on that web page notwithstanding doesn't this fall
under human subjects rules for experiments and/or rules of privacy
protection?  For example:

     http://inside.augsburg.edu/irb/

If not, why not?  If so, how have the relevant requirements been satisfied?

Thanks.

d/
-- 
Dave Crocker
Brandenburg InternetWorking
bbiw.net

---

From: Rolf Winter <[email-masked]>
Date: Tue, 14 Jul 2015 09:29:22 +0200

Hi Dave,

I am not sure I fully understand your question. You surely have noted 
that hs-augsburg.de != augsburg.edu so I assume you refer to the more 
general question of experimenting with human subjects. In my mind 
typically things like clinical tests fall under this. We will look 
solely at broadcasts (and multicast for that matter) sent out by 
devices. In essence data that devices send out to all other devices on a 
subnet. Clearly any IETF participant can conduct this experiment... well 
anybody on the IETF wireless can. We do not actively attempt to trigger 
broadcast/multicast communication, we merely listen to what the devices 
send out to everyoneon their own. But I am not sure I have answered your 
question. If not, could you be more specific?

Best,

Rolf

---

From: Dave Crocker <[email-masked]>
Date: Tue, 14 Jul 2015 06:51:05 -0700

On 7/14/2015 12:21 AM, Rolf Winter wrote:
> send out to _everyone_. But I am not sure I have answered your question.
> If not, could you be more specific?

Rolf,

The augsberg.edu reference was prefaced with "for example". It was not
meant as the specific set of rules at issue, but merely an example.
People often have no experience with modern rules on human subjects
research so I wanted to point to a representative set.

You are doing an experiment.  It involves human subjects, since humans
are generating the traffic you will be monitoring.  You are not
obtaining their explicit permission.

I do not know the usual parameters for including or excluding human
activity as qualifying for 'human subjects research' handling
procedures.  I also do not know the formal rules in terms of privacy
when capturing human-generated traffic.  But both of these lines of
concern are real and often challenging, with rules that vary across
institutions and laws that vary across countries.

I do know that being good folk and having good intentions do not
suffice, when privacy and/or human subjects research are involved.
There are professional standards and often there are legal strictures.

So I thought I should raise the issue both to ensure that you and IETF
management are aware of the topic, and to see whether anyone else in the
community cares about it.

d/

---

From: Rolf Winter <[email-masked]>
Date: Tue, 14 Jul 2015 16:27:51 +0200

Hi,

I am not a lawyer so anything I say is solely based on common sense, 
which probably means that legally speaking I am wrong. Just for the 
folks that have not read the description of our experiment, we solely 
talk about broadcast data.

I have actually talked to our lawyer here, and her spontaneous 
suggestion was to ask whether one of the participants/sponsors from the 
Czech Republic could ask their lawyers/data protection officers if such 
an experiment would be OK under Czech Republic law? I found that a 
smashing idea. Anybody on this list who could help out?

Best,

Rolf

Am 7/14/15 um 4:09 PM schrieb Joel M Snyder:
>
>
> On 7/14/15 3:51 PM, Dave Crocker wrote:
>
> This would not be considered human subject experimentation. Simply 
> because humans are involved in an activity does not make it human 
> subject experimentation.
>
> You have to be actually interacting (or otherwise affecting) the human 
> subject.  Gathering data passively is not considered human subject 
> experimentation, unless the data are PPI.
>
> You *could* argue that the data being collected could possibly be 
> private data, since a naive Wi-Fi user might have some expectation 
> that their Wi-Fi data were not being watched, and thus the information 
> would be private.  This was used as an argument to condemn Google for 
> capturing Wi-Fi data as they drove around.
>
> However, you could also argue that at a conference, in a hotel, there 
> is no expectation of privacy of the Wi-Fi data.  And you could argue 
> doubly (or triply) so that IETF users as a community are not so naive 
> as to expect their Wi-Fi data to be private.
>
> jms
> (PhD, veteran of human subjects committee wars...)
>
>

---

From: Jared Mauch <[email-masked]>
Date: Tue, 14 Jul 2015 10:34:34 -0400

On Tue, Jul 14, 2015 at 04:27:51PM +0200, Rolf Winter wrote:
> Hi,
> 
> I am not a lawyer so anything I say is solely based on common sense, which
> probably means that legally speaking I am wrong. Just for the folks that
> have not read the description of our experiment, we solely talk about
> broadcast data.
> 
> I have actually talked to our lawyer here, and her spontaneous suggestion
> was to ask whether one of the participants/sponsors from the Czech Republic
> could ask their lawyers/data protection officers if such an experiment would
> be OK under Czech Republic law? I found that a smashing idea. Anybody on
> this list who could help out?

	I find this study interesting because it's about data that people are
sharing by default settings of their software and acceptance of EULA.

	Attending a RIPE/NANOG/IETF meeting is interesting seeing all the
messages and disclosures from hosts that are broadcast.

	The same is true of CDP/LLDP and other protocols that operate
within this space.

	If you haven't looked at the data your laptop leaks from running iTunes,
mDNS/Bonjour, etc you may want to investigate it before joining an
untrusted network.

	The apple messages app and itunes share a lot of data, plus even
in just DHCP you see plenty of details.  Example from my home:

	  Client-Ethernet-Address c8:0a:a9:2d:c9:25
	  Vendor-rfc1048 Extensions
	    Magic Cookie 0x63825363
	    DHCP-Message Option 53, length 1: Discover
	    MSZ Option 57, length 2: 576
	    Vendor-Class Option 60, length 21: "Broadcom:LB4M:1.1.0.8"

	  Client-Ethernet-Address 5c:f9:38:da:d8:79
	  Vendor-rfc1048 Extensions
	    Magic Cookie 0x63825363
	    DHCP-Message Option 53, length 1: Request
	    Parameter-Request Option 55, length 6: 
	      Subnet-Mask, Default-Gateway, Domain-Name-Server, Domain-Name
	      Option 119, Option 252
	    MSZ Option 57, length 2: 1500
	    Client-ID Option 61, length 7: ether 5c:f9:38:da:d8:79
	    Requested-IP Option 50, length 4: 10.0.0.182
	    Lease-Time Option 51, length 4: 7776000
	    Hostname Option 12, length 15: "FamilyRAppleTV2"

	Take a look if you haven't studied this traffic.  Keep in mind what
this may do to the basic-1mbs rates supported on 802.11 radios and
how a large broadcast domain with lots of fe80:: traffic for NDP
will cause RF congestion due to speed changes.

	- Jared

-- 
Jared Mauch  | pgp key available via finger from [email-masked]
clue++;      | http://puck.nether.net/~jared/  My statements are only mine.

---

From: Tim Chown <[email-masked]>
Date: Tue, 14 Jul 2015 15:42:34 +0100

> On 14 Jul 2015, at 15:34, Jared Mauch <[email-masked]> wrote:
> 
> ….

Right, but (with IANAL disclaimer) there’s at least two aspects here:

a) gathering data generally isn’t the problem - it’s how you process and republish it, with user privacy in mind. Be that through specific MAC addresses, or names that might be embedded in mDNS names;

b) mDNS/DNS-SD is generally link-specific; a user may not expect their data to be discoverable beyond the link (whether it is meaningful or not). This is something we are discussing in the dnssd WG.

Tim

---

From: joel jaeggli <[email-masked]>
Date: Tue, 14 Jul 2015 08:13:29 -0700

Typically experiments involving the production network run past the
network staff and the IAD/IAOC or IETF chair.

I haven't seen this float by so I don't know if it has or not but if
you haven't, I'd suggest doing that.

thanks
joel

On 7/13/15 1:13 PM, Rolf Winter wrote:
> Hello everyone,
> 
> during the meeting we plan to conduct an experiment on the IETF
> wireless network. We will record the broadcast traffic sent over
> the network with the goal of analyzing current applications' use of
> IP broadcasts. We have conducted this experiment previously on
> another large wireless campus network with interesting results and
> will repeat the experiment on the IETF wireless network as a second
> data point. We collect the data and aggregate it to statistics
> which will not reveal data about individual users of the network
> and once that is done, we will delete all packet traces we
> collected. More information on the experiment can be found here:
> 
> _______________________________________________ 93attendees mailing
> list [email-masked] 
> https://www.ietf.org/mailman/listinfo/93attendees

---

From: Chris Elliott <[email-masked]>
Date: Tue, 14 Jul 2015 11:25:41 -0400

On Tue, Jul 14, 2015 at 11:13 AM, joel jaeggli <[email-masked]> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>

Joel,

Rolf contacted me a while ago and I had him contact Jari for approval of
this "experiment". Jari has approved it.

The device will sit in the NOC where we can easily disable it if there's an
issue.

> you haven't, I'd suggest doing that.

 Rolf's done his job. I got distracted by traveling and trying to get the
network working to forward this to the NOC list. I'll do that asap.

Chris.

> <http://net.hs-augsburg.de/projects/2015/07/09/ietf-broadcast-analysis.html>
> >
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG/MacGPG2 v2
> Comment: GPGTools - http://gpgtools.org
>
> iEYEARECAAYFAlWlJxkACgkQ8AA1q7Z/VrI/oQCfaRz2CkLU/XcADm4k+oB8RbPU
> CmMAmgMCFKiXqwrTnjARGga1KHv08T9S
> =2x3d
> -----END PGP SIGNATURE-----
>
> _______________________________________________
> 93attendees mailing list
> [email-masked]

-- 
Chris Elliott
[email-masked]

"What the f*ck is a sesame? It's a street...it's a way to open sh*t!"
--Mitch Hedberg

---

From: Ray Pelletier <[email-masked]>
Date: Tue, 14 Jul 2015 12:16:54 -0400

Chris
I asked Jim and Joel this but no response as yet. Maybe you have an opinion 

This appears to be a benign experiment, but would it impact operations, or in your opinion, intrude on privacy?  

Ray

> On Jul 14, 2015, at 11:25 AM, Chris Elliott <[email-masked]> wrote:
> 
> Rolf contacted me a while ago and I had him contact Jari for approval of this "experiment". Jari has approved it.
> 
> The device will sit in the NOC where we can easily disable it if there's an issue.
>  
>  Rolf's done his job. I got distracted by traveling and trying to get the network working to forward this to the NOC list. I'll do that asap.
> 
> Chris.
>  
>> thanks
>> joel
>> 
> "What the f*ck is a sesame? It's a street...it's a way to open sh*t!" --Mitch Hedberg

---

From: "McDonald, Alex" <[email-masked]>
Date: Tue, 14 Jul 2015 15:33:30 +0000

I am not a lawyer, but I have done some research in this area.

Please be aware that (a) the Czech Republic is in the EU (b) according to EU law you are collecting personal identifiable data.

Therefore (from http://ec.europa.eu/justice/data-protection/data-collection/legal/index_en.htm)

---->>
Under the Data Protection Directive, collecting and processing the personal data of individuals is only legitimate in one of the following circumstances laid down by Article 7 of the Directive:

    Where the individual concerned, (the 'data subject'), has unambiguously given his or her consent, after being adequately informed; or
    if data processing is needed for a contract, for example, for billing, a job application or a loan request; or
    if processing is required by a legal obligation; or
    if processing is necessary in order to protect the vital interest of the data subject, for example, processing of medical data of a victim of a car accident; or
    if processing is necessary to perform tasks of public interests or tasks carried out by government, tax authorities, the police or other public bodies; or
    if the data controller or a third party has a legitimate interest in doing so, as long as this interest does not affect the interests of the data subject, or infringe on his or her fundamental rights, in particular the right to privacy. This provision establishes the need to strike a reasonable balance between the data controllers' business interests and the privacy of data subjects.
<<----

The last clause is the only clause under which you can collect and process this data. To that end; http://ec.europa.eu/justice/data-protection/data-collection/obligations/index_en.htm

---->>
Obligations of data controllers

The Data Protection Directive requires data controllers to observe a number of principles when they process personal data. These principles not only protect the rights of those about whom the data is collected ("data subjects") but also reflect good business practices that contribute to reliable and efficient data processingEach data controller must respect the following rules as set out in the Directive:

    Personal Data must be processed legally and fairly;
    It must be collected for explicit and legitimate purposes and used accordingly;
    It must be adequate, relevant and not excessive in relation to the purposes for which it is collected and/or further processed;
    It must be accurate, and updated where necessary;
    Data controllers must ensure that data subjects can rectify, remove or block incorrect data about themselves;
    Data that identifies individuals (personal data) must not be kept any longer than strictly necessary;
    Data controllers must protect personal data against accidental or unlawful destruction, loss, alteration and disclosure, particularly when processing involves data transmission over networks. They shall implement the appropriate security measures;
    These protection measures must ensure a level of protection appropriate to the data.
<<----

If you feel you can meet these criteria, then you may want to make sure that you understand how to register as a data controller in the Czech Republic; https://www.uoou.cz/en/vismo/zobraz_dok.asp?id_org=200156&id_ktg=1159

There's a shorter version of this email available here http://images.huffingtonpost.com/2014-09-26-keepcalmanddontdoit2.png

Alex McDonald
Standards & Industry Associations Group
CTO Office
NetApp
+44 7795 046686 Mobile Phone
[email-masked]
twitter: @alextangent
Follow us: 

> -----Original Message-----
> From: 93attendees [mailto:[email-masked]] On Behalf Of
> Rolf Winter
> Sent: 13 July 2015 21:14
> To: [email-masked]
> Subject: [93attendees] Network experiment during the meeting
> 
> Hello everyone,
> 
> network. We will record the broadcast traffic sent over the network with the
> goal of analyzing current applications' use of IP broadcasts. We have
> conducted this experiment previously on another large wireless campus
> network with interesting results and will repeat the experiment on the IETF
> wireless network as a second data point. We collect the data and aggregate it
> to statistics which will not reveal data about individual users of the network
> and once that is done, we will delete all packet traces we collected. More
> information on the experiment can be found here:
>

---

From: Jari Arkko <[email-masked]>
Date: Tue, 14 Jul 2015 19:29:28 +0300

> this "experiment". Jari has approved it.

Right. I think it is a useful experiment and I find the privacy safeguards adequate.
And indeed, the main purpose of passing this kind of experiments via the
IETF chair is that I try to catch issues; in this case I reviewed the suggested
safeguards and suggested some changes, and felt that the result was adequate.

It is possible that there are legal or other standards that would specify in
detail what we can and can not do. I am obviously not a lawyer either.
I don’t mind passing this to someone who understands laws about
human subject research or privacy, of course.

Jari

---

From: Chris Elliott <[email-masked]>
Date: Tue, 14 Jul 2015 12:32:20 -0400

> in your opinion, intrude on privacy?

I do not expect it to impact operations, and, as the device collecting data
will be in the NOC, we can easily disable it should there be any concerns.

Both Jari and I have discussed privacy concerns with Rolf and, at the level
of information I have, I believe Rolf will be protecting our attendees
privacy.

That said, I'm not a security guy and a full analysis of the security
implications would probably need to be done by a security guru.

However, note, with or without our permission, any attendee can collect the
same information Rolf is collecting.

Chris.

> Ray
>
> On Jul 14, 2015, at 11:25 AM, Chris Elliott <[email-masked]
> <javascript:_e(%7B%7D,'cvml',[email-masked]');>> wrote:
>
> On Tue, Jul 14, 2015 at 11:13 AM, joel jaeggli <[email-masked]
> <javascript:_e(%7B%7D,'cvml',[email-masked]');>> wrote:
>
>> <javascript:_e(%7B%7D,'cvml',[email-masked]');>
>> <javascript:_e(%7B%7D,'cvml',[email-masked]');>
> [email-masked] <javascript:_e(%7B%7D,'cvml',[email-masked]');>
>
> <javascript:_e(%7B%7D,'cvml',[email-masked]');>

-- 
Chris Elliott
CCIE # 2013

“You and I are mirages that perceive themselves”
--Douglas Hofstadter

---

From: joel jaeggli <[email-masked]>
Date: Tue, 14 Jul 2015 09:44:22 -0700

On 7/14/15 8:25 AM, Chris Elliott wrote:
> <mailto:[email-masked]>> wrote:
> 
> Typically experiments involving the production network run past
> the network staff and the IAD/IAOC or IETF chair.
> 
> 
>> Joel,
> 
>> Rolf contacted me a while ago and I had him contact Jari for
>> approval of this "experiment". Jari has approved it.
> 
> I haven't seen this float by so I don't know if it has or not but
> if you haven't, I'd suggest doing that.
> 
> 
>> Rolf's done his job. I got distracted by traveling and trying to
>> get the network working to forward this to the NOC list. I'll do
>> that asap.

cool, Thanks
joel

> thanks joel
>> the network with the goal of analyzing current applications' use
>> of IP broadcasts. We have conducted this experiment previously
>> on another large wireless campus network with interesting results
>> and will repeat the experiment on the IETF wireless network as a
>> second data point. We collect the data and aggregate it to
>> statistics which will not reveal data about individual users of
>> the network and once that is done, we will delete all packet
>> traces we collected. More information on the experiment can be
>> found here:
> 
>> http://net.hs-augsburg.de/projects/2015/07/09/ietf-broadcast-analysis
.
html
>> _______________________________________________ 93attendees
>> mailing list [email-masked] <mailto:[email-masked]> 
> list [email-masked] <mailto:[email-masked]> 
> -- Chris Elliott [email-masked] <mailto:[email-masked]>
>

---

From: Ray Pelletier <[email-masked]>
Date: Tue, 14 Jul 2015 13:19:09 -0400

Rolf, and all,

We will inquire as to Czech and EU.

Ray
IAD

> On Jul 14, 2015, at 10:27 AM, Rolf Winter <[email-masked]> wrote:
> 
> Hi,
> 
> I am not a lawyer so anything I say is solely based on common sense, which probably means that legally speaking I am wrong. Just for the folks that have not read the description of our experiment, we solely talk about broadcast data. 
> 
> I have actually talked to our lawyer here, and her spontaneous suggestion was to ask whether one of the participants/sponsors from the Czech Republic could ask their lawyers/data protection officers if such an experiment would be OK under Czech Republic law? I found that a smashing idea. Anybody on this list who could help out? 
> 
> Best,
> 
> Rolf
> 
>> This would not be considered human subject experimentation.  Simply because humans are involved in an activity does not make it human subject experimentation. 
>> 
>> You have to be actually interacting (or otherwise affecting) the human subject.  Gathering data passively is not considered human subject experimentation, unless the data are PPI. 
>> 
>> You *could* argue that the data being collected could possibly be private data, since a naive Wi-Fi user might have some expectation that their Wi-Fi data were not being watched, and thus the information would be private.  This was used as an argument to condemn Google for capturing Wi-Fi data as they drove around. 
>> 
>> However, you could also argue that at a conference, in a hotel, there is no expectation of privacy of the Wi-Fi data.  And you could argue doubly (or triply) so that IETF users as a community are not so naive as to expect their Wi-Fi data to be private. 
>> 
>> jms

---

From: Leif Johansson <[email-masked]>
Date: Tue, 14 Jul 2015 19:53:40 +0200

> The last clause is the only clause under which you can collect and process this data. To that end; http://ec.europa.eu/justice/data-protection/data-collection/obligations/index_en.htm

I am not a lawyer either but I've dealt with a few cases similar
to this in my $dayjob.

In some countries research is considered to be a task of public
interest and fall under the last but one clause but then often
coupled with an ethics review function.

For the heck of it I just reviewed the Swedish research ethics board
note on PII and they cite the public interest clause [1] (Swedish
readers only I'm afraid).

To make things worse, EU regulation is changing from a directive to
"federal" EU law so national law may not even apply (or at least not
for very long) in this area.

I'm pretty sure that under (current) Swedish law you'd be required
to do a formal review by the human research ethics review board
for this type of research.

[1] http://www.epn.se/media/63764/faktabroschyr-pul-forskning.pdf

 	Cheers Leif

---

From: Joseph Lorenzo Hall <[email-masked]>
Date: Tue, 14 Jul 2015 15:45:52 -0400

There are a few of us that have a lot of experience with the law and
process of doing human subjects research... in the US, the general
calculus is essentially balancing the risk to individuals to the
research question at hand. For example, in a number of experiments
I've been involved with, we've been asked to drop significant octets
(or two) from IPv4 addresses, hash MAC addresses with a salt/key that
is securely destroyed immediately afterwards, and ensure we are
securely deleting data (random writes, etc.) after it is no longer
needed (and not keeping it forever).

If this is the kind of thing IETF might do more of, it might be good
to have a small group that can assess these kinds of requests, make
suggestions, and approve/reject before the Chair has to necessarily
step in. (Similarly, if IETFers might want guidance on these issues in
terms of network experiments and proper research data handling for
human subjects data, that's something we'd be interested in helping
with at CDT.)

The legal questions are going to be the ones we can't rely on our own
community to deal with and will need to have some analysis before each
IETF... of course, the hard alternative is "no experiments for other
than operational questions on the IETF network" which doesn't sound
satisfying to me.

best, Joe

-- 
Joseph Lorenzo Hall
Chief Technologist
Center for Democracy & Technology
1634 I ST NW STE 1100
Washington DC 20006-4011
(p) 202-407-8825
(f) 202-637-0968
[email-masked]
PGP: https://josephhall.org/gpg-key
fingerprint: 3CA2 8D7B 9F6D DBD3 4B10  1607 5F86 6987 40A9 A871

---

From: "Leif Johansson" <[email-masked]>
Date: Tue, 14 Jul 2015 21:50:17 +0200

> 14 jul 2015 kl. 21:46 skrev Joseph Lorenzo Hall <[email-masked]>:
> 

makes sense

> human subjects data, that's something we'd be interested in helping

my point was that national law may already provide such review mechanisms

> than operational questions on the IETF network" which doesn't sound

that would be bad

---

From: "Fred Baker (fred)" <[email-masked]>
Date: Tue, 14 Jul 2015 19:54:19 +0000

Is this specifically "broadcast", or does it also include "multicast"? I'd suggest that understanding multicast traffic is more useful, as broadcast is specifically IPv4 and multicast will also include IPv6.

> On Jul 13, 2015, at 10:13 PM, Rolf Winter <[email-masked]> wrote:
> 
> Hello everyone,
> 
> during the meeting we plan to conduct an experiment on the IETF wireless network. We will record the broadcast traffic sent over the network with the goal of analyzing current applications' use of IP broadcasts. We have conducted this experiment previously on another large wireless campus network with interesting results and will repeat the experiment on the IETF wireless network as a second data point. We collect the data and aggregate it to statistics which will not reveal data about individual users of the network and once that is done, we will delete all packet traces we collected. More information on the experiment can be found here:
>

---

From: Henning Schulzrinne <[email-masked]>
Date: Tue, 14 Jul 2015 20:00:20 +0000

IRB (institutional review boards) are associated with the home institution of the researcher, and only exist in institutions, largely universities or research hospitals, that conduct human subject experiments. For example, many or most research groups in industrial settings don't have access to an IRB unless they collaborate with a university researcher.

I would be very surprised if IRBs knew the law and requirements in countries other than their own, or felt comfortable speculating.

Thus, this will probably require a two-step test:

(1) where available, an IRB opinion from the researcher's home institution (in many cases that seem low risk or involve public data they simply say "thanks for asking, but no need for our review")

(2) some kind of locale-specific process. This is going to be the challenging part since you'd need a lawyer familiar with the local laws and practice.

Henning

________________________________________
From: 93attendees <[email-masked]> on behalf of Leif Johansson <[email-masked]>
Sent: Tuesday, July 14, 2015 3:50 PM
To: Joseph Lorenzo Hall
Cc: [email-masked]
Subject: Re: [93attendees] Network experiment during the meeting

makes sense

that would be bad

---

From: Randy Bush <[email-masked]>
Date: Tue, 14 Jul 2015 16:14:43 -0700

> hash MAC addresses with a salt/key that is securely destroyed
> immediately afterwards

how yucchhy.  use a one way hmac, which will preserve uniqueness (for
correnation) but provide reasonable hashing

randy

---

From: Toerless Eckert <[email-masked]>
Date: Tue, 14 Jul 2015 21:07:48 -0700

Rolfs web page explain almost nothing more than his email. I wouldn't
know any actual broacast packet of interest except for ARP. I am
pretty sure he means L2/L3 multicast. Having him say just "rfc919 / broadcast"
makes me a bit nervuous about how well the other bits are thought out.

As soon as IETF gives access for Rolf to any reasonable protected packets,
i would assume IETF is at least partially indemnifying Rolfs org from
legal responsibilities and takes on legal responsibilities itself.

It would be good to understand what the IETF is really responsible for.
I would fear that to be on the safe side, IETF should indemnify itself
against the attendees by having them sign "something". I am sure
that "something" needs to be better than "rfc919 / broadcast" unless he
really only wants to analyze ARP patterns.

Didn't IETF have security folks running around for decades telling us
to not be insecure because they will be tap'ing our unprotected WiFi
traffic and post our passwords ? Whatever happened of those experiments
(sorry, can't remember) ?

Logically its hilarious discussing legalese when Rolf would only tap 
what amounts to publically accessible packets, eg: on no- or obvious-password
encrypted WiFI accessible in public areas like Hotel lobbies. Of course i
am sure with digital laws being what they are, there is going to be difference
in him publishing a paper about those packets vs. posting a paper
about him observing/counting IETF participants in the public hotel
lobby and oh, their observable legal drug consumption patterns. 

I am actually interested in what the heck the technical details are.
Depending on what protocols are of interest, the different ways of how
multicast traffic is constrained (IGMP snooping) or L2 unicast converted 
(vendor specific) makes a lot of difference to what can be observed where.

If he can show some really useful stats he would create, i am all for giving
him all the access needed as long as we can make sure the IETF indemnifies
itself well enough so that it does not have to spend money later on some stupid
lawsuit with some disgruntled ITEF participant. But then again, i am using
a VPN tunnel for all my traffic anyhow. 

Cheers
    Toerless

On Tue, Jul 14, 2015 at 07:29:28PM +0300, Jari Arkko wrote:
> I don?t mind passing this to someone who understands laws about

-- 
---
Toerless Eckert, [email-masked]

---

From: Tim Chown <[email-masked]>
Date: Wed, 15 Jul 2015 09:22:56 +0100

Hi,

I did ask the question offsets, and the answer was yes that multicast is included.

Tim

> On 15 Jul 2015, at 05:07, Toerless Eckert <[email-masked]> wrote:
>

---

From: Rolf Winter <[email-masked]>
Date: Wed, 15 Jul 2015 10:52:18 +0200

Hi,

we were sloppy in our description, apologies. Multicast _is_ being 
collected. Basically everything the NIC receives which is not unicast. 
But ARP is actually not all that interesting. Most interesting are 
actually applications using broadcast/multicast messages. Here is a 
protocol distribution of a previous experiment omitting everything below 
7% of the overall broadcast/multicast traffic volume.

mDNS (16%), SSDP (15%), LLMNR (13%), NetBIOS (7%) and Dropbox LAN-sync (7%).

This clearly depends on the population of your LAN (mostly depending on 
OS distribution and installed apps). In this particular case, 
broadcast/multicast traffic peaked at around 1 GB a day, averaging at 
about 200 MB a day.

I hope this answers some of your no-legal questions.

Best,

Rolf

---

From: "Eric Vyncke (evyncke)" <[email-masked]>
Date: Wed, 15 Jul 2015 09:14:22 +0000

Like Toerless, I find interesting this discussion when we all know that WiFi (unless WPA is used) is 'broadcasted' everywhere.

During some previous IETF meetings, I used https://github.com/evyncke/mcast6 for one hour or two to collect aggregated statistics on IPv6 NDP & other multicast packets. Obviously, anybody could do it as the WiFi AP are configured in such a way that mcast packets are forwarded

-éric

From: 93attendees <[email-masked]<mailto:[email-masked]>> on behalf of Chris Elliott <[email-masked]<mailto:[email-masked]>>
Reply-To: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Date: mardi 14 juillet 2015 18:32
To: Ray Pelletier <[email-masked]<mailto:[email-masked]>>
Cc: joel jaeggli <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>, Rolf Winter <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: Re: [93attendees] Network experiment during the meeting

On Tuesday, July 14, 2015, Ray Pelletier <[email-masked]<mailto:[email-masked]>> wrote:
Chris
I asked Jim and Joel this but no response as yet. Maybe you have an opinion

I do not expect it to impact operations, and, as the device collecting data will be in the NOC, we can easily disable it should there be any concerns.

Both Jari and I have discussed privacy concerns with Rolf and, at the level of information I have, I believe Rolf will be protecting our attendees privacy.

That said, I'm not a security guy and a full analysis of the security implications would probably need to be done by a security guru.

However, note, with or without our permission, any attendee can collect the same information Rolf is collecting.

Chris.

Ray

On Jul 14, 2015, at 11:25 AM, Chris Elliott <[email-masked]<javascript:_e(%7B%7D,'cvml',[email-masked]');>> wrote:

On Tue, Jul 14, 2015 at 11:13 AM, joel jaeggli <[email-masked]<javascript:_e(%7B%7D,'cvml',[email-masked]');>> wrote:

Joel,

Chris.

thanks
joel

On 7/13/15 1:13 PM, Rolf Winter wrote:
> http://net.hs-augsburg.de/projects/2015/07/09/ietf-broadcast-analysis.
html<http://net.hs-augsburg.de/projects/2015/07/09/ietf-broadcast-analysis.html>
> list [email-masked]<javascript:_e(%7B%7D,'cvml',[email-masked]');>

_______________________________________________
93attendees mailing list
[email-masked]<javascript:_e(%7B%7D,'cvml',[email-masked]');>
https://www.ietf.org/mailman/listinfo/93attendees

--
Chris Elliott
[email-masked]<javascript:_e(%7B%7D,'cvml',[email-masked]');>

"What the f*ck is a sesame? It's a street...it's a way to open sh*t!" --Mitch Hedberg
_______________________________________________
93attendees mailing list
[email-masked]<javascript:_e(%7B%7D,'cvml',[email-masked]');>
https://www.ietf.org/mailman/listinfo/93attendees

--
Chris Elliott
CCIE # 2013

---

From: "DRAGE, Keith (Keith)" <[email-masked]>
Date: Wed, 15 Jul 2015 12:07:44 +0000

I think you will find the fact that anyone can collect the data is irrelevant.

And neither is it directly a security or privacy issue.

It is the responsibility of the organisation or person doing the data collection to ensure they comply with the requirements of data protection. These include the right of individuals affected to ensure the data collected is accurate, and also that it is not transferred outside the EU to a regime that does not have equivalent safeguards.

If this was a UK environment, that could also require registration with the data registrar, unless exemptions apply. No idea what the Czech implementation of the relevant directive is.

But fundamentally, is any of the information you are collecting, before or after subsequent processing, something that could be regarded as personal data? If the answer is no, then data protection will not apply; if the answer is yes, then just telling people you are doing it is certainly not a sufficient assessment of your responsibilities.

I assume by the way that the IETF secretariat has done a similar assessment of its responsibilities for any personal data it collects while it is in the EU?

regards

Keith

________________________________
From: 93attendees [mailto:[email-masked]] On Behalf Of Eric Vyncke (evyncke)
Sent: 15 July 2015 10:14
To: [email-masked]
Cc: Rolf Winter
Subject: Re: [93attendees] Network experiment during the meeting
Importance: Low

-éric

Chris.

Ray

Joel,

Chris.

thanks
joel

html

--
Chris Elliott
CCIE # 2013

"You and I are mirages that perceive themselves"
--Douglas Hofstadter

---

From: Jared Mauch <[email-masked]>
Date: Wed, 15 Jul 2015 08:15:28 -0400

> During some previous IETF meetings, I used https://github.com/evyncke/mcast6 for one hour or two to collect aggregated statistics on IPv6 NDP & other multicast packets. Obviously, anybody could do…

	This is why I see it as a non-issue, the data is broadcasted and
nobody is compelled to utilize the IETF network or bring an electronic
device to attend the meeting.

	By having a device set to join the IETF network it seems
that opting-in to share your data has occured.  Some people may want
a form of explicit consent or other details, but I've been to this
rodeo before and expect people to snoop on me in a public forum
and take this into account.

	It's super easy to ID people regardless by DNS or VPN
type traffic.  Someone connecting to puck.nether.net via SSH is
going to be a short list.  Same goes for hitting up $employer VPN
endpoint/allocated IP space.

	- Jared

---

From: Dave Crocker <[email-masked]>
Date: Wed, 15 Jul 2015 06:39:42 -0700

On 7/15/2015 5:15 AM, Jared Mauch wrote:
> that opting-in to share your data has occured.

That's a reasonable view.  The problem is that so are other, competing
views.

If the world were subject to your preferences, your view would hold
sway.  However in this world, some of those competing views are likely
to have professional and/or legal force.

d/

---

From: Toerless Eckert <[email-masked]>
Date: Wed, 15 Jul 2015 06:58:04 -0700

The IETF is idemnifying everything participants say already via the note well,
i don't understand why they wouldn't want to do it for the use of the IETF network.

Network note well:
  IETF will observe all traffic on the IETF network. Whatever you send/receive 
  on that network is not your traffic but owned by IETF. IETF will do its best
  to get as much research and commercial value out of you using the IETF network
  as IETF sees fit.

I just hate captive portals, otherwise i'd recommend for the IETF net to have
one with the above disclaimer before one can connect.

---

From: Jared Mauch <[email-masked]>
Date: Wed, 15 Jul 2015 09:59:32 -0400

> to have professional and/or legal force.

	I'm not saying there may be regulatory regimes where the legal
situation may be different than what I outlined above, but the easiest
way to not be part of this is to opt out by not using the IETF
network.  Seems like a fairly affirmative way.  It's interesting how
IETF went from being engineering based to lawyer based.

	The adage about how many people it takes to build something
vs tear it down seems like it may be applicable here and private
*constructive* input to the parties involved would have a positive
response.

	My experience is the people who gripe the loudest tend to be
ones that didn't investigate the device behaviors earlier.

	I've looked at traffic that my machines receive at these
networks as part of troubleshooting and a fair amount is revealed
in the DHCP request, including company names, usernames, etc..

	On a mac/apple device to help some of this leakge go into:

	1) itunes, set your library name to something generic like "my music"
	2) system preferences -> sharing -> computer name -> my computer
	3) messages -> preferences -> accounts -> bonjour and uncheck all
the boxes, including the share my IM contacts and e-mail addresses.

	for iPhone/iPad change your device name:

	settings -> general -> about -> Name

	If you are worried about your PII you likely would have already
done this, but if not, please consider the above steps.

	I'm sure there is a similar process for other applications, but this
is just what I have at my disposal for a quick write-up/response.

	- jared

---

From: Dave Crocker <[email-masked]>
Date: Wed, 15 Jul 2015 07:44:38 -0700

> The IETF is idemnifying everything participants say already via the note well,

On what basis does the Note Well constitute a guarantee of
indemnification for anyone.

And by the way, who do you believe is being indemnified by the IETF?

(In case there is confusion about the term:
http://www.merriam-webster.com/dictionary/indemnify)

d/

---

From: Dave Crocker <[email-masked]>
Date: Wed, 15 Jul 2015 07:56:59 -0700

> IETF went from being engineering based to lawyer based.

That view requires some assumptions, such as:

   1.  Everyone in the room will be sufficiently well-informed and in a
sufficiently timely manner, to be able to know opt-out.  It means, for
example, that even someone who is not on this list and who arrives late
to the session, we have some way of knowing to opt-out.  I don't know
how you are going to achieve that level of pervasive knowledge, and
mostly I suspect it is not possible.

   2.  Placing the burden on each user of opting out is reasonable.  It
presumes, for example, that those running the network and/or conducting
the experiment do not have an affirmative obligation to gain explicit
user permission beforehand.  (This issue about proper requirements for
gaining permission is a classic source of tension between marketers and
anti-spam practitioners.)

   3.  Being deprived of network access during a plenary is a reasonable
burden to place of attendees who opt-out

> *constructive* input to the parties involved would have a positive

The activity was announced not as a possibility, soliciting comments,
but as certain to happen.  There was no indication that basic questions
of privacy and user agreement had been considered.  And there isn't all
that much time left.

So, sorry, but raising concerns about this publicly is what was needed.
 It also provided a way of determining whether the IETF community cares
about the privacy and user agreement issues for this activity.

d/

---

From: Toerless Eckert <[email-masked]>
Date: Wed, 15 Jul 2015 08:47:53 -0700

> And by the way, who do you believe is being indemnified by the IETF?

I think the note well is trying to do its best to idemnify the IETF
and its participants against lawsuits claiming infringing on trade secret
or claims of novelty for things mentioned in public at the IETF.

> http://www.merriam-webster.com/dictionary/indemnify)

Sure, i am not a native, let me know if i am misunderstanding it.

Cheers
    Toerless

---

From: Stephen Botzko <[email-masked]>
Date: Wed, 15 Jul 2015 12:56:35 -0400

There is *nothing* in the Note Well (nor in the RFCs it references) about
indemnification.

Stephen

---

From: Toerless Eckert <[email-masked]>
Date: Wed, 15 Jul 2015 10:02:15 -0700

> There is *nothing* in the Note Well (nor in the RFCs it references) about

Sure, but the note well does not explain why the IETF does it, and
why it has attendees accept it. 

s/idemnify/protect/ ?

Cheers
   Toerless

---

From: Stephen Botzko <[email-masked]>
Date: Wed, 15 Jul 2015 13:06:22 -0400

> why it has attendees accept it.
No.
to protect (someone) *by promising to pay for the cost...*

Cheers.

---

From: Benson Schliesser <[email-masked]>
Date: Wed, 15 Jul 2015 19:24:26 +0200

> why it has attendees accept it.
Speaking only as an individual, with my personal understanding, and
foremost noting that I am not a lawyer:

The "Note Well" statement tells participants that what they publicly say,
write, sing and dance, etc in an IETF venue is considered a contribution to
the IETF. This has some legal implications, including that the IETF has the
right to publish those contributions. This is very much about copyrights,
licensing, etc. The Note Well does not make any statements about
indemnification.

Whether the meaning of the Note Well and it's implications are beneficial
or detrimental to any particular person or organization is an exercise left
up to the individuals that contribute and/or make use of contributions. In
my view, that very much depends on the specific circumstances. The IETF
rules certainly don't take the place of IPR law, legal disputes, and all of
that. That being said, if we are all "playing fair" with each other then it
should encourage collaboration.

Finally, as is typical in these kinds of things, it is often prudent to
check with legal counsel if one has questions. Of course, the process of
"checking with legal" is usually fraught with its own costs (financial and
otherwise) and is therefore a choice best made by the individuals involved.
:)

Cheers,
-Benson

---

From: "DRAGE, Keith (Keith)" <[email-masked]>
Date: Wed, 15 Jul 2015 17:54:03 +0000

And even if the IETF note well did cover such a thing, in general it could not indemnify an individual or person in breaking the law, but only become complicit is said illegal act. 

If we are talking about the handling of personal data, then the Czech authorities have put all the information together in English here:

https://www.uoou.cz/en/vismo/zobraz_dok.asp?id_org=200156&id_ktg=1107

>From the brief perusal I have done, it appears to mirror similar laws in other EU countries, both in requirements and management, as one might well expect.

Regards

Keith

> From: 93attendees [mailto:[email-masked]] On 
> Behalf Of Toerless Eckert
> Sent: 15 July 2015 18:02
> To: Stephen Botzko
> Cc: Jared Mauch; [email-masked]; [email-masked]
> > and its participants against lawsuits claiming infringing on trade 
> > secret or claims of novelty for things mentioned in public 
> at the IETF.
> > >>>
> > There is *nothing* in the Note Well (nor in the RFCs it references) 
> > about indemnification.
> 
> Sure, but the note well does not explain why the IETF does 
> it, and why it has attendees accept it. 
> 
> s/idemnify/protect/ ?
> 
> Cheers
>    Toerless
>

---

From: Jared Mauch <[email-masked]>
Date: Wed, 15 Jul 2015 14:25:27 -0400

> about the privacy and user agreement issues for this activity.

	Not everyone is on the attendee list, so perhaps ietf@
is a better venue?  I opted in to hear about how hot the rooms
are, why there are insufficent cookies and other comic relief.

	I'm certainly greatful for the attempt at disclosure
even if people deem it too late.  It sounds like there could have
been better communication there.  As with all things, it's hard or
impossible to reach 100%.  I applaud those who are trying.

	- Jared

---

From: Randall Gellens <[email-masked]>
Date: Wed, 15 Jul 2015 12:34:56 -0700

At 3:33 PM +0000 7/14/15, Alex McDonald wrote:

>      if processing is necessary to perform tasks of public interests 
> or tasks carried out by government, tax authorities, the police or 
> other public bodies; or
>      if the data controller or a third party has a legitimate 
> interest in doing so, as long as this interest does not affect the 
> interests of the data subject, or infringe on his or her 
> fundamental rights, in particular the right to privacy. This 
> provision establishes the need to strike a reasonable balance 
> between the data controllers' business interests and the privacy of 
> data subjects.
>  <<----
>
>  The last clause is the only clause under which you can collect and 
> process this data.

What about the "public interest" clause?

-- 
Randall Gellens
Opinions are personal;    facts are suspect;    I speak for myself only
-------------- Randomly selected tag: ---------------
To iterate is human; to recurse, divine.  --Robert Heller

---

From: "McDonald, Alex" <[email-masked]>
Date: Wed, 15 Jul 2015 19:56:30 +0000

http://www.cnpd.public.lu/fr/publications/groupe-art29/wp217_en.pdf

Opinion on the notion of legitimate interests of the data controller etc

Example 24: Information website for teenagers

An NGO website offering advice to teenagers regarding issues such as drug abuse, unwanted pregnancy and alcohol abuse collects data via its own server about visitors to the site. It then immediately anonymises these data and turns them into general statistics about which parts of the  website  are  most  popular  among  visitors  coming  from  different  geographical  regions  of the country.
Article 7(f) could be used as a legal ground even if data concerning vulnerable individuals are concerned,  because  the  processing  is  in  the  public  interest  and  strict  safeguards  are  put  in place  (the  data  are  immediately  rendered  anonymous  and  only  used  for  the  creation  of statistics), which helps tipping the balance in favour of the controller.

So the answer is perhaps yes, if caveats re anonymization and use are adhered to.

(As a general note, I didn't raise this with the intent of having "I am not a lawyer but..." discussions. It's just that this stuff has a tendency to bite hard when it does bite. The EU doesn't mess around, especially in light of recent events around Snowden and the leak of US clearance information, and with bodies or companies it thinks should know better.)

Alex McDonald
Follow us: 

> From: Randall Gellens [mailto:[email-masked]]
> Sent: 15 July 2015 20:35
> To: McDonald, Alex; Rolf Winter; [email-masked]
> >      if the data controller or a third party has a legitimate interest
> > in doing so, as long as this interest does not affect the interests of
> > the data subject, or infringe on his or her fundamental rights, in
> > particular the right to privacy. This provision establishes the need
> > to strike a reasonable balance between the data controllers' business
> > interests and the privacy of data subjects.
> >  <<----
> >
> -------------- Randomly selected tag: --------------- To iterate is human; to
> recurse, divine.  --Robert Heller

---

From: Randall Gellens <[email-masked]>
Date: Wed, 15 Jul 2015 15:24:43 -0700

>  (sorry, can't remember) ?

I don't recall that, but I do recall that it was common during the 
plenary of old (back then there was only the one) for slides to be 
shown with stats on how many plain-text passwords were detected, and 
in which protocols.

-------------- Randomly selected tag: ---------------
Ask a question and you're a fool for three minutes; do not
ask a question and you're a fool for the rest of your life.
                                         --Chinese proverb