Subject: Re: [93attendees] Reminder: CITIZENFOUR screening *tomorrow* at 7pm

From: <[email-masked]>
Date: Thu, 30 Jul 2015 15:55:18 +0200

Hi Charlie,

Before I detected the report here: http://www.theregister.co.uk/2015/07/20/edward_snowden_to_the_ietf_please_design_an_internet_for_the_user_not_the_spy/

I had only found a German summary at

http://www.heise.de/netze/meldung/Snowden-Appell-an-die-IETF-Schuetzt-die-Internetnutzer-2753289.html

which I tried to translate (with MS Translators help) as follows:

NSA whistleblower Edward Snowden at Internet Engineering Task Force addressed the participants of IETF 93:

He appealed to technically prevent the next generation of attacks on the infrastructure. Edward Snowden during a live connection demanded from the Internet Engineering Task Force (IETF) to develop the "next generation of protocols to protect against the next generation of attacks". Standards should help users to safely 'surf' through the network called the NSA whistleblower with a view on the IETF Internet standards and warned: "if technology itself becomes the risk, it is our fault, because we leave the development to others instead of intervening ourselves." Concrete proposals
The wish list Snowden delivered on Sunday night at IETF-93 includes quantum cryptography, a renewed DNS and especially the closure of universal global identifier in the network. After a video projection of the documentary film Citizenfour, the whistleblower, who is stuck in Moscow, answered the about one hour questions of engineers and campaigned for the detachment of the "identity of the person" in the network. The IETF developers acknowledged Snowdens participation with standing ovations.  "We need to separate permanently identity and person", Snowden confirmed the about 500 participants of the IETF (really?). Pervasive encryption of content, as it could be reality in 15 or 20 years, doesn't help if at the same time, metadata allow a monitoring and profiling. "We kill based on metadata", Snowden quoted the ex-NSA Chief Michael Hayden. Developers would have to enable users, to be in the net either a "Generic person, a non-person, or a completely anonymous person".

Priority of the user
The whistleblower especially emphasized the primacy of the will of users and of fundamental rights on the net. The interests of governments, but also of companies in metadata should be secondary after public interest in secure unobserved communications. The task of developers and administrators is "to safely help on the network path".  Exactly this "network path" is currently the most dangerous area in the network. The used middleboxes and the installation of lawful interception, which barge in between user and destination address automatically create vulnerabilities, the ex-NSA analyst argued. We are already far away from the original ideal concept of a stupid core/transport network and smart endpoints. "We now have very dumb endpoints and a deadly core network", Snowden said. A significant risk would also be that dangerous technology, as the surveillance by unmanned drones, will be commercially further developed by retiring experts and made market ready.

With technology against surveillance
Snowden entered in his answers very specifically on the work of the IETF and warned about the recently proposed idea to provide middle boxes through a new Protocol with the working title "Spud" with some data, to prevent disconnections or deep packet inspection. His plea for the restoration of end to-end principle - "the easiest path is the best" - was applauded extensively by many IETF participants. Snowden hoped for the reduction of metadata by other IETF work, e.g. the effort towards a more privacy friendly DNS including the developments of DANE and DNSSEC. Finally, he advised IETF strongly to pay more attention to Quantum Cryptography. Without encryption, which resists quantum computers of the future, powerful attackers such as the intelligence services could decrypt in the future, what they have saved over many years.

So at least with respect to the impact of Spud both sources have understood differently ;-)

Maybe this helps

Best Regards
Dirk

Hello Alex,

Perhaps too much to ask -- but is there a transcript available?

Regards,

Charlie P.

---

From: Christian Huitema <[email-masked]>
Date: Thu, 30 Jul 2015 19:01:35 +0000

On Thursday, July 30, 2015 6:55 AM, [email-masked] wrote:

> Snowden entered in his answers very specifically on the work of the IETF and warned 
> about the recently proposed idea to provide middle boxes through a new Protocol with 
> the working title "Spud" with some data, to prevent disconnections or deep packet 
> inspection. His plea for the restoration of end to-end principle - "the easiest path is the best" - 
> was applauded extensively by many IETF participants. 

Yes, that's what we heard. The Register's reporter got very confused, but the German transcript is correct.

> Snowden hoped for the reduction of  metadata by other IETF work, e.g. the effort towards a 
> more privacy friendly DNS including the developments of DANE and DNSSEC. 

Both DANE and DNSSEC can improve security, and help making sure that encryption works end-to-end. But the specific issue addressed here is the leakage of meta-data in DNS queries, which is addressed by the QName minimization proposed in DNSOPS and by the proposed work for stub-to-recursive-resolver encryption in DPRIVE.

This was an answer to a question by Juan Carlos, and the general idea is that we have to be concerned not just with encryption of content, but also with the leakage of meta-data at various layers in the stack. Snowden was for example commenting on listening devices that record radio traffic. Imagine drones circling abve cities and recording the IMSI of cell phones, or the MAC addresses used by the clients of Wi-Fi networks. That can lead to continuous tracking of devices and their owners -- and we should be doing something about it.

-- Christian Huitema

---

From: Stephen Farrell <[email-masked]>
Date: Thu, 30 Jul 2015 20:15:57 +0100

Hiya,

On 30/07/15 20:01, Christian Huitema wrote:
> This was an answer to a question by Juan Carlos, and the general idea
> is that we have to be concerned not just with encryption of content,
> but also with the leakage of meta-data at various layers in the
> stack. Snowden was for example commenting on listening devices that
> record radio traffic. Imagine drones circling abve cities and
> recording the IMSI of cell phones, or the MAC addresses used by the
> clients of Wi-Fi networks. That can lead to continuous tracking of
> devices and their owners -- and we should be doing something about
> it.

And luckily some of us (notably Christian! :-) [1,2,3] are trying to
tackle those meta-data issues. Which in most cases has to be done one
protocol at a time. Which means there's plenty of work to go around;-)

So if anyone has ideas about how to improve the privacy properties of
some IETF protocol in a similar fashion, best would be to send a
mail to [email-masked] (*) which we're still using to triage pieces
of work like that. Ideally folks proposing we do stuff will have had
the energy to write an I-D and we can figure out how best to process
that. Processing such an I-D could pointing the authors to some WG
(such as the DNSOPS work on QNAME minimisation referred to earlier) or
AD sponsoring the draft when it's ready or we can form a new WG when
needed. All of those are possible, and have been done with previously
suggested work in this space, and we're entirely happy to do more of
that whenever sensible ideas are presented.

Cheers,
S.

(*) If you're shy or unsure, feel free to mail Kathleen or I first
and we can try help.

[1] https://tools.ietf.org/html/draft-ietf-dhc-anonymity-profile
[2] https://tools.ietf.org/html/draft-huitema-privsec-harmfulname
[3] https://tools.ietf.org/html/draft-huitema-6man-random-addresses