Subject: Location Requirements - Working under failure

From: "Rosen, Brian" <[email-masked]>
Date: Wed, 17 Jul 2002 08:09:32 -0400

One of the uses for the geopriv object is in an emergency services
requests.  I am concerned about what happens under failure.  The
kind of problem I worry about is making an emergency call on
a VoIP phone which is not "logged in".  Actually, it can get
worse.  In the mobile world, you have to be able to make
a call to emergency services even if the phone is not authorized
(ie it has no service agreement).  This makes it challenging
to support authentication and to do key negotiation for
encryption.

So, whatever crypto is specified in the object itself has to work
in these scenarios.  It may not be necessary to drop all crypto.
We just have to work under challenging conditions.

Additionally, I worry about what happens under the failure of
the crypto.  Suppose, for whatever reason, the mechanism
fails to authenticate.  One might say that they would prefer
to not be able to reach what is supposed to be an emergency
service provider.  Others, myself included, would rather
get the information through even if authentication failed.
I'd rather not get into a discussion of who did what wrong
when I need help.  What is more likely to happen when
I need help - something went wrong, and a valid emergency
provider is not authenticating, or some nefarious person
is impersonating my emergency service provider?  I'm not
at all denying that the latter circumstance could arise.  
Indeed, it might be a good tactic in a terrorist attack if it was
feasible to intercept emergency calls.  It's just that I
think that it's much more likely to have the "good" case
occur rather than the bad case happen.

I would like to have a requirement that states this should
be possible.  I recognize that I should "send text".  I will,
but not tonight.

Brian

---

From: Randall Gellens <[email-masked]>
Date: Thu, 18 Jul 2002 10:02:50 +0900

At 8:09 AM -0400 7/17/02, Brian Rosen wrote:

>  The
>  a VoIP phone which is not "logged in".

It seems to me that in such a case there would be a set of default 
rules in force, created by the owner of the phone.

>  get the information through even if authentication failed.

I've always considered the rules to be able to specify whether to 
disclose location or not, and if so, to what degree of accuracy, 
depending on who is asking, which includes if and how the requester 
was authenticated, and perhaps what form of privacy protection is in 
force.  Also, there can always be legal, regulatory or contractual 
constraints on the rules.