Subject: [Ieprep] Folts' stated requirements: Non-Traceability

From: Fred Baker <[email-masked]>
Date: Tue, 02 Apr 2002 08:03:00 -0800

In 
http://www.ietf.org/internet-drafts/draft-folts-ieprep-white-paper-00.txt, 
you state that "A US Government working group recently identified fourteen 
basic functional requirements for the future ETS."

Could you please help me, specifically, with item (c) in section 2:

>c. Non-Traceability    Selected users must be able to use NS/EP
>                        services without risk of usage being
>                        traced (i.e., without risk of user or
>                        location being identified).

What is the specific problem that this is addressing? Under what 
circumstances does an emergency worker need to be able to address emergency 
issues without disclosing his or he identity or location? Doesn't this 
militate against point (b), in which you identify that emergency services 
need to be secured against threats such as unauthorized use?

_______________________________________________
Ieprep mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ieprep

---

From: "Folts, Harold" <[email-masked]>
Date: Tue, 2 Apr 2002 15:21:41 -0500

> -----Original Message-----
> From: Fred Baker [mailto:[email-masked]]
> Sent: Tuesday, April 02, 2002 11:03 AM
> To: Folts, Harold
> Cc: [email-masked]
> Subject: Folts' stated requirements: Non-Traceability
> 
> 
> In 
The non-tracebility requirement only applies to certain government officials
that could be involved in disaster recovery operations. Particularly this
could apply to the "continuity of government" procedures.

I have been told that fulfilling this requirement could be very difficult if
not impossible in the internet environment. Nevertheless it is an objective
to be considered. In addition, some ETS traffic might need to be encrypted
to protect sensitive and confidential information. Neither of these would
apply specifically to immediate recovery operations teams at the disaster
site or operations center.

Hal

---

From: Fred Baker <[email-masked]>
Date: Tue, 02 Apr 2002 13:01:20 -0800

At 12:21 PM 4/2/2002, Folts, Harold wrote:
>to protect sensitive and confidential information.

I'm not certain that it is impossible, or even difficult. Few internet 
devices know where they are now, so location hiding isn't a problem. It is 
possible to anonymize messages in various ways, usually by sending them to 
a server that forgets who sent it, manufactures a one-time identity, and 
resends the message. Of course, having done that, there is no telling who 
sent it. You would need an anonymous authenticator of some sort, such as 
putting a PGP signature on the email that was generated using a private key 
shared by the set of people authorized to use the service.

 From that perspective, this sounds like an attribute of the service that a 
service provider would set up under an appropriate contract. I don't think 
it is fundamental to the Internet, unless you care to convince me otherwise.

In the lawful intercept discussion, a German contribution viewed 
anonymization of messages as a variety of unlawful activity - it was an 
attack in its own right. Several years back, Finland was a common place for 
anonymization servers to be sited; that stopped when Finland interpreted a 
law as saying that the anonymization server operator had to be able to 
respond to a subpoena by correlating messages sent from the server with 
their initiators.

My humble opinion - this sounds like someone wanting to have their cake and 
eat it. Is an anonymization server OK, or is it not?

But as to the fundamental attribute, I'm not sure what to do with the 
statements in your draft. Is there a technical issue that the IETF would 
respond to with a protocol?