Subject: Re: Should IETF do more to fight computer crime?

From: "Steven M. Bellovin" <[email-masked]>
Date: Mon, 22 May 2000 11:21:55 -0400

In message <v04210102b54c9601e1fc@[193.173.137.42]>, Jacob Palme writes:
>Should IETF do anything to fight the increasing incidences
>of net criminality? Can we do anything? Can the protocols,
>which IETF manages, be modified so as to make it easier
>to fight virus distribution, mail bombing, ping attacks
>and the other ways in which people are harassing the
>Internet?
>
>Or would such changes to the Internet protocols mean
>more invasion of privacy, in a way which is even less
>acceptable than letting the criminals continue? It seems
>that there is a strong group in IETF which likes the
>freedom of the net and believes that changes to stop
>criminal usage would also remove this freedom? Is this
>true, or can we fight net criminaltiy without risking
>the freedom of the net?

Harald made some very good points; let me just add a few more.

First -- as a computer security professional, I'm certainly concrned 
about "cybercrime".  But the changes you suggest cut both ways.  I 
don't know how to weaken a security protocol selectively, so that only 
"good guys" can read the traffic.  Apart from varying definitions of 
what is good and bad -- and even the major democracies on this planet 
have very different standards on that -- a hole is a weakness, and 
requires much more complexity to protect that hole.  Complexity is, in 
itself, a security problem; in my opinion, and in the opinion of most 
(though, of course, not all) of the security folks in the IETF, adding 
any sort of back door to our cryptographic protocols would create far 
more security problems than it would solve.  (For more on this line of 
reasoning, see http://www.cdt.org/crypto/risks98.)  

There is also a major limit to the utility of strong authentication for 
tracing back attacks:  just as the bad guys use other folks' computers 
to launch their attacks, they will also use others' cryptographic 
credentials.  I'm far from convinced, for example, that the LOVEBUG 
virus would have been prevented were all mail digitally signed, because 
I strongly suspect that the attack would have invoked a digital 
signature API to generate digitally-signed copies of itself.  The real 
effect of such a policy would be a vast decrease in privacy on the net. 
(I note that the EU has very strong privacy protection laws, and U.S. 
law strongly protects anonymity as necessary for free political speech.)

In short -- yes, there are problems, but the best approach for the IETF 
is to design, build, and deploy stronger systems.

		--Steve Bellovin

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Mon, 22 May 2000 10:43:39 -0700

<rant>
We must be careful not to classify our efforts as preventing crime.
Crime is matter of law and law is jurisdictional.  As the Internet
is crosses jurisdictional boundaries, there is not one clear
definition of law and hence no clear definition of crime.  And
crime is not always bad.  Some crime, such as civil disobedience
to promote basic human rights, is good.

I believe it appropriate to discuss such issues in the general
context of security.  We should continue to enumerate, discuss,
and resolve security considerations.  Though we might be driven
by our own needs (hopefully well intended),  protocols we develop
can and will be used for both legal and illegal activities
(regardless of our intent).

The IETF should focus on providing technology to implement
secure solutions irregardless of whether the solutions are
used for legal or illegal activities.
</rant>

Kurt

---

From: Jacob Palme <[email-masked]>
Date: Mon, 22 May 2000 20:01:10 +0200

Does there exist a mailinglist specially oriented towards
cybercrime and its prevention? If not, should we start such
a list?
-- 
Jacob Palme <[email-masked]> (Stockholm University and KTH)
for more info see URL: http://www.dsv.su.se/jpalme/

---

From: Jacob Palme <[email-masked]>
Date: Mon, 22 May 2000 20:14:36 +0200

> is to design, build, and deploy stronger systems.

But would not better logg production in routers be an aid
in finding the villain behind computer crimes?
-- 
Jacob Palme <[email-masked]> (Stockholm University and KTH)
for more info see URL: http://www.dsv.su.se/jpalme/