Subject: PATRIOT/USA technical problems, call to action

From: William Allen Simpson <[email-masked]>
Date: Wed, 10 Oct 2001 15:13:12 -0400

Democracy is not a spectator sport.

The US House (hr.2975 PATRIOT) and US Senate (s.1510 USA) have 
introduced bills that will cost ISPs a lot of money. 

Unlike CALEA, there are no provisions for reimbursing ISPs for these 
expenses -- tens of thousands of dollars could bankrupt many ISPs.
This is an attack on both civil liberties and small business.

This happened because the legislators are clueless about technical 
requirements.  It is up to you to educate them!

With the bombing started, it is thought that the bills will be pushed 
through this week, without going through the normal committee review.

Each and every one of you MUST call your legislators, where you work and 
again where you live.  Call your Senators, and then call your 
Representative.  Do not send email, it won't get read soon enough!

And those of you overseas should contact your governments, too.  The 
bills both treat non-US citizens more harshly.

--

If you live or work in their state, especially call:

Daschle, Tom
Feingold, Russ

Graham, Bob
Hatch, Orrin G.
Leahy, Patrick J.
Lott, Trent
Sarbanes, Paul S.
Shelby, Richard C.

--

The open-ended lack of definitions of "routing" and "addressing" are the 
specific problem.  They are mixed in with phone calls and signaling.

The solution is to add clarification to the definitions section 3127.  
This solution means we can do it with standard tools, and unlike phone 
call setup, there's nothing in the definitions that indicates the 
information has to be recorded for future requests:

 (7) the term "addressing" means a numeric identifier that assists the 
delivery of electronic communications over a specific link, attached to 
the outermost encapsulation of the communication (but not including the 
contents of such communication).

 (8) the term "routing" means the numeric internetwork locator 
associated with a communication that facilitates its carriage between 
electronic communication services, contained within the internetwork 
communication encapsulation (but not including the contents of such 
communication).

--

The legal justification might be that there is no expectation of privacy 
for the IP header, as every service provider's router examines that 
header as it passes. 

There IS an expectation of privacy for everything beyond the IP header, 
as it is processed internally by the recipient.  

--

Urge your representatives in Congress to hold full hearings, and fix 
technical problems.

1. Call the White House switchboard at 202-224-3121, and ask to be 
connected to the office of your Senator/Representative.
 -or-
   Look up the office numbers on the web at www.house.gov and 
www.senate.gov.

2. When you are put through, say "May I please speak to the staff member 
who is working on the anti-terrorism legislation?" If that person is not 
available to speak with you, say "May I please leave a message?"

3. Briefly explain that you are an Internet Engineer, and although you 
appreciate the efforts of your representative to address the challenges 
brought about by the September 11th tragedy, it would be a mistake to 
make any changes in the federal wiretap statute that do not respond to 
"the immediate threat of investigating or preventing terrorist acts."

4. Tell them they need a strong definition of Internet "addressing" and 
"routing".  Ask for a direct staff email address.  Educate them!

--

If they want to talk details, here they are:

Both bills add "addressing" and "routing" to the list of activities that 
can be requested without a specific court order.  So, just like call 
setup for the phone companies, every single address that you assign, via 
DHCP or otherwise, and every ARP, RIP, OSPF, and BGP routing table 
change, must be recorded for posterity -- just in case any state or 
federal agents want to review it someday.  No time limits, and no 
statute of limitations.

Some lawyers read this to extend to tracking every URL accessed through 
your POPs, and every email To: CC: BCC: and From: transmitted over your 
networks, since they all can be considered "addressing" and your 
activity "routing".

Obviously, the legislators don't quite understand what a dynamic 
packet connectionless Internet means!

--

According to http://www.senate.gov/~leahy/press/200110/100401a.html,

  "Administration initially proposed expansion of pen register and trap 
  and trace authority to capture undefined "routing" and "addressing" 
  information of Internet users. "

I have received private confirmation that during negotiations, 

  "... the Republicans and the Administration would not accept the 
  definitions and prefer to leave it undefined. "

Apparently, the Administration wants the capability to track every 
Internet user simultaneously, just like they want to track every cell 
phone user.  They want the ISPs to record all addresses assigned, all 
email transmitted, all web sites accessed, and all routing changes, so 
that they can access the information without going to the trouble of a 
warrant.

Believe me, I've been explaining for days that URLs and email addresses 
are content, and routing changes are carried by ISPs not suspects, but 
I've only convinced some of my representatives.  Instead, others 
believe that we need to track every public library terminal, etc, that 
a suspect _might_ use, everywhere in the US.

According to former FBI agent nee Congressman Mike Rogers, "It will only 
give them addresses and other basic information....  these terrorists 
have multiple ways of communicating.  They can communicate through the 
Internet, they can use 15 cell phones and rotate them to avoid 
detection.  (The act) would allow us to keep pace with that....  it 
allows you rather than targeting a phone, to target an individual and 
their electronic communications. "

--

If you really want the nitty gritty on other issues with the so-called 
anti-terrorism legislation, in laymans' terms, I recommend reading

CRYPTO-GRAM SPECIAL ISSUE, September 30, 2001
<http://www.counterpane.com/crypto-gram.html>

Visit the following Web sites for up-to-date information on what is 
happening and what you can do to help.

The Electronic Privacy Information Center:
<http://www.epic.org>

The Center for Democracy and Technology:
<http://www.cdt.org>

The American Civil Liberties Union:
<http://www.aclu.org>
-- 
William Allen Simpson
    Key fingerprint =  17 40 5E 67 15 6F 31 26  DD 0D B9 9B 6A 15 2C 32

---

From: Fred Baker <[email-masked]>
Date: Wed, 10 Oct 2001 16:10:21 -0700

>This is an attack on both civil liberties and small business.

I agree that our legislators are not technologists. That said, what you 
report here isn't what I heard:

Said report on HR 2795, to whit:

>The text is at http://thomas.loc.gov/  The current version at Thomas does 
>not include the amendments.
>
>The following amendment caught my eye.  It isn't clear what its affect 
>would be on our CALEA efforts:
>----------------------------
>No Technology Mandates
>10/3. Rep. Rick Boucher (D-VA) offered an amendment at the House Judiciary 
>Committee's mark up of the PATRIOT Act on October 3, which was adopted by 
>a unanimous voice vote. The amendment prevents the government from 
>requiring ISPs or other service providers to modify their equipment or 
>services under the PATRIOT Act. The amendment was cosponsored by Rep. Bob 
>Goodlatte (R-VA) and Rep. Chris Cannon (R-UT).
>
>The amendment states as follows: "Insert at the end of Title I the 
>following. Section ___: Clarification of No Technology Mandates. Nothing 
>in this Act shall impose any additional technical obligation or 
>requirement on a provider of wire or electronic communication service or 
>other person to furnish facilities, services or technical assistance."
>
>There was nothing in the bill which required service providers to furnish 
>any facilities or services to the government. Reps. Goodlatte and Boucher 
>both explained their reasons for offering this amendment. They are 
>concerned about the history of the Communications Assistance for Law 
>Enforcement Act (CALEA). Congress passed this Act in 1994 to enable law 
>enforcement authorities to maintain their existing wiretap capabilities in 
>new telecommunications devices. The Congress had cell phones in mind. It 
>provides that wireline, cellular, and broadband PCS carriers must make 
>their equipment capable of certain surveillance functions. However, the 
>FBI has since sought an implementation of CALEA that expands surveillance 
>capabilities beyond those provided in the statute. Moreover, the FCC, 
>which has written implementing rules, has largely backed the FBI. This has 
>imposed considerable burdens and costs upon service providers, and their 
>customers.
>
>-----------------------------------------

---

From: William Allen Simpson <[email-masked]>
Date: Wed, 10 Oct 2001 21:06:29 -0400

> >not include the amendments.
Well, Fred, as you noted, the amendments that were adopted in House 
Judiciary have not been reported out, because the Administration doesn't 
like them.  That's why you won't find them on Thomas....

There were many other amendments offered, and the Chair refused to 
allow a vote, saying there could be changes between committee and the 
floor without any committee review.

Meanwhile, it apparently doesn't matter what the House Judiciary did, 
the Administration prefers the Senate version, and the Speaker is 
holding the House version up until after the Senate acts.  The 
Administration doesn't want this to go to conference committee.

That's why the folks I "especially" pointed to are all Senators.

That's why I noted "without going through the normal committee review."

Glad to see you are following this, at least to a minimal extent....
-- 
William Allen Simpson
    Key fingerprint =  17 40 5E 67 15 6F 31 26  DD 0D B9 9B 6A 15 2C 32