Subject: RE: Summary of RE: [Sip] Comment, SIP Privacy draft

From: "Mark Watson"<[email-masked]>
Date: Tue, 16 Apr 2002 14:31:25 +0100

Juha wrote:
> i don't see how "who pays for the service for a set of users" has any
> relevance to the privacy discussion.
> 

Then you should take this up with the European Commission, and other
legislative organisations in the rest of the world.

The identity of the user is considered by them to (potentially) reveal
Personal Data of the subscriber. Personal Data is protected by 'Data
Protection' laws which you are free to disobey if you don't mind the fines.

[It's not 'who pays', is it who has legally contracted for provision of the
service (usually the same person who pays).]

> i do insist individual usernames and passwords.  if you do not have
> that, then there is no way to figure out who made the calls, 
> which is a
> VERY big problem both for the company and for system in general.

The requirement is not about usernames, passwords, UAs, SIP, packets, IP,
clients, proxies, networks etc. etc. This requirement is about services,
service providers, Personal Data, subscribers, users and the protection of
their data according to the law.

...Mark

---

From: [email-masked]
Date: Tue, 16 Apr 2002 16:45:21 +0300

> Protection' laws which you are free to disobey if you don't mind the fines.

huh.  i have never said that i don't honor someone's privacy wish.

 > their data according to the law.

fine and i don't have any problem with any of that.  the display string
does protect the privacy of the user according to his/her wish either on
call by call basis or for all calls.

-- juha

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: "David R. Oran" <[email-masked]>
Date: Tue, 16 Apr 2002 09:59:59 -0400

Mark,

I must admit that I am not following at all what you are saying. As far
as I know, the privacy laws and regulations are meant to protect
personal information disclosed by the person *to his service provider*,
either via the act of subscribing, and/or by the act of invoking the
service.

I think that the vast majority of the information the user puts in SIP
messages (either header or body) are no more "information disclosed to
the service provider" than the contents of files he FTPs, or dirty
pictures in a jpeg MIME body. They are information disclosed TO THE
RECIPIENT, which the service provider just happens to see going by, or
acts on to provide services for the user. If it were required that the
service provider not disclose this information, they'd all be getting
sued for not encrypting all the traffic going by. The exception are
things specifically for the consumption of the service provider, such as
proxy-authenticate tokens and the like.

I think the information that is of relevance to this discussion is stuff
that was *NOT* inserted by the user, but was instead inserted by the
service provider based on things the user had previously disclosed to
the service provider. These are the things which in fact do need some
level of protection, which is why we have this complicated applicability
statement on the privacy draft and why (I at least) would argue that the
only reasonable design is one in which any identifying information
inserted by the service provider be encrypted or otherwise protected
from disclosure to other parties (including the callee) unless the
customer explicitly requests it not to be.

This last, is of course, just a matter of the default setting of the
privacy: header, which can be handled by default UA configuration and
need not be the subject of protocol standardization.

Dave.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Mark
Watson
Sent: Tuesday, April 16, 2002 9:31 AM
To: [email-masked]'
Cc: 'Ben Campbell'; Chiou, Mark; Dean Willis; [email-masked];
[email-masked]
Subject: RE: Summary of RE: [Sip] Comment, SIP Privacy draft

Then you should take this up with the European Commission, and other
legislative organisations in the rest of the world.
The identity of the user is considered by them to (potentially) reveal
Personal Data of the subscriber. Personal Data is protected by 'Data
Protection' laws which you are free to disobey if you don't mind the
fines.
[It's not 'who pays', is it who has legally contracted for provision of
the service (usually the same person who pays).]
> VERY big problem both for the company and for system in general. 
The requirement is not about usernames, passwords, UAs, SIP, packets,
IP, clients, proxies, networks etc. etc. This requirement is about
services, service providers, Personal Data, subscribers, users and the
protection of their data according to the law.
...Mark