Subject: Re: Summary of RE: [Sip] Comment, SIP Privacy draft

From: [email-masked]
Date: Fri, 12 Apr 2002 10:31:56 EDT

In a message dated 4/11/02 2:30:03 PM Eastern Daylight Time, 
[email-masked] writes:

> 5) Use a non-Internet protocol which completely constrains the service
> functionality and user experience to a least common denominator and stop
> pretending that your requirements have anything to do with the Internet.
> 
> Look, there are two reasons why we may want to use Internet protocols:
> 
> <snip>
> 
> 2) Because we're jealous of the success the Internet has had and want to
> contaminate it with "telco like" requirements so that Internet people
> can be miserable too.
> 
> <snip>
> 
> If we earnestly believe that Data Protection is going to require that
> we, by policy, alter these human-supplied/human-consumed values, then
> we're logically going to have to do the same for every other
> human-supplied/human-consumed values. I would argue that this completely
> defeats the value of an Internet protocol in this context.
> 
> I believe it is significantly more effective to provide guidelines on
> human-supplied/human consumed values, and implement hard requirements
> for data protection only on network-supplied values.
> 
> 

The issue here is not what any of us want to do to "contaminate" the purity 
of IP or to make it look like the PSTN with its "limited" capabilities, but 
rather, what will be required by various regulatory agencies once they 
realize that, if IP is going to be used to replace traditional telephone 
service, it has to comply with all the same rules and regulations. The area 
of calling line ID presentation and restriction is the most complicated, with 
different rules in different states and countries.

Voice over IP isn't going to escape this regulation for long. It will get 
"telco-like" requirements sooner or later. It's pretty obvious to me that 
there needs to be an agreement on the requirements before any more discussion 
on the protocol details that might be needed to solve an (undefined) problem.

Mike

---

From: "Dean Willis" <[email-masked]>
Date: Fri, 12 Apr 2002 10:52:24 -0500

Mike wrote:
------------- 
 Voice over IP isn't going to escape this regulation for long. It will
get "telco-like" requirements sooner or later. It's pretty obvious to me
that there needs to be an agreement on the requirements before any more
discussion on the protocol details that might be needed to solve an
(undefined) problem.  
-------------- 
 
I don't completely disagree. In fact, I'm arguing the requirements.
 
The point I'm trying to make is that To and From are USER supplied
information. The Service Provider doesn't insert them, inspect them, or
have any responsibility for them. Insisting that the service provider
change them is just like insisting that the service provider change any
other user-supplied information, such as the words I'm typing now.
Anything I put in my To or from field is deliberately and explicitly
intended to be delivered to the terminating side of the dialog, and if
as a service provider you FAIL to do that, then you have DAMAGED my
data, and my lawyers will be in touch!
 
The calling-party-identity presentation infromation (CLIP or RPID) is
NOT inserted by the user. It is inserted by the network, WITHOUT THE
CONSENT of the user. As such, the operator is responsible for the
protection of that information in a manner consistent with regulation
and the expressed wishes of the user.
 
The calling-line-identity-restriction information (CLIR or Privacy) is a
means by which the user expresses wishes with respect to the handling of
NETWORK provided information.
 
This divides data into three classes:
 
1) Data inserted by a user's system, under the control of a user, and
intended to be delivered to the termination of the dialog
2) Data inserted by a user's system, under the control of a user,
intended to be delivered to an intermediate system and not beyond
3) Data inserted by the network, without the awareness of a user,
intended to be delievred to an intermediary or terminal point.
 
Service providers are by regulation in reasonable nations required to
prevent class 2 information from being leaked, and to respect the user's
preferences for delivery of class 3 data. 
 
The problem is, the "normal" telephone network doesn't obviously HAVE
user-provided information in the signaling path which is intended to be
delivered to the other end, so telco people start by assuming that all
signaling is the responsibility of the service provider. But there
really is something analogous. Consider Q.SIG, user signaling at the
ISDN level generally used for PBX-to-PBX work. What Mark has been
arguing is essentially like arguing that a service provider must PREVENT
the delivery of Q.SIG data because it MIGHT compromise Data Privacy. Of
course it does! It's SUPPOSED to! The operator's responsibility is to
limit the delivery of the data to the intended party (as opposed to
deliverying it to somebody else), not to keep the user from
communicating with the intended party.
 
That's right, kids -- SIP by definition is an enhanced service channel.
It does MORE than plain-old-telephone-service. If you use it carefully,
you can emulate POTS.
 
So, what are these "anoymizer" services we keep talking about? Are they
consistent with my data class division? Notice that class #1 says "to
the termination of the dialog". In using such a service, I'm requesting
that my dialog terminate at an intermediate point which implements the
service of generating a second related but anonymized dialog. In other
words, the behavior is explicitly requested by the user, and is
therefore "ok with me".
 
--
Dean

---

From: [email-masked]
Date: Fri, 12 Apr 2002 21:31:58 +0300

Dean Willis writes:

 > have any responsibility for them.

if someone subscribes to my sip service, i DO check for each message
received from the user that the from field corresponds to what i have
agreed with the user.  otherwise the user could fake to be somone else
that i consider a bad thing.  if the from field doesn't match, i don't
forward the message.  if that is not acceptable for the user, the use
can choose another service provider or roll its own service.  ii do not
modify anything.

 > data, and my lawyers will be in touch!

i'm not damaging your data.  i simply don't serve your message and you
have no way to win the case in court.

-- juha

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip