Subject: RE: Requirements Document

From: [email-masked]
Date: Wed, 15 Aug 2001 09:42:00 +0300

Hi Behcet,

>   During the meeting Henning talked about the urgency of this 
> WG's business but I could not catch his reasons. Why?

Regulations in the US (specifically - but also elsewhere) requiring
the sending of location information during emergency (911) calls.

best regards,
John

---

From: Randy Bush <[email-masked]>
Date: Wed, 15 Aug 2001 06:48:08 -0700

> the sending of location information during emergency (911) calls.

and case-law elsewhere on the opposite.  hence the need for privacy
management.

randy, who gets cautious when someone tells me i must hurry

---

From: Henning Schulzrinne <[email-masked]>
Date: Thu, 16 Aug 2001 22:46:50 -0700

To be more precise on what I said (or meant to say):

- Emergency call services are a requirement for deploying Internet
telephony.

- In PSTN emergency call services, callers know (or should know) that
dialing 911 or 112 or whatever means that they agree and consent to have
their calling number and possibly their location revealed to the public
safety answering point (or the equivalent in other countries). 

For example, even with caller id disabled, the calling number will be
delivered. I'm reasonably certain that this is true for GSM, for
example, beyond the US.

This is thus implied voluntary disclosure, not fundamentally different
than, say, including your address to your email signature. I'd be
curious where the law is different in this respect. After all, in almost
all cases the caller would want to make sure that the location is
reported accurately, even when the caller is confused, unable to speak
or in a friend's house without precise knowledge of the current address.
If you don't like the policy, call the regular police or fire department
number - thus, this gives you "privacy management".

(As a side note, the various "drop a dime on crime" hot lines do allow
the police to see your calling number, as with any 'freephone' number.
You have to trust them to maintain your anonymity. That's clearly not a
particularly good design, but inherent in the notion of 800# - you want
free calls, you lose your anonymity.)

As far as the working group is concerned, my primary issue is that there
a circumstances where voluntary disclosure of location information is
common, either explicitly (e.g., by configuring some piece of software
to send a header or include an email signature) or implicitly (by
calling a certain number). I would be curious what kind of 'privacy
management' people have in mind for these cases. Clearly, it is useful
to the extent possible to ascertain that one is indeed conveying this
information to a desired party and only to such a party, but this may
not be easy to do in practice, particularly where privacy competes with
other goals, such as robustness and minimal configuration. (For example,
one could imagine a global private/public key pair for all emergency
call systems, but distributing a single private key to thousands of
locations across the globe raises some serious issues as to how long it
will stay secret. A level of indirection would be needed, through some
form of CA.)

---

From: Randy Bush <[email-masked]>
Date: Thu, 16 Aug 2001 20:47:14 -0700

> safety answering point (or the equivalent in other countries). 

once again.  this is not true for all countries or legal environments.
hence, this group's charter to provide privacy should not be assumed to
be abrogated in any circumstances.

randy

---

From: Henning Schulzrinne <[email-masked]>
Date: Fri, 17 Aug 2001 00:04:12 -0700

I'm curious how this should work - should the working group specify a UI
mechanism that says "I consent for this call/protocol exchange to have
my location revealed" or "I consent for calls of this type (e.g., to
this location) to have my location revealed" or should a caller/user be
prohibited from ever revealing his or her location? Pardon my puzzlement
as to how this should work in real life.

---

From: Adam Shostack <[email-masked]>
Date: Fri, 17 Aug 2001 11:23:38 -0400

> safety answering point (or the equivalent in other countries). 

Could you justify this?  If I call 911 from a cell phone today, I do
not expect that my location will be revealed.  In fact, I recall a few 
years back a very famous case in Boston where a fellow called 911,
passed out, and then nearly died because they couldn't locate him in
time.  So, I don't agree that you have informed consent or legitemate
expectation that my location will be revealed, or that I know what the 
information will be used for.

For example, does your implied consent extend to implied consent to a
statistical study of from where 911 calls are made?  Does it imply
consent to my name being in the court records as the one who made the
call?

> number - thus, this gives you "privacy management".

I don't understand the term "implied voluntary disclosure."  It is
either voluntary, in which case I should have a chance to make a
different decision, or it is not, in which case I can't.  I think in
the US, it is not voluntary, but it would be a serious mistake to
build US law into code that runs in other countries.

> management' people have in mind for these cases. Clearly, it is useful

I think that the privacy requirements here are that either the
information is used only for the immediate purpose (what the EU DPD
calls "necessary for the performance of a contract...protect the vital 
interests of the data subject" (article 7), or that there are ways in
which the fair information practices are respected as the data flows.

Adam

-- 
"It is seldom that liberty of any kind is lost all at once."
					               -Hume

---

From: Randy Bush <[email-masked]>
Date: Fri, 17 Aug 2001 10:40:08 -0700

> So part of the protocol exchange is a request from one endpoint to 
> the other for a location.  The response I envision must allow for I 
> consent/I forbid/I don't care responses to the location request.

i think that is the core of what this wg was charterd to do, requirements
for privacy/security.  to quote

    "The primary task of this working group will be to assess the the
    authorization, integrity and privacy requirements that must be met in
    order to transfer such information, or authorize the release or
    representation of such information through an agent."

note that authentication of the requestor is of interest, though possibly
less so when the host being asked to divulge its location placed the
'call'.  while i have 'divulge-to-family' turned on, how does the device
know the requestor is my spouse?

and precision is also of relevance.  two extremes:
  o i only want to divulge my exact location under very restricted
    circumstances 
  o i want to divulge my mobile phone's time zone to anyone, as i want
    them to use that info to decide whether it is polite to call me.

note that a cruise through the archives (i am not sure if this list and its
predecessor share archive(s)) will show that this has been discussed before.

randy

---

From: John W Noerenberg II <[email-masked]>
Date: Fri, 17 Aug 2001 10:26:26 -0700

>as to how this should work in real life.

I don't know that we can or should specify a specific UI mechanism. 
UI falls in the realm of the local device.  That is generally out of 
our purview.  However, protocol messages enabling such a UI mechanism 
would be a good idea.  Further, I don't see any reason the protocol 
specification can't recommend or even require the messages be used.

>>  > safety answering point (or the equivalent in other countries).

Hmmmm.  I *didn't* know this.  Presumably this is some document that 
I received at the time I got my cell phone service, or it appears on 
the back of every bill.  I wonder if the public in general is aware 
of this.  "Caveat emptor," but I find this worrisome.

best,
-- 

john noerenberg
[email-masked]
   --------------------------------------------------------------------------
   We keep passing unseen through little moments
   in other people's lives.
   -- Zen and the Art of Motorcycle Maintenance, Robert M. Pirsig, 1974
   --------------------------------------------------------------------------

---

From: Henning Schulzrinne <[email-masked]>
Date: Fri, 17 Aug 2001 13:15:13 -0700

> information will be used for.

See http://www.cs.columbia.edu/sip/emergency.html for pointers. As of
Oct. 1, 2001, all wireless providers in the US are supposed to have
implemented "Phase II" of the E911 service, which provides accurate
(within about 100m, with measurements depending whether network-based
location or end system-based location is being used) location
information. Many carriers are apparently asking for waivers since they
can't meet the deadline. "Phase I" is in common use today; wireless
carriers provide the PSAP with information about the cell tower and,
where available, antenna sector used. This is then plotted on a map
reflecting propagation characteristics. This gives reasonably good
location information in densely populated areas, but doesn't help much
in rural areas.

As far as I know, no state has asked customers whether they'd like this
location information to be kept private. This is simply not an option.
(Indeed, you're probably paying on your cellular bill to have this
feature implemented, even if you'd rather not have it.)

> consent to my name being in the court records as the one who made the

Yes, all 911 calls are recorded and routinely used in court proceedings.
This does require a subpoena from a judge, so presumably normal witness
protection mechanisms are applied (one would hope). This recording
certainly applies to the audio portion and time stamp and probably also
to the other data (location and such). There have also been cases where
people making prank 911 calls from cell phones were booked based on this
information, so this information can and will be used "against" you. I
don't know how long this information is kept on file.

No, you don't get a choice in the matter. Nobody forces you to call 911;
if you don't like the policy, you can call the police or fire department
at the number listed in the phone book. You may have to wait in line
behind somebody arguing about their parking ticket, but at least your
location information is safe-guarded.

> build US law into code that runs in other countries.

I'm not a lawyer, so don't take this as legal advice. Implied consent
means that by calling 911, you agree to the laws and regulations
governing 911, including disclosure of personal information. Same thing
as when you call an 800#, your number will be disclosed, regardless of
whether you suppress caller id or not.

Again, I would be really curious where regulations differ substantially.

Finally, it doesn't matter whether other countries or jurisdictions
handle this differently. I'm not arguing against privacy control for
location information - that's clearly a good thing. However, there are
circumstances where there's implied consent. Like I said earlier, the
use of intelligent end systems allows far greater freedom for that end
system to determine its information disclosure policy. Thus, we should
look at a range of environments, including:

- end-system (and user) initiated disclosure of location information; no
protocol is needed here. This is strictly a user interface issue,
probably governed by local regulations and laws. The IETF only needs to
get involved here to the extent of defining appropriate data structures,
so that we get global interoperability. 

This is the case I'm concerned about, as it is the simpler case
technically, but immediately useful to address the legitimate needs of
the public expecting efficient delivery of emergency services. (I find
it rather peculiar that privacy is treated as a single, overriding goal
for everyone and under all circumstances. One may at least consider
cases where people prefer to be found when they're in distress, and who
may not want to risk pressing the wrong button sending the ambulance
chasing through the whole county.)

- third-party-initiated disclosure of such information, where protocol
support is definitely needed. I believe this should be the focus of the
working group, as it raises the most difficult issues. We can provide
mechanism to authorize the release of different types of information;
whether local laws respect these choices is beyond our control. There
are two sub-cases here:

(1) The network knows my precise location. In that case, I can advise
the network to "fudge" the data to a lower precision, but local laws
won't necessarily honor those choices. Such is life. The place to
address this is via the local legislative body, not the IETF.

(2) I tell the network my precise location (and the network doesn't know
on its own). In that case, I have a choice as to what I reveal to the
network.

Read "the network" as meaning a server not under my control, e.g.,
operated by a carrier.

I'm arguing that in emergency communications, control and privacy has
potential costs, as you illustrate by the example.

> which the fair information practices are respected as the data flows.

I agree, but that's a political or legal issue, not a technical one. I
see no technical means to keep the police department from using data
that it has acquired legitimately for one purpose for another. The IETF
can't keep police departments honest.

---

From: Henning Schulzrinne <[email-masked]>
Date: Sat, 18 Aug 2001 02:02:18 -0700

Separating this as an issue, independent of the philosophical pieces:

I think we need to distinguish a number of different operating
scenarios, each with different requirements:

- Location information is embedded in another protocol by the user.
Thus, the user decides (in some generic sense, i.e., this could be
configured permanently or per request or any complicated logic, e.g.,
depending on the location itself)
  . who this information is made visible to at what precision
  . whether the recipient needs to be authenticated

I don't see where a protocol gets involved here, beyond the "mother"
protocol that carries this information. In this mode, authentication
will likely be performed in the mode best suited to the "mother"
protocol, e.g., TLS for HTTP.

- Location information is known to some server controlled by the user
and available for special-purpose queries. Here, the user has to tell
the server what to do, either interactively or by some logic. The latter
case is essentially the same as in the first case, i.e., no protocol is
needed.

- Location information is known to some server controlled by the user,
but inserted into another protocol "along the way" (e.g., in a proxy
server). Similar to the previous case, except that the "location release
authorization" may well need to be embedded in the "mother" protocol to
make sure it reaches the right server.

---

From: Adam Shostack <[email-masked]>
Date: Mon, 20 Aug 2001 13:22:30 -0400

> > > safety answering point (or the equivalent in other countries).
[...]
> location information to be kept private. This is simply not an option.

Thanks for the pointers.  I think we have a fundamental difference in
the way we're using the term "consent."  For me, I don't consent to
things that are mandatory, I accept them.  The term consent is usually
used this way in the privacy field; if you don't agree to the full
data transfer, you should still be able to get service.

Then I would avoid the use of the term consent, and say simply that
callers should know that their calling number and location will be
revealed to the public safety answering point.  Generally, this will
require some form of notice in those countries which have privacy
laws, although there may be exceptions already granted.

> Again, I would be really curious where regulations differ substantially.

The law enforcement use of the data (false calls) is different from
other secondary uses of the data.  Its not clear to me if other uses
(such as a statistical study of the data) would be allowed on the
fully identifiable data.  See section 7 of the EU Data Protection
Directive.  (I have a hardcopy here, so I don't have an URL handy.)

> chasing through the whole county.)

I don't see any problem with members of a society having different
priorities, or asking engineers to cope with them.  I do have a
concern about a technology (cell phones) which is very useful today being
changed so that it can be used as a tool of mass surveillance, and I
think that that concern is widely shared, by many engineers.

> can't keep police departments honest.

I think its possible to make design choices that make these things
easier or harder.  For example, we could suggest that the right way to
deal with all requests for data is via strongly authenticated http
requests to the network (as you defined it above).  We could also
suggest that the right way to handle such requests is via streaming
mbone to the various police agencies that might have an interest.  It
is clearly easier to audit and manage the use data in the first case.
We could go a step further and define a protocol which, unless there
is a specific reason not to, will notify the user device that the
network has answered a request on its behalf.  While neither of these
would keep a police department honest, I think it helps to illustrate
that there are choices we're making, and I think that its appropriate
for a group whose charter involves privacy to make those choices
consciously. 

Adam