Subject: [ietf-privacy] Research Note on NSA/Snowden for EuroParl PRISM inquiry

From: Caspar Bowden <[email-masked]>
Date: Sun, 29 Sep 2013 14:52:42 +0100

Although partly EU-specific, this <http://t.co/X4j9iCE6Ox> research Note 
on FISA/NSA for European Parliament PRISM inquiry might interest list 
members (35 pages, interdisciplinary). It was presented on 24th Sep and 
has now been accepted, so please redistribute if you wish

grateful for any feedback

Caspar
@CasparBowden

---

From: Stephen Farrell <[email-masked]>
Date: Sun, 29 Sep 2013 15:33:33 +0100

Hi Caspar,

> grateful for any feedback

I've only skimmed the recommnedations/conclusions so far but have
two comments. (I'll read the rest later, honest:-)

- I don't see why a "euro cloud" (section 3.1) would be any less
surveilled, e.g. by .eu governments on their own behalf of on behalf
of their partners. There could be jusrisdictional reasons for that
maybe (not that I'd understand those) but I don't think such a
recommendation really touches on pervasive monitoring at all unless
you're under the misaprehension that .eu governments are all far too
nice for that kind of thing or something. Can you explain that one?

- I think you could add a recommendation to work with the Internet
community on better technical solutions that can perhaps dramatically
increase the costs for pervasive monitoring. That's not a purely
cryptographic thing, and is something on which work is being done
e.g. here in the IETF. Note, nobody's claiming that changes made in
the IETF can fully "fix" this problem, but there are things we can
do that can help if they get deployed.

BTW, I think it'd be useful for us as well if the IETF had a way
to learn more about the non-technical reactions to all this stuff,
any ideas there welcome.

Cheers,
S.

> 
> Caspar
> @CasparBowden
> 
> 
> 
> 
> 
> 
> 
> 
> _______________________________________________
> ietf-privacy mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ietf-privacy
>

---

From: Caspar Bowden <[email-masked]>
Date: Sun, 29 Sep 2013 18:11:38 +0100

> two comments. (I'll read the rest later, honest:-)

thanks for feedback

> of their partners.

There's two reasons

1) most people in a democracy prefer to be spied on by their own govts. 
not a foreign govt (rather not be spied on at all obviously)

2) the "political" purposes in the defn. of FII I point at would be 
illegal in EU (they don't exist in corresponding EU laws, and the 
Belgacom/GCHQ case will be a real test case on this point). The fact is 
that it is not illegal (in US) for the US to do that to (say) Belgium, 
but is it is illegal for one European state to do that to another 
(political spying rather than "genuine" national security)

This is an incredibly important point which I still not think is widely 
understood (especially by people in US)

> There could be jusrisdictional reasons for that

It is "niceness" actually, to the extent European human rights law 
prohibits this (really, it does)

If they do it, they are breaking the law (ECHR)

> increase the costs for pervasive monitoring.

I agree but it;s hard to put that in legislation ? ("work with the 
Internet community"). Best I could get was the free-software recommendation

> That's not a purely

Happy to help with that any way I can

Caspar

---

From: Paul Ferguson <[email-masked]>
Date: Sun, 29 Sep 2013 10:15:22 -0700

> not a foreign govt (rather not be spied on at all obviously)

I would prefer not to be spied on by *any* government, and certainly not my
own. I would *expect* a foreign government to conduct such operations, not
my own on it's own citizens.

- - ferg

-- 
Paul Ferguson
Vice President, Threat Intelligence
Internet Identity, Tacoma, Washington  USA
IID --> "Connect and Collaborate" --> www.internetidentity.com

---

From: Stephen Farrell <[email-masked]>
Date: Sun, 29 Sep 2013 19:02:51 +0100

Hiya,

> not a foreign govt (rather not be spied on at all obviously)

Eh... not convinced by that one. Most people have a pretty low opinion
of their own government - familiarity, comtempt and all that:-)

> If they do it, they are breaking the law (ECHR)

So the benefit of a euro-cloud would be that it'd maybe (yes, Belgacom
will be mighty interesting) de-motiviate other EU govts from surveilling
EU citizens via data in that cloud. Isn't that making the same error
that your document rightly says the US are making in considering only
the rights of US citizens?

So fwiw, I'm not at all keen on that recommendation. Note that I only
mean I disagree with the recommendation for this purpose, there are
probably lots of other good reasons why locally provided services are
a good thing. (Actually, I'd like this to go towards its logical
conclusion that everyone have their own server box in their home,
and that all "cloudy" businesses have to deal with that. But that's
some way off;-)

> Internet community"). Best I could get was the free-software recommendation

I don't see any reason why legislation couldn't say "work with
the Internet community." Maybe that's because I'm ignorant of
how to write legislation (which is the case).

So while I don't know much about what makes good legislation, I do
know that the reality of making widely-deployed Internet protocols
more privacy friendly is that such work is most likely to be
formalised here in the IETF if at all. Getting that message over
to legislators would be good, even if no legislation resulted.
(But again, the IETF cannot "solve" the problem and its important
to say that too.)

In terms of what else legislation might say, one could imagine
some well crafted law saying that services have to do their best,
and that governments and e.g. EU research funding should work with
those who can have most impact on that.

> Happy to help with that any way I can

Ditto. Let's keep that in mind.

S.

---

From: SM <[email-masked]>
Date: Sun, 29 Sep 2013 09:38:01 -0700

Hi Caspar,
At 06:52 29-09-2013, Caspar Bowden wrote:
>Although partly EU-specific, this research Note on FISA/NSA for 
>European Parliament PRISM inquiry might interest list members (35 
>pages, interdisciplinary). It was presented on 24th Sep and has now 
>been accepted, so please redistribute if you wish

There is a recommendation to develop an autonomous European cloud 
computing capacity. I gather that is to tackle issues related to 
jurisdiction.  Would a person residing outside the EU enjoy the same 
protection in terms of privacy when the European cloud computing is used?

Regards,
-sm

---

From: Avri Doria <[email-masked]>
Date: Sun, 29 Sep 2013 15:44:40 -0400

> of their own government - familiarity, comtempt and all that:-)

Another big reason.  Your own government can act on the information in many more ways that a foreign governments.  As an example:, what do I care what info Iran collects on me, as long as I am not planning to go to Iran and it does not affect anyone I know in Iran.  But if my government gets itself in a twist on my talking to people in Iran, you bet I care about the surveillance.

Of course no spying ever on anyone is the Good.  
But that is also the Unlikely.
No matter how many laws, treaties or covenants are inked.

>>> nice for that kind of thing or something. Can you explain that one?

Does it matter, really who may or may not end up invading clouds' privacy with surveillance - either legally or roguishly.  Isn't making it as difficult as possible at as many layers as possible the goal? 

> and that all "cloudy" businesses have to deal with that. But that's

Wouldn't the question be how to make private really difficult to surveil cloud arrangements for various groupings, whether divided along state lines, regional lines or community lines?  

> how to write legislation (which is the case).

And legislation can punish efforts that go beyond acceptable infraction levels.
And International treaties can set limits and conditions for international action/sanction in respect to actions that go beyond agreed upon infraction levels.

> (But again, the IETF cannot "solve" the problem and its important

The IETF should definitely advise the policy and legislative conversations to make sure the limits makes sense. And the IETF can use the policies and legislations as guides to what priority and levels of effort need to be applied to various layers/levels of privacy protections.

> those who can have most impact on that.

funding is good.

>>> to learn more about the non-technical reactions to all this stuff,

I think the solution is going to be a complex techno-political mix (including but not limited to) technical solutions at all layers, user education and attention, policy, legislation and enforcement - all in constant interaction and improvement.

avri

---

From: Caspar Bowden <[email-masked]>
Date: Sun, 29 Sep 2013 21:16:00 +0100

> of their own government - familiarity, comtempt and all that:-) 

Yes, but the reality is that if you have Cloud (as computation) at all, 
then your own govt. is going to have laws to access that which is in 
it's own jurisdiction. That's all I meant. (and it is stuff in principle 
subject to the rule of law in that country)

>> ...If they do it, they are breaking the law (ECHR)
> EU citizens via data in that cloud.

For purely political purposes yes (they will still do it, but it will be 
illegal beyond a narrow meaning of "national security", not the carte 
blanche for foreign spying in FISA def,. of FII)

> Isn't that making the same error

No, because in Europe, rights apply irrespective of nationality (yes, it 
even protects Americans in America who might send their data to Europe)

> conclusion that everyone have their own server box in their home,

I agree. But elastic scalable massively parallel computation cannot be 
disinvented (maybe it should be cos such centralization is always 
dangerous), and there will be a demand for that

> formalised here in the IETF if at all. 

I agree - but that is no help to "the Cloud" as massively parallel 
computation

CB

---

From: Caspar Bowden <[email-masked]>
Date: Sun, 29 Sep 2013 21:22:52 +0100

On 09/29/13 20:44, Avri Doria wrote:
> Another big reason. Your own government can act on the information in 
> many more ways that a foreign governments. As an example:, what do I 
> care what info Iran collects on me, as long as I am not planning to go 
> to Iran and it does not affect anyone I know in Iran. But if my 
> government gets itself in a twist on my talking to people in Iran, you 
> bet I care about the surveillance. Of course no spying ever on anyone 
> is the Good. But that is also the Unlikely. No matter how many laws, 
> treaties or covenants are inked. 

True, but if you are a European campaigning against global warming, or 
Iraq war, or other US foreign polic, then you have US as adversary more 
than own govt. (modulo that govt. and FVEY etc.)

> Does it matter, really who may or may not end up invading clouds' privacy with surveillance - either legally or roguishly.  Isn't making it as difficult as possible at as many layers as possible th…

But for "the Cloud" as massively parallel computation (or plain vanilla 
IaaS or SaaS) - THERE IS NO TECHNICAL DEFENCE (homomorphic is 
commercially useless)

> Wouldn't the question be how to make private really difficult to 
> surveil cloud arrangements for various groupings, whether divided 
> along state lines, regional lines or community lines? 

There is no technical defence. If the Cloud provider can see plaintext 
then they are vulnerable to laws like FISA .702

> And legislation can punish efforts that go beyond acceptable 
> infraction levels. And International treaties can set limits and 
> conditions for international action/sanction in respect to actions 
> that go beyond agreed upon infraction levels. 

That's why my recommendation is a (EU - gotta start somewhere) full 
Treaty binding on US (but whether one can believe in that is another - 
important - problem)

CB

---

From: Caspar Bowden <[email-masked]>
Date: Sun, 29 Sep 2013 21:29:17 +0100

> protection in terms of privacy when the European cloud computing is used?

Yes that's the point, under EU (and ECHR) law protection is given to all 
(and their data), irrespective of nationality or wherever they are 
physically located (unlike US law - which is the main thrust of my 
critique of FISA and US law)

CB

---

From: Josh Howlett <[email-masked]>
Date: Sun, 29 Sep 2013 21:10:18 +0000

Caspar,

Thank you for your thoughtful paper.

>dangerous), and there will be a demand for that

The economics will drive the outcome, as ever. Accordingly I believe that
the prevailing focus of "what can the IETF do to improve privacy" is
misplaced. We should instead focus on "what can the IETF do to reduce the
cost of privacy". If we make it cheaper, we will help providers (and their
jurisdictions) to bid for the business where consumers want to
discriminate between providers on that basis.

Having the right regulatory environment will encourage that kind of
discrimination, if it imposes penalties and provides incentives. There is
a clear role for ISOC here, and I look forward to some substantive
movement that goes beyond a press release that they are "alarmed" by these
events. The IAB should be engaged at the next level down, considering how
the policy and regulatory environment should map to the technical
architecture.

Josh.

Janet(UK) is a trading name of Jisc Collections and Janet Limited, a 
not-for-profit company which is registered in England under No. 2881024 
and whose Registered Office is at Lumen House, Library Avenue,
Harwell Oxford, Didcot, Oxfordshire. OX11 0SG. VAT No. 614944238