Subject: Re: [Int-area] WG adoption call: Availability of Information in Criminal Investigations Involving Large-Scale IP Address Sharing Technologies

From: "Rajiv Asati (rajiva)" <[email-masked]>
Date: Wed, 9 May 2018 11:32:31 +0000

I agree with Med.

--
Cheers,
Rajiv

From: Int-area <[email-masked]> on behalf of "[email-masked]" <[email-masked]>
Date: Wednesday, May 9, 2018 at 7:26 AM
To: Juan Carlos Zuniga <[email-masked]>, "[email-masked]" <[email-masked]>
Subject: Re: [Int-area] WG adoption call: Availability of Information in Criminal Investigations Involving Large-Scale IP Address Sharing Technologies

Hi all,

There is no reason to revisit or deprecate RFC6302:

·         The root technical issues as documented by intarea (RC6269) are still valid. Those issues will be experienced by more and more in the future.

·         RFC6302 records a valid technical recommendation for servers logging IP addresses for abuse purposes.

I don’t think that the IETF has to mandate or preclude (IP address) logging. There are plenty cases where this is justified. Likewise, there are cases where this is not motivated at all.

Corollary, the IETF has not to provide a recommendation about “acceptable” duration for which logs, if recorded, have to be maintained. There are country-specific laws/rules for those matters.

Cheers,
Med

De : Int-area [mailto:[email-masked]] De la part de Juan Carlos Zuniga
Envoyé : mercredi 9 mai 2018 12:44
À : int-area
Objet : Re: [Int-area] WG adoption call: Availability of Information in Criminal Investigations Involving Large-Scale IP Address Sharing Technologies

Hello,

The call is now over and there’s been a good discussion on the list. Even though there is clearly no rough consensus to get the document adopted by the WG, many interesting points have been made.

More than the details about what/where/when/how/for-how-long to log, the more important question is whether IETF should say anything about this topic or not.

For this, we need to consider not only the technical details, but also the intended audience and the potential implications that the document could have outside the IETF.

There are three options, which could lead to different next steps:

·      Should IETF say anything at all about logging?
o  If yes,
§  Are we ok with RFC 6302 in its current form?
·      If yes: Then we have nothing else to do
·      If no: Should we amend 6302?
o  If no,
§  Should we deprecate/make-historical 6302?

Although this is something that may need to be addressed beyond the IntArea WG, any inputs people can provide here would be useful.

Best,

Juan Carlos & Wassim

From: Int-area [mailto:[email-masked]] On Behalf Of Juan Carlos Zuniga
Sent: April 19, 2018 5:38 PM
To: int-area <[email-masked]<mailto:[email-masked]>>
Subject: [Int-area] WG adoption call: Availability of Information in Criminal Investigations Involving Large-Scale IP Address Sharing Technologies

Dear all,

After some discussions on the v6ops and intarea mailing lists, the author of draft-daveor-cgn-logging is requesting its adoption by the IntArea WG.

Hence, we would like to start a WG adoption call for draft-daveor-cgn-logging-04 https://tools.ietf.org/html/draft-daveor-cgn-logging-04.

Please indicate your preferences/comments on the mailing list. The deadline is May the 4th.

Best,

Juan Carlos & Wassim

---

From: Joe Touch <[email-masked]>
Date: Wed, 9 May 2018 08:02:08 -0700

> 
> From: Int-area <[email-masked] <mailto:[email-masked]>> on behalf of "[email-masked] <mailto:[email-masked]>" <[email-masked] <mailto:[email-masked]>>
> To: Juan Carlos Zuniga <[email-masked] <mailto:[email-masked]>>, "[email-masked] <mailto:[email-masked]>" <[email-masked] <mailto:[email-masked]>>
> Hi all, <>
> I don’t think that the IETF has to mandate or preclude (IP address) logging.

I agree with the last sentence above, but I also think that the IETF shouldn’t be making “recommendations” in this area either (i.e., the last sentence implies to me that RFC6302 needs to be deprecated). 6302 is about identifying customers - not protocol or network diagnostics.

IMO:

- the IETF should speak to logging only when it relates to *protocol or network diagnostics*
- this means that the current document should not proceed
- this means that RFC6302 should be deprecated

Joe

---

From: Tom Herbert <[email-masked]>
Date: Wed, 9 May 2018 08:50:20 -0700

On Wed, May 9, 2018 at 8:02 AM, Joe Touch <[email-masked]> wrote:
>
>
>
> From: Int-area <[email-masked]> on behalf of
> "[email-masked]" <[email-masked]>
> Subject: Re: [Int-area] WG adoption call: Availability of Information in
> Criminal Investigations Involving Large-Scale IP Address Sharing
> Technologies
>
> Hi all,
>
> ·         The root technical issues as documented by intarea (RC6269) are
> still valid. Those issues will be experienced by more and more in the
> future.
> I agree with the last sentence above, but I also think that the IETF
> shouldn’t be making “recommendations” in this area either (i.e., the last
> sentence implies to me that RFC6302 needs to be deprecated). 6302 is about
> identifying customers - not protocol or network diagnostics.
>
> IMO:
>
+1. More generally, I believe that IETF should not publish protocols
or recommendations that are based on regulatory requirements.

Tom

> Joe
>
>
> _______________________________________________
> Int-area mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/int-area
>

---

From: Brian E Carpenter <[email-masked]>
Date: Thu, 10 May 2018 11:29:08 +1200

Joe,
> - the IETF should speak to logging only when it relates to *protocol or network diagnostics*

That may be a bit narrow, which is why I prefer ...relates to *operational requirements*. And yes, that could include requirements over which the operator has no control, such as regulatory requirements. It's really not the IETF's business *why* an operator decides to log stuff. RFC 6302 is about *how* to log address information.

> - this means that the current document should not proceed

A slightly different question from whether we should tackle the topic. I don't think the IETF would do itself any favours by tackling the topic. That doesn't mean the topic is unimportant, just that this is not the venue for it.

Why? It is about operational logging, and specifically says (end of section 2):

>> The above recommendations apply to current logging practices.  They
>> do not require any changes in the way logging is performed; e.g.,
>> which packets are examined and logged.

Regards
   Brian

---

From: Joe Touch <[email-masked]>
Date: Wed, 9 May 2018 19:23:25 -0700

> On May 9, 2018, at 4:29 PM, Brian E Carpenter <[email-masked]> wrote:
> 
>> IMO:
>> 

That’s disingenuous at best.

The RFC states:

   ...In the past, to support abuse mitigation or
   public safety requests, the knowledge of the external global IP
   address was enough to identify a subscriber of interest.  With
   address sharing technologies, only providing information about the
   external public address associated with a session to a service
   provider is no longer sufficient information to unambiguously
   identify customers.

This isn’t about how to log. This is about why merely logging the old way doesn’t suit a particular reason for logging.

> A slightly different question from whether we should tackle the topic. I don't think the IETF would do itself any favours by tackling the topic. That doesn't mean the topic is unimportant, just tha…

Granted - my reply could be suffixed with “here in the IETF”.

> Why? It is about operational logging, and specifically says (end of section 2):

It’s not about logging at all; it’s about what needs to be logged to track remote users behind NATs. There’s no justification given for needing to do this for operational purposes. The only examples given are regulatory or commercial.

Joe

---

From: <[email-masked]>
Date: Fri, 11 May 2018 05:21:52 +0000

Hi Joe,

This is a little bit subtle.

RFC6302 is about operating and protecting a server against abuses, denial-of-service, and all the issues discussed in rfc6269#section-13.1. 6302 does not ask a server to enable logging or not:

Further, 6302 says explicitly:

   Discussions about data-retention policies are out of scope for this
   document.

Cheers,
Med

De : Int-area [mailto:[email-masked]] De la part de Joe Touch
Envoyé : mercredi 9 mai 2018 17:02
À : int-area
Objet : Re: [Int-area] WG adoption call: Availability of Information in Criminal Investigations Involving Large-Scale IP Address Sharing Technologies

From: Int-area <[email-masked]<mailto:[email-masked]>> on behalf of "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Date: Wednesday, May 9, 2018 at 7:26 AM
To: Juan Carlos Zuniga <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: Re: [Int-area] WG adoption call: Availability of Information in Criminal Investigations Involving Large-Scale IP Address Sharing Technologies

Hi all,

There is no reason to revisit or deprecate RFC6302:
•         The root technical issues as documented by intarea (RC6269) are still valid. Those issues will be experienced by more and more in the future.
•         RFC6302 records a valid technical recommendation for servers logging IP addresses for abuse purposes.

IMO:

Joe

---

From: Joe Touch <[email-masked]>
Date: Fri, 11 May 2018 06:55:14 -0700

Whether 6302 makes a strong recommendation or not, it is clearly aimed at policy issues.

I don’t think we need documents to explain how to implement software that isn’t focused on supporting the protocols we specify.

I prefer to have 6302 deprecated so it is no longer usable as justification to do otherwise (e.g., as has been done throughout this discussion).

Joe

> On May 10, 2018, at 10:21 PM, [email-masked] wrote:
> 
> Hi Joe,
>

---

From: Brian E Carpenter <[email-masked]>
Date: Sat, 12 May 2018 08:23:38 +1200

> I prefer to have 6302 deprecated so it is no longer usable as justification to do otherwise (e.g., as has been done throughout this discussion).

Only by not reading the words Med quoted. I agree it would have been
better wordsmithed if it literally said "IF you examine and log packets
THEN this is how to do it." But logically, that's what it says.

   Brian

---

From: Joe Touch <[email-masked]>
Date: Fri, 11 May 2018 16:41:28 -0400

On 2018-05-11 16:23, Brian E Carpenter wrote:

>> I don't think we need documents to explain how to implement software that isn't focused on supporting the protocols we specify.
>> 
> Only by not reading the words Med quoted.

These words give a quite different impression: 

(abstract) ... this document recommends that Internet-facing servers log
   port number and accurate timestamps in addition to the incoming IP
   address.

Not "only if you're already doing it." - it makes the recommendation to
start, right there.

The motivation to do detailed logging (as recommended in Sec 2) is:

   In the past, to support abuse mitigation or
   public safety requests, ...

By the actual words, this RFC is very clearly motivated from policy, not
protocol reasons.

Joe