Subject: [Raven] Summary of Observations

From: [email-masked]
Date: Sun, 31 Oct 1999 15:05:35 EST

Dear raven mail list,

Some are calling for an end to the discussion.  However, I have not yet seen 
any conclusions listed.  So rather than let the discussion end like a talk 
show, I propose to summarize what I have observed and let the group add, 
modify, or ignore them, which in any case would be telling.  So here goes ...

1)  The IETF determined that there were many bad governments, but could not 
determine if there were any good governments.

2)  The IETF determined that each country has its own laws.  (don't lose your 
sense of humor)

3)  The IETF determined that bad governments do not currently have the tools 
to do electronic surveillance and won't until the IETF creates some for them.

4)  The IETF determined that no one is currently intercepting packets and 
possibly violating privacy on the Internet for either intelligence, law 
enforcement, network management, hacking, or any arbitrary reason.

5)  e-Commerce was accepted as a given.

6)  The IETF determined that there were no e-Criminals.

7)  The IETF determined that even if there were e-Criminals, those people do 
no one harm because there is no connection between cyberspace and the real 
world.

8)  The IETF determined that planning and issuing commands to subordinates 
does not (or should not) constitute a crime under any circumstances.  
(references to Nuremburg notwithstanding)

9)  The IETF does not think that there should be e-Cops.

10)  The IETF thought that the tools they possessed and used should not be 
trusted with the police (because they are human and fallable).

11)  The IETF did not attempt to determine whether e-Consumers would trust 
e-Commerce without e-Cops.

12)  The IETF thought that law enforcement should investigate e-Crimes in 
"meat-space."  Therefore, there was no need to detemine what constituted 
e-Fingerprints or e-Footprints of e-Criminals, because they don't exist.

13)  The IETF determined that the current state of Internet security and 
privacy was adequate.

14)  The IETF determined what consituted "unreasonable" search and seizure 
(see 4th Amendment of U.S. Consitution), but did not attempt to determine 
what constituted "reasonable" search and seizure.

15)  The IETF was not clear what law enforcement's requirements were, but 
that did not hinder the debate in anyway.

16)  The IETF did not make any distinctions between telecommunications 
services and information services, and did not make any distinctions between 
private services and public services, which might be germane to the law.

17)  The IETF detemined that its technical specifications were above the laws 
of any country.

18)  The IETF did not attempt to determine whether the Internet was a vital 
part of the public infrastructure (worthy of active protection) or the 
private playtoy of an elite group of technicians.

19)  There were some technical discussions concerning encryption, tap rooms, 
etc., but no conclusions.

20)  The IETF determined that the Internet was not a reflection of the real 
world with all its imperfections, and would therefore draw no parallels 
between the needs of the two, but would reinvent cybersociety unencumbered by 
existing social structures or past human history.

21)  The IETF determined that a technology should not be developed if there 
was the possibility that it could be used for evil purposes.  (or maybe that 
depends on what the technology is and whose evil purposes are served)

If there were any conclusions that I missed, please add them.  I ask 
forgiveness if I mistated any conclusions and that you correct those that are 
incorrect.  I am merely an observer wondering how much trust to put in this 
evolving, human-made system.

Sincerely (and paying homage to the group's values),
Anonymous

_______________________________________________
raven mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/raven

---

From: "Lyal Collins" <[email-masked]>
Date: Mon, 1 Nov 1999 10:09:58 +1100

I take small issue with point 12 ie
> e-Fingerprints or e-Footprints of e-Criminals, because they don't exist.

The electronic fingerprints, footprints do exist, they just can't be
reliably attributed to anyone, without stepping outside a "monitoring"
context and into phone and ISP logs.

Before going further, an attribution system is needed, either within this
environment, or paralle to it.
- reliable machine indicators (which has shades of the Intel chip hysteria)
- reliable user indicators (which has indications of privacy impact)

Most PKI/digital certificate stuff is somewhat inadequate at a commercial
and legal level, the excellent work done by all standards bodies (policy,
business, legal as well as technical) in this area has not solved that hard
questions, like interoperability, transportability, reliability, and
liability.

Regards,
Lyal