Subject: Re: [Raven] Anonymous taps

From: "Rick Braddam" <[email-masked]>
Date: Thu, 28 Oct 1999 20:12:00 -0500

----- Original Message -----
From: chefren <[email-masked]>
To: <[email-masked]>; Rick Braddam <[email-masked]>
Sent: Thursday, October 28, 1999 4:48 PM
Subject: Re: [Raven] Anonymous taps

Chefren wrote:
> It's not verifiable and it shouldn't be used for law
> enforcement just because there is little or no proof in
> just a tcpdump. Everyone can edit the dump for example.
>
> A tap made with respect for law should be verifiable. The
> communication provider shoul de able to say before the
> judge that he set the tap according to a warrant with the
> sealed tapbox.

Laws are only effective after they are broken, and then only if the breaker is caught. That's a mighty big IF when the ones
responsible for catching the breakers are the ones doing the breaking. Laws provide a means of punishing the ones who break the law
and are caught. They do not prevent breaking the law.

> > > > If the information obtained from taps is not used
> > > > in court directly, but used to develop other information
> > > > which can be used in court, the tap info is never
> > > > revealed.
> > >
Chefren also wrote:
> > > Might well be but if it pops up that information was
> > > gathered with unlawful means the prosecutor can stop his
> > > actions. (This is how it works over here...)

Another big if... IF it pops up, or can be discovered that the information was gathered by unlawful means. Our Director of the FBI
recently sent a request to the legislature to acquire the power to enter peoples' homes without their knowledge or permission, plant
bugs or software in their computers, then use information they gathered without having to reveal their sources.

> > It can be *discovered* by unlawful means then *gathered*
> > by lawful means such as a search warrant.
>
> If the "criminal" can prove so because small mistakes were
> made and probably revealed because an IETF standard with
> auditing was used we can get rid of such rotten apples in
> law enforcement.

Yet another big if. If small mistakes are made. If they are discovered.

> How can we =ever= get rid of them without good standards
> and laws?
>
By using good, old-fashioned investigation and legal prosecution.
>
> > > I have brought in a basic design that makes it possible to
> > > detect misuse.
> >
> > Only as long as you can trust all the people doing the detecting.
>
> Why? The tapbox is both sealed and open source. The
> communication provider has no interest in the date of his
> customer and if the tap is used against someone the same
> person may use the tap to prove he is =not= guilty. Taps
> aren't used for or against someone until a judge has made a
> decision at the end of the process.
>
> Taps often prove someone has nothing to do with a case for
> law enforcement.
>
> > > > > Taps made with tcpdmp or something like that should be
> > > > > subsubstandard for any court in this world as soon as
> > > > > possible
> > > >
> > > > It doesn't matter if they are, if an attacker is after credit card numbers.
> > >
> > > What has this to do with tapping by law enforcement?
>
> > You can't ensure that only law enforcement will be able
> > to use the identifying information in the protocol for
> > tapping. If it is there, people will make ways to use
> > it.
>
> Might be and the standard or laws can be tightened for that.

Ever hear of Echelon? World-wide tapping of any electronic communications they wanted to, except maybe those which only went over
fiber-optic cable, and maybe even them from a point where they were converted back to electronic form. I understand some countries
were a little upset about that.

> > > I have got to find that sig...
>
> > Don't bother if it also assumes that the people doing
> > the tapping are always completely trustworthy, and that
> > only they will be *able* to do tapping.
>
> Are you completely trustworthy? And if you were tapped,
> would you like to be tapped with an IETF standard tap with
> verifiable recordings or just an edited tcp dump?

I may already be tapped. Participation in this mailing list may be enough  to attract the attention of those (in government) who
want to know everything about anyone who opposes their plans or wishes.

If you don't know about Ruby Ridge and/or Waco, check them out.

Rick

_______________________________________________
raven mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/raven

---

From: "chefren" <[email-masked]>
Date: Fri, 29 Oct 1999 19:10:59 +0200

On 28 Oct 99, at 20:12, Rick Braddam wrote:

> Our Director of the FBI recently sent a request to the
> legislature to acquire the power to enter peoples' homes
> without their knowledge or permission, plant bugs or
> software in their computers, then use information they
> gathered without having to reveal their sources. 

That's precisely what you get if strong encryption is free. 
FAR worse situations regarding privacy.

More or less "private razzia's"

Please give me regulated encryption!

+++chefren

=Large signature follows=

I think we need a simple architecture for a point
to point tap interface that has strong provisions
against misuse.

On one side the communication provider who only
starts tapping a specific customer or IP number
with proper warrants.

On the other side the approved tapping room.
Everything should be organized by the central
"tapping office". This office should provide
keys for strong encryption to both communication
provider and tapping room.

Law and technology should both provide as
much checks and balances as we can come up
with. Law can provide good procedures,
technology can provide technical means to
check them or force them.    

=Large signature ended, please comment me
off-line to make it better=