Subject: [Raven] Carter Bullard's Conclusions: a few comments

From: "Richard Payne" <[email-masked]>
Date: Sat, 30 Oct 1999 15:11:42 -0400

Carter Bullard wrote:

> My personal opinion, is that the IETF should not, when developing new
protocols or modifying
> existing standards, address issues specific to wiretapping or other law
enforcement activities.
> In addition, it should not be possible for the issues of wiretapping, or
law enforcement activities
> in general, to be used to limit the activity of any WG in the IETF.

Although this may well be Carter's opinion, the proposition that any WG
should be free to undercut any other is pretty dubious. I believe that's why
the IESG started this list, since wiretapping support has the potential to
undermine security and privacy ostensibly provided by other protocols. BTW,
I agree with the _first_ sentence, if you append the phrase "with a view to
making such tapping easier".

Carter also wrote:

> Lawful intercept of network traffic, whether it is to support
> network management or to assist Law Enforcement, does not constitute
adding a security hole to IP
> technology. The IETF has standardized RMON

Now, in addition to giving us a proof by assertion ("not a hole!"), this is
really U.S.-centric, despite repeated pleas from list members to think about
global effects. The equation government = Law Enforcement = good does not
hold, in general. If it helps dictatorships spy on their populations,
claiming that it's not a security hole is not very convincing. I know,
everyone should use crypto, but not everyone has it - yet.

> The IETF should not be socially obnoxious.

If this means that everyone must comply with yet-to-be-written laws for fear
of some unspecified punishment, then "socially obnoxious" is what I want to
be. Is the opposite of "socially obnoxious" socially grovelling?

> The precedent allows the IETF to embrace the development of Lawful
Intercept technology just as easily
> as rejecting it.

I find this impossible to square with my reading of RFC 1984. Could you
share your reasoning as to how they are compatible?

> an individual's privacy. If the fear of supporting wiretapping stops
advances in RMON technology, the IETF
> becomes vulnerable to social deadlock on a number of important future IP
issues.

This is kind of vague, but if "advances in RMON technology" means something
like "caller id for computers", then it seems worthwhile to think the issues
through. Building wiretapping (by definition, a security hole from the
viewpoint of the user) into your protocols is neither morally neutral nor
smart engineering, since it makes the system less secure.

An assertion of my own: security and privacy should not be compromised for
all Internet users merely to allow telco's to get switches to market faster.

Richard Payne

_______________________________________________
raven mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/raven