Subject: [Raven] My Conclusions from the Raven Debate

From: "Carter Bullard" <[email-masked]>
Date: Fri, 29 Oct 1999 15:04:41 -0700

Gentle people,
   It is getting close to plenary time, and so focusing on the
IESG questions would benefit the effort/purpose of the mailing
list.  I hope that this response is benefical to the list.

   My personal opinion, is that the IETF should not, when
developing new protocols or modifying existing standards, address
issues specific to wiretapping or other law enforcement activities.
In addition, it should not be possible for the issues of wiretapping,
or law enforcement activities in general, to be used to limit
the activity of any WG in the IETF.

   The IETF should continue its historical position of advancing
IP technology independent of any political position.  The IETF has
been consistent in its political indifference with respect to encryption
technology.  It should continue to take a politically and socially
indifferent position when developing any IP technology, including
packet capture.

I have included my specific responses to the additional questions
raised by the IESG below.

Best regards to all the raven contributors.  I would like to thank
all of you for the opportunity to be provocative and, yes, ridiculous
at times.  All in a day's IETF debate.

Carter

Carter Bullard
Principal Consultant/Engineer
Nortel Networks
320 Park Avenue  16th Floor
New York, New York 10022
Email  [email-masked]
Phone +1 212 317 4230
Fax   +1 212 317 4324
Pager +1 800 217-7496 

Responses to additional IESG questions on wiretapping:

 "Adding wiretap capability is by definition adding a security hole. 
  Considering the IETF's commitment to secure protocols, is it a reasonable
  thing to open such a hole to meet these requirements?"

Lawful intercept of network traffic, whether it is to support network
management or to assist Law Enforcement, does not constitute adding
a security hole to IP technology.  The IETF has standardized RMON
and snoop(), and as such, has engineered packet capture into the
fundamental workings of IP technology.

 "Should the IETF as an international standards organization shape its 
  protocols to support country-specific legal requirements?"

The IETF has taken an historical position to be indifferent to the legal
requirements of nations.  Technology development should proceed independant
of whether it supports or conflicts with the existing laws of any nation.
However, in order to be a credible standards organization the IETF does
have a responsibility to respect formal societies and their complexities.
The IETF should not be socially obnoxious.

 "When IPv6 was under development, the IETF decided to mandate an 
  encryption capability for all devices that claim to adhere to those
  standards.  This was done in spite of the fact that, at the time the 
  decision was made, devices meeting the IPv6 standard could not then 
  be exported from the U.S. nor could they be used in some countries.
  Is that a precedent for what to do in this case?"

Absolutely.  But the example is not that the IETF must be counter to
societal rules and regulations, but rather that it must be indifferent.
The precedent allows the IETF to embrace the development of Lawful
Intercept technology just as easily as rejecting it.

 "Could the IETF just avoid specifying the part of the technology that 
  supports wiretapping, presumably assuming that some industry consortium 
  or other standards organization would do so?  Would letting that 
  responsibility fall to others weaken the IETF's control over its own 
  standards and traditional areas?"

The IETF loses whatever control it may have over IP technology when it
cannot respond to the needs of society for responsible IP networking
solutions.

 "If these functions must be done, is it better for the IETF to do them 
  so that we can ensure they are done in the most secure way and, where 
  permitted by the regulations, to ensure a reliable audit capability?"

The IETF should strive to provide technical solutions with best practice.
The issues of supporting responsible Lawful Intercept are the same
for supporting responsible RMON and network management.  Are we working
to ensure that RMON functions in a most secure way?

 "What would the image of the IETF be if we were to refuse to standardize 
  any technology that supported wiretapping? In the Internet community? 
  In the business community? To the national regulatory authorities?"

Regardless of image, the result of refusing to work on any technology
drives the IETF towards being incapable of developing any IP technology.
There is a successful argument that IP billing can potentially invade
an individual's privacy.  If the fear of supporting wiretapping
stops advances in RMON technology, the IETF becomes vulnerable to social
deadlock on a number of important future IP issues.

---

From: "Lyal Collins" <[email-masked]>
Date: Sat, 30 Oct 1999 13:28:47 +1000

Perhaps another way to look this issue, and some posts in the list is:

Do "we" wish to seize the agenda over on-line enforcement capabilities,
before the politicians do.

- Doing so allows "us" an active say in what is permitted.
- Not doing so allows us to voice a different view, which seems to be "hands
off!"

The IETF is an organisation where either approach could be coordinated.

Regards,
Lyal
-----Original Message-----
From: [email-masked] [mailto:[email-masked]]On Behalf Of Carter
Bullard
Sent: 30 October 1999 8:05
To: [email-masked]'
Subject: [Raven] My Conclusions from the Raven Debate

Gentle people,

_______________________________________________
raven mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/raven