Subject: RE: [Raven] Fly away, raven

From: Brian Rosen <[email-masked]>
Date: Fri, 29 Oct 1999 08:23:52 -0400

Oh I told myself, and my boss, that I'd keep quiet, but I 
just couldn't let this one go by :(

I believe you can state with confidence that those of
us who disagree with you are more aghast at your rhetoric than
your arguments.  Consensus is very far from "crystal clear".

We have to get this work done.  We want to do it in the IETF,
it is where the protocols at issue come from.  If we do it
elsewhere, then we have potential conflicts in modifying someone 
else's protocol.  If we are prevented from doing it in the IETF,
we will have to deal with these issues while we do it elsewhere, 
it's just a pain.  You can't really stop it, you can just give us 
some more work to do (and keep me traveling away from my family).

I believe the majority of people looking at this issue
who deal with the reality of the market and the reality of
the law have signed off the list, understanding that the
noise level is way too high to get anything done.

Do not take silence for assent.  Take it for bewilderment
and lack of time to argue, while we do the deed anyway.

Also, please, please remember.  The work is primarily to limit
what the tap gets you.  The tap itself is easy, and there now.
What we need to do is have a way to limit what the tap presents
to the LEA to just what the warrant says.  That we don't have
now.  

Brian

> -----Original Message-----
> From: Paul Ferguson [mailto:[email-masked]]
> Sent: Friday, October 29, 1999 7:45 AM
> To: Lyal Collins
> Cc: [email-masked]
> Subject: RE: [Raven] Fly away, raven
> 
> 
> At 06:45 PM 10/29/1999 +1000, Lyal Collins wrote:
> 
> >I'd like to add a different dimension to the discussion; 
> namely, is it a
> >discussion that's occuring too early?
> 
> Not at all. I personally think it was a very good idea to begin
> internal IETF dialog on this issue, and subsequently formulate a
> consensus (which I believe is crystal clear), before being formally
> approached by any law enforcement or intelligentsia to provide
> assistance in the manners which we have discussed.
> 
> Why do you think that this discussion may be occurring too early?
> Is some revelation going to appear which will force us all to
> rethink our positions & accept the fact that law enforcement
> entities need expanded snooping capabilities in the digital
> age? I don't think so.
> 
> As has been stated many times already, they probably already have
> the means available to do so anyway (except in the case of strong
> encryption with no key escrow/recovery).
> 
> If the IETF, IESG, IAB, and ISOC take a unified and formal position
> on this issue (and I believe it will -- that we are impartial to the
> CALEA proposals on their face, but will not take steps to 
> intentionally
> design weaknesses or specific wiretapping capabilities for VoIP into
> existing and future Internet protocols), then I also think 
> that we will
> have quite a few supporters. Within the US, at least, these will most
> likely include the ACLU, the EFF, the CDT (Center for Democracy and
> Technology), EPIC (Electronic Privacy Information Center), Privacy
> International, and a host of other privacy interest organizations
> around the world. So we certainly will not be persecuted for our
> position, in my opinion, if we steer that course.
> 
> If we take this sort of "formal" position, I believe the only 
> detractors
> we will have are (a) over-zealous law enforcement types who want easy
> access to private communications, and (b) politicians who 
> want a police
> state under the guise of "the war on drugs, national security, and
> dangers to children on the Internet."
> 
> Personally, I think anyone who believes that law enforcement needs
> expanded capabilities in the digital age needs to be avoided at all
> costs. But I'll stow my emotional opinions for another, more
> appropriate, time.
> 
> Be afraid, be very afraid. Methnks this is indicative of a much
> larger, and darker, issue.
> 
> $.02, and speaking only for myself,
> 
> - paul (concerned citizen)
> 
> 
> _______________________________________________
> raven mailing list
> [email-masked]
> http://www.ietf.org/mailman/listinfo/raven
> 

_______________________________________________
raven mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/raven

---

From: Paul Ferguson <[email-masked]>
Date: Fri, 29 Oct 1999 09:07:18 -0400

>your arguments.  Consensus is very far from "crystal clear".

I don't believe that at all. I think there is demonstrated
consensus on this list (which I understood was created for this
very discussion), and I also think that the discussion is not
yet finished. If opinions are not expressed here, then where?
Given the venue, one should seize the opportunity to use it
for what it is constructed.

>We have to get this work done.

Who, exactly, is "we"? And who, exactly, "must get this
work done"? And why exactly? Don't presume that simply
because LEA's want to wiretap, that "special" hooks into
existing and future protocols which come from the IETF
must be accommodated.

I don't follow your line of reasoning where you state
that if (paraphrased) "we don't do it, some other 'standards'
body will do it, so let's not allow that to happen." This is
just not a compelling line of reasoning, in my mind. And I've
heard a lot of other people state similar objections to this
line of reasoning.

I'm amazed at the presumption that the IETF is somehow
bound to design this type of stuff into protocols. It is
a giant leap of faith, and a bad one.

Similarly, I can only guess that individual opinions differ
as much as their individual backgrounds, some people having
spent more time in the "traditional" telephony area & others
having spent more time in the "traditional" Internet world.

Of course, I could just be wrong. Who knows. It's all just
opinion, right?

That's my opinion, and I'm sticking by it.  :-)

>We want to do it in the IETF,

[snip]

- paul

---

From: [email-masked] (Mikus Grinbergs)
Date: Fri, 29 Oct 1999 08:13:26 -0500

> We have to get this work done.

I believe there is a misunderstanding here.  The citizens of many
countries (including citizens who are IETF members) are not yet
under COMPULSION to get this work done.

I believe the consensus *is* "crystal clear" - those who WANT to
get _this_ work done are in the minority.

> to the LEA to just what the warrant says.  That we don't have

I believe there is a misplaced faith here.  As has been pointed
out on this list, whatever procedures are specified by whatever
organization, "authorities" are in the best position to disregard
such procedures if they so choose.

Mikus

---

From: James Carlson <[email-masked]>
Date: 29 Oct 1999 11:54:58 -0400

> your arguments.  Consensus is very far from "crystal clear".

All that's needed is *rough* consensus.

> noise level is way too high to get anything done.

If you're not participating, then I'd argue that you're implicitly
agreeing with whatever result the discussion produces.

> and lack of time to argue, while we do the deed anyway.

It doesn't work that way.  Lack of disagreement is, at least in the
rough-consensus world of the IETF, identical to assent.

> to the LEA to just what the warrant says.  That we don't have

Nobody says that all work must go through the IETF in order to be
standardized or validated.  If you feel the need to paint your
hardware puce and issue your software on Mylar punch tape, feel free.
No RFC required.

It appears to be the case that the majority on this list do not want
to proceed with an effort to standardize tapping mechanisms, and that
neither side of the debate is significantly affecting the other's
position.  Is it time for a poll?

-- 
James Carlson, System Architect                     <[email-masked]>
IronBridge Networks / 55 Hayden Avenue   71.246W   Vox:  +1 781 372 8132
Lexington MA  02421-7996 / USA           42.423N   Fax:  +1 781 372 8090
"PPP Design and Debugging" --- http://people.ne.mediaone.net/carlson/ppp

---

From: Grenville Armitage <[email-masked]>
Date: Fri, 29 Oct 1999 09:03:59 -0700

Mikus,

> under COMPULSION to get this work done.

The misunderstanding, in terms of the response to Brian, is yours.

I've noticed that Brian consistently refers to the demand on his
_professional_ activities. This notion that no law is compelling
anyone to build wiretap technology is completely irrelevant. Vendors
are driven by perceived 'market requirements' (which the few here
who actually build products will be familiar with). No 'consensus'
of the raven group will change any product manager's beliefs
about the market requirements in various communities around the
world. Get over it.

> get _this_ work done are in the minority.

Irrelevant again. Many working group's in the IETF are of interest
to only a minority. The IESG allows them, with constrained charters.
What should the IESG _do_ about this particular 'wiretap' minority?
That's the freakin' question. "They" (this minority) are not going
to go away just because the raven list's considered opinion
is "piss off!"

> such procedures if they so choose.

Again more misunderstanding. Who gives a damn whether the auditable
tap technology can be corrupted? We already _live_ in such a world.

The misplaced faith is the assumption that, if the IETF sticks its
head in the sand, the wiretappers will say "oh, gee, this stuff's
too hard for me to figure out" and will stop their efforts. Arrogant
B.S. IMHO.  At best we can answer the question by saying "we'll
develop protocols that allow law-abiding LEAs to do auditable
taps". Leave out the sniping and chest-thumping about one's
favorite experiences with non-law abiding LEAs. You wont (by
definition) control non-law abiding LEAs by _anything_ you do here
(meat space coercion tecnniques will do an end-run around any
cute key security schemes you build....) so stop wasting breath
about that subset of LEAs.

cheers,
gja