Subject: re: [Raven] Anonymous taps

From: "Richard Payne" <[email-masked]>
Date: Thu, 28 Oct 1999 19:15:52 -0400

Chefren wrote:

> Fire arms are regulated and encryption should be
> accordingly. No assault weapons and no free fully

a) Crypto is not an offensive weapon. The logical outcome and implementation
of "no private conversations" is "all conversations, even face-to-face, must
be monitored". I'm sure you don't mean that.

b) Just to make your day, check out the encryption system, designed by Bruce
Schneier, in the appendix to Neal Stephenson's Cryptonomicon. Then tell me
if you think world-wide regulation of playing cards is doable.

Just a reality check...

Richard Payne

_______________________________________________
raven mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/raven

---

From: "Lyal Collins" <[email-masked]>
Date: Fri, 29 Oct 1999 10:10:36 +1000

Both cars and the privilege of driving a car are regulated (e.g. manfacture,
sale, and usage), in numerous different ways, for at a small set of common
goals, basically:  improving consistency, reliability and safety

Reducing the potential for the technology to be abused (speeding, no-parking
zones, bald tires, deficient brakes) _can_ be a good thing.
The policy decision of deciding if, and what regulation is needed is outside
the cope of this discussion.

No regulation works, when the target of the regulation is used "outside the
system" - anyone can build a motorised vehicle but until it passes the
required checks, it stays off the roads i.e. it stays outside the
environment where most motorists are - on the road.  Auditing the fact this
motorised vehicle has stayed off the public roads is generally sufficient.

The technical issues of permitting regulation (in this case, most likely in
the form of self-regulation) are.

I'd prefer to see a technical environment that supports audited use of the
technology.  That leads to carrots and sticks:
- Any abuse of the (monitoring) technology by insiders or outsiders can be
detected - a potential stick.
- Abusing the audit process should also lead to penalties - a carrot to
follow the process

Since our current style of societies will never have the resources to
totally enforce regulation, a "best effort, check and balances " approach
can be highly effective (even if not totally).

Auditing the outcomes, and the possible abuse of the regulations (regulators
are human, after all) is critical to having broad confidence in the process.

Confidence in the process will never be total, but surely, ensuring there is
enough confidence for _most_ people to accept (as a minimum), or preferably,
to feel feel comfortable with the outcomes is critical to wide adoption of
anything.

Arguably, there is a lack of confidence - of appr 200 million Internet
users, only around 7% have bought and paid on-line.  That seems to indicate
a lack of confidence to me.
Theory on:
Without greater commercial gain from the Internet, there will be reduced
funding for Internet technology (bandwidth, servers, content), and the
Internet could return to the pre-90's era - special interest uses by a small
percentage of society and business, or _all_users_ pay a _lot_ more to use
the technology, mainly for play because there may be no commercial reason to
use it.
Theory off:

Accept the flaws, and make the best of them is a human condition.

Regards,
Lyal

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On Behalf Of
> Richard Payne
> Sent: 29 October 1999 9:16
> To: [email-masked]
> Subject: re: [Raven] Anonymous taps
>
>
> Chefren wrote:
>

---

From: "chefren" <[email-masked]>
Date: Fri, 29 Oct 1999 02:18:55 +0200

On 28 Oct 99, at 19:15, Richard Payne wrote:

> a) Crypto is not an offensive weapon.

A bullet without a gun or vice versa eighter.

> The logical outcome and implementation

That's NOT the logical outcome and that's typically not 
what regulation is about. Regulation is always done with 
best wishes and had probably never in history had a 100% 
impact nor were 100% of offenders brought to justice. 
Regulation is about keeping things in check for the society 
that has come up with the rules/laws. In check at an 
acceptable level.
 
> if you think world-wide regulation of playing cards is doable.

So you try to tell me your "reality" is more true or 
interesting than my "reality"?

This seems definitely something we will never come out.

The class of this problem is known as is the best solution 
for it if parties agree they want to live together: 
Democracy.

Lots of democracies have stated their law enforcement 
agencies should be able to tap. Civilized people just 
respect that, terrorists don't respect it.

IETF is just a standards organization and it seems pretty 
clear to me what's a good tap (one with good 
authentication, audits and strong encryption used to 
provide maximum privacy of people that haven't been judged 
yet) and a bad one (tcpdump / driftnet fishing).

IETF is not a political organization, it should provide 
technical standards that are needed. It will probably never 
happen that 100% of a population needs a specific standard. 
Some of us want encryption standards, others want tap-
standards. 

Shouldn't be any problem at all I think. Unfortunately what 
happens here is that some people that seem to belong to 
some "crypto-church" start talking about how strong and 
uncrackable crypto is (something they definitely cannot 
quantify at all and isn't interesting here too) and don't 
forget where a good tap is used for: Stating proof in 
court, where a fellow citizen realy risks his privacy. 
Certainly in the US where dead penalty stil exists, a very 
serious matter that cannot be done good enough.

IETF should take tapping very seriously and develop a 
standard that reflects a deep respect for the privacy of 
the citizens that in some cases will be tried based on the 
information gathered by the tap.

+++chefren

(Digital Church of Democracy according to Chefren: A world 
with regulated encryption is inevitable to prevent 
criminals hiding their organizations. Strong encryption 
will and should be used by communication providers to 
protect the data of their customers. Banks and other groups 
will be allowed to use strong encryption to protect 
specific things. Free use of encryption has nothing to do 
with civilization, justice or peace and everything with 
war.)

---

From: William Allen Simpson <[email-masked]>
Date: Fri, 29 Oct 1999 00:27:16 -0400

Folks, I think this list has pretty well served its purpose, as far as 
answering the original questions.  Thus far, we have learned that every 
single person promoting tapping standards on this list: 

(1) is not familiar with security terminology; 

(2) does not know even the most basic facts about cryptography mathematics, 
let alone the current state of the art; and 

(3) lives in a fantasy world where authority figures (humans) are 
incorruptable, and "democratic" processes are followed religiously.

Now, we have this bon mot.

Lyal Collins wrote:
>...
Wow, just the thought of not allowing any technology into the world 
until it had been regulated and audited....  I could almost support 
this fantasy scenario, as it would make the richest man in the world 
an instant pauper, while eliminating one of the worst known threats to 
network security.

We could add: (4) authoritarian luddites.

But that might be considered ad hominem.

[email-masked]
    Key fingerprint =  17 40 5E 67 15 6F 31 26  DD 0D B9 9B 6A 15 2C 32

---

From: "Lyal Collins" <[email-masked]>
Date: Fri, 29 Oct 1999 17:30:02 +1000

I was trying to make the point that "closed group" operation of technology
is difficult to monitor - and Law Enforcement knows that.

Using a technology in the open commnity, or on shared infrastructure will
get noticed at some point.  An unlicenced car driven on the road will get
noticied at some point.  It doesn't matter who is performing the abuse - Joe
Citizen or Law Enforcement officer #654321.

But, that's what auditability is about - detecting abuse of the system -
regardless of who does it.

Right now, there is no auditability on the monitoring of Internet
communications - the many posters who mention tcdump confirm that.
Therefore, abuse of privacy may or may not be occuring - but there is no
practical way to know, and no penalty box if the abuser is, by some chance,
detected.

If abuse of privacy can be detected, then it is possible to respond and
defend.

If abuse of privacy can occur without reasonable probability of detection,
don't expect privacy, and don't complain about the lack of it.

Regards,
Lyal

[snip]

---

From: "Ge' Weijers" <[email-masked]>
Date: Fri, 29 Oct 1999 09:03:07 -0700

> A bullet without a gun or vice versa eighter.

Anything with a sharp corner that weighs a couple of pounds is a sharp
weapon. We have not outlawed or regulated hammers.

Cryptography is a tool, and like most tools can be used for good and
evil. Good here means protecting the privacy of (for instance) medical
records flowing over the Internet between a lab and your doctor, or
between your lawyer and you. In most countries these interactions are
privileged communications.

Good is also protecting the records of civil rights workers who
operate in hostile environments.

> Some of us want encryption standards, others want tap-

This sounds like the "sports is not political" debate we've had on and
off. Of course the IETF makes political choices. It did not have to
set standards for OpenPGP, IPSEC, etc., and it chose to do so anyway.

You seem to have an overly optimistic view of the honesty of
governement and law enforcement officials. You live in a country where
the Prime Minister (Lubbers) closed down an intelligence agency so he
would not have to reveal what they were up to. And the move of Docters
van Leeuwen from chief spook to chief prosecutor was far to smooth,
I'm sure he immediately broke all contacts with his buddies on the
Laan van Meerdervoort.

> with civilization, justice or peace and everything with 

I think the IETF should not be an instrument in furthering the goals
of this corporatist agenda, where the governement decides what's good
for the citizens.

A lack of tapping standards would keep it much more expensive to do
driftnet fishing, so let's not commoditize the technology.

Ge'

-- 
-
Ge' Weijers                                Voice: (614)326 4600
Progressive Systems, Inc.                    FAX: (614)326 4601
2000 West Henderson Rd. Suite 400, Columbus OH 43220

---

From: "chefren" <[email-masked]>
Date: Fri, 29 Oct 1999 18:48:53 +0200

> driftnet fishing, so let's not commoditize the technology.

Driftnet fishing is a fact, tcpdmp and other utilities 
exist. Definitely a cheap solution for those who want to do 
driftnet fishing.

I think there are enough reasons to develop a standard that 
counters those activities and gives both law-enforcement 
and communication providers a way to protect privacy as 
much as possible.

+++chefren

---

From: "Ge' Weijers" <[email-masked]>
Date: Fri, 29 Oct 1999 12:11:29 -0700

> exist. Definitely a cheap solution for those who want to do 

tcpdump et. al. will not work that well when you have a passive tap on
an OC-12 switch. That requires specialized hardware for address
filtering. Stuff the NSA has been using for years.

> and communication providers a way to protect privacy as 

This proposed standard will not counter illicit activities, it will
lower the cost of court-approved wiretaps to a level where it will
become a favorite tool of law enforcement.

Those who have any secrets to protect know that the Internet can be
sniffed easily at many points. I've been using encryption for 3 years
now to legitimately protect company secrets. It's not _that_ hard to
design an encryption system that will cause serious headaches for law
enforcement, especially if you know what you're doing, so
standardizing on a version with law enforcement access to keys won't
help much.

Ge'