Subject: RE: [Raven] Anonymous taps

From: "Thomas Junker" <[email-masked]>
Date: Thu, 28 Oct 1999 23:58:30 -0500

I hate it when I overlook that a reply to a message from this list doesn't go 
to the list.

------- Forwarded Message Follows -------
From:           	Self <tj>
Subject:        	RE: [Raven] Anonymous taps
Date sent:      	Thu, 28 Oct 1999 10:36:34 -0500

Chefren and Lyal Collins, at a minimum, seem to be laboring under the 
misconception that standards formulated by IETF would have some force or 
effect on the physical and procedureal implementations of wiretap provisions.  
That is, talk of "sealed hardware" and audit mechanisms seems to me to be 
based on the premise that if the IETF says, "Here is how this protocol or 
mechanism should be used," then it will be used in that manner.  I believe 
such a premise is utterly false, and rather thoroughly confuses the concepts 
of technical standards with those of law and regulation.

As far as I can see, nothing the IETF could say would have the slightest 
effect on how governments will dictate that carriers and manufacturers conduct 
themselves in the engineering and offering of services and products.  The IETF 
could publish a standard for a sealed-box implementation of a tapping 
mechanism with all manner of audit controls, and the U.S. or North Korea could 
simply say to the vendors, "We are taking bids on equipment compliant with 
STDxyz except that the equipment will not be sealed and will ignore provisions 
(a) through (f) for audit controls."  End of issue, and the engineers will 
fall all over themselves to modify their Netherlands-compliant models to meet 
the North Korean RFQ.

Just as the IETF is not bound to pay any attention to any national 
requirements, national government are not bound to pay any attention to IETF 
standards.  If the IETF facilitates the standardization of any aspect of 
wiretapping, the abusive governments (which seem at the moment to be virtually 
all except chefren's allegedly very polite and well-behaved Netherlands 
authorities) will take advantage of the parts of a standard that benefit their 
wiretapping interests and ignore what doesn't suit them.  This is so 
fundamental that I am surprised that any of the discussion here has 
degenerated into issues that are completely non-technical and wholly outside 
the realm of anything the IETF can influence.

A protocol that includes some kind of provision for supporting wiretapping is 
a technical issue.  Matters of "sealed hardware" and audit provisions are non-
technical legislative and regulatory issues over which the IETF has no 
authority and probably close to zero influence.  In a country where chefren's 
gentlemanly oversight and supervision of wiretaps are not the rule there 
simply will not be any sealed hardware or audit mechanisms.

Moreover, the question before the IETF has nothing to do with the feasibility 
of "proper" wiretapping, whether in well-behaved or abusive national regimes.  
The question is the advisability of the IETF becoming involved in facilitating 
wiretapping.  It *certainly* has nothing whatsoever to do with theoretical 
scenarios for properly supervised wiretapping, since national governments can 
and will specify anything they damn well please.  The only things the IETF can 
do are either to facilitate and encourage governments to implement wiretapping 
by providing wiretap-friendly protocol standards and the resulting wider 
availability of less-expensive wiretap-capable and fully interoperable 
equipment that will tend to flow from standards, or to ignore the issue and 
let the vendors sort it out without help, or to promulgate standards that tend 
to make wiretapping more difficult and less interoperable.

I recommend that the IETF follow RFC1984 and generally formulate and 
promulgate the strongest security feasible and appropriate in any given 
protocol standard.  Failing that, I recommend that the IETF adopt a completely 
neutral stance on wiretap issues.  

I am not the least interested in the technical problems faced by the carriers 
or vendors.  Wiretapping should *not* be easy, and if they face enormous 
problems of working out their own standards, so much the better.  If they 
succumb to the proprietary trap and their various equipment is not 
interoperable, so much the better.  If that raises the costs of government 
wiretapping everywhere, that is a good thing.  If that raises the costs 
generally of networking, tough.  No vendor and no government is ultimately 
going to stand in the way of the exponential explosion of interconnection now 
underway.  The very best we could hope for as human beings is that as the 
technology mushrooms, governments are left behind with their heads spinning 
and their surveillance budgets broken.  We should all realize the benefits of 
a future in which North Korea or a Big Brother U.S. find the bids for the 
surveillance and wiretapping equipment and services they seek to be 
unaffordably expensive.  We should all desire that when sweeping wiretap 
provisions are passed by a clueless or out of control legislature the carriers 
and vendors wring their hands and respond with fully realistic assessments of 
the impossibility or hugely expensive nature of the requirements.  The very 
last thing we should want is that the carriers and vendors can reach to a 
documentation shelf and pull out a standard that makes it easy and relatively 
inexpensive for them to comply with unreasonable demands.

When and how can this list discussion be brought to a conclusion?  It has 
already been beaten to death.

Regards,

Thomas Junker
[email-masked]

The Unofficial Wang VS Information Center
http://www.phoenix.net/~tjunker/wang.html

The Live VS Web Server
http://www.tjunker.com

_______________________________________________
raven mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/raven

---

From: "chefren" <[email-masked]>
Date: Fri, 29 Oct 1999 19:14:37 +0200

On 28 Oct 99, at 23:58, Thomas Junker wrote:

> That is, talk of "sealed hardware" and audit mechanisms seems
> to me to be based on the premise that if the IETF says, "Here is how this
> protocol or mechanism should be used," then it will be used in that
> manner.

Lawyers can tell the judges they can't accept other taps!

+++chefren

= =
Verdien 100 Euro bij aanbrengen van een nieuwe
klant voor een website: http://www.ii.nl/premie