Subject: Re: [Raven] Anonymous taps

From: "chefren" <[email-masked]>
Date: Thu, 28 Oct 1999 19:11:26 +0200

On 27 Oct 99, at 22:10, Richard Payne wrote:

> Chefren wrote:
> > "Grrrrrrrrrrrrrrrr"
> Sorry.

;-)

> Chefren also wrote:
> 
> > SOME of us say that if there inevitable will be taps it
> > will be smart to configure an IETF standard that specifies
> 
> Some of us think that IPSec will eventually make taps useless, except
> perhaps for traffic analysis, and that something like onion routing could be
> used to defeat most traffic analysis. It therefore seems pointless to make
> an IETF standard for something that will likely become obsolete.

I'm not interested in the useful/useless discussion. I'm 
not interested in the data that's transported at all. Thats 
up to law-enforcement and not interesting for communication 
providers.

Fact is there do exist laws in this world that demand taps 
and IETF can make a standard for good, auditable, taps that 
respect privacy as much as possible.

Taps made with tcpdmp or something like that should be 
subsubstandard for any court in this world as soon as 
possible

+++chefren

_______________________________________________
raven mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/raven

---

From: "Rick Braddam" <[email-masked]>
Date: Thu, 28 Oct 1999 13:58:29 -0500

----- Original Message -----
From: chefren <[email-masked]>
To: <[email-masked]>; Richard Payne <[email-masked]>
Sent: Thursday, October 28, 1999 12:11 PM
Subject: Re: [Raven] Anonymous taps

> respect privacy as much as possible.

Fact is that the IETF can't guarantee that any one country, much less all countries, will adhere to the standard or respect privacy.
If they make a method available for unlimited taps, there will be unlimited taps. If the information obtained from taps is not used
in court directly, but used to develop other information which can be used in court, the tap info is never revealed. If the tap info
is used for other than LE uses, such as for financial gain by individuals, where is your respect for privacy then? You can't come up
with a tapping system which doesn't involve actions by people, and some people are subvertable.

> subsubstandard for any court in this world as soon as

It doesn't matter if they are, if an attacker is after credit card numbers.

Rick

---

From: "chefren" <[email-masked]>
Date: Thu, 28 Oct 1999 22:27:56 +0200

On 28 Oct 99, at 13:58, Rick Braddam wrote:

> Fact is that the IETF can't guarantee that any one
> country, much less all countries, will adhere to the
> standard or respect privacy.

The same for other IETF standards, IETF can't guarantee 
they won't be misused for a conspiracy to kill the 
president or for a government conspiracy against you.

> If they make a method available for unlimited taps, there
> will be unlimited taps. 

Not necessary, tcpdump exist.

> If the information obtained from taps is not used
> in court directly, but used to develop other information
> which can be used in court, the tap info is never
> revealed.

Might well be but if it pops up that information was 
gathered with unlawful means the prosecutor can stop his 
actions. (This is how it works over here...)

> If the tap info is used for other than LE uses,
> such as for financial gain by individuals, where is your
> respect for privacy then?

We/IETF should make a standard that gives laws all the 
hooks and features necessary to get this kind of misuse out 
of this world as much as possible. Encryption, 
authentication and all kind of basic technic tricks kan 
help here.

> You can't come up with a tapping system which doesn't
> involve actions by people, and some people are
> subvertable. 

And you cannot come up with a guarantee that everyone who 
uses the Internet won't use it for deeds agains laws.

I have brought in a basic design that makes it possible to 
detect misuse.

> It doesn't matter if they are, if an attacker is after credit card numbers.

What has this to do with tapping by law enforcement?

I have got to find that sig...

+++chefren

=Large signature follows=

I think we need a simple architecture for a point to point
tap interface that has strong provisions against misuse.

On one side the communication provider who only starts tapping a specific customer or IP number with proper warrants. On the ot
her side
 the approved tapping room. Everything should be organized by the central "tapping office". This office should provide keys for
 strong 
encryption to both communication provider and tapping room.   

Law and technology should both provide as much checks and balances as we can come up with. Law can provide good procedures, tec
hnology 
can provide technical means to check them or force them.    

=Large signature ended, please comment me off-line to make
it better=

---

From: Mark Atwood <[email-masked]>
Date: 28 Oct 1999 13:48:52 -0700

> tap interface that has strong provisions against misuse.

If you think so, go write up a strawman "internet draft",
and post it.

-- 
Mark Atwood               | 
[email-masked]             | 
http://www.pobox.com/~mra |

---

From: Sandy Harris <[email-masked]>
Date: Fri, 29 Oct 1999 02:12:00 +0000

> > tap interface that has strong provisions against misuse.

Which of course does not imply that such an architecture is possible.
 
> If you think so, go write up a strawman "internet draft",

Let's see. We can use IPSEC to deliver data from tap point to LEA.
That's the easy bit. What else do we need?

Warrants and records, digitally signed and timestamped. A public key
infrastructure so the signatures can be verified. This is already a
non-trivial protocol.

Security for both warrants and records, since various criminals and
other targets of investigation might find them interesting reading.
An encryption system that protects against that, without interfering
too much with auditing or with use in evidence.

A tapping mechanism that only takes things it is authorised to and
delivers them, suitably secured, to authorised parties. Some sort of
policy mechanism for expressing to that system how it is to interpret
"authorised". A means for warrants to express what authorisations
they are providing.

Do we need a policy mechanism that lets, say, a French ISP decide
whether his software should honour a US-issued warrant to tap a link
between Canada and Belgium, if the packets pass through his routers?
Or can we keep this part of the technology simple, just let him honour
only requests from French courts and leave getting a French warrant issued as a problem for the US authorities?

Logging and error-reporting. Must some types of error or attempts at
unauthorised actions be reported to the warrant issuer or to the LEA?

Perhaps some kind of blind verification protocol that lets the
communication provider verfify that a warrant is legitimate without
letting him know things like who the tap's target is, or whether the
agency involved is national security or the drug squad. 
 
Then there's the identity problem. Suppose my friendly local Mounties
get a warrant to tap my communications. If I'm dialing in to an ISP,
with a different IP address every time, how do they identify my
messages?

This might be easy if they're tapping from that ISP and the protocol
specifies (another complication) that the ISP must provide them with
the mapping between my login name and an IP address, in real time. I don't see how it would be possible if their tap is
elsewhere, e.g. on
the backbone.

And what about messages I send from work, where my workstation's IP
address is translated by the firewall so it does not appear on
Internet-visible packets, and my packets are mixed with those of other
employees? Same problem comes up if I'm on a multi-user computer.

If they cannot identify my IP address, I think the only way they can
tap me is to collect all packets, then try to sift out mine. Ooops.
That has some interesting implications for senders and receivers of
all those other packets. Or is your proposed protocol going to include
a spec for a sifting daemon that will automagically recognise the
packets the warrant covers?

If, on the other hand, the tapping protocol specifies that warrants
can be issued only for taps on specified IP addresses, not on individuals, that doesn't work either. In some cases it catches
lots
of  packets from innocent bystanders; in others it misses the target.

Your "strong provisions against misuse" mean difficult auditing and
verifiability requirements for all the above.

Wanting "a simple architecture" for a difficult problem does not work.
Unless you have a magic wand handy, give up the whole notion.

---

From: "Lyal Collins" <[email-masked]>
Date: Fri, 29 Oct 1999 17:19:25 +1000

I think it is technically do-able.
Also, expensive.
Accordingly, will it be implemented ?

Regards,
Lyal

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On Behalf Of
> Sandy Harris
> Sent: 29 October 1999 12:12
> To: [email-masked]
> only requests from French courts and leave getting a French 
> warrant issued as a problem for the US authorities?
> 
> the mapping between my login name and an IP address, in real 
> time. I don't see how it would be possible if their tap is
> elsewhere, e.g. on
> the backbone.
> 
> can be issued only for taps on specified IP addresses, not on 
> individuals, that doesn't work either. In some cases it catches
> lots

---

From: "Ge' Weijers" <[email-masked]>
Date: Fri, 29 Oct 1999 09:17:23 -0700

> actions. (This is how it works over here...)

That's exactly what they hope you believe. When the pressure is on law
enforcement authorities will do all kinds of illegal things. You can
find all kinds of things in public reports of 'enquetecommissies'
(parliamentary inquest committees in NL) if you're willing to read
them. There was this policeman breaking into a home, who them made an
anonymous call to the police tip line. Qui custodiet custodes.

Ge'

-- 
-
Ge' Weijers                                Voice: (614)326 4600
Progressive Systems, Inc.                    FAX: (614)326 4601
2000 West Henderson Rd. Suite 400, Columbus OH 43220

---

From: "chefren" <[email-masked]>
Date: Fri, 29 Oct 1999 18:51:49 +0200

> I think it is technically do-able.

More expensive than tcpdump on the backbone of a 
communication provider, a place where law-enforcement 
shouldn't have any access to.

> Accordingly, will it be implemented ?

$3000 is stated by someone and I think it will cost $5000-
$10.000 per tapbox. That's definitely no serious problem.

+++chefren

I think we need a simple architecture for a point
to point tap interface that has strong provisions
against misuse.

On one side the communication provider who only
starts tapping a specific customer or IP number
with proper warrants.

On the other side the approved tapping room.
Everything should be organized by the central
"tapping office". This office should provide
keys for strong encryption to both communication
provider and tapping room.

Law and technology should both provide as
much checks and balances as we can come up
with. Law can provide good procedures,
technology can provide technical means to
check them or force them.    

=Large signature ended, please comment me
off-line to make it better=