Subject: RE: [Raven] aclu letter on wiretapping and the internet

From: "Thomas Junker" <[email-masked]>
Date: Tue, 9 Nov 1999 23:10:10 -0600

On 9 Nov 99, at 21:43, chefren, who has now exceeded 100 
off-topic posts, wrote:  

> On 9 Nov 99, at 0:01, Thomas Junker wrote [about Lyal's
> statements]: 
> 
> > You should take your arguments to a legal discussion 
> > forum.  Nothing you are saying has any bearing on the IESG 
> > questions put to the IETF on the policy issue of whether 
> > or not the IETF should facilitate wiretapping in 
> > formulating Internet protocols.
> > 
> > Do you get it yet?
> 
> No. I still see you and others arguing that I say or want 
> things that I totally don't want.

I was specifically addressing Lyal Collins' post, of 
course.  While I mentioned you later on, the question 
above was directed at Lyal.  Specifically, he was going on 
about things such as, 

    "allowing a defendant to query the court," 
    "validity of the evidence presented," 
    "the relevant warrant," 
    "If the prosecution can't show such evidence,"
    "it adds doubt to their case,"
    "it results in 'case dismissed'"

I suggested he take those matters to a legal discussion 
forum because they are irrelevant here and decidedly off-
topic.  Both he and you, though, insist on interwining 
presumptions about legal issues with advocacy of a 
standards feature that is also off topic, or conditioning 
on such legal issues the desirability or feasibility of 
the mechanisms you suggest should be taken up as standards 
issues.  I attempted to focus Lyal on the issue before the 
group, and you replied, in what I regard as a leap of 
inference, claiming that I "and others [are] arguing that 
I say or want things that I totally don't want."  What's 
your point?  Where is the connection to the point to which 
you were responding, which was that legal issues are not 
the topic here?

> For example: I have NEVER said IETF should facilitate 
> wiretapping in formulating Internet protocols.

Reasonable and customary English usage allows one to 
conclude from your advancement of an entirely new 
proposition, i.e. a standard for auditable tapping (off-
topic itself, IMO, since that is not the question before 
us) that you have *frequently* said that IETF should 
facilitate wiretapping in formulating Internet protocols.  
Most here would probably agree that your suggestions 
qualify advocating "facilitation."

> I want the IETF to formulate ONE tap-protocol. 

Which is most decidedly NOT the topic here.  The IETF was 
NOT asked to propose protocols or standards for tapping, 
auditable or not.

> A standard 
> that defines tapping from a standard IP stream and 
> transporting it in a secure way to the tapping room of law 
> enforcement. 

That does not address the issue on the table for 
discussion, which is the question "SHOULD?" not "WHAT?" 
and not "HOW?"

> A far more difficult way to tap than with the 
> readilly and omnipresent available tcpdump utility.

So you are now defending your attempt to introduce a 
proposal for a protocol into a discussion forum created 
explicitly to take up the question of "SHOULD THE IETF 
DEVELOP NEW PROTOCOLS OR MODIFY EXISTING PROTOCOLS?" by 
suggesting that your proposal would not *facilitate* 
wiretapping because it would be more trouble and effort 
than tcpdump?  How does that address the problem that 
proposing *any* protocols is off topic in this discussion?

> > > Hence, I would think there is strong potential for
> > > constitutional challenges to show the source and
> > > credibility of the technically gathered evidence. 
> > 
> > You are apparently unaware that some countries have no 
> > constitution at all; that others completely ignore 
> > supposed protections of "rights" in their constitutions; 
> 
> Its not important that crooks exist, 

It certainly is, when you have embraced police access to 
transmissions as a Good Thing and when your auditing 
mechanism does nothing to protect anyone in the absence of 
legislation and rulemaking, both of which are outside the 
scope of technical standards.  My dissection of your 
arguments for an auditable tapping standard are not 
intended to suggest that advancing such a standard is 
proper or on-topic here.  The flaws in your arguments are 
so egregious that they beg reply even though off topic.

> thats just a fact why 
> law enforcement exists, it's important that a standard 
> auditable tap exists, the only way I see to have taps as a 
> multitude of democracies want and data that isn't 
> tampereded with and privacy of the tapped that isn't abused 
> a little more than necessary.

Still off topic.  What you really seem to desire is laws 
and regulations that make anything less than an auditable 
tap unacceptable in the courts.  That is a legal issue 
separate and distinct in each legal jurisdiction of the 
world.  Even in your narrow view of The Netherlands, Dutch 
law, and the role of EU laws, rules, resolutions or 
recommendations, you have failed to provide specific 
documentation.  Instead, you seem to project onto the 
whole of Dutch and EU law your presumption that because 
you believe you see a certain practice in effect where you 
are, that it flows from Dutch and EU law.  Greg Broiles 
has tried to pin you down on that and, as is frequently 
seen in non-lawyers, you have provided little more than 
presumption and fragmentary, seemingly inapplicable and 
contradictory substantiation for your legal beliefs.

Even considering your off-topic viewpoint for the purpose 
of analysis, it seems that you have your issues upside 
down:  if you believe enforcement of tapping auditability 
is a Good Thing, then the place to start is with the law, 
not with the IETF.  If many nations establish auditability 
requirements to keep their police in line and limit 
opportunities for tampering with or fabricating wiretap 
evidence, then standards will follow.  

Perhaps you think that if standards precede the law, the 
law will follow.  There are some few examples of that on 
the record, but no real indication that any governments 
other than your apparently altruistic Dutch one would rush 
to embrace such standards.  More likely is the outcome 
that the IETF would make a fool of itself by attempting to 
tell governments how they should arrange their laws and 
constrain their police.

You also seem to be obsessed with maintaining the privacy 
of information being intercepted by police, as if the most 
potentially damaging and injurious violation of privacy 
were not the tapping itself.  That is quite a peculiar 
view to those of us outside your lovely, trusting world in 
The Netherlands, where you seem to claim that telecomms, 
police and courts fall all over themselves to "prove 
people innocent" and to be scrupulously ethical in their 
handling of wiretaps and wiretap data.  I don't know how 
accurate the picture you paint may be, but I can assure 
you that it is largely inapplicable to the realities 
extant in most of the rest of the world.

> > and that still others use Newspeak to twist their 
> > constitutional limitations into useless pretzels.  You 
> > need to get out more.
> 
> Stop saying things tap apparently point at yourself. Go out 
> to a court and imagine a tap used in a case and think how 
> stupid it would be when tcpdump was used instead of a 
> secure version of it.

I am making every effort to be as clear and consistent as 
is humanly possible.  In any case I was describing the 
third class of constitutions, such as the soviet 
constitution, which guaranteed freedom of religion but was 
universally understood not to mean what it said.  As for 
the "stupidity" of tcpdump output being used as evidence, 
that is another legal argument, which should be taken up 
by concerned parties with their legislators.  Until dealt 
with by legislatures, your vision of an auditable tap 
carries no more weight or effect than an inscription on a 
gun that says, "Only for use against bonafide 
lawbreakers."

> > And it still has nothing to do with the topic here.
> 
> I think it has. I also think IETF has opened this 
> discussion to get further than the "encryption is out of 
> the bottle so tapping is stupid" discussion.

"Encryption is out of the bottle" was not the topic, 
either, nor was it a substantive issue raised here.  You 
insist on making such claims of things raised or written 
here, but they are false claims.  Further, what you 
*think* or imagine about the intent of the IESG (*not* the 
IETF) in opening this discussion is also not relevant.  
The IESG stated clearly what the question is.  It is *not* 
"what should we do to facilitate wiretapping," it is 
"SHOULD WE...FACILITATE WIRETAPPING."  That is a policy 
question.  It has nothing to do with what neat protocols 
you think should be proposed or drafted.  It is only the 
question of whether or not the IETF should even consider 
taking steps to enter into the arena of facilitating 
wiretapping in Internet protocols.

> Although it's up to democracies to decide: 

Yes, so go speak with your democratic legislators, not 
with us.

> Even an 
> encrypted message is important for law enforcemement as are 
> fingerprints without a 3d video presentation of a criminal 
> case. 

Not relevant to this discussion.

> It's not up to you or me or IETF to decide if taps 
> should be legal, thats upon democracies.

Legality of wiretaps was never the question here, either.  
You keep inserting things that the IESG never asked.  Why 
do you do that?  Are you devious and manipulative, or do 
you really have that much difficulty with English?

> But it's quite simple to say that IF taps exist auditable 
> taps are technically superior and IETF can define a 
> standard for it.

Agreed that auditable taps would be better than tamperable 
taps.  But not only is that not the issue *here*, that is 
not a technical issue -- that is a legal issue.  No 
standard for an auditable tape can enforce itself.  You're 
dreaming if you think that such a standard would in any 
way lead to its own adoption, except maybe in that one 
perfect place, The Netherlands.  You are putting the cart 
before the horse in advocating a standard completely 
dependent on legal issues before a single legal standard 
is put in place in a large number of places.

> (NO I didn't say anything about backdoors or modifications 
> in existing standards!)  

You keep defending yourself on the issue of back doors 
when no one has raised back doors.  *You* are the only one 
talking about back doors.  Nor are back doors the issue 
before this group.

> > If you cannot afford the time and the twenty years, you 
> > are allowed to substitute Red Corner, the movie with 
> > Richard Gere and Bai Ling about an American businessman 
> > framed for murder in China.  It's not a documentary but 
> > it's probably not far from what happens there except that 
> > the happy ending is probably pure fantasy.
> 
> (I think this was very stupid and irrelevant text)

You are entitled to your opinion, but that suggestion was 
directed at Lyal, not at you.  Since you wish to make an 
issue of it, though, why not rent the video and then tell 
us about the universal workability of courts, defenses, 
and lawyers' arguments, hmmm?  It's a movie, and its topic 
bears directly on the foundation of many of your and 
Lyal's arguments.  I fail to see how suggesting that Lyal 
view the movie is "stupid," and although suggestions for a 
tapping protocol are completely off-topic on this list, I 
fail to see how suggesting an exercise entirely relevant 
to the off topic arguments is itself irrelevant to those 
making those arguments.  BTW, I have seen no review or 
commentary that even suggests that the movie is inaccurate 
in its portrayal of the functioning of the Chinese legal 
system.

> > > I also think courts are starting to take into account
> > 
> > What courts????  The PRC's courts?  Cuba's courts?  
> > Madagascar's courts?  North Korea's courts?  Russia's 
> > courts?  How about Chechnya's courts?  Do you think there 
> > are many weighty arguments of this type in Chechnya?  What 
> > about Afganistan?  Iraq?  Libya?  Saudi Arabia?
> 
> All examples of bad courts, Yes you are right!

But you fail to comprehend the point.  The point is that 
your many assertions of how courts and legal systems 
*must* *necessarily* react to the existence of an 
auditable tapping standard, indeed your assertion quoted 
above, the very one to which you responded without 
understanding, are fallacious in the context of the many 
courts and systems of courts in the world.  When you 
write, "I also think courts are starting to take into 
account," you are speaking nonsense in any international 
sense.  Further, I couldn't take seriously that kind of 
statement from an obvious amateur when it comes to the law 
even were it within the context of a specific country or 
court.  Non-lawyers and casual lay observers of the law 
have very imaginative and often amusing ideas of what "the 
courts are starting to take into account..."

> But is it important? No. Those guys also have no problems 
> with chemical plants that distribute dioxin.

And that helps your supporting assertions about what 
courts are taking into account exactly how?

> There are however countries that care about 1 molecule in 
> 1.000.000 or even 100.000.000.

Let me see if I follow your reasoning:  The fact that a 
large part of the world, including the most populous 
nation in the world, would likely laugh at and ignore and 
bypass any chefren-approved standard for auditable taps is 
irrelevant next to the arguable fact that some tiny 
minority of nations might seize upon chefren's standard to 
pass laws that no one could think of or propose in the 
absence of such a standard to impose ethical constraints 
on police and courts with respect to wiretapping.  Right?  
You assert that it is reasonable and practical to 
promulgate an international standard for the benefit of 
the altruistic officials and their wiretapping victims in 
maybe one or a small handful of nations when the rest of 
the world is going to ignore such a standard?  Isn't that 
like proposing that the IETF formulate a standard for the 
data reporting of coin tosses by left-handed, myopic Swiss 
albinos who speak Portugese in the hope that the standard 
will itself encourage the numbers of such individuals to 
increase?

> And so there are countries that want data that isn't 
> tampered with in their courts and that's only possible to 
> obtain with good, and open standards.

Almost completely false.  Maybe there are some countries 
that want data in their courts that hasn't been tampered 
with.  Maybe there is only one: The Netherlands.  Maybe 
there are two or three.  But in any case no IETF standard 
can make nations desire that, and any nation that desires 
it can do it without an IETF standard.  AND IT'S STILL OFF-
TOPIC.

> > > So, on that basis, I can't agree with the claim nobody
> > > agrees with chrefren - some of us are  expressing it
> > > differently, and we end up in violent agreement as a
> > > consequence. 
> > 
> > Two is not a crowd, and in any case I have so far seen no 
> > indication that you or chefren understands the topic here 
> > or even that there is a topic.
> 
> So you don't see what we mean, we admit that.

When two are singing a tune that no one asked to hear, and 
that most everyone finds to be out of tune, it is 
remarkably arrogant to characterize that as the majority 
failing to see what the two oddballs mean.  You sound 
something like the asylum inmate whose thesis is that no 
one in the world understands his universal truth.

And whether "we" understand your "we" is also irrelevant.  
This is not a forum for proposing a wiretapping-related 
protocol.  It is a forum for discussing whether the IETF 
should even *entertain* or *sanction* such proposals.  Do 
you understand the difference between those two things?

>    http://www.ietf.org/mail-archive/working-groups/raven/cu
>    rrent/msg00000.html 
> 
>    "should the IETF develop new protocols or modify
>    existing protocols to support mechanisms whose primary
>    purpose is to support wiretapping or other law
>    enforcement activities" 

Read closely... 

    "Should the IETF develop...or modify ...protocols..." 
     ^^^^^^

    NOT 

    "What protocols should the IETF develop or modify..."
     ^^^^

"Should?" is essentially answered "Yes" or "No," with or 
without an explanation.  That is what was asked.

"What?" could be answered with specific or general 
suggestions or proposals.  That is NOT what was asked.

> Essentially two questions in the first paragraph. 

No, it is one question.  The operative word is "Should?"

> Answers:
> 
> No modification of existing protocols (no backdoors) and 
> yes one 

Modification of existing protocols does not, as you seem 
to assume, necessarily imply back doors.

> (1) new protocol that supports the citizens that 
> are wiretapped against abuse by encrypting the tapdata and 
> making sure the tap is an exact copy of the real data of 
> the tapped (encrypted or not) and that all relevant 
> circumstances of the tap are preserved.

Nothing in the IESG's question suggested your 
interpretation.  There was one minor mention of "auditing" 
in the follow up questions.  You seem to have 
misunderstood the entire basis of the list's creation to 
think that anyone asked about the desireability of 
auditing or how to do it.  That was not the question.  No 
protocol or issue of this or that protocol has any bearing 
on the question.

Do you get it yet? (this time directed at you, chefren)

Regards,

Thomas Junker
[email-masked]

_______________________________________________
raven mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/raven