Subject: RE: [Raven] Summary of Observations

From: [email-masked]
Date: Mon, 1 Nov 1999 20:47:24 +0200

Hi, here're my few cents,
(note the word 'my', all the opinions in this list have been
those of the writers, not the 'IETF', you see...)

> 1)  The IETF determined that there were many bad governments, 
> but could not determine if there were any good governments.

 - Maybe some day there is.. the government of Utopia ;-). But, 
the problem is not only the government, but also the people 
(officers, judges, etc.) behind it. They tend to do all kinds of
illegal things if you give them a chance... Not to mention the 
very bad track record of some of the agencies of the 'so called' 
democracies. (I guess you live in one..).

> 2)  The IETF determined that each country has its own laws.  
> (don't lose your sense of humor)

 - That may be funny, but that is the point here. Since there's no 
common global law on information transfer, a global body like IETF
cannot say 'OK, we are above ALL governements and choose which
laws of which governments we support'. Only reasonable way to proceed
is to stay out of the legal discussion and concentrate on technical 
interoperability and robustness issues (including maximazing the
security of the system).

 - Also, remember that next year the law, according to which the 
work has been done, could be reversed. What then? Start all over
again? Define a new subset of governments (heh) whose laws to 
support?

> 3)  The IETF determined that bad governments do not currently 
> have the tools to do electronic surveillance and won't until 
> the IETF creates some for them.

 - They have tools, sure. We should make standards that make their
work harder. Nobody (at least the more intellectual ones) dares to
send business-critical data over the Internet, since there's very
little security against big countries spying for THEIR companies.

> 4)  The IETF determined that no one is currently intercepting 
> packets and possibly violating privacy on the Internet for either 
> intelligence, law enforcement, network management, hacking, or 
> any arbitrary reason.

 - Which discussion are you following. This has been discussed to 
death here in Raven and everyone agrees about this...

> 5)  e-Commerce was accepted as a given.
> 6)  The IETF determined that there were no e-Criminals.

 - Sure there are. That's why everyone wants the strongest security
possible (and I mean security through integrity, authentication,
non-repudiation and confidentiality, i.e., through strong crypto, 
not through having more holes...).

[Lot's of semi-sarcastic points deleted below...] 

> 11)  The IETF did not attempt to determine whether 
> e-Consumers would trust e-Commerce without e-Cops.

 - I'd rather have strong crypto, with which I can be sure (or at 
least MORE sure than with e-Cops listening) that no-one, except
the company with which my transaction is done, can change, substitute
or remove my messages without my knowledge.
 
 - Not to mention that there may be some personal transactions that
you wouldn't want reveal to your local cop (who could, e.g., be 
your brother-in-law, or whatever...;->).

> 13)  The IETF determined that the current state of Internet 
> security and privacy was adequate.

 - Eh? It surely is far from adequate (mainly due to sloppy admins and
users (and OS developers..)), but at least there's very little sense 
to make it worse..
 
> 14)  The IETF determined what consituted "unreasonable" 
> search and seizure (see 4th Amendment of U.S. Consitution)...

 - This is a bit off-topic, but I really can't relate to this USA-
centricism in this list. I have no clue about your laws, but it 
seems there's less concern about privacy in US than here... 

> 15)  The IETF was not clear what law enforcement's 
> requirements were, but that did not hinder the debate in anyway.

 - The point excactly! Why care about the law X of the country Y 
while discussing about international standards?

> 17)  The IETF detemined that its technical specifications 
> were above the laws of any country.

 - They're just technical specs, nothing more, nothing less. Just 
protocols/procedures with which various interconnected systems can
interact with each other in a meaningful, manageable, effective and
(hopefully) secure way.
 Very little to do with various laws of just as various countries...

> 18)  The IETF did not attempt to determine whether the 
> Internet was a vital part of the public infrastructure (worthy of
> active protection) or the private playtoy of an elite group of 
> technicians.

 - You haven't been around lately, eh? This issue may have been
interesting during late 80's, though.

> 19)  There were some technical discussions concerning 
> encryption, tap rooms, etc., but no conclusions.

 - Yeah, chefren sure was promoting his company's (?) tap-device
high-level architecture. What did you expect? Everyone says "yeah,
now we see the light! We need this and it must be exactly like this,
so why don't we make our scope a little wider and start promoting
our own little 'IETF-HW-design'".

 - If you haven't reached any conclusions about encryption, then I
suggest you to stop sending anything even remotely 'secret' over the 
Internet (e.g. credit-card number) because changes are, you are doing
that unprotected.

> I am merely an observer wondering how much trust 
> to put in this evolving, human-made system.

 - It always pays to be cautios. If you have nothing to hide, then 
obviously you don't need to worry about others sniffing your data,
but then, what can you offer, if everything you know/do is already
known by everyone. On the other hand, if you have some valuable info,
surely you want to be sure that nobody else, than those to whom you 
address that info to, can get it?

 Once again, these were just MY thoughts on the issue at hand.

_______________________________________________
raven mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/raven

---

From: "chefren" <[email-masked]>
Date: Mon, 1 Nov 1999 23:17:50 +0100

> our own little 'IETF-HW-design'".

I wasn't promoting any companies design I was definitely 
promoting a fully opened design tapbox that anyone could 
construct below what was estimated by another to $3000.

Open hardware architecture and open source software, closed 
and sealed hardware box in the field and anyone can check 
if someone has tampered with it.

The over-all architecture isn't ours, it's what's required 
in The Netherlands for phone-taps. The IP part of it is 
"new", well thought out I think by multiple parties (law 
enforcement agencies, communication providers and 
suppliers but not "high tech" in any way.

+++chefren