Subject: Re: [Raven] View From 20,000 Feet

From: "Thomas Junker" <[email-masked]>
Date: Tue, 9 Nov 1999 23:10:40 -0600

On 9 Nov 99, at 16:24, Richard Payne wrote:

> 5) Some list participants have suggested that the IETF has no choice but to
> bow to national laws that allegedly already require tapping the Internet.
> This "legal requirement" argument, examined closely, does not seem to hold
> up, either for the US (CALEA exemption for information services) or the EU
> (Enfopol '98 being dropped).
> 
> 6) Many list particpants consider such a "legal requirement" argument
> invalid in any case, citing RFC 1984 as a precedent for "doing the right
> thing" from a security viewpoint regardless of whether national laws have
> caught up yet.

There is no obligation of any kind on the IETF to do 
*anything*, *ever*.  It does not turn on examination of 
CALEA or any other law.  Even if every nation on the 
planet passed a perfect copy of some hyper-CALEA that 
*did* require all manner of facilitation of wiretapping by 
telecomms and ISPs, that would *still* not obligate the 
IETF to do a single thing.  All the discussions suggesting 
that any law obligates the IETF in any way have been bogus 
and have missed the point.  IETF can ignore whatever it 
wishes.  It is not a formal body.  It has no identifiable 
membership.  It exists and has an effect solely through 
the good and useful works it has produced.  No one in the 
world is bound to abide by anything the IETF says, and 
nothing anyone anywhere in the world says binds the IETF 
in any way, except the guidance of the IESG, under whose 
guidance the IETF takes up issues.  If any government 
anywhere were foolish enough to name the IETF in a 
purported requirement, the IETF could in that same moment 
cease to have any participants upon which such a 
requirement could be imposed.  Any notion of a "legal 
requirement" is silly.  It is the carriers and vendors 
either trapped in a given jurisdiction or wishing to sell 
their wares in a given jurisdiction who may have "legal 
requirements" to concern themselves with.  Don't confuse 
that with any fallacious legal requirement on the IETF.

Nor is RFC 1984 any kind of legal precedent.  It neither 
validates nor invalidates any suggestions of any legal 
requirement.  RFC 1984 is a statement of policy for those 
who pay attention to RFCs.  Presumably, it was intended to 
set a course for future IETF consideration of issues 
touched on by RFC 1984, that has zero legal significance.

Your intent is good, but you inadvertantly give your 
opposition parts of their arguments for free when in 
reality there cannot be any applicable legal requirement.

Regards,

Thomas Junker
[email-masked]

_______________________________________________
raven mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/raven