Subject: RE: [Raven] Summary of Observations

From: Mark McCutcheon <[email-masked]>
Date: Wed, 3 Nov 1999 11:08:01 UTC-0800

On 2 Nov 99, at 22:33:58 UTC "chefren" <[email-masked]> wrote:

>> b) It amazes me that a T1/E1 connected "tapbox" is considered
>>    useful in the Netherlands, at least at carrier level.
> 
> Here you are, in the explanation some day's ago I explained 
> how it should work: The communication provider should route 
> the to be tapped data allong the low-cost 10-100Mbit 
> ethernet adapter of the tapbox.
> 
> After such a short explanation things become simple isn't 
> it?

Indeed they do.  I misunderstood the purpose of your proposed
device because you call it a tapbox.  It is not.  It is a sealed,
open hardware design, open-standard software, auditable *digital
recorder* designed to produce as gold-plated evidence whatever
the tapping agent decides to record.

The tap box itself - the circuits and software which pick out a
particular flow and send it to the recorder interface - is part
of the closed, proprietary hardware and inaccessible firmware of
the carrier switch.  Not you nor I nor the IETF will know or be
able to verify its adherence to any supposed standards of
auditability or accountability, any more than we are allowed to
inspect the code for Cisco's implementation of BGP4 or Nortel's
for diffserv in its Versalar 25000 terabit switch-router.

>> The vendor engineers who wish to specify tap-friendly
>> protocols for VoIP represent multi-gigabit-per-second switch
>> manufacturers. Tapping technology they build into their
>> hardware will owe nothing to this quaint fiction, but rather a
>> lot to the US FBI's demanded capacity requirement.
> 
> IETF should like communication providers never mind about the
> message into the message. Law enforcement should figure out
> what everything could mean by themselves or pay the VoIP
> software manufacturer for a decoding program.

Huh?  Non-sequiter.

>> This has at times run as high as the ability to tap 1% of the
>> system's "engineered capacity" simultaneously.
> 
> So a 100MBit tapinterface is good enough. Highest cost will 
> probably the extra port on the high-speed router. Don't 
> forget the interface isn't designed for driftnet fishing, 
> every tap should get it's own tapbox. No sweat here.

I don't believe your economic "analysis" of the cost increase to
backbone switches for a nanosecond, but that's really not the
issue.  If the law enforcement agencies of even relatively open
societies demand simultaneous access to 1% of terabits per second
of traffic, and switch vendors are falling over themselves to
provide it, it's NOT going to be through means which require 5000
sealed digital recorders and 10,000 incorruptible tapping agents
*per switch* (1Tbps * 1% / E1 bitrate) (1).

Thanks to your explanation, it's more clear than ever that this
digital recorder, alias "tapbox", is an irrelevant distraction
and a continuing source of off-topic posts.  I apologize to the
list for my part in it, will try really hard not to follow up
further, and hope against hope that you (chefren) will do
likewise.

Mark McCutcheon

----------

Footnote 1:  These numbers obviously don't mean much.  On the one
hand, each conversation is only 2 x 64kbps, so a Tbps switch
could carry 7.5M simultaneous conversations, and tapping 1% would
require 75K recorders.  On the other hand, no-one imagines a Tbps
switch carrying nothing but VoIP - do they?

_______________________________________________
raven mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/raven

---

From: "chefren" <[email-masked]>
Date: Wed, 3 Nov 1999 21:19:03 +0100

On 3 Nov 99, at 11:08, Mark McCutcheon wrote:

..

> I misunderstood the purpose of your proposed

OK it's a recorder and it's for sure designed to deliver 
gold-plated evidence.

However there is something "strange" in the design: It's 
distributed among all parties involved:

Prosecutor
Law enforcement
Communication provider
Judge
Tapped person

And all parties are restricted to only that what they need 
to know or have to get things up.

+++chefren

p.s. Why would the place where the auditable tap probably 
should be used be off-topic?