Subject: [Raven] Consensus?

From: Graham Klyne <[email-masked]>
Date: Wed, 17 Nov 1999 13:11:50 +0000

At 17:07 16/11/99 -0800, gustav wrote:
[...]
>I wasn't at the meeting, but it's clear that this list has a 90%
>consensus for no wiretapping, and features to inhibit wiretapping.

I think it is clear that a majority of active particpants have taken an
early view against wiretapping, and a smaller number have a definite
pro-tap view.

But this says nothing about the undecided.

Personally, I think most of the debate so far is much too simplistic, and
have yet to discern any consensus on some principles that could form the
basis of a reasonable IETF (as opposed to personal) policy in this matter.

#g

------------
Graham Klyne
([email-masked])

_______________________________________________
raven mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/raven

---

From: Sandy Harris <[email-masked]>
Date: Wed, 17 Nov 1999 08:56:48 +0000

> basis of a reasonable IETF (as opposed to personal) policy in this matter.

RFC 1984 states a policy and gives a rationale. As I see it, that policy is obviously
correct and supported by a broad consensus among people working on IP networking.

Regrettably, some questions have arisen in the areas of voice over IP since many voice
networks are regularly tapped. Applying the RFC 1984 policy there, and pushing hard for
secure end-to-end encryption would certainly be reasonable there, and is what I would
advocate, but we don't yet seem to have a consensus on that. In fact, the notion seems
to shock some of the people who are used to delivering tappable devices. Moreover, it
might shock various governments and perhaps be forbidden by law.

But neither end-to-end voice security nor the various spurious notions about auditable
taps, CALEA applying to IP, etc. which have been introduced here are the issue. The
only questions asked in the email which chartered this list were whether the IETF
should consider building features into future protocols or modifying existing protocols
to support wiretap.

Of course not. See RFC 1984.

---

From: gustav <[email-masked]>
Date: Wed, 17 Nov 1999 12:11:20 -0800 (PST)

> basis of a reasonable IETF (as opposed to personal) policy in this matter.

I agree with you on that.  This debate is completely political, and
the standard that comes out of it will be a political statement as
much as a technical standard.

Maybe the IETF should compromise.  Make a standard that allows easy
tapping, and supports end-to-end strong crypto.  I would be happy with
that.

---

From: Christian Price <[email-masked]>
Date: Wed, 17 Nov 1999 13:40:13 -0700

Unfortunately certain governments (the US) have made this highly
political by being too thickheaded as to see that by limiting encryption
technology they are stagnating technology.  The European Banking
community /must/ use 512 bit encryption.  US law prohibits us from using
512 bits so we are prohibited from electronic commerce with most of
Europe!  And we wonder why we fear our government!

--Christian

---

From: "Thomas Junker" <[email-masked]>
Date: Thu, 18 Nov 1999 02:57:50 -0600

On 17 Nov 99, at 12:11, gustav wrote:

> I agree with you on that.  This debate is completely political,

The debate is political because the *question* that is the 
charter for this list was political.  READ THE CHARTER.

> and

The purpose of this list is not to develop a standard or 
to discuss which standard should be developed.  READ THE 
CHARTER.

> tapping, and supports end-to-end strong crypto.  I would be happy with

Anyone who came into the list for the purpose of 
discussing the question for which the list was created 
might *not* be happy with that, because making a standard 
for wiretapping is not the purpose of this list.  You are 
evidently a late arrival and have no idea why this list 
was created.

The list page with a link to the message archive is:

The first message, posted by the IESG and stating the 
charter of the Raven list may be found at:

    http://www.ietf.org/mail-archive/working-
groups/raven/current/msg00000.html

Regards,

Thomas Junker
[email-masked]

---

From: Ben Laurie <[email-masked]>
Date: Thu, 18 Nov 1999 11:06:29 +0000

> Europe!  And we wonder why we fear our government!

This is utter tosh. Banks shouldn't use anything as weak as 512 bits,
and US law makes no restriction on what you use.

Cheers,

Ben.

--
http://www.apache-ssl.org/ben.html

"My grandfather once told me that there are two kinds of people: those
who work and those who take the credit. He told me to try to be in the
first group; there was less competition there."
     - Indira Gandhi

---

From: Matthew Saroff <[email-masked]>
Date: Thu, 18 Nov 1999 08:50:40 -0600

> charter for this list was political.  READ THE CHARTER.
	Just to remind people, here is what it said (snipping a lot):
The key questions are:

  "should the IETF develop new protocols or modify existing protocols
  to support mechanisms whose primary purpose is to support wiretapping
  or other law enforcement activities"

  and

  "what should the IETF's position be on informational documents that
  explain how to perform message or data-stream interception without
  protocol modifications".

	I would note that this NOTHING to do with Chefrens business of making
electronic snoops.
	I would also note that the second question has not been discussed at
all on the list.  It's essentially aasking if IETF should support an
instruction manual for intercepts.  Any opinions on this?

-- 
Matthew Saroff
Do not reply directly to this message.  Reply to
[email-masked]

---

From: Christian Price <[email-masked]>
Date: Thu, 18 Nov 1999 10:16:59 -0700

Thank you for bringing the list back to focus.  My $0.02 worth below.

>   or other law enforcement activities"

I don't think the IETF should support any protocol which would undermine
the privacy of end-to-end encryption. (ie include encryption w/key
recovery in the IP stack).  However, we are sure that our governments
will want to tap our communications so maybe it is apropriate to develop
something which makes misues more difficult.  In other words, if we let
the FBI develop its own standard it will probably be much less in our
favor than one we create.
 
>   explain how to perform message or data-stream interception without

I think publishing information on how to tap is an excellent idea.  Not
only does it alert the informed consumer of where privacy does not
exist, it promotes learning and development in much the same way that
the GNU/Linux Open Source movement has.  This will inevitably improve
the quality of the protocols and highlite the need for end-to-end
encryption.

Essentially, I don't care who can tap me, so long as I can use an
encryption which they will have to break to find out what I am saying. 
If it can't be broken then tough for them.  However I would be
interested to be able to be alerted that my communication was tapped.

---

From: Sandy Harris <[email-masked]>
Date: Thu, 18 Nov 1999 17:32:14 +0000

> instruction manual for intercepts.  Any opinions on this?

There has been some discussion. e.g. from a post of mine Oct 15 with subject
"the original questions":

|   "what should the IETF's position be on informational documents that 
|   explain how to perform message or data-stream interception without 
|   protocol modifications".   
|
| By all means, write them. Like any security flaw, these things
| should be exposed so that they can be defended against.
|
| Any such RFC should, of course, also discuss the defenses, or at a
| minimum contain pointers to defensive information.

If nothing else, do we have a consensus on at least this?

---

From: Sampo A Syreeni <[email-masked]>
Date: Fri, 19 Nov 1999 16:17:53 +0200 (EET)

>favor than one we create.

Speaking against any wiretapping proposals in general, another way to go is
to move the current Net architecture in a direction that makes future
attempts at wiretapping even more difficult.

>the quality of the protocols and highlite the need for end-to-end

Agreed. Seeing how difficult it is to convert people from telnet to ssh
certainly supports the case.

Sampo Syreeni <[email-masked]>, aka decoy, student/math/Helsinki university

---

From: "chefren" <[email-masked]>
Date: Tue, 23 Nov 1999 23:30:44 +0100

> evidently a late arrival and have no idea why this list 

However... The political question to a would be non 
political group can be bounced by supplying the proposed 
auditable tapping standard.

As I said: Nobody here want's to be involved in new 
backdoors in old protocols or new protocols with backdoors.

+++chefren

(Sorry I reacted somewhat late.)

---

From: "Thomas Junker" <[email-masked]>
Date: Sat, 27 Nov 1999 03:59:10 -0600

Unofficial Raven list position summary through 0500 GMT, Sat 27-Nov-1999
Compiled by Thomas Junker <[email-masked]>

0. Preface
1. The Key
2. The Tally
3. The Surprise
4. The Results

0. Preface

    I offered to summarize the for/against positions of list posters
    because a veritable flood of traffic at best peripheral to the 
    question posed to the list by the IESG made it difficult for me
    to have a feel for the actual number of those in favor or against.
    The question for the list was:

        "Should the IETF develop new protocols or modify existing
        protocols to support mechanisms whose primary purpose is to
        support wiretapping or other law enforcement activities?" 

    In tallying for/against positions I did not consider the follow-on 
    question, nor the subsidiary questions posed by the IESG, only the 
    principal one stated above.

    In classifying the positions of list participants I looked for at
    least a strong implication of a position taken, if not an explicit
    "Yes" or "No".  I intentionally did not delve deeply into essays
    that failed to indicate a position on the question itself or that
    would require drawing an excessively subjective inference.

    I can't assert 100% accuracy, only best effort to report faithfully.
    If anyone wishes to challenge any of my classifications, I suggest
    that they first review the messages in question, as I have done.  I
    particularly recommend this to those marked as "0," since I honestly
    could not classify those as to position on the IESG's question, even
    though many of them were clearly against wiretapping altogether or
    against excessive ease and facilitation of wiretapping.  If a 
    participant didn't state a position on the question that I could
    discern, I marked them as "0."

1. The Key

    "-" = against IETF facilitation of wiretap
    "0" = neutral or no expression of a position
    "+" = in favor of IETF facilitation of wiretap
    "?" = ambiguous or took both positions
    "*" = Press or IESG/IETF, counted but not included in calculations

    No weight is accorded the number of posts by any poster.  Numbers in
    parentheses are footnotes. 

2. The Tally

- "Aaron Armitage" <[email-masked]>
- Adam Back <[email-masked]>
+  "Adam Rabblerouser" <[email-masked]> (1)
- Adam Shostack <[email-masked]>
0 Alan Barrett <[email-masked]>
- "Albert Gidari" <[email-masked]>
0 [email-masked]
* "Ann Harrison" <[email-masked]>
- Anonymous <[email-masked]> (2)
- Barry Steinhardt <[email-masked]> (3)
0 Anonymous <[email-masked]>
- Ben Laurie <[email-masked]>
0 Bill Manning <[email-masked]>
- Bill Sommerfeld <[email-masked]>
- Bob Mahoney <[email-masked]>
- Brett McCormic- "Brett Wooldridge" <[email-masked]>
+ Brian Rosen <[email-masked]> (4)
- "C. Wegrzyn" <[email-masked]>
+ "Callaghan, Robert" <[email-masked]> (4)
- "Carter Bullard" <[email-masked]> (4)
0 "Caspar Bowden" <[email-masked]>
+ "chefren" <[email-masked]> (4) (5)
0 Chip Sharp <[email-masked]> (4)
0 "Chris Rose" <[email-masked]>
- Chris Savage <[email-masked]>
- Christian Huitema <[email-masked]>
? Christian Price <[email-masked]> (4)
- "Computer User" <[email-masked]>
0 Craig Brozefsky <[email-masked]>
0 Dan Schlitt <[email-masked]>
0 "Dave" <[email-masked]>
- David Banisar <[email-masked]> (6)
0 David Sobel <[email-masked]>
* Declan McCullagh <[email-masked]>
0 Dennis Glatting <[email-masked]>
- Derek Balling <[email-masked]>
- David Gamey <[email-masked]>
0 "Dustin Goodwin" <[email-masked]>
- Ed Stone <[email-masked]>
- [email-masked]
- Eugene Leitl <[email-masked]>
0 "Fellows, Peter [UK]" <[email-masked]>
- Firebeard <[email-masked]>
* Fred Baker <[email-masked]>
0 [email-masked]
- "Ge' Weijers" <[email-masked]>
0 Glen Zorn <[email-masked]>
0 Graham Klyne <[email-masked]>
- Greg Broiles <[email-masked]>
+ Grenville Armitage <[email-masked]> (4) (7)
0 Gus Hosein <[email-masked]>
- gustav <[email-masked]>
0 [email-masked]
0 Harald Tveit Alvestrand <[email-masked]>
0 Ted Hardie <[email-masked]>
0 dh <[email-masked]>
0 Ian Jackson <[email-masked]>
+ Jacob Palme <[email-masked]>
- James Carlson <[email-masked]>
- Janne Haikonen <[email-masked]> (4)
0 "Jill C. Arnson" [email-masked] (4)
- Jim Dempsey <[email-masked]>
- Jim Gillogly <[email-masked]>
0 Johann Wurzenberger <[email-masked]> (4)
0 "John A. Limpert" <[email-masked]>
- John Gilmore <[email-masked]>
0 John Young <[email-masked]>
0 Johnny Eriksson <[email-masked]>
0  John David Galt <[email-masked]>
0 "Jon 'tex' Boone" <[email-masked]>
0 Josephine Riter <[email-masked]>
- Keith Moore <[email-masked]>
- Koen Holtman <[email-masked]>
0 Leslie Daigle <[email-masked]>
0 "Lyal Collins" <[email-masked]>
- Marcus <[email-masked]>
0 Mark Atwood <[email-masked]>
0 Mark Gaynor <[email-masked]>
- Mark McCutcheon <[email-masked]>
0 Martin Minow <[email-masked]>
- "Matt & Carolyn Rogers" <[email-masked]>
- "Matt Clark" <[email-masked]>
0 "Matt Crawford" <[email-masked]>
0 Matthew Saroff <[email-masked]>
* "Meeks, Brock" <[email-masked]>
0 Melinda Shore <[email-masked]> (4)
0 "Michael Froomkin - U.Miami School of Law" <[email-masked]>
- Michael Richardson <[email-masked]>
0 "Michael Welser" <[email-masked]>
- [email-masked] (Mikus Grinbergs)
- Nate Lawson <[email-masked]>
0 Nicholas Bohm <[email-masked]>
- "Nicholas C. Weaver" <[email-masked]>
- "P.J. Ponder" <[email-masked]>
- Patrick May <[email-masked]>
0 "Paul A. Lambert" <[email-masked]>
- Paul Crawford <[email-masked]>
- Paul Ferguson <[email-masked]>
- Paul Hoffman <[email-masked]>
0 Paul Krumviede <[email-masked]> (4)
0 Peter Greenwood <[email-masked]>
- Peter Gutmann <[email-masked]>
- Publius II <[email-masked]>
- Ray Yang <[email-masked]>
0 Richard Higson <[email-masked]>
- Richard Lamont <[email-masked]>
- Richard McAllister <[email-masked]>
- "Richard Payne" <[email-masked]>
0 Richard Shockey <[email-masked]>
- Richard Willey <[email-masked]> (4)
- "Rick Braddam" <[email-masked]>
0 Rob Lockhart <[email-masked]> (4)
- "Rob P. Martin" <[email-masked]>
0 Robert Hettinga <[email-masked]>
0 Robert Joseph Honan <[email-masked]>
0 Robert Marshall <[email-masked]>
0 "Robert Wood, Chrmn." <[email-masked]>
- Robin Wilton <[email-masked]>
0 "Ron Ryan" <[email-masked]> (4)
- Russell Nelson <[email-masked]>
0 Sampo A Syreeni <[email-masked]>
- Sandy Harris <[email-masked]>
0 Scott Bradner <[email-masked]>
0 Scott Cadzow <[email-masked]>
0 Secret Squirrel <[email-masked]>
0 Seth David Schoen <[email-masked]>
- Snagnbytz <[email-masked]>
0 Stephen Farrell <[email-masked]>
0 Steve Bellovin <[email-masked]> (4)
0 Steve Schear <[email-masked]>
0 Stuart Staniford-Chen <[email-masked]>
- Stuart Yeates <[email-masked]>
- "Thomas Junker" <[email-masked]>
0 Tim Chown <[email-masked]>
0 "Turner W. Rentz, III" <[email-masked]>
- uombat <[email-masked]>
- Vernon Schryver <[email-masked]>
0 "Vicente Arias Davila" <[email-masked]>
- Walter Reed <[email-masked]>
- Wendell Bishop <[email-masked]>
- William Allen Simpson <[email-masked]>
- "William H. Geiger III" <[email-masked]>

Footnotes:

(1) Expressed approval of intercept as a tool of law enforcement,
    which was not the issue under discussion

(2) Expressed disapproval of intercept, which was not the issue

(3) Forwarded material on topic, against IETF facilitation of wiretap

(4) Vendor/carrier

(5) I had to wrestle with this, because chefren's advocacy is for 
    something other than the question put to the list, as revealed 
    in his very first post, in which he agreed with Brian Rosen in
    favor of IETF formulating standards with respect to wiretap,
    but then clearly indicated that the wiretap issue to which
    he was referring was not the one put to the list:

        > 	Sit down and do it right. 

        My opinion too. 

        "Wire"tapping is a serious problem, lot's of democracies have
        thoroughly thought about it and have decided it should be
        done with lots of concerns and often made those concerns a
        serious part of the law. 

        It's definitely not up to techies to obstruct democratic
        choices. 

    This was the foundation for chefren's suggestions that the IETF
    formulate standards for "auditable taps," which was not relevant
    to the question the IESG put to the list.  Still, he did write
    "My opinion too" in agreement with Brian's clear position in favor
    of IETF facilitating wiretapping.

(6) David Banisar's post is a letter drafted specifically to oppose
    IETF facilitation of wiretapping, and is signed by 61 individuals
    and one organization, some of the individuals also having posted
    direct expressions of opinion to the Raven list.  Banisar's post
    is counted here as one participant in opposition, since many of
    the signers did not choose to participate directly, while others 
    are counted elsewhere by virtue of their own posts.

(7) Declared in favor of IETF formulating protocols or standards 
    requiring auditing, even though the IETF, as a technical body, 
    can do no such thing, on the basis that lawmakers might mandate 
    audibility at some time subsequent to the promulgation of such 
    a standard.

3. The Surprise

    Many who probably think they expressed a position on the question
    didn't. 

    It appears to me in reviewing the traffic by poster that many
    people whose position may be inferred from their comments did
    not actually express a position, and may be under the impression that
    they *did* express a position.  I have graded those posters as "0" in
    an effort to maintain objectivity in reporting this count.  Where
    I did infer a position, it was only where such an inference was easy
    and defensible and did not require deep analysis of the message.  In
    doing so I did not interpret positions taken on wiretapping or other
    issues of privacy and freedom in general to be positions on the 
    question.

    Oddly, many of those who were the most outspoken in opposition to
    wiretapping and trusting government neglected to state a clear
    position on the specific policy question before the IETF, and so are
    marked "0" in the list above.  There is probably a lesson in there
    somewhere:  keep your eye on the issue that is on the table.

4. The Results

 66    "-" = against IETF facilitation of wiretap
 64    "0" = neutral or no expression of a position
  6    "+" = in favor of IETF facilitation of wiretap
  1    "?" = ambiguous or took both positions
  4    "*" = Press or IESG/IETF, counted but not included in calculations
---
141    Distinct participants
 -4    Presumably impartial ("*")
---
137    Qualified participants

48%    of qualified participants "against"
47%    of qualified participants failed to state a position
 4%    of qualified participants "for"
 1%    of qualified participants ambivalent

 72    Positions taken

92%    of positions taken were "against"
 8%    of positions taken were "for"

-end-

---

From: "P.J. Ponder" <[email-masked]>
Date: Sat, 27 Nov 1999 09:03:09 -0500 (EST)

Thanks to Thomas Junker for compiling the tally of positions taken for or
against.  That's a lot of work to go through all those messages and
analyze them.  

I imagine a lot of the people who wound up with a zero (neutral or no
position) will be surprised, and many of them will probably clarify their
feelings now that the tally is posted.

In regard to the recent discussion of shutting down the mailing list, I'd
vote for keeping it going to see if we can get a statement drafted that
reflects, at least, the majority position in clear and unambiguous terms.

(And I hate to see the thing go away now that John Young has started
posting to the list.  Nobody rants like John.)

---

From: Matthew Saroff <[email-masked]>
Date: Mon, 29 Nov 1999 08:42:37 -0600

Hi,
	Once again, I don't write clearly enough, and I was listed as not
having stated a position.
	I am opposed to the IETF creating of modifying protocols to facilitate
wiretapping.
	This opinion is noe even worth the electrons it's printed on.

---

From: "Paul A. Lambert" <[email-masked]>
Date: Mon, 29 Nov 1999 09:23:59 -0800

Thomas,

You have me listed incorrectly:

>    0 "Paul A. Lambert" <[email-masked]>

Please change your tally of my opinion to a 'minus', that is, against IETF 
facilitation of wiretap.

Paul A. Lambert

---

From: "chefren" <[email-masked]>
Date: Tue, 30 Nov 1999 00:18:38 +0100

On 27 Nov 99, at 9:03, P.J. Ponder wrote:

> Thanks to Thomas Junker for compiling the tally of
> positions taken for or against.  That's a lot of work to
> go through all those messages and analyze them.  

Although upfront I was against it and I still know numbers 
say nothing about truth. I do appreciated the work he 
definitely did.

Problem still is he started "lying with statistics" as I 
presumed upfront. For example his report didn't stated that 
I'm definitely against any backdoors in existings or future 
protocols. That's the meaning of probably 100% of the 
people here and definitely usefull to report to the outside 
world.

..

> posting to the list.  Nobody rants like John.)

Pfffff just easy to skip FUD until now.

+++chefren

= =
ii.nl ontwerpt, bouwt én onderhoudt websites
100 Euro aanbrengpremie: http://www.ii.nl/premie