Subject: Re: [Raven] Fly away, raven

From: "chefren" <[email-masked]>
Date: Mon, 1 Nov 1999 22:43:36 +0100

On 29 Oct 99, at 17:08, Vernon Schryver wrote:

> By definition, a tap is a security hole.  It may be a trivial hole no one
> worries about if no cleartext is deciphered (e.g. tcpdump against people
> with common sense), but it is still a hole.

It COULD be a security hole.

If we put together a good design with minimum software, 
processor running from ROM-code, sealed box and open 
software, it should be pretty clear that the tapbox cannot 
be programmed from outside the communication providers 
network and thus wouldn't be a serious hole.

Tcpdump is like drifnet fishing, the word "hole" isn't in 
place at all. It's an optimum privacy breaking port to law 
enforcement agencies.

+++chefren

= =
Verdien 100 Euro bij aanbrengen van een nieuwe
klant voor een website: http://www.ii.nl/premie

_______________________________________________
raven mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/raven

---

From: Brian Rosen <[email-masked]>
Date: Mon, 1 Nov 1999 17:07:20 -0500

Brian Rosen wrote:
> 
> > C'mon, we live in the real world, and we sometimes have to
> > support things that aren't "nice".  Legal Intercept is a law,
> > a very old law.  It may be that it should be abolished.  Talk to
> > your congressperson.  Until the law changes, we (vendors and
> > carriers) are required to meet its terms.  The issue doesn't
> > rise to the level where civil disobedience is appropriate.
> 
> which raises a number of questions:
> 
> 0) Is 'things that aren't "nice"' a euphemism for 'things 
> that I know darn
> well are wrong'?
I personally don't like legal intercept.  I don't know darn
well that it is wrong.  BTW I think restricting export of strong encryption
is wrong.  Doesn't mean that I didn't help my company make "weak" encryption
to meet the law as it existed.
 
> 1) Does 'legal intercept' here refer to CALEA, which was the 
> first law to
> place the onus on telecoms to use wiretap-friendly equipment? 
> If so, does a
> law passed by Congress by voice vote in the middle of the 
> night (gotta love
> that accountability to the voters) in 1994 count as "a very old law"?
Legal Intercept is a general term that provides an undetected listen only
connection.  CALEA is merely the current incarnation in U.S. law.  We have
to meet the current laws in the countries we market into.  

Law passed at midnight is law.  

> 2) (Related to 1) Is it proven that CALEA applies to the 
> Internet? If so, is
> the reasoning supporting this conclusion generally available? 
> If not, what
> is the legal authority for making people build security holes 
> into their
> protocols?
Legal Intercept is as old as the hills.  If you seriously think it doesn't
apply to voice over net telephony, get a lawyer and challenge. At the
moment, our customers think it does.
That's all I need to know - I can't sell equipment unless I meet legal
intercept rules, US, Europe, and anywhere else we decide to sell equipment.

Any country has the legal authority to compel building security holes in
products sold in their country - or even providing service into their
country.  You can argue how far CALEA goes,
or the actual state of the EU law.  Again, I'm not asking my lawyer, I'm
asking my customer.
 
> 3) If I'm not an American, which congressperson should I talk 
> to about this?
Your EU representatives if you live in the EU.  Fill in the appropriate
title elsewhere.

> 
> 4) (Related to 4) If I'm not an American vendor or carrier, would I be
> civilly disobedient if I were to note that CALEA doesn't 
> apply to me in any
> case?
EU law, as our customers interpret it, is more onerous than CALEA.  Some
local European laws are even more onerous.
Actually, I believe that if this work is not done in the IETF, it is likely
to be done in some more international venue, with a more European attitude,
which means more "holes".  I rather like the limits of CALEA more than some
other things I have heard.

In the end, it's the laws of the country we sell to (or our customers
provide service into) that matters.  If we want to sell in China, we meet
Chinese law, or we don't sell.  You can ask my management to not sell in
some markets because they don't meet your standards for civil liberties.
Standards make a lot of sense - we aren't going to compete on how swift our
legal intercept implementation is.  It's a check-off item on every tender.  

Again, there are always limits to such discussions.  We aren't in such
limits IMHO.

---

From: "Richard Payne" <[email-masked]>
Date: Mon, 1 Nov 1999 20:21:51 -0500

> to meet the law as it existed.

which shows his heart is more or less in the right place (although I think
I'll be buying my crypto elsewhere), as well as

>intercept rules, US, Europe, and anywhere else we decide to sell equipment.

which you will note answers a different question than I asked, and does not

> or the actual state of the EU law.  Again, I'm not asking my lawyer, I'm

which once again does not actually provide any proof that these
often-referred-to laws actually apply.

Maybe I'm just too skeptical, but if:

i) I were against something, and

ii) had no actual legal advice telling me that it applied to my activities,

then I'm not sure the first thing I'd do is comply. It would seem more
reasonable to clarify the extent to which CALEA (which says, right in
Section 102, that it doesn't apply to information services) might _possibly_
apply.

This seems fairly important, since the only non-bogus argument I've seen so
far for the IETF to make tap-friendly protocols is that CALEA somehow
requires it. I don't actually believe this argument, since U.S. is different
from world, and since the IETF is free to ignore CALEA and let the switch
manufacturers work things out in their own private forum, but somebody
somewhere _might_ believe it.

Accordingly, does anybody out there actually have any hard information on
how CALEA applies to:

a) the Internet in general;

b) voice over IP using a general purpose computer going through an ISP; and

c) voice over IP using a special-purpose IP phone.

I think the answers follow from the definitions in Section 102, but I'm not
a lawyer.

Richard Payne

---

From: "Thomas Junker" <[email-masked]>
Date: Wed, 3 Nov 1999 00:59:12 -0600

On 2 Nov 99, at 16:11, chefren wrote:

> On 2 Nov 99, at 7:55, Matthew Saroff wrote:
> 
> > On Nov 2, 12:09am, Brett Wooldridge wrote:
> > > 1) What is stopping the IETF from ignoring government X's
> > >     regulations on wiretap, and coming up with a standard
> > >     this is tap-proof?
> > 	I am not a networking guru, but, as I understand it, some sort of basic
> > intercept capability is necessary for basic network maintaince.  The problem
> > (not considering issues of government snoops) is that designing in "wiretap"
> > capabilities makes the maintainance mechanisms less secure.
> 
> So you just demonstrate you have no idea of what it's all 
> about.

Boy, if *that* isn't a case of the pot calling the kettle black!

chefren, get a clue.  You are the one who is completely confused about the 
purpose of the list.  Read the docs.

Regards,

Thomas Junker
[email-masked]

The Unofficial Wang VS Information Center
http://www.phoenix.net/~tjunker/wang.html