Subject: [Raven] IETF Consensus? Not according to Fred Baker

From: Declan McCullagh <[email-masked]>
Date: Fri, 12 Nov 1999 15:06:50 -0500

This is forwarded mail that Josephine Riter sent to the cyberia list. She
indicates it came from Fred Baker. Two excerpts are interesting:

"I cannot say that the sense of the room is anywhere near the final answer,
although it is surely indicative of the direction we are likely to go."

"We are not against law enforcement per se, but may not be convinced of the
mandate to give law enforcement special support unneeded elsewhere."

-Declan

>Date:         Fri, 12 Nov 1999 13:37:19 -0500
>From: Josephine Riter <[email-masked]>
>Subject:      IETF Consensus?  Not according to Fred Baker
>
>According to Fred Baker, chair of the IETF . . .
>
>At 09:05 AM 11/12/99 -0500, David Noack wrote:
>>I see that a decision has been made in regards to a backdoor for IP
>>telephony. Was a formal vote taken on some kind of resolution or how was
>the
>>issue resolved?
>
>We had a discussion, Wednesday evening and on the [email-masked] list, on
>the general subject of privacy and legal intercept, on a global stage.
>CALEA was mentioned, of course, as an example of such a law authorizing
>legal intercept, but numerous laws exist in various countries with varying
>provisions; we tried to keep the discussion from focusing on any single
>specific law and deal with the general case.
>
>A number of viewpoints were expressed, varying from "I have to do it,
>whether for commercial or legal reasons, and will standardize it wherever I
>have to go to write the specification; I would rather do so here because
>the IETF is perhaps more likely to do it in a manner that limits the
>negative impacts to security" to "we will discuss the subject here over my
>dead body", with many stop-offs in between. A straw poll was taken (not a
>vote - we don't do that) on the question "do you believe that the IETF
>should standardize features explicitly and solely defined to enable legal
>intercept"; the sense of the room was that we should not, although there
>were many who felt that we should, or that the question was inappropriately
>simple. Since the IETF works on the basis of consensus (not unanimity,
>which would be difficult on a question of this type, nor on the principle
>of simple majority votes), I cannot say that the sense of the room is
>anywhere near the final answer, although it is surely indicative of the
>direction we are likely to go.
>
>It was also pointed out that there are a number of ways legal intercept can
>be performed using tools that are already needed for network management or
>service-related reasons. For example, one can argue that a wire-tapped
>telephone call is indiscernible from a conference call where one or more
>hearers are precluded from speaking, and perhaps are precluded from hearing
>all of the speakers. For "billing record" type of information, which under
>CALEA is available to law enforcement without a warrant, there exist
>standardized network management tools which will identify device pairs that
>are communicating and log the necessary information. We would certainly not
>try to remove conference calling as a feature, or network management's
>traffic analysis tools, because their results might be interesting to law
>enforcement. We are not against law enforcement per se, but may not be
>convinced of the mandate to give law enforcement special support unneeded
>elsewhere.
>
>The IETF is not, at this time, prepared to make a formal announcement. When
>we announce a policy, we will do so by publishing an RFC and making that
>RFC available to the press and others, as we did with
>http://www.isi.edu/in-notes/rfc1984.txt. Before we can do that, the IAB and
>IESG need to spend some time in discussion, reviewing the mailing list
>discussion, the floor discussion, and legal opinions as appropriate.
>
>>Can and will this issue resurface again, either regarding IP Telephony or
>>some other protocol were law enforcement operating either under CALEA or
>the
>>federal wiretapping law, can ask/pressure for a backdoor.
>
>I have no doubt it will come up again.
>
>__________________________________________________
>FREE Email for ALL! Sign up at http://www.mail.com
> 

_______________________________________________
raven mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/raven

---

From: William Allen Simpson <[email-masked]>
Date: Mon, 15 Nov 1999 09:30:23 -0500

Please note that there was a _second_ question, raised in response to my 
comments from the floor:

  Should the IETF standardize protocols to be resistant to wiretapping, 
  such as features for confidentiality and privacy protection?

It seemed to me that there was a positive 10 to 1 level of support for 
this result, notwithstanding some argument about the wording.

BTW: I checked on Baker's comment that South Africa required wiretapping 
for all Internet connections.  Alan Hannan from Internet Africa says 
that he's unaware of any such requirement. 

[email-masked]
    Key fingerprint =  17 40 5E 67 15 6F 31 26  DD 0D B9 9B 6A 15 2C 32

---

From: Fred Baker <[email-masked]>
Date: Mon, 15 Nov 1999 17:58:16 -0800

>that he's unaware of any such requirement. 

I spoke on the basis of information provided to me by the relevant Cisco
office. 

First off, that's not how I reported the regulation: I said that South
Africa was requiring that switching equipment support the ability to tap
Internet connections. 

It may also be that they were incorrect on the status of the regulation; I
am told that it is a regulation that is being developed, and which they are
lobbying against. I'm sorry if that confused anyone.

---

From: Alan Barrett <[email-masked]>
Date: Wed, 17 Nov 1999 15:19:59 +0200 (SAST)

On Mon, 15 Nov 1999, Fred Baker wrote:
> It may also be that they were incorrect on the status of the
> regulation; I am told that it is a regulation that is being
> developed, and which they are lobbying against. I'm sorry if
> that confused anyone.

Ah, that makes more sense now.  Yes, there was a proposal
last year about wiretapping in South Africa, but AFAIK
it's just a discussion paper or something similar.  See
http://cryptome.org/za-esnoop.htm

--apb (Alan Barrett)