Subject: Re: [Raven] chefren's position: a summary

From: "chefren" <[email-masked]>
Date: Mon, 1 Nov 1999 22:07:39 +0100

On 29 Oct 99, at 14:43, Richard Payne wrote:

> Well, it's been a full and frank exchange of views, and I believe I can now
> summarize the key points of chefren's position, with some interesting
> implications of each, as follows:
> 
> 1) Private possession of strong crypto should be illegal.

=NO= It should be regulated. For example not for use within 
a country with proper and responsible communication 
providers and between countries with such providers.

> This has obvious implications for the millions of copies of PGP out there,
> as well as a few hundred computer science texts, any browser with SSL
> capabilities, any computer language with bignum's built in, any computer
> language in which bignum's can be simulated (ask Dr. Turing!) and all decks
> of playing cards.

Yuck!

> Oh, I almost forgot: there might be a few RFC's that should be rewritten,
> since they might otherwise be advocating breaking the law.

No, didn't state that anywhere. I pointed out: Strong 
encryption should for example be used between communication 
providers.

> 2) All conversations should be conducted in clear, except by those who have
> something to hide.

Didn't say that either. Your enlarging ideas that aren't 
even important for the basic discussion here.
 
> Next time you want to send someone some trade secrets, or some information
> that might move a company's share price, be sure to send it on a postcard,
> so you can prove your innocence of (say) cocaine trafficking to the police.
> Echelon and economic espionage operatives send their thanks in advance.

It will help lower costs of law enforcement wouldn't it?

> 3) You must prove your innocence to police, rather than them proving your
> guilt.

Thats about dishonest. I just stated that with free 
encryption you will definitely get precisely that, 1+1=2. 
First signs are there. Reno stated already things in that 
direction.

> Pretty startling to those of us in common-law countries, but I guess you
> learn something every day...

Hm.

> 4) Strong crypto can be regulated, "just like murder".

About everything can be regulated. If laws are in place to 
regulate encryption they will work to some extend.

As a mather of fact: They are in place and they do work. 
128bit key's aren't exported.

> Not all moral equivalences are obvious, I guess ;-)
> 
> 
> Richard Payne

Please try writing without names into it, it will help you 
to get better letters.

+++chefren

= =
Verdien 100 Euro bij aanbrengen van een nieuwe
klant voor een website: http://www.ii.nl/premie

_______________________________________________
raven mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/raven

---

From: Paul Ferguson <[email-masked]>
Date: Mon, 01 Nov 1999 18:30:20 -0500

>providers and between countries with such providers.

Regulated? I'm sorry, but that genie is already out
of the bottle -- strong crypto is already in the hands of
the masses.

I personally believe that for anyone to suggest that folks
may only have private communications at the discretion of the
"government" is a most despicable viewpoint. Almost fascist,
in fact.

To usurp personal privacy in the name of "national security"
is indeed a belief that erodes personal privacy to the point
of no return. Have you ever read "1984"?

>It will help lower costs of law enforcement wouldn't it?

These sorts of statements fly in the face of individual liberties.

You know, if we placed _everyone_ under surveillance, we could watch to see
if they break the law. Would you agree to constant surveillance of your
home, bedroom, children?

This is a ridiculous discussion.

- paul

---

From: "chefren" <[email-masked]>
Date: Tue, 2 Nov 1999 01:15:31 +0100

> of the bottle -- strong crypto is already in the hands of

In the ages before cities appeared in Western Europe 
everyone had all kinds of weapons.

If people hadn't special rights they had to leave those 
weapons at the gate of the city.

Almost all laws declare things forbidden that were allowed 
before.

What's strange here exept your thinking about 
regulation/laws?

> "government" is a most despicable viewpoint. Almost fascist,

  I  D I D N ' T  S A Y  S O  ! ! !

I have stated again and again that communication providers 
may use, and perhaps should be demanded by law, strong 
encryption so the communication of their clients is well 
protected.

> of no return. Have you ever read "1984"?

No, the only book I ever read after childhood was from 
Machiavelli, Il Principe. With the famous quote about how 
difficult it is to introduce new things.

  "There is nothing more difficult to take in hand, more
  perilous to conduct, or more uncertain in its success,
  than to take the lead in the introduction of a new order
  of things. Because the innovator has for enemies all
  those who have done well under the old conditions, and
  lukewarm defenders in those who may do well under the
  new.  This coolness arises partly from the fear of the
  opponents, who have the laws on their side, and partly
  from the incredulity of men, who do not readily believe
  in new things until they have had long experience of
  them." 

  The Prince, Niccolò Machiavelli, 1469-1527 

And in the weekends I read The Economist:

  = = = = = = = = = = = = = = = = = = = = = = = = = = = =
  To take part in "a severe contest between intelligence,
  which presses forward, and an unworthy, timid ignorance
  obstructing our progress.   (The Economist, since 1843)
  = = = = = = = = = = = = = = = = = = = = = = = = = = = =

Shees, I knew I don't like people who believe and don't 
think for themselves. And yes all people here that keep 
thinking crypto has anything to do with this list after all 
explanations from various sides may take the Economist 
quote above specially pasted for them. 

> These sorts of statements fly in the face of individual liberties.

Basic part of capitalism. If our societey saves money on 
stupid forms of law enforcement we can do something more 
interesting with it.
 
> if they break the law. Would you agree to constant surveillance of your

I don't know. I just need only a few braincell's to figure 
you get that kind of razzia-society if communication is 
totally shielded from law enforcement.

> This is a ridiculous discussion.

It's ridiculous to come up here with encryption religion 
instead of requirements for an Internet tap.

+++chefren

p.s. Mail to "pseudorandom surfer" Richard Higson 
<[email-masked]>, bounces. I was interested to know 
how he linked ii.nl and idd. Just for fun. Again: I didn't 
wanted to withold anything, if I would I hadn't used my 
real name and standard mailbox. I see all "withold" remarks 
or worse as ad-hominem. I know of no rule here that demands 
use of real names and curriculum vitae.

---

From: "Derek J. Balling" <[email-masked]>
Date: Mon, 01 Nov 1999 16:21:20 -0800

At 06:30 PM 11/1/99 -0500, Paul Ferguson wrote:
To usurp personal privacy in the name of "national security"
>of no return. Have you ever read "1984"?

Speaking of which, there was supposedly an article written listing all the 
"invasions of personal privacy" mentioned or implied in 1984, and then 
comparing them with present day, showing a whopping 70-odd-percent of them 
were already true. Does anyone know where this can be obtained?

D

---

From: Paul Ferguson <[email-masked]>
Date: Mon, 01 Nov 1999 19:31:04 -0500

>stupid forms of law enforcement we can do something more

Spoken like a true usurper of individual liberties.

Capitalism is a form of market economy, and has no intrinsic bearing
on governmental principles. Don't confuse market economies with
government models.

The problem here is the definition of what consitutes "law enforcement"
and since we'll obviously never agree on that, we should just stick to
the question at hand.

And the answer to that question is, "No, the IETF need not take any
special steps to specifically accomodate CALEA".

Enough said.

My opinion,

- paul

ps. By the way, chefren, have you ever even attended an IETF meeting?

---

From: "Thomas Junker" <[email-masked]>
Date: Tue, 2 Nov 1999 00:51:08 -0600

>   I  D I D N ' T  S A Y  S O  ! ! !

You certainly did.  More than once you have clearly stated that you believe 
strong crypto should be "regulated" such that individuals cannot lawfully do 
end-to-end encryption, so that the government may tell the carrier providing 
the encryption to turn it off or provide cleartext.  That precisely fits 
Paul's characterization that you have advocated that "folks may only have 
private communication at the discretion of the government."  I, too, find that 
a despicable viewpoint, but namecalling will not enhance the discussion.  
Suffice it to say that viewpoints differ greatly.  More than a few Europeans 
have expressed views to me about the "excessive" freedoms we in the U.S. 
either have, believe in, or nominally have according to our much-abused 
Constitution.  Your viewpoints are very similar to those to which I refer, and 
yours as well as theirs shock me to the core.  I recognize, though, that we 
come from very different origins and we view the world and government very 
differently.  I don't know the answer to that.  It seems an unbridgeable chasm 
that prevents utterly any real communication, because the fundamental premises 
are so incompatibly different.  With all the wars and government betrayals 
that have befallen Europeans in recent centuries, it confounds me how so many 
can place so much faith in government (while hypocritically banking in 
Switzerland, no doubt), but that faith is a fact, as evidenced by your posts 
here.  So be it.

> Machiavelli, Il Principe. 

That is a remarkable admission, if it is not a sarcasm.  It speaks for itself.

> instead of requirements for an Internet tap.

You don't get it:  the question before the group is *not* requirements for an 
Internet tap.  The question before the group is the policy question of whether 
or not the IETF should even become involved in facilitating wiretapping in the 
protocols it formulates and promulgates.  "Requirements for an Internet tap" 
are not even on the table.

Regards,

Thomas Junker
[email-masked]

The Unofficial Wang VS Information Center
http://www.phoenix.net/~tjunker/wang.html

---

From: "Thomas Junker" <[email-masked]>
Date: Tue, 2 Nov 1999 01:51:21 -0600

> providers and between countries with such providers.

At least in the common law countries, people are free to do that which is not 
prohibited.  There is no basis in such countries for "regulation."  That which 
is to be "regulated" must therefore first be outlawed, or made illegal.  Then 
the exceptions to the proscription are what make up the body of the regulatory 
law.  Take driver licenses, for example.  It is no the case that someone once 
said, "We have to regulate drivers for the public safety," and that the 
legislature then passed a law regulating drivers.  There is no such basis for 
law in the U.S.  Instead, the driver licensing laws start with language along 
the lines of, 

    "It shall be a misdemeanor punishable by not more than a $100 fine or not
    more than six months imprisonment for any person to operate a motor
    vehicle on any public road or highway of this State unless such person is
    the holder of a valid license issued by the Department of Mortar
    Veeckles, etc. etc. etc." 

Virtually all the licensing laws I've seen begin with language that makes the 
activity to be controlled illegal.  The remainder of those laws deals with the 
conditions and penalties attached to the license, which are usually more 
onerous than the basic language up front that makes the activity unlawful.

This, of course, is fully in accordance with common law notions of "license," 
which essentially means permission from competent authority to do that which 
would otherwise constitute a crime.  It is unlawful for you to enter my house. 
Unless I give you "license" -- my permission to enter into and remain in my 
house.  Should I withdraw that permission, you must leave or be liable to 
prosecution for trespassing.

I understand that this notion is reversed in "civil law" countries -- the 
Western countries that do not inherit their legal systems from England, but 
rather more directly from Roman law.  In those countries it is more the case 
that people may do what they have been given permission to do, while 
everything else is unlawful.  Not surprisingly, that gives rise to wildly 
differing world views between people from common law countries and those from 
civil law countries.

Americans tend to view your widespread wiretapping and "proving people 
innocent" as fascist and evil, while you tend to view the principles we 
espouse as naively and excessively liberal and loose.  "You have too much 
freedom," I've been told by more than one European.  "You should know better 
than to say such a thing, given European history," I reply.

So, at least from the point of view of common law countries, I have to agree 
with Richard Payne in that talk of "regulation" is by definition talk of 
making things illegal.  Even in a quite different legal system, you can't 
"regulate" something without making something illegal.  In several instances 
in which people have taken you to task you have responded in a way that 
attempts to fudge the terms and allow you to make statements on both sides of 
the issue.

In the instant case you stated several times that strong crypto should be 
regulated, and available to carriers to protect traffic in transit, but not 
available to individuals to use for end-to-end encryption.  Payne termed that, 
"Private possession of strong crypto should be illegal."  You strongly 
objected, claiming only to want to "regulate" it, and seeming to lump carriers 
into "private possession" when it was pretty clear that Payne was referring to 
the same private individuals you already said should not be permitted to use 
strong encryption.  How can you limit strong encryption to carriers without 
making it illegal for others?  When Payne states your position, how can you 
then argue against it with games of what "regulate" means?

I find it annoying that you, who admittedly make your living by providing the 
means and technology for wiretapping, have managed to dominate this list with 
incessant calls for wiretap-friendly standards, especially when the question 
is simply whether or not the IETF should involve itself -- not when or where 
or how to implement such standards.

Regards,

Thomas Junker
[email-masked]

---

From: "chefren" <[email-masked]>
Date: Tue, 2 Nov 1999 13:17:32 +0100

On 2 Nov 99, at 0:51, Thomas Junker wrote:

> the encryption to turn it off or provide cleartext.

Yes I did say that.

> That precisely fits Paul's characterization that you
> have advocated that "folks may only have private
> communication at the discretion of the government." 

That's far far too simple! What you lifted out is: IF 
government has reasons that fit requirements specified by 
law it may give out a warrant for a tap. Information of the 
tap may appear nowhere because the tap or other evidence 
proved someone wasn't guilty. All tap-data and other 
information will be deleted and the tapped person will be 
informed. OR tapdata will appear in court and can ALSO be 
used by the tapped person to prove he isn't guilty.

..

> Suffice it to say that viewpoints differ greatly.

No thats not sufficient. They have about nothing to do with 
each other.

..

> Your viewpoints are very similar to those to which I
> refer, and yours as well as theirs shock me to the core. 

And we still have to live together peacefully as we have to 
live with criminal organizations...

> I recognize, though, that we 
> differently.  I don't know the answer to that.

Splitting up problems. You cannot be against an auditable 
tcpdump so you shouldn't stand in the way.

> It seems an unbridgeable chasm that prevents utterly any
> real communication, because the fundamental premises are
> so incompatibly different. 

Doesn't matter, fact is we have to come out if we want to 
live peaceful together. So if we really don't come out we 
use democracy, just stupid voting.

> With all the wars and government betrayals that have
> befallen Europeans in recent centuries, it confounds me
> how so many can place so much faith in government (while
> hypocritically banking in Switzerland, no doubt), but
> that faith is a fact, as evidenced by your posts here.

Thanks for the last part, concerning the first part: There 
have been major changes in our societies since world war 2. 
Probably the first generation that never has met a serious 
form of war in their own streets are raising grandchildren. 
The times are very peaceful and I definitely that's because 
our societies are more open and transparent.

> So be it. 

No. We have to go, live together peacefully with more 
interaction than ever, there are lot's of serious problems. 
Encryption isn't used as much as lot's of people seem to 
think here and it's not used in places where I think it 
should be used (between all communication providers against 
sleepnet fishing by other governments)

> That is a remarkable admission, if it is not a sarcasm.  It speaks for itself.

I admit: That part was sarcasm.

Both quotes not, they only stated how difficult it is to 
get new ideas picked up by majority. Your letter is a proof 
of the problem.

> Internet tap.

Oh strange, =I= didn't see that at the entrance...

> The question before the group is the policy question of
> whether or not the IETF should even become involved in
> facilitating wiretapping in the protocols it formulates
> and promulgates.

Maybe the word "wiretap" should be left out totally because 
it attracts people who start buzzing about encryption 
that's good for the world.

It should probably only be about auditable version of 
tcpdump.

(Talking about tapping of encryptionprotocols, thus making 
backdoors into them, is so stupid I cannot immagine IETF or 
IESG would start a discussion about it.)

> "Requirements for an Internet tap" are not even on the table.

Interesting. Maybe we should delete everything said now and 
start again.

+++chefren

= =

---

From: Matthew Saroff <[email-masked]>
Date: Tue, 02 Nov 1999 07:36:17 -0600

> "government" is a most despicable viewpoint. Almost fascist,
	I would take exception to the term "almost".  It's totally facist.

-- 
Matthew Saroff
Do not reply directly to this message.  Reply to
[email-masked]

---

From: Matthew Saroff <[email-masked]>
Date: Tue, 02 Nov 1999 07:40:33 -0600

On Nov 2,  1:15am, chefren wrote:
> Subject: Re: [Raven] chefren's position: a summary
> encryption so the communication of their clients is well
	What you have just said is that individuals have no right to strong
cncryption except through state approved providers.  Simply because a private
enterprise is providing tit infrastructure for extensive and pervasive snooping
in no way makes it any more desirable.  Fascism is a good characterization of
this opinion.

---

From: Bill Sommerfeld <[email-masked]>
Date: Tue, 02 Nov 1999 08:53:19 -0500

> 	I would take exception to the term "almost".  It's totally facist.

while we're picking nits, "totalitarian" would be a more accurate
characterization.  I wouldn't want to pretend that only extremists
from the far right wish to deny people the right to seek privacy..

					- Bill

---

From: "Thomas Junker" <[email-masked]>
Date: Wed, 3 Nov 1999 00:47:36 -0600

On 2 Nov 99, at 13:17, chefren wrote:

> law it may give out a warrant for a tap. 

Which is essentially the same as saying "at the discretion of the government." 

> Information of the 
> proved someone wasn't guilty. 

Only in your imagination and in extraordinarily ethical government 
administrations.  No standard and no wish of chefren can assure that your 
statement above will have any recognizable relationship to actual practice.  
You continue to confuse technical standards with the complex of laws and 
regulations that would be required to make your statement above come true in 
any given place and time.  Technical standards cannot and do not determine how 
governments behave.

> All tap-data and other 

Who says?  chefren?  Who made you King?  You are adding into your arguments 
large doses of presumption about how things would actually be implemented by 
governments neither you nor the IETF control.  I think the list members can 
readily testify that your narrow view of the world through what you see as the 
Netherlands rules is inapplicable in most of the rest of the world.  When you 
say "may appear nowhere," where is the law that says that in the U.S., the 
U.K, Spain, South Korea, Japan, Cuba, Argentina, North Korea, etc. etc.???  
When you say, "All tap-data...will be deleted and the tapped person will be 
informed," where are the laws that say that in all the countries of the world? 
Do you have even the slightest clue what goes on in the world outside a 20-
mile radius of where you live?  What you say in the two excerpts above is 
laughably naive and false with respect to the U.S., for instance.

> Thanks for the last part, 

You take offense at that?  Where do you think the majority of customers of 
Swiss banks come from?  Tierra del Fuego?  A substantial segment of Swiss 
banking business has traditionally come from the other, less stable European 
countries where people trust Swiss banks a lot more than they trust their own 
governments.  Do you doubt that?  I simply find it remarkable that those same 
populations who don't trust their own governments and patronize Swiss banks 
also seem to vote authoriarians into office and tell Americans that "you have 
too much freedom."  Not a big issue, but clearly an inconsistency, not 
something to take offense at.

> concerning the first part: There 

That's why we have history books and teachers, so we won't have to repeat the 
errors of the past ad infinitum.  If you and your countrymen can so easily and 
quickly forget the Hell that reigned in the occupied countries in WWII, then 
you are undoubtedly destined to experience it again.  That's the way ignorance 
of history works, whether the ignorance is intentional or not.

> get new ideas picked up by majority. Your letter is a proof 

I think you have things reversed.  Eavesdropping is not exactly new, and 
institutionalizing it in the form of wiretapping "appliances" is not by any 
stretch of the imagination a groundbreaking idea.  What is new is that the 
means are at hand to have substantial protections of our communications, and 
you are resisting that with all your being, seeing it as the end of the world.

> Oh strange, =I= didn't see that at the entrance...

Then you weren't paying attention.  The purpose of this list is not a mystery.

The list page with a link to the message archive is:

The first message, posted by the IESG and stating the purpose of the Raven 
list may be found at:

    http://www.ietf.org/mail-archive/working-
groups/raven/current/msg00000.html

> It should probably only be about auditable version of 

Then why don't you go off and start your own Internet Tapping Steering Group 
and your own Internet Tapping Engineering Task Force?  The *real* IESG asked 
the *real* IETF to discuss this (quoted from msg0000 above):

  "The key questions are:

  "'should the IETF develop new protocols or modify existing protocols 
  to support mechanisms whose primary purpose is to support wiretapping 
  or other law enforcement activities'

  "and 

  "'what should the IETF's position be on informational documents that 
  explain how to perform message or data-stream interception without 
  protocol modifications'".

Do you get it yet?  There is *no* project underway under IETF auspices to 
develop tappable protocols with or without audit features.  There is *only* 
the question, "Should the IETF get involved in that stuff?"

> IESG would start a discussion about it.)

They didn't.  You did.

> Interesting. Maybe we should delete everything said now and 

It would be very nice if *you* could delete *your* 77 mostly off-topic posts 
and start by paying attention to what the topic here is.  Unfortunately, all 
the participants and all the observers are stuck with your one-man campaign to 
shift the discussion from the topic to something that is *not* the topic.  
Sadly, you have hopelessly confused some other latecomers who also failed to 
pay attention to the topic and to the clear guidance in msg0000 and who took 
your huge volume of mail to be some kind of indication of what the topic was 
supposed to be here.

Since nothing anyone says about your off-topic posts seens to have any effect 
on you, and since the on-topic opinions seem to have been pretty well 
expressed, there appears to be no solution other than to call for the list to 
be closed.  I so call.  Any seconds?  How does this work?

Regards,

Thomas Junker
[email-masked]

---

From: "Aaron Armitage" <[email-masked]>
Date: Wed, 03 Nov 1999 16:46:06 GMT

I see this debate as a part of the wider question of privacy. A police state 
is indeed one in which things are easy for the police. I do not think we 
should debate whether to have this, and certainly not how, but how to make 
all forms of government snooping more difficult. Aside from fascists like 
Chefron, I think we could all agree that this is a desirable goal. My humble 
suggestions:

1)The IETF should make wiretapping IP harder, not easier.
2)End wiretapping. The IETF can't do the lobbying for this, but we as 
private citizens can.
3)Stop local police from setting up cameras by the side of the road.
4)Avoid any kind of national database of people.

Any other ideas?

______________________________________________________
Get Your Private, Free Email at http://www.hotmail.com

---

From: "chefren" <[email-masked]>
Date: Wed, 3 Nov 1999 18:42:45 +0100

> discretion of the government." 

In what way? In The Netherlands they have to notify:

A) The communication provider, with a warant, the 
communication provider may not even tap if the warrant 
isn't OK. The communication provider has to send 
authentication/encryption key's to the tapping room. There 
is of course an independent administration of all this at 
the communication provider.

B) The tapping room, receives the authentication/encryption 
keys from the telecom provider, records the taps in an 
unalterable way. Everything administrated here too.

C) Tapped person, receives a written statement within a 
certain time after the tap has ended.

That has nothing to do with "at the discretion of the 
government". There are enough checks and balances here.

> administrations.

AND the administration of communication providers. You also 
seem to forget that you just say "government" where 
actually 2 of the three powers of Montesqieu are active. If 
it comes in court the third wil check everything.

> tandard and no wish of chefren can assure that your 

Up to 5 different parties are involved if everything is 
even a little administrated everyting can be checked good 
enough.

> any given place and time.  Technical standards cannot and do not determine how 

IETF cannot demand governments to make their standards 
laws. However IETF do can give a standard that describes an 
auditable tap and should be preferred for law enforcemnt 
above dumptcp by every country that respects privacy.
 
> governments neither you nor the IETF control.

They ARE implemented in that way in The Netherlands. And it 
works fine no illegal taps here anymore. A few years ago 
tapping room assistants had good relations with telecom 
providers and by just asking for taps they got them without 
warrants. The strikt distributed authentication-key has 
cracked that illness of the system totally.

> I think the list members can 
> Netherlands rules is inapplicable in most of the rest of the world.

I think that if they understand how it works here they 
would love to have that system at home.

You seem to forget: Tapping will always happen, I don't 
know of any government that doesn't tap. This is probably 
the most civil way to do it.

> When you 

Laywers there will say in court "Hey why did you use 
tcpdump instead of Chefren's checked IETF system and how 
can I know you didn't tamper with the data?

> informed," where are the laws that say that in all the countries of the world?

Will appear, just because those laws are reasonable.

  The Netherlands are often years ahead of the pack. Since
  the discussions here I think we had a more trustful
  society than US now around 1500 (see the paintings from
  those day's and don't think there wasn't any "power"
  here, the Dutch ruled the world for nearly 200
  years...). 

> mile radius of where you live?

I'm quite sure there are lots of people who trust their own 
gun's and encryption more than society...

> What you say in the two excerpts above is laughably
> naive and false with respect to the U.S., for instance. 

  I think you will have a very big problem to prove I'm
  naieve. You can declare, scream and place lots of at
  hominem attacks here but you cannot even prove at all
  that your knowledge of tapping comes close to mine. Or
  that I don't know much of the underlying technical
  problems. Did you had a look at the
  http://www.ii.nl/idd/pp-00.html link? 5 weeks only from
  idea to working hardware. For more fun:
  http://www.ii.nl/idd/sophie.html Unix computer, no
  networking in those day's for us... 

(Exuses about what I posted about the original poster of 
the first link, he did respond it was a technicality that 
made me think he had a false name/address.)

> governments.  Do you doubt that?

No and I think we have to work about it. It's not fair 
people avoid paying taxes by using Luxembourg or Swiss 
banks.

> I simply find it remarkable that those same 

Where dit I(? tell American's have too much freedom? I do 
have said =I think= unregulated encryption isn't reasonable 
concerning law enforcement and will disappear on the long 
run. Just a prediction that's not attacked here with much 
knowledge other than "I only trust my own gun/encryption". 
If you talk about naive: That's naive to me.

> you are undoubtedly destined to experience it again.

That's believe, your believe.

> That's the way ignorance of history works, whether the
> ignorance is intentional or not. 

  Again, believe. You can use history to predict the
  future but you still don't know what will happen. Lot's
  of things that happened in history just happened because
  communication was a big problem compared to the way we
  communicate now. Did you see the russians on television
  on TV last day's? Without our modern communication
  systems and openness they would definitely be busy with
  raping and murdering of the local people. 

> I think you have things reversed.  Eavesdropping is not exactly new,

Auditable eavesdropping seems to be quite new...

> and 

No, nowhere did you see I'm against use of strong 
encryption. I do am for regulated strong encryption but 
that's totally a sidestep concerning auditable tapping.

> groups/raven/current/msg00000.html

Thanks, I couldn't find it.

..

>   or other law enforcement activities'

Answer: No modification of existing protocols, one new 
protocol for auditable tapping. To be used on one side 
under total control of the communication provider and on 
the other side by the tapping room, under control of law 
enforcement.

Simple eh?
 
> the question, "Should the IETF get involved in that stuff?"

I think yes and I have given the one and single argument 
for it: The citizens in this world need auditable taps in 
order to have maximum privacy.

+++chefren

= =

---

From: "Brett Wooldridge" <[email-masked]>
Date: Wed, 3 Nov 1999 15:43:21 -0600

[merging two replies into one for expediency]

> > In short, let the genie out of the bottle, quickly, before the bottle is
> > welded shut.  I give us six-months.
>
> So you more or less know your own democratically chosen 
> government will be against it and you try to get "things 
> fixed" before they can stop you.
>
> I'm quite sure I'm not a facist and I'm quite sure you are 
> a terrorist...

A terrorist?!  LOL!

> > I am at a loss as to how to unseat your blind trust of governments.
>
> I don't trust governments, I trust democracy.

Ah.  Well, while I agree with you it's the probably the best thing going,
it still, as least in America, reflects the will of the people poorly.  Here
over 90% of the people are for campaign finance reform, yet the 
politicians (yes we elected them) consistently shoot down any reforms.
Any challenger to an existing politician accepts moneys through the
same system -- ensuring it's continueance, no matter how corrupt.

I won't go into the myriad of examples I can give of my country or others,
where elected politicians consistently thwart the will of the people.  This
is not history class.  Suffice it to say that if 90% of the people want X, but
the military-industial complex does not, there will be no X.  It's a failing of
our democracy.  It sucks.  But it's reality.  And more shocking is that this
occurs in a First World country -- I can only imagine how things work in
Iran, Columbia, or China.

So, basically, no matter how rosey things are in NL, put yourself if our
shoes, or those of people living under repressive regimes.

> > Since 1989 there have been in excess of 6000 such
> > requests with not a single one denied.  
>
> In The Netherlands there were about 4000 taps in that year, 
> all administered.

What?!  I said SINCE 1989 there have been 6000, not IN 1989.
That's 6000 over the course of ten years in a country of 250
million people.  You had 4000 taps in 1989, in a country of,
what, 5 million?!  My God, man!  I thought we were turning into
a police state!  Sheesh.

Brett Wooldridge

---

From: "chefren" <[email-masked]>
Date: Thu, 4 Nov 1999 00:22:48 +0100

> what, 5 million?!  My God, man!  I thought we were turning into

Excuse, misread the year: In 1998 there were about 4000 
taps in the Netherlands (little less if I remember well).

There are about 5.000.000 telephone lines and tap-warrants 
need to be refreshed each few weeks.

And there is no reason to believe there were more taps for 
law-enforcement. Just because everything was registered.

It's about 1/1000 lines and that for a few weeks and as I 
stated only for heavy criminal cases.

I can give more examples: If a murder has taken place and 
there are no clues all friends of the killed person are 
tapped immediately. Often only for a day or two.

And yes, everything registered and little chance of any 
illegal tap because of the checks and balances. All digital 
taps, GSM and ISDN are with authentication and secured 
lines. Not very strong, DES authentication and ISDN 
hardware routing. However quite difficult to make an 
illegal tap or to tap the tap-lines.

In the next phase of phone-tapping I will propose to end 
using DES and start using the to be selected AES standard. 
We are studying Rijndael, realy looks good.

A few weeks ago my proposal to make all software interfaces 
open-source among all involved parties was taken.

I really cannot think of a better way to tap from both 
technical and legal side. Of course the taplines could have 
stronger authentication and encryption but believe me I 
will push on those fronts. The design is far far better 
than what's happening in the US and other countries.

+++chefren

= =

---

From: Matthew Saroff <[email-masked]>
Date: Wed, 03 Nov 1999 17:37:54 -0600

> tapped immediately. Often only for a day or two.
	Without probable cause?  In the US, one has to show some sort of reason
other than "he knew the guy".  I cetrainly hope that you are in error.

---

From: "Brett Wooldridge" <[email-masked]>
Date: Wed, 3 Nov 1999 17:59:56 -0600

----- Original Message ----- 
From: chefren <[email-masked]>
To: <[email-masked]>; Brett Wooldridge <[email-masked]>
Sent: Wednesday, November 03, 1999 5:22 PM
Subject: Re: [Raven] minority position: a summary

> taps in the Netherlands (little less if I remember well).

Still, we're talking about a per-capita tap frequency in your country
500 times more frequent than the United States!

> tapped immediately. Often only for a day or two.

I find this extremely Draconian.  The friends of a murdered person
have their privacy invaded merely for having an association with
the victim?  Why stop there, what about relatives, neighbors, and
co-workers?  Wait, don't tell me, I know the answer.

> illegal tap because of the checks and balances.

I would argue that those are all immoral taps.  Legality is an issue
of law.  It was legal in this country once to deny blacks and women
the ability to vote.  Legal and right are two different issues.  But I
would imagine the distinction is lost on you.

> technical and legal side.

How about fighting to make taps illegal?  I'll send you $100 if you
start Netherlanders For A Tap-Free Society -- I'll even let you pick
a more clever name whose initials spell some poignant word in Dutch.

Brett Wooldridge

---

From: "chefren" <[email-masked]>
Date: Thu, 4 Nov 1999 01:33:38 +0100

> other than "he knew the guy".  I cetrainly hope that you are in error.

I'm not.

And I don't see a problem either.

The law enforcers who have listened to the private 
conversations have to keep their mouth shut by law, have no 
personal interests and the tapes and reports will be 
deleted thoroughly as required by law too.

It seems my country has decided murder is something so 
wrong that breaching privacy a little by wiretapping 
persons involved with the murdered is of minor importance.

And why should it be? Don't you want to see killers in 
prison?

And again: How much privacy is broken here?

+++chefren

p.s. If police asks and gets your driving license they 
probably know your age, is that breach of privacy? I 
wouldn't think so. If they would put your name and age on 
the frontpaper of a magazine it would be breach of privacy 
but they may not do so, (I hope...).
= =
Verdien 100 Euro bij aanbrengen van een nieuwe
klant voor een website: http://www.ii.nl/premie

---

From: "chefren" <[email-masked]>
Date: Thu, 4 Nov 1999 01:33:38 +0100

I'm not.

+++chefren

---

From: "chefren" <[email-masked]>
Date: Thu, 4 Nov 1999 01:52:39 +0100

On 3 Nov 99, at 17:59, Brett Wooldridge wrote:

..

> 500 times more frequent than the United States!

((((HAHA!!! We don't have anything comparable to your NSA 
here!))))  

Probably even more, there are 16.000.000 people here and I 
thought about 360.000.000 in the US?

Is there any good administration about it?
 
> co-workers?  Wait, don't tell me, I know the answer.

And?

It's just to find the killer and nothing else. It realy 
helps because lots of murders are done by people 
surrounding the killed and early taps in unclear cases 
quite easilly reveal who is suspect and who isn't.

> I would argue that those are all immoral taps.

What's a moral tap?

A tap is just a technical means to gather evidence. It 
would be immoral if reports and tapes were send to 
newspapers. =Never= heard of that here!

> Legality is an issue of law.  It was legal in this
> country once to deny blacks and women the ability to
> vote.  Legal and right are two different issues.  But I

Since the discussions here I have started to figure out how 
far your country is behind ours. In many ways it's at least 
tens or years.

> How about fighting to make taps illegal?

I don't know of any political party that is against.

> I'll send you $100 if you start Netherlanders For A
> Tap-Free Society -- I'll even let you pick a more clever
> name whose initials spell some poignant word in Dutch. 

Why do you want to send money to change a situation that 
you appear to know very little about?

Please don't forget that the law that requires all 
communication providers to provide taps if proper warants 
are delivered to them was democratically chosen by ALL 
parties last december.

My country definitely want it this way and the law was 
according to a pan-european directive.

  Please forgive me but on one side your money makes me
  think about the way IRA finances their murder campaigns
  and on the other side about the way some people try to
  spread their belief. 

+++chefren
 
= =

---

From: Ed Stone <[email-masked]>
Date: Wed, 03 Nov 1999 19:48:16 -0500

>And why should it be? Don't you want to see killers in

<satire>
Sure. Couldn't we more easily find out who the killer is by just a little 
torture? Not too many people, just those involved with the person who was 
murdered. Widow, kids, friends, co-workers, etc... Breaching a little 
comfort for a few hours, if it helps us catch the killer, would be 
reasonable, right? And not for a long period of time. They'd all be out in 
time for the funeral. Just enough torture to get a confession from the 
murderer. Care would be taken only to inflict pain, not do any permanent 
physical harm. You DO want to see the killer in prison, don't you?
</satire>

The set of beliefs you have been expressing seems best described as 
collectivism. Possibly you are simply having some fun and you are not serious.

--
--------------------------
Ed Stone
[email-masked]
--------------------------

---

From: "Brett Wooldridge" <[email-masked]>
Date: Wed, 3 Nov 1999 19:22:44 -0600

> And why should it be? Don't you want to see killers in 

Funny, other countries don't do this and still manage to catch
better than 90% of murders.

> And again: How much privacy is broken here?

Sounds to me like a of dozen or more people had their
personal conversations for several days listened to.  Your
logic seems to be that of "if you don't have anything to hide,
why worry?"  That, to me is frightening.  Ever read any
George Orwell?

> probably know your age, is that breach of privacy?

Yes.  They can't ask for it, at least here, without reason to
believe (meaning some indication by action or evidence)
that you have commited a crime.  Knowing someone who
commited a crime, or was the victim of a crime is
insufficient.  For example, if I am pulled over for speeding,
they certainly have the right to ask for my ID, but they have
no cause to ask for the ID of my passenger, for they have
done nothing to provoke such a request.  Similarly, just
because my friend gets killed, they have no reason to tap
my phone, unless there is some indication that I was
involved (Iike being seen in the area).

Brett Wooldridge

---

From: William Allen Simpson <[email-masked]>
Date: Wed, 03 Nov 1999 23:55:21 -0500

> the communication provider.
I'm an ISP -- how do I tell that the warrant is OK?

You don't need to answer.  So far in my life, I've seen 3 warrants and 
subpoenas, and every single one of them has been flawed.  I've had to 
spend far too much in attorney's fees quashing them.

> unalterable way. Everything administrated here too.
I have no experience with this, so it's hard to say it will work.

> certain time after the tap has ended.
Speaking as a previously tapped person, when am I going to get my 
notification?  Maybe the tapping hasn't ended?

Heck, when am I going to get my FOIA results from the FBI, that they are 
required by law to give me within 20 days?  (I've been waiting for years, 
they send me another notice for additional time every 6 months or so.)

> government". There are enough checks and balances here.
Well, they don't work here....

> cracked that illness of the system totally.
Amazing admission!

> Brett Wooldridge wrote:
>...
Remember, that 4000 taps were just the administered taps, but "[a] few 
years ago ... they got them without warrants."  

I visited the Netherlands in 1993, for the first European IETF meeting, 
and later that same year was hit with an FBI investigation and 7 year 
IRS audit.  I'd never thought about that coincidence!

[email-masked]
    Key fingerprint =  17 40 5E 67 15 6F 31 26  DD 0D B9 9B 6A 15 2C 32

---

From: Paul Ferguson <[email-masked]>
Date: Thu, 04 Nov 1999 07:35:18 -0500

>And why should it be? Don't you want to see killers in

This line of reasoning is so offensive, I can only assume
that it is flame-bait.

- paul

---

From: "Ge' Weijers" <[email-masked]>
Date: Thu, 4 Nov 1999 08:06:07 -0700

> what, 5 million?!  My God, man!  I thought we were turning into

It's 6000 because there's a bad problem with underreporting of
wiretaps. LA county judges wrote _one_ warrant to tap a whole cellular
provider's network. Something clearly illegal, by the way.

Ge'

-- 
-
Ge' Weijers                                Voice: (614)326 4600
Progressive Systems, Inc.                    FAX: (614)326 4601
2000 West Henderson Rd. Suite 400, Columbus OH 43220

---

From: "chefren" <[email-masked]>
Date: Thu, 4 Nov 1999 22:14:44 +0100

> better than 90% of murders.

I think you are very bad informed.

+++chefren

= =

---

From: "chefren" <[email-masked]>
Date: Thu, 4 Nov 1999 23:59:54 +0100

> spend far too much in attorney's fees quashing them.

Ugly costs of living in a society. I do think most law 
enforcement agencies know about nothing about Internet and 
I can believe they were 3 times in error. Couldn't you ask 
for money after the first time?

> I have no experience with this, so it's hard to say it will work.

It works in the Netherlands quite some time now for 5 
telecom providers and 40 different tapping rooms.

> notification?  Maybe the tapping hasn't ended?

About 3 weeks after the tap has ended if the prosecutor 
stops the investigation. The tap will also end the moment 
he has decided the case will become before the judge, then 
you know about instantly since all evidence against you is 
in the dossiers.

> they send me another notice for additional time every 6 months or so.)

? During the tap you will never know. The communication 
provider may not tell you as clearly stated in the law.

> Well, they don't work here....

Because there is no standard for auditable taps?

+++chefren

= =

---

From: "chefren" <[email-masked]>
Date: Fri, 5 Nov 1999 00:02:56 +0100

> This line of reasoning is so offensive, I can only assume

Not intended, please accept my excuses,

+++chefren

= =

---

From: Martin Minow <[email-masked]>
Date: Fri, 05 Nov 1999 16:32:39 -0800

At 4:46 PM +0000 11/3/99, Aaron Armitage wrote:
>I see this debate as a part of the wider question of privacy. ... My 
>humble suggestions ...
>
>Any other ideas?

My humble suggestion would be to avoid calling people whom you disagree
with "fascists."

Chefren lives in a country with quite recent experience of having
a fascist government imposed on it. Their response has been to
subject wiretapping to strict safeguards -- with stronger protection
for the rights of private citizens than appears to be the case in such
"non-fascist" countries as the United States.

It is not obvious to me whether ICANN can, or should, design a
wiretapping standard.  However, it it does, it would do well to
examine the Netherland's experience carefully to see how individual
rights can be preserved.

Remember, the real fascists will always have tcpdump.

Martin Minow
[email-masked]

---

From: Mark Atwood <[email-masked]>
Date: 05 Nov 1999 16:48:06 -0800

Martin Minow <[email-masked]> writes:
> wiretapping standard.

ITYM "IETF"

-- 
Mark Atwood               | 
[email-masked]             | 
http://www.pobox.com/~mra |

---

From: "Brett Wooldridge" <[email-masked]>
Date: Fri, 5 Nov 1999 21:01:19 -0600

Thanks for the enlightening email, Mr. Schryver.  I'd pegged you as a
nice guy.  Quite an insight into the inner workings of the IAB/IESG.  But
in the future, try not to tell people they're just sheep herded into a group
to bleat out a foregone conclusion, whose sole purpose is to provide a
public mandate for the "smarter political animals" of the IESG.

As they say, "That's gonna leave a mark."

Everyone can go home, as I am.  Apparently, this whole mailing list
was setup for the purposes of providing political justifications for
positions already decided by IETF.  I'm told that the "smarter political
animals" never would have set this group up if it were believed it
would reach conclusions other than those it had, so wisely, already
arrived at.

Fortunately for me, in this case, our views coincided.  But that's not
the point.  Betting on the users of the Internet to support a privacy
stance has good odds.  I just feel stupid now, for not seeing the
"rigged poll" for what it was -- plain as the nose on my face, if I had
looked.

Shame on me, and apparently shame of all of us for not seeing the
IETF as the political animal it is.  Been too long since I read any
Chomsky, I'm slipping.

This is my last post, thanks to all those who sent nice email.

Brett Wooldridge

P.S.  Vernon, it's funny, but I actually thought there was an problem with
    the mail delivery, because I've been having problems, so when my mail
    to you bounced, I sent from another account.  I had no idea you had
    blocked my email.  If I had known, I certainly wouldn't have "worked
    around it."  Sorry for the undue email.

---

From: Matthew Saroff <[email-masked]>
Date: Mon, 08 Nov 1999 08:44:53 -0600

> "non-fascist" countries as the United States.
	I would actually disagree with the sociology of the situation.  This
was not a case of Facists taking power, as they did in Germany, Italy, and
Spain, but a case of invasion, where police powers have no effect.
	That being said, I believe that Chenfren's positions come from two
factors:
*	The Netherlands is a very homogenious society, and as such tends to
have a much less negative view of those who break societal norms (the "There
but for the grace of God go I" thing).  Because they don't tend to view (for
example) drug abusers as "bad people" (see the US for a counter ecample), the
law enforcement establishment does not tend to see the entire population as law
breakers who haven't been caught yet.  This attitude makes for more trust by
the average person in the fairness of the law enforcement apparatus.
*	His business is manufacturing tapping equipment.  This affects one's
outlook about law enforcement.  You can see a simmilar effect with business in
China, who see "real improvement", or Microsoft, where it's "the rough and
tumble of competition".  The profit motive almost universally effects the world
view of the people doing business.

---

From: "chefren" <[email-masked]>
Date: Mon, 8 Nov 1999 23:40:17 +0100

On 8 Nov 99, at 8:44, Matthew Saroff wrote:

There are more Energizer Bunnies here...

> That being said, I believe that Chefren's positions
> come from two factors: 

> *	The Netherlands is a very homogenious society,

Ah you think so? In big cities nearly 50% of all people are 
born outside of The Netherlands or born from people who 
where born outside The Netherlands. For hundreds(!) of 
years The Netherlands has given shelter to people with 
idea's that weren't wanted in other parts of Europe. New 
people sometime have big problems with the openness here, 
especially with social things but they get something for 
it, they may say whatever they want too, their kids can go 
to the schools they need. (Vernon Schryver's type of 
intolerant "I know best and just try to order you and if 
you don't listen I block your mail before you can say 
sorry!" behaviour is pretty strange over here...)

> and as such tends to have a much less negative view of
> those who break societal norms (the "There but for the
> grace of God go I" thing).

Sigh...

> Because they don't tend to view (for example) drug
> abusers as "bad people" (see the US for a counter
> ecample), the law enforcement establishment does not tend
> to see the entire population as law breakers who haven't
> been caught yet.  This attitude makes for more trust by

We have made government ourselves and change all levels of 
it every 4 years, by democratic means. The government we 
have is what we have chosen. I do believe that isn't very 
well organized in the US. The more or less dual party 
system with two parties that let marketing people think for 
them instead of people with ideas...

> *	His business is manufacturing tapping equipment.  This
> affects one's outlook about law enforcement.  You can see
> a simmilar effect with business in China, who see "real
> improvement", or Microsoft, where it's "the rough and
> tumble of competition".  The profit motive almost
> universally effects the world view of the people doing
> business. 

Ah YUCK. And now I insist: You tell the list everything 
about yourself and let me personally "use" it "against you" 
(I will flag the messages with "PF" (Personal Flame) in the 
subject line.)

You totally misuse information about your "adversary" in a 
place where no adversaries should exist and only arguments 
should be exchanged and everyone should think for himself!

Be happy with different input!

+++chefren

=Large signature follows=

I think we need a simple architecture for a point
to point tap interface that has strong provisions
against misuse.

On one side the communication provider who only
starts tapping a specific customer or IP number
with proper warrants.

On the other side the approved tapping room.
Everything should be organized by the central
"tapping office". This office should provide
keys for strong encryption to both communication
provider and tapping room.

Law and technology should both provide as
much checks and balances as we can come up
with. Law can provide good procedures,
technology can provide technical means to
check them or force them.    

=Large signature ended, please comment me
off-line to make it better=

---

From: Fred Baker <[email-masked]>
Date: Fri, 12 Nov 1999 23:19:14 -0800

I love it when private mail is forwarded without permission to volatile
lists. It makes me feel like my privacy is so well respected, in this case
by some who make such long and pious statements about respecting and
preserving privacy at all costs. It just so improves my day.

That email originated with me, and it reflects my understanding and opinion
of the result Wednesday night. There were a lot of people, more than half
the people present, who said we should not explicitly support wire-tap
features, but there was a large crowd who felt otherwise or felt that the
discussion and question were in one way or another malformed, and "well
more than half" is not a consensus. To declare in a headline that the IETF
took a vote and *unanimously* decided to not do this is inaccurate
reporting - it doesn't even take into account the IETF's tradition of
extension by email lists. Even to report a consensus doesn't take into
account the IETF's traditions concerning consensus.

This isn't over. I wish it was, oh do I wish it was, but it is definitely
not over. 
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Fred Baker	| 519 Lado Drive
IETF Chair	| Santa Barbara California 93111
www.ietf.org	| Desk:   +1-408-526-4257
		| Mobile: +1-805-886-3873
		| FAX:	  +1-413-473-2403

---

From: John Young <[email-masked]>
Date: Sat, 13 Nov 1999 08:05:03 -0500

Fred,

I appreciate your being pissed at private mail exposure, as well as
your follow-up message. The raven list has been a fine service of IETF
for those of us who benefit from the group's work but don't know much
about its inner workings.

It would be exemplary for IETF to keep the wiretap debate as public as
possible, especially as the dispute gets more intense, which appears to
be in the offing according to your messages.

You know that there's been a long-standing effort to make the cellular
standards deliberations more public in order to air disputes on weak
encryption in the US and abroad. And that is still being debated behind
closed doors at the cost of  public credibility of those standards groups.

Public debate puts a lot of heat on those who seek agreement, whether in
Congress or in private organizations. The few persons who can show
courageous leadership in open discourse, and resist temptation and
pressure to arrange covert deals, well, those are the kind of individuals
we all dream of, and are promised repeatedly, but too seldom find in 
the right place at the right time doing the right thing.

Ever think of running for national office? We're told that requires training
in talking to watermelons with intense focus out two sides of the mouth,
hand out at the back for special support.

---

From: Ed Stone <[email-masked]>
Date: Sat, 13 Nov 1999 08:41:52 -0500

>This isn't over. I wish it was, oh do I wish it was, but it is definitely

So when does the usual closed-door, dark-of-night, unscheduled, 
industry-led, tax-code-incentivized, FBI-scare-tactics, 
congressional-debateless arm twisting begin?
   ;-)

---

From: Ian Jackson <[email-masked]>
Date: Mon, 15 Nov 1999 13:46:45 +0000 (GMT)

> preserving privacy at all costs. It just so improves my day.

I think you would have had a point if your message really was a
personal email.  But, I don't think it was.  Consider this paragraph
from your message:

> The IETF is not, at this time, prepared to make a formal announcement. When
> we announce a policy, we will do so by publishing an RFC and making that
> RFC available to the press and others, as we did with
> http://www.isi.edu/in-notes/rfc1984.txt. Before we can do that, the IAB and
> IESG need to spend some time in discussion, reviewing the mailing list
> discussion, the floor discussion, and legal opinions as appropriate.

This looks very much like an informal position statement on behalf of
the IETF.  Of course we here on Raven know that it couldn't possibly
be (right?), but it's clear that the niceties of IETF processes are
not necessarily obvious to everyone.

So I assert that Fred was claiming some authority from the IETF to
write that message, which makes it not a personal email, but rather a
corporate one.

The transactions of supposedly-open organisations very rarely need
privacy, unlike those of individuals.

Ian.

---

From: "chefren" <[email-masked]>
Date: Mon, 15 Nov 1999 18:26:50 +0100

> congressional-debateless arm twisting begin?

Concerning tapping it will stop after the simple proposed 
standard is implemented ("auditable tcpdump with open-
source and design but in practice sealed tapbox").

This auditable tap standard doesn't require a change in 
basic principles, attitudes and even choices of all 
involved parties. That's to say I have never seen a "Green 
Peace" like party arguing against tcpdump, although nobody 
with some technical knowledge can argue tcpdump based taps 
should have any chance in courts.

The =next= discussion will undoubtly be if encryption 
should be regulated or not but that has nothing to do with 
tapping as such.

+++chefren

=Signature follows=

Everything should be organized by a central
"tapping office". This office should provide
keys for strong encryption to both communication
provider and tapping room.

=Large signature ended. If you want to
help to setup a standard for the above
design, please contact me.=

---

From: Matthew Saroff <[email-masked]>
Date: Mon, 15 Nov 1999 11:53:56 -0600

> source and design but in practice sealed tapbox").
Hi,
	Can someone please offer a simple (not-for-gurus) summation on what the
"wiretap friendly" proposal was?
	I get the impression that it was not the product that it was not the
product that chenfren seems intent on selling.

---

From: Martin Minow <[email-masked]>
Date: Mon, 15 Nov 1999 11:45:22 -0800

> "wiretap friendly" proposal was?

Here's my understanding. I suspect that Chefren will have his own version. Some
of this may be specific to Dutch law.

1. There is a "tapping bureau" that is, presumably, part of the justice system
   (in the same way that the coroner's office is, perhaps) but independent
   of the police/proscecutor apparatus.
2. The tapping bureau has a secure (encrypted) link to the telephone service
   provider(s).
3. The tapping bureau and telephone service provider maintain independent
   MD5 checksums of all traffic. This is part of the record of the tap, and
   the checksums are maintained independently and in a manner that frustrates
   collusion.
4. The police/proscecutor provide a warrant to the tapping bureau who then
   provide it to the telephone service provider. This warrant establishes
   the tap.
5. The entire tap datastream is recorded by the tapping bureau.
6. At the conclusion of the tap, the entire content of the tap are provided
   to the suspect, who can use the independent MD5 checksums to verify that
   no data was added, removed, or edited.

If the only way to tap a data stream is by feeding it (with checksums) to
the tapping bureau who will then provide the entire record to the suspect,
exculpatory evidence will be retained.

Also (putting words in Chefren's mouth), using a technical standard minimizes
the risk that unaudited taps are provided through a back-door -- the telephone
switch provider can embed the secure/checksummed tapping path deep within
the switch architecture and not provide a tcpdump facility in the switch
operating system (or provide one that is only capable of recording message
transport data and not message content).

Finally, I note that this is my understanding of Chefren's proposal, and
not necessarily his, nor am I suggesting that this is either possible
technically or politically.

Martin Minow
[email-masked]

---

From: Ed Stone <[email-masked]>
Date: Mon, 15 Nov 1999 14:50:45 -0500

> > "wiretap friendly" proposal was?

The IETF acted under the guidance of IESG, who had asked if the standards 
group should undertake the development of new protocols, or the 
modification of existing protocols, in support of facilitating wiretapping. 
The response in the meeting was reported by multiple attendees and the 
press to be overwhelmingly against such development/modification in support 
of facilitating wiretapping.

The group was not charged with evaluating, and did not have before it, any 
particular wiretap-supporting protocol for consideration.

---

From: Matthew Saroff <[email-masked]>
Date: Mon, 15 Nov 1999 13:56:24 -0600

On Nov 15, 11:45am, Martin Minow wrote:
> Subject: Re: [Raven] IETF Consensus? Not according to Fred Baker
> Matthew Saroff wrote:
>
	Sorry, I wasn't clear.  What exactly is the proposal before the IETF?

---

From: "chefren" <[email-masked]>
Date: Tue, 16 Nov 1999 20:12:03 +0100

> product that chenfren seems intent on selling.

Please stop this!

I'm definitely for an exceptionally open architecture. 
Everyone can manufacture the proposted tapbox with standard 
components and standard open source software.

The sealed open source tapbox is just needed because it's 
under control of the communication provider who may not 
tamper with it.

+++chefren

=Signature follows=

---

From: "chefren" <[email-masked]>
Date: Tue, 16 Nov 1999 21:08:54 +0100

> technically or politically.

My proposals where just an open sketch and your copy came 
pretty close to it,

thanks,

+++chefren

=Signature follows=

---

From: Vernon Schryver <[email-masked]>
Date: Tue, 16 Nov 1999 18:19:20 -0700 (MST)

> From: "chefren" <[email-masked]>

> ...
> Cops that tap with tcpdump should go instantly to jail, 
> it's as simple as that with this very serious offence.

That finally makes clear that the notion of an auditable tcpdump is based
on the same idea of outlawing (or "regulating") trivial software such as
real encryption, and never mind the billions of copies of DH and RC4 in
circulation.

In the U.S. it is illegal for the police to use a "scanner" to listen to
cell phone conversations.  See the ECPA.  Nevertheless, it is widely
reported that many police departments have scanners, and listen to cell
phone converstations to find various kinds of criminal activity.  The U.S.
laws against such behavior have not worked.

A copy of tcpdump or Microsoft's netmon fits on a CDROM or 3 floppies and
can be installed on any PC running UNIX or Windows 95 in seconds.  In
minutes and without a CDROM or floppies, you can install snooping software
on any PC connected to the Internet from Internet sites.  Scanners are
physical boxes hard to conceal under your coat.  Netsnooping is a matter
of knowledge not hardware, and doesn't make your coat bulge (well...).
Since laws against hardware scanners have not worked, why would laws
against netsnooping work?  As with scanners, as long as the police don't
say why they just happened to stop that particular car to check that the
driver's license was current, who is to say that they used a scanner or
tcpdump?

> >   - As we all know (or have no business talking about anything technical),
> >    as long as the Internet is useful, everyone on the Internet has "access"
> >    to "insert" IP packets "on the backbone."  If you can't insert IP packets
> >    on the backbone, then you cannot make TCP connections to much of the
> >    rest of the Internet.  That's fundamental to how the thing works!
>
> OK I thought you mentioned this earlier. One of the abuses 
> of the proposed auditable tap could be false injections of 
> tcp packets. I thought you mentioned also those false 
> packets could be detected.

No, I mentioned a way to obscure one of the unreliable signs of games such
as spoofing TCP/IP connections.  There are other, obvious ways to deal
with the particular sign in addition to fiddling with TTL's.

Consider more creative ways to play games if you have access to one of
the many Ethernets and FDDI rings on which default-free routers sit.
For example, think about adding a couple of host routes, one on each side
of the tapping room.  Consider much easier those games are in the marches
that use default routes.  Such games are theoretically impossible to detect
unless the victims are using real (i.e. private) authentication and real
encryption, but then the tap rooms and auditable tcpdump are useless.

> >   - there will continue to be 10,000's of Ethernets and FDDI rings inside
> >    any ingress filtering where purely bogus TCP/IP packets with forged IP
> >    source addresses can be inserted, and the wonderful tapping boxes the
> >    perfect tapping roomes will be unable to distinguish those bogus packets
> >    from the real things.
>
> I assume the tapbox can detect those errors and log them.

Engineers soon learn the truth in the old saying "if wishes were horses,
then beggars would ride."  Salescritters and politicians learn otherwise,
that the Big Lie works great.  The idea that a tapbox could detect forged
cleartext TCP streams is obviously technically silly in the Internet as
it exists or is likely to exist in the foreseeable future, but don't let
me stop anyone from selling it.

Vernon Schryver    [email-masked]

---

From: "chefren" <[email-masked]>
Date: Wed, 17 Nov 1999 16:08:37 +0100

> laws against such behavior have not worked.

I would suggest: Only vote on parties that promise to do 
something about it.

> can be installed on any PC running UNIX or Windows 95 in seconds.

I can probably kill anybody within a second by very firmly 
beating this keyboard on his/her head.

> In

Our standard should use technical tricks that make it 
obvious they didn't had a warrant and didn't use the 
properly sealed tapbox.

> encryption, but then the tap rooms and auditable tcpdump are useless.

I really think we can simply agree on the technical facts 
but there is still the basic problem, there are criminals 
in this world, how can we hold their activities below an 
acceptable level.

And in this /sub/sub/sub/case:

How to counter a malicious communication provider?

Pretty simple start: We need a law that prohibits him to do 
so. If there is no law that states the communication 
provider may not inject false packets he may.

The law should provide a pretty high penalty and if there 
are serious suspicions the police should be able to enter 
the technical rooms of the provider and hire Vernon to 
check if someone messed with the routers.

> Such games are theoretically impossible to detect unless
> the victims are using real (i.e. private) authentication
> and real encryption, but then the tap rooms and auditable
> tcpdump are useless. 

As far as I know they aren't useless. There are still 
precise fingerprints of the communication and those 
fingerprints can help law enforcement. Law enforcement is 
used to work with little...

> me stop anyone from selling it.

Is there a way to detect injected TCP packets or not? I 
assume the tapped person will receive them and his tcp-
stack will reject them?

+++chefren

= =
ii.nl ontwerpt, bouwt én onderhoudt websites
100 Euro aanbrengpremie: http://www.ii.nl/premie

---

From: Matthew Saroff <[email-masked]>
Date: Wed, 17 Nov 1999 09:35:35 -0600

> beating this keyboard on his/her head.
	Could I get the make of the Keyboard?  The one that I have is really
flimsy.

---

From: "Thomas Junker" <[email-masked]>
Date: Thu, 18 Nov 1999 02:57:50 -0600

On 17 Nov 99, at 10:23, Christian Price wrote:

> This appears to be the first explanation of an auditable tcpdump which
> makes sense to me 

Except that that has nothing to do with the purpose of 
this list, which was to consider a yes/no class of 
question posed by the IESG to the IETF.  It is principally 
chefren, in the course of something close to 140 posts 
(almost 17% of all the list traffic), who has thoroughly 
muddled the list topic through repeated references to an 
imaginary "proposed standard" and "auditable taps."  This 
list was not created to take up consideration that or any 
other proposal for a standard -- only to discuss whether 
making explicit provision for wiretapping in future 
standards should be done or not.  There are other lists 
and other fora for the proposal and discussion of 
standards.  chefren has consistently ignored repeated 
efforts to call that to his attention, one of the results 
of which has been to seriously confuse people who came 
into this list without reading its charter.

> - if the audited taps are the only ones allowed in
> court, 

And just how would the IETF bring *that* about, eh?  Even 
if this *were* the right place to be hashing out the pros 
and cons of chefren's ideas, those ideas hopelessly 
comingle technical and legal concepts.  Since the IETF is 
not a legal body, but a technical one, and since its 
standards have no force of law over anyone, I believe it 
is entirely inappropriate to put forward proposals that 
*presume* and entire legal structure of laws and 
regulations and enforcement, particularly inasmuch as it 
is trivial to show that such structures in no way exist in 
much of the world as chefren imagines they do.

> then it does put the onus on law enforcement to 
> demonstrate that they are on the up-and-up.  

No, "it" doesn't.  You are falling into the trap that 
chefren has laid, overlooking the stark fact that no IETF 
standard can put any such onus on any law enforcement 
agency anywhere in the world.  That is why I have pointed 
out that even if chefren's idea appeals to you, the 
starting point for what he envisions is not in the IETF 
but in the legislatures of the countries where you think 
you can convince the lawmakers to require audited taps and 
only audited taps, after which some standard might emerge 
to address a commonality among the laws of many such 
nations, assuming that sufficient commonality could emerge 
from legislatures to be addressed in a standard.  In cases 
where law and not technology drives standards, standards 
are often set right in the words of the law, instantly 
setting a national standard, which is sufficient to all 
parties except multinational vendors who have a commercial 
interest in manufacturing the same equipment for all their 
markets.

> just so long as it doesn't introduce any
> backdoors or prevent me from using my own flavor of encryption.

Before you fall too much in love with chefren's ideas you 
should consider that he doesn't believe you should be 
permitted to use your own encryption.  When he speaks of 
the benefits of encryption he is referring to government-
liftable encryption applied to network links by carriers, 
something that is of little interest to anyone who values 
his privacy and wishes to use end-to-end encryption to 
protect it.

The first message, posted by the IESG and stating the 
charter of the Raven list may be found at:

Regards,

Thomas Junker
[email-masked]

---

From: "chefren" <[email-masked]>
Date: Tue, 23 Nov 1999 23:57:10 +0100

On 18 Nov 99, at 2:57, Thomas Junker wrote:

> comingle technical and legal concepts.  

It's partly a chicken-egg problem.

Partly because the governments just starts tapping without 
much technical knowledge.

The technical ignorance of politics gives a collision with 
techies.

What should be done is sort things out.

To avoid politics here, I think everybody should want that 
under the IETF flag, IETF should do the maximum about 
tapping it can think of: Nothing more or less than a new 
auditable version of tcp-dump.

If that standard (because of some details + technical 
recommandations) is finished politics can be send to hell 
if they want further things from IETF.

+++chefren

---

From: William Allen Simpson <[email-masked]>
Date: Tue, 23 Nov 1999 18:56:34 -0500

As far as I can tell, the strong recommendation is to do the "maximum 
about tapping that it can think of:", make all protocols hard to tap, 
and protect the security and privacy of all Internet users.

chefren wrote:
> tapping it can think of: 

[email-masked]

---

From: "chefren" <[email-masked]>
Date: Wed, 24 Nov 1999 02:27:29 +0100

> and protect the security and privacy of all Internet users.

.. And forget law enforcement, they are useless, everybody 
should buy his own guns and maintain his own laws. Eh? no 
no, you don't have to write them down, just shoot! ..

???

Still puzzled by the simple a-social views here.

OK, I admit, there is a lot of evidence your (US) 
government is pretty dumb but it seems that you all US-ies 
just get what you have.

Start voting on better politicians. End the 2 party system 
as soon as possible, that's definitely too stable to be 
good or to introduce real and often good changes.

+++chefren

p.s. Definitely nothing personal to anyone, my estimation 
is that most of the writers here are idealists and do have 
positive intentions. Some writers seem to make a living of 
their belief...

---

From: "Lyal Collins" <[email-masked]>
Date: Wed, 24 Nov 1999 13:19:21 +1100

I don't think many on this list disagree much with the statement below.

Conceptually speaking;
Define "hard to tap".
And define "protect privacy".

When I think through these issues, and as I suspect many others do, it is
quickly obvious that  requirements emerge that allow punishment of
transgressors of those definitions and boundaries.  A little latitude in
controls is required to avoid the police-state most of us fear, so deterrent
measures complement prevention measures.

Today, we can't identify transgressors, let alone have effective evidence to
prosecute.

Authentication and audit are the key terms underlying punishment of
transgression of privacy.

In the absence of a "lynch mob" culture, what are we (list members and
Internet users in general) proposing to do?

I think the idea of an auditable, secured (ie. private and reliable)
communication infrastructure is emminently desirable

Lyal

---

From: Matthew Saroff <[email-masked]>
Date: Wed, 24 Nov 1999 08:40:04 -0600

> auditable version of tcp-dump.
	What you are doing is suggesting a piece of software, i.e. a version of
a utility with some sort of encrypted signature, not a standard.  This is not
germain to the purpose of the list.
	To everyone else out there, I'd like to apologize for the fact that I
am the source of about 3% of the list posts.  That's way too much for a a
mechanical engineer who doesn't do network programming.

---

From: Christian Price <[email-masked]>
Date: Wed, 24 Nov 1999 10:04:49 -0700

Apologies to all - I have drifted off subject a little. 

> no, you don't have to write them down, just shoot! ..

Sarcasm wins few friends or debates.  
(Yeah, I laughed - but it doesn't affect my opinions)
 
> government is pretty dumb but it seems that you all US-ies

Agreed on both counts (I am a 'US-ie')
 
> good or to introduce real and often good changes.

Ending the 2-party system is not a realistic option right now,
maybe over the course of a couple decades.  Unless you are suggesting
revolution, but then we would need untappable encryption. <yes, that was
sarcastic>
 
> positive intentions. Some writers seem to make a living of

The 'radical' philosophies which have been espoused by us 'US-ies' are
derived from the formative writings of of this country.  Thomas
Jefferson, Thomas Paine, Alexander Hamilton, etc. based their
philosophies on the writings of John Locke, Jean-Jaqus Rousseau and
Charles Louis de Secondat Montesquieu.  These men had experienced the
tyrrany of a 'good' government gone bad - corrupted by individuals, not
the system itself.  Even the Netherlands has some experience in these
political/social ills:

----<snipped from http://infoplease.lycos.com/ce5/CE055855.html>----
Called to the throne upon the abdication of his
father (1840), William II was immediately confronted with a grave
financial problem, which was solved by raising a “voluntary loan” among
the people. Demand mounted for constitutional revision, but the king
resisted the liberal movement, led by Jan Thorbecke, until the
revolutionary spirit of 1848 induced him to grant the desired reforms.
He
was succeeded by his son, William III.

--Christian

---

From: "chefren" <[email-masked]>
Date: Wed, 24 Nov 1999 20:04:08 +0100

> germain to the purpose of the list.

A) The standard I ask for describes the way the software
   has to work.

B) Because of the nature of the problem there is a
   hardware side on it, to avoid corruption we need open
   source hardware and software AND a sealed box. 

> To everyone else out there, I'd like to apologize for the
> fact that I am the source of about 3% of the list posts. 

Get real, there is a very tricky problem that definitely 
hasn't a 100% solution and so all input is needed to get 
the best solution. As long as you can read and understand 
enough from what's written here there is no problem at all.

> That's way too much for a a mechanical engineer who
> doesn't do network programming. 

So you can propose a better box or just a better seal for 
the box?

As far as I know getting before a judge and get taps to 
prove things against you can happen to everyone of us. I 
would like to see an auditable tap with as much technical 
means as reality allows that keep misuse and fraud in 
check. 

+++chefren

=Signature follows=