Subject: [Raven] CESA

From: "Richard Payne" <[email-masked]>
Date: Fri, 5 Nov 1999 09:46:40 -0500

At the risk of perhaps making an off-topic post, although I think its
relevant, it may be worthwhile for everyone to take a look at

http://cryptome.org/fbi-cesa.htm

which describes what appears to be the next big push for surveillance.

Note that they've backed off the "search warrants for encryption keys
without contemporaneous notice to the subject" (that's a black-bag job to
you and me) that was in the original proposal, but there's still a lot of
things very wrong with it.

The proposed ability of the Government to use plaintext without having to
reveal how it was obtained is particularly troubling, since it obviously
affects the right to a fair trial. How can the truth of the evidence be
assessed if the method of gathering it is held secret? How do we know the
plaintext is not a fabrication?

Richard Payne

_______________________________________________
raven mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/raven

---

From: "chefren" <[email-masked]>
Date: Fri, 5 Nov 1999 19:09:55 +0100

On 5 Nov 99, at 9:46, Richard Payne wrote:

> How can the truth of the evidence be assessed if the
> method of gathering it is held secret? How do we know
> the plaintext is not a fabrication? 

  HUH ???

Sorry, I started guessing you do would like to introduce an 
auditable tapping standard.

I must be wrong I know, ;-)

+++chefren

= =
ii.nl ontwerpt, bouwt én onderhoudt websites
100 Euro aanbrengpremie: http://www.ii.nl/premie

---

From: Greg Broiles <[email-masked]>
Date: Fri, 5 Nov 1999 10:52:32 -0800

> auditable tapping standard.

No - Mr. Payne seems to understand what you are unable (or perhaps just
unwilling, due to your line of business) to recognize - that technology
can and will be used for good or for evil, and it's worth remembering
that before designing and building it. As William Gibson said, "the
street finds its own uses for things." 

It doesn't matter how many special audit features are built into devices
- especially if we're talking about software devices - in some
countries, law enforcement and the courts will disable or ignore the
audit features. As another list member mentioned, the US federal police
have recently suggested legislation which would allow them to avoid
describing even the technology used to gain evidence which is admitted
into court.

Not only are they not going to introduce auditable logs, they're not
even going to say whether or not some information was gained by a
wiretap, or a room bug, or a TEMPEST van, or a keyboard sniffer, or a
surreptitious copy of the subject's hard disk. 

It's recently come out that the Los Angeles Police Department (who's
been held up as a model of "professional policing") - and who would be
included in the group of people allowed to escape even basic
authentication, if the legislation suggested by the federal police is
passed - has been DELIBERATELY SHOOTING CITIZENS and then lying and
planting fake evidence to cover up the circumstances of the shooting.
They have also been participating in years-long illegal wiretaps
covering tens (if not hundreds) of thousands of people, then conspiring
with prosecutors to hide those wiretaps from people accused of crimes,
as well as the innocent people whose conversations were also invaded.
This information came out of the prosecution of an officer who was
stealing drugs from the police department's evidence locker and selling
them on the street, after his partner was arrested for participating in
an armed bank robbery. Apparently, the two weren't even aware of each
other's criminal activity.

The Los Angeles County District Attorney (the elected official in charge
of all state prosecutions in Los Angeles County) dismissed questions
about the illegal wiretaps by saying that what they're doing in LA is
nothing special, that police all over the United States do that
regularly and there's nothing remarkable about it.

Can you understand why US-based list members* are uncomfortable with
giving more powerful technology to the police? 

(* well, except for those who make money by selling more powerful
technology to the police.) 

--
Greg Broiles
[email-masked]

---

From: "Brett Wooldridge" <[email-masked]>
Date: Fri, 5 Nov 1999 15:13:32 -0600

----- Original Message ----- 
From: Greg Broiles <[email-masked]>
To: chefren <[email-masked]>
Cc: <[email-masked]>
Sent: Friday, November 05, 1999 12:52 PM
Subject: Re: [Raven] CESA
<snip>

> surreptitious copy of the subject's hard disk. 

<snipped a whole bunch of righteous sh*t>

You are my hero for the day!  You are tha man!  Well put!

I've tried not to air the dirty laundry of how abusive of the laws our
law enforcement and even prosecutors are, but it may be necessary
to drive home the importance (even to U.S. list members) of what we
are discussing here.

What has happened in L.A. turns my stomach, but it makes me
remember Serpico's congressional testimony in the 70's and
reinteration just three years ago, in which he (as a former cop)
estimates that over 80% of cops are corrupt -- and the rest look
the other way, maintaining the "blue wall of silence".  Serpico, for
those who don't know, was ambushed and shot over a dozen
times by fellow officers in the NYPD, for exposing their corruption.

Brett Wooldridge

---

From: "chefren" <[email-masked]>
Date: Mon, 8 Nov 1999 13:20:19 +0100

On 5 Nov 99, at 10:52, Greg Broiles wrote:

> that before designing and building it.

Please correct the last part of that sentence: technology 
can and will be used for good or for evil, and if people 
see a chance to develop new technology they will.

To me you didn't state anything interesting concerning this 
list.

> As William Gibson said, "the street finds its own uses
> for things." 

Ah sorry, forgot to tell the list, I did read Neuromancer 
too of course...

More serious:

> audit features.

Here you are plain wrong.

I have NEVER written about building special audit features 
into (=existing=) devices.

I think there the world community has a strong need for an 
auditable tap. And that's roughly nothing more than a new 
auditable version of tcpdump with some security stuff.

> As another list member mentioned, the US federal police

  That has NOTHING to do with auditable taps. That's a
  direct and economic consequence of the IMHO stupid and
  uncivil idea of letting encryption free. [If you let it
  both unregulated and don't demand communication
  providers to do their task good, encrypt communiction for
  customers those customers will use strong encryption themselves.
  Law enforcement can decrypt some of them but isn't
  willing to tell which or what because that will lead to
  use of stronger encryption that's out of reach and/or
  will lead to higher decrypting costs that aren't
  acceptable for community.] 
 
> Not only are they not going to introduce auditable logs,

Here in the Netherlands auditable taps are introduced years 
ago and it's starting to spread in Europe.

> they're not even going to say whether or not some
> information was gained by a wiretap, or a room bug, or a
> TEMPEST van, or a keyboard sniffer, or a surreptitious
> copy of the subject's hard disk. 

Unacceptable. Not that they do such things, that should be 
regulated by law's, but that they wont reveal where the 
evidence comes from and thus cannot proof nobody tampered 
with the evidence.

..

> .. has been DELIBERATELY SHOOTING CITIZENS and then lying and

Might well be true but has NOTHING to do with this list. 
IETF shouldn't be a political organization and just keep 
producing good standards.

> covering tens (if not hundreds) of thousands of people,

Yes yes... "US doesn't tap as much as The Netherlands" B... 
S...!

..

> giving more powerful technology to the police? 

An auditable version of tcpdump should thus be PRECISELY 
what US-based list members* should love to see.

> technology to the police.) 

I think it's immoral to provide the police with any 
unauditibable technology. We aren't talking about the army!

+++chefren

(* I start thinking you all US-ies are converted some day's 
ago although most of you don't know yet...)
= =
ii.nl ontwerpt, bouwt én onderhoudt websites
100 Euro aanbrengpremie: http://www.ii.nl/premie

---

From: Greg Broiles <[email-masked]>
Date: Mon, 8 Nov 1999 08:07:51 -0800

> see a chance to develop new technology they will.

And that devlopment can occur in an efficient, standardized way, or in
an inefficient, duplicative, non-standardized way. I'd prefer the
latter, when we're talking about surveillance technology. 

> auditable tap.

But it seems the only people who think that are surveillance fetishists,
and those who supply them. The rest of the "world community" is in no
hurry to recreate the Eastern Bloc, with neighbors spying on neighbors
spying on neighbors, with each informing on the other for fear of being
caught hiding information. 

> ago and it's starting to spread in Europe.

Several days ago, I asked you for a reference or a citation to the laws
implementing this, but you've avoided the question. Please provide a
citation, I'm sure that several of us would like to read these laws for
ourselves. 

> evidence comes from and thus cannot proof nobody tampered 

I very much agree that it's unacceptable. That's why (a) I don't want
them to pass a law allowing it, and (b) I don't want it to be easy or
inexensive for them to tap if they manage to get the law passed, or if
they choose to ignore the law.

> producing good standards.

It's a reminder to you about what sort of people are going to be using
the technology you're so excited to design. They don't care about
audits, they don't care about testifying truthfully, and they don't even
have the basic human decency to avoid injuring or killing other human
beings. In that context, your notion that you'll just build surveillance
equipment and ignore the consequences is remarkably naiive.

> what US-based list members* should love to see.

No, because we know well enough that the audit features will be ignored
or disabled when it's convenient to do so, and that courts will admit
the evidence anyway.

---

From: "chefren" <[email-masked]>
Date: Mon, 8 Nov 1999 23:12:25 +0100

> citation, I'm sure that several of us would like to read these laws for

Excuse me for not replying. I did see the question but only 
could find Dutch text and on paper only. Maybe I should 
explain things further and translate some quotes.

A) The Netherlands is part of the European Community and 
they come with a kind of rulings that should be adopted in 
national laws. The rule in question is the one decided upon 
17'th of january 1995 (PbEG C329).

B) There are all kind of law's, the new telecom law based 
upon (PbEG C329) was effective a few weeks after 10 
november 1998 the date the law was published.

C) The law states a few things, I will cite/"translate" 
(sorry for my crude english...): 

   Article 2e

   At the moment it comes available telecommuncation
   obtained by tapping will be transferred to the person or
   agency trough an ISDN link as stated in the warrant.

 (yes, seems stupid they stated "ISDN" in the law but
 they did, probably because it's quite difficult to fake
 begin and end of an ISDN line. Speeds will for example
 definitely be a problem in the near future.) 

   Article 2j

   Telecommunication switched to another network or
   network connection should be tapable.

D) The rest of it is described in "maatregelen van 
bestuur", measurements of order(???). So besides the point 
to point ISDN link, the auditable part of it is hidden in 
protcols that are more or less supplied by department of 
justice. A few times a year there are good organized talks 
among all involved parties and if someone comes up with a 
good idea they are often implemented quite fast in the 
protocols. (Give me a good idea and it will be implemented, 
sounds funny but it's true. One of the points that were 
accepted lately is about "open source interfaces". We have 
ended the implementation debates of interface standards by 
exchanging sourcecode and headerfiles among suppliers. 
Funny isn't it?)

E) Both European and Dutch "tapping standards" are secret. 
I have never signed anything but "secret" is what's written 
on it. I'm against it but see no good reason to publish 
them here or elsewhere. Someone pointed on the ETSI 
standards in this list. They are highly stupid and designed 
by people that seems to never have writen one serious line 
of c-code or and that's all I want to say about it. Eh 
that's to say, maybe that's why I'm putting efforts in an 
IETF standard? (I thought this list wouldn't be longer than 
a few weeks...)

> they choose to ignore the law.

The logic behind your (b) is flawed since nobody proposed a 
new IETF standard to make tapping easier or to provide 
backdoors in existing standards. An auditable tap makes 
tapping less easier for all parties. Less easier than 
tcpdump that exists, and is used now.

+++chefren

= =

---

From: Greg Broiles <[email-masked]>
Date: Mon, 8 Nov 1999 14:37:51 -0800

Thank you for the citations. I'm sure I will have more comments when
I've had a chance to read the underlying documents. 

>	[...] 

I see where the ability to tap is presumed, and how there are rules
regarding what can be tapped, but I didn't see (in your translation) any
rules regarding auditability.

> justice.

Are these available? It sounds from your description like the
auditability standards are not really part of the law which allows or
requires taps; or at least they're not part of the EU standard.

Is that correct?

Would it be accurate to say that the EU standard requires taps, but
allows member governments to add auditability requirements if they
choose to do so? 

> E) Both European and Dutch "tapping standards" are secret. 

How can the police's behavior be compared to the standards if the
standards are secret?

If the IETF were to write a protocol which allowed taps under certain
circumstances, would that even be useful to the EU/NL governments, given
that they seem to prefer to operate in an environment of secrecy? That
certainly isn't compatible with an international technical standard -
we'd have to know what was allowed, and when, to write it into the
protocol. If Dutch citizens aren't even ordinarily allowed to read that
sort of thing, how will the government look at your suggestion that
these currently secret standards be published for the entire world in
one or more RFC's? 

> tcpdump that exists, and is used now.

The IETF standard will not itself make tapping easier - but it will make
interoperability between hardware and software which implements tapping
easier, that's why I don't like it. 

And, regarding tcpdump, I don't think the problem can be solved by
making a new (and less useful, in the eyes of an eavesdropper) version
of tcpdump - it can only be solved by making the information available
to tcpdump less useful, e.g., with good encryption and tunneling and
traffic shaping.

--
Greg Broiles
[email-masked]

---

From: "chefren" <[email-masked]>
Date: Tue, 9 Nov 1999 00:19:16 +0100

> rules regarding auditability.

Only the ISDN part directs at it. A secure line between 
communication provider and tapping room is the basic part 
that's in the law.
 
> requires taps; or at least they're not part of the EU standard.

The EU standard also provides information about the tap in 
headers thet are send to the tapping room. Those headers 
are "manufactured" automatically under control of the 
communication providers. Lot's of logs make it a lot of 
work to forge a lot. But it could be possible without a 
sealed tapbox. For ISDN a sealed tapbox is unthinkable. 
They will tap on the "SS7 level", the programming language 
of telephone exchanges.

   (Is there someone who can tell us about that? I have
   understood the standard exchanges don't have provisions
   on the SS7-level for tapping. I never could believe so
   but the telephone guys I know really say so and they
   have to pay an awful lot of money to for example
   Ericsson to make the GSM exchanges tapable. I saw this
   as a kind of proof that NSA taps whole communication
   lines and doesn't work within the exchanges...) 

> allows member governments to add auditability requirements if they

"No", as far as I know the ETSI spec just defines which 
information has to be send with a tap. Probably with simple 
audit parts such as counters. Together with the checked 
ISDN line tampering isn't likely. For TCP tap's it should 
be considered not good enough for obvious reasons.

> How can the police's behavior be compared to the standards if the

Ah, the general design, as I described it earlier, with for 
example a central office that distributes key's is "leaked" 
to the equivalent of senate and house and press. Lawyers 
may ask for how things work and get answers.

But again: TCP is another beastie. The current standards 
are more or less based on plain old telecom and I think we 
need a good standard for TCP with more security and 
auditing.

> that they seem to prefer to operate in an environment of secrecy?

??? I really miss something here. Your basic idea doesn't 
seem to fit with the idea of "the minority"... (See 
signature.) The needed protocol is more or less a new 
version of tcpdump for in a tapbox with communication 
protocol to the tapping room.

> That

I'm definitely for a totally open standard, including 
hardware, OS and tap-software. Everyone should be able to 
build the tapbox and verify if one is build according to 
the specs.

> easier, that's why I don't like it. 

Nope. It' won't make that easier, to the contrary. With 
tcpdump I can redirect an unaudited tap with a few 
keystrokes to the other side of the world, any moment, I 
can even filter it before it leaves my computer and without 
anyone who can prove it afterwards. With the audited tap 
only the tapping room can do something with the tapped 
information and tampering is nearly impossible.

> making a new (and less useful, in the eyes of an eavesdropper)

A good law enforcer wants proof that can persuade the 
judge/jury. An audited tap according to IETF standards 
doesn't compare to tcpdump.

> version

I don't know what you mean with traffic shaping (making the 
trafic more even so nobody can recognize bursts or count 
bytes and puzzle who said what?). But yes. The information 
between tapbox and tappingroom should definitely be 
tunneled/encrypted. There is data there from people who are 
NOT convicted and whose privacy should be respected!

+++chefren

=Large signature follows=

I think we need a simple architecture for a point
to point tap interface that has strong provisions
against misuse.

On one side the communication provider who only
starts tapping a specific customer or IP number
with proper warrants.

On the other side the approved tapping room.
Everything should be organized by the central
"tapping office". This office should provide
keys for strong encryption to both communication
provider and tapping room.

Law and technology should both provide as
much checks and balances as we can come up
with. Law can provide good procedures,
technology can provide technical means to
check them or force them.    

=Large signature ended, please comment me
off-line to make it better=

---

From: Greg Broiles <[email-masked]>
Date: Mon, 8 Nov 1999 16:52:00 -0800

> november 1998 the date the law was published.

I have been able to find a copy of "96/C 329/01", "Council Resolution of
17 January 1995 on the lawful interception of telecommunications".

The document I've got (downloaded from eudor.com, which claims to be the
official publication arm of the EC) does not require that member
governments implement legislation which would allow or require wiretaps;
nor does it require them to use auditable taps, in the event that
wiretaps are implemented. As I understand the document, it is a Council
Resolution which expresses the opinion of the EC but is not binding on
any person or government.

The document seems to summarize the requests made by various law
enforcement agencies, and recommends that Member States "take into
account" the requests and concerns when drafting local legislation.

The requests made by law enforcement are strikingly similar to those
made here in the US by our internal security/police force regarding
digital telephony. Indeed, I later found
<http://news.heise.de/tp/english/special/enfo/6398/1.html> by Duncan
Campbell, which documents the process by which the US' internal security
agency held a "seminar" attended by a number of EU people, who then
returned to Europe and presented the US' "requirements for law
enforcement" as their own requirements. 

I was not able to find any reference at all in the document to auditable
taps; given that it's a list of recommendations made by law enforcement 
(and the US', at that), perhaps that's not surprising. 

I'm going to try to convert the document into .PDF or text this evening
- until then, an English version is available to interested readers at
<http://www.parrhesia.com/C329.tif>. (You may encounter file type
difficulties with that, sorry.)

I also found <http://news.heise.de/tp/english/special/enfo/6389/1.html>,
which seems to be a draft copy of a proposal to replace/supersede C 329,
and it does not mention auditable taps, either.

Are you certain that EU law requires auditable taps? 

--
Greg Broiles
[email-masked]

---

From: "chefren" <[email-masked]>
Date: Tue, 9 Nov 1999 01:55:19 +0100

Already posted it to the list:

http://europa.eu.int/eur-lex/en/lif/dat/1996/en_496Y1104_01.html

Remember this is not the law but the requirement of the law. Law in 
The Netherlands is according to this requirement since december 1998.

Part 3.2. describes more or less the "format" where in practice in 
The Netherlands authentication and other things are demanded:

   3.2. Law enforcement agencies require that the format for
   transmitting the intercepted communications to the monitoring
   facility be a generally available format. This format will be
   agreed upon on an individual country basis. 

The format doesn't seem generally available to me but it is available 
to all parties involved without any checking that I'm aware of.

I think the IETF tapping standard should be used for the "tcpdump" 
part under control of the communication provider and the transfer to 
the tapping room. IETF can easily provide thougher and better 
standards in that crucial part of the requirements. 

Sorry I didn't knew earlier this was on the web already.

+++chefren

---

From: "chefren" <[email-masked]>
Date: Tue, 9 Nov 1999 02:04:44 +0100

> Are you certain that EU law requires auditable taps? 

In The Netherlands the parties that are busy with it have 
concluded that simply using tcpdump will not be enough. In 
the old telecom world there are logs in all exchanges and 
it isn't that simple to change start and end dates and 
times. They don't think about tampering with the message 
itself in the law. (Little bit stupid but not that easy to 
do.)

With tcp it's far simpler to tamper with the data. So while 
designing the "tapbox" we envisioned the seal and open 
source design and "tunneling" to the tapping room to 
counter those problems.

+++chefren

---

From: Greg Broiles <[email-masked]>
Date: Mon, 8 Nov 1999 17:42:02 -0800

> http://europa.eu.int/eur-lex/en/lif/dat/1996/en_496Y1104_01.html

Thanks- I'm sure this will help clear things up.

> The Netherlands is according to this requirement since december 1998.

Are you sure that this is really a requirement? This is the text that
was not included in your earlier message to the list, which is the
actual resolution of the Council -

--

1. The Council notes that the requirements of Member States to enable
them to conduct the lawful interception of telecommunications, annexed
to this Resolution ('the Requirements`), constitute an important summary
of the needs of the competent authorities for the technical
implementation of legally authorized interception in modern
telecommunications systems.

2. The Council considers that the aforementioned Requirements should be
taken into account in the definition and implementation of measures
which may affect the legally authorized interception of
telecommunications and requests Member States to call upon the Ministers
responsible for telecommunications to support this view and to cooperate
with the Ministers responsible for Justice and Home Affairs with the aim
of implementing the Requirements in relation to network operators and
service providers.

--

.. the language, especially in part 2, does not seem as clear and as
forceful as I would expect it to be were the requirements in the Annex
themselves considered part of the law. Also, it seems very unlikely that
the EU would simply accept the US' statement of what's required of law
enforcement and adopt it wholesale as its own law without any
modification, don't you think? That seems like a reasonable approach if
what's approved isn't law, merely something for lawmakers to think about
.. but if the EC really was making law when it adopted C 329, I'm
surprised that they weren't more inclined to think independently. It
seems like the people I've met from Europe weren't so agreeable to
American pushiness, but perhaps I've had a biased sample. I understood
the Annex to be describing what the Council perceived as the needs of
law enforcement, generally, but not a requirement that those needs be
met.

It turns out that the same document is known to Australian, folks, too -
it's available on their Department of Communications, Information
Technology and the Arts' website at
<http://www.dcita.gov.au/nsapi-text/?MIval=dca_dispdoc&pathid=%2fresponsi%2fint%5fintercept%2ehtml>,
(sorry for the long URL), mirrored at
<http://cryptome.org/ilets-snoop.htm>. 

>    agreed upon on an individual country basis. 

So, then, we agree that the EU document C 329 does not, itself, require
that only auditable wiretaps may be used if wiretaps are used at all? 

--
Greg Broiles
[email-masked]