Subject: [Raven] (no subject)

From: "Adam Rabblerouser" <[email-masked]>
Date: Wed, 24 Nov 1999 14:03:33 EST

>Hello:
>	I've been lurking for a while, this is my first post ;-) Please
>backchannel hate mail.
     --snipped--
>	Actually, during Jefferson's age (at least later in his life) they
>had this little thing called protection against unreasonable searches and
>seizures, and except in time of war, the government wasn't allowed to do
>that sort of thing w/o a warrant.
Amazing, same concept.  It was allowed with a warrant.  Still is,
and it will be tomorrow too.

>Furthermore, cryptograms existed in that
>era, and there was no general attempt to get everybody to store the keys
>to their cryptograms with the government (or to forbid people to use
>cryptograms in their letters).
I'll agree that mandating key escrow when exporting Schneiers book
with source code was legal is crazy.  Genii out of the bottle.
Eventually we got it right, and, in the scheme of things, it didn't
take all that long to get it right.  That's the way it works - we
often DO go down the wrong path for a while.  Eventually, we end
up on the side of the Angels.

>As a matter of fact, there was a rather
>famous example where even during the war, General Washington refused to
>order one of his officers to divulge the contents of an encrypted letter
>the officer had received, believing in the man's right to privacy -- I
>don't recall the details of the incident, but I do remember the officer
>was vindicated. The point is that privacy in personal correspondence was
>the rule -- not the exception.
Yep, and it still is today.  However, the constitution says
that you CAN invade personal privacy when there is probable
cause.

>	As I understand it, the discussion on the list centers not on the
>merits of intercepts, but on the advisability of building a large
>infrastructure to assist LEAs in tapping communications on a fairly easy
>level -- something like a point-and-click, I'd imagine.
There you are wrong son.  The discussion is whether the IETF should
do anything to support wiretap.

>That sort of
>ability has never existed in the past -- it was never possible before (at 
>least, I hope not).
Don't look too hard at what the NSA can do then.

>In American society, the government exists to protect
>our rights, and we ought not to give it any more power than it needs to do
>so. What is the powerful threat that justifies giving the FBI abilities
>that the SS could only dream about?
Technology marches on.  What was impossible is possible.

Let's stay off the specifics of CALEA, shall we?

There is no new huge threat, what there is is a whole new
communications technology.  Should the Internet be tappable.
I say yes.  Should the IETF participate in setting standards for
taps.  I say yes.  When we get beyond that, it may be that I
am more on your side than you suspect fella.

>	I think that regardless of whether the IETF creates a standard to
>allow for point-and-click privacy intrusion, the FBI will find a way to do
>intercepts when they really need to. The question is whether we want to
>make it so easy that they can casualize it and they can trivialize
>intrusions on privacy. In a nightmare scenario, we should wonder whether
>we want to give the closest thing America's ever had to a secret police
>the ability to analyze and read the mail of millions of people.
Geez guy, don't you think it's possible to do that RIGHT NOW?
Someone said something about "the basic tap ability is already
there".  I'm just with the camp that wants some decent standards,
developed in public.  I kinda think we get a better result that way.
It's worse to let someone develop the standards in secret
and deploy them without scrutiny.

> > Yeah, right.  Just what do you think you would do if it happened to
> > you?  Tell your kids "I told you so"?  You REALLY think your teenagers 
>are > different from all the rest, and they can tell
> > who's a scum, and wouldn't go meet someone who sounded way
> > cool and .....  You want to tell the parents of the kid
> > it happened to that they were bad parents and should have taught their
> > kids better?  You make me puke.
>
>	As a teenager, I resent the idea that parents should completely
>shield their children from the world. I think it would be irresponsible of
>parents to deny their children the chance to make their own judgments and
>their own decisions -- everybody makes bad decisions, but we have to learn
>from the consequences of our own mistakes. Parents eventually (hopefully
>not before I leave college) have to let kids go. That said, let me say
>that I'm very grateful to my parents for a splendid environment to grow up
>in, and a (hopefully) clear sense of right, wrong, what is safe, and what
>is stupid. Parents can teach these things, but they cannot force children
>to follow them forever.
Nice sentiment son, credit to your parents, and all of that.

Now, fast forward.  You are the parent, you did all those things.
Your kid made a mistake.  Some sleaze is in fact emailing your kid.
Worse, the sleaze is talking to other kids.  Are you ready to say
that because some dirty cops in LA abused the existing wiretap law,
we ought to PROHIBIT a cop from being able to tap & trace on the net?
Are you advocating that the IETF explicitly work to PREVENT
the possibility that we could use tap/trace techniques to find
the scumbag?

Don't get me wrong.  You can use a parallel to that argument to
justify beatings in police custody.  Trace and tap is a relatively benign 
tool.  When it's abused, people don't usually die (okay,
despots sometimes do make people die).

I'm advocating that if a judge is presented with probable cause,
that the cops ought to be able to trace and tap the sucker.

Adam

______________________________________________________
Get Your Private, Free Email at http://www.hotmail.com

_______________________________________________
raven mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/raven

---

From: Bob Mahoney <[email-masked]>
Date: Wed, 24 Nov 1999 15:03:32 -0500

I don't have anything terribly unique or interesting to add to this 
discussion, but since the list may be sifted later to contribute to 
the determination of consensus, I'll put my opinions into the mix 
very briefly:

1) The IETF should not assist in adding wiretap support to networking 
protocols.

2) I would support efforts to make undetectable taps harder, should 
that question come up again.

3) Stopping bad people and bad actions is important, but not as 
important as opposing new threats to freedom and privacy.

I actually spend most of my professional time these days detecting, 
recovering from, and attempting to prevent various assaults on MIT's 
network.  In this context I work with law enforcement fairly 
regularly, and I have found those I've worked with to be good and 
fine folks.  But I have no interest in simplifying their jobs if it 
increases the chances that their successors may someday choose 
expediency over due process.

I'm not sure that minds are being changed here, but I'd encourage 
people to speak up at least once, before wandering away.

-Bob

---

From: "Lyal Collins" <[email-masked]>
Date: Thu, 25 Nov 1999 07:43:52 +1100

I'd think most people would support (2).
I feel that (1) and (2) are not entirely exclusive.  With balance, there is
a small area of intersection between those two statements that we can work
towards for social good.

Nor do I think (3) is undesirable.
I do think "opposing new threats to freedom and privacy" is closing the barn
door after the horses, cows, chickens, and pigeons have bolted in today's
Internet.

Some rebuilding and replacement is necessary, rather than simply applying
spit and band-aids then hoping the problems go away.

Regards,
Lyal

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On Behalf Of Bob
> Mahoney
> Sent: Thursday, 25 November 1999 7:04
> To: [email-masked]
> Subject: [Raven] Opinion toss
>
>

---

From: "chefren" <[email-masked]>
Date: Thu, 25 Nov 1999 02:40:52 +0100

On 24 Nov 99, at 15:03, Bob Mahoney wrote:

> network.  In this context I work with law enforcement fairly regularly,
> and I have found those I've worked with to be good and fine folks.  But I
> have no interest in simplifying their jobs if it increases the chances
> that their successors may someday choose expediency over due process.

So you tap, probably even without warrants and if you have 
"proof" there is probably no auditability at all.

Why should law enforcement with warrants not be allowed to 
do so? And why shouldn't there be standards for auditable 
taps?

Is this really so difficult to understand?

+++chefren

=Signature follows=

I think we need a simple architecture for a point
to point tap interface that has strong provisions
against misuse.

On one side the communication provider who only
starts tapping a specific customer or IP number
with proper warrants.

On the other side the approved tapping room.

Everything should be organized by a central
"tapping office". This office should provide
keys for strong encryption to both communication
provider and tapping room.

Law and technology should both provide as
much checks and balances as we can come up
with. Law can provide good procedures,
technology can provide technical means to
check them or force them.

=Large signature ended. If you want to
help to setup a standard for the above
design, please contact me.=

---

From: Ed Stone <[email-masked]>
Date: Wed, 24 Nov 1999 21:05:19 -0500

>"proof" there is probably no auditability at all.

You don't get it. If he is charged by the owners of the systems (MIT) to 
administer them and provide security services, he does not need a warrant.

The processes of a warrant, and the dangers of wiretapping, converge where 
government accesses resources it does not own, without notice to those 
tapped, and provides findings so that persons can be prosecuted and 
potentially deprived of life, liberty, and or property by the government.

If the MIT CS security staff can imprison people based on a tcp dump, then 
we approximate the government wiretap.

--
--------------------------
Ed Stone
[email-masked]
--------------------------

---

From: "chefren" <[email-masked]>
Date: Thu, 25 Nov 1999 19:01:15 +0100

> administer them and provide security services, he does not need a warrant.

Ah, I don't get it...

"If he is charged by the owner of the system (US) to 
administer them and provide security services, he does need 
a warrant."  

I know the government doesn't "own" the country but they do 
are in charge and what's the difference?

> potentially deprived of life, liberty, and or property by the government.

A warrant is nothing less than an auditable means in the 
process. If people could be trusted warrants weren't 
necessary at all. (And law enforcement wasn't necessary 
too...)

> we approximate the government wiretap.

I just understand they still break privacy without warrant, 
without specially educated personnel, without 
democratically constituted rules.

What I really don't get is that privacy here is something 
different than privacy elsewhere.

+++chefren

---

From: Ray Yang <[email-masked]>
Date: Thu, 25 Nov 1999 13:55:45 -0500

> do anything to support wiretap.

       Sorry if I'm wrong (and please do correct me), but I was under the
impression that the IETF was a standards-setting body. That meant that
anything done to support tapping would mean creating a standard for tapping.
Since such a standard could not include legal remedies (because the IETF has
no legal power), the standard would have to be primarily technical in nature.
A technical standard would be something like a 1-2-3 process for tapping --
which would make it easier than it is now. To be redundant, the process would
be standardized -- made easy, and massively reproducible. Maybe it won't
initially be as easy as a point-and-click, but given the capabilities of
modern computers to automate lots of tasks, I don't see how such a standard,
if introduced, could be prevented from going there. 

> am more on your side than you suspect fella.

       I think that the Internet will be inevitably tappable, but I don't
think it's such a hot idea for the IETF to make it easy. I think that the IETF
should actually go in the opposite direction (possibly off-topic) -- that the
IETF should create standards that improve privacy over the internet --
precisely in order to prevent easy tapping. This would probably include
encryption. The standard would probably specify a place where the key to this
system would be stored -- from there, let the legal system handle things,
probably in the form of a search warrant delivered to the repository (which
would hopefully be independent of the government). 
       I suppose my point is that if you give the repressive arm of the
government (in the sense that they use force to put down actions perceived as
undesirable) easy access to power, that power can and will be abused, and the
consequences of its abuse will be horrifying. A corollary is that if the power
is hard to access, while the possibility of abuse still exists, people making
use of that power will be far more responsible in its use because it's hard to
get. 
       I think that we agree on a lot of this -- it's just that I'm
questioning whether such a standard would help the goals we both espouse. 

> and deploy them without scrutiny.

       The IETF doesn't really have any legal power -- as far as I understand,
the standards it creates are technical -- so I don't think any standard thus
created will shed that much light on the practices of government agencies.
Remember, we're not creating a standard for when they choose to tap, but the
specifics of how they actually do it once they've decided to. 
       And I think you're perfectly right on the fact that such standards will
be developed as things stand, which will amount to an Orwellian intrusion on
privacy. I think, however, that the job of the IETF is to prevent something
like that, not to aid or abet it. 

> the possibility that we could use tap/trace techniques to find

       No and yes =) We couldn't and shouldn't prevent a cop from being able
to tap & trace, but we could rachet up the difficulty. We could have a scheme
where the cop has to go to some private citizen and has to serve up a warrant
to that private citizen before they even have the capability to tap. This
would make it harder to tap/trace, but in no way would it ever make things
impossible. To bring us back to the parent/kid analogy, you want the cops to
do the footwork and track down which sleazeball they want to tap/trace,
instead of indiscriminately tap/tracing everything from, say, a particular
block.
       It's good that it's harder for LEAs to obtain the technical means to
intrude on privacy -- that means that when LEAs do spy on people, they're more
likely to have good reason for doing so. When you go up before a judge, a
judge is far more likely to authorize something you present as being easy and
easily hidable -- a judge is less likely to authorize an intrusive raid --
unless you have good reason. We should try to make sure the cops have good
reason before acting invasively. 
> despots sometimes do make people die).

      We could also use such an argument to justify not reading Miranda rights
in order to get more confessions. Not that many people die from not having
their Miranda rights read to them. However, when the Miranda warning is
forgotten or ignored, crucial concepts such as fair play, restraint, and
respect for citizens rights go out the window. We don't want that to happen to
our privacy -- it's less severe, granted, than losing our lives, but a
government that exists to protect our rights shouldn't be doing that to any of
our rights unless they have damned good reason. As good citizens, let's make
it so that we know they do have good reason before they act.

Respectfully yours,

Ray Yang

---

From: "P.J. Ponder" <[email-masked]>
Date: Thu, 25 Nov 1999 17:00:52 -0500 (EST)

Once more into the breach... 

On Thu, 25 Nov 1999, chefren wrote, commenting on Ed Stone's message:
<. . . .>
> are in charge and what's the difference?

They, meaning the government, don't own the Internet, either.  And in mnay
countries, the government doesn't own the telephone system.  MIT owns its
internal computer network, and can hire people to monitor it and keep it
running properly.  It is a private network, subject to the owner's rules.

> necessary at all. (And law enforcement wasn't necessary 

'Audit' and 'warrant' don't necessarily go together, just like 'tapping'
and 'audit' don't go together.  If the IETF were to design protocols to
facilitate tapping, what would stop someone from using them without any
auditing whatsoever?  Rules written down in a book somewhere?  Who will
watch the watchers? 

> democratically constituted rules.

Users of MIT's private, internal network agree to the terms of use, or
they don't get to use the network.  MIT network administrators
don't need warrants to monitior their own network, just like you don't
need a warrant to monitor your own workstation - it is yours to do with as
you please.

Simple concept, isn't it, this private ownership of networks?  Does it
apply to the Internet or to the IETF's business?  

> different than privacy elsewhere.

Privacy is privacy.  I am opposed to the IETF making it easier to violate
the privacy of Internet users, whether in the name of law enforcement,
national security, or historical precedent.  Let's take a stand now, even
though the privacy battle is lost on so many other fronts.  The fact that
privacy is soon to be a thing of the past makes me want to more vigorously
protect what little I have left.

---

From: Ed Stone <[email-masked]>
Date: Thu, 25 Nov 1999 17:33:58 -0500

>democratically constituted rules.

Possibly private property is a foreign concept to some. Let me boil it down:

You own a computer. You decide to open your file on your computer and read 
it on your screen.

The government does not own your computer, nor the file in question. It 
decides to open your file without your permission, and without notifying 
you, and to read it.

To look into your own computer, you will not need a warrant, legally or 
morally.

For the government to look into your computer....

Get it now?

---

From: "chefren" <[email-masked]>
Date: Mon, 29 Nov 1999 23:46:31 +0100

On 25 Nov 99, at 13:55, Ray Yang wrote:

> anything done to support tapping would mean creating a standard for
> tapping. Since such a standard could not include legal remedies (because
> the IETF has no legal power), the standard would have to be primarily
> technical in nature. A technical standard would be something like a 1-2-3
> process for tapping -- which would make it easier than it is now.

Not necessarilly =easier=!!! Technicians have concluded 
long time ago, nothing is more easy than tap with the 
tcpdump utility that's widely available.

Since that's not very auditable it's not very usefull in 
court.

> To be
> redundant, the process would be standardized -- made easy, and massively
> reproducible. Maybe it won't initially be as easy as a point-and-click,
> but given the capabilities of modern computers to automate lots of tasks,
> I don't see how such a standard, if introduced, could be prevented from
> going there. 

Yes!

+++chefren

= =
ii.nl ontwerpt, bouwt én onderhoudt websites
100 Euro aanbrengpremie: http://www.ii.nl/premie

---

From: "chefren" <[email-masked]>
Date: Mon, 29 Nov 1999 23:55:04 +0100

> For the government to look into your computer....

They need warrants according to laws and the executive 
people have to stand behind it and they can be judged upon 
it. > Get it now?  

Yes. If law would allow places to hide for organized crime 
law enforcement cannot do anything against the most vicious 
part of crime.  

+++chefren

= =

---

From: "Thomas Junker" <[email-masked]>
Date: Mon, 29 Nov 1999 19:31:43 -0600

On 29 Nov 99, at 23:55, chefren wrote:

> it. 

Yes, more or less.  You mixed up what Ed was commenting 
on, though.  Funny how you do that, isn't it?  You had 
expressed doubt or confusion over the difference between 
monitoring by owners or agents of a system or network and 
monitoring by outsiders such as govermnent.  You didn't 
seem to understand that different rules apply, and that if 
you use someone's private property, you are subject to 
their rules, within certain limits.

> law enforcement cannot do anything against the most vicious 

To say "If the law would allow places to hide..." you 
*have* to be reasoning from the common European viewpoint 
that one is "allowed" to do only that which government 
authorizes.  The U.S. system is quite the opposite: we do 
anything we damn well please *except* those limited things 
the government has legitimately and constitutionally 
prohibited.  The notion of privacy is built in to our 
heritage, while it probably has to be explicitly 
legislated in Europe.  The concept of "If the law would 
allow" is foreign to us as free people.  Here, in general, 
the law does not "allow," it only "prohibits," and can 
only do that legitimately where its enumerated powers 
granted by the people give it the authority to do so.  At 
the risk of overstating the principle, in the European 
model, that which the law does not explicitly allow, is 
prohibited, and in the U.S. model, all that the law does 
not explicitly prohibit is by definition "allowed."

Moreover, *most* of life's activities are beyond the scope 
of either the European model to "allow" or the U.S. model 
to prohibit.  Therefore, no matter what provisions are 
made for wiretapping, criminals will always be "allowed" 
in all places to use cars, to eat food, to breathe air, to 
conduct their activities behind closed, opaque doors, to 
get their hair cut, to twiddle their thumbs, to kick cats 
in private, to raise their children properly or badly, to 
be lazy or energetic, to change their minds, to speak in 
tongues no one else understands, to use the position of a 
flowerpot in the window to signal their compatriots that 
the bank robbery is on for tonight, to keep information in 
their heads instead of writing it down where others can 
find it and use it against them, to speak and write 
indirectly in informal cypher, to use real encryption and 
hide it invisibly in other information regardless of what 
the law says, etc. etc. etc.  

The more effective and widespread wiretapping becomes, the 
more it will drive illicit communication to channels and 
modes ever more difficult to detect, intercept, or 
decipher.  If, in the process, all the truly clueless 
criminals are bagged, all that will have been accomplished 
at the huge cost of destroying privacy will be to use 
natural selection to weed out the stupid criminals, 
raising the bar to criminal survival and leaving only 
really clever criminals.  After a period of adjustment, 
wiretapping will be just as ineffective as it would have 
been if it had never had so much access to traffic in the 
first place, but all the honest people's lives will be an 
open book.

You are fanatically addressing one small aspect of how 
illicit activity may "hide."  Wake up.  The world and its 
possibilities are far wider than your vision.

Regards,

Thomas Junker
[email-masked]

The Unofficial Wang VS Information Center
http://www.phoenix.net/~tjunker/wang.html

---

From: "chefren" <[email-masked]>
Date: Wed, 1 Dec 1999 01:04:28 +0100

On 29 Nov 99, at 19:31, Thomas Junker wrote:

> authorizes.

Sorry my wordings lead to misconception. We may do whatever 
we want that's not forbidden by laws.

> The U.S. system is quite the opposite: we do 
> prohibited.

OK I think that's just fundamental law. According to United 
Nations declarations. You can never by punished for 
something that wasn't punishable on the moment you did it.

> The notion of privacy is built in to our 
> legislated in Europe.

As you could have heard from some news agencies: European 
privacy laws go pretty much further than American ones.

> The concept of "If the law would 
> allow" is foreign to us as free people.

I should have used the word "left" I guess. Again sorry.

Try again: "If the law would leave places for organized 
crime to hide".

Still it's just a saying of course.

..

..
 
> decipher.

Sure, so new measures will be necessary in the future. 
There is nothing new here.

..

> After a period of adjustment, 

Why? The book will only open if there are warrants that 
meet strict guidelines made up by laws.

(As houses in the US are only entered after comparable 
guidelines are met, why all "Angst"???)

> possibilities are far wider than your vision.

I don't think my vision is even as near as you try to 
explain to others here. Maybe we should arrange a virtual 
"shoot out"? Can someone arrange a quiz with questions that 
measure how much a person knows and understands from this 
world? I would be very happy to meet and amaze you.

I'm also not very happy with making me subject. Please come 
with thinkings or arguments and leave my person out. 

Respect my privacy...

+++chefren