Subject: [Raven] View From 20,000 Feet

From: "Richard Payne" <[email-masked]>
Date: Tue, 9 Nov 1999 16:24:31 -0500

After four weeks and 700 postings, I think it's safe to draw some general
conclusions about the Raven list. Here's my view from 20,000 feet:

1) Most list participants strongly oppose any IETF involvement in
wiretapping, whether by setting an IETF standard for it or by weakening the
security of existing protocols. Some participants oppose tapping involvement
on moral grounds, some oppose it on practical grounds, some on both.

2) Telecommunications carriers generally comply with national laws requiring
them to perform tapping for law enforcement authorities under certain
conditions. The minority of list participants supporting tapping tend to
have a telecom background. This is not to suggest that everyone who works
for a telecom supports tapping, since that is far from the case.

3) Those against tapping tend to be vehement in their opposition: those in
favor of tapping tend (with one or two notable exceptions) to be lukewarm in
their support.

4) It is generally agreed that widespread deployment of strong end-to-end
encryption, together with something like onion routing, will reduce the
scope for law enforcement to conduct taps, regardless of how much
cooperation they get from telecoms.

5) Some list participants have suggested that the IETF has no choice but to
bow to national laws that allegedly already require tapping the Internet.
This "legal requirement" argument, examined closely, does not seem to hold
up, either for the US (CALEA exemption for information services) or the EU
(Enfopol '98 being dropped).

6) Many list particpants consider such a "legal requirement" argument
invalid in any case, citing RFC 1984 as a precedent for "doing the right
thing" from a security viewpoint regardless of whether national laws have
caught up yet.

Richard Payne

_______________________________________________
raven mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/raven

---

From: "chefren" <[email-masked]>
Date: Tue, 9 Nov 1999 22:36:47 +0100

> cooperation they get from telecoms.

It's not upon IETF or even us to argue about "reducing the 
scope", it's like a fingerprint that's not the 3d 
presentation of a crime: If democracies decide law 
enforcement needs a tap even with in practice 100% of the 
communication end to end encrypted we have to obey that.

+++chefren

= =
ii.nl ontwerpt, bouwt én onderhoudt websites
100 Euro aanbrengpremie: http://www.ii.nl/premie

---

From: "Thomas Junker" <[email-masked]>
Date: Wed, 10 Nov 1999 00:44:38 -0600

On 9 Nov 99, at 22:36, chefren wrote:

> scope", 

He wasn't arguing about "reducing the scope" -- he was 
making an observation.  It's as if you were arguing in the 
telegraph age that standards were needed for body searches 
at the borders to prevent unauthorized capital flows in 
and out of countries, and Payne had observed that "It is 
generally agreed that widespread deployment of telegraphs 
will allow people to move funds without carrying banknotes 
on their persons, so it's all pretty much pointless."  
That is not arguing for or against a principle, it is 
pointing out what the author believes is a fact that 
undermines your position.

But your position is still off topic.

> it's like a fingerprint that's not the 3d 

You're confused about who has to obey what.  If 
democracies everywhere decide that telcomms have to 
deliver bit streams directly to the court in real time, 
there is nothing in that that I have to obey unless I am a 
telecomm company.  If democracies decide that law 
enforcement needs to tap phones or data or VoIP or 
whatever, the IETF does not have to "obey" that because 
the IETF is not a law enforcement agency nor a telecomm 
nor a vendor of telecomm equipment.  The IETF is free to 
ignore such decisions.  The IETF formulates protocols and 
standards, and people use them or not as they wish.  It 
makes little difference to the truth of that if some 
telecomms somewhere wish they had a standard for building 
equipment for the benign but wiretap-crazy Dutch or the 
malevolent and wiretap-crazy North Koreans.

And proposing protocols on the Raven list is still, IMO, 
off topic.

Regards,

Thomas Junker
[email-masked]