Subject: Not just GAK: RE: [Raven] Summary of Observations

From: "Paul A. Lambert" <[email-masked]>
Date: Mon, 01 Nov 1999 09:15:48 -0800

At 10:09 AM 11/1/99 +1100, Lyal Collins wrote:
>I take small issue with point 12 ie
> > 12)  The IETF thought that law enforcement should investigate e-Crimes in
> > "meat-space."  Therefore, there was no need to detemine what constituted
> > e-Fingerprints or e-Footprints of e-Criminals, because they don't exist.

But they do exist.  MAC addresses, IP addresses, board serial numbers, on-line
software product registration all represent unique metrics that bind us to our
computers.

>The electronic fingerprints, footprints do exist, they just can't be
>reliably attributed to anyone, without stepping outside a "monitoring"
>context and into phone and ISP logs.

No. Every time we make a electronic purchase, on-line information can be 
gathered
that ties our physical identity to our electronic footprints.

>Before going further, an attribution system is needed, either within this
>environment, or paralle to it.
>- reliable machine indicators (which has shades of the Intel chip hysteria)
>- reliable user indicators (which has indications of privacy impact)

There are circumstances that attribution is critical, but it should not be 
a part of our
everyday web browsing.  If I remotely manage a commercial web site an audit
log and strong authentication makes sense.  Having every URL that I browse
or every phone number I call logged and correlated and examined to see
if I match a criminal profile is unacceptable.

Government access is not just GAK.

Paul

_______________________________________________
raven mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/raven

---

From: William Allen Simpson <[email-masked]>
Date: Mon, 01 Nov 1999 13:13:20 -0400

[email-masked] wrote:
> 
> Dear raven mail list,
> 
> Some are calling for an end to the discussion.  However, I have not yet seen
> any conclusions listed.  So rather than let the discussion end like a talk
> show, I propose to summarize what I have observed and let the group add,
> modify, or ignore them, which in any case would be telling.  So here goes ...
> 
> 1)  The IETF determined that there were many bad governments, but could not
> determine if there were any good governments.
> 
> 2)  The IETF determined that each country has its own laws.  (don't lose your
> sense of humor)
> 
> 3)  The IETF determined that bad governments do not currently have the tools
> to do electronic surveillance and won't until the IETF creates some for them.
> 
> 4)  The IETF determined that no one is currently intercepting packets and
> possibly violating privacy on the Internet for either intelligence, law
> enforcement, network management, hacking, or any arbitrary reason.
> 
> 5)  e-Commerce was accepted as a given.
> 
> 6)  The IETF determined that there were no e-Criminals.
> 
> 7)  The IETF determined that even if there were e-Criminals, those people do
> no one harm because there is no connection between cyberspace and the real
> world.
> 
> 8)  The IETF determined that planning and issuing commands to subordinates
> does not (or should not) constitute a crime under any circumstances.
> (references to Nuremburg notwithstanding)
> 
> 9)  The IETF does not think that there should be e-Cops.
> 
> 10)  The IETF thought that the tools they possessed and used should not be
> trusted with the police (because they are human and fallable).
> 
> 11)  The IETF did not attempt to determine whether e-Consumers would trust
> e-Commerce without e-Cops.
> 
> 13)  The IETF determined that the current state of Internet security and
> privacy was adequate.
> 
> 14)  The IETF determined what consituted "unreasonable" search and seizure
> (see 4th Amendment of U.S. Consitution), but did not attempt to determine
> what constituted "reasonable" search and seizure.
> 
> 15)  The IETF was not clear what law enforcement's requirements were, but
> that did not hinder the debate in anyway.
> 
> 16)  The IETF did not make any distinctions between telecommunications
> services and information services, and did not make any distinctions between
> private services and public services, which might be germane to the law.
> 
> 17)  The IETF detemined that its technical specifications were above the laws
> of any country.
> 
> 18)  The IETF did not attempt to determine whether the Internet was a vital
> part of the public infrastructure (worthy of active protection) or the
> private playtoy of an elite group of technicians.
> 
> 19)  There were some technical discussions concerning encryption, tap rooms,
> etc., but no conclusions.
> 
> 20)  The IETF determined that the Internet was not a reflection of the real
> world with all its imperfections, and would therefore draw no parallels
> between the needs of the two, but would reinvent cybersociety unencumbered by
> existing social structures or past human history.
> 
> 21)  The IETF determined that a technology should not be developed if there
> was the possibility that it could be used for evil purposes.  (or maybe that
> depends on what the technology is and whose evil purposes are served)
> 
> If there were any conclusions that I missed, please add them.  

22) The participants advocating wiretapping were not conversant with 
terminology or current state of the art of cryptography.

23) The participants advocating wiretapping were discovered to be 
motivated by hidden commercial or law enforcement agendas, and were 
not ethical in disclosure.

24) The anonymous poster of items 1 to 21 was not familiar with the Tao 
of the IETF, nor the organization of the IETF, and the items were not 
supported by any factual basis, and may therefore be disregarded.

[email-masked]
    Key fingerprint =  17 40 5E 67 15 6F 31 26  DD 0D B9 9B 6A 15 2C 32