Subject: [Raven] aclu letter on wiretapping and the internet

From: Barry Steinhardt <[email-masked]>
Date: Fri, 05 Nov 1999 13:23:19 -0500

Please excuse the intrusion of a non list member. Scott Bradner asked me to 
forward the ACLU's letter on the wiretapping issue to your list.

Barry Steinhardt

November 5, 1999

Mr. Fred Baker
Internet Engineering Task Force Secretariat
c/o Corporation for National Research Initiatives
1895 Preston White Drive
Suite 100
Reston VA 20191-5434

         Re: Wiretapping and the Internet

Dear Mr. Baker:

I am writing on behalf of the American Civil Liberties Union (ACLU) and its 
approximately 300,000 members.

The Internet Engineering  Task Force(IETF) has been studying whether to 
conform network technology with the requirements of the Communications 
Assistance to Law Enforcement Act (CALEA). The proponents of this move, 
including the Federal Bureau of Investigation argue that law enforcement 
needs built in surveillance capacities and that CALEA may require this 
compliance.

The ACLU urges the IETF to reject these calls, and to emphasize that the 
plain language of CALEA, as well as the legislative history, make it quite 
clear that the Federal government cannot require Internet architecture to 
be CALEA compliant.

CALEA was originally enacted in 1994. Its proponents argued that the Act 
was necessary to help law enforcement keep pace with technology. The FBI 
claimed that it sought no new powers, but only to preserve their existing 
communications surveillance capabilities.

         Under its provisions, telecommunications companies must build 
wiretap capabilities into their systems. Among other things, the Act states 
that telecommunications carriers generally shall ensure that the government 
can intercept communications and get caller identification information (see 
47 U.S.C. § 1002(a)). The Act also applies to telecommunications equipment 
manufacturers, who are to consult and cooperate with carriers to ensure 
compliance with the needs of law enforcement (see 47 U.S.C. § 1005).

         CALEA contains a number of exemptions. The statute explicitly 
provides that the general compliance requirements “do not apply to -
·       (A) information services; or
·       (B) equipment, facilities, or services that support the
transport or switching of communications for private networks
or for the sole purpose of interconnecting telecommunications
carriers.” (See 47 U.S.C. § 1002(b)(2).)

         In addition, the statute contains a definition of 
“telecommunications carrier” which “does not include persons or entities 
insofar as they are engaged in providing information services” (see 47 
U.S.C. § 1001(8)(C)). This definition has the effect of excluding 
“information services” providers from having to submit to CALEA’s conditions.

         The question that then arises is: what are “information services”? 
According to the Act, “The term ‘information services’ -

·       (A) means the offering of a capability for generating,
acquiring, storing, transforming, processing, retrieving,
utilizing, or making available information via
telecommunications; and
·       (B) includes -
·       (i) a service that permits a customer to retrieve stored
information from, or file information for storage in,
information storage facilities;
·       (ii) electronic publishing; and
·       (iii) electronic messaging services; but
·       (C) does not include any capability for a telecommunications
carrier's internal management, control, or operation of its
telecommunications network.” (See 47 U.S.C. § 1001(6).)

         This portion of the statute essentially describes the key 
functions of the Internet, which allows individuals to retrieve stored 
information (e.g. FTP or Gopher), as well as engage in electronic 
publishing (such as the World Wide Web) or send electronic messages 
(including e-mail). Furthermore, the Act’s definition of “electronic 
messaging services” leaves no doubt that this exemption was meant for the 
computing world; under this definition, ''electronic messaging services'' 
are “software-based services that enable the sharing of data, images, 
sound, writing, or other information among computing devices controlled by 
the senders or recipients of the messages.”  (See 47 U.S.C. § 1001(4).) 
This close similarity between the CALEA’s description of “information 
services” and the functions of the Internet is not just a coincidence. It 
is a clear indication that CALEA exempts the Internet and its constituents 
from having to comply with statute’s stringent wiretapping requirements.

         The legislative history of CALEA also bears out the fact that 
Congress never intended the statute to apply to the Internet. When Congress 
discussed the bill, it was noted that:

“The term ‘information services’ encompasses both electronic 
publishing...and electronic messaging services, which is a term broadly 
defined to encompass electronic mail, electronic forms transfer, electronic 
document interchange, and electronic data interchange.” (See 140 CONG. REC. 
H10780 (daily ed. October 4, 1994) (statement of Rep. Markey).) (Emphasis 
added.)

These discussions also show that Congress intended the bill to apply, not 
to the Internet, but to:

“such service providers as local exchange carriers, interexchange carriers, 
competitive access providers [CAPs], cellular carriers, providers of 
personal communications services(PCS), satellite-based service providers, 
cable operators and electric and other utilities ...” (See 140 CONG. REC. 
H10779 (daily ed. October 4, 1994) (statement of Rep. Hyde).)

         In addition, it should be noted that CALEA has been amended (see 
General Accounting Office Act of 1996, Pub. L. 104-316, § 126(b), 110 Stat. 
3826, 3840 (1996)). However, Congress did not remove or otherwise change 
the exemption for “information services” when it added the amendments. If 
Congress intended the Internet to comply with CALEA’s requirements, it 
surely would have taken the opportunity to say so. The fact that this 
opportunity was not taken is further evidence that Congress did not intend 
the Act to apply to cyberspace.

In short, the providers of Internet services are not required to comply 
with CALEA and the IETF is under no obligation to assist law enforcement in 
bringing Internet services into compliance with CALEA.  As Rep. Bob Barr’s 
letter to you indicated, there is also substantial opposition in the 
Congress to any extension of CALEA to the Internet and, in fact, I am not 
aware of any bills which have been introduced that would remove the 
exemption for “information service providers” or that purport to require 
Internet services to become CALEA compliant.

It also seems evident that built in surveillance capabilities would violate 
the terms of the European Privacy Directive (97/66/EC of 15 December 1997), 
which provides that telecommunications services "must take appropriate 
technical and
organizational measures to safeguard security of its services."

Beyond question of law, it would be a serious mistake to alter the very 
architecture of the Internet to make it wiretap or surveillance ready. What 
law enforcement is asking you to do is the equivalent of requiring the home 
building industry to place a “secret” door in all new homes to which only 
it would have the key. That is a frightening extension of the proposition 
that an industry is required to cooperate with law enforcement when it has 
obtained a proper judicial order.

         Just as a secret door would add a new level of insecurity to our 
homes that could be exploited by criminals, so too would built-in law 
enforcement access add new levels of insecurity that could be exploited by 
information pirates and thieves.

         I also urge you to consider the FBI’s broken promises about CALEA 
before you jump to accommodate them.  The FBI has repeatedly violated its 
promises to Congress and the telephone industry that it would not seek 
expanded surveillance powers, but only sought to preserve its existing 
surveillance capabilities.

         For example, the FBI has sought the capability to use cellular 
telephones as tracking devices. In its so-called “punch list”, the FBI 
sought expanded access to post connection digits dialed by telephone 
customer. It demanded the right to stay on conference call even after the 
subject of its wiretap order is off the call and  sought a whole series of 
expensive signaling requirements. Most extraordinarily, the FBI has 
proposed a series of capacity notices, that, in their most extreme form, 
would have required the telephone industry to provide it with the capacity 
to simultaneously tap in every telephone line in major urban areas like New 
York.

         Once you begin the process of building surveillance features into 
the Internet, you will open Pandora’s box to an ever increasing demand for 
services  from law enforcement, and you will be consigning service 
providers to a future of unknown, but undoubtedly significant, costs. The 
ultimate irony for service providers would be that, since they do not come 
under the terms of CALEA, they would not even be eligible for limited cost 
reimbursements offered by the law to the telecommunications carriers.

         I hope you will find this material of interest, and I am happy to 
answer any questions you might have.

Sincerely,

Barry Steinhardt
Associate Director

Cc: Dr. Scott Bradner--Transport Area Director--<[email-masked]>

Barry Steinhardt
Associate Director
American Civil Liberties Union
125 Broad St
NY,NY 10004
212 549 2508 (v)
[email-masked]
Barry Steinhardt
Associate Director
American Civil Liberties Union
125 Broad St
NY,NY 10004
212 549 2508 (v)
[email-masked]

---

From: "Brett Wooldridge" <[email-masked]>
Date: Fri, 5 Nov 1999 15:01:04 -0600

Thank you, thank you, thank you!  And God bless the
American Civil Liberties Union (I think I'll join, now).

To re-iterate my favorite part of the ACLU position letter, which
to my suprise mirrors almost exactly the sentiments of my
last post:

  Beyond question of law, it would be a serious mistake
  to alter the very architecture of the Internet to make it
  wiretap or surveillance ready.  What law enforcement is
  asking you to do is the equivalent of requiring the home
  building industry to place a "secret" door in all new homes
  to which only it would have the key.  That is a frightening
  extension of the proposition that an industry is required to
  cooperate with law enforcement when it has obtained a
  proper judicial order.

  Just as a secret door would add a new level of insecurity
  to our homes that could be exploited by criminals, so too
  would built-in law enforcement access add new levels of
  insecurity that could be exploited by information pirates
  and thieves.

I couldn't have put it better.  Any wiretap capability we add to
a protocol is useable not only by the FBI, Scotland Yard, and
Interpol, but also useable by organized crime and garden
variety despotic rulers (with garden variety despotic goverments
under their control).

Security means SECURITY, dammit, it's either wiretap friendly
to the world, or to nobody, including LE.  I'll take "nobody".  If we
don't secure our protocols, from wiretap and even traffic analysis,
the Internet robberies, and incidences of espionage of the future
will make a $20 million Brinks armored car robbery look like
pocket change.

Do you think the communications between the Whitehouse and the
Pentagon, or between the NSA and Pine Gap, are tappable?  Not
in a million years.  Why should the government, who has shown itself
largely unworthly of our trust, enjoy secure communications, while
we're left twisting in the wind?  The private sector (that's us) PAYS for
the government.  THEY are responsible to US.  They WORK for US.
If WE say no wiretap, guess what?  NO FLIPPING WIRETAP.

Brett Wooldridge

_______________________________________________
raven mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/raven

---

From: James Carlson <[email-masked]>
Date: 05 Nov 1999 16:03:54 -0500

[email-masked] (Barry Steinhardt) writes:
> I am writing on behalf of the American Civil Liberties Union (ACLU) and its=
> =20

I am one of those members, and although I agree that the IETF should
certainly reject the call for wiretapping, I also think the situation
is far more murky than your letter suggests.

First, there's the problem of voice carriage on IP (not necessarily
"the Internet," but also private IP-based networks).  It is possible,
for instance, that if a interexchange carrier were to replace its
circuit-switched long lines with a private, IP-based network and use
VoIP (voice over IP), then this network and the equipment on it would
be subject to CALEA.  (I am not a lawyer!)

Second, there's the problem that the IETF is not a US group.  It's
international in scope.  Different systems of laws and different
standards apply in different countries.  The specific terms of CALEA
are peculiar to the US and might not have bearing on the issue.

Finally, there's the problem of the IETF goals.  One of them is to
promote strong encryption.  Poking a hole in this goal is no small
matter.

As I said, I completely agree with you that the calls to modify
existing and proposed IETF protocols to support wiretapping should be
rejected.  It's only the legal situation of the equipment
manufacturers and network providers that's much less clear.

-- 
James Carlson, System Architect                     <[email-masked]>
IronBridge Networks / 55 Hayden Avenue   71.246W   Vox:  +1 781 372 8132
Lexington MA  02421-7996 / USA           42.423N   Fax:  +1 781 372 8090
"PPP Design and Debugging" --- http://people.ne.mediaone.net/carlson/ppp

---

From: "Brett Wooldridge" <[email-masked]>
Date: Fri, 5 Nov 1999 15:30:50 -0600

----- Original Message ----- 
From: James Carlson <[email-masked]>

> is far more murky than your letter suggests.

<snip>
 
> manufacturers and network providers that's much less clear.

And I completely agree with you.  The best solution is for the IETF
(who is CLEARLY not subject to CALEA, for a variety of reasons, not
the least of which is that it is an international organization) to engineer
a standard which CANNOT POSSIBLY satisfy the requirements of
CALEA.  By that I mean using non-escrowed strong encryption and
whatever anti-traffic analysis wrenches can be thrown in.  In this way,
when and if the congress-critters get around to attempting to require
wiretap of IP, the equipment manufacters will have the opportunity to
point out that doing so is a technical impossibility given the latest IETF
protocols.  And unless congress is willing to require that the private
sector eat the multi-billion dollar cost of "retooling" software, switches,
and God knows what else, they will simply have to "give a miss" on
such a law.

Brett Wooldridge

---

From: "chefren" <[email-masked]>
Date: Mon, 8 Nov 1999 21:59:09 +0100

> manufacturers and network providers that's much less clear.

Maybe we should vote about this. I don't think there is 
anyone for modification of existing and even proposed IETF 
protocols here. So discussion about backdoors in protocols 
seems totally out of the question.

+++chefren

=Large signature follows=

I think we need a simple architecture for a point
to point tap interface that has strong provisions
against misuse.

On one side the communication provider who only
starts tapping a specific customer or IP number
with proper warrants.

On the other side the approved tapping room.
Everything should be organized by the central
"tapping office". This office should provide
keys for strong encryption to both communication
provider and tapping room.

Law and technology should both provide as
much checks and balances as we can come up
with. Law can provide good procedures,
technology can provide technical means to
check them or force them.    

=Large signature ended, please comment me
off-line to make it better=

---

From: "chefren" <[email-masked]>
Date: Mon, 8 Nov 1999 21:56:29 +0100

On 5 Nov 99, at 15:01, Brett Wooldridge wrote:

>   to which only it would have the key. 

Sorry you are plain wrong. "The minority[0]" here has 
=nowhere= argued for "backdoors in the Internet" or 
"secret" doors in al new homes or old homes or whatever.

Tcpdump exists and "the minority[0]" only ask for a 
standard that defines an auditable version of it.

+++chefren

[0] Outside the techie community definitely a democratic 
majority, at least in Europe.
= =
ii.nl ontwerpt, bouwt én onderhoudt websites
100 Euro aanbrengpremie: http://www.ii.nl/premie

---

From: James Carlson <[email-masked]>
Date: 08 Nov 1999 18:34:42 -0500

> seems totally out of the question.

Wrong again.  Did you read the questions posed by the IESG before
posting to the list?  The discussion here is about whether to damage
existing security for the aid and comfort of LEAs.  That's the
beginning and end of it.  *NOBODY* but you, chefren, is here to talk
about any sort of "auditable tapping standard" silliness.  I
understand that this is your baliwick, but it has nothing to do with
the charter of this mailing list, and no flood of off-topic messages
will somehow turn this into your forum.

If you think that adding some sort of encumbrance to tcpdump is a good
thing and you can somehow get your local LEAs to use this rather than
unencumbered garden-variety tcpdump, then that's just super.  You
should do it.  But be aware that it's absolutely irrelevant to the
goals of the other members on the list, the IETF, or the list itself.

And, before you say it, no.  It's not the case that I already agree
with you but that I just don't realize it.  Nope.  I just don't agree
with you at all.

---

From: "Lyal Collins" <[email-masked]>
Date: Tue, 9 Nov 1999 11:36:50 +1100

There is strong validity in the assumption that technology can be misused
and abused - many have already noted that in recent messages.

Putting the capability for "checks and balances" into standards would have a
positive effect by
"keeping the bastrads honest"  (a common Australian term).

A consequence could be that of allowing a defendant to query the court on
the validity of the evidence presented - is it backed by credible audit data
that shows the person(s) involved, date, time, the relevant warrant etc.
If the prosecution can't show such evidence, it adds doubt to their case at
worst; at best, it results in "case dismissed".
The Munden case in the UK was such a case, when Munden was acquitted after
the bank accusing him of fraud was unable/unwilling to prove their systems
could not have been subverted by someone inside the bank - a point the bank
had based it's case on.

Hence, I would think there is strong potential for constitutional challenges
to show the source and credibility of the technically gathered evidence.
They question the relibility of other forensics tools - why is wiretap so
different.

I also think courts are starting to take into account

So, on that basis, I can't agree with the claim nobody agrees with
chrefren - some of us are  expressing it differently, and we end up in
violent agreement as a consequence.

Regards,
Lyal
Virtual Business Associates    ECommerce Strategies and Internet Security
ACN 083 334 052
Ph;    02 9712 0205      Fax;    02 9712 0467      Mobile;   0416 097 120
1/37 Walton Crescent  Abbotsford NSW 2046    Australia

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On Behalf Of
> James Carlson
> Sent: Tuesday, 9 November 1999 10:35
> To: [email-masked]
> Subject: Re: [Raven] aclu letter on wiretapping and the internet
>
>

---

From: "Thomas Junker" <[email-masked]>
Date: Tue, 9 Nov 1999 00:01:43 -0600

On 9 Nov 99, at 11:36, Lyal Collins wrote:

> There is strong validity in the assumption that
> technology can be misused and abused - many have already
> noted that in recent messages. 
> 
> Putting the capability for "checks and balances" into
> standards would have a positive effect by "keeping the
> bastrads honest"  (a common Australian term). 

The IETF is in no position to put checks and balances into 
the conduct of wiretapping.  Only national legislatures, 
executives and courts can do that, and only then if they 
are so inclined.  

> A consequence could be that of allowing a defendant to
> query the court on the validity of the evidence
> presented - is it backed by credible audit data that
> shows the person(s) involved, date, time, the relevant
> warrant etc. If the prosecution can't show such
> evidence, it adds doubt to their case at worst; at best,
> it results in "case dismissed". 

You should take your arguments to a legal discussion 
forum.  Nothing you are saying has any bearing on the IESG 
questions put to the IETF on the policy issue of whether 
or not the IETF should facilitate wiretapping in 
formulating Internet protocols.

Do you get it yet?

> Hence, I would think there is strong potential for
> constitutional challenges to show the source and
> credibility of the technically gathered evidence. 

You are apparently unaware that some countries have no 
constitution at all; that others completely ignore 
supposed protections of "rights" in their constitutions; 
and that still others use Newspeak to twist their 
constitutional limitations into useless pretzels.  You 
need to get out more.

And it still has nothing to do with the topic here.

> They question the relibility of other forensics tools -
> why is wiretap so different. 

You are hereby assigned to fund your own field trip to the 
People's Republic of China, to get yourself into some 
court situation there, and to question the reliability of 
some forensic tool or other.  In twenty years or so you 
can report back to us on the results of your experiment.

If you cannot afford the time and the twenty years, you 
are allowed to substitute Red Corner, the movie with 
Richard Gere and Bai Ling about an American businessman 
framed for murder in China.  It's not a documentary but 
it's probably not far from what happens there except that 
the happy ending is probably pure fantasy.

> I also think courts are starting to take into account

What courts????  The PRC's courts?  Cuba's courts?  
Madagascar's courts?  North Korea's courts?  Russia's 
courts?  How about Chechnya's courts?  Do you think there 
are many weighty arguments of this type in Chechnya?  What 
about Afganistan?  Iraq?  Libya?  Saudi Arabia?

> So, on that basis, I can't agree with the claim nobody
> agrees with chrefren - some of us are  expressing it
> differently, and we end up in violent agreement as a
> consequence. 

Two is not a crowd, and in any case I have so far seen no 
indication that you or chefren understands the topic here 
or even that there is a topic.  There is.  It was posted 
in the first message to the list when the list was 
created.

Regards,

Thomas Junker
[email-masked]

The Unofficial Wang VS Information Center
http://www.phoenix.net/~tjunker/wang.html

---

From: "chefren" <[email-masked]>
Date: Tue, 9 Nov 1999 21:43:15 +0100

On 9 Nov 99, at 0:01, Thomas Junker wrote:

..

> formulating Internet protocols.

No. I still see you and others arguing that I say or want 
things that I totally don't want.

For example: I have NEVER said IETF should facilitate 
wiretapping in formulating Internet protocols.

I want the IETF to formulate ONE tap-protocol. A standard 
that defines tapping from a standard IP stream and 
transporting it in a secure way to the tapping room of law 
enforcement. A far more difficult way to tap than with the 
readilly and omnipresent available tcpdump utility.
 
> supposed protections of "rights" in their constitutions; 

Its not important that crooks exist, thats just a fact why 
law enforcement exists, it's important that a standard 
auditable tap exists, the only way I see to have taps as a 
multitude of democracies want and data that isn't 
tampereded with and privacy of the tapped that isn't abused 
a little more than necessary.

> constitutional limitations into useless pretzels.  You 

Stop saying things tap apparently point at yourself. Go out 
to a court and imagine a tap used in a case and think how 
stupid it would be when tcpdump was used instead of a 
secure version of it.

> And it still has nothing to do with the topic here.

I think it has. I also think IETF has opened this 
discussion to get further than the "encryption is out of 
the bottle so tapping is stupid" discussion.

Although it's up to democracies to decide: Even an 
encrypted message is important for law enforcemement as are 
fingerprints without a 3d video presentation of a criminal 
case. It's not up to you or me or IETF to decide if taps 
should be legal, thats upon democracies.

But it's quite simple to say that IF taps exist auditable 
taps are technically superior and IETF can define a 
standard for it.

(NO I didn't say anything about backdoors or modifications 
in existing standards!)  

..

> the happy ending is probably pure fantasy.

(I think this was very stupid and irrelevant text)

> about Afganistan?  Iraq?  Libya?  Saudi Arabia?

All examples of bad courts, Yes you are right!

But is it important? No. Those guys also have no problems 
with chemical plants that distribute dioxin.

There are however countries that care about 1 molecule in 
1.000.000 or even 100.000.000.

And so there are countries that want data that isn't 
tampered with in their courts and that's only possible to 
obtain with good, and open standards.

> or even that there is a topic.

So you don't see what we mean, we admit that.

> There is. It was posted in the first message to the list
> when the list was created. 

   http://www.ietf.org/mail-archive/working-groups/raven/cu
   rrent/msg00000.html 

   "should the IETF develop new protocols or modify
   existing protocols to support mechanisms whose primary
   purpose is to support wiretapping or other law
   enforcement activities" 

Essentially two questions in the first paragraph. Answers:

No modification of existing protocols (no backdoors) and 
yes one (1) new protocol that supports the citizens that 
are wiretapped against abuse by encrypting the tapdata and 
making sure the tap is an exact copy of the real data of 
the tapped (encrypted or not) and that all relevant 
circumstances of the tap are preserved.

+++chefren

= =

---

From: Johnny Eriksson <[email-masked]>
Date: Tue, 9 Nov 1999 22:14:15 +0100 (MET)

On Tue, 9 Nov 1999, chefren wrote:

> I want the IETF to formulate ONE tap-protocol. A standard=20
> that defines tapping from a standard IP stream and=20
> transporting it in a secure way to the tapping room of law=20
> enforcement. A far more difficult way to tap than with the=20

It seems to me that the IETF itself does not want to formulate this
protocol.

Maybe you should start thinking about doing it yourself, since we
won't.

--Johnny