Subject: Re: [Raven] Fly away, raven

From: "Brett Wooldridge" <[email-masked]>
Date: Tue, 2 Nov 1999 00:09:40 -0600

Sorry for jumping into the middle of this discussion, but I just
joined the list.

I guess the questions I have are:

1) What is stopping the IETF from ignoring government X's
    regulations on wiretap, and coming up with a standard
    this is tap-proof? 

2) Given that such a ursurpous standard emerges, what is
    to stop individuals from implementing the standard?

3) The internet being what it is, what is to stop the spread of
    such code to the point where it is the defacto standard?

I guess my point is, IETF doesn't have to "color within the lines"
drawn by arbitrary government bodies.  Everyone involved in
developing standards (RFC or otherwise) has the opportunity
to define things "as they should be done".  It is our place as
"netizens", i.e. citizens of "The Net" not citizens of country X,
to define standards most advantageous to US, not most
advantageous to country X.  Will Government X be unhappy?
You bet your sweet ass, as it is a direct usurpation (gotta love
that word) of their regulatory authority -- which I, for one, do not
recognize in the case of the internet.

Sorry if I threw gas on the fire, but you're dealing with a 100%
dyed in the wool libertarian here.

Brett

Hushmail.com account: [email-masked]

_______________________________________________
raven mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/raven

---

From: "Thomas Junker" <[email-masked]>
Date: Tue, 2 Nov 1999 00:51:08 -0600

>     regulations on wiretap, and coming up with a standard

Nothing.

>     to stop individuals from implementing the standard?

Nothing except local laws in particular jurisdictions.

>     such code to the point where it is the defacto standard?

That probably depends on whether the larger jurisdictions in which much of the 
Internet activity takes place prohibit some or all of such a standard within 
their jurisdictional reach.  If the world generally implements secure 
protocols and Lower Slobovia demands tappable interconnects, Lower Slobovia 
can pound sand, as they say here.  They can connect to the existing Net with 
the existing protocols or connect to the trees in their forests.  If, on the 
other hand, a very large Internet area such as the U.S. mandates less than 
secure protocols, directly or indirectly (through requirements placed on 
vendors and/or carriers), then Lower Slobovia will be able to make its 
tappable connections to a significant portion of the Internet and may find 
that to be sufficient.

> drawn by arbitrary government bodies.  

Quite right.  But that doesn't mean there aren't issues to be considered.  If 
the IETF formulates protocols that few parts of the world will implement, 
those standards will fail to have much effect.  The other side of that is that 
if the IETF includes non-protocol requirements in a protocol standard, which 
is in effect what one poster from The Netherlands is suggesting, then all 
"bad" governments will simply ignore the non-protocol requirements such as 
auditable taps, while a few "good" governments may seize the standard as a way 
to constrain law enforcement.  Don't hold your breath for that, though.

> Everyone involved in
> to define things "as they should be done".  

Yes, as long as "as they should be done" has some realistic chance of being 
adopted and used.  No one, though, has suggested that a hands-off or even an 
actively pro-privacy approach to protocols would run afoul of obstacles to 
widespread implementation.

> It is our place as
> advantageous to country X.

Yes.

> Will Government X be unhappy?

You may not, but at the other end of the spectrum are those such as Brian 
Rosen, who says, more or less, "Tapping requirements are inevitable, so let's 
just do the work and build protocols that give LEA what they are allowed by 
law and no more."  I'm being generous, since I usually get the impression that 
he thinks riveting collars on our necks is inevitable and so we may as well 
have a hand in the design of the collars to up the chance we can make them 
less uncomfortable.  But he has clarified himself to be concerned with the 
business issues of carriers and vendors not having a choice in their own 
jurisdictions and vendors having to meet foreign requirements or not sell into 
those markets.  I wonder what the arguments would sound like from the very 
real manufacturers and exporters of thumbscrews and other implements of 
torture?  No joke... the U.S. has had a thriving torture-implement export 
business sector for many years.  I'm not trying to characterize Brian in that 
vein, only suggesting that we might hear the same kinds of business 
justifications from those folks that we've heard here on this list from the 
vendors.

> dyed in the wool libertarian here.

Libertarian or not is really not the issue.  The question before the IETF is 
whether or not to facilitate wiretapping by making provisions for it in 
protocols.  It is a political policy issue, not a technical one, although it 
can also be viewed and analyzed from a technical standpoint, which has already 
been done.  The negative opinions on the issue range from the purely political 
to the technical security.  The positive opinions on the issue range from the 
engineers who seemingly would build anything at all they think they are told 
to build to the very small minority who seem to think government wiretapping 
is a good idea and that we should all be happy to have policemen listening in 
to "prove our innocence."

Regards,

Thomas Junker
[email-masked]

The Unofficial Wang VS Information Center
http://www.phoenix.net/~tjunker/wang.html

---

From: Matthew Saroff <[email-masked]>
Date: Tue, 02 Nov 1999 07:55:29 -0600

>     regulations on wiretap, and coming up with a standard
	I am not a networking guru, but, as I understand it, some sort of basic
intercept capability is necessary for basic network maintaince.  The problem
(not considering issues of government snoops) is that designing in "wiretap"
capabilities makes the maintainance mechanisms less secure.

-- 
Matthew Saroff
Do not reply directly to this message.  Reply to
[email-masked]

---

From: "chefren" <[email-masked]>
Date: Tue, 2 Nov 1999 16:11:12 +0100

> capabilities makes the maintainance mechanisms less secure.

So you just demonstrate you have no idea of what it's all 
about.

Where is that signature...

+++chefren

=Large signature follows=

I think we need a simple architecture for a point
to point tap interface that has strong provisions
against misuse.

On one side the communication provider who only
starts tapping a specific customer or IP number
with proper warrants.

On the other side the approved tapping room.
Everything should be organized by the central
"tapping office". This office should provide
keys for strong encryption to both communication
provider and tapping room.

Law and technology should both provide as
much checks and balances as we can come up
with. Law can provide good procedures,
technology can provide technical means to
check them or force them.    

=Large signature ended, please comment me
off-line to make it better=

---

From: "Brett Wooldridge" <[email-masked]>
Date: Wed, 3 Nov 1999 19:58:24 -0600

----- Original Message ----- 
From: chefren <[email-masked]>
To: <[email-masked]>; Brett Wooldridge <[email-masked]>
Sent: Wednesday, November 03, 1999 6:52 PM
Subject: Re: [Raven] minority position: a summary

> On 3 Nov 99, at 17:59, Brett Wooldridge wrote:
> > > Excuse, misread the year: In 1998 there were about 4000 
> > > taps in the Netherlands (little less if I remember well).
> > 
> > Still, we're talking about a per-capita tap frequency in your country
> > 500 times more frequent than the United States!
> 
> ((((HAHA!!! We don't have anything comparable to your NSA 
> here!))))  

Sounds like you don't need them!  I can discern very little difference
between what you have described you're governments tapping
behavior is, and what the NSA does.  Except for the fact that I would
gladly eliminate the NSA, yet you seem quite taken with your
evesdroppers. 

> Probably even more, there are 16.000.000 people here and I 
> thought about 360.000.000 in the US?

250 million in the US.  So, I revise my figure.  You execute about
16000% (160 times) as many taps as us.  Whew.

> > I find this extremely Draconian.  The friends of a murdered person
> > have their privacy invaded merely for having an association with
> > the victim?  Why stop there, what about relatives, neighbors, and
> > co-workers?  Wait, don't tell me, I know the answer.
> 
> And?

LOL!  Nevermind.  That was supposed to be ironic.  Unfortunately,
taking it with the straight face that you did took all the wind out of it. :)

> > > And yes, everything registered and little chance of any 
> > > illegal tap because of the checks and balances.
> > 
> > I would argue that those are all immoral taps.
> 
> What's a moral tap?

You got me there.  I can't think of a moral justification for tapping.
I find "for the good of society" a disturbing answer.  Why not
euthanise retarded or deformed children?  Some people could
probably put forth very convincing arguments about the great
boon that would be to society.

Why don't we all wear tracking collars so a record of our
whereabouts can be recorded?  Only police would have
access to the records, but those records would clearly show
which friend, neighbor, co-worker, or relative was with the
victim when they got killed.  <that was satire, btw>
 
> > Legality is an issue of law.  It was legal in this
> > country once to deny blacks and women the ability to
> > vote.  Legal and right are two different issues.  But I
> > would imagine the distinction is lost on you. 
> 
> Since the discussions here I have started to figure out how 
> far your country is behind ours.  In many ways it's at least 
> tens or years.

How quaint.  LOL!  I haven't thought of it in those terms, but
then, I'm American.  I would like to note that many in our
country would consider the kind of "advancement" you are
advocating a decided step *back*.  American's are strange
birds when it comes to freedoms -- it's in our history.

> > I'll send you $100 if you start Netherlanders For A
> > Tap-Free Society -- I'll even let you pick a more clever
> > name whose initials spell some poignant word in Dutch. 
> 
> Why do you want to send money to change a situation that 
> you appear to know very little about?

A joke, chefren.  Jokes appearently don't translate very well.

>   Please forgive me but on one side your money makes me
>   think about the way IRA finances their murder campaigns
>   and on the other side about the way some people try to
>   spread their belief. 

Wow.  Chefren, please get the picture of me as terrorist out
of your brain -- that's the second time you've made such a
reference.  Would you characterize someone who advocates
the rights of women a terrorist?  You would have been so
characterized 150 years ago, even in your country (I did some
research).  I advocate the privacy rights of the individual --
total and complete with no exceptions.  I may be characterized
as a terrorist now, but I'm just 150 years ahead of my time.

Brett

---

From: Matthew Saroff <[email-masked]>
Date: Thu, 04 Nov 1999 08:00:22 -0600

> gladly eliminate the NSA, yet you seem quite taken with your
	Of couse he is taken with him.  They are the market for his business.
 In the words of Deep Throat, "Follow the money".  In the US many people who
are making money in Cina allow the profit motive to blind them morally.

---

From: "chefren" <[email-masked]>
Date: Thu, 4 Nov 1999 23:50:58 +0100

On 3 Nov 99, at 19:58, Brett Wooldridge wrote:

..

> I can discern very little difference
> behavior is, and what the NSA does.

The big difference is that all parties involved, even the 
tapped persons, will always know of it. If a case comes 
before the judge the tapped person has access to ALL 
information and can use it to prove he isn't guilty.

Intelligence agencies like NSA only store information from 
which they think it's important. Unmodified recorders used 
by intelligence agencies aren't very usefull for law 
enforcement in The Netherlands since listeners are allowed 
to delete information they think is of no importance. 
Something strictly forbidden in The Netherlands.

> Except for the fact that I would gladly eliminate the
> NSA, yet you seem quite taken with your evesdroppers. 

I think NSA is inevitable in a world with countries like 
Iraq, Iran, North-Korea. Deleting NSA is like deleting the 
army, neither smart nor realistic IMHO.

> 16000% (160 times) as many taps as us.  Whew.

DOCUMENTED taps. Take it from me US taps at least 1000 
times as much and it could easily be 10.000 or 100.000, 
everyting undocumented of course. Public will maybe know of 
it after 50 years and maybe never?

..

> You got me there.  I can't think of a moral justification for tapping.

Do you have a moral justification for democracy?

  It's probably far simpler than I thought. Lot's of
  people here don't accept democracies. 

> I find "for the good of society" a disturbing answer.

You didn't saw me writing that.

> Why not euthanise retarded or deformed children?

In The Netherlands we allow abortion for less...

But after the moment the phoetus even probably could stay 
alive at it's own it's protected.

..

> whereabouts can be recorded?

Because in democratic practice such a risk of possible 
breach of privacy has proven to be unnecesary to keep crime 
at acceptable levels.

> Only police would have

Maybe satire. Main point could be interesting for the 
discussion seems to me that it's unrealistic. Tapping the 
way it's done in The Netherlands, always written reports of 
everyting tapped, is far to costly to do so. Law forbids 
such driftnet fishing too...

..

> A joke, chefren.  Jokes appearently don't translate very well.

Maybe a joke but you made me think so...
 
> the rights of women a terrorist?

Strictly depends upon the way it's done. If the person uses 
guns, spread of fear, use of power to silence parties 
he/she can still be a terrorist.

> You would have been so characterized 150 years ago, even
> in your country (I did some research).  I advocate the
> privacy rights of the individual -- total and complete
> with no exceptions.  I may be characterized as a
> terrorist now, but I'm just 150 years ahead of my time. 

Or behind, and that's the question. And since you cannot 
state how organized crime should be kept in check if it 
uses strong encryption and anonymous communication systems 
I don't see why total and complete privacy rights are 
reasonable.

And again: I know of no country that even comes close of 
100% privacy rights. Police may enter your house with 
proper warants I hope?

And if they do I hope you would be happy if everything was 
documented well? You probably want to check the warrant and 
everything before you let them in.

And that's about why I think this world needs auditable 
taps instead of tcpdump.

+++chefren

= =
Verdien 100 Euro bij aanbrengen van een nieuwe
klant voor een website: http://www.ii.nl/premie