Subject: RE: [Raven] Re: Thoughts of IESG and IAB members on Raven

From: Scott Bradner <[email-masked]>
Date: Mon, 6 Dec 1999 12:32:54 -0500 (EST)

Brian sed:
> There was a proposal to add a feature to Megaco in support of
> this requirement.  Several of us believed that this feature
> alone was not sufficient, and a system design for how to do
> legal intercept of multimedia traffic carried over IP was
> needed.  We asked our WG chair to raise the issue with our
> AD.  Raven resulted.  If there was any OTHER communication
> from LEAs, it did not come through Megaco, and I believe we
> started the process that resulted in Raven. 

this is correct - there were no other contacts that caused raven
to be created

Scott

_______________________________________________
raven mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/raven

---

From: Graham Klyne <[email-masked]>
Date: Mon, 06 Dec 1999 18:19:00 +0000

At 11:53 06/12/99 -0500, Rosen, Brian wrote:
[...]
>I work for an equipment vendor.  We believe we have an
>non-negotiable requirement to support LI from our customers.
>Having talked with quite a few carriers, I'd say that somewhere
>north of 99% of them believe they have to support LI.

In a recent posting, Christian Huitema wrote:
>Hacking protocols, or installing backdoors, is needed when one wants to
>alter the behavior of a computer without having to request the cooperation
>of the owner of that computer. 

and

>[...] The nature of the applications requires
>that application-level monitoring can only be performed ethically if one of
>the parties in the application cooperates, in which case there is no real
>need to change the application protocols in any way. Other forms of
>monitoring pose very strong ethical questions, and cannot reasonably be
>expected from an open forum like the IETF. In short, whatever we may think
>of the balance between privacy and law enforcement needs, there are good
>technical reasons to answer negatively to the question that was posed to
>the Raven list. No, the IETF should not attempt to modify protocols in
>order to facilitate wiretap.

I find this a very compelling argument.

I'd like to understand how this sits with the megaco position you describe.

#g

------------
Graham Klyne
([email-masked])

---

From: "Rosen, Brian" <[email-masked]>
Date: Mon, 6 Dec 1999 14:03:59 -0500

> >It's an academic/legal exercise to debate whether any particular
> >law applies to any particular carrier, in any particular
> >circumstance.  The point is that the carriers believe that
> >they have to support LI, and therefore there is a requirement
> >of the equipment to support LI.  Since carriers want
> >interoperable equipment, that translates to a requirement in
> >some protocols.
> 
> Does "LI" mean "lawful intercept"? If so, and that is what you want 
> protocols to support, then don't "particular laws" actually 
> define the 
> capability you want to develop, rather than simply exist as an 
> academic/legal exercise?
Yes I used LI to mean lawful intercept

Generally speaking, the base capability that is needed is
not all that complicated, and not too different between countries in a
technical sense.  There is no doubt however, that when 
you get down to the details, the laws of the various countries will have to
be considered.  For the question at hand, that
is not relevant.

> If you want to facilitate "lawful intercepts", then how do 
> you do that 
> without reading the law so that you can understand what is 
> lawful? And how 
> do you determine which law will be applied? US - yes, China - no?
Having worked on a number of standards activities, even when
there were some legal requirements, we found a way through
the morass.  In this arena, right or wrong, U.S. and European markets tend
to dominate, and most of the requirements come from them.  What will happen
here, I don't know.   If there are
extra requirements that are seen as essential in some markets,
the protocols may need more options.  To enter those markets,
vendors may have to implement those options.  There has not, to my
knowledge, been any other requirements cited besides North American and
European.
 
> Can we learn more about this "non-negotiable requirement"? At its 
> foundation, is it a demand from government based on law?
Sure  (I already said LEAs are involved indirectly)
 
> Does that 99% of carriers base that on some law of some jurisdiction?
Sure
 
> >   No IETF
> >policy will change that.  I believe most, equipment vendors
> >believe that standards for LI are required.
> 
> By whom? If by governments, wouldn't we see that in the form of laws?
Well, standards are required indirectly from the requirements,
and they derive from laws.
 
> >   No IETF policy
> >will change that.  The only thing that changes is the venue.
> >The IETF venue has several advantages, particularly the
> >openness, the security consciousness, and the fact that the
> >protocols in question originate here.

Brian

---

From: "Rosen, Brian" <[email-masked]>
Date: Mon, 6 Dec 1999 14:22:38 -0500

I work for a vendor, not a carrier.  I believe most carriers
think that when they offer explicit telephony service over an
IP network, then CALEA applies.

So if a carrier advertised local telephone service provisioned on, say, a
cable modem, under this reasoning, CALEA applies to 
the telephony service.  As you point out, I'm not a lawyer.  Whether it
actually does or not, I don't know.  This is 
different from an ISP offering IP service where some customer puts voice on
the IP packets and the ISP doesn't offer any special service for those
packets.

Again, specific requirements are not the subject of this
discussion.  The carriers, for whatever reason, assert they
have a requirement for legal intercept, and want the systems
we as vendors deliver to be interoperable and meet that requirement.  Right
now, the Megaco requirements literally says "Provide lawful wiretap
capability" with no further detail. 

Whether CALEA applies or not doesn't matter.

Brian

> The point of my original question is to find out why the 
> carriers believe
> this "requirement" applies to the Internet, and what, 
> exactly, they think
> "requirement" and "support" mean. Given, for example, that:
> 
> - CALEA exempted information services,
> 
> - the FCC is facing multiple court challenges right now on 
> its August order
> for stepping beyond CALEA, and
> 
> - the improbability that any of this applies to the IETF 
> under any theory,
> 
> it seems reasonable for the IETF to try to find out what the 
> current legal
> status is in the U.S. and other countries. I'm not a lawyer, 
> you're not a
> lawyer, but if someone tells you to spend time and effort to 
> implement a
> "legally required" feature, it makes sense to find out what 
> that really
> means before rushing to do what you _think_ it means.
> 
> If there's no clear legal requirement to build in specific 
> features for law
> enforcement, it seems clear that most of the people who've expressed
> opinions (not all) would prefer that it not be done. I 
> suspect you may be in
> this category yourself.
> 
> Richard Payne
>

---

From: "Rosen, Brian" <[email-masked]>
Date: Mon, 6 Dec 1999 14:28:45 -0500

While I have great respect for Christian, in this case our
views differ.  As I have stated several times, it's easy to
get the basic tap, and no protocols are needed.  What is hard
is to limit what the tap delivers.  Warrants specify what the
LEA is allowed to get.  A simple tap gets everything.  What
we need protocol support for is a link between the call control that knows
what is happening, and the data part that the tap
operates on, so that the tap can turn on and off appropriately.

Specific laws may put more requirements on us than this, but
for now, just stay with me - the protocols are needed to limit the effect of
the tap so that it conforms to the terms of the warrant.

Also please note that no one speaks for the "megaco position".  Christian is
a part of the megaco working group, and his 
position is just as valid as mine.

Brian

> -----Original Message-----
> From: Graham Klyne [mailto:[email-masked]]
> Sent: Monday, December 06, 1999 1:19 PM
> To: Rosen, Brian
> Cc: [email-masked]
> Subject: RE: [Raven] Re: Thoughts of IESG and IAB members on Raven
> 
>

---

From: Ed Stone <[email-masked]>
Date: Mon, 06 Dec 1999 14:34:43 -0500

<snip>

>Sure  (I already said LEAs are involved indirectly)

Good. We are making progress. So we **are** responding to governments. May 
we see the formally-stated desires of those LEAs? They would be useful for 
two purposes, at least:
1. to understand what technical capabilities are desired;
2. to understand the LEAs request for them in terms of *law* that is 
operative in requesting LEA's jurisdiction.

> > Does that 99% of carriers base that on some law of some jurisdiction?

More progress. May we get more information from you about that?

>and they derive from laws.

OK. Then we would see laws, and we would see "requirements" that derive 
from them, and enlightened people could see if the "requirements" are based 
in law...

To start off, can your LEA "indirect" folks put forward the statutes which 
serve as the basis of their statement of "requirements"? Citations of 
appropriate USC would be sufficient, to the extent that they are US LEAs.

As has been pointed out here by lawyers, CALEA does not apply to ISPs or 
the net...

But further, are there nations whose laws we are to use to determine 
"requirements" and nations whose laws are not to determine "requirements"?

As a somewhat related aside, I note today's news about the European A5/1 
GSM Telephone Voice protocol being cracked by Alex Biryukov and Adi Shamir:
"In this paper we describe a new attack on A5/1, which is based on subtle 
flaws in the tap structure of the registers, their noninvertible clocking 
mechanism, and their frequent resets. The attack can find the key in less 
than a second on a single PC with 128 MB RAM and two 73 GB hard disks, by 
analysing the output of the A5/1 algorithm in the first two minutes of the 
conversation."
http://cryptome.org/a51-crack.htm

A5/1 was created with LEA national-security consciousnes in mind, in 
secret, to meet LEA "requirements".

--
--------------------------
Ed Stone
[email-masked]
--------------------------

---

From: "Rosen, Brian" <[email-masked]>
Date: Mon, 6 Dec 1999 14:49:32 -0500

You can't make me jump this hoop.

All I have at the moment is a vaguely stated requirement.  

The only question before the group is whether we do anything
in support of legal intercept.

Those two things match.  First we find out if we can do anything.
Then we get to the what exactly part.

Brian

> From: Ed Stone [mailto:[email-masked]]
> Sent: Monday, December 06, 1999 2:35 PM
> To: [email-masked]

---

From: Ed Stone <[email-masked]>
Date: Mon, 06 Dec 1999 15:20:49 -0500

>IP network, then CALEA applies.

I agree that what they think is something to consider, but what would 
prevail is the law. How can we find out what law, specifically, they rely 
upon to extend CALEA to the net, whether it is a net telephony service or 
non-telephony service?

Is it this August 99 FCC ruling? Does US law prevail on what IETF should 
undertake? Here is the FCC ruling...:

"Discussion.  Under Section 107 of CALEA, we can establish technical 
requirements or standards only after a Government agency or person 
petitions us to do so because an industry standard has not been developed 
or because the petitioner finds that such a standard is deficient.  In the 
absence of a petition, we do not have authority to establish standards and 
thus do not do so herein for   telecommunications carriers deploying other 
technologies.  We note that each of the requirements we adopt herein with 
respect to wireline, cellular, and broadband PCS carriers is not 
necessarily appropriate for other technologies."
see http://www.epic.org/privacy/wiretap/calea/fcc_calea_decision_8_99.html

May we see the petition by a Government agency or person which finds any of 
the current standards or protocols deficient with regard to IP, which is 
not wireline, cellular, or broadband PCS? Is there any such petition?

>the IP packets and the ISP doesn't offer any special service for those

And such a service, as described in the FCC ruling of August 99 above, is 
currently excluded, correct?

>capability" with no further detail.

Since there is no "detail", just assume, in the absence of Goverment agency 
petition, that you're there, and no changes are needed....

>Whether CALEA applies or not doesn't matter.

The law doesn't matter? That opens up quite a lot...

---

From: Ed Stone <[email-masked]>
Date: Mon, 06 Dec 1999 15:26:42 -0500

>in support of legal intercept.

As long as all we have is "a vaguely stated requirement", what is there to 
do? Might it be reasonable, from a US law viewpoint at least, to expect the 
government to follow the ruling of the FCC and to petition? Such a petition 
would remove the "vagueness", which is a precursor to any standard I'm 
familiar with.

>Then we get to the what exactly part.

No, first we find out what the government wants, clearly, not vaguely, not 
ambiguously, not non-legal wish lists...

IETF can vote up a standard tomorrow that creates branching of *every* IP 
packet to the World Court, can it not? It is not a matter of what IETF 
*can* do.

---

From: "Rosen, Brian" <[email-masked]>
Date: Mon, 6 Dec 1999 16:02:36 -0500

I don't agree with this line of thinking

The question at hand is can we do <anything>.

<What> we do depends on specifics.  Specifics have not yet
been raised.

We most certainly can decide if anything can be done without
having to be specific about what exactly anyone does.  
What we do should be within the purview of a specific work group,
and not the IETF at large.

It is dangerous for one group of people to tell another group
what they cannot do.  If I wish to start a work group on
wiretap, and I get enough people to do the work, that should be
enough.  The WG needs a charter, and that has to be somewhat
specific.  The WG needs to develop its requirements, and they
should be quite specific.

What we are discussing here is whether I am allowed to start
that work group.  I take it that your position is no,
I should not even be able to call a BOF meeting.

Brian

> From: Jim Gillogly [mailto:[email-masked]]
> Sent: Monday, December 06, 1999 3:15 PM
> To: [email-masked]
> Brian Rosen wrote:
> Not quite.  The questions before the group is whether we <should>
> develop new protocols or modify existing ones to support internet
> wiretap, and what should be the IETF's position on informational
> docs that say how to do internet wiretap without protocol mods.
> 
> So rather than "first we find out if we can do anything" the
> order is "first we find out whether we <should> do anything."
> This discussion's charter has nothing to do with whether we
> <can> do anything.
> 
> If we <should> support internet wiretap in any way, it would be
> because of a real requirement of some kind.  A "vaguely stated
> requirement" based on an unsupported extension of a related law
> in one country that happens to support a lot of IETF engineers
> does not yet rise to the level of a real requirement.
> 
> If somebody knows a legal or other compelling reason that we
> should be supporting internet wiretaps, speak up... but be sure
> to keep it as international as IETF.
> -- 
> 	Jim Gillogly
> 	Mersday, 16 Foreyule S.R. 1999, 20:00
> 	12.19.6.13.14, 9 Ix 2 Mac, Fourth Lord of Night
>

---

From: Jim Gillogly <[email-masked]>
Date: Mon, 06 Dec 1999 21:19:07 +0000

> <What> we do depends on specifics.  Specifics have not yet

I don't agree that this is the question at hand, and I have backup.
The Raven mailing list's charter is to address these two questions:

"should the IETF develop new protocols or modify existing protocols to
support mechanisms whose primary purpose is to support wiretapping or other
law enforcement activities"

and

"what should the IETF's position be on informational documents that explain
how to perform message or data-stream interception without protocol
modifications".

If you think these were inappropriate questions for the IESG
to raise, you should take it up with them.  I agree with them:
it's appropriate to first decide whether IETF support for these
modifications is necessary or even desireable before discussing
how to implement the modifications.

-- 
	Jim Gillogly
	Mersday, 16 Foreyule S.R. 1999, 21:12
	12.19.6.13.14, 9 Ix 2 Mac, Fourth Lord of Night

---

From: Ed Stone <[email-masked]>
Date: Mon, 06 Dec 1999 16:48:13 -0500

>The question at hand is can we do <anything>.

Then why wasn't that asked, instead of what WAS asked, which was:
Should IETF develop new protocols or modify existing ones to support internet
wiretap, and what should be the IETF's position on informational docs that 
say how to do internet wiretap without protocol mods.

>having to be specific about what exactly anyone does.

The issue is not about "what exactly anyone does" rather it is about 
<should> IETF develop new protocols or modify existing ones to support 
internet wiretap...

Are you asking if the IETF can create or modify standards?

>and not the IETF at large.

You can seek a charter for a WG by following procedure outlined at 
http://www.ietf.org/rfc/rfc2418.txt.
One of the elements that Area Directors are to evaluate before 
commissioning a WG is "Is the proposed work plan an open IETF effort or is 
it an attempt to "bless" non-IETF technology where the effect of input from 
IETF participants may be limited?"  ;-)

The process entails:
"The formation of a working group requires a charter which is primarily 
negotiated between a prospective working group Chair and the relevant Area 
Director(s), although final approval is made by the IESG with advice from 
the Internet Architecture Board (IAB).  A charter is a contract between a 
working group and the IETF to perform a set of tasks."

Of course, it seems that the views expressed here to the specific 
questions, as well as press accounts of the count at the meeting, indicate 
that IETF generally sees such a WG as a bad idea. And if the "Best 
Practices" statement for forming WGs gets in the way, then I suppose that 
process can be tossed along with the show of hands at the meeting and the 
talley of the raven list...

But why not get that sought after consensus here rather than bailing for a 
different venue?

>should be quite specific.

Yes, and since those requirements will have to be specific, why not just go 
ahead now, prior to the new WG, and submit the specifics here in the light 
of day for all to see?

---

From: Jim Gillogly <[email-masked]>
Date: Mon, 06 Dec 1999 21:56:27 +0000

Brian Rosen wrote:
> What words are you splitting here?
...
> The question remains as stated, should we
> develop any protocols that have mechanisms specific to law 
> enforcement.

Agreed.  You and I, at any rate, have reached consensus on
this point, which is different from attempting to determine
precisely what protocol modifications are possible to provide
this kind of support.

> If carriers want it, regardless of why, we get
> to choose to build it, or we get to choose another line of 
> business.

There's a change of "we" here.  We are a mailing list under
the aegis of the IETF.  Developers may build and deliver
whatever they wish to their customers.  What they build may
or may not have the support of IETF standards.  Our charter
is to decide whether that support is appropriate, and by
saying "we have to do this" you are attempting to assume
that the decision has alrady been made by the marketplace
and that the IESG/IETF have nothing more to do than approve
the RFC's.  I think this position is premature.

-- 
	Jim Gillogly
	Mersday, 16 Foreyule S.R. 1999, 21:40
	12.19.6.13.14, 9 Ix 2 Mac, Fourth Lord of Night

---

From: "Richard Payne" <[email-masked]>
Date: Mon, 6 Dec 1999 19:33:55 -0500

ch*fr*n wrote:

> members. Yes there are a lot of people crying about it but
> implementation will be there in all countries, one after
> another and before a point in time specified by another
> other EU requirement/directive.

What is the other directive? What is the point in time? Does the clock run
from the time of the (secret, not revealed to citizens allegedly exercising
democratic control) resolution or from the time two years later when they
found out about it for the first time?

Just wondering ;-)

Richard Payne

---

From: Graham Klyne <[email-masked]>
Date: Tue, 07 Dec 1999 12:30:55 +0000

At 14:28 06/12/99 -0500, Rosen, Brian wrote:

>...  What

Ah... I had overlooked the (telephony style?) separation of control and data.

Then, returning to Christian's comments, monitoring requires:
(a) cooperation of *two* communicating systems that are parties in the
application, or
(b) interception of the data stream before it enters the "media gateway"(?)

#g

------------
Graham Klyne
([email-masked])

---

From: "Rosen, Brian" <[email-masked]>
Date: Tue, 7 Dec 1999 07:44:23 -0500

Suppose I artificially restricted the membership of the
WG to those people who had participated actively in
IETF working groups for the past two years, and excluded
from the group anyone who had not, and I still had 50
people who wanted to work on wiretap?  Would you still
ban the effort?

You can't call this effort an outside affair.  The people
who want to do it are, and have been, active in the 
IETF since there was serious effort on IP telephony.
As with any new WG, there will always be a few first
timers.  We always need and want some new blood. 
However, don't assume that just because you,
and the majority of the people on the list and in
the plenary agree with each other, that prohibiting 
work in an area where there is a sufficiently large minority
of people who want to work on some task is appropriate. 
IETF is not a majority rules organization.  It works
on consensus WITHIN A WORKING GROUP.

If I don't like what you are doing, and a majority of
IETFers don't like what you are doing, should we get together
and stop you?  Where do you draw the line?

Brian

> From: [email-masked] [mailto:[email-masked]]
> Sent: Monday, December 06, 1999 6:23 PM
> To: [email-masked]
> Subject: Re: [Raven] Re: Thoughts of IESG and IAB members on Raven
> 
> 
> On Mon, 6 Dec 1999 17:33:40 -0500  "Rosen, Brian" 
> <[email-masked]> wrote:
> >
> > We don't normally have plenaries with a show of hands to
> > decide if a BOF can be started.  We could have 10000 IETFers say,
> > "I won't work on wiretap", but if 100 show up to work on it,
> > you want us to say "no, you can't do that"?
> >
> > This question is very much "prior restraint".  It's asking
> > a philosophical/ethical question, not a legal one, and not
> > a technical one.  It is not following the normal IETF procedure.
> 
> Yes, what is being discussed is "prior restraint" on you
> appropriating the name 'IETF' for your group.
> 
> You can set up whatever group you want.  But you need approval of
> IETF officials (and since wiretap is a controversial topic, I
> suggest that you *do* need the consensus of those plenary IETFers
> as well) before calling it an  __IETF__  BOF or WG.
> 
> I do not see that kind of a consensus here in favor of setting up
> a wiretap group under the aegis of the IETF.
> 
> 
> mikus
> 
>

---

From: "Richard Payne" <[email-masked]>
Date: Tue, 7 Dec 1999 08:54:50 -0500

> and stop you?  Where do you draw the line?

I don't think anyone is trying to stop you. I think all of us would support
the proposition that you are free to develop whatever software you want to:
even including software that has no purpose but wiretapping.

I think, though, that most of the people who've expressed an opinion would
prefer that the _IETF_ not be associated with such a standard. Presumably if
you and like-minded individuals formed the LITF (Lawful Interception Task
Force), there would be no problem, although the result could not
legitimately be labelled as having anything to do with the IETF.

Richard Payne

---

From: Ed Stone <[email-masked]>
Date: Tue, 07 Dec 1999 09:41:37 -0500

At 09:25 AM 12/7/1999 , you wrote:
>So you are saying, despite the fact that we have a significant
>minority of people who wish to do the work within the IETF,
>that is not sufficient; we have to get the permission of the
>majority.
>
>Where do you draw the line?

I submit that since your stated reason for IETF going "forward" to create 
or modify protocols to facilitate wiretapping is a _legal reason_, that 
first, IETF must test that supporting reason to determine if, in fact, such 
"non-negotiable legal requirements" exist and have the force of law to 
compel IETF to act to produce such a protocol. To do that, IETF should 
commission a legal review of that issue.

To do otherwise is to create a most dangerous precedent. A very slipperly 
slope.

---

From: Ed Stone <[email-masked]>
Date: Tue, 07 Dec 1999 10:29:14 -0500

Again, governments and LEAs are hotboxing your customers. Because of that, 
you say your customers are hotboxing you. You say you aren't given legal 
demands, rather you are given market demands. Wink, wink, nod, nod -- 
everybody knows that the origin of the "requirements" are governments and LEAs.

How long shall we pretend that we can't step behind the curtain and _ask_ 
them for a written copy of their "non-negotiable requirements", and their 
legal justification to impose them on a) your customers, and b) IETF, such 
that IETF can accomplish a reasonable and professional review of them?

They will either give IETF the requirements in writing or they will not. 
They will either give IETF the legal justification for imposing them on 
your customers and IETF or they will not.

Ask them, and publish the answer, if any. Then test IETF consensus.

Since the requirements are purportedly of legal origin, IETF cannot use the 
manufacturers or ISPs (who are being hotboxed by the government/LEAs) as a 
"cutout" from responsibility to determine if the intentional weakening of 
security between sender and receipient is justified by requirements in law.

Is there some reason that we don't see:
1. statements from the government/LEAs about what they want that they are 
not getting;
2. statements from the folks that are making wiretap support demands on you 
about why they are making them and exactly what the changes must accomplish?

Why is this behind the curtain?

Again. The initiating force is ostensibly a legal requirement. Before IETF 
acts to create a US-centric, security-weakening WG, we need a legal review 
of the basis for it and its international repercussions, whether "cutouts" 
and "plausible deniability" is invoked or not. The slippery slope is in 
what powers this precedent grants to other nations have to directly (or 
indirectly) "require" other security weakening protocols.

At 10:10 AM 12/7/1999 , you wrote:
>Okay, one last time, and then, at least on this thread, I stop.
>
>I'm one of the guys who:
>         Has the requirement
>         Wants to meet it
>         Understands what is means to the protocols
>
>In my world:
>         CALEA may or may not apply.  Don't care.
>         Some specific EU law may or may not apply. Don't care
>
>There are some basic requirements, that I already understand,
>that don't derive from CALEA, that require, IMO some protocol
>work.  They derive from how legal intercept is now done, and
>what my customers tell me they want to have.
>
>There MIGHT be additional requirements, that do derive from
>CALEA or new (or old) EU law.  When we get into actually
>working on it, we will have to face those issues.
>
>No LEA has ever contacted me.  I don't know if they ever
>contacted my customers.  But my customers tell me, in no
>uncertain terms, that I have a requirement to support
>legal intercept.  That's enough for me.  I haven't asked my
>lawyers for an opinion on whether my customer is asking for
>something he doesn't need.  I'm not in the habit of doing so.
>
>Sorry, I have to go back to work
>
>Brian
>
>
>
> > Sent: Tuesday, December 07, 1999 9:35 AM
> > To: [email-masked]
> > At 07:44 AM 12/7/1999 , you wrote:
> > It seems time for a recap.
> >
> > First, questions were posed to IETF for which the raven list
> > was created.
> > Those questions were:
> > The predominating response in numbers (see earlier reports of
> > the meeting
> > vote and the raven talley) is "No, IETF should not develop
> > new protocols or
> > modify existing protocols to support mechanisms whose primary
> > purpose is to
> > support wiretapping or other law enforcement activites." I
> > have not seen
> > stated here any disagreement that the above stated sentiment
> > predominates
> > in the meeting and on this list.
> >
> > Regardless of the finding that IETF "should not", it is reported by a
> > minority on the list that (and I paraphrase), "we have to do
> > it because it
> > is required and the requirements are not negotiable, so our
> > only question
> > is how do we go forward and do it". So then an exploration
> > begins for the
> > answers to two obvious questions:
> > 1. what is "it"?
> > 2. required by and declared non-negotiable by whom?
> >
> > After some dodging and weaving, the obvious is admitted: it is
> > government/LEA who has non-negotiable requirements, and who is the
> > motivating force behind the demand for new or modified protocols to
> > facilitate wiretapping.
> >
> > This leads me to inquire:
> > 1. If there are non-negotiable requirements that IETF must
> > meet in its
> > standards and protocols, then are we to actually believe that
> > they are not
> > written down, and that we cannot all see them? That rather than being
> > written and public in the tradition of law and regulations,
> > they exist only
> > in the mind of governors and are only verbally transmitted on a
> > need-to-know basis?
> > 2. If they are requirements of the government, are they in
> > the form of a)
> > law, lawful regulation, or treaty, or are they b) extra-legal
> > demands,
> > without the benefit of any legal standing?
> >
> > If a) then we can all read them now and understand their
> > legal basis and
> > jurisdiction. We can all see what "it" is. If b) then they
> > have no force of
> > law, and a rush by IETF to honor extra-legal demands sets a
> > fatal precedent.
> >
> > But giving the benefit of the doubt to those who demand that the
> > "non-negotiable requirements must be met", let's assume for a
> > moment that
> > the requirements come from USA/CALEA/FCC Ruling of August, 1999.
> >
> > It is undisputed that IETF specifications and processes lead
> > to standards
> > and protocols that are world-wide in scope, rather than USA
> > in scope. What
> > status does US law/regulation/administrative law ruling have
> > over IETF
> > that, say, Myanmar law/regulation/administrative law rulings
> > do not? By
> > what mechanism is IETF to accept the legal requirements of
> > the USA, but
> > reject the legal requirements of, say, Syria, Libya, Iraq,
> > China or North
> > Korea, for example?
> >
> > In the absence of a treaty brought to IETF by a
> > super-national body (UN,
> > World Court), is IETF to grant the same power to submit
> > "non-negotiable
> > requirements" to all governments or only the to the USA? If
> > only the USA,
> > what is IETF's basis for that discrimination?
> >
> > If the USA is not to have unilateral and exclusive powers to
> > require and
> > define international Internet protocols and standards denied to other
> > nations, then prior to endeavoring to implement wiretapping
> > facilitation to
> > meet parochial US "requirements", wouldn't IETF at least
> > issue a CFR (Call
> > for Requirements) to governments? And what treatment would
> > IETF be expected
> > to give to a Myanmar "requirement" that IETF assist Myanmar
> > by a protocol
> > modification that assists LEA there in the identification of users of
> > modems, so that they can be legally prosecuted and executed
> > according to
> > the rule of (Myanmar) law?
> >
> > But assuming that IETF determines to follow only US
> > administrative law in
> > regard to wiretapping, then of what import is it that the August 1999
> > ruling of the FCC separates out IP from wireline, cellular
> > and broadband
> > PCS requirements?
> >
> > Of what import is its wording:
> > "Under Section 107 of CALEA, we can establish technical
> > requirements or
> > standards only after a Government agency or person petitions
> > us to do so
> > because an industry standard has not been developed or because the
> > petitioner finds that such a standard is deficient.  In the
> > absence of a
> > petition, we do not have authority to establish standards and
> > thus do not
> > do so herein for telecommunications carriers deploying other
> > Of what import is the fact that substantial legal action
> > challenging the
> > FCC ruling is underway and filed in appropriate US courts?
> >
> > What is the cause for haste that is pressed upon us?
> >
> > Appearances: It is simply unseemly and profoundly offputting that the
> > motivating forces, governments/LEAs are not standing up
> > publicly with their
> > specific "non-negotiable requirements" in hand. If these demands are
> > legitimate and appropriate, why are we hearing from industry
> > executives who
> > have been hot-boxed, rather than from the governmental
> > entities who are
> > hot-boxing them. Is there something here that will not do well in the
> > sunshine of public debate and review? Hiding the motivating
> > forces behind
> > the curtain is not going to build trust nor generate consensus.
> >
> > What to do: IETF has asked "should we...". Two answers have
> > been given (I
> > paraphrase):
> > 1. NO, IETF should not...
> > 2. YES, IETF must meet the non-negotiable requirements, and
> > the next step
> > is to begin the WG authorization process.
> >
> > I submit that the second answer should be rigorously
> > explored, now, prior
> > to consideration of any wiretapping WG.
> >
> > My rationale for this is as follows:
> >
> > It is stated that the reason that IETF must take a certain action is
> > because of a legal requirement. To evaluate that dominant supporting
> > reason, since it is a reason purportedly based in law, a
> > legal review must
> > be made.
> >
> > Specifically, IETF should acquire appropriate, high-level
> > legal advice on
> > this question: Does any legal requirement exist that has
> > jurisdiction and
> > standing to compel IETF "to develop new protocols or modify existing
> > protocols to support mechanisms whose primary purpose is to support
> > wiretapping or other law enforcement activities".
> >
> > Such rigorous exploration might include an inquiry to the US
> > DOJ for their
> > position and to EPIC, ACLU, CSPR, and CDT for theirs, as well
> > as a call for
> > briefs from other sovereign legal entities. But the point
> > here is simple:
> > If we are to be compelled by a purported non-negotiable legal
> > requirement,
> > we must evaluate formally and rigorously, in the legal
> > environment with
> > legal professionals, whether or not such "legal requirement"
> > legimately
> > exists and is binding on IETF. For funding such legal
> > inquiry, why not
> > solicit the manufacturers, the membership and the civil
> > liberties community?
> >
> > Does anyone object to initiating and concluding such a formal
> > legal review
> > prior to IETF commissioning a wiretap WG on the basis of purported
> > "non-negotiable legal requirements"?
> > --

---

From: "Richard Payne" <[email-masked]>
Date: Tue, 7 Dec 1999 14:52:02 -0500

Robert Callaghan wrote:

> 4) It is necessary that individual service providers comply with a legally
> mandated order to wiretap.  (Legal is defined locally and not necessarily
by
> U.S. definitions. In some cases what is locally legal is abhorrent to an
> American.)

This is true. In particular, the last sentence is true, perhaps even when
locality = America, but this idea never resurfaces in the rest of the post.

He also wrote:

> It is now being required that the classical services be available in the
> world of new technologies.  They also want the same cost of service as was
> possible with the classical tools (Free).

One of the issues with which the list has been grappling is whether there is
in fact any legal requirement for telecoms to provide special support to
LEA's for information services. Given that that very issue is being
litigated in the U.S., it might be clearer to write the first sentence in
the style of the first: "They _want_ the classical services to be available
in the world of new technologies".

Finally he wrote:

> current protocols can be tapped.  The questions should be should the IETF
> modify protocols in order to assist services providers in limiting taps to
> that required by the court order?  And secondly should the IETF help the
> service providers by establishing protocols and procedures that allow for
an
> efficient, secure, and traceable tapping mechanism?

These questions implicitly assume:

1) That there _is_ a court order.

2) That making tapping more efficient, which implies that more of it will
take place, is a good thing.

The first assumption seems more likely (not 100% certain) in the U.S., less
likely in some other countries. The second assumption may _just possibly_ be
true in the U.S. (although I doubt it), but is certainly not true in some
other countries.

This takes us back to:

> In some cases what is locally legal is abhorrent to an American.

I think that any cost-benefit type analysis should consider among the costs:

any loss of privacy to Americans and Europeans, both by government action
and by hacker exploitation of the tapping interface, as well as

the long-run human rights effect of making tap-friendly protocols and
equipment available to countries like <your choice of villain>.

Richard Payne