Subject: RE: [Raven] Re: Raven, What's Needed...

From: Chris Savage <[email-masked]>
Date: Thu, 23 Dec 1999 17:29:25 -0500

>-----Original Message-----
>From: Fred Baker [mailto:[email-masked]]
>Sent: Thursday, December 23, 1999 4:46 PM
>To: chefren
>Cc: [email-masked]
>Subject: RE: [Raven] Re: Raven, What's Needed...
>
>
<snip>

>>Concerning b): The law doesn't say "we" must. To comply 
>>efficiently with the new laws there are standards needed.
>
>This is a true statement, at least in the United States, as 
>interpreted by the FCC in its third ruling on CALEA. Vendors are threatened

>with fines if they don't provide "packet mode intercept" by a certain date.
The
>interesting question is whether "packet mode intercept" 
>applies to IP, or whether it is limited to ATM etc.

As I see it, the (legal) issue isn't whether CALEA applies to IP or not; the
issue is whether the entities deploying the devices are "telecommunications
carriers" (as opposed to, most relevant here, providers of "information
services") and/or the device manufacturers are manufacturing devices which
are "telecommunications transmission or switching equipment" used by a
"telecommunications carrier."

For instance, suppose GTE announced that last night it had secretly changed
out all of its old-style circuit-switched local exchange equipment in
Southern California for some new packet-based (maybe even IP-based)
equipment that *did the same thing, functionally, as the old stuff.*  GTE
would still be a "telecommunications carrier," and its equipment would still
need to be CALEA-compliant.  There would of course be debates about whether
the (hypothetical) change-over to IP gear got them an automatic extension of
the 6/00 compliance date for J-STD-025, since they would be using very
different technical arrangements, but the basic applicability of CALEA to
them and to their equipment wouldn't magically change just by waving an "IP"
wand over it.

But the fact that one can use IP-based gear to do what one needs to do to be
a "telecommunications carrier" under the statute does not make everyone
using IP-based gear into a "telecommunications carrier" under the statute.
That latter question is basically technology-neutral; it has to do with what
the entity in question holds itself out as selling, not with the technical
details of how its services are provided.

Most Internet-related entities -- certainly front-line ISPs, large and
small, as well as Web hosters -- are *not* classified as "telecommunications
carriers" under US law, but, rather, as "information service providers" -- a
class of entity expressly excluded from the applicability of CALEA.  So to
say that CALEA on its face or as interpreted by the FCC requires ISPs as
such to do anything at all seems to me to be inaccurate.

Now, it may well be that there is a groundswell of interest on the part of
ISPs to *become* carriers in order to exploit business opportunities in the
VoIP space, or whatever.  So that could be creating a market demand for VoIP
gear that is CALEA compliant.  I, personally, do not understand how that
possibility extends to a general idea that CALEA would apply to ISPs
generally, or "the Internet" generally.

In this regard, folks who might be subject to tapping will generally (not
always, but generally) connect to an ISP (or "the Internet") over some sort
of common carrier facility -- dial-up, DSL, ISDN, T1, whatever.  If a LEA
needs to see the bits that Jane Doe is shipping to/from the Internet, the
LEA can tap the *carrier-provided* connection between Jane and the 'net.
There is no question that CALEA applies to the carrier.

All of this, of course, is my current, personal view of what CALEA means and
how it has been interpreted by the FCC.  Others may have a different view.
This is part of the "legal homework" I was referring to in an earlier post
that needs to be done, not only for the US, but for a substantial subset of
affected countries (purists would say "all," I suppose).

That said, in my experience, Internet-related entities in the US have fought
hard for, and cherish, their status as non-regulated entities, not
classified as common carriers for (essentially) any regulatory purpose in
connection with their Internet-related activities.  In purely parochial,
US-regulatory terms, I find it hard to see why US Internet-related entities
would have a different view on this issue.

>But certain standards are specified as legal "safe harbors",
>notably TIA's specification. ACLU, the vendors, and
>others are as we speak arguing that ruling, arguing that it
>should not apply to IP telephony. Meanwhile, TIA, T1P1,
>and Packet Cable are developing "safe harbor" intercept
>specifications.

They are developing those specifications, as I understand it, to apply to
entities that are *telecommunications carriers* under the law but that don't
use POTT (Plain Old Telephone Technology).  That would apply (at most) to
folks who offer to the public, and sell, IP-based telephony as a separate
service, not to all incarnations of IP-technology.

>Hence, from a US perspective, the question whether the IETF 
>should develop a "safe harbor" standard.

If the focus of such a standard were something like, "how should folks who
are offering IP telephony for sale, as carriers, comply with CALEA?" that
might line up with the statute.  But a general question of whether "the
Internet" (or its protocols) should be modified to facilitate access by LEAs
seems to me to be much, much broader than what CALEA calls for.

I wonder if the vehement opposition to facilitating of tapping that has
appeared on this list would be quite as vehement if the focus were limited
to entities that are in the (specific) business of selling IP-based
telecommunications (which, again, under current US law, normal ISP
functionalities are *not* classified as).  I also wonder whether there is
some sort of specific gear that such entities would use, such that CALEA
compliance would logically be embedded/embodied in that gear, as compared to
"the Internet" as a whole.

Chris S.

All opinions/views are my own.

*************************************************************************** 
This electronic mail transmission may contain confidential or 
privileged information.  If you believe that you have received the 
message in error, please notify the sender by reply transmission 
and delete the message without copying or disclosing it. 
***************************************************************************

_______________________________________________
raven mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/raven

---

From: Greg Broiles <[email-masked]>
Date: Thu, 23 Dec 1999 16:51:25 -0800

On Thu, Dec 23, 1999 at 05:29:25PM -0500, Chris Savage wrote:

> functionalities are *not* classified as).

Some fraction of my vehement opposition comes from an assumption that
tapping will be useless without a corresponding limitation on encryption
technology, and that standards and protocols for surveillance aren't the
last step in a series, but the first.

It would be easy to say "sure, let's make it easy to tap, those stupid
cops don't know they'll never be able to understand our traffic because
we've got end-to-end application level crypto with strong
authentication" .. then build a surveillance infrastructure, only to see
the powers that be forbid the use of crypto - either technically (by
rejecting/detecting streams with too much entropy) or legally or both.

It's simply not sensible to talk about building a surveillance
infrastructure if it will be easily subverted with simple tools.
Prototypes of 3DES crypto phone addons have been available for several
years on the civilian market in the US for $1K each - the vendor is
rumored to be close to a deal to include them in mass-market phones for
< $100. We've already seen several feasible but not wildly popular
secure VoIP implementations - as technology gets better, they'll get
friendlier.

Did the FBI spend years lobbying Congress and the EU and AU and others,
and will telecommunications carriers spend billions on
surveillance-enabled equipment, merely to see it thwarted by the use of
cheap consumer-level crypto? I don't think so. 

--
Greg Broiles [email-masked]
PO Box 897
Oakland CA 94604

---

From: "chefren" <[email-masked]>
Date: Fri, 24 Dec 1999 02:23:55 +0100

> last step in a series, but the first.

Inevitably as far as I see it.

It's all about one basic thing: Can a government allow 
their citizens places where they can hide their 
communication in a more or less absolute way?

The answer is, unfortunately, no. And it is no because some 
citizens would use it to hide their criminal organization. 
Unacceptable for serious governments that want to stand for 
law and order in their countries.

> rejecting/detecting streams with too much entropy) or legally or both.

I agree if you say most governments started with pretty 
stupid opinions some years ago but that has definitely 
ended. The current legislation in EU and Australia is 
pretty clear and doesn't leave room for discussions like 
the US Calea "what and what not" discussion.
 
> infrastructure if it will be easily subverted with simple tools.

Well, the "who talks to who" analysis is helpfull for law 
enforcement, every communication leaves some equivalent of 
fingerprints.

But I admit, if crypto would be used more widely it's 
pretty clear it will be more regulated. (More because 
communication providers already have to decrypt data if 
they crypted it before they handle it to tapping rooms, 
thats regulated encryption.)

> cheap consumer-level crypto? I don't think so. 

Me too, no, I'm sure.

Some of us seem to want to fight a battle that is already 
lost. I think we should think and work on the best way's to 
implement tapping. Think of ways to improve security 
against misuse and auditability.

Happy days to you all!

+++chefren

---

From: Ed Stone <[email-masked]>
Date: Fri, 24 Dec 1999 08:57:24 -0500

>communication in a more or less absolute way?

Or another perspective is "can a people allow their government to perfect 
cheap, mass surveillance mechanisms, which are to be operated in secret, 
according to the laws and practices (if any) which it chooses to honor at 
the moment?"

But as we have been reminded, the question is not about what goverment  or 
people can allow, it is about what IETF should do. I think this list has 
reached consensus, that IETF should not create or modify protocols to 
facilitate wiretapping.

Chefren, even though you have a different opinion, don't you agree that 
this list, by preponderance of opinion of participants, has reached that 
consensus?

--
--------------------------
Ed Stone
[email-masked]
--------------------------

---

From: "chefren" <[email-masked]>
Date: Mon, 27 Dec 1999 18:26:19 +0100

> according to the laws and practices (if any) which it chooses to honor at 

Problem is that's it's not "another perspective", it's 
about a sub-aspect of tapping.

In respectable countries it's democratically justified that 
in very special cases tapping is allowed. Fact.

Please don't mix that up with abuse/misuse/arbitraryness.

That's were good laws, good law enforcement and technical 
help like auditability, encryption technologies and not to 
forget =proven= standards can definitely help.

> Chefren, even though you have a different opinion,

Our opinions don't differ much on the point of disgust for 
misuse of tapping. I don't know of the respect for 
democratic ruling has much to do with "opinion" so what's 
left?

> don't you agree that this list, by preponderance of
> opinion of participants, has reached that consensus? 

That concensus makes no sense. Communication providers in 
the EU and Australia need tappable networks and that need 
has to be met. If IETF doesn't make standards for it on the 
longer run other organizations will do it and I can almost 
guarantee that from that moment on almost all Internet 
standards will be made by the other organization. Use of 
those standards will be demanded by laws. Just as happened 
with telecom in Europe.

It could well be a kind of IETF self-murder not to supply a 
way to tap.

+++chefren

---

From: "Thomas Junker" <[email-masked]>
Date: Mon, 27 Dec 1999 17:53:32 -0600

> about a sub-aspect of tapping.

Your response is nonsensical.  Ed was taking issue with 
your "Can government allow their citizens..." and trying 
to show you that the question in some other places would 
be, "can a people allow their government..."  To you, 
government power and policy is absolute as long as it is 
"democratically" derived.  To some others, especially here 
in the U.S., the model is quite the opposite.  In fact, 
the very basis for the formation of our government is that 
it is a servant of very narrowly defined powers, not a 
master.  To you, it seems that whatever government may 
decide is intrinsically correct as long as it emanates 
from a "democratic" process.  Here, government is only 
correct as long as it stays within its defined 
Constitutional powers; otherwise it is abusive and 
unlawful.

> in very special cases tapping is allowed. Fact.

So what?

> Please don't mix that up with abuse/misuse/arbitraryness.

You can't expect to give government power without also 
experiencing abuse/misuse/arbitrariness.  That's the human 
condition.  The formation of governments based on the 
separation of powers and representation was in its 
entirety an attempt to overcome the inherent tendency of 
monarchical governments to despotism and tyrrany.

> forget =proven= standards can definitely help.

The IETF has nothing to do with good nor bad laws nor good 
nor bad enforcement.  Auditability is a legal issue, not a 
technical one.  Strong, end to end encryption is becoming 
more and more widely recognized as the *only* way to 
ensure communication privacy.  You have already gone on 
record as being opposed to end user encryption, hiding 
that authoritarian position by advocating abstract 
"privacy" by carrier encryption that can be lifted at 
will.  Your paragraph above really doesn't say anything, 
at least not in English.

> That concensus makes no sense. 

So much for belief in democracy, eh?  When you don't agree 
with the result, the result "makes no sense" or is 
"stupid."

> Communication providers in 
> has to be met. 

Some do, some don't, and some (in the largest telecomm 
market in the world) have no present or forseeable 
requirement to provide push-button wiretap of IP traffic 
whatsoever, wiretap in the U.S. having its historical 
basis in interception of voice traffic.

In any case, let them build it themselves.

> If IETF doesn't make standards for it on the 
> longer run other organizations will do it

As far as the real requirements go, yes, that is certainly 
a possibility.  Those who love freedom hope that that 
course is bumpy, difficult, full of squabbles and turf 
wars, and competing proprietary "standards."  Efficiency 
in government and government-mandated matters is usually 
not a good thing.  Ask your countrymen who were alive in 
the first half of the 1940s about that for some 
perspective.

>  and I can almost 
> standards will be made by the other organization. 

Ha!  That's an outlandish claim.  In the rich tapestry of 
Internet protocols, possible wiretap standards are but a 
tiny pimple on the fair cheek of Lady Internet.  To 
suggest that IETF will lose all standing in the 
forumulation and dissemination of Internet standards by 
ignoring the politically contaminated question of wiretap 
is alarmism at its worst.

> Use of 

We'll see, won't we?  And we'll also see how well Europe 
fares beneath the weight of some of the most complex 
bureaucracy in human history.  In any case, what may or 
may not be demanded by laws is speculation, and in any 
case may be ignored by IETF, since IETF neither 
manufactures equipment nor provides telecomm services.

> It could well be a kind of IETF self-murder not to supply a 

You're delirious.  Better have your medications adjusted.  
Wiretap is a small issue in the landscape of the Internet, 
and one that will lose much of its importance as end to 
end encryption is deployed.  The future of the IETF in no 
way turns on caving in to pressures to make wiretapping 
cheaper and easier for the commercial entities who choose
to be in regulated businesses.

Regards,

Thomas Junker
[email-masked]

[this addendum is specifically for "chefren" messages, 
since he tries to take the list discussion far from its 
purpose]

NOTE:  The person calling himself "chefren" has virtually 
hijacked the Raven list by blitzing it with posts in which 
he repeatedly ignores reminders of the purpose of the list 
and suggests, directly and indirectly, that discussion of 
his "proposals" for "auditable wiretaps" are legitimate 
topics for discussion here.

This list was created by the IETF to entertain discussion 
of a specific policy question, phrased by the IESG as two 
questions:

    "Should the IETF develop new protocols or modify
    existing protocols to support mechanisms whose 
    primary purpose is to support wiretapping or other 
    law enforcement activities?" 

    and 

    "What should the IETF's position be on informational
    documents that explain how to perform message or
    data-stream interception without protocol 
    modifications?"

That's it!  The first and primary question requests a 
"Yes" or "No" answer, presumably with discussion of pros 
and cons with differing opionions, for the purpose of 
clarifying their positions and possibly convincing others.

The second question requests a similarly simple answer, 
presumably also to include supporting discussion.

Nowhere in the list's charter does it appear appropriate 
to use the list to shift the discussion to the hows and 
whys of wiretapping, or specific proposals for setting 
standards for wiretapping.  The question before the IETF 
is WHETHER OR NOT TO INVOLVE ITSELF IN SUCH MATTERS.

Appropriate discussion could certainly include specifics 
of the technical challenges faced by the vendors and 
carriers in meeting their legal obligations in various 
jurisdictions, as part of their case for IETF 
participation in setting standards for wiretapping.  It 
could certainly also include discussion of the technical 
and political reasons for IETF NOT to get involved in such 
matters.

Contrary to what chefren often writes, there is no 
"proposed auditable tap standard" in any IETF context.  
Such references are entirely in the imagination of 
chefren, who fails utterly to comprehend the purpose and 
nature of this list and the process for submission of 
proposed standards.  Unfortunately, many newcomers to the 
list and at least several reporters have concluded that 
the topic of the list is chefren's ravings.  The topic of 
the list is to answer the two questions quoted above that 
were posed by the IESG to the IETF.  Period.

The charter of the list may be found in its first message, 
available for viewing at:

    http://www.ietf.org/mail-archive/working-
groups/raven/current/msg00000.html

The Web page for the Raven list and access to the list 
archive may be found at:

-----

---

From: "chefren" <[email-masked]>
Date: Tue, 28 Dec 1999 16:35:56 +0100

> NOTE:  The person calling himself "chefren" has virtually

"Chefren" is my real name probably like your "Thomas".
 
> topics for discussion here.

..

If the people who set up the list think my postings are 
useless or contra-productive, please let they inform me, 

I have no problems with stopping to write or unsubscribing 
if they think so.

+++chefren

---

From: "chefren" <[email-masked]>
Date: Tue, 28 Dec 1999 16:27:49 +0100

On 27 Dec 99, at 17:53, Thomas Junker wrote:

> Your response is nonsensical.

Ah.

> Ed was taking issue with 
> be, "can a people allow their government..."

Yep.

> To you, 
> "democratically" derived.

Yep.

> To some others, especially here 
> in the U.S., the model is quite the opposite.

Yep, a primitive model with all kind of irregularities.

> In fact, 
> from a "democratic" process.

A little short, in an open society, with free press and 
free speech and probably some other "details".

..

> > in very special cases tapping is allowed. Fact.

Good question?

I think the answer is simple: So networks should be 
tappable.

In one way they are already tappable but we have learned 
here that governments don't accept plain ip dumps of all 
communinication of a communication provider. They want only 
the data transferred for the customer for which they law 
enforcement has a warrant.

The rationale behind it is positive: Law Enforcement 
shouldn't see data of other citizens, privacy of them 
should be respected.

> experiencing abuse/misuse/arbitrariness.

Same for the citizens. We only can make laws to keep things 
under enough control.

> That's the human  condition.

Yep.

> The formation of governments based on the 

Yep. 

> technical one.

I doubt that. Without an offer from the technical side laws 
have no "base". We can't expect lawyers to say reasonable 
things about technical things while they have no knowledge 
about it.

> Strong, end to end encryption is becoming more and more
> widely recognized as the *only* way to ensure
> communication privacy. 

Nice and pretty reasonable you believe so but I wonder why 
you think that it will stay unregulated. That's not 
reasonable. I don't want a government that cannot crack 
down criminal organizations because they use strong end to 
end encryption.

> You have already gone on record as being opposed to end
> user encryption, 

Ah! On which hitlists am I already? May I inform you and 
others that the European Community demands openness to me 
about registration of that kind of data about me?

> hiding that authoritarian position by advocating
> abstract "privacy" by carrier encryption that can be
> lifted at will.

It should be organized in such a way that misuse/abuse is 
clearly registrated.

> Your paragraph above really doesn't say anything, at
> least not in English. 

Why would an intelligent person like you react on "nothing"?

> So much for belief in democracy, eh?

I think it's a pretty bad system but admit I don't know a 
better system so we have to do with it.

> When you don't agree with the result, the result "makes
> no sense" or is "stupid." 

I try to use that kind of words in balance with the other 
side. If =I= see strong opinions or words on the other side 
I try to use them too, so the other party clearly and 
openly understands what I think of it.

  (Please don't see it as a lack of respect, if I hadn't
  respect for the people here I would have unsubscribed
  long time ago.) 

> Some do, some don't,

No. in EU and Australia ALL communication providers need 
tappable networks.

> and some (in the largest telecomm 

There are no "two Internets" in theory router companies 
could deliver two different routers one with and another 
without tapping protocol. In practice the difference will 
be in software and not in hardware. Tappability would be an 
add-on so in future all routers will be capable of standard 
tapping. That standard is lacking for now.

> not a good thing.

Grrrrrr, if government is inefficient WE have to pay for it.

> Ask your countrymen who were alive in the first half of
> the 1940s about that for some perspective. 

I have almost never problems with explaining the need of 
tappability to older and non-techie people.

> Ha!  That's an outlandish claim.

From =me= I clearly wrot so...

> In the rich tapestry of Internet protocols, possible
> wiretap standards are but a tiny pimple on the fair
> cheek of Lady Internet. 

How romantic... I admit tappability is a small issue but 
it's very important for society. It shouldn't be a pimple 
but a good controlled feature of the whole system.

> To 

If the IETF want's to survive on the long run it should be 
responsible to real world problems.

> may not be demanded by laws is speculation,

You don't tell the truth here, the laws are very clear: All 
communication of a person/company and only the 
communication of that person/company.

> and in any 

Of course but that would be the start of less control over 
Internet standards by the IETF.

> You're delirious.

Without drugs?

> Better have your medications adjusted.

There is nothing to adjust...

> Wiretap is a small issue in the landscape of the Internet,

Maybe small but not unimportant, no wiretap no Internet in 
EU and Australia...

> end encryption is deployed.

Will be regulated, just because the reasons why you are for 
end to end encryption are unacceptable for a serious 
GOVERNment

> The future of the IETF in no way turns on caving in to
> pressures to make wiretapping cheaper and easier for the
> commercial entities who choose to be in regulated
> businesses. 

We will see.

+++chefren