Subject: RE: [Raven] Re: Raven, What's Needed...

From: Chris Savage <[email-masked]>
Date: Wed, 22 Dec 1999 16:38:13 -0500

>-----Original Message-----
>From: chefren [mailto:[email-masked]]
>Sent: Wednesday, December 22, 1999 3:25 PM
>To: [email-masked]
>Subject: RE: [Raven] Re: Raven, What's Needed...
>
>On 22 Dec 99, at 10:44, Chris Savage wrote:
>
>> 1.  What countries' laws require equipment 
>> manufacturers/users to support tapping (beyond
>> honoring any standard warrant that could 
>> say, e.g., "let LEA connect X equipment (bought
>> by LEA) to Y equipment (owned by subject of
>> warrant) for Z period of time")?
>
>For example EU countries and Australia.

I have heard it asserted that the EU directive is not actually binding law
on anybody, and legally can't be binding until/unless EU member countries
adopt it as they would other laws.  I, personally, have no clue whether that
assertion is accurate.  Some lawyer fluent with the interplay between what
the EU qua EU does, and what member EU countries do, would need to address
that situation.  Probably a boring and hypertechnical (well, hyper-legal)
issue to engineers, but I probably don't have to tell you what some
engineering issues seem like to lawyers.  <g>

As to Australia, what I have heard asserted is that some sort of tapping is
indeed required by some new law.  Again, I personally have no clue.  Now,
what happens in "common law" jurisdictions, of which Australia is one, is
that if a law is passed that some set of people really don't like, they try
to get courts to narrow/limit its actual implementation based on whatever
arguments turn out to be available.  (In the US, we typically claim that a
law violates this or that provision in our written Constitution; in the UK,
Australia, and others in the "English" tradition there is no written
constitution, but courts can and do still mess with laws on the basis of the
court's own precedents.  Where, exactly, courts get this power is not at all
clear as a matter of political theory, but there you go.)  It is not at all
atypical for a thorough legal analysis of a law to include discussion of
whether it is likely to actually be upheld by courts, how it is likely to be
interpreted, etc.

As to the US, it's pretty clear that the relevant statute, CALEA, does *not*
apply to the Internet as such or to ISPs as such.  Long ago on this list I
posted some of the relevant legal issues/distinctions.

>> 2.  There should be some combined legal/technical analysis 
>> of what the laws actually require of manufacturers/users,
>> to look for common threads.  If 17 different countries
>> "require" 15 different (possibly incompatible) things, then
>> whatever the solution might be, it isn't a "standard"
>> developed by IETF or anyone else.  It is (probably) country-
>> specific devices.   pain but not unheard of.  For instance,
>> in the US California-specific auto emission
>> requirements are well known.  If this is the case, IETF 
> would seem to have little to do.
>
>The general problem is that law-enforcement agencies don't 
>accept "tcpdump" taps, they only want communication data 
>that they have a warrant for.  

I (think) I understand what you have just said, but I don't think it
reflects what I was getting at in point (2) above.  The question I was
posing was a "legal" one: (a) look at relevant laws that are actually
binding on entities relevant to the Internet; and (b) see if those relevant
laws impose parallel/similar obligations on the Internet and/or those
entities.  You have responded with, if I understand it, the observation that
LEAs see a problem in getting more data than that to which they are entitled
under warrants.  Without getting into the issue of ill-motivated LEAs in
evil countries, etc., your observation is reasonable as far as it goes, but
misses the *legal* point.  Suppose the laws of country A allow access to [x]
type of data with a warrant, but not to [y] type of data ever.  Suppose the
laws of country B allow access to [z] type of data without a warrant, [q]
type of data with a warrant, and [p] type of data never.  And the laws of
country C allow access to [x] type of data without a warrant, [y] and [q]
type of data with a warrant, but [p] and [z] type of data never.  Etc.

The LEAs in all those (by hypothesis, here, reasonable) countries see the
"same" practical problem: they want access to certain information -- that
for which they have authorization -- and probably don't want to have to deal
with the rest of it.  But whether there is actual commonality among the
"appropriately intercepted" data in countries A...N depends in large measure
on what the specific laws of those countries specifically say.  One can't
figure that out without looking at the laws of the various relevant
countries and comparing them.  That will take a fair amount of time and
effort on the part of lawyers, which does not seem to have yet been brought
to bear on this debate.

By way of example, a point of great controversy in the US under CALEA was
the fact that the telecom industry's interim standard, approved in a
backhanded way by the FCC, allows telecom carriers to provide LEAs with both
packet header (addressing) data and packet content in cases where the LEA
only has authority that would cover the addressing data.  The matter is now
in court.  I have no idea whether other countries' laws would make such a
distinction relevant; but if you are doing CALEA issues in the US, you have
to build any relevant "standard" to accommodate it, one way or another.

Another example, less directly on point due to non-LEA overtones, is the
fight between the EU and the US over consumer data privacy and the EU
privacy directive.  In that context, stuff that is considered routinely
available for use and redistribution in the US is considered private and
non-re-usable in the EU.

>> 3.  A review of whether the relevant laws apply to "the 
>> Internet" or devices that support the Internet, or
>> instead to something else.  The legal classification of
>> the Internet and 'net-related entities is somewhat subtle
>> and variable.
>
>Laws demand tappable networks from communication providers, 
>they don't state how it should be done.

Well, it isn't actually that simple.  Again, the only law I remotely know
anything about that is relevant here is CALEA, and under US law the relevant
term is "telecommunications carriers," not "communications providers."  And
for a variety of historical, complex, and basically boring reasons, those
two phrases mean very different things under US law.  From a lawyer's
perspective, saying, in effect, "communications providers,
telecommunications carriers, whatever, it's all the same" would be like me
saying, "RFC 1218, RFC 1984, RFC 2102, whatever, they're all just RFCs,
right?"

Beyond the general definitional point (definitions are *very* important to
lawyers sometimes), it may be that some laws "don't state how 'it' [whatever
that happens to be under a particular law] should be done," but some might;
and some might say, "Do it however you want, except don't do X;" and others
might say, "Do it any one of the following three ways;" and still others
might, indeed, say, "Do Z."  I don't know the answer to that question.  I do
know that finding the answer will take a non-trivial amount of lawyer time
and effort.  And it does seem to me that the answer is relevant to what this
group is/should be talking about.

>> If all/most of the relevant laws don't actually apply to
>> the Internet, then again IETF would seem to have little
>> to do. 
>
>There are many IETF standards that aren't used by a 
>majority of the consumers...

Sure.  But that wasn't my point.  If some/many other countries follow US
practice in distinguishing between the Internet and ISPs on the one hand,
and the PSTN and telecom carriers on the other, then a law that applies to
the PSTN and telecom carriers would not on its face be particularly relevant
to the IETF; it would be relevant to TIA, to USTA, etc., etc.  And vice
versa.  Bell Atlantic is not going to lose lots of sleep over the details of
Internet Protocols; Cisco is not going to lose lots of sleep over changes in
the standard parameters for DS-3 level intermachine trunks.  (Obviously,
some parts of each company will care a lot about the other's issues, but my
point is one of concern and emphasis.)

>> 4.  If the laws of some substantial number of countries 
>> (market-weighted somehow, I would imagine: 30 countries with combined
annual 
>> router sales of 12 units have to count less than 1 major developed
economy 
>> with device sales in the thousands or hundreds of thousands of units)
seem to 
>> require the same/similar things of Internet entities, then, and only 
>> then, ISTM, do the questions that have been the recent focus here have
relevance.
>
>IETF is no political nor a commercial organization. If an 
>Internet standard is needed IETF "should" supply it. If 
>they didn't serve the needed standards unevitably another 
>body will emerge and IETF will be used less and less for 
>Internet standards.

I agree.  As I see the question(s) at hand, though, the IETF doesn't really
know "[i]f an Internet standard is needed" until legal homework along the
lines I outlined earlier has been done.  Now, maybe someone somewhere has
already done it; if so, I'd much appreciate a URL if available.  If the work
hasn't been done (which seems to be the case) then we get all tangled up in
debates about generic politics, whether LEAs are good or bad generally,
whether the Internet community should be supportive or suspicious of law
enforcement, etc., etc.

These are all interesting topics on some level.  But they seem to be beside
the point.  If the law is such that "an Internet standard is needed," then
one is "needed."  Only if a consensus emerged in favor of making life hard
for LEAs, laws notwithstanding, would "no standard" then be an appropriate
outcome in terms of a consensus-based process.  On the other hand, if the
law is such that "no Internet standard is needed," then one would be
supplied only if a consensus emerged that the IETF should take steps to make
life easy for LEAs, beyond what is legally required.

If I had to bet, I'd bet that the Internet community generally is more
likely to achieve consensus around the idea of slowing down LEAs despite
laws supposedly mandating cooperation, than it is likely to achieve
consensus around the idea of helping LEAs when no law requires cooperation.
But that's just from watching the traffic go by on this list for the last n
weeks...

>> Now, lawyers generally do work for clients.  I don't know 
>> that the "IETF" is a sufficiently corporate entity to 
>> actually be a "client," although other 
>> Internet-associated groups not only no doubt are, but 
>> probably already have their own counsel.
>
>As far as I know the IETF can definitely not be "sued" 
>because they don't supply a standard.

Again, an interesting question but not what I was getting at.  There is (I
gather) a history/tradition of Internet-related engineers donating their
time/effort (or their employers' time/effort) to tackling engineering issues
relevant to the Internet.  Far be it from me to suggest that engineers are
more public-spirited than lawyers in this space, but I am unaware of any
history of an "Internet Legal Task Force" volunteering time and effort to
tackling legal issues relevant to the Internet.  What I was implying was
that the legal issues involved here are likely to be big and complicated,
which means if they need to be answered, someone probably needs to actually
*pay* some lawyer to answer them, and that, as I understand it, the IETF is
not likely to do itself.

>> All the political debating back and forth is great, but it 
>> seems to me to be taking place in the absence of relevant
>>legal input.
>
>Follow the EU and Australian links and read...

See above.  Knowing what a statute literally says is only step one of a
multi-step process that needs to be separately undertaken for each relevant
country...

Chris S.
(All views my own)

*************************************************************************** 
This electronic mail transmission may contain confidential or 
privileged information.  If you believe that you have received the 
message in error, please notify the sender by reply transmission 
and delete the message without copying or disclosing it. 
***************************************************************************

_______________________________________________
raven mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/raven

---

From: "chefren" <[email-masked]>
Date: Wed, 22 Dec 1999 23:17:11 +0100

> to build any relevant "standard" to accommodate it, one way or another.

In the Netherlands there are "degrees" of tapping for 
telephones. The first and least costly degree is only the 
logging of connection/duration information (which 
numbercalled or to who was the tapped one making a call and 
how long), more or less tapping without the data. The 
second degree is a "full" tap, header and data.

The big difference is the work involved. If a full-tap is 
made the law requires everyting should be listened to and 
reported. That's pretty costly. If someone makes a call of 
let's say 10 minutes the reporting costs at least 20 
minutes. (So phoneline tapping is already pretty expensive. 
Internet tapping will definitely be more expensive.)

> available for use and redistribution in the US is considered private and

I think a very interesting point but I see only remote 
interest concerning Raven. In my "What's Needed" proposal I 
tipped the problem a little. The US way of gathering and 
using citizens data is highly offensive to privacy and I 
don't know why EFF and other privacy minded organizations 
aren't focussing on it.

..

> saying, "RFC 1218, RFC 1984, RFC 2102, whatever, they're all just RFCs,

The EU directive and neatly corresponding implementation in 
Dutch laws are pretty clear to me and the Australian law 
came pretty close as far as I have seen.

=All= provided communication, analog, digital, you name it, 
should be tappable. If the communication provider add's 
crypto that should be stripped and data other than the 
warrant asks for may not be in the stream to the tapping 
room.

> group is/should be talking about.

Only thing I can say about the technicalities is that Dutch 
law require the data to be delivered via ISDN to the 
tapping room.

> Sure.  But that wasn't my point.

Ah, sorry.

> If some/many other countries follow US

The splitting in the US seems a bit primitive to me, 
probably because the laws are older. A few years ago the 
Dutch laws didn't allow any other tapping than letters and 
phonelines. This was extended to faxing by local 
"jurisprudentie", earlier explanations of laws by judges. 
The problem was studied by the EU and the resulting 
directive simply demanded -all- telecom to be tappable in 
an equal way.

..

> whether the Internet community should be supportive or suspicious of law

OK, so maybe one of the participants who work for Cisco, 
Nortel or another company can "step forward" and tell us 
more?

> one is "needed."

Eh, I haven't seen a law that states such a thing. The 
standard is just needed for compatibility/economic-
efficiency and =good auditability=.

> Only if a consensus emerged in favor of making life hard
> for LEAs, laws notwithstanding, would "no standard" then
> be an appropriate outcome in terms of a consensus-based
> process. 

I still think "childish" is the only word for that outcome.

>  On the other hand, if the

Well there were a few but prety distinct postings by Fred 
Baker, Brian Rosen and others that pointed in "the other" 
direction.

> tackling legal issues relevant to the Internet.

Well I was pleased to meet some individuals on this list 
who donated time in favor of law enforcement, I didn't see 
a sign of someone who wanted to start an "ILTF".

(ROFL...)

> What I was implying was

I don't think the legal issues are big and complicated. And 
I don't think they are of any importance for IETF.

Take for example encryption, encryption using some IETF 
standards is forbidden in some countries. Which IETF member 
was bothered by that?

+++chefren