Subject: Re: [Raven] Preponderance say "No"?

From: "Richard Payne" <[email-masked]>
Date: Wed, 29 Dec 1999 21:06:13 -0500

ch*fr*n wrote:

>Get real and don't stand in the way of the will of
>respectable democratic countries.
>
>Communiction providers may only provide tappable networks
>within a year here and they need tapping standards for it.
>It's about Internet and about standards so IETF should
>provide them.
>
>Fanatic people with little or even no respect for democracy
>shouldn't stand in the way. IETF is no political
>organization and the standards are definitely needed.

Oh, I guess we're done with the pretend debate stage and into the "implement
or die" phase. As they said when the tanks rolled into Prague, "surely you
could cache a small Czech?"

A quibble: countries have no will, people do. Another: which jurisdictions
are actually, really, making SSL and IPSEC illegal and when? ch*fr*n has
asserted this, _third_ time I've asked for specifics, likelihood of answer
now approaching zero...

<Deep breath> </Deep breath>

Seriously, countries other than the Netherlands and Australia (which I'm
beginning to think are not such respectable democracies) have not passed
these laws. Am I allowed to express a contrary opinion in my own country
without being called a fanatic? (Funny definition of democracy, if not...)
If my country's policy is free use of strong crypto, what exactly am I
standing in the way of?

<grin>
(Perhaps dreaded Dutch Ninja clog force? Tulip grenades?)
</grin>

Also, as Scott Bradner told us earlier today, there is no requirement for
the IETF to bail out clueless politicians. Since most people who've
expressed an opinion on this list are against any hypothetical IETF
wiretapping standard, and there's no legal theory under which IETF can be
compelled to create one, we must be done, right?

Richard Payne

_______________________________________________
raven mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/raven

---

From: "chefren" <[email-masked]>
Date: Thu, 30 Dec 1999 04:00:45 +0100

On 29 Dec 99, at 21:06, Richard Payne wrote:

> or die" phase.

No, I think the debate needs new input and that the input 
needed is about WHAT could be done instead of "HOW CAN WE 
AVOID IT".

If we have no overview concerning WHAT can be done and what 
are the implications, if al naysayers here want to obstruct 
people that just want to LOOK further this list is 
senseless.

I think I will resend the original "What's needed" posting, 
there was an awfull lot of response on stupid details and 
almost none around the basic idea, whats wrong or could be 
bettered.

..

> beginning to think are not such respectable democracies)

You can doubt anything you can piss at anything but you 
can't say you are very interested in possibilities other 
than that you don't want tapping to be done ever. 

Well if that's your opinion: We know so.

For me that question is answered by my country. It's only 
"how can tapping be done best"  

> have not passed these laws.

Within a short time all other EU countries and would-be EU 
countries will follow. They have to.

You may keep doubting that, I think that's what we call 
"struisvogelpolitiek" here, politics comparable to an 
ostrich that puts his head in the sand.

> Am I allowed to express a contrary opinion in my own
> country without being called a fanatic? 

Am I in my own country allowed to call you a fanatic?

> (Funny definition of democracy, if not...) If my
> country's policy is free use of strong crypto, what
> exactly am I standing in the way of? 

You can use tricky wordings but strong crypto is regulated 
in your country, not heavily but it is. You may not export 
it freely and because of patents and other obstructions 
some crypto communication to other countries is at least 
partly illegal because the other side can not legally 
obtain specific software.

I think the principles that make a lot of US citizens think 
crypto should be free are pretty outdated, from a time when 
telecom was about non existent compared to what's possible 
now.

NRA type discussions, very very primitive.

..

> the IETF to bail out clueless politicians.

"Clueless politicians", well well what a respect, you 
forget they represent the people. People like you an me!

> Since most people who've expressed an opinion on this
> list are against any hypothetical IETF wiretapping
> standard, and there's no legal theory under which IETF
> can be compelled to create one, we must be done, right? 

Maybe, I guess it's the start of the end of IETF as an 
Internet standardisation organization. Tapping standards by 
nature need good integration with the standards they tap.

For good, auditable, tapping it can well happen that 
existing standards need some extra's.

If IETF wants to keep control of Internet Standards they 
should supply them. If there is stong auditability in them 
there is about no chance that Milosevices and other crooks 
will use them at all.[0]

Maybe it is better that everyone who doesn't want tapping 
standards just votes so, unsubscribes and let the others 
who don't know or want standards finally figure out what 
can be done.

+++chefren

[0] Don't YOU think so?

---

From: Ed Stone <[email-masked]>
Date: Wed, 29 Dec 1999 22:31:45 -0500

>needed is about WHAT could be done instead of "HOW CAN WE

You mean, ignore the majority view that IETF should not, and simply proceed 
to figure out how to do it, ignoring that majority?

>people that just want to LOOK further this list is

You mean, that if the list participants answer the question "should IETF 
...." in the negative, that the list is useless, and to make it useful, we 
should simply proceed to figure out how to do it, ignoring the majority?

>almost none around the basic idea, whats wrong or could be

You mean, ignore the preponderance of opinion here, and at the meeting, and 
the absence of a professional legal opinion, and simply work on your view 
of the right kind of tap?

>than that you don't want tapping to be done ever.

If I understand Mr. Payne's view, it is that IETF should not create or 
modify protocols to facilitate wiretapping. As such, it is responsive to 
the question posed. Your desire to begin architecting a tap protocol, is 
not responsive.

>For me that question is answered by my country. It's only

Your country does not require any modification to protocols, per the 
posting by a Netherlands ISP.

>countries will follow. They have to.

I think you have provided that unsupported opinion previously.

>ostrich that puts his head in the sand.

That will win many converts to your side, I'm sure.

>Am I in my own country allowed to call you a fanatic?

That would not provide any insights on whether or not IETF should create or 
modify protocols, would it?

>obtain specific software.

Encryption is not the subject matter of this list, as per the initial posts.

>NRA type discussions, very very primitive.

Guns are not the subject matter of this list...
>forget they represent the people. People like you an me!

Attitudes toward politicians are not the subject matter of this list...

>nature need good integration with the standards they tap.

So you mean, IETF must facilitate wiretapping via new or modified 
protocols, or it is the "start of the end of IETF"? That sounds like a 
model of coercion, rather than democracy.

>existing standards need some extra's.

Auditable tapping is not the subject matter of this list...

>there is about no chance that Milosevices and other crooks

IETF keeping control by providing what is demanded of it? Interesting...

>who don't know or want standards finally figure out what

You mean, if one answers the primary question posed to this list with a 
"no", then one should shut up and go away so you can proceed to create or 
modify protocols to facilitate wiretapping?

--
--------------------------
Ed Stone
[email-masked]
--------------------------

---

From: "Thomas Junker" <[email-masked]>
Date: Wed, 29 Dec 1999 22:59:23 -0600

On 30 Dec 99, at 4:00, chefren wrote:

> > Oh, I guess we're done with the pretend debate 
> > stage and into the "implement or die" phase.
> 

What is it about the charter question of this list that 
you don't understand, chefren?  Do you behave this badly 
in your social and business interactions?  The question of 
"What could be done?" is not the topic of this list.  That 
is not why this list was created.  What you *think* about 
what the topic here should be is irrelevant.

Don't you realize that by ignoring the purpose of this 
list and by spamming it with well over 200 posts, 
virtually all of them off topic, you are showing yourself 
to be a complete fool?

> people that just want to LOOK further this list is 

Only to someone like you who completely (and apparently 
intentionally) misunderstands the stated purpose of this 
list.  

> I think I will resend the original "What's needed" posting, 

Which was completely off topic to begin with.  What you're 
doing fits the original Internet definition of "spamming," 
which was the sending of irrelevant, unwanted, untargeted 
traffic.

> almost none around the basic idea, whats wrong or could be 

That's because the basic idea was unwanted, irrelevant, 
and sent to the wrong place, as has been pointed out to 
you on numerous occasions.

What is *wrong* with you?

> than that you don't want tapping to be done ever. 

Few to no people on this list are interested in your 
"possibilities."  Further, "possibilities" that go in a 
direction generally considered to be negative are not 
positive things.  You don't get any points for being 
"interested in possibilities" in this case.

> "how can tapping be done best"  

We have to assume that if a question of genocide had been 
"answered" by your country, democratically of course, you 
would only be interested in "how can genocide be done 
best."  Or forced labor.  Or book burning.  Or political 
incarceration.  Or forced relocation.  Anyone with even 
half a brain can see that you salute the state and ask 
what color it wants you to shit.  The reason you have 
gotten such flak from U.S. people and will continue to get 
it as long as you continue is that you are the embodiment 
of the antithesis of the founding principles of our 
country.

> countries will follow. They have to.

So you claim.  You have been contradicted by a recent 
poster with experience in these issues at a Dutch ISP.  
You seem to be projecting your subjective beliefs onto all 
of Europe, onto the legal system, and are trying to 
project them onto the entire world of the Internet.  You 
need help.

> ostrich that puts his head in the sand.

Strange, but those of us who value freedom see you as 
having your head firmly implanted in the asshole of the 
state.  And maybe your hand in its pocketbook, too.

> Am I in my own country allowed to call you a fanatic?

Which fails utterly to respond to the question.  "Fanatic" 
accurately describes the obsession you have brought to 
this list, although your use of the word to describe your 
correspondent manifests a distinct lack of command of the 
English language.

> You can use tricky wordings 

There's nothing tricky about what he wrote.  He observed 
that you claim an undying attachment to "democracy" but 
brush aside a clear consensus expressed by the 
participants in this list.  That was his polite way of 
calling attention to your hypocrisy, at the least, and 
perpaps even irrationality.

> but strong crypto is regulated 
> in your country, not heavily but it is. 

No, that is not correct.  Strong crypto is *not* regulated 
*in* our country.

> You may not export 
> it freely 

For the time being.  Eventually that will change.  It is 
changing even as we argue, but eventually the export 
regime will fall because it cannot stand against reality.

> and because of patents and other obstructions 

That is completely false.  There is no illegality in 
communicating using strong encryption with people in other 
countries.  How they came by their strong encryption, 
whether they found it on the street or cracked open a book 
and wrote it themselves, or got it from someone else 
outside the U.S. who cracked a book and wrote it, is 
irrelevant.  There is no issue of "illegal" in such 
communications -- only in your badly flawed understanding 
of such things.

> telecom was about non existent compared to what's possible 

My view of such a statement is that you have no idea what 
you're talking about.  Strong crypto is more important to 
individual privacy than it ever was, specifically because 
of advances in telecommunications and the consequent shift 
of traffic from avenues much less susceptible to wholesale 
surveillance and interception to digital messaging.

> NRA type discussions, very very primitive.

Well, we can be reasonably certain that you know *nothing* 
of what you speak on that subject.  

> forget they represent the people. People like you an me!

You consistently evade the points made.  The point of the 
statement was not "clueless politicians" but "there is no 
requirement for the IETF."

As to "clueless," another Dutch poster pretty much stated 
that the Dutch law you are so fond of tossing around 
resulted from the "cluelessness" of legislators who didn't 
understand that analog voice telephony and packet networks 
are entirely different things.  So "clueless" would seem 
to be a very appropriate adjective for the politicians in 
these matters, and particularly for yours.

> Internet standardisation organization. 

Vacuous alarmism.  If anyone in any responsible position 
in the IETF or IESG bodies were to be susceptible to such 
childish scaremongering they should be replaced instantly.

> Tapping standards by 

Things do not "need," only people "need," and in all of 
this discussion, the "need" that has surfaced is a 
commercial one of vendors seeking an easier time of it in 
business by getting an IETF stamp of approval on standards 
that are useful only to them, to law enforcement, and to 
secret police agencies, and a "need" of carriers seeking 
an easier time of it in the legal arena with certain 
national authorities who may or may not be able to place 
penalties on them for not finding a "safe harbor."  If the 
recent Dutch poster was correct, your claims are false 
even with respect to The Netherlands, where no one is 
punished for not doing the impossible, and where 
bureaucrats were reported to have undertaken building 
wiretap stuff themselves (wheeee! where can we buy the 
video?) because there was none in the market.

The day that someone can provide evidence that someone put 
a gun to the heads of the people working for the carriers 
and forced them to be in one of the most regulated 
industries in human history is the day I will have some 
sympathy for them in matters such as these.

> should supply them. 

Nonsense.  We're not talking here about core Internet 
protocols, we're talking about whining from some corners 
about what a hard time they're going to have if they can't 
use the IETF imprimatur to stamp on the wiretap-friendly 
features they'd like the world to adopt to make their 
equipment cheaper and easier to manufacture and market.  
The effect of that on the proliferation of wiretapping 
seems to hold no importance for them, which is why it is 
necessary for people who do give a damn to participate in 
this Raven zoological exercise.

> If there is stong auditability in them 

That's absurd!  The first time a salesman brings in an 
order from N. Korea or Cuba or the PRC (or the FBI or the 
LAPD for that matter) for wiretap equipment with the 
encryption or audit features disabled, the same engineers 
who brought this up will fall all over themselves to patch 
the microcode to disable those features and allow their 
companies to make a sale.  That should be crystal clear to 
anyone who thinks about it for even a microsecond.

> who don't know or want standards finally figure out what 

Why would we do that?  So you can complete your hijacking 
of the list and use it as a pet forum for advancing your 
wiretapping agenda?  Don't you get it?  "Figuring out what 
can be done" is not the purpose of this list!  I have to 
conclude that there really is something gravely wrong with 
you.

Thomas Junker
[email-masked]

[this addendum is specifically for "chefren" messages, 
since he tries to take the list discussion far from its 
purpose]

NOTE:  The person calling himself "chefren" has virtually 
hijacked the Raven list by blitzing it with posts in which 
he repeatedly ignores reminders of the purpose of the list 
and suggests, directly and indirectly, that his off-topic 
"proposals" for "auditable wiretaps" are legitimate 
subjects for discussion here.

This list was created by the IETF to entertain discussion 
of a specific policy issue, phrased by the IESG as two 
questions:

    "Should the IETF develop new protocols or modify
    existing protocols to support mechanisms whose 
    primary purpose is to support wiretapping or other 
    law enforcement activities?" 

    and 

    "What should the IETF's position be on informational
    documents that explain how to perform message or
    data-stream interception without protocol 
    modifications?"

That's it!  The first and primary question requests a 
"Yes" or "No" answer, presumably with discussion of pros 
and cons with differing opionions, for the purpose of 
clarifying their positions and possibly convincing others.

The second question requests a similarly simple answer, 
presumably also to include supporting discussion.

Nowhere in the list's charter does it appear appropriate 
to use the list to shift the discussion to the hows and 
whys of wiretapping, or specific proposals for setting 
standards for wiretapping.  The question before the IETF 
is WHETHER OR NOT TO INVOLVE ITSELF IN SUCH MATTERS.

Appropriate discussion could certainly include specifics 
of the technical challenges faced by the vendors and 
carriers in meeting their legal obligations in various 
jurisdictions, as part of their case for IETF 
participation in setting standards for wiretapping.  It 
could certainly also include discussion of the technical 
and political reasons for IETF NOT to get involved in such 
matters.

Contrary to what chefren often writes, there is no 
"proposed auditable tap standard" in any IETF context.  
Such references are entirely in the imagination of 
chefren, who fails utterly to comprehend the purpose and 
nature of this list and the process for submission of 
proposed standards.  Unfortunately, many newcomers to the 
list and at least several reporters have concluded that 
the topic of the list is chefren's ravings.  The topic of 
the list is to answer the two questions quoted above that 
were posed by the IESG to the IETF.  Period.

The charter of the list may be found in its first message, 
available for viewing at:

    http://www.ietf.org/mail-archive/working-
groups/raven/current/msg00000.html

The Web page for the Raven list and access to the list 
archive may be found at:

-----

---

From: "chefren" <[email-masked]>
Date: Thu, 30 Dec 1999 15:23:51 +0100

> to figure out how to do it, ignoring that majority?

No. I want a careful study. The no-sayers obstruct the 
discussion, we don't get a clear view of what could be done 
for tapping and how the often to be respected arguments of 
the no-sayers can be encountered with a good system design.

..

..

> posting by a Netherlands ISP.

Maurice worked for an ISP in the past.

As said before: A crude form of tapping is no problem, good 
auditable tapping requires a good over all design.

..

..

> Encryption is not the subject matter of this list, as per the initial posts.

Sure but it's used as an argument against tapping 
standards. I think that's wrong but people still do.

..

> Auditable tapping is not the subject matter of this list...

The existence of other forms than crude tapping is 
important for the subject of this list.

+++chefren

---

From: "chefren" <[email-masked]>
Date: Thu, 30 Dec 1999 15:42:29 +0100

> No, that is not correct.  Strong crypto is *not* regulated 

Playing with words again.

IN your country you may not mail 128 bit encryption 
programs to someone in a rogue country.

+++chefren