Subject: RE: [Raven] Re: Thoughts of IESG and IAB members on Raven

From: "Rosen, Brian" <[email-masked]>
Date: Tue, 7 Dec 1999 10:10:44 -0500

Okay, one last time, and then, at least on this thread, I stop.

I'm one of the guys who:
	Has the requirement
	Wants to meet it
	Understands what is means to the protocols

In my world:
	CALEA may or may not apply.  Don't care.
	Some specific EU law may or may not apply. Don't care

There are some basic requirements, that I already understand,
that don't derive from CALEA, that require, IMO some protocol
work.  They derive from how legal intercept is now done, and
what my customers tell me they want to have.

There MIGHT be additional requirements, that do derive from 
CALEA or new (or old) EU law.  When we get into actually 
working on it, we will have to face those issues.

No LEA has ever contacted me.  I don't know if they ever
contacted my customers.  But my customers tell me, in no
uncertain terms, that I have a requirement to support
legal intercept.  That's enough for me.  I haven't asked my
lawyers for an opinion on whether my customer is asking for
something he doesn't need.  I'm not in the habit of doing so.

Sorry, I have to go back to work

Brian

> -----Original Message-----
> From: Ed Stone [mailto:[email-masked]]
> Sent: Tuesday, December 07, 1999 9:35 AM
> To: [email-masked]
> Subject: RE: [Raven] Re: Thoughts of IESG and IAB members on Raven
> 
> 
> At 07:44 AM 12/7/1999 , you wrote:
> >Suppose I artificially restricted the membership of the
> >WG to those people who had participated actively in
> >IETF working groups for the past two years, and excluded
> >from the group anyone who had not, and I still had 50
> >people who wanted to work on wiretap?  Would you still
> >ban the effort?
> 
> It seems time for a recap.
> 
> First, questions were posed to IETF for which the raven list 
> was created. 
> Those questions were:
> "should the IETF develop new protocols or modify existing protocols to
> support mechanisms whose primary purpose is to support 
> wiretapping or other
> law enforcement activities"
> 
> and
> 
> "what should the IETF's position be on informational 
> documents that explain
> how to perform message or data-stream interception without protocol
> modifications".
> 
> The predominating response in numbers (see earlier reports of 
> the meeting 
> vote and the raven talley) is "No, IETF should not develop 
> new protocols or 
> modify existing protocols to support mechanisms whose primary 
> purpose is to 
> support wiretapping or other law enforcement activites." I 
> have not seen 
> stated here any disagreement that the above stated sentiment 
> predominates 
> in the meeting and on this list.
> 
> Regardless of the finding that IETF "should not", it is reported by a 
> minority on the list that (and I paraphrase), "we have to do 
> it because it 
> is required and the requirements are not negotiable, so our 
> only question 
> is how do we go forward and do it". So then an exploration 
> begins for the 
> answers to two obvious questions:
> 1. what is "it"?
> 2. required by and declared non-negotiable by whom?
> 
> After some dodging and weaving, the obvious is admitted: it is 
> government/LEA who has non-negotiable requirements, and who is the 
> motivating force behind the demand for new or modified protocols to 
> facilitate wiretapping.
> 
> This leads me to inquire:
> 1. If there are non-negotiable requirements that IETF must 
> meet in its 
> standards and protocols, then are we to actually believe that 
> they are not 
> written down, and that we cannot all see them? That rather than being 
> written and public in the tradition of law and regulations, 
> they exist only 
> in the mind of governors and are only verbally transmitted on a 
> need-to-know basis?
> 2. If they are requirements of the government, are they in 
> the form of a) 
> law, lawful regulation, or treaty, or are they b) extra-legal 
> demands, 
> without the benefit of any legal standing?
> 
> If a) then we can all read them now and understand their 
> legal basis and 
> jurisdiction. We can all see what "it" is. If b) then they 
> have no force of 
> law, and a rush by IETF to honor extra-legal demands sets a 
> fatal precedent.
> 
> But giving the benefit of the doubt to those who demand that the 
> "non-negotiable requirements must be met", let's assume for a 
> moment that 
> the requirements come from USA/CALEA/FCC Ruling of August, 1999.
> 
> It is undisputed that IETF specifications and processes lead 
> to standards 
> and protocols that are world-wide in scope, rather than USA 
> in scope. What 
> status does US law/regulation/administrative law ruling have 
> over IETF 
> that, say, Myanmar law/regulation/administrative law rulings 
> do not? By 
> what mechanism is IETF to accept the legal requirements of 
> the USA, but 
> reject the legal requirements of, say, Syria, Libya, Iraq, 
> China or North 
> Korea, for example?
> 
> In the absence of a treaty brought to IETF by a 
> super-national body (UN, 
> World Court), is IETF to grant the same power to submit 
> "non-negotiable 
> requirements" to all governments or only the to the USA? If 
> only the USA, 
> what is IETF's basis for that discrimination?
> 
> If the USA is not to have unilateral and exclusive powers to 
> require and 
> define international Internet protocols and standards denied to other 
> nations, then prior to endeavoring to implement wiretapping 
> facilitation to 
> meet parochial US "requirements", wouldn't IETF at least 
> issue a CFR (Call 
> for Requirements) to governments? And what treatment would 
> IETF be expected 
> to give to a Myanmar "requirement" that IETF assist Myanmar 
> by a protocol 
> modification that assists LEA there in the identification of users of 
> modems, so that they can be legally prosecuted and executed 
> according to 
> the rule of (Myanmar) law?
> 
> But assuming that IETF determines to follow only US 
> administrative law in 
> regard to wiretapping, then of what import is it that the August 1999 
> ruling of the FCC separates out IP from wireline, cellular 
> and broadband 
> PCS requirements?
> 
> Of what import is its wording:
> "Under Section 107 of CALEA, we can establish technical 
> requirements or 
> standards only after a Government agency or person petitions 
> us to do so 
> because an industry standard has not been developed or because the 
> petitioner finds that such a standard is deficient.  In the 
> absence of a 
> petition, we do not have authority to establish standards and 
> thus do not 
> do so herein for telecommunications carriers deploying other 
> technologies.  We note that each of the requirements we adopt 
> herein with 
> respect to wireline, cellular, and broadband PCS carriers is not 
> necessarily appropriate for other technologies."
> 
> Of what import is the fact that substantial legal action 
> challenging the 
> FCC ruling is underway and filed in appropriate US courts?
> 
> What is the cause for haste that is pressed upon us?
> 
> Appearances: It is simply unseemly and profoundly offputting that the 
> motivating forces, governments/LEAs are not standing up 
> publicly with their 
> specific "non-negotiable requirements" in hand. If these demands are 
> legitimate and appropriate, why are we hearing from industry 
> executives who 
> have been hot-boxed, rather than from the governmental 
> entities who are 
> hot-boxing them. Is there something here that will not do well in the 
> sunshine of public debate and review? Hiding the motivating 
> forces behind 
> the curtain is not going to build trust nor generate consensus.
> 
> What to do: IETF has asked "should we...". Two answers have 
> been given (I 
> paraphrase):
> 1. NO, IETF should not...
> 2. YES, IETF must meet the non-negotiable requirements, and 
> the next step 
> is to begin the WG authorization process.
> 
> I submit that the second answer should be rigorously 
> explored, now, prior 
> to consideration of any wiretapping WG.
> 
> My rationale for this is as follows:
> 
> It is stated that the reason that IETF must take a certain action is 
> because of a legal requirement. To evaluate that dominant supporting 
> reason, since it is a reason purportedly based in law, a 
> legal review must 
> be made.
> 
> Specifically, IETF should acquire appropriate, high-level 
> legal advice on 
> this question: Does any legal requirement exist that has 
> jurisdiction and 
> standing to compel IETF "to develop new protocols or modify existing 
> protocols to support mechanisms whose primary purpose is to support 
> wiretapping or other law enforcement activities".
> 
> Such rigorous exploration might include an inquiry to the US 
> DOJ for their 
> position and to EPIC, ACLU, CSPR, and CDT for theirs, as well 
> as a call for 
> briefs from other sovereign legal entities. But the point 
> here is simple: 
> If we are to be compelled by a purported non-negotiable legal 
> requirement, 
> we must evaluate formally and rigorously, in the legal 
> environment with 
> legal professionals, whether or not such "legal requirement" 
> legimately 
> exists and is binding on IETF. For funding such legal 
> inquiry, why not 
> solicit the manufacturers, the membership and the civil 
> liberties community?
> 
> Does anyone object to initiating and concluding such a formal 
> legal review 
> prior to IETF commissioning a wiretap WG on the basis of purported 
> "non-negotiable legal requirements"?
> --
> --------------------------
> Ed Stone
> [email-masked]
> --------------------------
> 
> _______________________________________________
> raven mailing list
> [email-masked]
> http://www.ietf.org/mailman/listinfo/raven
> 

_______________________________________________
raven mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/raven

---

From: "chefren" <[email-masked]>
Date: Wed, 15 Dec 1999 02:35:15 +0100

(Sorry I didn't wrote last days, I was so stupid to look in 
a very tired modus after my nephew of 2 years with a fever 
of 40C...)

I intended to start writing again this friday with exactly 
the basics Brian described:

> 	Understands what is means to the protocols

..

> something he doesn't need.  I'm not in the habit of doing so.

I will definitely try to avoid all those laywer and politic 
discussions. They are senseless, since we live in a world 
where you cannot sell communication equipment in major 
countries if you cannot tap the customers you use the 
equipment for.

> Sorry, I have to go back to work

One of my problems...

From Friday on I will concentrate on what's needed, simply 
said, new and simple protocols to program the routers to 
lead datastreams along the tapbox. The moment a customer 
accesses the network of an access provider his access 
control software has to program his routers with that 
protocol with the given IP number so they rout it along the 
tapbox.

Thats the probably inevitable model that's needed and only 
the ins and outs of that model are relevant for the furter 
discussion.

IMHO of course...

+++chefren

---

From: Ed Stone <[email-masked]>
Date: Wed, 15 Dec 1999 08:03:35 -0500

<snip>
>countries if you cannot tap the customers you use the

If many "customers" want to be able to grab email addresses (without 
bothering the owner of the email address for permission) of web site 
visitors, should IETF modify SMTP, HTTP or POP protocols, upon sufficient 
request from "customers", to provide for that?

If not, then may we assume that any role of IETF in modifying protocols to 
facilitate wiretapping is NOT because of such "market demand", rather it is 
because of some sense of being compelled by law?

If the compelling is by law, rather than by "market demand", then when may 
we see IETF's rigorous legal review that answers these questions:

1. Will IETF implement protocol changes as to facilitate wiretapping and 
other government action by the law of any country? Laws of all countries 
except the nasty seven? US only? On what basis?

2. Since the use of protocols is global, how will IETF handle, via protocol 
modifications, what is required in one jurisdiction, but prohibited in another?

3. If the zeal to facilitate wiretapping is based on the current (Aug 99) 
FCC ruling re CALEA (US law only), why would IETF proceed prior to the 
specification of features required by TIA, as described in the FCC ruling? 
Why write standards now that the ruling expressly does not require until 
September 2001 at the earliest, assuming the court challenges to CALEA/FCC 
ruling that are undway fail?

4. From a legal standpoint, exactly what requirements definition, supported 
by exactly what law, do advocates propose IETF base its wiretap 
facilitation protocols upon?