Subject: FW: [Raven] Re: Raven, What's Needed...

From: Chris Savage <[email-masked]>
Date: Wed, 22 Dec 1999 18:40:00 -0500

This was sent just to Mr. Chefren earlier, but was intended for the list... 

-----Original Message-----
From: Chris Savage
To: 'chefren'
Sent: 12/22/99 5:53 PM
Subject: RE: [Raven] Re: Raven, What's Needed...

chefren said:

>OK, so maybe one of the participants who work for Cisco, 
>Nortel or another company can "step forward" and tell us 
>more?

It would certainly save me (and my clients) some time and money!

>> These are all interesting topics on some level.  But they 
>> seem to be beside the point.  If the law is such that "an
>> Internet standard is needed," then one is "needed."
>
>Eh, I haven't seen a law that states such a thing. The 
>standard is just needed for compatibility/economic-
>efficiency and =good auditability=.
>
>> Only if a consensus emerged in favor of making life hard
>> for LEAs, laws notwithstanding, would "no standard" then
>> be an appropriate outcome in terms of a consensus-based
>> process. 
>
>I still think "childish" is the only word for that outcome.

Your basic point being, "c'mon guys, this is the way the world is
heading, get with the program?"

From this perspective, those debating you on matters of policy remind me
of Wm. F. Buckley (a prominent conservative in the US) describing his
mission in founding his (influential among conservatives) magazine in
the 1950s as "Standing athwart history and yelling 'STOP!'"

I expect that few debating you would like to be identified with Buckley
generally, but the movement he helped crystallize and inform did more or
less run the US from 1980-92, and has radically changed the terms of
debate since then.  Who amongst your interlocutors would not be
delighted by success in the measure achieved by conservatives in the US?
Yet things looked pretty grim for them for some time, including much of
the 1960's and 1970's.

>>  On the other hand, if the
>> law is such that "no Internet standard is needed," then one would be
>> supplied only if a consensus emerged that the IETF should 
>> take steps to make life easy for LEAs, beyond what is legally
required.
>> 
>> If I had to bet, I'd bet that the Internet community 
>> generally is more likely to achieve consensus around the
>> idea of slowing down LEAs despite laws supposedly mandating
>> cooperation, than it is likely to achieve consensus around the
>> idea of helping LEAs when no law requires cooperation.
>> But that's just from watching the traffic go by on this list 
>> for the last n weeks...
>
>Well there were a few but pretty distinct postings by Fred 
>Baker, Brian Rosen and others that pointed in "the other" 
>direction.

Which raises the unending "political" debate about process, consensus,
leadership, burden of proof, etc.  What happens in the IETF if the "big
guns" think the outcome ought to be X but (let's say, hypothetically)
that a substantial majority of the working stiffs think the outcome
ought to be Y, or at least not-X?

>> >> Now, lawyers generally do work for clients.  I don't know 
>> >> that the "IETF" is a sufficiently corporate entity to 
>> >> actually be a "client," although other 
>> >> Internet-associated groups not only no doubt are, but 
>> >> probably already have their own counsel.
>> >
>> >As far as I know the IETF can definitely not be "sued" 
>> >because they don't supply a standard.
>> 
<snip>
>> What I was implying was
>> that the legal issues involved here are likely to be big and 
>> complicated, which means if they need to be answered, someone
>> probably needs to actually *pay* some lawyer to answer them, 
>> and that, as I understand it, the IETF is not likely to do itself.
>
>I don't think the legal issues are big and complicated.

Just hire two decent lawyers to take opposite sides of them, and you
will be utterly astonished how complicated they will become.  To use an
example from the US/CALEA issues, there was a heated exchange before the
FCC about whether and to what extent it mattered that Congress changed a
particular term from "call set-up information" to "call-identifying
information" in the process of considering, amending, then enacting
CALEA.  Scrutinizing how controversial legislation evolves even before
it is enacted is garden-variety legal argumentation.  But it immediately
takes you beyond what the law itself literally says.  (And, yes, there
are specific legal rules to tell you when you should look beyond what
the law actually says and when you shouldn't.  And exceptions to those
rules.)

Legal argumentation can be modeled as, e.g., an arms race or repeated
rounds of applying a fractal-generating formula.  The complexities and
subtleties are, and become, effectively infinite.  I'd apologize, but,
like the scorpion said to the camel in mid-river, it's just our nature.

> And I don't think they are of any importance for IETF.

Well, legal developments are at the base of the "market demand" that
underlies your "get with the program" assessment.  I can see your point
that if there is strong market demand for X, there is some basis for the
IETF to create a standard for X.  I guess I am concerned that there is
an unexamined run from "the law requires it, so vendors are demanding
it, so we've got to do it."  I suppose on some level that if all the
important Internet gear makers wanted a standard on this stuff, couldn't
they just make one up, publish it, and build to it?  Or they could all
send a joint letter to the IETF saying, "please develop a standard for
this," which (I gather) has not actually happened.

But you are certainly correct that none of the laws of which I am aware
directly requires the IETF to do anything.

Chris S.
(my views are my own)

*************************************************************************** 
This electronic mail transmission may contain confidential or 
privileged information.  If you believe that you have received the 
message in error, please notify the sender by reply transmission 
and delete the message without copying or disclosing it. 
***************************************************************************

_______________________________________________
raven mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/raven

---

From: "chefren" <[email-masked]>
Date: Thu, 23 Dec 1999 00:58:25 +0100

On 22 Dec 99, at 17:53, Chris Savage wrote:

> To use an example from
> the US/CALEA issues, there was a heated exchange before the FCC about
> whether and to what extent it mattered that Congress changed a particular
> term from "call set-up information" to "call-identifying information" in the
> process of considering, amending, then enacting CALEA.

Seems an American tradition to be no-cooperative with the 
law?

I've seen Mr Gates on television starting discussions with 
the judge about the most common english words.

However, Australian and EU directives are very clear about 
the above: All information. Even the =physical location= of 
the tapped communicators if known. (And it is known with 
GSM because of the technology.)

+++chefren

---

From: Chris Savage <[email-masked]>
Date: Thu, 23 Dec 1999 05:31:53 -0500

>Seems an American tradition to be no-cooperative with the 

No doubt true.  We're basically schizophrenic about law and law enforcement.
To list but one example, Dr. Martin Luther King, now honored with a national
holiday, was famous for his public civil disobediance: blatantly ignoring
laws with which he disagreed, in order to illustrate their injustice.  And
he is even sort of relevant to this list, given the degree of surveillance
to which he was subject.

>the judge about the most common english words.

Not to mention Mr. Clinton, who is, under our system of government, the
chief executive charged with enforcing the law.  Go figure.

>GSM because of the technology.)

Physical location is another one where CALEA doesn't expressly say (if I
recall correctly; I'm not in my office at the moment so can't check to be
sure), but where there was great controversy about just how much information
about "location" could be required by LEAs and provided to them.

Chris S.

---

From: Chris Savage <[email-masked]>
Date: Thu, 23 Dec 1999 15:14:46 -0500

Dang, did it again...

Christopher W. Savage, Cole, Raywid & Braverman, L.L.P.
1919 Penn. Ave. N.W., Suite 200, Washington, D.C. 20006
voice: 202-828-9811 e-fax: 703-991-1470  fax: 202-452-0067	

-----Original Message-----
From: Chris Savage 
Sent: Thursday, December 23, 1999 1:26 PM
To: 'chefren'
Subject: RE: [Raven] Re: Raven, What's Needed...

>From: chefren [mailto:[email-masked]]
>Sent: Thursday, December 23, 1999 12:58 PM
>To: [email-masked]
>On 23 Dec 99, at 11:07, Ed Stone wrote:
>> 
>> >chfren wrote:
>> >
>> Most Americans obey most laws most of the time. Particularly 
>> the reasonable laws. But some don't.
>
>Ah, so if an American is too stupid to understand a law and 
>thinks it's an unreasonable one he hasn't to obey that law?

Not exactly.  One of the great maxims of the law is "ignorance of the law is
no excuse."

What is actually the American tradition is affirmatively flouting laws that
strike us as wrong.  For a LEA (or even a court) to acknowledge that this is
legitimate behavior is impossible, and they basically don't.  (As always,
exceptions exist...there is a long tradition of basically nullifying (some)
laws of general application in case of sufficient conflict with someone's
religious beliefs; and then there is "jury nullification," where a jury
intentionally defies a judge's explanation of the law as applied to facts,
and simply refuses to convict someone, despite a clear showing of a legal
violation.)  But in the broader social and political context of the US,
certain types of defiance of the law is regarded as heroic.

Not to mention the related but ultimately separate US tradition of
romanticizing "glamorous" outlaws -- Billy the Kid, Bonnie & Clyde, etc.  As
a generalization, we like to support the "little guy" against the "big guy."
Sometimes that applies, as a sociological matter, to the "little guy"
robbing banks and the "big guy" of law enforcement trying to stop him.  I
don't think anyone thinks that this tradition (glamorizing outlaws) makes
any identifiable "sense" at all, other than being a somewhat peculiar
instance of our general tendency to like the underdog.

>Funny Americans seem "proud" of it.

Some are, some aren't.  We are on the whole a more complex people than we
are given credit for in some quarters.

Chris S.

---

From: Chris Savage <[email-masked]>
Date: Tue, 28 Dec 1999 08:04:06 -0500

>From: Ben Laurie [mailto:[email-masked]]
>Sent: Friday, December 24, 1999 10:06 AM
>To: Chris Savage
>Cc: 'Fred Baker '; 'chefren '; [email-masked] '
>Subject: Re: [Raven] Re: Raven, What's Needed...
>
>Interesting. So we may end up with the FCC modifying IETF standards?
>What happens when the consensus says "no" to their modifications?
>

Well, there are some steps in there.

First off, the standards apply only to telecommunications carriers and to
equipment used for the transmission and switching of telecommunications.

So the first step to the FCC getting involved in some space that is also
"IETF space" is a conclusion that what the relevant entities are doing,
under US law, is a form of telecommunications, as opposed to information
services.  Not impossible, but that would be a large step for the FCC to
explain (which under US law they have to do, or courts reverse their
actions) in light of their consistent treatment of ISPs and the Internet
generally as involving information services.

But *IF* that Rubicon were crossed, then, sure, of course the FCC would be
involved, because their jurisdiction in the US extends to telecommunications
(among other things), which, by hypothesis, this would be.

The basic process would be this.  An industry group or whomever establishes
a standard (here, by hypothesis, IETF).  That action by industry creates a
"safe harbor," i.e., as long as the standard has not been modified by the
FCC, compliance with it means that you can't be found to be out of
compliance with the underlying statute (CALEA).  This means that if a LEA
wants something beyond what the standard calls for, they have to pay for it
(see below).

If someone thinks that the standard is no good in some respect (e.g., a LEA
thinks it doesn't go far enough to assist tapping, a privacy group thinks it
goes too far) they can petition the FCC to review it (i.e., file some papers
explaining what the supposed problem is).  The FCC then will review the
matter and after taking public comments, etc., will issue a ruling either
okaying the existing standard, or indicating that changes are required.

Nobody has to comply with the changed standard.  Actually, nobody has to
comply with the *original* standard, either.  But if you don't comply with
the applicable standard (original, pre-FCC action; modified, post-FCC
action), and a LEA comes to you with a warrant or other authorization to do
something that the standard deals with, and you can't do it (either as per
the standard *or in some other way*), then they can get a court order
requiring you to do it at your expense, and they can have you fined for not
complying with the law.

Not to be too terribly crass about it, but there is a sense in which CALEA
is primarily about neither the effectiveness of tapping nor the privacy
rights of individuals, but, instead, about money.

If a LEA really, really needs some complex gizmo attached to an ISP or
backbone provider's facilities in order to investigate some bad guys, they
can probably get a court to issue an order authorizing the attachment of the
gizmo.  What CALEA primarily addresses from an economic perspective is, who
pays for the gizmo and the infrastructure to support it within the entity's
network/facilities?  If the particular gizmo is, or does stuff that is,
above and beyond the call of any applicable standard, then (IIRC) the entity
served with the papers is required to lend "reasonable" assistance (or some
such vague phrase) under US law.  Meaning, if the gizmo is too odd or too
cumbersome, the LEA, not the entity, has to pay.  OTOH, under CALEA if there
is (for example) a standard that provides that the entity needs to have a
standard Ethernet port that will output the requested data in a simple
format, and the LEA shows up with an appropriate plug, then the entity is on
the hook for the cost of installing the appropriate port (and support
software, etc.) if one isn't there.

Now, where all the politics gets involved in this economic notion, I
suppose, is that the more the LEAs have to spend to get their information,
the more sparing they will be in seeking taps, using them only in important
cases where they are most likely to generate usable information, etc., etc.

Chris S.

All views are my own.

---

From: Chris Savage <[email-masked]>
Date: Tue, 28 Dec 1999 08:18:29 -0500

>From: Richard Payne [mailto:[email-masked]]
>Sent: Tuesday, December 28, 1999 7:55 AM
>To: Fred Baker
>Cc: [email-masked]
>Is this "safe harbor" being challenged by the TIA as going 
>beyond the scope
>of CALEA, and hence not really a safe harbor at all, or is it 
>only being
>challenged by the ACLU, the EFF, and EPIC?
>
>Richard Payne

AFAIK, the latter.  The FCC, however, did not literally require compliance
with the packet-mode communications segment of J-STD-025 at this time.  They
sent TIA back to the drawing board, to report in September 2000, with a
compliance date of September 2001.  I think the expectation is that the
final standard will look a bit different.

But, IIRC, ACLU/EPIC etc. are challenging the "approval" of the existing
standard (with the 9/01 compliance date) because it permits the carrier to
forward to the LEA both packet header (identification) information along
with packet payload (content) information, on the strength of a LEA
authorization that extends only to identification information.

Chris S.

All views are my own.

---

From: Ed Stone <[email-masked]>
Date: Tue, 28 Dec 1999 08:31:07 -0500

>cases where they are most likely to generate usable information, etc., etc.

Also in the process of insuring that, like CALEA, if the US government 
creates such laws, they also create the demand to fund it. That funding 
will either be US taxpayer funds, or action by ISPs nationwide to 
dramatically jack up rates to consumers.

If every one of the millions of consumers hears that he is going to need to 
chip in another $60/year so the gov't can wiretap him, that will get 
healthy attention.

If it is public funding then that requires going to congress.

Going to congress requires at least the usual embarrasing (but telling) 
midnight cave in, or possibly even a little public debate.

IETF rushing in retards both of those possibilities.

The costs, and the incidence of "taxation" should be in plain sight and the 
process should be public.
--
--------------------------
Ed Stone
[email-masked]
--------------------------

---

From: Chris Savage <[email-masked]>
Date: Thu, 30 Dec 1999 07:54:24 -0500

>2) If the ISP can't read the content of traffic going through 
>it, because it's encrypted, and allows LEA's complete access to the
(unreadable)
>packets, has it fulfilled all its legal requirements under the
>Telecommunications Act?
>
>Richard Payne

This question assumes that an ISP is subject to CALEA (which is what I
assume you meant by "the Telecommunications Act").  Generally in the US that
is not the case.

But this raises a few technical questions.

If a LEA can convince a court that it needs access to a particular subject's
communications with an ISP, the LEA can get an order to obtain the contents
of messages sent over the subject's phone line.  That order would be
implemented by the subject's telecommunications carrier.  The LEA could then
record/analyze everything that went over the line, including modem signals
between the subject's computer and the subject's ISP.  Presumably these are
not terribly difficult to convert into packets by one sufficiently
technically skilled.  Is that true?  If a competent techie employed by or
under contract to a LEA has an accurate recording of the signaling sent
between a subject and an ISP (provided by tapping the carrier-provided
link), can that signaling be accurately reconstructed into packets?

Now, if the packet payloads are encrypted, then the LEA has a problem, but
that problem is the same as it would have if it picked up the packets from
the ISP.  Let's leave that aside.

Put another way, one of the underlying assumptions in this discussion seems
to be that there will be information that a LEA can obtain from a "tap" of
an Internet entity (e.g., ISP) which cannot equally well be obtained from a
standard intercept of a subject's phone line.  I am not a "techie," so I
could well be missing something, but I don't see how that could be true in
most cases.  Entity X connects to the Internet by means of some link,
provided by a carrier, between X's location and X's ISP.  Under CALEA the
carrier is subject to various surveillance support obligations, and could
presumably be required to provide the content of the communications sent
between the subject and the ISP.

I'm not saying that the fact that the ability to tap an ISP is (may be?)
utterly superfluous to LEA access to a subject's packet-based transmissions
has the effect of limiting the scope of the law (whatever that scope may
be).  But if I am correct that such ability is actually superfluous, that
would certainly be a relevant fact in various contexts.

Am I correct?  When, if ever, would an Internet entity have information
about a subject's transmissions that would not be obtainable by a LEA simply
tapping the carrier-provided link between the subject and the Internet?

Chris S.

All views (and all questions) are my own.