Subject: [Raven] Preponderance say "No"?

From: Ed Stone <[email-masked]>
Date: Tue, 28 Dec 1999 11:57:00 -0500

At 11:46 AM 12/28/1999 , you wrote:
On 28 Dec 99, at 11:19, Ed Stone wrote:

 > At 11:11 AM 12/28/1999 , chefren wrote:
 > >Tappability is required as it was with other technical
 > >communication methods like snailmail, telephone, telex and
 > >fax. The lawyers have some experience with the first
 > >technical offerings for Internet tappings and have
 > >concluded that it's unacceptable to get information from
 > >other persons/organisations than were they have a warrant
 > >for.
 > >
 > >So now the techies have to show what's possible.
 >
 >
 > At 01:47 PM 10/11/99 -0400, The IESG wrote:
 >  >  "should the IETF develop new protocols or modify existing protocols
 >  >  to support mechanisms whose primary purpose is to support wiretapping
 >  >  or other law enforcement activities"
 >
 > Chefren, do you agree that the preponderance of people posting to this list
 > have answered the question above essentially as  "No." ?

(Hm... Aren't you spoiling a thread?)

I have no problems with you concluding as such, the IETF
chairman wrote only some days ago:

Chefren, I am not asking what you think of my concluding that the answer 
from the preponderance of people posting here is "no", rather I am asking 
if you also conclude that the answer from the preponderance of people 
posting here is "no".

--
--------------------------
Ed Stone
[email-masked]
--------------------------

_______________________________________________
raven mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/raven

---

From: "chefren" <[email-masked]>
Date: Tue, 28 Dec 1999 19:30:48 +0100

> if you also conclude that the answer from the preponderance of people 

Unfortunately I cannot find that message in my archive, and 
the web-archive seems to "end" at Nov 30 1999, I don't know 
what went wrong, please accept my apologies if I made a 
mistake.

(If Ed Stone can forward the message I would be happy!)

=

Although I think it's at least a little misleading I have 
no problems with the exact phrase 'conclude that the answer 
from the preponderance of people posting here is "no"'. Yes 
that's my opinion but since I'm not in charge here I doubt 
if my opinion is of any value.

If the chairman both thinks so AND doesn't close the Raven 
list I think he want's or needs other results. Not 
necessarily everyone saying "yes", but =new= ideas and 
thoughts.

=New= things often come from the smallest thinkable 
minority and so we have to care individuals...

I'm more or less fixed on what I think is a basic question: 
=how= tapping could be done best (auditability/guarantees 
against misuse). Respectable governements have already made 
laws that require tappability and I'm not going to fight 
that. Fighting tappability, in my opinion stupid, is 
spoiling this list, my opinion sorry. That are bot my 
=personal= opinions and I have no problems with respecting 
most of the people who do want to fight and I even highly 
respect most of the reasons why they do so.

If we have good proposals for tapping standards it's far 
easier to discuss if the IETF will set them or not. I think 
the discussion definitely still lacks input.

See what has happened in the US without good tapping 
standards: From a distance Los Angeles Police seemed 
comparable to a kind of totally uncontrolled KGB.

Unthinkable here in The Netherlands. Because we have 
thought about problems and solutions and implemented some 
of the solutions in a pretty reasonable way.

+++chefren

---

From: Ed Stone <[email-masked]>
Date: Tue, 28 Dec 1999 14:06:54 -0500

>what went wrong, please accept my apologies if I made a

What message are you looking for, rather than answering my question, which is:

To the first question assigned to this list by IESG, which was "The IESG wrote:
"should the IETF develop new protocols or modify existing protocols
to support mechanisms whose primary purpose is to support wiretapping
or other law enforcement activities" ,

Do YOU conclude that the answer from the preponderance of people posting 
here is "no"?

---

From: "chefren" <[email-masked]>
Date: Tue, 28 Dec 1999 20:26:14 +0100

On 28 Dec 99, at 19:30, chefren wrote:

  > Although I think it's at least a little misleading I
  > have no problems with the exact phrase 'conclude that
  > the answer from the preponderance of people posting here
  > is "no"'. Yes that's my opinion but since I'm not in
  > charge here I doubt if my opinion is of any value. 

Translation?: YES.

Again: of no importance as far as I see it.

+++chefren

p.s. Please forward the message you seemed to quote that I 
missed in my archive.

---

From: Ray Yang <[email-masked]>
Date: Tue, 28 Dec 1999 16:17:43 -0500 (EST)

> of the solutions in a pretty reasonable way.

	You miss the point, chefren. In LA, there were stringent tapping
standards supposed to be legally auditable (we're speaking of phone taps
in this case). This is a case where the police decided they didn't give a
damn about rights, about law, or about due process -- they just wielded
power over their fellow citizens while hiding behind their uniforms and
their lawyers. You can look at it this way: IF it was harder to tap
phones, IF it was a technically difficult (i.e. non-standardized) feat, IF
tapping was not supported, you can be damned sure that police would only
go to the immense trouble of tapping when they truly need it. 
	I don't know enough about the Netherlands to dispute with you the
extent of police powers there, but I will suggest that if you give power
to somebody, you must be prepared for the abuse of that power -- so if
that power isn't necessary, you shouldn't give it. The power we're talking
about here is a standardized method for tapping the communications of
private citizens -- which, as numerous people have pointed out, in the age
of automation translates into the ability to tap on a massive scale very
easily. We don't need it. We want to make tapping very hard. 

Ray

---

From: "chefren" <[email-masked]>
Date: Tue, 28 Dec 1999 23:34:32 +0100

On 28 Dec 99, at 16:17, Ray Yang wrote:

> in this case).

Hm... "supposed to be" but it has been proven that they 
weren't?

> This is a case where the police decided they didn't give a
> their lawyers.

Come on, thats impossible with good procedures and splitted 
powers. The telecom providers had to assist and in The 
Netherlands should have broken the laws as much as the 
police. Nowhere do I read any complaints about the telecom 
companies so I see no sign of serious auditability.

> You can look at it this way: IF it was harder to tap

That's a way that's has no reason behind it. Democracies 
have chosen tapping should be possible, with good reasons I 
think with bad reasons most of the writers here think. 
Doesn't matter. Under serious conditions taps are allowed 
and thats a basic requirement.

> that power isn't necessary, you shouldn't give it.

That seems somewhat comparable to "don't give the police 
guns because the might misuse them".

Wrong start.

A democracy decides the police may tap if good defined 
critera are met.

Because tapping can be misused there are strict controls 
needed. What I expect is happening in America: Police 
officers talk directly with telecom company people, become 
friends and "help" each other. That's a way of tapping left 
years ago in The Netherlands. There are central offices on 
both sides that communicatate via faxes in a simple 
challenge response way. For analog taps that's it, for 
digital taps (ISDN/GSM) the recorders and tapboxes in the 
telecom switches do serious DES based challenge response. 
Everything via ISDN lines so it's pretty difficult to come 
in between.

Certainly not a perfect way but I guess there is about no 
abuse of the law for years.

> The power we're talking
> easily.

There is NO "automatic" translation to massive scale 
tapping if there are serious standards and procedures.

> We don't need it.

That's not up to you or me, governments can perfectly 
decide for themselves.

> We want to make tapping very hard. 

Not me.

What I read in your line is "we want to make it as 
difficult as possible to crack down organized crime" and 
that's a pretty stupid idea IMHO.  

What keeps puzzling me is that a pure aggressive point of 
view "We want to make tapping very hard.", one that's 
clearly against the intentions of laws, is a fully 
acceptible one.

+++chefren

---

From: Peter Greenwood <[email-masked]>
Date: Wed, 29 Dec 1999 01:35:51 +0000

> That seems somewhat comparable to "don't give the police  guns because
> the might misuse them". 

If you're suggesting that is a ridiculous idea, come to Britain sometime
and look at some typical policemen.

The police here do have access to guns ... for specific purposes, for use
only by specially trained officers and only with proper authorisation. Even
with these restrictions there have been several much-debated cases of
innocent citizens being shot.

This point highlights an underlying problem which has been mentioned before:
what is required in one jurisdiction may well be unacceptable somewhere else.

-- 
	Peter Greenwood		[email-masked]

---

From: "chefren" <[email-masked]>
Date: Wed, 29 Dec 1999 03:15:01 +0100

> what is required in one jurisdiction may well be unacceptable somewhere else.

?

Fire arms are regulated, as far as I know in every country 
of this world. The policemen in The Netherlands may not 
bear arms if they haven't had enough training and passed 
tests.

  There was some fuzz about it a few weeks ago. Proof the
  control systems worked I think 

"Unacceptable" is just an extreme on a scale, measurement 
according to a standard.

If tapping standards exist they will have about nothing to 
do with the use of them.  Regulation in individual 
countries will "decide" about that.

The more I think of it the more absurd it seems to me if 
the IETF says "no we don't make standards for tapping".

With IPSEC IETF has manufactured a kind of virtual "gun" 
that clearly can be used for good and for bad. Was there 
much discussion about it? I would be surprised if anyone 
had stood up to say "hey and what if criminals would use it 
for organizing crimes, what can we do against misuse?".

Like firearms tapping is sometimes necessary, it's up to 
governments to decide when. Some may say "never" others may 
say "often", not up to us. What we techies can do is to 
design auditability in the standards so misuse can be 
detected.

+++chefren

---

From: "Richard Payne" <[email-masked]>
Date: Wed, 29 Dec 1999 06:20:19 -0500

>A democracy decides the police may tap if good defined

and

>clearly against the intentions of laws, is a fully

What keeps puzzling me is someone who continues to make arguments starting
from:

a) one false premise ("all governments are democracies"); and

b) another premise false in many democracies ("laws require tapping the
Internet")

without, apparently, noting that the conclusions of an argument are suspect
if the premises are false.

Richard Payne

---

From: "chefren" <[email-masked]>
Date: Wed, 29 Dec 1999 14:13:41 +0100

> a) one false premise ("all governments are democracies"); and

Where did I say so?

I'm not interested in countries or people that misuse 
technology in any other way than supplying them with 
technology that registers misuse.

It's probably possible to kill people with water in 100 
way's. Is that interesting? I don't think so. Tapping 
Internet is very easy with tcpdump but such a tap is 
unrespectable since it breaches privacy from people and 
companies that shouldn't be tapped.

There are =respectable countries= that demand

A) Tappable networks

B) Only data of the person or company law enforcement for
   whom or which law enforcement has a warrant.

"Valid" demands in my eyes, demands that deserve good standards.

> b) another premise false in many democracies ("laws require tapping the

The world isn't static, the first democracies are "over the 
line" and unevitably more will follow.

If you don't want to look further than "now" it's OK for me 
but I'm not interested in definitely shortsighted opinions.

> without, apparently, noting that the conclusions of an
> argument are suspect if the premises are false. 

My premises aren't false, you try to turn them without much 
succes as far as I see it. The Netherlands and Australia 
have laws in place and need standards. More countries, rest 
of EU, East Block, Turkey and others, will follow. If you 
cannot reason that I'm sorry for you.

And again, even "less respectable countries" may use 
auditable standards.

They will definitely gain respect if they do so.

Away with all those unauditable taps in courts "now"!

+++chefren