Subject: RE: [Raven] Re: Thoughts of IESG and IAB members on Raven

From: Ed Stone <[email-masked]>
Date: Tue, 07 Dec 1999 09:34:48 -0500

At 07:44 AM 12/7/1999 , you wrote:
>Suppose I artificially restricted the membership of the
>WG to those people who had participated actively in
>IETF working groups for the past two years, and excluded
>from the group anyone who had not, and I still had 50
>people who wanted to work on wiretap?  Would you still
>ban the effort?

It seems time for a recap.

First, questions were posed to IETF for which the raven list was created. 
Those questions were:
"should the IETF develop new protocols or modify existing protocols to
support mechanisms whose primary purpose is to support wiretapping or other
law enforcement activities"

and

"what should the IETF's position be on informational documents that explain
how to perform message or data-stream interception without protocol
modifications".

The predominating response in numbers (see earlier reports of the meeting 
vote and the raven talley) is "No, IETF should not develop new protocols or 
modify existing protocols to support mechanisms whose primary purpose is to 
support wiretapping or other law enforcement activites." I have not seen 
stated here any disagreement that the above stated sentiment predominates 
in the meeting and on this list.

Regardless of the finding that IETF "should not", it is reported by a 
minority on the list that (and I paraphrase), "we have to do it because it 
is required and the requirements are not negotiable, so our only question 
is how do we go forward and do it". So then an exploration begins for the 
answers to two obvious questions:
1. what is "it"?
2. required by and declared non-negotiable by whom?

After some dodging and weaving, the obvious is admitted: it is 
government/LEA who has non-negotiable requirements, and who is the 
motivating force behind the demand for new or modified protocols to 
facilitate wiretapping.

This leads me to inquire:
1. If there are non-negotiable requirements that IETF must meet in its 
standards and protocols, then are we to actually believe that they are not 
written down, and that we cannot all see them? That rather than being 
written and public in the tradition of law and regulations, they exist only 
in the mind of governors and are only verbally transmitted on a 
need-to-know basis?
2. If they are requirements of the government, are they in the form of a) 
law, lawful regulation, or treaty, or are they b) extra-legal demands, 
without the benefit of any legal standing?

If a) then we can all read them now and understand their legal basis and 
jurisdiction. We can all see what "it" is. If b) then they have no force of 
law, and a rush by IETF to honor extra-legal demands sets a fatal precedent.

But giving the benefit of the doubt to those who demand that the 
"non-negotiable requirements must be met", let's assume for a moment that 
the requirements come from USA/CALEA/FCC Ruling of August, 1999.

It is undisputed that IETF specifications and processes lead to standards 
and protocols that are world-wide in scope, rather than USA in scope. What 
status does US law/regulation/administrative law ruling have over IETF 
that, say, Myanmar law/regulation/administrative law rulings do not? By 
what mechanism is IETF to accept the legal requirements of the USA, but 
reject the legal requirements of, say, Syria, Libya, Iraq, China or North 
Korea, for example?

In the absence of a treaty brought to IETF by a super-national body (UN, 
World Court), is IETF to grant the same power to submit "non-negotiable 
requirements" to all governments or only the to the USA? If only the USA, 
what is IETF's basis for that discrimination?

If the USA is not to have unilateral and exclusive powers to require and 
define international Internet protocols and standards denied to other 
nations, then prior to endeavoring to implement wiretapping facilitation to 
meet parochial US "requirements", wouldn't IETF at least issue a CFR (Call 
for Requirements) to governments? And what treatment would IETF be expected 
to give to a Myanmar "requirement" that IETF assist Myanmar by a protocol 
modification that assists LEA there in the identification of users of 
modems, so that they can be legally prosecuted and executed according to 
the rule of (Myanmar) law?

But assuming that IETF determines to follow only US administrative law in 
regard to wiretapping, then of what import is it that the August 1999 
ruling of the FCC separates out IP from wireline, cellular and broadband 
PCS requirements?

Of what import is its wording:
"Under Section 107 of CALEA, we can establish technical requirements or 
standards only after a Government agency or person petitions us to do so 
because an industry standard has not been developed or because the 
petitioner finds that such a standard is deficient.  In the absence of a 
petition, we do not have authority to establish standards and thus do not 
do so herein for telecommunications carriers deploying other 
technologies.  We note that each of the requirements we adopt herein with 
respect to wireline, cellular, and broadband PCS carriers is not 
necessarily appropriate for other technologies."

Of what import is the fact that substantial legal action challenging the 
FCC ruling is underway and filed in appropriate US courts?

What is the cause for haste that is pressed upon us?

Appearances: It is simply unseemly and profoundly offputting that the 
motivating forces, governments/LEAs are not standing up publicly with their 
specific "non-negotiable requirements" in hand. If these demands are 
legitimate and appropriate, why are we hearing from industry executives who 
have been hot-boxed, rather than from the governmental entities who are 
hot-boxing them. Is there something here that will not do well in the 
sunshine of public debate and review? Hiding the motivating forces behind 
the curtain is not going to build trust nor generate consensus.

What to do: IETF has asked "should we...". Two answers have been given (I 
paraphrase):
1. NO, IETF should not...
2. YES, IETF must meet the non-negotiable requirements, and the next step 
is to begin the WG authorization process.

I submit that the second answer should be rigorously explored, now, prior 
to consideration of any wiretapping WG.

My rationale for this is as follows:

It is stated that the reason that IETF must take a certain action is 
because of a legal requirement. To evaluate that dominant supporting 
reason, since it is a reason purportedly based in law, a legal review must 
be made.

Specifically, IETF should acquire appropriate, high-level legal advice on 
this question: Does any legal requirement exist that has jurisdiction and 
standing to compel IETF "to develop new protocols or modify existing 
protocols to support mechanisms whose primary purpose is to support 
wiretapping or other law enforcement activities".

Such rigorous exploration might include an inquiry to the US DOJ for their 
position and to EPIC, ACLU, CSPR, and CDT for theirs, as well as a call for 
briefs from other sovereign legal entities. But the point here is simple: 
If we are to be compelled by a purported non-negotiable legal requirement, 
we must evaluate formally and rigorously, in the legal environment with 
legal professionals, whether or not such "legal requirement" legimately 
exists and is binding on IETF. For funding such legal inquiry, why not 
solicit the manufacturers, the membership and the civil liberties community?

Does anyone object to initiating and concluding such a formal legal review 
prior to IETF commissioning a wiretap WG on the basis of purported 
"non-negotiable legal requirements"?
--
--------------------------
Ed Stone
[email-masked]
--------------------------

_______________________________________________
raven mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/raven

---

From: [email-masked] (Mikus Grinbergs)
Date: Tue, 07 Dec 1999 09:23:56 -0600

> "non-negotiable legal requirements"?

No objection.

But please consider that asking "Is there a law ... ?" lets OTHERS
(those that make the laws) determine the circumstances.  Further,
laws can be changed - if for example CALEA would not apply to net
wiretaps, those who passed CALEA can simply pass a new law that
does require tappability of all net communications.

I think the question should be "When should vs. should_not the IETF
work to meet requirements that are subordinate to communications?"
The answer would come from the IETFers themselves.  And the answer
should be expressed as a clearly understandable policy statement.
Then future requests to the IETF, such as for the establishment of
a particular WG, could be measured against explicit policy criteria.

mikus