Subject: [Raven] Draft Policy Statement

From: "Richard Payne" <[email-masked]>
Date: Thu, 2 Dec 1999 17:17:08 -0500

Here is a draft policy statement that I think covers the main issues. It's
obviously not middle-of-the-road, but I think that it applies to the world
in which we live and provides practical guidance.

Richard Payne

----------------------------------------------------------------------------
-----------------------------------------------------------

Draft IETF Policy Statement On Interception

Given:

a) the importance of secure communications on the Internet;

b) the fact that interception tools such as tcpdump already exist;

c) the inability of hardware and software to detect the intent of the person
using them; and

d) the global nature of the Internet, such that not all users of
interception capabilities can reasonably be assumed to be as benevolent as
America's law enforcement agencies;

there is no need for the IETF or any of its working groups to develop new
interception tools or capabilities, and it would be unwise for them to do
so.

Consistent with the commitment to security and privacy outlined in RFC 1984,
the IETF should continue to have as an objective the development of
end-to-end secure, back-door-free protocols such as IPSEC. Widespread usage
of these protocols will eventually reduce the security risks associated with
point b) above.

The IETF should also continue to have as an objective the development and
dissemination of information on known security problems with existing
protocols. Any potential disclosure of information to a destination not
intended by the sender of the information should be considered to be a
security problem.

Work contemplated by Megaco and currently underway in Packet Cable and T1P1,
supporting wiretapping, should not be undertaken, since it is inconsistent
with these objectives.

_______________________________________________
raven mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/raven

---

From: "chefren" <[email-masked]>
Date: Fri, 3 Dec 1999 20:50:14 +0100

On 2 Dec 99, at 17:17, Richard Payne wrote:

> Any potential disclosure of information to a destination
> not intended by the sender of the information should be
> considered to be a security problem. 

A security problem for the communicating parties or for 
society?

That's the essential question you don't want to take care 
of.

+++chefren

= =
ii.nl ontwerpt, bouwt én onderhoudt websites
100 Euro aanbrengpremie: http://www.ii.nl/premie

---

From: Ed Stone <[email-masked]>
Date: Fri, 03 Dec 1999 15:17:53 -0500

>That's the essential question you don't want to take care

There are two opposing fears at play:
1. The fear of the harm that people could commit if their communications 
are not more cheaply and easily tappable.
2. The fear of the harm that government could commit if people's 
communications are more cheaply and easily tappable.

Some would rather risk number 2. Some would rather risk number 1.

--
--------------------------
Ed Stone
[email-masked]
--------------------------

---

From: Fred Baker <[email-masked]>
Date: Fri, 03 Dec 1999 12:47:46 -0800

>Some would rather risk number 2. Some would rather risk number 1.

So how do we come up with a policy on IETF feature development that
recognizes and legitimizes people's freedom to choose which they fear more?
Or are we not free to decide that?

While this active disagreement (I can't call it a debate, I don't see you
guys refuting each other's arguments, clarifying opinions, or moving
anything towards a consensus) is interesting, I don't see it leading us
toward a useful conclusion related to the purpose of this list.

---

From: "chefren" <[email-masked]>
Date: Fri, 3 Dec 1999 22:12:34 +0100

We should hurry up somewhat now...

> Some would rather risk number 2. Some would rather risk number 1.

Fears do not apply to techies (us here).

A) We are agains any form of backdoors.

B) Auditable tapping protocol and necessary tapbox is
   technically reasonable.

All countries in the world can have their own laws: I'm not 
interested in that. It is none of my business. What I want 
is that =IF I'm tapped= I want a tap that's as secure as 
possible. Secure in a few ways:

A) People who asked the tap, who set the tap and who
   listened to the tap should definitely be entitled to
   do so.

B) I want encryption techniques to be used to make sure
   nobody exchanged the words "no" and "yes" in my tapped
   message so it seems on two places that I said the
   opposite thing. (MD5 hash)

C) I don't want others listening in. So please use strong
   encryption between tapbox and tapping room. (

D) I would like it if hashess of all my properly tapped
   messages were send to a third party.

E) <to be defined>

F) ..

Please stop all other forms of idealistic writing?

+++chefren

= =

---

From: "Richard Payne" <[email-masked]>
Date: Fri, 3 Dec 1999 16:13:36 -0500

A security problem for the communicating parties.

I have taken care of the question, but I suspect that you don't like my
answer.

Richard Payne

---

From: "chefren" <[email-masked]>
Date: Fri, 3 Dec 1999 22:34:44 +0100

> I have taken care of the question, but I suspect that you don't like my

I even respect it but it makes no sense regarding a 
solution to the tapping question.

Tapping is done by society and you are not interested in 
this society problem. Why did you subscribe to Raven?

+++chefren

---

From: "Richard Payne" <[email-masked]>
Date: Fri, 3 Dec 1999 17:13:54 -0500

I subscribed to Raven because I was worried that people would write inane,
meaningless phrases like "tapping is done by society". Society is composed
of human beings. It is not a separate entity. There is not one homogenous
society on Earth, there are many. Some of them are nastier to their
"citizens" (subjects?) than others. Not all of them are democratic.

My point is that a security risk is a security risk, period. I therefore do
not support tapping. This is a "solution to the tapping question", as you
put it, but not the one you want, as I predicted.

Richard Payne

---

From: Ed Stone <[email-masked]>
Date: Fri, 03 Dec 1999 18:29:12 -0500

>this society problem. Why did you subscribe to Raven?

Probably because raven was not created for the purpose of creating means of 
facilitating wiretapping; it was created (see the intial posts) for the 
purpose of discussion whether or not IETF should create or modify protocols 
to facilitate wiretapping. If you don't want to discuss that, and instead 
you want to discuss means of facilitating wiretapping, why did you subscribe?

---

From: Ed Stone <[email-masked]>
Date: Fri, 03 Dec 1999 18:22:36 -0500

>Or are we not free to decide that?

One way would be for people who choose to be tappable for crime control 
purposes to have the ability to provide their own bits open to 
tapping.  You agree, I suppose, that one making a choice that sacrifices 
the confidentiality of his own bits is quite different (morally and 
practically) from one making a choice that costs another, non-agreeing 
person the confidentiality of his bits. Otherwise you have two wolves and a 
sheep deciding what to have for dinner.

>toward a useful conclusion related to the purpose of this list.

I think that a VERY useful conclusion can be reached by asking for and 
publishing the master plan of the government's desired powers and 
capabilities. One document, stating what they want granted legally and 
technically in its entirety, not just gimme CALEA as a standalone; not just 
gimme cellular location to 300 meters as a standalone; not just gimme VOIP 
tapping as a standalone; not just gimme crypto export licensing review as a 
standalone; not just gimme driver license pictures for a photo database as 
a standalone; not just gimme CESA access to do black bag jobs on your home 
computer as a standalone.... The WHLOE master plan...

My bet is even Richard Nixon's remains would spin and you'd get your 
"useful conclusion" in a heartbeat.

A couple of suggestions:

stop looking at the surveillance and privacy issues the way Chamberlain 
looked at Poland;

stop acting like the sought-after-surveillance-piece du jour can be 
evaluated as a standalone, and that those who refuse to do so are 
anti-social paranoiacs. Wouldn't that help us reach that "useful conclusion"?

---

From: "chefren" <[email-masked]>
Date: Sat, 4 Dec 1999 00:57:00 +0100

> put it, but not the one you want, as I predicted.

Eh Richard...

"A security risk is a security risk." is pretty inane and 
meaningless...

You do say persons have personal risks and they shouldn't 
have multi-person risks???

+++chefren

= =

---

From: Fred Baker <[email-masked]>
Date: Fri, 03 Dec 1999 16:11:56 -0800

At 06:22 PM 12/3/99 -0500, Ed Stone wrote:
>capabilities.

"the" government? Which one?

Since when is the IETF supposed to sit in judgement of any given
government's master plan? Yes, that would be a good things for the citizens
of various governments to do, but that's not this context.

---

From: "Richard Payne" <[email-masked]>
Date: Fri, 3 Dec 1999 19:32:23 -0500

A tautology is not meaningless. I'm suggesting that all security risks
should be evaluated exactly the same way.

Could you explain what a multi-person risk is?

Richard Payne

---

From: Ed Stone <[email-masked]>
Date: Fri, 03 Dec 1999 20:32:52 -0500

>of various governments to do, but that's not this context.

A very useful service of IETF, in moving toward consensus, would be to 
apply the technical acuity of its membership to a query to government 
(starting with the US, which leads this movement worldwide) to describe the 
whole picture. It would be useful for gaining IETF consensus, and it would 
be useful for understanding the upcoming technical elements, for which 
congruence could be built as you go along.

If IETF is talking about facilitating wiretapping, you are in the political 
realm. If you want to engage in intentionally reducing the security of bits 
passing from author to intended recipient, to include non-intended 
recipients without notice to those tapped, you will be doing that not for 
good technical reasons, and not for efficiency reasons, and not for 
reliability reasons, rather you will be doing it for purely political 
reasons, for the unique and exclusive benefit of the class of political 
entity called "government" which is demanding such capability.

If IETF can't ask a political question, then it surely shouldn't be 
delivering political answers.
--
--------------------------
Ed Stone
[email-masked]
--------------------------

---

From: Ed Stone <[email-masked]>
Date: Fri, 03 Dec 1999 20:48:18 -0500

>>of various governments to do, but that's not this context.

And wouldn't it be very simple and straight forward to respond (minimally, 
rather than just rolling over) with "We hear what sounds like a vague, 
informal, parochial and unoffical request to modify internet protocols to 
facilitate wiretapping. But we are unable to find any requirement to do so 
in any existing law, nor any authority to intentionally weaken the security 
of communications between sender and recipient. Please clarify this vague, 
informal and parochial desire via the normal process that generates a 
clear, formal, jurisdictional and democratically official request: Go see 
the legislature and make a law or treaty. The latter is much better because 
the IETF is not a national body, and the standards and protocols do not 
stop at the water's edge. IETF does not make laws or treaties, we make 
secure protocols and standards. Have a nice day, and call back when you 
have a law or treaty."
--
--------------------------
Ed Stone
[email-masked]
--------------------------

---

From: "chefren" <[email-masked]>
Date: Sat, 4 Dec 1999 03:29:58 +0100

On 3 Dec 99, at 18:22, Ed Stone wrote:

> purposes to have the ability to provide their own bits open to tapping. 
> You agree, I suppose, that one making a choice that sacrifices the
> confidentiality of his own bits is quite different (morally and
> person the confidentiality of his bits.

There are examples where citizens have democratically 
chosen those difficult kind of things.

For example: Taxpaying.

"We" have agreed to pay taxes, give a part of our own(!!!) 
money to society, and that's not all, we have given what I 
think you call IRS the "right" to look in our books and 
check if we have paid enough.

And now there are countries where "we" have agreed to give 
away a part of our privacy to keep down organized crime by 
passing a small part of our privacy, the small chance of 
getting tapped while doing no wrong at all AND police 
misusing the tapped data.

A few pretty important countries have decided to allow all 
communication to be tapped in special cases.

+++chefren

= =

---

From: "chefren" <[email-masked]>
Date: Sat, 4 Dec 1999 03:39:25 +0100

> should be evaluated exactly the same way.

OK you suggest that but is it believable if you clearly do 
not intend to do so.

> Could you explain what a multi-person risk is?

A social problem.

+++chefren

p.s. You think a risk for one person is important I say a 
risk for one person plus one is a risk and important too. 
It's highly probable that a risk for all persons in a 
society is more important than the risk for one person.

= =

---

From: "Richard Payne" <[email-masked]>
Date: Fri, 3 Dec 1999 21:47:51 -0500

Bravo!

Richard Payne

---

From: "Richard Payne" <[email-masked]>
Date: Fri, 3 Dec 1999 21:59:21 -0500

I don't understand your first response: please rephrase. I'm saying that an
insecure protocol is insecure, whether because of a design oversight or a
genuine desire to catch bad guys.

Your second response is confusing, since something can't be a problem for
all people unless it's a problem for each of them individually. I _think_
you're saying that privacy is too risky for society to tolerate, i.e. that
all of "us" (whoever "us" is) must gang up on each other to take away each
other's privacy.

This remains unproven, although I've certainly asked you enough times to
display any evidence you might have for such a remarkable assertion.

Richard Payne

---

From: "chefren" <[email-masked]>
Date: Mon, 6 Dec 1999 22:03:25 +0100

> From: Ed Stone <[email-masked]>

..

> > IETF does not make laws or treaties, we make

Why did you write "bravo"?

The problem is that there are definitely law and treaties 
both there and in the make that will actively forbid the 
use and spread use of IETF secure protocols and standards.

In other words: It makes no sense to define standards and 
secure protocols that may not be used by customers.

+++chefren

---

From: "Michael D. Myjak" <[email-masked]>
Date: Tue, 07 Dec 1999 14:39:54 -0500

Ed Stone wrote:

> <snip>

I've recently joined the Raven list and have not had a chance to read through the
archives as yet.  But it does seem to me that the banter going on here is way-off
topic (as Ed indicated above).

MO: The IETF should NOT be in the business of modifying existing (or future)
protocols to facilitate wire tapping. In the first place, as telephony moves into
the digital domain (and more specifically, on to the desktop) user-defined
encryption techniques can be employed end-to-end (obviously with varying degrees
of success).  Given that, then _No_ underlying protocol is going to be able to
facilitate POTS-like wiretapping over the Internet any better than sniffing can.
The technology is fundamentally different: single media (i.e., POTS) over single
(and accessible) wire is almost gone, and probably for good.  Network management
tools (and associated protocols) now replace alligator clips and tape recorders.
In short, your discussion of _how_ to facilitate wiretapping is not only off
topic, it is also IMHO, moot.

--
All the best -
    _
___|0|_|___  Michael D. Myjak, Vice President R&D and CTO
 | N & W |   The Virtual Workshop, Inc.
= oo---oo =  P.O. Box 98 Titusville Fl 32781
email: <[email-masked]>  voice&fax: 407.264.0440