Subject: RE: [Raven] Re: Raven, What's Needed...

From: Ed Stone <[email-masked]>
Date: Tue, 28 Dec 1999 08:38:18 -0500

At 08:18 AM 12/28/1999 , you wrote:
> >-----Original Message-----
> >From: Richard Payne [mailto:[email-masked]]
> >Sent: Tuesday, December 28, 1999 7:55 AM
> >To: Fred Baker
> >Cc: [email-masked]
> >Subject: Re: [Raven] Re: Raven, What's Needed...
> >
> >
> >Is this "safe harbor" being challenged by the TIA as going
> >beyond the scope
> >of CALEA, and hence not really a safe harbor at all, or is it
> >only being
> >challenged by the ACLU, the EFF, and EPIC?
> >
> >Richard Payne
>
>AFAIK, the latter.  The FCC, however, did not literally require compliance
>with the packet-mode communications segment of J-STD-025 at this time.  They
>sent TIA back to the drawing board, to report in September 2000, with a
>compliance date of September 2001.  I think the expectation is that the
>final standard will look a bit different.

Clearly. And while we await the TIA report before the "requirements" are 
even written down on paper, the lawsuits may obviate that matter, and the 
words from the debate in congress regarding how CALEA does NOT apply to the 
Internet may still be within the "free speech" safe harbor.

But it is worth noting that no law or interpretation of regulation requires 
any change, under the circumstances most favorable to wiretapping, until 
September 2001. Why the rush here to facilitate wiretapping? Can't wait for 
the Sept 2000 TIA report and the court actions? Why not?

--
--------------------------
Ed Stone
[email-masked]
--------------------------

_______________________________________________
raven mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/raven

---

From: Fred Baker <[email-masked]>
Date: Tue, 28 Dec 1999 16:27:35 -0800

>the Sept 2000 TIA report and the court actions? Why not?

I believe we covered that in private email a little earlier. If it turns
out that something does need to be done, and that we are responsible to do
it, waiting until the due date and then starting is a little like starting
to lay the foundation of a house on the day the house is to be completed.
It is silly - I believe the legal term, from a "fiduciary responsibility"
perspective, would be "negligent" - procedure, and no responsible party
would follow it.

Of course, that's my opinion, just like the frequently stated amateur legal
opinions concerning the correct application of CALEA are the opinions of
those who have stated them, and may have no bearing on reality or substance
in a court of law.

---

From: Tim Salo <[email-masked]>
Date: Wed, 29 Dec 1999 00:03:43 -0600 (CST)

> Date: Tue, 28 Dec 1999 16:27:35 -0800
> From: Fred Baker <[email-masked]>
> Subject: RE: [Raven] Re: Raven, What's Needed...
> 	[...]
> If it turns out that something does need to be done, ...
> 	[...]

Needs to be done _by whom_?

It may be that operators need to do something.  As a result, vendors
will be under pressure to do something.

That doesn't necessarily imply that a standards organization needs to do
something.

Furthermore, it doesn't necessarily follow that _this_ standards organization
needs to do something.

I would be happy to formalize my suggestion that the IETF team with the
ITU on this topic.  The ITU appears much better equipped to handle the
political and legal issues than is the IETF.

> those who have stated them, and may have no bearing on reality or substance

I would like for the IETF lawyer to render an opinion on the IETF's
obligations.

I would very much like a written opinion, not an "I talked the IETF lawyer
and she/he/it agrees with me" opinion.

-tjs

---

From: Ed Stone <[email-masked]>
Date: Wed, 29 Dec 1999 08:32:42 -0500

>and she/he/it agrees with me" opinion.

Absolutely!!

---

From: Ed Stone <[email-masked]>
Date: Wed, 29 Dec 1999 08:30:40 -0500

>perspective, would be "negligent" - procedure, and no responsible party

I believe it would be negligent to create or modify protocols to accomplish 
something that will not be defined until September 2000 in the TIA report, 
per the August FCC ruling.

I believe it would be improper and destructive to create or modify 
protocols to accomplish something that may become moot due to legal 
challenge that has been filed against the August FCC ruling.

I believe it would be harmful to create overbroad, overly intrusive "safe 
harbor" protocols which purportedly provide "safety" from prosecution based 
on delivering the superset of whatever the chefrens of the world imagine 
might satisfy LEAs. This in spite of the congressional debate on CALEA 
which expressly excluded the Internet. This in spite of the failure of IETF 
to seek professional and rigorous legal opinions in writing prior to 
embarking upon a purportedly "legally-mandated" action.

Given that the preponderance at the meeting said "no", and the 
preponderance in this list say "no", and that you have no professional, 
rigorous legal opinion in hand to justify precipitous action prior to the 
Sept 2000 report, and that the legal challenges have not yet been heard, 
what's the rush?

Possibly you want to tell us that router design and production lead times 
now place "requirements" on us also? That the TIA report of Sept 2000 is 
not in time to help you deliver tap-friendly routers on September 2001.

>those who have stated them, and may have no bearing on reality or substance

Bingo. So when may we see a formal legal opinion on what is "required" of 
whom when? We don't want to rely on "amateur legal opinions" for our basis 
of wiretapping the Internet, now do we??

Let me suggest that your first question be this one: "Is IETF constituted 
such that standards it provides constitute industry "safe harbor" 
standards, per the definition of the FCC and CALEA?"

Is this when the rabbit leaves the legal hole and runs to the market demand 
hole?

---

From: "chefren" <[email-masked]>
Date: Wed, 29 Dec 1999 17:07:38 +0100

> not in time to help you deliver tap-friendly routers on September 2001.

I object to this very US-centric point of view.

+++chefren

---

From: Ed Stone <[email-masked]>
Date: Wed, 29 Dec 1999 11:11:51 -0500

>I object to this very US-centric point of view.
That reminds me. I've not seen any news accounts or source citations of 
news about the unsellable routers you reported in the Netherlands. Can you 
provide a citation (link) to such a news account of the crisis in the 
Netherlands caused by routers not having a new or modified wiretap-friendly 
IETF protocol?
--
--------------------------
Ed Stone
[email-masked]
--------------------------

---

From: "chefren" <[email-masked]>
Date: Wed, 29 Dec 1999 17:51:16 +0100

On 29 Dec 99, at 11:11, Ed Stone wrote:

> At 11:07 AM 12/29/1999 , Ed Stone wrote:

..

> Netherlands caused by routers not having a new or modified wiretap-friendly 

If I had proof I would probably have published it.

I do know for sure Internet communication providers have 
gotten a time out of 2 year after the "tapping law" became 
valid in dec 1998. So december 2000 everything should be up 
and running.

Short time.

I also know Internet is already tapped in The Netherlands, 
probably tcpdump style and probably only for very serious 
cases. It's not yet generally available for law enforcement.

+++chefren

---

From: Maurice Wessling <[email-masked]>
Date: Wed, 29 Dec 1999 22:48:23 +0100 (CET)

> Netherlands caused by routers not having a new or modified wiretap-friendly 

Let me give you some insight on the political developments in the
Netherlands regarding wiretapping. I've been involved in the matter while
working at the ISP xs4all.nl. Currently I'm setting up a digital civil
rights movement in the Netherlands called Bits of Freedom.

The Telecommunications Act of December 1998 says:

"Providers of public telecommunications networks and public
telecommunications services shall only make their telecommunications
networks and telecommunications services available to users if they can be
wiretapped."

chapter 13. authorized wiretapping

http://www.minvenw.nl/dgtp/data/tweng.doc

Regarding internet it means that an ISP has to make its network tappable.
How to do that? At this moment it is basically by leading the network
through at box that looks for radius packets and thus can provide the
dynamic IP number of the user involved. Of that traffic a tcp/ip dump is
made. The box is controlled by the ISP who can turn the tap on and off,
according to the warrant.

So in practice internet traffic in the Netherlands can already be tapped
by law enforcement but only on a rather small scale by law enforcement
(I'm not talking about any backbone tapping on Echelon-like level). To
overcome all of these practical problems and to improve reliability the
government wants to define more in detail how the infrastructure for
digital wiretapping should be organized. Of course the government has been
talking to hardware vendors to get an out-of-the-box solution. They didn't
find it and started to build a box themselves and wrote code for it.

It is important to understand is that the Telecommunications Act doesn't
require anything from hardware vendors. The law only presents rules for
the ISP whom can not be asked to do the impossible. If Cisco can't provide
a router that makes Dutch law enforcement happy, then that it pity for
them. But it will have no legal implications for ISP's, Cisco or users
whatsoever. It just means that Dutch providers and law enforcement will
have to work with limited, impractical and inefficient tapping technology.
Is that bad news? I don't think so.

The Telecommunications Act was passed through parliament because, in my
opinion, the members did not understand the fundamental difference between
audio taps and internet taps. They just thought it was a logical step to
apply on the internet what was already applied to telephone companies for
a long times. They didn't see that automated, large-scale tapping would be
the result in the end because it can be so easy, cheap and convenient for
law enforcement if the infrastructure is well organized. Parliament didn't
listen to grass-root groups, ISP's and legal experts who had been
protesting for months against digital wiretapping.

Building tapping features into internet protocols, hardware or procedures
makes tapping too easy and law enforcement is not up to that temptation.

Should the IETF act upon laws in the Netherlands? From my explanation
above I hope to make clear that there is no law here that requires anybody
to develop new methods or change protocols.

Even if it would. If I think that providing easy tapping for a democratic
country like the Netherlands is a bad idea, I surely think that having it
available for dictatorships is a very bad idea. As far as I know western
countries do not have any export controls in place to prevent the
spreading of hardware tapping equipment. In other words, western
government do not care if Milosevic gets his hands on equipment to tap
internet in Yugoslavia. Why should the IETF work along with such an
irresponsible and ignorant policy?

Please contact me directly if you need any further information on the
present state of policies in the Netherlands.

Maurice Wessling

---

From: "chefren" <[email-masked]>
Date: Wed, 29 Dec 1999 23:32:21 +0100

On 29 Dec 99, at 22:48, Maurice Wessling wrote:

> The Telecommunications Act was passed through parliament
> because, in my opinion, the members did not understand
> the fundamental difference between audio taps and
> internet taps. They just thought it was a logical step
> to apply on the internet what was already applied to
> telephone companies for a long time. 

Isn't that the truth?

> They didn't see that automated, large-scale tapping would
> be the result in the end because it can be so easy, cheap
> and convenient for law enforcement if the infrastructure
> is well organized. 

"automated, large-scale tapping would be the result in the 
end because it can be so easy, cheap and convenient for law 
enforcement if the infrastructure is well organized" is not 
a logical result.

GSM and ISDN tapping can be considered "fully automated" 
and the normal regulation keeps it perfectly in check. No 
large scale tapping at all. Yes there are more lines tapped 
last years but that can be perfectly explained because most 
suspects have both analog telephone and a portable 
telephone now.

Tapping has never been cheap in The Netherlands since the 
laws demand Law Enforcement to listen to everything that's 
tapped and to make a report of it.

> Parliament didn't listen to grass-root groups, ISP's and
> legal experts who had been protesting for months against
> digital wiretapping. 

I doubt that they didn't listen, there are also a lot of 
pretty knowledgable people who see no problem with allowing 
digital wiretapping.
 
> makes tapping too easy and law enforcement is not up to that temptation.

I see no sign of it and the build-in auditability will 
definitely prevent misuse.

  [The protocols should of course prevent that law
  enforcement can setup or change taps by themselves!!!] 

> to develop new methods or change protocols.

I agree, neighter the law nor the in the law mentioned 
measurements of governance ask for specific protocols. That 
can be changed easilly with changed or new measurements of 
governance.

> available for dictatorships is a very bad idea.

The tcpdump program  IS available now. In my opinion we are 
just talking about new auditable protocols or nothing.

> As far as I know western

Why is what you mention here relevant? Milosevic can use 
about =any= antique Unix computer with the tcpdump utility. 
That exists, and can't be sticked back in the bottle, using 
the words "irresponsible and ignorand policy" seems 
somewhat "over the top" to me...

+++chefren

---

From: "Richard Payne" <[email-masked]>
Date: Thu, 30 Dec 1999 07:06:02 -0500

> present state of policies in the Netherlands.

I agree with your statements about the bad effects of easy tapping.

I have two questions:

1) Apparently contrary information, to the effect that the Netherlands will
require "complete tappability" by the end of 2000, has been posted to the
list previously. Do you have any idea what, if anything, that might have
meant?

2) If the ISP can't read the content of traffic going through it, because
it's encrypted, and allows LEA's complete access to the (unreadable)
packets, has it fulfilled all its legal requirements under the
Telecommunications Act?

Richard Payne

---

From: Maurice Wessling <[email-masked]>
Date: Thu, 30 Dec 1999 14:03:08 +0100 (CET)

> list previously. Do you have any idea what, if anything, that might have

The current situation is a quick and dirty hack that can only be used on a
small scale. After the summer ISP's must have adapted their infrastructure
to make tapping possible on a larger scale.

Details of that are still subject to talks between ISP's and law
enforcement / intelligence service. At this moment I believe the outcome
will be that a ISP has to deliver the real-time data stream of any given
user on the system (dial-up or logged in from another system) according to
an capacity rule. This is not so difficult for about 90 to 95 % of all
traffic average users produce. The real problem lies in the remaining
part. It is not yet clear how this will develop.

Basically the government had no idea how this "complete tappability"
should be implemented when it pushed forward this law. The trick is that
it wasn't even their problem but that of the ISP: they had to figure it
out. There are all kinds of practical problems. The many different sorts
of ISP's, the limited financial possibilities of small ISP's to adapt
their systems, the complexity of systems the really big ISP's are running,
etc. I don't think there will be any "complete tappability" in the end.
But they will come quite close.

> packets, has it fulfilled all its legal requirements under the

Yes. In the Netherlands tappability is about data not content. One
exception: if the ISP itself adds encryption to the data (SSL server) then
it has to remove it before giving the data to law enforcement.

There are no laws to place or to be expected regarding the use of
encryption. XS4ALL gave all of its users a copy of the Freedom software
just a few weeks ago.

Maurice Wessling

---

From: "chefren" <[email-masked]>
Date: Thu, 30 Dec 1999 15:12:48 +0100

> encryption. XS4ALL gave all of its users a copy of the Freedom software

I thought only free access was given to the software for 
four months. Can you estimate how many of the about 
50.000(?) Xs4all did use or tried it?

+++chefren