Subject: [Raven] Thoughts of IESG and IAB members on Raven

From: "Richard Payne" <[email-masked]>
Date: Sat, 4 Dec 1999 15:42:54 -0500

Are you aware of any IESG or IAB members who might have opinions and
supporting reasoning that they'd like to post to the list? This could be
done on a no-names basis, if they're worried about having to put on their
asbestos longjohns or about unduly influencing the rest of us.

As you know, the primary list questions are:

"should the IETF develop new protocols or modify existing protocols to
support mechanisms whose primary purpose is to support wiretapping or other
law enforcement activities"

and

"what should the IETF's position be on informational documents that explain
how to perform message or data-stream interception without protocol
modifications".

Richard Payne

_______________________________________________
raven mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/raven

---

From: Ed Stone <[email-masked]>
Date: Sat, 04 Dec 1999 17:54:44 -0500

"Under the new law, Australia's attorney general can authorize legal 
hacking into private computer systems, as well as copying or altering data, 
as long as he has reasonable cause to believe it's relevant to a "security 
matter."

"This just brings ASIO's powers in line  with new technologies," she said. 
"It doesn't give them increased powers at all."  "

Sound familiar? The "Wired" title of the article is "Orwellian Nightmare 
Down Under?"

see http://wired.lycos.com/news/politics/0,1283,32853,00.html

--
--------------------------
Ed Stone
[email-masked]
--------------------------

---

From: Fred Baker <[email-masked]>
Date: Mon, 06 Dec 1999 06:24:00 -0500

>asbestos longjohns or about unduly influencing the rest of us.

I don't think you have to worry about the composition of the IESG/IAB's
long johns. Between frequent flames on various subjects and periodic dunks
in cold water, I would say that those folks are pretty well tempered by
now. The opinions on these boards could be said to be a microcosm of the
opinions expressed on the raven list to date.

Between the two boards, there are three members of the ACLU that I know of,
one of which was a signatory to one of the open letters sent to me on this
subject. You can guess the drift of their opinion, although they go about
it in different ways.

You may have heard the story of a woman who was propositioned in the form
"would you sleep with me for a billion dollars? for a million? for a
thousand? for a hundred?" She answers in the affirmative at a billion
dollars; at a hundred, she replys "what do you think I am, a prostitute?"
The man answered "we have established that, ma'am; now we're haggling over
the price". There are some who find a strong parallel in the proposal that
we will not develop features explicitly for wiretap but will not prevent
standard network management features from being used by law enforcement
agencies. Since we're not going to stop trying to manage the network, nor
legislate network management policies to service providers, nor are we
going to sit in judgment of the laws put in place by governments (that is
the function of courts, not standards groups), these find the discussion a
little inane.

Most are somewhere in between, with perhaps some other axis in the graph.

If they have opinions to express, no doubt they are quite capable of
expressing them for themselves, with the use of anonymous remailers being
at their discretion. Understand, however that they are trying pretty hard
to do the right thing for the community and for the Internet, which
sometimes means trying to find consensus among themselves where the
community seems to lack that ability.

---

From: "Richard Payne" <[email-masked]>
Date: Mon, 6 Dec 1999 09:28:09 -0500

> the function of courts, not standards groups), these find the discussion a

Isn't the distinction precisely that, from the 1920's until the passage of
CALEA, LEA's in the U.S. were allowed (only with a court order, of course!)
to make use of facilities that telco's had already created for other
reasons, while CALEA was the first attempt to _mandate_ carriers to build in
facilities "required" by LEA's?

Without taking away from the analogy, I don't think it's applicable in this
case. There is a real difference between putting LEA's in the driver's seat
for network design, and not.

Another question: where is the request for providing extra facilities for
LEA's ultimately coming from? Is it official? Is there any legal reason to
believe that the IETF has to do anything other than nod politely and ignore
the requestor? With three ACLU members involved in IESG/IAB, have these
questions been raised and answered?

Richard Payne

---

From: Ed Stone <[email-masked]>
Date: Mon, 06 Dec 1999 10:40:17 -0500

>questions been raised and answered?

This is an important question and I'd like to hear an answer from IETF 
officials.

Did the question posed to raven arise simply out of the ether, without any 
communication or support for the question from government persons or agencies?

Did it arise from ISPs in **response** to the inconvenience of tapping 
requests? Did it arise form router manufacturers looking to add a 
competitive "feature" to their hardware that might gain them favored import 
or export status?

Or should we believe that the question is an orphan, posed only as an 
intellectual exercise, with no initial causation by governments or 
government wiretapping agencies?
--
--------------------------
Ed Stone
[email-masked]
--------------------------

---

From: Christian Huitema <[email-masked]>
Date: Mon, 06 Dec 1999 10:58:49 -0500

Not being a member of the IAB or IESG, I am not really qualified to answer
Richard's question. However, I can explain how architecture principle can
apply to the wiretap issue, and how they guide the role that the IETF
should or should not play in the design of wiretap traps.

I think that the first principle we should keep in mind is the need to
retain the transparency of the network. This transparency allows for the
unfettered development of new applications. The network service is defined
by the Internet Protocol. The responsibility of the Internet Service
Providers is to accept IP packets from their customers and to relay these
packets to their destination. It is true that ISP have also historically
provided other servcies, such as DNS, E-Mail or Web hosting. However, these
additional services are in no way part of the network layer. In fact, these
services are commonly provided today either directly by corporate users, or
by application service providers independent of the ISP. If we accept the
conclusion that the ISP are only responsible for the IP service, then any
court order should be written so that it can be fulfilled by an ISP that
only has access to the IP layer. If ISPs can only be mandated to copy
certain IP packets, such as those that bear certain addresses or those that
are carried over specific links, then there is no rational basis for
twisting application protocol specifications in order to facilitate wiretap.

Indeed, even if we accept that ISPs should only be ordered to deliver
copies of IP packets, there is no question that the long arm of the law
will try to also reach the servers of application service providers (ASP),
such as web hosts or mail servers, or, for that matter, providers of
Internet Telephony services. Even if we concluded that possible wiretap
mandates on ISPs do not justify hacking application protocols, there could
be a reasoning that wiretap mandates on ASPs would request special purpose
modifications of application protocols. However, the experience shows that,
when a wiretap is performed with the cooperation of the managers of the
service, no special modifications is generally requested. Servers routinely
keep accounting files that provide the equivalent of "pen register"
facilities. Web pages can be read and duplicated without any modification
to HTTP. If the server cooperates, e-mail can be archived and copied
without any modification of SMTP. In fact, when ASPs provide a service from
their servers, they can almost always instruct these servers to replicate
or log the information, without having to affect the application protocol.
Again, there does not appear to be any strong justification for the IETF to
hack application protocols in order to facilitate wiretap.

Hacking protocols, or installing backdoors, is needed when one wants to
alter the behavior of a computer without having to request the cooperation
of the owner of that computer. We have seen examples quoted on the Raven
lists of the attempts of various law enforcement agencies to do precisely
that. They would develop viruses or other devices that would infiltrate
into a target computer and report the activities of that computer,
unbeknown to the computer's user. An equivalent would be a hidden command
in a device, that woul for example turn of encryption, or send the
encryption key to a third party. An even more devious example would be a
command that can turn on the microphone of an Internet Telephony appliance,
and record the conversation of its owner even if this owner is not
currently using the appliance. There are obvious questions of ethics, and
in fact of liability. Would it be fair to sell appliances that have hidden
functions? We know that any such wiretap is likely to be overtaken by
hackers. Who would get sued for the resulting losses? Imagine the marketing
disaster when the capabilities of the appliance become known to the public!
Frankly, I cannot see the IETF helping in developing such technology.

It is very hard, on this subject, to separate emotions from engineering
principles. But I think that the architecture principles are clear. The IP
architecture mandates that ISP's can only be mandated to provide copies of
IP packets, a requirement that can be met today with readily available
tools such as TCP-dump or RMON. The nature of the applications requires
that application-level monitoring can only be performed ethically if one of
the parties in the application cooperates, in which case there is no real
need to change the application protocols in any way. Other forms of
monitoring pose very strong ethical questions, and cannot reasonably be
expected from an open forum like the IETF. In short, whatever we may think
of the balance between privacy and law enforcement needs, there are good
technical reasons to answer negatively to the question that was posed to
the Raven list. No, the IETF should not attempt to modify protocols in
order to facilitate wiretap.
-- Christian Huitema

---

From: "chefren" <[email-masked]>
Date: Mon, 6 Dec 1999 19:46:10 +0100

> "It doesn't give them increased powers at all."  "

I fully agree this goes not a little to far.

However: Changing bit's on the computer of a person that's 
NOT CONVICTED is something that has nothing to do with 
tapping.

Tapping should be a clean, certified, auditable process 
that cannot be detected by the tapped person or 
organization.

+++chefren

=Signature follows=

I think we need a simple architecture for a point
to point tap interface that has strong provisions
against misuse.

On one side the communication provider who only
starts tapping a specific customer or IP number
with proper warrants.

On the other side the approved tapping room.

Everything should be organized by a central
"tapping office". This office should provide
keys for strong encryption to both communication
provider and tapping room.

Law and technology should both provide as
much checks and balances as we can come up
with. Law can provide good procedures,
technology can provide technical means to
check them or force them.

---

From: "Lyal Collins" <[email-masked]>
Date: Tue, 7 Dec 1999 06:56:38 +1100

This law is merely a clarafication of an existing power, to many LE
agencies.
ie If LE has a warrant to break into a premises and place a listening
device, then they have the power to place the listening device in a PC.
This law clarifies the legality of changing "data" (defined as software or
information) to facilitate the ability "listen" - not voice, but data.

Everyone else in the world seems subject to this issue now, the law applying
to them is less clear than ours.

Regards,
Lyal

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On Behalf Of
> chefren
> Sent: Tuesday, 7 December 1999 5:46
> To: [email-masked]
> Subject: Re: [Raven] Will IETF be asked to modify protocols for
> Australian law?
>
>

---

From: "chefren" <[email-masked]>
Date: Mon, 6 Dec 1999 21:09:08 +0100

> see http://wired.lycos.com/news/politics/0,1283,32853,00.html

I have thought again about it and see no serious problems, 
if the Australian democracy decides so they should 
implement it. We have to respect that.

No serious problems? That's to say, if enough provisions 
are made against misuse.

And those provisions are: sound methods of administration.

The information technology term for it is: Auditability.

In this case: Good described methods and auditability of 
all actions. Probably MD5 checksums of all actions to a 
public forum.

We all have to respect the Australian democracy... There is 
no state of war, their society want's it that way.

We can only inform them and hope they will change their 
minds.  

+++chefren

p.s. I also respect the US democracy although the death 
penalty is probably the most bad thing I can think of.

---

From: "chefren" <[email-masked]>
Date: Tue, 7 Dec 1999 00:10:33 +0100

On 6 Dec 99, at 10:58, Christian Huitema wrote:

> There are obvious questions of ethics, and in fact of
> liability. Would it be fair to sell appliances that have
> hidden functions? 

It's fair as long as it's not against laws. Laws that 
should be put in place by politicians...

> We know that any such wiretap is likely to be overtaken
> by hackers. Who would get sued for the resulting losses?
> Imagine the marketing disaster when the capabilities of
> the appliance become known to the public! 

As said enough: Nobody here seems to be for any backdoors

Although very difficult to design open source third party 
system is thinkable.

http://www.cdt.org/crypto/risks98/

I still think the system that has proven to be good enough 
for telephone for 150 years is good enough for IP: Let the 
communication providers keep our communication private.

+++chefren

---

From: Greg Broiles <[email-masked]>
Date: Mon, 6 Dec 1999 15:47:31 -0800

> communication providers keep our communication private.

Good enough? That's ridiculous. Illegal wiretaps are easy and common,
and the communication providers don't care. Physical and protocol
security are terrible - they can't even keep their own billing
information secure, much less the information we put on the channel.

If there's one lesson we can learn from voice telephony, it's that
communication providers cannot and must not be trusted to keep
communications private. End users must take responsibility for that
themselves if they want any hope of privacy.

The system isn't anywhere near good enough, which is why people who
really need privacy in the US and have an unlimited budget - e.g., the
military, the intelligence agencies, and the upper echelons (so to
speak) of the executive branch have built themselves a physically
separate communications system. Less well-funded people use end-to-end
encryption devices like STU-III's, or Comsec's 3DES phones.

It's very clear that nobody who takes security seriously uses
traditional telephones for anything other than encrypted or unimportant
traffic, and any suggestion to the contrary leads to speculation about
whether the suggestor is incompetent or deliberately misleading their
readers.

--
Greg Broiles [email-masked]
PO Box 897
Oakland CA 94604