Subject: [SIP] Re: Location information

From: William Marshall <[email-masked]>
Date: Mon, 5 Feb 2001 11:39:57 -0500 (EST)

Brian,

It seems that the privacy draft faces up squarely to the privacy
concerns.  The draft already deals with all the regulatory requirements
about verification of identity, hiding of identity, etc.  The security
implications of knowing who you are are just as daunting as knowing
where you are.  In some places regulations already cover location info,
and the framework in the privacy draft deals with them.

As with the subscriber identity - the UA may insert it, and may
demand (via a tag and a Proxy-Require) that it be kept private.
The proxies may verify the identity, and mark it verified, or mark
it unverified, and must delete the information if privacy was requested.
The procedures are all there in the privacy draft, and just need
some minor extensions to handle multiple identity types, and per-identity
privacy requests.

The previous efforts (spatial) generated a string giving location
information.  Sip uses "name-addr | addr-spec" everywhere, which
includes a display-name string; however a URL format would be nicer.
I was sure I had heard about a URL format with this information, but
can't find any reference to it.

Bill Marshall
[email-masked]

-----original message-----
From: "Rosen, Brian" <[email-masked]>
Subject: RE: Location information (was Re: [SIP] SIP Privacy Draft)
Date: Mon, 5 Feb 2001 10:44:54 -0500

There was an effort started several IETFs ago to define a PROTOCOL
to exchange geographic location.  That was shot down.  There is still
a low level effort to define a format for exchanging such information.

Before starting another effort, you might want to look at the prior
work (spatial).  You also MUST forthrightly face up to the privacy
concerns that have stymied other efforts.  The security implications of
knowing where you are can be VERY daunting, and in general discussions
on the issues have yielded more problems than answers.'

Brian

_______________________________________________
This list is for continuing development of the SIP protocol.
The sip-implementer's list is the place to discuss implementation,
and to receive advice on understanding existing sip.
To subscribe to it, send mail to [email-masked] with
"subscribe sip-implementors" in the body.

---

From: "Rosen, Brian" <[email-masked]>
Date: Mon, 5 Feb 2001 12:01:48 -0500

The problem that location presents that is different from the 
privacy draft (unless I missed it) is that an emergency call must
yield location information.  There is not an option for the user
to suppress this, by law.  The path by which a user might connect
to an emergency center cannot be pre-arranged.  I believe that it
will take creation of a cryptographically secure infrastructure
to allow such a system to have the desired property that the user
can control location information, but when required it can be
securely delivered.

I also think that location is not an "all or nothing" kind of
thing.  The privacy draft presupposes that the world is bifurcated
into trusted and untrusted domains, and privacy is secured
when venturing into an untrusted domain.  This is not the behavior
I really want. The desired behavior I want is:
	Accuracy (precision) of location is variable
		I may want to give some people precise information, others
		less precise.  There will be multiple levels
	Time (and motion) variability - if I am mobile, then where I
		am changes over time.  I need to express this somehow,
		but I also need to control it (not everyone can be told that
		I am mobile)
What we learned in the spatial effort is that the whole location thing
is more complex that you would like it to be, and it is hard to get
an implementable subset that has enough functionality to be interesting.
We also learned the difficulties in reaching consensus on issues that
involve privacy.

Brian

> -----Original Message-----
> From: William Marshall [mailto:[email-masked]]
> Sent: Monday, February 05, 2001 11:40 AM
> To: [email-masked]
> Cc: [email-masked]
> Subject: [SIP] Re: Location information
> 
> 
> Brian,
>

---

From: "Rosen, Brian" <[email-masked]>
Date: Mon, 5 Feb 2001 13:48:25 -0500

If I have an enterprise network, and it connects to a public network, then
the trust boundary may stop at the private/public boundary.  The
"subscriber"
is the enterprise, not the individual.  In the privacy draft, if extended to
location, there is no mechanism to:
	Recognize that this is an emergency call
	Recognize that the UAS is the emergency center
	Pass location information despite any of the requests the UAC may
make.

Yet, the requirement is to identify the location of the individual.
I think the draft has some fine mechanisms in it.  I just don't think they
are 
sufficient for emergency purposes.

Brian

> Sent: Monday, February 05, 2001 1:31 PM
> Subject: RE: [SIP] Re: Location information
> 
> 
> An ordinary call must yield subscriber information.  There is
> not an option for the user to suppress this, by law (although the
> user may request this information not be given to the destination).
> However, the destination can always identify the caller, for purposes
> of tracing an obscene or harassing call.
> 
> Accuracy of location is certainly variable, and it is possible
> the UA may permit delivery of less precise information, but suppress
> accurate information.  Multiple levels are just like multiple 
> identities;
> the privacy draft as described by Mark in previous email 
> allows separate
> anonymity requirements to be attached to each.
> 
> Bill Marshall
> [email-masked]
> 
> To: "'William Marshall'" <[email-masked]>
> Subject: RE: [SIP] Re: Location information
> Date: Mon, 5 Feb 2001 12:01:48 -0500 
>

---

From: "Christian Huitema" <[email-masked]>
Date: Tue, 6 Feb 2001 09:36:37 -0800

Uh, what is exactly the "public network" that you are talking about? The
ISP to which my entreprise network connects have no idea of what the
bits in the packets are, and probably don't want to know. The basic SIP
solution is end-to-end, with the network being essentially transparent.
Sure, there may be competing voice service providers that want to
provide added value on top of the basic service, but we cannot assume
that there has to be a man in the middle. 
 
-- Christian Huitema

-----Original Message-----
From: Mark Watson [mailto:[email-masked]] 
Sent: Tuesday, February 06, 2001 8:02 AM
To: Rosen, Brian; William Marshall
Cc: [email-masked]
Subject: RE: [SIP] Re: Location information

	The public network will likely be trusted in the sense that it
promises to obey the user's stated privacy requirements, indeed Data
Protection legislation will usually oblige the public network provider
to do this. Also, it will likely be a requirement of the public service
that terminals identify themselves in some way.

	I do not think it likely that for Emergency calls,
terminals/networks will behave differently with respect to identity
information than for normal calls except that it will probably not be
considered an infringement of privacy to deliver identity information to
an Emergency call centre even when the user has requested it be kept
private.

	More complex is how does the public service provider verify the
identity and location information ? In the example above, the public
service provider can only be sure of the owner of the Enterprise network
from which the call came, and this may not translate into a single
geographic location. The network would be forced to send forward only
the 'unverified' location information provided by the caller.

	...Mark 

	> From: Rosen, Brian [mailto:[email-masked]] 
	> Sent: 05 February 2001 18:48 
	> To: 'William Marshall' 
	> > > concerns.  The draft already deals with all the regulatory

	> > > requirements 
	> > > it unverified, and must delete the information if privacy
was 
	> > > requested. 
	> > > some minor extensions to handle multiple identity types,
and 
	> > > per-identity 
	> > > knowing where you are can be VERY daunting, and in general

	> > discussions

---

From: "Mo Zonoun" <[email-masked]>
Date: Wed, 7 Feb 2001 12:53:30 -0500

TIA TR-41.4 committee has been working on the E911 issues for while. There
are two choices of positioning technologies under consideration.
Network-based, which achieves positioning with a network management overlay
such as SNMP and Set-based, which uses positioning devices integrated into
the set. 

Some of the issues identified in this list as being out side of IETF area of
work should be forwarded to TR-41.4 ([email-masked]) for further
discussion and inclusion into their work.
Mo 

-----Original Message-----
From: Rosen, Brian [mailto:[email-masked]]
Sent: Tuesday, February 06, 2001 4:31 PM
To: Michael Thomas; Drage, Keith (Keith)
Cc: 'William Marshall'; [email-masked]
Subject: RE: [SIP] Re: Location information

>    I don't see what the problem is here. The proxy that
>    suppresses caller id is a trusted third party. Part
>    of the implicit agreement between my UA and the 
>    proxy is that certain entities -- 911 centers, etc, --
>    will always have access to my caller id. If you 
>    don't like that service, then don't use that proxy.
> 
This is a protocol issue because there are three entities,
the UAC, the outgoing proxy, and the incoming proxy (or UAS)
at the emergency center.  There has to be additional
specification that details how this works.  The spec probably
needs some MUSTs.  Some of the issues are:
	How does the UA indicate to the outgoing proxy that
	this is an emergency call?  What are the minimum
	requirements for caller identification and location
	that must be delivered from the UAC to the Proxy Server?

	How does the outgoing proxy server identify "right"
	emergency server?  What is the minimum requirement for
	caller identification and location that must be
	delivered from the outgoing Proxy Server to the center?
	Are there some minimum requirements for protocol options
	the emergency center (or proxy or gateway) must implement
	in order to provide the service needed?

It's not entirely clear to me that this is an IETF matter,
but it HAS to be done, somewhere.

Brian

---

From: "Rosen, Brian" <[email-masked]>
Date: Fri, 9 Feb 2001 12:57:12 -0500

> > >  The path by which a user might connect
> I don't see this as a problem if we can arrange for an 
> end-to-end public
> key for PSAPs (or one of the copies of the entity that routes 
> to PSAPs)
> stored in end systems.
> 
I was thinking that we would have a PSAP CA, the root certificate of which
could easily be stored in the UA (or proxy servers).  Then anyone could
validate easily that the other end was a PSAP. 

Brian

---

From: "Mark Watson" <[email-masked]>
Date: Thu, 15 Feb 2001 12:06:52 -0000

Hmmm, this is perhaps a slightly larger issue than suits this thread, but
anyway:
 
If there is no 'man in the middle' i.e. you can find and connect to your
destination directly at the IP layer, then this is essentially a private
transaction between you and the destination. You can do what you like in
this context - it's just up to you and the destination to agree between
youselves. (Although you still both have to respect applicable Data
Protection Legislation in respect of any personal information you receive
from each other.)
 
If you make your connection via an intermediate proxy or proxies operated by
a third party, presumably you do this because those proxies offer some kind
of service (e.g. routing). If the third party makes this service publically
available, then this is whom I consider the 'public network'.
 
Of course there will be many such service providers that a user can choose
from - though there is plenty of work going on to invent ways of restricting
a users choice in certain environments.
 
...Mark

-----Original Message-----
From: Christian Huitema [mailto:[email-masked]]
Sent: 06 February 2001 17:37
To: Watson, Mark [MAIFP:EP11-M:EXCH]; Rosen, Brian; William Marshall
Cc: sip
Subject: RE: [SIP] Re: Location information

Uh, what is exactly the "public network" that you are talking about? The ISP
to which my entreprise network connects have no idea of what the bits in the
packets are, and probably don't want to know. The basic SIP solution is
end-to-end, with the network being essentially transparent. Sure, there may
be competing voice service providers that want to provide added value on top
of the basic service, but we cannot assume that there has to be a man in the
middle. 
 
-- Christian Huitema

-----Original Message-----
From: Mark Watson [mailto:[email-masked]] 
Sent: Tuesday, February 06, 2001 8:02 AM
To: Rosen, Brian; William Marshall
Cc: [email-masked]
Subject: RE: [SIP] Re: Location information

The public network will likely be trusted in the sense that it promises to
obey the user's stated privacy requirements, indeed Data Protection
legislation will usually oblige the public network provider to do this.
Also, it will likely be a requirement of the public service that terminals
identify themselves in some way.

I do not think it likely that for Emergency calls, terminals/networks will
behave differently with respect to identity information than for normal
calls except that it will probably not be considered an infringement of
privacy to deliver identity information to an Emergency call centre even
when the user has requested it be kept private.

More complex is how does the public service provider verify the identity and
location information ? In the example above, the public service provider can
only be sure of the owner of the Enterprise network from which the call
came, and this may not translate into a single geographic location. The
network would be forced to send forward only the 'unverified' location
information provided by the caller.

...Mark 

> From: Rosen, Brian [ mailto:[email-masked]
<mailto:[email-masked]> ] 
> > From: William Marshall [ mailto:[email-masked]
<mailto:[email-masked]> ] 
> > > From: William Marshall [ mailto:[email-masked]
<mailto:[email-masked]> ]

---

From: Chip Sharp <[email-masked]>
Date: Thu, 15 Feb 2001 09:49:16 -0500

The term "public network" has regulatory implications in most countries.
As you say, SIP runs end-to-end over an IP infrastructure.  It can run 
between two endpoints that also terminate the RTP stream (e.g., "SIP 
phones") or it can run between a SIP UA and a proxy/redirect/etc. 
server.  Either way, the two IP hosts running SIP are endpoints on the IP 
network and (may) have a customer relationship with the IP network provider 
(i.e., not belong to the IP access provider).

In this case, I may go Christian's question one step further and ask  "what 
is this network you are talking about." ;-)  It is kind of like talking 
about the email network.

Basically, SIP exchanges are always private exchanges between two endpoints 
on the IP network as you say in the first paragraph.
:-)

As for work going on for restricting users' choice,  this should *not* be a 
work item for the SIP WG charter.  I can think of at least one regulatory 
agency that would be interested in hearing more about this work. :-\

Chip

At 07:06 AM 2/15/2001, Mark Watson wrote:
>If you make your connection via an intermediate proxy or proxies operated 
>by a third party, presumably you do this because those proxies offer some 
>kind of service (e.g. routing). If the third party makes this service 
>publically available, then this is whom I consider the 'public network'.
>
>from - though there is plenty of work going on to invent ways of 
>restricting a users choice in certain environments.
>
>...Mark
>>ISP to which my entreprise network connects have no idea of what the bits 
>>in the packets are, and probably don't want to know. The basic SIP 
>>Sure, there may be competing voice service providers that want to provide 
>>added value on top of the basic service, but we cannot assume that there 
>>has to be a man in the middle.
>>
>>-- Christian Huitema
>>
>>
>>The public network will likely be trusted in the sense that it promises 
>>to obey the user's stated privacy requirements, indeed Data Protection 
>>Also, it will likely be a requirement of the public service that 
>>terminals identify themselves in some way.
>>I do not think it likely that for Emergency calls, terminals/networks 
>>will behave differently with respect to identity information than for 
>>normal calls except that it will probably not be considered an 
>>infringement of privacy to deliver identity information to an Emergency 
>>call centre even when the user has requested it be kept private.
>>More complex is how does the public service provider verify the identity 
>>and location information ? In the example above, the public service 
>>provider can only be sure of the owner of the Enterprise network from 
>>which the call came, and this may not translate into a single geographic 
>>location. The network would be forced to send forward only the 
>>'unverified' location information provided by the caller.
>>...Mark
>>
>> > From: Rosen, Brian 
>> [<mailto:[email-masked]>mailto:[email-masked]]
>> > > From: William Marshall 
>> [<mailto:[email-masked]>mailto:[email-masked]]
>> > > > From: William Marshall 
>> [<mailto:[email-masked]>mailto:[email-masked]]

-------------------------------------------------------------------
Chip Sharp                       Consulting Engineering
Cisco Systems
-------------------------------------------------------------------

---

From: "Mark Watson" <[email-masked]>
Date: Fri, 16 Feb 2001 15:45:19 -0000

Chip,

Comments inline...

...Mark

> From: Chip Sharp [mailto:[email-masked]]
> Sent: 15 February 2001 14:49
> To: Watson, Mark [MAIFP:EP11-M:EXCH]
> Cc: 'Christian Huitema'; Rosen, Brian; William Marshall; sip

Oh yes.

> is this network you are talking about." ;-)  

The 'network' consisting of the SIP proxies and the relationships between
them. Perhaps 'network' is not the right term.

It is kind of 
> like talking 

Yes, by which you would mean SMTP servers and the relationships between
them.

> on the IP network as you say in the first paragraph.

If the SIP 'exchanges' are owned by a third party (i.e. not one of the
parties between whom the session is being set up), and the service offered
by them is offered publically (i.e. to anyone with enough $$$), then I think
they could be considered 'publically available telecommunications systems',
not private systems.

> work item for the SIP WG charter.  

The very thought!

>I can think of at least 
> one regulatory 
> terminals/networks