Subject: [ietf-privacy] In case you haven't seen it yet

From: "Fred Baker (fred)" <[email-masked]>
Date: Wed, 26 Feb 2014 08:59:20 +0000

http://windowsitpro.com/identity-management/richard-clarke-rsa-conference-10-observations-us-intelligence-gathering

---

From: S Moonesamy <[email-masked]>
Date: Wed, 26 Feb 2014 01:58:27 -0800

Hi Fred,
>http://windowsitpro.com/identity-management/richard-clarke-rsa-conference-10-observations-us-intelligence-gathering

 From Mr Clarke's comments:

   "The real solution for privacy isn't data localization; the real solution is
    to secure the data in the cloud.  Where the server sits is unimportant."

In my opinion the above conflates privacy and security.  Having data 
"in the cloud" obfuscates the jurisdiction aspect.  From a privacy 
perspective, where the server sits is important if a person would 
like to find out which laws may be relevant.

Mr Clarke also commented that:

   'One of the reasons for this loss of marketing share is because non-US
    companies, particularly Asian companies, are using the NSA revelations
    as a marketing tool to say that US products are untrustworthy because
    they're bugged by the NSA.  Clarke said "The hilarious part is that
    they're not.  But the products you can get from certain Asian
    manufacturers are."'

It is difficult to convince people from the rest of the world that 
the products from certain Asian manufacturers are untrustworthy as 
there aren't any reports to support that claim.

Regards,
S. Moonesamy

---

From: Pranesh Prakash <[email-masked]>
Date: Thu, 27 Feb 2014 03:05:22 +0100

One of the points made there is:
>  One of the reasons for this loss of marketing share is because non-US companies, particularly Asian companies, are using the NSA revelations as a marketing tool to say that US products are untrustworthy because they’re bugged by the NSA. Clarke said “The hilarious part is that they’re not. But the products you can get from certain Asian manufacturers are.”

The NSA has the capabilities to intervene in the supply chain:

<http://www.wired.com/wiredenterprise/2013/12/nsa-cisco-huawei-china/?mbid=social16469164>
<http://www.spiegel.de/international/world/catalog-reveals-nsa-has-back-doors-for-numerous-devices-a-940994.html>
<https://www.schneier.com/blog/archives/2013/12/more_about_the.html>

And while I'm certain other countries are doing so as well, as things 
stand, there is no firm evidence of "certain Asian manufacturers" 
'bugging' their wares.

But to insist that some Asian countries (namely China, via Huawei, ZTE, 
etc.) do it while others like USA and Sweden don't is naive at best and 
duplicitous propaganda at worst:

<https://plus.google.com/+PraneshPrakash/posts/N9xA8enxHSs>

-- 
Pranesh Prakash
Policy Director, Centre for Internet and Society
T: +91 80 40926283 | W: http://cis-india.org
-------------------
Access to Knowledge Fellow, Information Society Project, Yale Law School
M: +1 520 314 7147 | W: http://yaleisp.org
PGP ID: 0x1D5C5F07 | Twitter: https://twitter.com/pranesh_prakash

---

From: S Moonesamy <[email-masked]>
Date: Wed, 26 Feb 2014 23:44:27 -0800

Hi Pranesh,
At 18:05 26-02-2014, Pranesh Prakash wrote:
>But to insist that some Asian countries (namely China, via Huawei, 
>ZTE, etc.) do it while others like USA and Sweden don't is naive at 
>best and duplicitous propaganda at worst:

To avoid any doubt about conflict of interest I'll mention that I do 
not work for Cisco.  I am okay with any questions about that.  I 
prefer to answer them on [email-masked].

Appendix C of 
http://tools.ietf.org/html/draft-moonesamy-traffic-peeking-01 
discusses about lawful interception.  There is a sentence about the 
IETF perspective about the publication of RFC 3924.  There was a 
message from Fred Baker about why he wrote the RFC.  I don't recall 
the reference for that as it has been a while since I looked into 
it.  I can probably find the reference if it is really important.

There are multiple aspects to the text quoted above (and the link in 
that message).  I did an (internal) analysis to try and understand 
the issues.  I would describe them as tackling an impossible task.

Regards,
S. Moonesamy

---

From: "Fred Baker (fred)" <[email-masked]>
Date: Thu, 27 Feb 2014 08:50:46 +0000

On Feb 27, 2014, at 7:44 AM, S Moonesamy <[email-masked]>
 wrote:

>> But to insist that some Asian countries (namely China, via Huawei, ZTE, etc.) do it while others like USA and Sweden don't is naive at best and duplicitous propaganda at worst:
> 
> To avoid any doubt about conflict of interest I'll mention that I do not work for Cisco.  I am okay with any questions about that.  I prefer to answer them on [email-masked].
> 
> Appendix C of http://tools.ietf.org/html/draft-moonesamy-traffic-peeking-01 discusses about lawful interception.  There is a sentence about the IETF perspective about the publication of RFC 3924.  There was a message from Fred Baker about why he wrote the RFC.  I don't recall the reference for that as it has been a while since I looked into it.  I can probably find the reference if it is really important.
> 
> There are multiple aspects to the text quoted above (and the link in that message).  I did an (internal) analysis to try and understand the issues.  I would describe them as tackling an impossible task.
> 
> Regards,
> S. Moonesamy 
> _______________________________________________
> ietf-privacy mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ietf-privacy

I'm having some problems deciphering this conversation, and the traffic-peeking draft. What is being alleged, and by whom? 

I do work for Cisco.

Between appendices B and C, I'm not sure I know the difference between "wiretap" and "lawful intercept", which is now more properly referred to "lawfully authorized electronic surveillance". If you want to know what we wrote RFC 3924, it was because RFC 2804 asked us to. If you want to know why we implemented an intercept solution, it's because our customers were required by law to deploy one, and we're their vendor. If you want to know why I got involved, it's because Johann Bakker, who at the time was holding the pen on the ETSI specification, told me that it was pushing a model in which every fiber was split and one end shoved under the intelligence service's door, which could then take what it liked. I wanted there to be a warrant before the interception took place, which is consistent with US law, and I wanted audit trails. Getting them meant I needed to be involved.

And the point of all of this is...?

---

From: S Moonesamy <[email-masked]>
Date: Thu, 27 Feb 2014 01:55:14 -0800

Hi Fred,
At 00:50 27-02-2014, Fred Baker (fred) wrote:
>I'm having some problems deciphering this conversation, and the 
>traffic-peeking draft. What is being alleged, and by whom?

Nothing is being alleged.  I mentioned (in the draft) that "It was 
the belief of the IETF that "mechanisms designed to facilitate or 
enable wiretapping, or methods of using other facilities for such 
purposes, should be openly described".  That's the IETF angle.  As to 
why the document was written I consider that an open explanation has 
been given.  I mentioned "conflict of interest" as it can come out 
like I am favoring Cisco out of interest.

>Between appendices B and C, I'm not sure I know the difference 
>between "wiretap" and "lawful intercept", which is now more properly 
>referred to "lawfully authorized electronic surveillance". If you 
>want to know what we wrote RFC 3924, it was because RFC 2804 asked 
>us to. If you want to know why we implemented an intercept solution, 
>it's because our customers were required by law to deploy one, and 
>we're their vendor. If you want to know why I got involved, it's 
>because Johann Bakker, who at the time was holding the pen on the 
>ETSI specification, told me that it was pushing a model in which 
>every fiber was split and one end shoved under the intelligence 
>service's door, which could then take what it liked. I wanted there 
>to be a warrant before the interception took place, which is 
>consistent with US law, and I wanted audit trails. Getting them 
>meant I needed to be involved.
>

I used "wiretap" in the draft as I was referring to the IETF 
policy.  The "lawful intercept" is more interesting.  There is a need 
for interception as part of the work on criminal activity in most 
countries of the world.  The draft references legislation from the 
United States and the European Union as that were the only public 
references I could use.  I avoided Latin America as the material I 
found was in Spanish.  There is very little material for Africa 
online.  There was also the language problem for Asia and the 
question of which references to choose.  The material (authoritative 
source) from Russia was not in English.

The point of all this is the tussle (Clark D., Wroclawski J., Sollins 
K., Braden R., "Tussle in cyberspace: Defining tomorrow's Internet", 
2002.).  There is also the matter of understanding IETF decisions 
which were taken many years ago.  If I look at the RFC outside that 
context I could form an incorrect opinion [1] (speaking for myself 
and not saying that it should be the right conclusion).

The conclusion from the draft is:

   "The end user will usually be at the losing end of the bargain in
    a tussle between the end user and government when Internet traffic
    wiretapping is a matter of national security."

That would apply to my location.  As a thought experiment if everyone 
on this mailing list looked into that from his/her own jurisdiction, 
would the conclusion be different?

Regards,
S. Moonesamy

1.  I personally do not think that you did anything wrong in 
publishing that RFC.

---

From: "Fred Baker (fred)" <[email-masked]>
Date: Thu, 27 Feb 2014 12:39:18 +0000

>   wiretapping is a matter of national security."

That depends on context. In a technology context, I imagine you're correct; in America we say "you can't fight city hall." In the context of citizenship, it is exactly the role of a citizen to use the processes of "city hall" to engage and perhaps win.

On February 11, I sent emails to each of my senators and my representative. This is Fred the Citizen doing the Citizen thing. The content of that email was:

> Two weeks ago, I visited the FCC, staff for the House Committee on Energy and Commerce, majority and minority, and senate staff regarding Net Neutrality. In my opinion, many of the problems we now experience have to do with the baroque structure of the Communications Act, OCCSS, FISA, ECPA, CALEA, and Patriot. They were probably appropriate for the telecom era. However, the changes due to the Internet and the eventual shutdown of the PSTN are forcing a new regulatory regime, one decision or lawsuit at a time. 
> 
> In my opinion, Congress would do us all a favor if they scrapped the current regulatory structure and designed a structure appropriate to an open Internet.
> 
> Today, you will be hearing a lot about the NSA and the surveillance state. In my opinion, law enforcement should be authorized to intercept whatever they need to, whether metadata or content; the current structure authorizes some things and not others, with no evident foresight or plan. However, law enforcement should only be authorized to do so when they have been given a warrant identifying the surveillance subject and the data expected to be intercepted. Any concept of mass collection of either metadata or communication content is, to my thinking, an unreasonable search and seizure.
> 
> In the words of G.K.Chesterton, "We are learning to do a great many clever things. The next great task will be to learn not to do them." In the era of the Internet, his observation is especially meaningful.

I got two responses. My representative sent me her "out of office" response, and one of my senators sent a note indicating that she thinks Net Neutrality is an important topic. "City Hall" is listening about as well as it ever does.