Tap-Tap-Tapping the Net

The IETF will be considering building wiretapping into internet protocols (see previous slashdot story) tonight at their conference; the Washington Post has a story on the subject. A great many civil liberties and technically-oriented organizations have signed onto an Open Letter urging the IETF to reject any attempt to build snooping into the net.

Comments

Whatever.

[Signal 11]

Sure, let the IETF build in wiretapping stuff. I think they need to fail horribly before they stop doing stupid things like that. For one, if it's at the protocol level it will be exploited. Alot. Remember source-routing? Notice how everybody even remotely concerned about security has it disabled, and infact under linux and most UN*X implimentations require you to specifically enable it?

Secondly, why should we care? Anyone doing anything illicit will be using encryption anyway. So catching criminals isn't the issue here. Hell, I frequently use PGP for stuff that I don't consider sensitive - like sending source back and fourth between my friends. The only use for a wiretapping protocol will be to let the l335 h4x0r d00ds have a reign of terror on the 'net.

I say to hell with the IETF - Let the chips fall where they may (and they will fall!).

--

Wiretapping protocols

[jd]

This begs some interesting questions:

1. How do the IETF propose to wiretap -AND- have strong PtP IPSec encryption?
2. How do the IETF propose to locate packets, given that routers decide paths on-the-fly?
3. How do the IETF propose to enforce this, when they are not a regulatory body? In fact, the strongest the IETF can do is release an RFC, which is just that - a request for comments.
4. Who, exactly, is going to implement this wiretapping protocol? Even if the entire backbone used it, all you need do is tunnel through and the protocol becomes useless.
5. What protections can the IETF impose, which guarantee that the wiretapping would even work, even assuming you -could- find all the fragments of all the packets and re-assemble them all? It's easy enough to modify a TCP/IP stack. A few tweaks here, a few tweaks there, and you're sending valid data which the sniffer will reject, but which your intended recipient will accept.

In balance, I think it's useless, pointless and stupid. Stick to IPv6 promotion. That's useful. This isn't.

Is Wiretap Immunity An Absolute Right?

[Effugas]

This isn't going to be very popular, but I'd really appreciate some responses from people who've dedicated much more energy to the analysis of these type of questions.

Now, I say this as a hardcore privacy advocate. I'm not the enemy. I'm a theorist, who wants to know:

Is wiretapping evil?

By that, I mean do people have an intrinsic right to privacy that doesn't end when they begin violating the rights of others?

After all, few of us would complain about the subpeonas that have been delivered unto Tobacco Companies, Microsoft, and hopefully RealNetworks. Subpeonas are after the fact violations of privacy--society is demanding some chunk of personal information from the subpeona'd party. Steganography is designed to defeat such information gathering techniques...but the existence of the technology doesn't mean subpeonas must be evil.

Nor too does the existence of wiretapping prevention technology automatically make wiretaps illegal.

From what I've been able to discern from the literature, there's a slant towards arguing that wiretapping should be difficult--essentially, so it's only used for cases where national security is at risk. Can a system be designed where it is intrinsically difficult, but not impossible for society to spy on certain individuals' communications?

Again, I'm the guy at work who is the point man on SSH, on custom designed secured VPN proxy links(believe me, that actually makes sense), and all these types of technology. But I'm also the guy that, when his friend was attacked by somebody who called her on the phone a half hour before, ran to campus Information Technology demanding the phone logs(and was oh-so-irate when they wouldn't let me write the simple Perl scripts necessary to extract them from the logging port on the switch. And people wonder why IT hates me. ;-)

Screaming about how child molestors are being used to justify widespread Big Brother monitoring is all too appropriate...but begs the question, what about the child molestors? Is it possible to shield everyone but expose those who society does need exposed?

At least a government intrinsically possesses citizen oversight. Corporations and "Mafia" style operations have no such limitations, and flourish quite well under power vacuums. A government that cannot keep tabs on such organizations is arguably irrelevant to them--just look at Russia lately.

Sooner or later, I'm going to be taken to task over the secure technologies I'm personally involved with designing and deploying, and I want to be able to reply with something I believe in. I want to be able to defend my position, and I need your help to do so.

So, is wiretapping evil?

Yours Truly,

Dan Kaminsky
DoxPara Research
http://www.doxpara.com

Big company fears

[fizzbin]

It seems that (according to the Washington Post story) companies who make communications equipment were worried about the Feds requiring their equipment to comply.

This leads me to wonder: Since this has arisen because of IP telephony, is it possible that traditional phone companies, fearing a loss of business to entities who don't comply with wiretap laws, are pushing this proposal? Seems like an interesting conspiracy theory at least.

Anyway, the IETF will probably kill this bad idea.