Subject: [Enum] e164.arpa: a technical or policy issue?

From: "Stastny, Richard" <[email-masked]>
Date: Thu, 1 Nov 2001 12:47:28 +0100

Dear Colleagues, especially Tony,

If the attached (mail with attachment on hold for moderator) proposal from
the German regulator to SG2 AENUM is accepted, it would end this discussion
anyway, since it states, that E.164 numbers are protected by _COPYRIGHT_ and
can only be used in the golden tree under ITU-T TSB supervision. No other
domains using public E.164 numbers would be allowed.

e.g. ref:

6.3 Telecommunication numbers as of recommendation E.164 are "sequences of
characters which are used in telecommunication networks for purposes of
addressing". These resources are arranged and transferred on the
international level (Country Codes) by the ITU and in many countries
sovereign by the national telecommunication laws. According to this
definition there is no doubt that a telecommunication numbers remains
recognized in copyright matters, when it is transferred in a Domain Name for
instance according to the procedure as described in section 2 of RFC 2916.
Both before and after the conversion of a E.164-Ressource by means of DNS it
concerns a character sequence, which serves purposes of the addressing. It
is also not missing the factual characteristic "in telecommunications
networks" as independent of the transport technology used at least a part of
the route of transportation will always be situated in a circuit switched
telecommunication network.

BTW, it is also not conforming to RFC2916, since it proposes to use an
e164.<TLD>, where the ITU-TSB is the domain holder of the TLD.

I fear, there is a big danger, that Tony is correct at least in his
statement, that with ITU-T ENUM may never fly, or not in time with the
market window. 

best regards

Richard STASTNY
OeFEG
Arsenal Objekt 24
P.O. Box 147
A-1103 Vienna, Austria

Tel: +43 664 420 4100
Fax: +43 1 79780 13
[email-masked]
[email-masked]

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
Sent: Wednesday, October 31, 2001 5:36 PM
To: [email-masked]; [email-masked]; [email-masked];
[email-masked]; [email-masked];
[email-masked]; [email-masked];
[email-masked]; [email-masked];
[email-masked]; [email-masked]; [email-masked];
[email-masked]; [email-masked];
[email-masked]; [email-masked]; [email-masked];
[email-masked]; [email-masked];
[email-masked]; [email-masked]; [email-masked];
[email-masked]; [email-masked]; [email-masked];
[email-masked]; [email-masked];
[email-masked]; [email-masked];
[email-masked]; [email-masked];
[email-masked]; [email-masked]; [email-masked];
[email-masked]
Subject: Proposals for draft Rec. E.A-ENUM
Importance: High

Dear All,

Enclosed please find the proposals of the German Administration to change
the draft Recommendation E.A-ENUM for your collective consideration.

Additionally please find our comments on the "Report of Q1/2 Rapporteurs
Group, 04-14 September 2001, TD 1/2-63 Rev.3-E". Please take these comments
into account in oder to be able to understand our comments on the draft
Recommendation E.A-ENUM. We will be prepaired to explain our concerns at the
next Rapporteurs meeting of Q1/2.

Best Regards,

Markus Stoelzle

2 Enclosures (contained in the annexed zip-file)

 <<E_A-ENUM-2001-10-31.zip>> 

---------------------------------------------------------------------------
Dipl.-Ing. Markus Stoelzle
Regulatory Authority for Telecommunications and Posts
426a
Canisisustrasse 21
D-55122 Mainz

Phone:	            +49-6131-18-22 49
Fax:		+49-6131-18-56 05
E-Mail:		<Mailto:[email-masked]>
Internet:	http://www.regtp.de

_______________________________________________
enum mailing list
[email-masked]
http://www1.ietf.org/mailman/listinfo/enum

---

From: Tony Rutkowski <[email-masked]>
Date: Thu, 01 Nov 2001 07:45:29 -0500

Hi Richard,

>recognized in copyright matters, when it is transferred in a Domain Name

Interesting find.

The assertion of copyright over telephone numbers has
been a long standing debate regarding which there are
divergent views among different Administrations.  At
the recent SG2 meeting, France raised a similar issue.
The U.S. among other countries, however, has generally
rejected the assertion.  The CEC is also likely to weigh
into the matter among European countries.

Maybe if the lookups are moved off port 53, no one will
care. :-)

--tony

---

From: "Mark Harris" <[email-masked]>
Date: Thu, 1 Nov 2001 13:39:49 -0500

Hello Richard and All:

>that E.164 numbers are protected by _COPYRIGHT_

Would that mean that if I was given a telephone number (as a subscriber),
I would not be "allowed" to give it to others to put into various other
directories?

Kind of defeats the purpose of a telephone number...

Regards,
Mark

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]On Behalf Of
Stastny, Richard
Sent: Thursday, November 01, 2001 6:47 AM
To: [email-masked]'
Subject: [Enum] e164.arpa: a technical or policy issue?
Importance: High

e.g. ref:

best regards

Richard STASTNY
OeFEG
Arsenal Objekt 24
P.O. Box 147
A-1103 Vienna, Austria

Tel: +43 664 420 4100
Fax: +43 1 79780 13
[email-masked]
[email-masked]

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
Sent: Wednesday, October 31, 2001 5:36 PM
To: [email-masked]; [email-masked]; [email-masked];

Dear All,

Best Regards,

Markus Stoelzle

Phone:	            +49-6131-18-22 49
Fax:		+49-6131-18-56 05

---

From: Richard Shockey <[email-masked]>
Date: Thu, 01 Nov 2001 14:53:37 -0500

>Kind of defeats the purpose of a telephone number...

I've asked Richard Stastny to send me the document so I can have it made 
available as a URL ..

then you can read it and judge for yourself.....

Richard Shockey, Senior Manager, Strategic Technology Initiatives
NeuStar Inc.
45980 Center Oak Plaza   Bldg 8     Sterling, VA  20166
1120 Vermont Ave NW Suite 400 Washington DC 20005
Voice 571.434.5651 Cell : 314.503.0640,  Fax: 815.333.1237
<mailto: [email-masked]> or
<mailto: [email-masked]>
<http://www.neustar.com>
<http://www.enum.org>
<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<

---

From: Ray Anderson <[email-masked]>
Date: Fri, 02 Nov 2001 22:00:22 +0000

I have recently been given very clear advice, that under
European law you are NOT allowed to publish somebody's phone number
unless they give you explicit permission to do so.

Operators are under that obligation, and may not transmit the numbers 
outside Europe
unless the jurisdiction gives at least the same level of protection.

Ray

At 13:39 01/11/2001 -0500, Mark Harris wrote:
>Ray Anderson    CEO   Bango.net Limited  www.bango.net/00454545

The Mobile Internet is for everyone. It must be very easy to use.

---

From: "Dan Wing" <[email-masked]>
Date: Fri, 2 Nov 2001 14:56:37 -0800

How does this apply to ENUM?  ENUM doesn't map person's name to
a number, and doesn't map a number to a person's name.

-d

> From: [email-masked] [mailto:[email-masked]]On Behalf Of Ray
> Anderson
> Sent: Friday, November 02, 2001 2:00 PM
> To: [email-masked]; Stastny, Richard; [email-masked]
> Subject: RE: [Enum] e164.arpa: a technical or policy issue? 
> 
>

---

From: "Clive D.W. Feather" <[email-masked]>
Date: Sat, 3 Nov 2001 09:11:02 +0000

> unless they give you explicit permission to do so.

That's an issue of data protection and, in particular, 97/66/EC. It only
applies to directories (that map name to number and v.v.).

-- 
Clive D.W. Feather  | Work:  <[email-masked]>   | Tel:  +44 20 8371 1138
Internet Expert     | Home:  <[email-masked]>  | Fax:  +44 20 8371 4037
Demon Internet      | WWW: http://www.davros.org | Mobile: +44 7973 377646
Thus plc            |                            |

---

From: Jim Reid <[email-masked]>
Date: Sat, 03 Nov 2001 04:10:48 -0800

>>>>> "Dan" == Dan Wing <[email-masked]> writes:

    Dan> How does this apply to ENUM?  ENUM doesn't map person's name
    Dan> to a number, and doesn't map a number to a person's name.

EU data protection laws apply to any data that could reasonably be
expected to identify someone. Phone numbers clearly meet that
requirement. There are also EU-wide regulations on privacy that have
to be followed. This probably means that in Europe an opt-in scheme
will have to be used for ENUM. Discussing these issues can get you
into existential discussions about who owns a phone number: the
organisation that issues the number or the entity that uses it.

---

From: Jim Reid <[email-masked]>
Date: Sat, 03 Nov 2001 04:32:17 -0800

>>>>> "Clive" == Clive D W Feather <[email-masked]> writes:

    >> European law you are NOT allowed to publish somebody's phone
    >> number unless they give you explicit permission to do so.

    Clive> That's an issue of data protection and, in particular,
    Clive> 97/66/EC. It only applies to directories (that map name to
    Clive> number and v.v.).

IIUC 97/66/EC appplies to more than directories, however you have
defined them. [Did you mean phone book type directories or stuff like
LDAP servers?] It's not unlikely that NAPTR records for some number
could contain the name of the person owning that number or a pointer
to their web site or email address or postal address or.... In that
case, ENUM will fall within the remit of EU data protection directives
and national data protection law.

---

From: Ray Anderson <[email-masked]>
Date: Sat, 03 Nov 2001 17:28:44 +0000

It means that the technical implementation of ENUM needs to ensure that
we do whatever we can in the technical design to ensure we are able to
comply with the relevant EU (and other ) directives.

The fact that name is or is not mapped is irrelevant.   Many phone numbers
are to services, not individuals, yet these can still be "protected" or made
ex-directory.

If we proceed with an implementation that increases the difficulty of complying
with the relevant laws, we have less chance of success, just as GSM had
to balance technical complexity with security.

Ray

> > unless the jurisdiction gives at least the same level of protection.

===

---

From: Dave Crocker <[email-masked]>
Date: Sat, 03 Nov 2001 10:02:01 -0800

>comply with the relevant EU (and other ) directives.

         of course.

>The fact that name is or is not mapped is irrelevant.

         on the contrary, it is entirely relevant.  as noted, the EU 
proscription pertains to exactly this function.  if ENUM does not do the 
mapping -- and it does not -- then that particular proscription is not 
applicable to ENUM.

>Many phone numbers are to services, not individuals, yet these can still 
>be "protected" or made ex-directory.

         Whatever do you mean, here?  Anyone can dial any telephone 
number.  ENUM enables virtual dialing.  As such, it does not create a basic 
ability that does not already exist.

>to balance technical complexity with security.

         The real challenge is moving from this truism to specifics that 
actually apply to ENUM.

d/

----------
Dave Crocker  <mailto:[email-masked]>
Brandenburg InternetWorking  <http://www.brandenburg.com>
tel +1.408.246.8253;  fax +1.408.273.6464

---

From: "Dan Wing" <[email-masked]>
Date: Sat, 3 Nov 2001 10:13:36 -0800

> requirement. 

Modifying an example from RFC2916, I could see that

  $ORIGIN 4.3.2.1.6.7.9.8.6.4.e164.arpa.
    IN NAPTR  10 10 "u" "sip+E2U"     "!^.*$!sip:[email-masked]!".

could be identify Patrik if you had some way of knowing that
[email-masked] is an identity he uses.

But, if his ITSP is required by law (or subscriber preference) 
to obfuscute this mapping, you could use

  $ORIGIN 4.3.2.1.6.7.9.8.6.4.e164.arpa.
    IN NAPTR  10 10 "u" "sip+E2U"     
             "!^.*$!sip:[email-masked]!".

and the problem moves from ENUM to SIP to not disclose 
identifying information of the endpoint if the endpoint 
cannot be identified by law or by subscriber preference.

> There are also EU-wide regulations on privacy that have
> will have to be used for ENUM.

It depends on what's placed in the ENUM database.  The ENUM
database can safely contain pointers for all phone numbers
identifying the ITSP for that user, for example.  In countries
where there is still only a PTT, the ITSP would be the PTT.  
In countries where there is competition, the identified ITSP
would be based on the user's preference.

> Discussing these issues can get you

It doesn't seem to matter who owns the information or who owns
the mapping -- if mapping +1-408-525-5314 to "sip:[email-masked]" 
is considered excessive identifying information, that needs to
not be disclosed no matter who owns the number.  I don't
see how mapping +1-408-525-5314 to 
"sip:[email-masked]" could possibly violate the
EU privacy laws.  As an example, every number in +49 is 
serviced by Deutche Telecom, but that information doesn't identify
a person.  As another example, my work number, +1-408-525-xxxx,
identifies me as inside the US, in N. California, and in a
specific section of San Jose.  Certainly knowing that my
ITSP is Pacific Bell - the local incumbant carrier - isn't
excessive identifying information.

-d

---

From: "Dan Wing" <[email-masked]>
Date: Sat, 3 Nov 2001 10:16:55 -0800

> are to services, not individuals, yet these can still be 
> "protected" or made ex-directory.

Today's PSTN subscribers are not restricted to dialing numbers that only 
appear in a phone book.

Not disclosing a number does not somehow "protect" it.  Decades ago it was
common to set up a PC over a weekend to dial numbers sequentially to 
determine what sorts of services are available on different numbers.

-d

---

From: Patrik Fältström <[email-masked]>
Date: Sat, 03 Nov 2001 17:25:38 +0100

> and national data protection law.

It's because of this I personally have thought there is a need for a
standardized way of (a) having an LDAP URI in a NAPTR in a standardized way
where "sensitive information" is stored and (b) continuing to be very
strict on having ENUM being an opt-in system on all levels, from
countrycodes to consumers.

Do you think these two things help?

   paf

---

From: Eric Brunner-Williams in Portland Maine <[email-masked]>
Date: Sat, 03 Nov 2001 14:21:33 -0500

Dan,

If you'll take a look at our (p3p spec wg) current public draft, you will
see that we (or rather, the broad set of people who've given us $.02 worth
of their time) have "online.email" in our schema.

We believe that knowing "paf@swip" is PII. We could be wrong, but that is
in our base data schema.

We also have ipaddr.{hostname,partialhostname,fullip,partialip}, so we're
fairly certain that endpoint identifiers means something in a DP-context,
though we are divided on what degree "partial" differs from "full" in the
presence of a determined and resourcefull attacker (such as Engage, and/or
DoubleClick, or a State).

The "point to the ISP" approach has been considered, and rejected. This is
also one proposal in the provreg wg, to make all registrants appear to be
their registrar. It has advantages (maybe) for the registrant (subscriber),
and is really interesting for "sticky" registrars (walled-garden operators).

Again, aggregation degrades as the attacker-cost increasses to the commercial
or state resource levels.

Again, title isn't the controlling issue.

Anyway, have a gander at (or toss it over the cubie-wall to the pointy-haired
legal myrmidons) the following:

Opinion 5/2000 on The Use of Public Directories of Reverse or Muti-criteria
Searching Services (Reverse Directories)
http://europa.eu.int/comm/internal_market/en/dataprot/wpdocs/wp33en.htm

When I find the paper on certificates indicating a pseudonymn I'll send it
to the WG.

Eric

---

From: Dave Crocker <[email-masked]>
Date: Sat, 03 Nov 2001 11:55:42 -0800

>expected to identify someone. Phone numbers clearly meet that

Jim, please forgive my confusion.

Are you an expert on EU data law?  That is, do you have direct, 
professional experience formulating EU data laws and/or advising clients in 
the topic and/or litigating such matters?

I ask only because you are making statements about legal certitude.

>will have to be used for ENUM.

And since you are now noting that even the strict EU has a path that 
permits use, we are left not knowing what the relevance of this discussion 
thread has, to a group discussing technical matters.

It is also odd that such a concern would be raised this late in the process.

d/

----------

---

From: Eric Brunner-Williams in Portland Maine <[email-masked]>
Date: Sat, 03 Nov 2001 15:18:05 -0500

Following up on Jim's observation that 97/66/EC [1] applies to more than

> countrycodes to consumers.

(a) certainly makes characterization and processing easier. See "Well-Known
Location" for P3P policies, in the work I mentioned earlier.

(b) is consistent with 95/46/EC and 97/66/EC and ... as you know.

Eric

[1] http://europa.eu.int/eur-lex/en/lif/dat/1998/en_398L0010.html
[2] http://europa.eu.int/comm/internal_market/en/dataprot/wpdocs/wp33en.htm

---

From: Jim Reid <[email-masked]>
Date: Sun, 04 Nov 2001 14:31:41 -0800

>>>>> "Dave" == Dave Crocker <[email-masked]> writes:

    Dave> Jim, please forgive my confusion.

    Dave> Are you an expert on EU data law?  That is, do you have
    Dave> direct, professional experience formulating EU data laws
    Dave> and/or advising clients in the topic and/or litigating such
    Dave> matters?

No, of course not! But I do have first-hand experience of dealing with
data privacy and protection issues in the EU, notably the UK Data
Protection Act.
 
    Dave> I ask only because you are making statements about legal
    Dave> certitude.

So what? It's not necessary to be a lawyer or legislator to be aware
of the basics of the law. [Are the speed limits known only to lawyers?
:-)] And if someone wanted professional legal advice, I would hope they
knew not to look for it on this list.

    >> There are also EU-wide regulations on privacy that have to be
    >> followed. This probably means that in Europe an opt-in scheme

    Dave> And since you are now noting that even the strict EU has a
    Dave> path that permits use, we are left not knowing what the
    Dave> relevance of this discussion thread has, to a group
    Dave> discussing technical matters.

I was only answering a point that someone else had brought up.

    Dave> It is also odd that such a concern would be raised this late
    Dave> in the process.

There are a number of concerns about ENUM -- like privacy and data
protection issues! -- that are only just beginning to emerge. Luckily
these are largely not things that the IETF should deliberate
upon. They are however exercising governments, regulators and
telcos. I think it would be prudent at the very least for the IETF to
be aware of what those concerns are and to consider ways of addressing
them even if they are not directly related to the implementation of
RFC2916 and RFC2915.

---

From: Dave Crocker <[email-masked]>
Date: Sun, 04 Nov 2001 14:48:39 -0800

At 02:31 PM 11/4/2001 -0800, Jim Reid wrote:
>upon.

Again, please excuse my confusion.  Here you say the topic is not within 
the IETF's purview -- and that certainly matches my own sense of things -- 
except that leads to the question of why any of this is being raised in the 
IETF.

And then...

>I think it would be prudent at the very least for the IETF to

you say the IETF indeed SHOULD deliberate on the matter, although it is not 
relevant to the IETF's standards efforts in this area.

What, exactly, is this working group supposed to do?

d/

----------

---

From: "Clive D.W. Feather" <[email-masked]>
Date: Mon, 5 Nov 2001 09:34:11 +0000

Eric Brunner-Williams in Portland Maine said:
> We believe that knowing "paf@swip" is PII.

Not sure what you mean by "PII", but the UK Data Commissioner takes the
view that email addresses are "personal data".

---

From: "Clive D.W. Feather" <[email-masked]>
Date: Mon, 5 Nov 2001 09:29:55 +0000

> expected to identify someone. Phone numbers clearly meet that

Meep.

The UK legislation on the topic (Data Protection Act, 1998 c.29) reads:

    "personal data" means data which relate to a living individual who can
    be identified-  
      (a) from those data, or 
      (b) from those data and other information which is in the possession
          of, or is likely to come into the possession of, the data
          controller, 
    and includes any expression of opinion about the individual and any
    indication of the intentions of the data controller or any other person
    in respect of the individual; 

where the "data controller" is:
    a person who (either alone or jointly or in common with other persons)
    determines the purposes for which and the manner in which any personal
    data are, or are to be, processed;

Nothing about "reasonably expected".

In particular, my phone number is only covered if it identifies me directly
or with the aid of other information that is practically available. [Which,
IMO, excludes a reverse directory.]

> This probably means that in Europe an opt-in scheme

Different issue. You can't put my personal data into ENUM without my
permission or an exemption thereto. So you can't put:

    +44 20 8371 1138 -> [email-masked]

without my permission, but you *can* put:

    +44 20 8371 1138 -> [email-masked]

because there's no personal data involved.

> organisation that issues the number or the entity that uses it.

The DPA doesn't talk about the "owner" of data, just the data subject,
processor, and controller.

---

From: Jim Reid <[email-masked]>
Date: Mon, 05 Nov 2001 03:53:07 -0800

>>>>> "Dave" == Dave Crocker <[email-masked]> writes:

    Dave> you say the IETF indeed SHOULD deliberate on the matter,
    Dave> although it is not relevant to the IETF's standards efforts
    Dave> in this area.

    Dave> What, exactly, is this working group supposed to do?

Come up with some recommendations -- perhaps a BCP or two -- that
cover policy issues like privacy and data protection. I believe topics
like these fall within the scope of this WG. IMO it would be better if
the IETF came up with guidelines in these areas. The probable
alternatives are likely to be unsatisfactory: ad hoc solutions or
government-imposed rules.

---

From: Dave Crocker <[email-masked]>
Date: Mon, 05 Nov 2001 07:09:59 -0800

At 03:53 AM 11/5/2001 -0800, Jim Reid wrote:
>like these fall within the scope of this WG.

No, they do not.

d/

----------

---

From: "Dan Wing" <[email-masked]>
Date: Mon, 5 Nov 2001 08:43:12 -0800

> because there's no personal data involved.

I was making this assumption as well, but after several emails
exchanged offline with Eric Brunner-Williams, I now agree that
this can be enough to provide personal idenfification information.

For example, if the above mapping to 
[email-masked] is your email address, one could
connect to the mailer for enum-map.bt.com and use EXPN to determine
where your mail is forwarded, which could be [email-masked].  In
this case, the service provider -- not ENUM -- is at fault.  However,
ENUM assisted in identifying you personally because of the mapping.
There is an additional issue that British Telecom decided to not
occlude your phone number via a hash, although with the abilities
to create reverse directories, a hash is of limited value.

If the above mapping is to your sip address, one could query 
your sip proxy to determine the location you're currently forwarding
certain connections to.  With this information and the ease of
creating reverse directories, it's trivial to determine your home
telephone number if your email address or business phone number is
known -- you only need to create an association between them (by
forwarding a phone number which propagates to SIP, for example),
which allows anyone substantially interested to obtain a lot of
other information about you.

Today, it's hard to go through all phone numbers in +44 and
ask  "Do you know Clife Feather?" until you finally dial your
number or dial someone that knows you (and not the other Clife
Feathers that live in the +44 country code).

With the ability to build up huge databases copying telco's
"forward" entries (such as what is in ENUM and SIP) and 
reversing all of those databases, allows companies or countries
to obtain information that today is hidden in Local Number
Portability databases, PBX forwarding entries, telco's 
forwarding, and mobile phone operator's forwarding databases.

-d

---

From: "Dan Wing" <[email-masked]>
Date: Mon, 5 Nov 2001 08:43:34 -0800

> view that email addresses are "personal data".

PII = personal identifying information.

-d

---

From: Richard Shockey <[email-masked]>
Date: Mon, 05 Nov 2001 10:50:38 -0500

>>like these fall within the scope of this WG.

Well yes and no ... the proposed new charter specifically discusses the 
need for privacy considerations.

What might be useful is a 1. Informational document discussing the current 
state of privacy and data protection rules in general. This might be useful 
the general IETF community and a reasonable addtion to the RFC series much 
like the WG's Number Portability draft.

Beyond that there might be specific Informational documents relating to 
data protection and privacy in ENUM or we might suggest to authors working 
on ENUM drafts that they put in a specific privacy considerations section.