Subject: Re: [Enum] Compendium on enumservices registration

From: John Morris <[email-masked]>
Date: Wed, 20 Nov 2002 17:26:10 -0500

Richard, a few comments....

At 05:06 PM 11/20/02 +0100, Stastny Richard wrote:

<snip>
>Since ENUM is an opt-in service, as defined in all policy frameworks
>I currently know of, I considered this problem dealt with.

When discussing privacy, some proponents of ENUM argue that it is opt-in 
and thus we do not need to worry about privacy.  Yet at the same time, they 
have grand visions of how ENUM will be widely used by large businesses, 
small businesses, and perhaps even consumers.

If ENUM ultimately only fills the needs of a fairly small niche market, 
then perhaps you can say that it is opt in.  But if ENUM will be widely 
deployed and possibly used by many (large or small, corporate or 
individual), then you cannot say it is opt in.  Simply put, if something 
becomes an important tool in our society and one cannot compete as 
effectively without it, then it is not opt in.  That view would be like 
saying that there is no need to permit unlisted telephone numbers in the 
PSTN because, hey, telephones are opt-in (if you don't want to be listed, 
don't get a phone).

Having said this, I generally agree with you that -- so long as Called 
Party control is a truly viable option -- then the privacy concerns raised 
by the Calling Party control approach are greatly mitigated (as I noted in 
my e-mail a few days ago).  Thus, it will be important for ENUM authorities 
and implementers NOT to force ENUM customers into the calling party model.

<snip>
>I also consider ENUM as very useful for enterprise use, and companies do not
>have a privacy problem at all.

Some companies will be happy to publish all contact info for their 
employees, but others will view full contacts info as both a privacy and 
corporate security concern.  I know of a number of multinational companies 
that view their internal phone directories has confidential 
documents.  Personally, I suspect that the companies concerned about 
privacy and security of contact info will increase, not decrease.

The upshot of all of this is that anonymous ENUM entries have significant 
value (as does, for some, the master-global-white-pages vision of ENUM).

John

_______________________________________________
enum mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/enum

---

From: "Stastny Richard" <[email-masked]>
Date: Thu, 21 Nov 2002 08:55:21 +0100

Hi John,
 
This is a long one, but the conclusion below is IMHO important
 
first the minor issue concerning privacy issues:
>documents. 
 
I know, the company I worked for in the 80ies had a licence of DMS-100, so a had a lot to do
with NORTEL (better Northern Telecom and BNR;-), and they really where crazy about their phone
directory (mainly because of MITEL).
 
Considering this, we are working on models for companies in ENUM (there is a lot of other issues too, mainly provisioning), including the usage of split-DNS for ENUM.
 
Now to the opt-in issue:
 
This was NOT my idea, although many people in IETF seem to believe this, it was the idea from the Report of the Department of State ITAC-T Advisory committee Study Group A Ad Hoc on ENUM, July 6th, 2001, (puh), BTW chaired by Gary Richenaker, now chair of the US ENUM Forum and chair of ITU-T SG2 Q.1 (from Telcordia),  proposing the US ENUM Forum and stating:

4.3 Opt-in service for called user.

The assignee of a number must choose to participate in ENUM before any NAPTR records for the number can be populated. This is important since records in ENUM are publicly accessible via DNS query. The opt-in process should be designed to ensure the following:

·         Users can control privacy and security of their information.

·         The default condition is to not include NAPTR record information.

·         Any request for inclusion must be authenticated as being from the assignee of the E.164 number.

·         Inclusion of NAPTR record information must be reversible, allowing the party to remove the data from the DNS in a timely fashion.

4.4 Opt-in service for calling user and service provider.

The crucial part of Opt-in for the calling user and service provider is whether or not to query ENUM and then whether or not to make use of the results. 

The following approach is proposed for telephony services:

1.       No originating party (e.g., a calling user or a service provider) is obligated to perform an ENUM query to complete a telephone call to an E.164 number.

2.       A party making an ENUM query, whether a calling user or service provider, is not obligated to use any of the services in the NAPTR records returned.

3.       All E.164 numbers must have a Public Switched Telephone Network (PSTN) point of interface. (For geographic numbers this would be an end office or tandem.)

This was taken over in principle as policy by ITU-T and slightly modified by ETSI in TS 102 051 "ENUM Administration in Europe", and therefore by all regulators dealing with ENUM issues, and therefor I have to live with this, as far as "User-ENUM" is concerned.

And because I fully support your arguments, I tried to raise these issues in draft-stastny-enum-scenarios-00 in IETF, proposing a User-ENUM and an infrastructure ENUM, with no response (it was not even put on the agenda). The infrastructure ENUM would only contain records without any privacy problems, therefore would not require opt-in and could be used by operators for infrastructure purposes routing, NP, etc.). ETSI is currently progressing this work in SPAN with a Work Item on ENUM for Network Routing.

One reason may be that a majority in the US sees e164.arpa as infrastructure ENUM anyway (which is seen differently elsewhere, ITU and ETSI sees e164.arpa as User-ENUM), so they see on one hand not the reason for an additional infrastructure ENUM, and on the other hand do not see a reason for the services provided in the Compendium, because they are really  not needed  in an infrastructure ENUM. For infrastructure ENUM I just need sip, h323 and tel with the James Yu extensions. For User ENUM I need the Compendium services.

I think there is a severe misunderstanding here, both sides always talking differnent things.

best regards

Richard Stastny

	-----Ursprüngliche Nachricht----- 
	Von: John Morris [mailto:[email-masked]] 
	Gesendet: Mi 20.11.2002 23:26 
	An: Stastny Richard; [email-masked] 
	Cc: 
	Betreff: Re: [Enum] Compendium on enumservices registration

	
	<snip>

	
	
	<snip>

	
	John

---

From: John Morris <[email-masked]>
Date: Thu, 21 Nov 2002 16:45:38 -0500

Richard,

a brief comment, with more conversation on privacy in the coming weeks...

John

At 08:55 AM 11/21/02 +0100, Stastny Richard wrote:
<snip>

>Now to the opt-in issue:
>
>This was NOT my idea, although many people in IETF seem to believe this, 
>it was the idea from the Report of the Department of State ITAC-T Advisory 
>committee Study Group A Ad Hoc on ENUM, July 6th, 2001, (puh), BTW chaired 
>by Gary Richenaker, now chair of the US ENUM Forum and chair of ITU-T SG2 
>Q.1 (from Telcordia),  proposing the US ENUM Forum and stating:

Yes.  To be clear, I did not think the opt-in analysis was your idea -- I 
appreciate that it has long been an analysis advanced by ENUM 
proponents.  But I think it has only limited validity, and in any event 
does not avoid the need to develop and offer privacy friendly options 
within the ENUM structure.