Subject: Re: ENUM Privacy (was RE: [Enum] User ENUM vs Operator ENUM)

From: "Peter Williams" <[email-masked]>
Date: Sat, 26 Jun 2004 13:31:14 -0400

We have a history in IETF of addressing privacy in the area of name 
bindings. For nearly 20 years, we have addressed disclosures in the area of 
CA - TTPs (much like ENUM TTPs) that address name bindings. Whereas CAs bind 
names in a certificate, ENUM providers will bind names in a DNS entry.

And if you don't then, either because your ISPs do it without asking for 
your permission or it is mandated by the regulator, then you have a ITSP 
/regulation which dont understand privacy, and that's an issue *you* bring 
to them, not to ENUM WG.

ENUM WG can decide to follow the practice of other WGs in addressing policy 
disclosures, and means for accessing policy discloures about name bindings, 
or it can decide to offload the issues to future subscribers and/or users. 
Inevitably the AD will be heavily involved in this, and the factors and 
communications that sway her will be up for IETF disclosure, and (as IETF 
operates mainly in the US) discovery.

What she cannot argue is that IETF has no understanding or involvement in 
the topic area: it has considerable knowhow, and has previously standardized 
topics in the area of operational policy disclosure for name binding 
mechanisms before now. Mostly significantly, it has undertaken to publish 
compliance criteria for such operators to use ,when measuing their 
conformance to the IETF policy disclosure standards - for name binding 
mechanisms.

Peter.

_______________________________________________
enum mailing list
enum at ietf.org
https://www1.ietf.org/mailman/listinfo/enum

---

From: Jeff Williams <[email-masked]>
Date: Sun, 27 Jun 2004 02:17:11 -0400

Peter and all,

> names in a certificate, ENUM providers will bind names in a DNS entry.

  Your right here of course as you state it.  And it is that ENUM providers
can still bind names with assigned ENUM's to users without those
names and numbers being necessarily viewable to anyone.  However
as the current standards track is now, that is not an option for users
to decide, which is where the crux of the privacy problem/issue is
from a technical perspective.  As the IAB has a history of being
anti-privacy bigots, this concern is therefore not only appropriate
but also heightened accordingly.

> conformance to the IETF policy disclosure standards - for name binding

Regards,

--
Jeffrey A. Williams
Spokesman for INEGroup LLA. - (Over 134k members/stakeholders strong!)
"Be precise in the use of words and expect precision from others" -
    Pierre Abelard

"If the probability be called P; the injury, L; and the burden, B;
liability depends upon whether B is less than L multiplied by
P: i.e., whether B is less than PL."
United States v. Carroll Towing  (159 F.2d 169 [2d Cir. 1947]
===============================================================
Updated 1/26/04
CSO/DIR. Internet Network Eng. SR. Eng. Network data security
IDNS. div. of Information Network Eng.  INEG. INC.
E-Mail jwkckid1 at ix.netcom.com
 Registered Email addr with the USPS
Contact Number: 214-244-4827