Subject: Re: AW: [Enum] Carrier ENUM mini-BoF Agenda

From: "Peter Williams" <[email-masked]>
Date: Mon, 21 Jun 2004 01:07:56 -0400

From: Jeff Williams <jwkckid1 at ix.netcom.com>
To: Stastny Richard <Richard.Stastny at oefeg.at>
CC: enum at ietf.org, Richard Shockey <richard at shockey.us>
Subject: Re: AW: [Enum] Carrier ENUM mini-BoF Agenda
Date: Sun, 20 Jun 2004 19:42:26 -0700
Stastny and all,
Stastny Richard wrote:
> So given Steven questions, my "User ENUM" definitions
> and Richards "Carrier TN to URI translation mechanisms" aka "Carrier 
ENUM",
>
> I want to try to give an answer to question 1b first, before I address 
1a
>
> a: within User ENUM there exist privacy issues.
>     set-up properly these issues do not exist in "Carrier ENUM",
>     because either the information is not accessible or not usable
>     by end-users.
>     Note: all privacy issues with ENUM should thereore be discussed
>     in the first half of the meeting, not in the mini-BoF on "Carrier 
ENUM"

  Good point.

This is not appropriate, in my view. The reasoning is very flawed. There is 
a relationship between holder of the E.164 and the ENUM provider. While 
end-users may be unable to gain access to the marketing information derived 
from the providers analyis of the transactions for a given ENUM name, 
listing beneath e164.arpa (or elsewhere), the provider may seek to sell this 
information about the holder to value-added resellers, folk sellling 
additional telematic services, etc etc. This is quite typical in the US, and 
is what the US privacy policy apparatus is designed to codify, and disclose 
(even if it provides little in the way of enfocement) - so subscribers are 
at least notified of the possible arrangements that may impact their wider 
use of telematics.

Remember to distinguish between privacy, and security folks. Providing 
wonderful access conrol security by DNS or procedural means has no relevance 
to the privacy issues which we mut address in our engineering work on a 
public lookup service. Privacy is about information reuse, and disclousre of 
the possible reuses  by all involved parties, including providers. In many 
cases, the most blatant privacy abuses do NORMALLY not involve the end-users 
directly: they involve selling information about end-users by providers and 
others with whom the end-user has no contractual relationships.

Remember, it took IETF over 15 years of hard work to privacy-enhace our 
email standards, with CA policy disclosures etc. We bridged complex legal 
work about digital signatures and CAs, and simple crypto work. And it took 
us over 10 years to secure IPSEC. If if takes as long to privacy enhance or 
secure ENUM protocols, so be it.

Peter.

_______________________________________________
enum mailing list
enum at ietf.org
https://www1.ietf.org/mailman/listinfo/enum

---

From: Jeff Williams <[email-masked]>
Date: Mon, 21 Jun 2004 01:37:26 -0400

Peter and all,

> others with whom the end-user has no contractual relationships.

Given your own comments and remarks here Peter, I would disagree
that there is a separation between privacy and security, they are directly
as well as indirectly.  If a provider can and does sell such user ENUM
data to any other party, the security of those users at that point is
jeopardized.  This can by in large, but not completely eliminated/reduced
if the standards track is inclusive of the necessary provisions.  These were
already discussed and discounted  as not necessary at that time.  Bad idea,
that.

> secure ENUM protocols, so be it.

  It shouldn't take anywhere near 10 years to address security and privacy
issues with the ENUM standards track unless anti-privacy bigots
wish to be continually disruptive...

> Peter.

Regards,
--
Jeffrey A. Williams
Spokesman for INEGroup LLA. - (Over 134k members/stakeholders strong!)
"Be precise in the use of words and expect precision from others" -
    Pierre Abelard

"If the probability be called P; the injury, L; and the burden, B;
liability depends upon whether B is less than L multiplied by
P: i.e., whether B is less than PL."
United States v. Carroll Towing  (159 F.2d 169 [2d Cir. 1947]
===============================================================
Updated 1/26/04
CSO/DIR. Internet Network Eng. SR. Eng. Network data security
IDNS. div. of Information Network Eng.  INEG. INC.
E-Mail jwkckid1 at ix.netcom.com
 Registered Email addr with the USPS
Contact Number: 214-244-4827