Subject: ENUM Privacy (was RE: [Enum] User ENUM vs Operator ENUM)

From: "Fullbrook Kim (UK)" <[email-masked]>
Date: Fri, 18 Jun 2004 10:42:24 -0400

>> If you live in a real world, and want to communicate with
>> Others, you always have to disclose privacy information.

I see the underlying issue here being where and how widely that private information is disclosed.

Drawing an analogy with basic PSTN landline service.  I'm not sure how it is in other countries but here in the UK you can choose to have your name and phone number included in the regional phone book or you can choose not to (and pay some money not to, but that's a different issue). If you're in the phone book any marketing company can look up your name & number and phone you up to try to sell you something.  (We also have an "opt out" system in the UK to stop unsolicited commercial phone calls but even though it should cut out these calls it does not always work).

If I'm concerned about privacy I have a choice about opting out of the phone book and I can be careful who I give my business card to.  Here I am the customer and have control over privacy.  The danger is that an open ENUM DNS is a freely accessible "phone book" and I believe that Telecomms Regulators, especially in the EU would look unfavourably on this. Particularly if Presence and related messaging information was put in there - already we know that IM spam (spim) is a menace. There would have to be access controls and quickly the question becomes: why should anyone display their details except for businesses advertising in a Yellow Pages directory ?

To me this is a completely different issue to that of "war dialling" phone numbers which you can never stop, except perhaps make more difficult by adding time delays or cost. The point is whether as a telecomms company you make available a list of your customers irrespective of the naming & addressing scheme used, because having a list means you are making life easier for the spammers and other undesirables. Sorry if this last point upsets someone but the only way forward which acknowledges privacy concerns seems to be "Operator ENUM" and not implementing open "User ENUM".

========================================================This electronic message contains information from the mmO2 plc Group which may be privileged or confidential. The information is intended tobe for the use of the individual(s) or entity named above. If you are notthe intended recipient be aware that any disclosure, copyingdistribution or use of the contents of this information is prohibited. If youhave received this electronic message in error, please notify usby telephone or email (to the numbers or address above) immediately.========================================================
_______________________________________________
enum mailing list
enum at ietf.org
https://www1.ietf.org/mailman/listinfo/enum

---

From: James Seng <[email-masked]>
Date: Fri, 18 Jun 2004 11:54:44 -0400

Repeat after me: ENUM is not a yellowpage.

On 18 June 2004 pm 22:19, Fullbrook Kim (UK) wrote:
> Drawing an analogy with basic PSTN landline service.  I'm not sure how it
> is in other countries but here in the UK you can choose to have your name
> and phone number included in the regional phone book or you can choose not
> to (and pay some money not to, but that's a different issue). If you're in
> the phone book any marketing company can look up your name & number and
> phone you up to try to sell you something.  (We also have an "opt out"
> system in the UK to stop unsolicited commercial phone calls but even though
> it should cut out these calls it does not always work).
>
> If I'm concerned about privacy I have a choice about opting out of the
> phone book and I can be careful who I give my business card to.  Here I am
> the customer and have control over privacy.  The danger is that an open
> ENUM DNS is a freely accessible "phone book" and I believe that Telecomms
> Regulators, especially in the EU would look unfavourably on this.
> Particularly if Presence and related messaging information was put in there
> - already we know that IM spam (spim) is a menace. There would have to be
> access controls and quickly the question becomes: why should anyone display
> their details except for businesses advertising in a Yellow Pages directory
> ?
>
> To me this is a completely different issue to that of "war dialling" phone
> numbers which you can never stop, except perhaps make more difficult by
> adding time delays or cost. The point is whether as a telecomms company you
> make available a list of your customers irrespective of the naming &
> addressing scheme used, because having a list means you are making life
> easier for the spammers and other undesirables. Sorry if this last point
> upsets someone but the only way forward which acknowledges privacy concerns
> seems to be "Operator ENUM" and not implementing open "User ENUM".
>
>
>
>
> -----------------------------------------------------------------------
>
> ========================================================
> This electronic message contains information from the mmO2 plc Group
> which may be privileged or confidential. The information is intended to
> be for the use of the individual(s) or entity named above. If you are not
> the intended recipient be aware that any disclosure, copying
> distribution or use of the contents of this information is prohibited. If
> you have received this electronic message in error, please notify us
> by telephone or email (to the numbers or address above) immediately.
> ========================================================

---

From: Jeff Williams <[email-masked]>
Date: Sat, 19 Jun 2004 01:32:27 -0400

Kim and all,

Fullbrook Kim (UK) wrote:

> I see the underlying issue here being where and how widely that
> private
> information is disclosed.

  Yes this is indeed part of the issue.  But only part.  Those that
wish to control your privacy level is being undermined using a
lack of willingness and policy making of technical standards tracks.

>
>
> Drawing an analogy with basic PSTN landline service.  I'm not sure how
> it is
> in other countries but here in the UK you can choose to have your name
> and
> phone number included in the regional phone book or you can choose not
> to
> (and pay some money not to, but that's a different issue).

  This is also true in the US and many other countries.

> If you're in the
> phone book any marketing company can look up your name & number and
> phone
> you up to try to sell you something.  (We also have an "opt out"
> system in
> the UK to stop unsolicited commercial phone calls but even though it
> should
> cut out these calls it does not always work).

  In the US we also now have a similar option.  Yet is seems with some
within the IETF with ENUM and VOIP, there is a resistance to allow
for stakeholders/users to make that sort of decision for themselves
indicating
that either users are not really able to make such decisions for
themselves
and still utilize the technology of ENUM and VOIP or that the laziness
of
really not very difficult technical capability or providing for
non-listed
ENUM numbers as part of the standard proposed.

> phone
> book and I can be careful who I give my business card to.  Here I am
> the
> customer and have control over privacy.  The danger is that an open
> ENUM DNS
> is a freely accessible "phone book" and I believe that Telecomms
> Regulators,
> especially in the EU would look unfavourably on this.

  And the US as well and a number of other western nations such as
Canada
will also look very unfavorably upon not having the same of similar
ability to opt-out with ENUM.

> Particularly if
> Presence and related messaging information was put in there - already
> we
> know that IM spam (spim) is a menace. There would have to be access
> controls
> and quickly the question becomes: why should anyone display their
> details
> except for businesses advertising in a Yellow Pages ?

  Good question.

> -
> ---------------------------------------------------------------------
>
> distribution or use of the contents of this information is prohibited.
> If you
> have received this electronic message in error, please notify us
>    Part 1.2       Type: Plain Text (text/plain)
>               Encoding: 7bit

Regards,

--
Jeffrey A. Williams
Spokesman for INEGroup LLA. - (Over 134k members/stakeholders strong!)
"Be precise in the use of words and expect precision from others" -
    Pierre Abelard

"If the probability be called P; the injury, L; and the burden, B;
liability depends upon whether B is less than L multiplied by
P: i.e., whether B is less than PL."
United States v. Carroll Towing  (159 F.2d 169 [2d Cir. 1947]
===============================================================
Updated 1/26/04
CSO/DIR. Internet Network Eng. SR. Eng. Network data security
IDNS. div. of Information Network Eng.  INEG. INC.
E-Mail jwkckid1 at ix.netcom.com
 Registered Email addr with the USPS
Contact Number: 214-244-4827

---

From: Jeff Williams <[email-masked]>
Date: Sat, 19 Jun 2004 01:40:57 -0400

James and all,

  Right!  It is becoming if the current standards track goes on
unchecked, the White Pages and you as a user MUST be
listed in it.

Regards,

---

From: "Christian de Larrinaga" <[email-masked]>
Date: Sat, 19 Jun 2004 10:18:26 -0400

Fullbrook Kim (UK)Sent: 18 June 2004 15:20

>the only way forward which acknowledges privacy concerns seems to be
"Operator ENUM" and >not implementing open "User ENUM".

Well perhaps for your company but I don't believe this is a general
observation applicable to all.

Privacy concerns as other operational issues differ between Operator and
direct user usage of ENUM. These stem from the different ambitions for ENUM
use and of course the existant regulatory frameworks that govern operators
and of users themselves.

Christian de Larrinaga

---

From: "Clive D.W. Feather" <[email-masked]>
Date: Mon, 21 Jun 2004 02:33:27 -0400

Fullbrook Kim (UK) said:
> Drawing an analogy with basic PSTN landline service.  I'm not sure how it is
> in other countries but here in the UK you can choose to have your name and
> phone number included in the regional phone book or you can choose not to

Free opt-out is a legal requirement throughout the EU.

-- 
Clive D.W. Feather  | Work:  <clive at demon.net>   | Tel:    +44 20 8495 6138
Internet Expert     | Home:  <clive at davros.org>  | Fax:    +44 870 051 9937
Demon Internet      | WWW: http://www.davros.org | Mobile: +44 7973 377646
Thus plc            |                            |

---

From: Mike Hammer <[email-masked]>
Date: Mon, 21 Jun 2004 19:53:46 -0400

At 12:25 AM 6/19/2004 -0700, Jeff Williams wrote:
James and all,
  Right!  It is becoming if the current standards track goes on
unchecked, the White Pages and you as a user MUST be
listed in it.
Is there an RFC that specifies what are the mandatory elements in the record?
While the white pages contains a person's name and number, I don't think a 
person's name is mandated in ENUM, is it?

Mike

---

From: James Seng <[email-masked]>
Date: Tue, 22 Jun 2004 08:54:53 -0400

as far as i know, the RFC is silent on how you want to use it. so 
basically you have the right to use it in stupid ways, if you wish to.

that to me is a good engineering design :- one that allow good things to 
happen but also does not prevent stupid things. the latter may turn out 
to be smart in some other ways in future..you never know.

thus, policies on privacies are interested and definately important, but 
that discussion to bring it to another forum, e.g. Numbering Authority 
of each country.

On the other hand, this is not to say we dont discuss it at all :- I am 
all for discussing "Considerations of Privacy in ENUM" altho I am more 
relucant to discuss "Privacy Statement for ENUM". Lets not pretend IETF 
can do global policy.

ps: In case anyone wonders what I am doing in Singapore for privacy, I 
am advocating we publish only records that users wants to publish and 
absolutely no WHOIS or (horror!) CRISP.

-James Seng
Mike Hammer wrote:

Is there an RFC that specifies what are the mandatory elements in the 
record?

While the white pages contains a person's name and number, I don't think 
a person's name is mandated in ENUM, is it?

Mike