Subject: RE: ENUM Privacy (was RE: [Enum] User ENUM vs Operator ENUM)

From: "Fullbrook Kim (UK)" <[email-masked]>
Date: Fri, 25 Jun 2004 05:11:59 -0400

The underlying intent in the SIP world is for everyone to have a "user friendly" address rather than an E.164 number.  I might choose to have a SIP URI as kim at bigtelco.com  - a name which says something about me - and will probably have a similarity to my email address and Presence address.  I don't want to have to choose  x43thyu at bigtelco.com  to maintain obscurity.  Perhaps we may have to argue over whether someone whose SIP URI is oldbrowneyes at bigtelco.com is being obscure or giving out information about themself.  My assertion is that this is personal information and should be kept private if the owner wishes.

If someone wardials a list of E.164 numbers today they will get ring tone (or busy tone) from valid numbers and probably "number unobtainable" from invalid numbers.  But all they have is a list of numbers.  There is nothing to distinguish one number from another. My number doesn't say anything about me except possibly the area I live in or the carrier that I use.  

The intent of the ENUM DNS (from RFC 2916) is that it can be "used for identifying available services connected to one E.164 number" giving examples of re-directs, email address and web page.

Someone can wardial the DNS using E.164 numbers to get back a list of SIP URIs and potentially other information such as email addresses. My definition of a phone book obtained by this means is a list of valid SIP URIs which contain some user-specific information.  

So to sum up and answer the question:
- a list of e.164 numbers is just a list of numbers which says nothing about the owner of the number, only that there is probably a working phone on the end of it

- A list of SIP URIs, if we follow the intent behind the use of SIP, is that it makes available naming information about that person which they may not want to give out, whether it is in the form of "kim" or "oldbrowneyes".

Kim.

-----Original Message-----
From: James Seng [mailto:jseng at pobox.org.sg] 
Sent: 24 June 2004 23:06
To: Fullbrook Kim (UK)
Cc: 'enum at ietf.org'
Subject: Re: ENUM Privacy (was RE: [Enum] User ENUM vs Operator ENUM)

And how is it different from someone wardial a set of numbers and 
obtained a list of valid phone number today?

ps: list of numbers != phone book. A yellowpage associate a number with 
a person.

-James Seng

Fullbrook Kim (UK) wrote:
> - If the DNS is publicly accessible with the URI in usual format e.g. 
<FONT SIZE=
2>> 12345678909 -> sip:jdoe at bigtelco.com  then we are back to the same 
> situation already described: anyone can "war dial" the DNS and build up 
> a list of SIP URIs of subscribers which is effectively a publicly 
> accessible phone book without "opt out".
> 
> Kim.

-----Original Message-----
From: James Seng [mailto:jseng at pobox.org.sg] 
Sent: 24 June 2004 23:06
To: Fullbrook Kim (UK)
Cc: 'enum at ietf.org'
Subject: Re: ENUM Privacy (was RE: [Enum] User ENUM vs Operator ENUM)

And how is it different from someone wardial a set of numbers and 
obtained a list of valid phone number today?

ps: list of numbers != phone book. A yellowpage associate a number with 
a person.

-James Seng

Fullbrook Kim (UK) wrote:
> - If the DNS is publicly accessible with the URI in usual format e.g. 
> 12345678909 -> sip:jdoe at bigtelco.com  then we are back to the same 
> situation already described: anyone can "war dial" the DNS and build up 
> a list of SIP URIs of subscribers which is effectively a publicly 
> accessible phone book without "opt out".
> 
> Kim.
> 
> -----Original Message-----
> From: Mike Hammer [mailto:mhammer at cisco.com]
> Sent: 22 June 2004 20:38
> To: Jeff Williams
> Cc: enum at ietf.org; Stastny Richard
> Subject: Re: AW: ENUM Privacy (was RE: [Enum] User ENUM vs Operator ENUM)
> 
> <Original note edited>
> 
> I would argue that for any E.164 number in the form of a domain name that
> is found within the DNS, if the resulting records point simply to
> information of a service or a service provider address that does not
> provide more information specific to an individual subscriber, then no
> privacy violation has occurred.  Any messages sent to that address, be they
> http, email, im, sip, h323, or whatever can then be handled on their own
> terms.  Routing happens.
> 
> ------------------------------------------------------------------------
> 
> ========================================================
> This electronic message contains
information from the mmO2 plc Group
> which may be privileged or confidential. The information is intended to
> be for the use of the individual(s) or entity named above. If you are not
> the intended recipient be aware that any disclosure, copying
> distribution or use of the contents of this information is prohibited. 
> If you
> have received this electronic message in error, please notify us
> by telephone or email (to the numbers or address above) immediately.
> ========================================================
> 
> 
> ------------------------------------------------------------------------
> 
> _______________________________________________
> enum mailing list
> enum at ietf.org
> https://www1.ietf.org/mailman/listinfo/enum

_______________________________________________
enum mailing list
enum at ietf.org
https://www1.ietf.org/mailman/listinfo/enum

========================================================This electronic message contains information from the mmO2 plc Group which may be privileged or confidential. The information is intended tobe for the use of the individual(s) or entity named above. If you are notthe intended recipient be aware that any disclosure, copyingdistribution or use of the contents of this information is prohibited. If youhave received this electronic message in error, please notify usby telephone or email (to the numbers or address above) immediately.========================================================
_______________________________________________
enum mailing list
enum at ietf.org
https://www1.ietf.org/mailman/listinfo/enum

---

From: James Seng <[email-masked]>
Date: Fri, 25 Jun 2004 06:22:23 -0400

Fullbrook Kim (UK) wrote:
The underlying intent in the SIP world is for everyone to have a "user 
friendly" address rather than an E.164 number.  
And a E.164 number is also a user-friendly identifier as much as SIP is.
> I might choose to have a
SIP URI as kim at bigtelco.com  - a name which says something about me - 
and will probably have a similarity to my email address and Presence 
address.  
If you choose it to be similar, thats your choice. But you can also 
choose it to be different.

I don't want to have to choose  x43thyu at bigtelco.com  to 
maintain obscurity.  
Then find a ITSP which dont do this. The choice is still yours.
> Perhaps we may have to argue over whether someone
whose SIP URI is oldbrowneyes at bigtelco.com is being obscure or giving 
out information about themself.  My assertion is that this is personal 
information and should be kept private if the owner wishes.
As you can see above, you have a choice.
 > If someone wardials a list of E.164 numbers today they will get ring
tone (or busy tone) from valid numbers and probably "number 
unobtainable" from invalid numbers.  But all they have is a list of 
numbers.  There is nothing to distinguish one number from another. My 
number doesn't say anything about me except possibly the area I live in 
or the carrier that I use. 
Yes.
The intent of the ENUM DNS (from RFC 2916) is that it can be "used for 
identifying available services connected to one E.164 number" giving 
examples of re-directs, email address and web page.
Someone can wardial the DNS using E.164 numbers to get back a list of 
SIP URIs and potentially other information such as email addresses. My 
definition of a phone book obtained by this means is a list of valid SIP 
URIs which contain some user-specific information. 
Not _neccessary_. While it is _possible_ for someone to obtain a lot of 
information by doing ENUM queries, you can either choose to put in this 
information yourself or you don't.

And if you don't then, either because your ISPs do it without asking for 
your permission or it is mandated by the regulator, then you have a ITSP 
/regulation which dont understand privacy, and that's an issue *you* 
bring to them, not to ENUM WG.

So to sum up and answer the question:
- a list of e.164 numbers is just a list of numbers which says nothing 
about the owner of the number, only that there is probably a working 
phone on the end of it

- A list of SIP URIs, if we follow the intent behind the use of SIP, is 
that it makes available naming information about that person which they 
may not want to give out, whether it is in the form of "kim" or 
"oldbrowneyes".
Nope. You have a choice. There is nothing to say your SIP address = 
Email address.

For a lot of reasons, my IETF EMail address != Person Email address != 
Personal Phone number != SIP Address.

In summary, your _supposingly_ problem, is a problem of many _ifs_. If 
user sip address = email, and if you put that into DNS or if someone 
else put it into it without your permission, and if someone wardials, 
etc. Along each of these 'ifs', there are many alternative realities 
which does not violate privacy.

-James Seng