Subject: RE: [Enum] NITS review of draft-ietf-enum-infrastructure-03

From: "Rosbotham, Paul" <[email-masked]>
Date: Fri, 5 Jan 2007 12:01:34 -0000

OK, I've been trying to keep out of this but I guess I should step in and clarify, given it was me who had the meeting with the UK Information Commissioner's Office.

They had I-ENUM explained to them and expressed reservations.  Reservations, not outright written legal objections...they were asked to give an informal opinion and personally I welcome that they did so.  Laurence is correct, however, that there is no formal position.  Similarly, Clive is also correct to mention that there may be issues.  

I am not a lawyer, so apologies if any of this is garbled.  The basic view was that although a telephone number in itself is not personal data, via the concept of "linked datasets", it can be combined with other databases to produce things which represent privacy concerns under EU legislation.  In particular, when linked with a telephone directory, it would allow the tying together of an individual and their telephone provider, which could be considered as personal data.  In putting their number into a telephony directory, the end user consented to that information being published, not for it to be possible to determine their choice of supplier.  It's this "linked datasets" consideration which leads to the rules around CLI transmission...the CLI isn't personal data but when linked to other data it becomes so : therefore if the customer wishes to withhold their CLI they can do so, and this is independent of whether they choose to be listed in a directory.  The fact that some numbers relate to corporate entities is irrelevant...many belong to an individual.

In terms of the position elsewhere in the EU, I wouldn't comment.  There isn't a formal position in the UK, just an informal reservation.  My experience on other issues relating to information privacy is that although the EU Directive may be pan-European, interpretation of it is not.  The UK tends to take a middle line, with some countries being more liberal, others more conservative.  I would query whether in the Austrian case approval was given by the telecoms regulator, or the information privacy regulator...these are typically not the same.  However, if the Austrian information commissioner has given consent, well they know far more about Austrian legislation than I do so I wouldn't query that.

If the current informal position did harden into a formal one, then the conclusion IMHO is that it could be difficult to put i-ENUM in public DNS.  This doesn't mean that CPs in other jurisdictions couldn't adopt that approach, but I have to act within my national law.

As to the opinions of others who assert that the UK Information Commissioner is wrong, well you're welcome to these opinions, but you'll forgive me if I listen to the UK regulator when determining whether I'm compliant with legislation, rather than someone's opinion on a mailing list...

Regards

Paul Rosbotham 
Manager, Interconnect Strategy & Technology Regulation
Cable & Wireless 
www.cw.com

-----Original Message-----
From: Otmar Lendl [mailto:[email-masked]]
Sent: 05 January 2007 11:37
To: [email-masked]
Subject: Re: [Enum] NITS review of draft-ietf-enum-infrastructure-03

On 2007/01/04 17:01, "Clive D.W. Feather" <[email-masked]> wrote:
> lconroy said:
> 
> > If any NRA or equivalent data protection authority refused to permit
> > a necessary part of SIP URLs to be published, then doing so would
> > make VoIP in general rather hard. An originating system has to be able
> > to "find" the destination SIP provider or it isn't going to work. I hear
> > rumours, but I can't believe anyone intends to block VoIP in this way.
> 
> There's a difference between User (opt-in) and Infrastructure (everyone is
> included) Enum in this context. I'm referring to Infrastructure Enum only.

I'm not sure whether the suggested legal problems stem from EU law or
national .uk one. In any case, you might be interested to hear that
the Austrian NRA (RTR GmbH) happily signed a contract with us
designating us to run an infrastructure ENUM trial in the *public* DNS.

Whether that's just because we Austrians tend to be creative in the
interpretation of EU regulations or whether there is really no problem
there, I can't tell.

But it's a fact that we run an officially sanctioned I-ENUM trial
here in an EU member state.

/ol
-- 
< Otmar Lendl ([email-masked]) | nic.at Systems Engineer >

_______________________________________________
enum mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/enum

This e-mail has been scanned for viruses by the Cable & Wireless e-mail security system - powered by MessageLabs. For more information on a proactive managed e-mail security service,  visit http://www.cw.com/uk/emailprotection/ 
 
The information contained in this e-mail is confidential and may also be subject to legal privilege. It is intended only for the recipient(s) named above. If you are not named above as a recipient, you must not read, copy, disclose, forward or otherwise use the information contained in this email. If you have received this e-mail in error, please notify the sender (whose contact details are above) immediately by reply e-mail and delete the message and any attachments without retaining any copies.

_______________________________________________
enum mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/enum

---

From: "Richard Shockey" <[email-masked]>
Date: Fri, 5 Jan 2007 08:46:11 -0500

The simple truth is you don't need to put I-ENUM in the public DNS and I
still can't understand why anyone would.

Carrier Interconnection is a function of trusted Registry Infrastructures
and the Policies associated with those Registries not the access method to
the data.

This IMHO this news out of the UK actually good news, hopefully it will
bring some folks to their senses especially about that bizarre CREW idea
floating around over there.

> From: Rosbotham, Paul [mailto:[email-masked]]
> Sent: Friday, January 05, 2007 7:02 AM
> To: [email-masked]
> Subject: RE: [Enum] NITS review of draft-ietf-enum-infrastructure-03
> 
> OK, I've been trying to keep out of this but I guess I should step in and
> clarify, given it was me who had the meeting with the UK Information
> Commissioner's Office.
> 
> They had I-ENUM explained to them and expressed reservations.
> Reservations, not outright written legal objections...they were asked to
> give an informal opinion and personally I welcome that they did so.
> Laurence is correct, however, that there is no formal position.
Similarly,
> Clive is also correct to mention that there may be issues.
> 
> I am not a lawyer, so apologies if any of this is garbled.  The basic view
> was that although a telephone number in itself is not personal data, via
> the concept of "linked datasets", it can be combined with other databases
> to produce things which represent privacy concerns under EU legislation.
> In particular, when linked with a telephone directory, it would allow the
> tying together of an individual and their telephone provider, which could
> be considered as personal data.  In putting their number into a telephony
> directory, the end user consented to that information being published, not
> for it to be possible to determine their choice of supplier.  It's this
> "linked datasets" consideration which leads to the rules around CLI
> transmission...the CLI isn't personal data but when linked to other data
> it becomes so : therefore if the customer wishes to withhold their CLI
> they can do so, and this is independent of whether they choose to be
> listed in a directory.  The fact that some numbers relate to corporate
> entities is irrelevant...many belong to an individual.
> 
> In terms of the position elsewhere in the EU, I wouldn't comment.  There
> isn't a formal position in the UK, just an informal reservation.  My
> experience on other issues relating to information privacy is that
> although the EU Directive may be pan-European, interpretation of it is
not.
> The UK tends to take a middle line, with some countries being more
liberal,
> others more conservative.  I would query whether in the Austrian case
> approval was given by the telecoms regulator, or the information privacy
> regulator...these are typically not the same.  However, if the Austrian
> information commissioner has given consent, well they know far more about
> Austrian legislation than I do so I wouldn't query that.
> 
> If the current informal position did harden into a formal one, then the
> conclusion IMHO is that it could be difficult to put i-ENUM in public DNS.
> This doesn't mean that CPs in other jurisdictions couldn't adopt that
> approach, but I have to act within my national law.
> 
> As to the opinions of others who assert that the UK Information
> Commissioner is wrong, well you're welcome to these opinions, but you'll
> forgive me if I listen to the UK regulator when determining whether I'm
> compliant with legislation, rather than someone's opinion on a mailing
> list...
> 
> Regards
> 
> Paul Rosbotham
> This e-mail has been scanned for viruses by the Cable & Wireless e-mail
> security system - powered by MessageLabs. For more information on a
> proactive managed e-mail security service,  visit
> http://www.cw.com/uk/emailprotection/
> 
> The information contained in this e-mail is confidential and may also be
> subject to legal privilege. It is intended only for the recipient(s) named
> above. If you are not named above as a recipient, you must not read, copy,
> disclose, forward or otherwise use the information contained in this
email.
> If you have received this e-mail in error, please notify the sender (whose
> contact details are above) immediately by reply e-mail and delete the
> message and any attachments without retaining any copies.
>

---

From: Otmar Lendl <[email-masked]>
Date: Fri, 5 Jan 2007 16:12:33 +0100

> still can't understand why anyone would.

Oh, you don't need to have it in the public DNS.

That is, if you want to build a closed system for a single
administrative domain (e.g. a country). Within that country you can
decide who is a legitimate carrier, you can do access control on 
the DNS and as much legal hand-binding as you want.

Such a system was fine for the 20th century with neatly defined
and non-overlapping markets. 

It just breaks down if you take into account the state of networking
in the 21th century.

Do you want us to open the Austrian I-ENUM to every single small VoIP
carrier worldwide? If yes, what is then the real difference (other than
another charging point) to just using the public DNS?

You're replicating the PSTN trust model ("Trust all carriers").  Haven't
you noticed that this is breaking down left and right as the global SS7
network extends to locations which don't give a $#$%$% what the FCC or
the EU regulations dictate. For all I know, the PSTN guys are scrambling
to patch up their security model as they discovered that they can't just
trust all SS7 messages any more.

Once you distribute a "secret" widely, that information won't stay
secret. So why bother with this security by obscurity?

On the other hand, if we restrict access to the Austrian I-ENUM to local
carriers, then how is e.g. a German carrier supposed to select the
correct Austrian carrier which is probably present at a carrier hotel /
peering fabric in Frankfurt anyway? There is no technological need to
use special "transit carriers" for intra-european calls.

The sheer size of the NANP may skew your perception. Just try to imagine
that each US State were its own country with each own FCC and thus carrier
accredidation procedure. Now try to design a system for this scenario.

> and the Policies associated with those Registries not the access method to

I never understood why the Policies have to be associated with
Registries and not with Carriers themselves (other than the bottom
line of Registries).

> floating around over there.

No comment on this, I defer to Jim.

/ol

---

From: "Stastny Richard" <[email-masked]>
Date: Fri, 5 Jan 2007 16:31:45 +0100

This may work in the US with two carriers and one registry (Neustar)
International calls are done anyway via Skype.
 
It does not work in Europe - and it would also not work in the US
with 100 carriers and 50 registries as Otmar says.
 
BTW: Interconnction is done via sip URIs (Speermint) and not ENUM
 
Richard
PS: Paul, your UK Information Commission arguments are
very similar to the discussion on how many angels may dance on a pin
 
Otmars mentioning about mobile phones kills this argument anyway

________________________________

Von: Richard Shockey [mailto:[email-masked]]
Gesendet: Fr 05.01.2007 14:46
An: 'Rosbotham, Paul'; [email-masked]
Betreff: RE: [Enum] NITS review of draft-ietf-enum-infrastructure-03

Similarly,
not.
liberal,
email.

---

From: "Richard Shockey" <[email-masked]>
Date: Fri, 5 Jan 2007 11:14:39 -0500

> Sent: Friday, January 05, 2007 10:13 AM
> To: [email-masked]

But so long as nation-states continue to define who is or who is not a
carrier you will run into this. I am finally trying to deal with the world
as it is not what I think is should be.

> It just breaks down if you take into account the state of networking

No if it aint broke don't fix it. Its not about the DNS it's about data
exchanges. 

> carrier worldwide? 

No actually ...

If yes, what is then the real difference (other than
> You're replicating the PSTN trust model ("Trust all carriers"). 

Well if I'm a carrier I'm in a good position to define who I can trust and
why that does not mean I have to trust all carriers.

 Haven't
> secret. So why bother with this security by obscurity?

Some security is better than none which is what we have with the DNS.

> peering fabric in Frankfurt anyway? 

Have you heard of by-lateral agreements?

There is no technological need to
> use special "transit carriers" for intra-european calls.

Of course not but carrier interconnection and network peering even for IP is
all bilateral. I cannot peer with BT's IP backbone unless I can negotiate an
agreement with BT. That bilateral agreement ultimately becomes expressed as
my policy in by BGP tables.

Everything else is transit.

> accredidation procedure. Now try to design a system for this scenario.

The ITU? 

> Registries and not with Carriers themselves (other than the bottom

Well Carrier policy is expressed in how the registry data is used and the
common agreement between registry registrars on who can modify the registry.

---

From: [email-masked]
Date: Fri, 5 Jan 2007 17:25:50 -0500

From: "Richard Shockey" <[email-masked]>

But it can get complicated, and the complications can change fairly
quickly.  As you say, nation-states define who is a carrier and can
join the club.  But at least in the US, we're just one election from a
change in policy -- what if the FCC suddenly decides to "level the
playing field" between Verizon and Mom & Pop?  A shift in attitude
could change the set of carriers from a dozen or two to thousands.
And worse, members could join or leave the set quickly.

We at least need an architecture that won't fail under such a change.

Dale

---

From: "Stastny Richard" <[email-masked]>
Date: Sat, 6 Jan 2007 00:19:00 +0100

>We at least need an architecture that won't fail under such a change.

Thank you, Dale
 
Nobody prevents carriers to make private clubs, and they do already,
but any club can only serve a subset of subscribers

So we also need an option to include all subscribers, either direct or
indirect, e.g. draft-stastny-enum-ern-01.txt
 
Richard

Von: [email-masked] [mailto:[email-masked]]
Gesendet: Fr 05.01.2007 23:25
An: [email-masked]
Betreff: Re: [Enum] NITS review of draft-ietf-enum-infrastructure-03

Dale

---

From: Otmar Lendl <[email-masked]>
Date: Mon, 8 Jan 2007 15:41:49 +0100

On 2007/01/05 17:01, Richard Shockey <[email-masked]> wrote:
> carrier you will run into this. 

For the write permission: Yes. 

To add numbers to I-ENUM you first have to get numbers assigned to
you in the first place. There are established procedures for that
in all jurisdictions, thus there is no need to invent new rules and
regulations. So that base is covered.

A carrier only has numbers from countries where he operates, is
accredited with the NRA, and thus can deal with local rules.

For the read permissions: No.

A subscriber can dial any international number he pleases. His carrier
has to route calls to countries where he is *not* an accredited carrier.
Maybe he has a peering relationship with the destination network. How
is he going to find out?

> I am finally trying to deal with the world

You're not dealing with the world. You're dealing with individual
countries.

[...]
> why that does not mean I have to trust all carriers.

Correct: You as the carrier want to decide whom to trust and thus from
whom to accept calls.

That's quite orthogonal to "who is allowed to see information about
numbers".

Is the carrier going to decide with whom he will to peer or will some
mandate concerning the availability of information restrict his choices?

> Some security is better than none which is what we have with the DNS.

Yes, that will work out just as great as the idea of using social
security numbers as authentication tokens. Just restrict that
information to "authorized entities" and you have a decent system.

Indeed.

> Have you heard of by-lateral agreements?

... which transfers that oh-so-secret information about who owns which 
numbers to an entity which is not bound by the NRA's privacy regulation. 
Sure, you try to fold them into the bi-lateral agreement. Good luck on
enforcing these when that routing information get re-injected in foreign
minute-reselling markets.

What if that a peering possible based on a mutually trusted TLS cert?

> my policy in by BGP tables.

I wrote: "technological need". You wrote: "negotiate an agreement".
These are different facets of the peering problem space.

This is the crux of the matter: 

VoIP peering need not be about stringing a wire, but about establishing
a trust relationship. The distribution of number ownership tables 
isn't the crucial part of this.

(And we should be careful about BGP analogies. cf TRIP, RIR routing
registries, RIR IP assignement DBs, contract-less peering, ...)

> > accreditation procedure. Now try to design a system for this scenario.
> 
> The ITU? 

Hu?

The ITU is a VoIP Peering System?

The ITU will distribute Number->URI mappings to all carriers?

The ITU will determine whether someone is a legitimate carrier and thus
eligible to receive I-ENUM data?

/ol