Subject: Re: [Enum] NITS review of draft-ietf-enum-infrastructure-03

From: "Lupton, Ronan" <[email-masked]>
Date: Tue, 2 Jan 2007 19:03:22 -0000

Clive, are we dealing with an actual Internet versus Telco logic problem
here?

I'd tend to agree with Lawrence and also his comments re: formal statement
on subject in writing. I didn't spot anything in the DTI response from the
Commission on UK ENUM in general.

Ronan

-----Original Message-----
From: Michael Hammer (mhammer) <[email-masked]>
To: Clive D.W. Feather <[email-masked]>; Livingood, Jason
<[email-masked]>
CC: [email-masked] <[email-masked]>; [email-masked]
<[email-masked]>
Sent: Tue Jan 02 18:44:47 2007
Subject: RE: [Enum] NITS review of draft-ietf-enum-infrastructure-03

Clive,

I see no user at all here:

 sip:<e164_phone_number>@provider.example.net

Thus, PII is not an issue.

Mike

> -----Original Message-----
> From: Clive D.W. Feather [mailto:[email-masked]] 
> Sent: Tuesday, January 02, 2007 6:14 AM
> To: Livingood, Jason
> Cc: [email-masked]; [email-masked]
> Subject: Re: [Enum] NITS review of draft-ietf-enum-infrastructure-03
> 
> Livingood, Jason said:
> > Attached is the new -04 draft, which was just submitted to 
> the editor.
> [...]
> 
> > 5. Security and Privacy Considerations
> >     
> >    Since Infrastructure ENUM is also implemented on the 
> public Internet, 
> >    the same security considerations apply as noted in RFC 3761. 
> >      
> >    In addition, since there is no opt-in for end-users, personally-
> >    identifiable information (PII) must not be disclosed for any end-
> >    user.  
> >     
> >    Thus, the information provided in the NAPTR records must 
> not disclose 
> >    any PII about the end-user such as a name in user-info. 
> This can be 
> >    achieved, for example, by entering the information in the format 
> >    sip:<e164_phone_number>@provider.example.net,  
> >    mailto:<e164_phone_number>@provider.example.net or sip:<opaque 
> >    string>@provider.example.net. 
> 
> The UK's Office of the Information Commissioner have stated 
> that the identity of the provider used by a user *is* PII in 
> this context.
> 
> -- 
> Clive D.W. Feather  | Work:  <[email-masked]>   | Tel:    
> +44 20 8495 6138
> Internet Expert     | Home:  <[email-masked]>  | Fax:    
> +44 870 051 9937
> Demon Internet      | WWW: http://www.davros.org | Mobile: 
> +44 7973 377646
> THUS plc            |                            |
> 
> _______________________________________________
> enum mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/enum
> 

_______________________________________________
enum mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/enum
_______________________________________________
enum mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/enum

---

From: "Lupton, Ronan" <[email-masked]>
Date: Thu, 4 Jan 2007 22:45:43 -0000

Andrew,

This is not the case at all and I believe we've been around these issues
enough already overtime.

Clive, what exactly are you getting at? There are Data Protection provisions
in place in most member states to sufficiently protect User/s privacy.

Ronan

-----Original Message-----
From: Andrew Newton <[email-masked]>
To: Michael Hammer "((mhammer)) <[email-masked]>
CC: [email-masked] <[email-masked]>; Livingood, Jason
<[email-masked]>; Clive D.W. Feather <[email-masked]>;
[email-masked] <[email-masked]>
Sent: Thu Jan 04 22:19:15 2007
Subject: Re: [Enum] NITS review of draft-ietf-enum-infrastructure-03

On Jan 4, 2007, at 12:29 PM, Michael Hammer ((mhammer)) wrote:

If I publish +44* meaning all combinations of E.164 phone numbers

assigned to UK, have I just now violated that Act?

Using this Act as an excuse to preserve anti-competitive practices

(keeping call routing information limited to a small closed club) is not

in the public interest and not likely to hold up under scrutiny IMHO.

I tend to agree.  This is getting silly.  An E.164 might identify a person,
but it just as likely is the phone number for the front desk, a pay
telephone, or a fax machine.  Perhaps we should change the language to:

In addition, since there is an unknown probability that any part of the URI
might in some theoretical way identify an actual person, care should be
taken to consult the over-reaching and/or out-dated laws and regulations of
the appropriate governing and oppressive regimes.

-andy

---

From: Peter Williams <[email-masked]>
Date: Fri, 5 Jan 2007 08:11:08 -0800

> Richard> PS: Paul, your UK Information Commission arguments are> very similar to the discussion on how many angels may dance on a pin> > Otmars mentioning about mobile phones kills this argument anyway
I'm not so sure about these angles on the pinhead where each angel espies the world from its facet for a living, unseen, covert, only sometimes visible: not quite among us but scheming nonetheless to organize the pins just so, the facets at just the right angle.
 
Several trends are going on. Layer 2 switching is doing much of what IPv6 was supposed to have done. Stacked switches and tunneling is making often making IP routing meaningless. LANs, MANs and PANs are evolving according to their own convergence dynamics. TLS and its handshakes are doing what IPSEC/ISAKMP were supposed to have done. WS-Security stack is doing what the upper layer OSI stack was supposed to have done. All these are attacking the concept of the Network OS, that propelled Internet adoption - and necessarily stymied other ways of thinking about technology adoption in secure global networking.
 
On the other hand, voip family is so much more effective than H323 gateways, particular in repurposing legacy local loops. But again, we see layer 2 switching and vlans impacting IP, particular in mobile IP where a channel, a port, a vlan, a fragment, and a nic have already converged into the same thing, given 802.1x. In the wired world, we see the BRI D channel coming back into vogue, enabling voice and ethernet termination convergence even in the US as streaming QOS begins to issue demands for tv (on no!, Milo Medin was right all along!). In ENUM we obviously see the E.164 number as a switching/routable address, again. Stripped from .arpa, the role of the DNS as an IP/ICMP technology is not as obviously necessary for the resolution process as it was: it may be the fallback when nothing better exists beyond ARPA control.
 
The privacy principles relevant to the convergence of telephone and IP are by no means clear. Much of US internet thinking is set in stone: the past of data vs voice, VANs vs telcos, backbone vs P2P, packet surveillance vs traditional voice wiretapping, security vs privacy. But swords are pulled from stones, as lots of 5 years olds know.
_________________________________________________________________
Type your favorite song.  Get a customized station.  Try MSN Radio powered by Pandora.
http://radio.msn.com

---

From: "Stastny Richard" <[email-masked]>
Date: Fri, 5 Jan 2007 17:27:13 +0100

>>Otmars mentioning about mobile phones kills this argument anyway

>Not here it doesn't.  MNP means you don't know the carrier from the number range.  
>For ported numbers, you're charged according to the number range (ie rangeholder rate), not the individual number (ie termination rate).

You are turning around cause and effect.
Nobody discussed privacy issues in choosing the charging

Richard

---

From: "Michael Hammer \(mhammer\)" <[email-masked]>
Date: Fri, 5 Jan 2007 20:20:37 -0500

Paul,

I certainly understand the need to follow policy and regulations of
one's nation-state.  However, those who make the laws need to understand
the resulting implications.

I understand that in "connecting the dots" one can arrive at a
conclusion that reveals information associated with a person.  But, if
you take that to its logical conclusion, no information of any kind
should ever be shared with anyone.  The key is to keep the focus on the
correct associations to protect; namely, the immediate ones tied to a
real human identity.  It is that last link to the person that makes the
revelation, not all the associations twenty steps removed.

It is the unintended consequences of application of rules with blinders
on that concern me.  The numbering and routing is crucial to the
functioning of the telephone network.  Restrictions on the sharing of
what number is served by what service provider can hamper the efficient
operation of the network and lead to designs that are anti-competitive.
And as has been pointed out, hiding certain associations is a lost
cause, unless you want to revoke number portability.

We need to design with 21 century thinking, not 20th century, with
respect to both regulation and technology.

Mike

> From: Rosbotham, Paul [mailto:[email-masked]] 
> Sent: Friday, January 05, 2007 7:02 AM
> To: [email-masked]
> OK, I've been trying to keep out of this but I guess I should 
> step in and clarify, given it was me who had the meeting with 
> the UK Information Commissioner's Office.
> 
> They had I-ENUM explained to them and expressed reservations. 
>  Reservations, not outright written legal objections...they 
> were asked to give an informal opinion and personally I 
> welcome that they did so.  Laurence is correct, however, that 
> there is no formal position.  Similarly, Clive is also 
> correct to mention that there may be issues.  
> 
> I am not a lawyer, so apologies if any of this is garbled.  
> The basic view was that although a telephone number in itself 
> is not personal data, via the concept of "linked datasets", 
> it can be combined with other databases to produce things 
> which represent privacy concerns under EU legislation.  In 
> particular, when linked with a telephone directory, it would 
> allow the tying together of an individual and their telephone 
> provider, which could be considered as personal data.  In 
> putting their number into a telephony directory, the end user 
> consented to that information being published, not for it to 
> be possible to determine their choice of supplier.  It's this 
> "linked datasets" consideration which leads to the rules 
> around CLI transmission...the CLI isn't personal data but 
> when linked to other data it becomes so : therefore if the 
> customer wishes to withhold their CLI they can do so, and 
> this is independent of whether they choose to be listed in a 
> directory.  The fact that some numbers relate to corporate 
> entities is irrelevant...many belong to an individual.
> 
> In terms of the position elsewhere in the EU, I wouldn't 
> comment.  There isn't a formal position in the UK, just an 
> informal reservation.  My experience on other issues relating 
> to information privacy is that although the EU Directive may 
> be pan-European, interpretation of it is not.  The UK tends 
> to take a middle line, with some countries being more 
> liberal, others more conservative.  I would query whether in 
> the Austrian case approval was given by the telecoms 
> regulator, or the information privacy regulator...these are 
> typically not the same.  However, if the Austrian information 
> commissioner has given consent, well they know far more about 
> Austrian legislation than I do so I wouldn't query that.
> 
> If the current informal position did harden into a formal 
> one, then the conclusion IMHO is that it could be difficult 
> to put i-ENUM in public DNS.  This doesn't mean that CPs in 
> other jurisdictions couldn't adopt that approach, but I have 
> to act within my national law.
> 
> As to the opinions of others who assert that the UK 
> Information Commissioner is wrong, well you're welcome to 
> these opinions, but you'll forgive me if I listen to the UK 
> regulator when determining whether I'm compliant with 
> legislation, rather than someone's opinion on a mailing list...
> 
> Regards
> 
> Paul Rosbotham
> Manager, Interconnect Strategy & Technology Regulation Cable 
> & Wireless www.cw.com
> 
> 
> 
> From: Otmar Lendl [mailto:[email-masked]]
> Sent: 05 January 2007 11:37
> To: [email-masked]
> On 2007/01/04 17:01, "Clive D.W. Feather" <[email-masked]> wrote:
> > lconroy said:
> > 
> > > If any NRA or equivalent data protection authority 
> refused to permit 
> > > a necessary part of SIP URLs to be published, then doing so would 
> > > make VoIP in general rather hard. An originating system has to be 
> > > able to "find" the destination SIP provider or it isn't going to 
> > > work. I hear rumours, but I can't believe anyone intends 
> to block VoIP in this way.
> > 
> > There's a difference between User (opt-in) and Infrastructure 
> > (everyone is
> > included) Enum in this context. I'm referring to 
> Infrastructure Enum only.
> 
> I'm not sure whether the suggested legal problems stem from 
> EU law or national .uk one. In any case, you might be 
> interested to hear that the Austrian NRA (RTR GmbH) happily 
> signed a contract with us designating us to run an 
> infrastructure ENUM trial in the *public* DNS.
> 
> Whether that's just because we Austrians tend to be creative 
> in the interpretation of EU regulations or whether there is 
> really no problem there, I can't tell.
> 
> But it's a fact that we run an officially sanctioned I-ENUM 
> trial here in an EU member state.
> 
> /ol
> --
> < Otmar Lendl ([email-masked]) | nic.at Systems Engineer >
> 
> This e-mail has been scanned for viruses by the Cable & 
> Wireless e-mail security system - powered by MessageLabs. For 
> more information on a proactive managed e-mail security 
> service,  visit http://www.cw.com/uk/emailprotection/ 
>  
> The information contained in this e-mail is confidential and 
> may also be subject to legal privilege. It is intended only 
> for the recipient(s) named above. If you are not named above 
> as a recipient, you must not read, copy, disclose, forward or 
> otherwise use the information contained in this email. If you 
> have received this e-mail in error, please notify the sender 
> (whose contact details are above) immediately by reply e-mail 
> and delete the message and any attachments without retaining 
> any copies.
>