Subject: [ipfix-eval] Question regarding Wiretapping

From: <[email-masked]>
Date: Fri, 31 Jan 2003 10:42:23 -0500

Greetings,

I have a  general question, Hope to get an answer you people. 

For network management purposes, the network element may duplicate the user traffic (packet ) and forwards towards the 
management application. This may be considered as wiretapping and not legal in some countries. 

RFC 2804 describes what is wiretapping etc. Does that mean that user needs to be informed about fields are going 
to collected etc.... is there any technical solution for it.

Regards
Ramg

--
Help        mailto:[email-masked] and say "help" in message body
Unsubscribe mailto:[email-masked] and say
"unsubscribe ipfix" in message body
Archive     http://ipfix.doit.wisc.edu/archive/

---

From: "Carter Bullard" <[email-masked]>
Date: Fri, 31 Jan 2003 12:03:41 -0500

Hey Ramg,
   My understanding is that with regard to the U.S.
federal voice wiretapping laws there are no restrictions
to collecting network traffic by the service provider.
The U.S. wiretapping laws simple define the conditions
where carriers must disclose collected information to
Law Enforcement.

   There are various state and federal privacy laws that
restrict the disclosure of private information by service
providers, but none of these laws restrict a service
providers ability to collect information for operations
management purposes.

   This is my simple understanding.

Carter

> -----Original Message-----
> From: majordomo listserver 
> [mailto:[email-masked]] On Behalf Of [email-masked]
> Sent: Friday, January 31, 2003 10:42 AM
> To: [email-masked]; [email-masked]
> Cc: [email-masked]; [email-masked]; 
> [email-masked]
> Subject: [ipfix-eval] Question regarding Wiretapping
> 
> 
> Greetings,
> 
> For network management purposes, the network element may 
> duplicate the user traffic (packet ) and forwards towards the 
> RFC 2804 describes what is wiretapping etc. Does that mean 
> that user needs to be informed about fields are going

---

From: "MEYER,JEFFREY D (HP-Cupertino,ex1)" <[email-masked]>
Date: Fri, 31 Jan 2003 12:59:58 -0500

Hi,

  I view the current information model defined by IPFIX 
as being the equivalent of "call logs".  I.e. it shows when
and who I spoke to, but doesn't divulge any information
about the content of the conversation.

  So, in the sense the the phone company records all this
info and needs/uses it for billing, I view as being an
analogous case in the IP world, using IPFix or other 
usage recording methodologies.

  Wiretapping, actually monitoring the contents of the
conversation is not something which IPFIX has in its 
information model (as far I am aware).

  So my take is that the IPFIX information is equivalent
to information which is always recorded in the PSTN
world.  Now from a privacy perspective, who you divulge
call logs to has broad legal repurcussions, but that is
a separate topic.

Regards,

  Jeff Meyer

> From: [email-masked] [mailto:[email-masked]]
> Sent: Friday, January 31, 2003 7:42 AM

---

From: "Carter Bullard" <[email-masked]>
Date: Fri, 31 Jan 2003 17:39:34 -0500

Hey Tal,
   Based on the official position of the IETF and
Internet Society to not describe technology that
supports wiretapping (raven), I wouldn't recommend that
IPFIX pursue it.  I was just trying to answer Ramg's
question.

   I suspect that the 5 applications mentioned
in section 3 don't really qualify as classes of
applications.  Network Management is formal class
of application.  While Security Management, which
is a logical subset of Network Management, may
be considered a class of application, Attack/Intrusion
detection is a specific Security Management
application, not a class.

Carter

> From: Tal Givoly [mailto:[email-masked]] 
> Sent: Friday, January 31, 2003 3:59 PM
> To: Carter Bullard; 'MEYER,JEFFREY D (HP-Cupertino,ex1)'; 
> [email-masked]; [email-masked]; [email-masked]
> Subject: RE: [ipfix-eval] Question regarding Wiretapping
> 
> 
> Hi,
> 
> Getting back to the requirements, which of the 5 classes of 
> applications
> discussed in section 3 of the requirements (Usage-based 
> accounting, Traffic
> Profiling, Traffic Engineering, Attack/intrusion detection, 
> QoS monitoring),
> would wiretapping or lawful interception in any form be classified as?
> 
> Is it the intent that IPFIX protocol support these applications?
> 
> Tal
> 
> [mailto:[email-masked]]On Behalf
> Of Carter Bullard
> To: 'MEYER,JEFFREY D (HP-Cupertino,ex1)'; [email-masked];
> [email-masked]; [email-masked]
> Subject: RE: [ipfix-eval] Question regarding Wiretapping
> 
> 
> Hey Jeff,
>    Just for completeness, the US wiretapping laws cover
> three types of wiretaps, Pen Register, Trap and Trace
> and Content surveillance.  Flow data can easily support
> all three types, but the simple flow model described
> in IPFIX should be able to support Pen Register, which
> generally provides calling and called party identifiers.
> It could also provide some of the Trap and Trace data,
> which looks alot like general PSTN billing data, but is
> provided in real time.
> 
>    There are standards for the format and transport of
> the data which collectively are referred to as the J-STD.
> IPFIX could conceivably meet J-STD transport requirements.
> 
> Carter
> 
> 
> 
> > [mailto:[email-masked]] On Behalf Of
> > MEYER,JEFFREY D (HP-Cupertino,ex1)
> > Sent: Friday, January 31, 2003 1:00 PM
> > To: [email-masked]'; [email-masked];
> > [email-masked]
> > Subject: RE: [ipfix-eval] Question regarding Wiretapping
> >
> >
> > Hi,
> >
> Help        mailto:[email-masked] and say "help" 
> in message
> body