Re: [Ecrit] AD review: draft-ietf-ecrit-additional-data-29

[Alissa Cooper <[e-mail]>]

Hi Randy,

Thanks for addressing my comments. I have one follow-up below.

On Jun 28, 2015, at 6:53 PM, Randall Gellens <[e-mail]> wrote:

>> 
>> Section 4.3.4:
>> I'm curious about the kinds of "investigations" 
>> that PSAPs do and how they have used unique 
>> device IDs in those investigations -- could you 
>> explain? At first blush this seems to require 
>> over-sharing of sensitive data.
> 
> The most common situation that I'm aware of is 
> repeated false/accidental calls.  If there is no 
> callback number or it isn't usable, the PSAP may 
> need to try and track down the device by 
> contacting the service providers in the area.  In 
> the case of handsets without current service, 
> they may be able to determine who last had 
> service.  

How does the user make an emergency call without current service?

> There could be other situations where 
> this might be useful (e.g., a disconnected call 
> where the call taker believes there is a need for 
> assistance but was not able to obtain a location 
> or other information).

It would be helpful if the above explanation could be included in the draft.

Given the explanation above, does it really make sense for the device to be providing this information in addition to the service provider? That is, the device may have many possible device IDs that it could include, but it may not know which ones the service provider collects and correlates to specific users, so it won’t necessarily know which ones to provide. Given that all of these IDs can be uniquely identifying in different contexts, providing multiple IDs that won’t get used seems like not the best idea. And if the user is abusing the emergency call system, he won’t include these anyway.

Are we sure that all of the device types specified actually get used in this way by PSAPs? E.g., I was curious about whether service providers track device RFIDs.

I also think, as much as I dislike the subscriber privacy indicator specified in 4.4.1, it should cover this data element as well, particularly since this element can be inserted by the service provider without the user knowing.

Thanks,
Alissa