Re: [ietf-privacy] Research Note on NSA/Snowden for EuroParl PRISM inquiry

[Stephen Farrell <[e-mail]>]

Hiya,

On 09/29/2013 06:11 PM, Caspar Bowden wrote:
> On 09/29/13 15:33, Stephen Farrell wrote:
>> I've only skimmed the recommnedations/conclusions so far but have
>> two comments. (I'll read the rest later, honest:-)
> 
> thanks for feedback
> 
>> - I don't see why a "euro cloud" (section 3.1) would be any less
>> surveilled, e.g. by .eu governments on their own behalf of on behalf
>> of their partners.
> 
> There's two reasons
> 
> 1) most people in a democracy prefer to be spied on by their own govts.
> not a foreign govt (rather not be spied on at all obviously)

Eh... not convinced by that one. Most people have a pretty low opinion
of their own government - familiarity, comtempt and all that:-)

> 
> 2) the "political" purposes in the defn. of FII I point at would be
> illegal in EU (they don't exist in corresponding EU laws, and the
> Belgacom/GCHQ case will be a real test case on this point). The fact is
> that it is not illegal (in US) for the US to do that to (say) Belgium,
> but is it is illegal for one European state to do that to another
> (political spying rather than "genuine" national security)
> 
> This is an incredibly important point which I still not think is widely
> understood (especially by people in US)
> 
>> There could be jusrisdictional reasons for that
>> maybe (not that I'd understand those) but I don't think such a
>> recommendation really touches on pervasive monitoring at all unless
>> you're under the misaprehension that .eu governments are all far too
>> nice for that kind of thing or something. Can you explain that one?
> 
> It is "niceness" actually, to the extent European human rights law
> prohibits this (really, it does)
> 
> If they do it, they are breaking the law (ECHR)

So the benefit of a euro-cloud would be that it'd maybe (yes, Belgacom
will be mighty interesting) de-motiviate other EU govts from surveilling
EU citizens via data in that cloud. Isn't that making the same error
that your document rightly says the US are making in considering only
the rights of US citizens?

So fwiw, I'm not at all keen on that recommendation. Note that I only
mean I disagree with the recommendation for this purpose, there are
probably lots of other good reasons why locally provided services are
a good thing. (Actually, I'd like this to go towards its logical
conclusion that everyone have their own server box in their home,
and that all "cloudy" businesses have to deal with that. But that's
some way off;-)

>> - I think you could add a recommendation to work with the Internet
>> community on better technical solutions that can perhaps dramatically
>> increase the costs for pervasive monitoring.
> 
> I agree but it;s hard to put that in legislation ? ("work with the
> Internet community"). Best I could get was the free-software recommendation

I don't see any reason why legislation couldn't say "work with
the Internet community." Maybe that's because I'm ignorant of
how to write legislation (which is the case).

So while I don't know much about what makes good legislation, I do
know that the reality of making widely-deployed Internet protocols
more privacy friendly is that such work is most likely to be
formalised here in the IETF if at all. Getting that message over
to legislators would be good, even if no legislation resulted.
(But again, the IETF cannot "solve" the problem and its important
to say that too.)

In terms of what else legislation might say, one could imagine
some well crafted law saying that services have to do their best,
and that governments and e.g. EU research funding should work with
those who can have most impact on that.

>> That's not a purely
>> cryptographic thing, and is something on which work is being done
>> e.g. here in the IETF. Note, nobody's claiming that changes made in
>> the IETF can fully "fix" this problem, but there are things we can
>> do that can help if they get deployed.
>>
>> BTW, I think it'd be useful for us as well if the IETF had a way
>> to learn more about the non-technical reactions to all this stuff,
>> any ideas there welcome.
> 
> Happy to help with that any way I can

Ditto. Let's keep that in mind.

S.


> 
> Caspar
> 
>