Re: [Int-area] Logging Recommendations for Internet-Facing Servers

[Suresh Krishnan <[e-mail]>]

Hi Scott,
(with Chair hat on)

On 06/17/2014 10:36 AM, SHEPPARD, SCOTT wrote:
> Folks
>
> To close this for now.
>
> I see no compelling reason to change the BCP RFC 6302.

Thanks for providing your opinion. I think opinions from operators are 
extremely useful and helpful.

>
> Privacy is important. But equally so is the need to protect our customers, ourselves and the population against cyber criminals and they are legion. There is a compelling need for Law Enforcement Agencies and Governments to know some information about traffic as it relates to criminal and military acts (state sponsored cyber espionage etc.,). It is up to the civil authorities to define what is "acceptable reach" for the above agencies actions. It is up to us as citizens to then hold the civil authorities accountable at least in the US.
>
> This is far beyond an IETF discussion.

I think there is a delicate balance between protecting the users' 
privacy and implementing the operators' requirements for traceability. 
If by "far beyond an IETF discussion" you mean that recommendations from 
the IETF are only one consideration among many for real life 
deployments, I fully agree with you. But what the IETF publishes as a 
BCP is within the purview of the IETF, and it is entirely reasonable for 
people to initiate discussion on whether the recommendations in RFC6302 
are current in light of RFC7258.

Thanks
Suresh