Re: [rtcweb] RTCWEB and emergency services

[Bernard Aboba <[e-mail]>]

Ted Hardie said: 


"Speaking personally, I don't think that is the right model.  I can see an emergency service provider providing an RTCWeb service as part of its efforts, just as it may accept IMs, text messages, and other non-traditional communications.  But assuming that any provider of an RTCWeb application must provide a method to reach emergency services does not make sense to me. "

[BA] I believe that is what I said in my original message.  The obligations of the RTCWeb application will depend on what it is doing, as well as the country/state and possibly the device it is running on.   Some applications (e.g. realtime enablement of a game or social network) may not have an emergency service obligation.  Others (such as service enabling phone calls to and from the PSTN) may have such an obligation.  YMMV.  

An emergency service provider or PSAP could also use RTCWeb as part of their efforts, of course.   Dispatcher workstations often do support browsers, although the sites that can be accessed may be controlled for security reasons.  That is definitely worth mentioning. 

Ted Hardie also said: 

"Downloaded javascript from a system presumed to be malicious is not how you want to make your 911/112 calls."

[BA] Indeed, this does raise potential issues, given concerns over attacks such as "swatting".   Currently this kind of attack isn't covered in the RTCWEB security document.  In addition to the malicious Javascript concern, there is experience with SIM-less calls, for example, which indicates that lack of authentication tends to lead to an increase in prank calls.  


Ted Hardie said:

"Can the poker site require that emergency services folks have a login to its system in monitor state in order to provide this service?"

[BA] I'm not aware of any jurisdiction which currently imposes an emergency services obligation on an online game.  Is this a real use case?

Ted Hardie said:

"Despite our re-use, it is vitally important to remember that these applications are not phones."

[BA] We've already seen a demo of a handset utilizing RTCWEB technology.   However, just because some applications *are* phones doesn't imply that *all* RTCWeb applications will have emergency service obligations, that an RTCWeb-enabled browser needs to natively support every potential emergency service scenario, or even that RTCWeb needs to handle all the obligations that do arise.   After all, many of the major issues in emergency services (like location determination) don't have that much to do with RTCWeb, and there are other APIs (such as the Mozilla WebAPI proposal) that could provide emergency services functionality based on the underlying telephony platform, distinct from RTCWeb.

Ted Hardie said:


"If you must describe in the terms of telephony, please circumscribe your terms--"For RTCWeb applications intended to provide telephony services, the following considerations apply...."  

[BA] I would prefer not to give advice as to what applications do and do not have emergency service obligations.  Given some of the proceedings now in progress that is a complex subject and I'm not a lawyer.  But we can say "For those RTCWeb applications that have emergency services obligations, the following considerations apply.... "  leaving it up to the reader (and their lawyer) to parse through the existing and future regulations to figure out what their obligations might be.