Re: [sipcore] How to signal that a conversation is being recorded

The only legal constraints I know (and IANAL) is the requirement to tell the other party that you are recording.

I do understand the issue of a malicious actor in the middle of the path.  My use case wouldn’t have that problem, but the general case would.  I suspect that we would note that in the security considerations and suggest that the recording entity insert the indications in the media if they are worried about that threat.  Real fixes would be messy: round-trip with some material only known to the endpoint?  Something like a digital signature with a cert known by the originator as the identity of the recipient?

Brian

> On Mar 6, 2023, at 10:05 PM, Paul Kyzivat <paul.kyzivat@comcast.net> wrote:
> 
> Brian,
> 
> Are there legal constraints here?
> 
> I presume that the party doing the recording has a legal obligation to ensure an indication makes it to the other participants that are being recorded. OTOH there may be others in the call that might wish to suppress the indication, to one or more of the participants.
> 
> If the indication is in the signaling, then everybody in the signaling path has an opportunity to meddle with the indication.
> 
> That is potentially also true if the indication is in the media. But it may at least be a lot harder to do.
> 
> I have no recommendation yet, just exploring.
> 
> 	Thanks,
> 	Paul
> 
> On 3/6/23 5:51 PM, Brian Rosen wrote:
>> Many are familiar with a requirement to insert an audible indication of a voice call being recorded, and in some circumstances, visible indication of a video recording.   SIPREC provides the recording mechanism, and it’s possible for the SIPREC client to insert the indications.  This doesn’t work very well in applications like emergency services, where recording often happens in multiple places.  We don’t want multiple media insertions.  The usual SIP way to do things like this is to pass the indication as data in signaling, and render the audio/video/whatever locally.
>> Suppose we wanted to do that: we would need to pass to all endpoints (think conference) the information that the session was being recorded.
>> Does that make sense?
>> What would you suggest we use to carry that indication?
>> Brian
>> _______________________________________________
>> sipcore mailing list
>> sipcore@ietf.org
>> https://www.ietf.org/mailman/listinfo/sipcore
> 
> _______________________________________________
> sipcore mailing list
> sipcore@ietf.org
> https://www.ietf.org/mailman/listinfo/sipcore