Due to interception capabilities being required, perhaps? -- Juha Saarinen twitter: juhasaarinen On 20/11/2013, at 7:33 am, Jay Daley wrote:

Perhaps the question should be asked the other way around - "why wouldn't this be permitted?"

On 2013-11-19, at 13:50, Rob McDonald wrote:

The interception doesnt need to br covert. Un-encrypted streams could be supplied following receipt of thr appropriate court order. Which I believe is what was lacking in the case of the nsa scandal.

With a small concentration of layer-2 (and lower) transport providers, you can also challenge the ease at which court-ordered taps are deployable by adjusting your expectations about how data could be intercepted. For example, I think it's commonplace to assume that traffic carried between private networks over the public Internet deserves some protection; this is why people suffer the cost and inconvenience of VPNs. I think it's less common for people to assume that transport services below layer 3 are as vulnerable, which is quite arguably a mistake. A single court order delivered to a metro ethernet provider could facilitate interception of traffic between many different networks if they all happen to use the same layer-2 transport. Treat those metro ethernet services as hostile and encrypt the traffic across them, and the same interception capability might involve many more court orders and considerably more infrastructure in order to tap the points on the path where the traffic runs in the clear. Joe

On 20/11/2013 07:46, Juha Saarinen wrote:

...

Due to interception capabilities being required, perhaps?

There's a quagmire there about who can be required to help intercept, under what legal process, and with what expectation of success. Personally I would prefer that was something for law enforcement lawyers to prove rather than for us to assume. On 19/11/2013, at 3:53 pm, Brian E Carpenter wrote:

That's exactly why the IETF decided many years ago not to consider wiretapping when writing standards (RFC 2804) and why the IETF is now busy looking for ways to make pervasive surveillance much harder (http://www.ietf.org/media/2013-11-07-internet-privacy-and-security).

The phrase used this week by the Chair of the IETF is "Anything indistinguishable from an attack must be considered an attack". Which I took to mean that interception will be mitigated in the protocols regardless of whether or not it is "lawful" interception. Jay -- Jay Daley Chief Executive .nz Registry Services (New Zealand Domain Name Registry Limited) desk: +64 4 931 6977 mobile: +64 21 678840 linkedin: www.linkedin.com/in/jaydaley