Subject: [Ecrit] Hiding (partial) locations

From: Henning Schulzrinne <[email-masked]>
Date: Sun, 15 Apr 2007 21:32:30 -0400

After the discussion, I think the simplest approach is the partial  
response solution:

The ISP returns partial location information that is sufficiently  
accurate to return the correct PSAP. This would typically be the  
county or city. This reveals (almost) no additional information to  
the client beyond the PSAP URL. After all, the PSAP boundaries are  
public or easily guessable, so it would be easy for an external  
entity to construct a mapping that maps PSAP URLs back to rough  
locations, thus defeating the efforts by the ISP to hide the location  
information from their customers. This level of location information  
is also more or less what you can get for free already from services  
such as http://www.ip2location.com/free.asp or MaxMind.

There are two mechanisms for doing that:

(1) combined LbyV and LbyR: rough information by value, precise  
information by (protected) reference;

(2) just LbyR, but the reference is roughly resolvable by possession,  
precise resolution requires a shared secret (held by the PSAP).

This approach has three advantages:

(1) If all else fails (such as attempts to resolve the reference),  
the PSAP at least has some location information to work with, rather  
than a completely useless reference. This is particularly important  
if the call arrives at an overflow or backup PSAP, since it will  
assume that the call is from its service area and it may not be able  
to resolve the reference due to lack of an established trust  
relationship.

(2) The client can verify the information, reducing errors.

(3) Nothing changes in terms of processing compared to providing full  
location information.

Henning

_______________________________________________
Ecrit mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ecrit

---

From: "Clive D.W. Feather" <[email-masked]>
Date: Mon, 16 Apr 2007 10:23:29 +0100

Henning Schulzrinne said:
> This level of location information  

I hope not.

I tried both of these with my home system and my office system. Both are
within blocks assigned by RIPE and with the correct civic location in the
RIPE database.

IP2location: returned a location in the wrong country! [Actually, returned
an offshore location approximately 100m from low water mark and 300m from
high water mark, but still the wrong country.]

MaxMind got the right conurbation for my office, though I suspect it went
for some kind of geographic centre for that conurbation, since it's out by
several kilometres. For my home it was wrong by about 120km.

-- 
Clive D.W. Feather  | Work:  <[email-masked]>   | Tel:    +44 20 8495 6138
Internet Expert     | Home:  <[email-masked]>  | Fax:    +44 870 051 9937
Demon Internet      | WWW: http://www.davros.org | Mobile: +44 7973 377646
THUS plc            |                            |

---

From: "Tschofenig, Hannes" <[email-masked]>
Date: Mon, 16 Apr 2007 11:41:46 +0200

Hi Clive, 

Are you saying that you think that the idea of providing enough information for routing by the ISP is good or do you think that the ISP will not even want to provide this information? 

Ciao
Hannes

> -----Ursprüngliche Nachricht-----
> Von: Clive D.W. Feather [mailto:[email-masked]] 
> Gesendet: Montag, 16. April 2007 11:23
> An: Henning Schulzrinne
> Cc: ECRIT
> Betreff: Re: [Ecrit] Hiding (partial) locations
>

---

From: "Marc Linsner" <[email-masked]>
Date: Mon, 16 Apr 2007 08:37:13 -0400

Henning,

The partial location would need to be accurate enough such that tandem LoST
queries don't have to dereference real-time.  The only deference should
happen at the PSAP for dispatch.  If the ESInet deploys a state level proxy
which performs a second LoST query to find the county level PSAP, enough
data in the LbyV should be there to do so.

This is doable today, protocol-wise.  The only work may be an additional tag
in the LO for the LbyR (if <provided-by> isn't the choice).

This also supports the location 'integrity' desires.  Prior to expending
high-cost resources with a dispatch, the PSAP knows the location provider
via the TLS setup during dereference to find the precise location of the
caller.

-Marc-

> 
> The ISP returns partial location information that is 
> sufficiently accurate to return the correct PSAP. This would 
> typically be the county or city. This reveals (almost) no 
> additional information to the client beyond the PSAP URL. 
> After all, the PSAP boundaries are public or easily 
> guessable, so it would be easy for an external entity to 
> construct a mapping that maps PSAP URLs back to rough 
> locations, thus defeating the efforts by the ISP to hide the 
> location information from their customers. This level of 
> location information is also more or less what you can get 
> for free already from services such as 
> http://www.ip2location.com/free.asp or MaxMind.
> 
> (1) combined LbyV and LbyR: rough information by value, 
> precise information by (protected) reference;
> 
> (2) just LbyR, but the reference is roughly resolvable by 
> possession, precise resolution requires a shared secret (held 
> by the PSAP).
> 
> (1) If all else fails (such as attempts to resolve the 
> reference), the PSAP at least has some location information 
> to work with, rather than a completely useless reference. 
> This is particularly important if the call arrives at an 
> overflow or backup PSAP, since it will assume that the call 
> is from its service area and it may not be able to resolve 
> the reference due to lack of an established trust relationship.
> 
> (3) Nothing changes in terms of processing compared to 
> providing full location information.
> 
> Henning
>

---

From: Henning Schulzrinne <[email-masked]>
Date: Mon, 16 Apr 2007 08:45:55 -0400

Marc,

I generally agree; I was indeed assuming PSAP-level accuracy, i.e.,  
in the US, a community or county. At least in the US, for wireline,  
the PSAP boundaries often correspond to rate center boundaries, so  
all lines on a DSLAM will have the same PSAP. (I will note that in  
the US, the same location information is also roughly available from  
the phone book, since the three digits after the area code often  
correspond to the community or rate center. For example, my phone  
number is 201 592 xxxx, and all 592's are in Leonia, NJ. As far as I  
know, the phone company hasn't tried to hide my phone number from me,  
although they'll force me to pay if I want to hide it from others...)

Henning

---

From: "Brian Rosen" <[email-masked]>
Date: Mon, 16 Apr 2007 11:19:03 -0400

This doesn't work in areas that don't have simple PSAP boundaries.

Even in a case where the PSAP serves a city, the boundary of the city is
very often not exactly that of the municipal boundary.

It definitely doesn't work in the U.S. where there are PSAP boundaries that
are one side or the other of the street (even and odd addresses), or between
two house numbers on a street.

Brian

> -----Original Message-----
> From: Henning Schulzrinne [mailto:[email-masked]]
> Sent: Sunday, April 15, 2007 9:33 PM
> To: ECRIT
> Subject: [Ecrit] Hiding (partial) locations
>

---

From: Henning Schulzrinne <[email-masked]>
Date: Mon, 16 Apr 2007 13:15:19 -0400

> This doesn't work in areas that don't have simple PSAP boundaries.

Agreed; it would require more precise location in those  
jurisdictions. Those do seem to be the exception, however.

> very often not exactly that of the municipal boundary.

Again, this would only force an ISP to provide more precise location  
information to those relative handful of exception cases. This seems  
like a fair trade-off.

> two house numbers on a street.

My perception is that PSAP boundaries that don't correspond to  
community or county names occur, but only affect a tiny fraction of  
the population.

(Street don't matter. Broad Avenue, for example, traverses a half  
dozen communities in northern Bergen County, but each town has its  
own PSAP, whose responsibility is defined by the community, not the  
street.)

---

From: "Brian Rosen" <[email-masked]>
Date: Mon, 16 Apr 2007 14:57:04 -0400

I don't understand this.

If, in order to make a route decision, you need street name and house
number, but the access network wishes to hide location from non emergency
use cases, how the heck do we supply "coarse" location that is any different
from full LbyV?

You can't restrict the access network from hiding location ONLY IF the PSAP
boundary is truly coarse.  I'm also not so sure the access networks would be
willing to give out coarse location down to, say, city.

So, I guess I disagree this is a fair trade-off.  In fact, I think it's a
non-starter.

Brian

> Sent: Monday, April 16, 2007 1:15 PM
> To: Brian Rosen
> Cc: 'ECRIT'
> Subject: Re: [Ecrit] Hiding (partial) locations
> 
>

---

From: Henning Schulzrinne <[email-masked]>
Date: Mon, 16 Apr 2007 15:31:12 -0400

> use cases, how the heck do we supply "coarse" location that is any  

I'm saying that in those exceptional cases, ISPs should indeed give  
out more information. This does not significantly devalue their  
precious location information since only a few "lucky" customers  
receive it, but it makes the system more robust. That seems like a  
fair trade-off to me.

> willing to give out coarse location down to, say, city.

They do today - via the area code and exchange in phone numbers,  
which are, as far as I know, disclosed to customers. Indeed, DT uses  
phone numbers as the user identity for their DSL customers, if I  
remember correctly. (In Germany, each city has its own area code,  
more or less, so this fits your description of coarse location down  
to a city pretty well; see http://www.deutschland-adressen.de/ 
vorwahlen-02.php for an example) I haven't heard that this has caused  
major revenue loss or heart burn to phone companies.

> So, I guess I disagree this is a fair trade-off.  In fact, I think  

Are you representing carriers?

---

From: "Brian Rosen" <[email-masked]>
Date: Mon, 16 Apr 2007 15:59:38 -0400

I am not a carrier, and I don't play one on TV.

I'll let the carriers speak for themselves.

I don't think, based on my understanding, they will agree with you, I'll let
them say it direct.

Brian

> Sent: Monday, April 16, 2007 3:31 PM
> To: Brian Rosen
> Cc: 'ECRIT'

---

From: "Stark, Barbara" <[email-masked]>
Date: Mon, 16 Apr 2007 16:54:24 -0400

The way I envisioned partial locations, from my civic location bias, is
to provide city, county, and state information. I'm not aware of cases
where a city is sub-divided, so a provider in that situation would have
to figure out the information needed to uniquely map for emergency
services.

But I know that around me, cities (incorporated areas) and counties
(unincorporated) have responsibility for services within their borders.
In some cases the counties provide service to cities by agreement.

City boundaries do meander around, and split streets in half. But I'm
not aware of cases where a city has told its residents to call another
city for emergency services. Cities are responsible to the citizens
within their borders, no matter how twisted those borders might be. The
same goes for counties.
Barbara

-----Original Message-----
From: Brian Rosen [mailto:[email-masked]] 
Sent: Monday, April 16, 2007 2:57 PM
To: 'Henning Schulzrinne'
Cc: 'ECRIT'
Subject: RE: [Ecrit] Hiding (partial) locations

I don't understand this.

If, in order to make a route decision, you need street name and house
number, but the access network wishes to hide location from non
emergency use cases, how the heck do we supply "coarse" location that is
any different from full LbyV?

You can't restrict the access network from hiding location ONLY IF the
PSAP boundary is truly coarse.  I'm also not so sure the access networks
would be willing to give out coarse location down to, say, city.

So, I guess I disagree this is a fair trade-off.  In fact, I think it's
a non-starter.

Brian

> Agreed; it would require more precise location in those jurisdictions.

> Those do seem to be the exception, however.
> 
> >
> > Even in a case where the PSAP serves a city, the boundary of the 
> > city is very often not exactly that of the municipal boundary.
> 
> > It definitely doesn't work in the U.S. where there are PSAP 
> > boundaries that are one side or the other of the street (even and 
> > odd addresses), or between two house numbers on a street.
> 
> dozen communities in northern Bergen County, but each town has its own

> PSAP, whose responsibility is defined by the community, not the
> street.)
> 
> 
> >
> > Brian

*****

The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential, proprietary, and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from all computers. GA622

---

From: Hannes Tschofenig <[email-masked]>
Date: Tue, 17 Apr 2007 08:39:42 +0200

Barbara,

could you sell the partial location story within your company (i.e., 
providing the end host with information about country, state and city)?

Ciao
Hannes

---

From: "Stark, Barbara" <[email-masked]>
Date: Tue, 17 Apr 2007 15:14:46 -0400

I might be able to sell partial location, but I've heard from others who
don't think that would be acceptable. And it doesn't get the dial
strings to the device. The overall solution must get the dial strings to
the device.
Barbara 

-----Original Message-----
From: Hannes Tschofenig [mailto:[email-masked]] 
Sent: Tuesday, April 17, 2007 2:40 AM
To: Stark, Barbara
Cc: ECRIT
Subject: Re: [Ecrit] Hiding (partial) locations

Barbara,

Ciao
Hannes

Stark, Barbara wrote:
> The way I envisioned partial locations, from my civic location bias, 
> is to provide city, county, and state information. I'm not aware of 
> cases where a city is sub-divided, so a provider in that situation 
> would have to figure out the information needed to uniquely map for 
> emergency services.
>

> within their borders, no matter how twisted those borders might be. 
> The same goes for counties.
> Barbara
>
> emergency use cases, how the heck do we supply "coarse" location that 
> is any different from full LbyV?
>

> PSAP boundary is truly coarse.  I'm also not so sure the access 
> networks would be willing to give out coarse location down to, say,
city.
>
> So, I guess I disagree this is a fair trade-off.  In fact, I think 
> it's a non-starter.
>
> Brian
>
>   
jurisdictions.
>> own
> The information transmitted is intended only for the person or entity 
> to which it is addressed and may contain confidential, proprietary, 
> and/or privileged material. Any review, retransmission, dissemination 
> or other use of, or taking of any action in reliance upon this 
> information by persons or entities other than the intended recipient 
> is prohibited. If you received this in error, please contact the 
> sender and delete the material from all computers. GA622
>
>
>

---

From: Henning Schulzrinne <[email-masked]>
Date: Tue, 17 Apr 2007 15:23:33 -0400

With partial location, LoST works just fine, i.e., can produce dial  
strings for the device.

---

From: "Clive D.W. Feather" <[email-masked]>
Date: Tue, 24 Apr 2007 08:54:01 +0100

>>> such as http://www.ip2location.com/free.asp or MaxMind.

is meant to represent state of the art, then this whole thing is dead in
the water: one of them couldn't even find the right *COUNTRY*.

The test addresses I used were not special or "tricks"; they should have
been easy.

---

From: "Brian Rosen" <[email-masked]>
Date: Tue, 24 Apr 2007 07:32:34 -0400

Right.

No one responded to the original of that because we understand the issues
with those kinds of services.  VPNs, and the variability of carrier network
design make such mechanisms have high error rate; certainly no where near
good enough for any kind of emergency services.  We've discussed them
before.

They are often accurate to roughly city level for residential deployments
without VPNs obscuring them, but "roughly" and "city level" and "without"
make them useless for any practical purpose.  Any multi-site enterprise
typically reports all sites as being the HQ site.

Brian

> From: Clive D.W. Feather [mailto:[email-masked]]
> Sent: Tuesday, April 24, 2007 3:54 AM
> To: Tschofenig, Hannes
> Cc: ECRIT
> > Are you saying that you think that the idea of providing enough
> information for routing by the ISP is good or do you think that the ISP
> will not even want to provide this information?
>