Subject: Confirming the Nominet position

From: "Jay Daley" <[email-masked]>
Date: Wed, 26 May 2004 09:48:34 +0100

Two things
 
1.  Late new comers

The criticism levelled about "late new comers" is well founded and I'm 
sorry that is the case.  This is something we should have raised some time 
ago.  Recognising that we were late with this we did try to avoid just 
unproductive foot stamping by the development of the NSEC2 draft as a 
positive alternative.  We are now committed to the process and we will be 
here to stay.  As evidence of this I should make clear that our next steps 
will be to write NSEC2 patches for BIND and if possible NSD to allow 
proper interoperability testing.

Ideally we would like NSEC2 to go forward properly now but I understand 
very well that this causes significant problems for many in this WG.  So 
we would be quite happy with a mechanism that allowed NSEC2 to be 
introduced later in a backwards compatible fashion, such as the previosuly 
suggestion version field for NSEC.

2. Legal mumbo jumbo

I'm sorry if we appear to have been hiding behind legal mumbo jumbo, this 
was not our intention.  So I need to be clear that zone file enumeration 
is a show-stopper for us that will prevent us from fully implementing 
DNSSEC and our legal advice is ancillary to that not the determining 
factor.  So if DNSSEC stays in its current form then we will have to make 
a local determination about how/what we implement, which is still to be 
decided.

However, for those of you that have asked, this is the gist of our legal 
advice...

As compilations, zone file databases are protected under EU law by 
?Database Right?. As a derivative work of the main register from which 
they are sourced, they are likely also to attract copyright protection in 
addition to or in place of database right.

Both database right and copyright are negative rights in that they 
prohibit certain acts (primarily, copying the whole or a substantial part 
of the materials) but do not grant positive rights (unlike, for example, a 
patent, which grants a monopoly on the material involved). Database right 
is unique to countries which implement European Community law, but 
copyright is more universal. 

If legal rights would be infringed with copying, then is it not better to 
allow the copying, and then rely on the law to assist against any 
infringers.  The short answer is ?no?, and here the analogy of locking 
one?s house or car despite laws against burglary and theft may be helpful. 
 Prevention is not always better than cure, if one is led to make an 
overly restrictive solution in order to prevent a minor risk.  However, if 
the risk of harm is major, and is highly likely to take place, and will be 
expensive and difficult to put right after the event, then in those 
circumstances, prevention is very definitely better than cure.

The problem with both copyright and database right arises with 
enforcement, particularly in respect of electronic data such as a zone 
file.  Firstly it can be hard to identify whether a data mining event has 
taken place, in the context of the high volume of traffic affecting the 
nameservers on a day to day basis. If a technical department cannot show 
this, there is nothing that a legal department can do. Even if it is clear 
that it is happening, the technical department may not be able to trace 
who has done it, because the use of multiple proxies can make it 
impossible (or prohibitively expensive) to find it. Even if this can be 
done, the person(s) involved may be abroad. If they are in a difficult 
jurisdiction (even including eastern Europe, which is part of the EU) the 
differences in language and legal systems add to the expense and 
complexity of pursuing legal proceedings. 

Jay

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: [email-masked]
Date: Thu, 27 May 2004 13:54:25 +0000

> complexity of pursuing legal proceedings. 

	to make it easier to track, would "watermarking" the
	database be helpful?

> Jay

--bill

---

From: "Jay Daley" <[email-masked]>
Date: Thu, 27 May 2004 21:24:24 +0100

Bill

>    to make it easier to track, would "watermarking" the

Possibly, but we would need to decide whether to do this by IP address, by 
zone etc. (which may not be as trivial as it seems).  Whatever the way 
this is still an after-the-fact control mechanism and those are arduous 
and expensive to pursue.  This is something we unfortunately have a lot of 
experience of ... http://www.vnunet.com/news/1154488

Jay

---

From: [email-masked]
Date: Fri, 28 May 2004 13:03:03 +0000

> experience of ... http://www.vnunet.com/news/1154488

	Beating this dead mule...  Digitally signing the data provides an
	un-ambigious, hard to forge, proof that the zone and each RR in the
	zone was signed by a unique source. This "watermark" technique is being 
	considered by some to dis-abmbigious potential conflicts.
	YMMV.

--bill

---

From: [email-masked] (Geoffrey Sisson)
Date: Fri, 28 May 2004 14:42:57 +0100 (BST)

> 	considered by some to dis-abmbigious potential conflicts.

Hi Bill

Are you suggesting the use of steganography to somehow uniquely
identify RRs, or set of RRs, by whomever retrieved them?  Or are you
suggesting the use of the RRSIGs as legal evidence of the unambiguous
origin of the zone data?  Or something else?

Regards

Geoff

---

From: Ben Laurie <[email-masked]>
Date: Fri, 28 May 2004 16:01:15 +0100

[email-masked] wrote:
> 	zone was signed by a unique source.

I don't see how that helps Nominet, since, by definition, if it ends .uk 
it'll be on their servers and the signatures would surely not be 
preserved in a list of .uk domains.

> This "watermark" technique is being 

I don't understand what this means?

Cheers,

Ben.

---

From: [email-masked]
Date: Fri, 28 May 2004 15:16:21 +0000

> origin of the zone data?  Or something else?

	i've been told that digital signatures can be used as
	legal evidence in some jurisdictions. if true, it is 
	conceivable that by my holding signed data indicates,
	if not the path by which i received said data, who signed the
	data.  

-- bill

---

From: [email-masked]
Date: Fri, 28 May 2004 15:39:46 +0000

> preserved in a list of .uk domains.

	er... not at all.  the server @ 198.32.2.10 has had 100,000s
	of RRs that end in uk. locally stored.  - I could slurp them into 
	zone file format and publish it as uk. for the server users.  Not 
	a Nominet server(s) and not Nominet data.  QED.

> I don't understand what this means?

	How does one distinguish the Nominet collection of data that
	ends in uk. and the Msrs Bill, Ben & Geoffs collection of data 
	that ends in uk.?

	The simple way is to "watermark" the dataset and it elements
	with digital signatures.  ergo the database entry  "co.uk."
	with a Nominet signature is clearly signed by Nominet and 
	presumably they acknowledge that the data so signed is 
	authentic to Nominet.

	One might presume that a careful application might be able
	to distinguish a "co.uk." signed by Msrs Bill, Ben & Geoff and 
	a "co.uk." signed by Nominet.  

	And it might even be reasonable to consider the possiblity of
	Nominet being grumpy about finding the unauthorized republication
	of signed Nominet data by Msrs Bill, Ben & Geoff... don't you think?

	One should be careful to mind the huge gaps in thinking here, but
	it is a plausable argument to digitally sign your zones & data.

--bill

---

From: [email-masked] (Geoffrey Sisson)
Date: Fri, 28 May 2004 17:08:59 +0100 (BST)

Hi Bill

Thanks for the clarification.  As you say, it's possible that RRSIGs
could be used to show unambigiously that the data originated from a
particular source, but it's unlikely that RRSIG data would be left in
unauthorised copies of zones, if for no other reason than they would
likely to be seen to consume storage unneccessarily.  (I expect
elaboration tools will summarily discard them!)

Regards

Geoff

---

From: Edward Lewis <[email-masked]>
Date: Fri, 28 May 2004 14:03:49 -0400

>	if not the path by which i received said data, who signed the

Evidence != conclusion.  I'm sure a digital signature is worthless if 
the private key needed to generate it is "widely" known.  Much like 
having the keys to a car that caused the accident doesn't mean you 
were driving it at the time.

Sorry, I think I've strayed into a legal discussion...
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                            +1-703-227-9854
ARIN Research Engineer

Even the voices inside my head are refusing to talk to me anymore.

---

From: [email-masked]
Date: Fri, 28 May 2004 18:11:13 +0000

On Fri, May 28, 2004 at 02:02:35PM -0400, Derek Atkins wrote:
> Except signatures can be removed.

	see above.  in the example, I end up holding signed 
	data.

> I could remove it in my copy, so you
> couldn't verify the origin of the document.

	and -you- are smarter than the average bear. :)

> Watermarking needs to be performed _IN_ the document, not by a
> signature.  And all watermarking techniques have been shown to be
> breakable via collusion of multiple recipients of the data.

	yes... note again (earlier in thread) that watermark was
	quoted. that was intentional.

> -derek