Subject: Re: Proposal to fix NSEC

From: Jaap Akkerhuis <[email-masked]>
Date: Fri, 21 May 2004 20:38:49 +0200

I see a some of arguments being made about EU concerns over privacy.
The subject whether DNSSEC would be run into EU privacy concerns
pops up on a regular base in various places.

Therefore, SIDN, the Dutch registry, asked for an opinion of the
faculty of law of the University of Brabant. These people, all
lawyers, are specialized in privacy and the influence of crypto
technology on the law (and vice versa). They don't have no specialist
knowledge of the DNS, but know the role it has in the proper working
of the Internet.

I explained them the situation:

	Lots of ccTLDs are preventing zone transfers to be done by
	the public in general often using privacy concerns as the
	primary motif. I also explained that DNSSEC has this back
	door where you can get the names out of the zone by walking
	the NXT records. So the basic question was, is there really
	a concern that this backdoor might prevent the deployment
	of DNSSEC in Europe because of privacy regulation?

Note, this was before NSEC records existed. I'm sticking here to
the term NXT records to stay close to the original conversation.

They were willing to do an small study, and, if they thought that
there might be any problems, they would raise that and then we would
decide whether a larger study was necessary.

It resulted in:
	Tilburg University (B.J. Koops & E. Schreuders), Quickscan
	DNSsec/NXT and privacy, March 2003 (unpublished).

It is not really big, I give here a translation from the Dutch,
leaving out some of the details.

	We don't think that there is a special privacy problem with
	the deployment of DNSSEC caused by the NXT walking which
	would give you a list of names which might be used to query
	the whois service.  The privacy rules are already in force
	by the Wbp (Dutch privacy law, fully implementing the EU
	directives --j) and the regulation of the registry.  (I'm
	skipping the details they quote from court cases and articles
	in our regulations --j).

	DNSsec only offers something new by the capability to get
	a list of domain names. This list is irrelevant from a
	privacy point of view, only the combination with the whois
	database gives the list personal sensitive information (with
	the exception that of domain names such as michaeljfox.com,
	vix.com and jaap-akkerhuis.nl).  Possible problems occur
	when the list is used for interrogating the whois database.
	But for that, there are already existing rules so DNSsec
	doesn't add any problems.

        In short, the back door can give personal data but only
        in combination with whois for which is existing regulation.

Although they don't claim that they didn't do "fundamental research",
We (SIDN) would have been happy to pay for such a study as well,
but they refused, since they thought that such a study would have
a very similar outcome.

So, we concluded that the NXT walking (now NSEC) and (EU) privacy
concerns would not be a show stopper for introducing DNSSEC in the
NL zone.

On this list in this context I noticed that also concernsabout the
IP-rights (Intellectual Property rights) popped up, like one had
on a telephone directory. (There the data is also meant to be public,
but on how it is organized there are IP rights). You cannot just
copy a directory because of that. For a zone file you can claim
this probably as well. That gives you a handle to whack people
making copies. We discussed this internally somewhat.  We think
that IP-rights on a zone file is an interesting idea, but doesn't
prevent zone enumeration. It has more juridical aspects then
technical.

Back to (EU and other) pivacy concerns. Given the fact that there
are multiple ways to do data mining for domain names in a zone as
pointed out by Paul Vixie and Robert Elz, one really must take steps
to limit access to "whois data".

	jaap

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Alex Bligh <[email-masked]>
Date: Fri, 21 May 2004 20:42:46 +0100

--On 21 May 2004 20:38 +0200 Jaap Akkerhuis <[email-masked]> wrote:

> For a zone file you can claim
> making copies.

The (expensive, uncertain) legal "handle to whack people" doing something
unlawful is no substitute for stopping them doing it in the first place.
That's the same reason you have a lock on your front door despite laws
against theft, and (bring this back to a protocol level) the same reason we
promote strong encryption in protocols such as DNSSEC despite computer
crime and fraud laws. If we said in a more general case "we'll leave this
out the protocol and let them sort out the consequences in court" we might
as well not do DNSSEC, and just pay investigators and lawyers to go verify
whether DNS records are accurate and sue if not.

Whilst the legal point is interesting, my main argument is from a
functionality point of view.

Alex

---

From: Mark Andrews <[email-masked]>
Date: Sat, 22 May 2004 09:40:23 +1000

> copy a directory because of that.

	But you can compile your own.  I seem to remember a court case
	here where OCR scanning of a existing directory was illegal but
	getting a team of typists to re-enter all the data in a
	existing directory was legal.

--
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: Roy Badami <[email-masked]>
Date: Sat, 22 May 2004 01:00:16 +0100

>>>>> "Mark" == Mark Andrews <[email-masked]> writes:

    Mark> 	But you can compile your own.  I seem to remember a
    Mark> court case here where OCR scanning of a existing directory
    Mark> was illegal but getting a team of typists to re-enter all
    Mark> the data in a existing directory was legal.

Hmm, I'm kind of surprised that even OCR was illegal in the US.  But
there is a significant difference between UK and US copyright law in
this area.  AIUI in US copyright law there is an exclusion from
copyright for a unique, canonical representation of a set of data.  A
consistently formatted alphabeticised list of names and phone numbers
of all telephone users would hence fall into this category, since it
is not regarded as a creative work.

Many other jurisditions (certainly the UK) do not draw this
distinction.

	-roy

---

From: [email-masked]
Date: Fri, 21 May 2004 19:18:23 +0000

> prevent zone enumeration. It has more juridical aspects then

	the one concern here is that the process of signing the
	data sorts the zone into a "normal" form.  this is a two-edged
	sword :)  in the singed case, I can unambigiously prove
	that the zone contents were sorted and signed by me. e.g.
	the compilation is mine.

> to limit access to "whois data".

	There are otheres that called out the ability to either
	"slow-scan" the replies & build up a copy of the DB over time,
	or "brute-force" the effort. Both take time, both are known
	tools (and some of us have used them!)  

> 	jaap

--bill