Subject: [Ecrit] some observations from yesterday wg meeting

From: James Seng <[email-masked]>
Date: Wed, 3 Aug 2005 12:04:18 +0800

I am not a regular on this list so whatever I said here is based on  
what I see at yesterday wg meeting. Pardon me if these already been  
discussed.
1. There are a lot of talks about how caller can authenticate the  
emergency response centers (singapore term for what WG's called PSAP)  
but not much talks about how PSAP is going to authenticate the callers.

Considering how many prank calls typical PSAP gets, I wont be  
surprised if their priority is to identify the caller first and less  
about your house on fire.

No I am serious. That's my experience when dealing with them on E911  
when we are working on our IP Telephony framework.

2. Any bet how long it will take PSAP to install a SIP server into  
their system? Especially a system which will allow anyone from  
anywhere in the world to call them anonymously?

So while it is important for the caller to be able to identify his  
nearest PSAP, it is equally important for PSAP to be able to (a)  
identify the caller and (b) establish that the caller is within the  
zone they are serving.

-James Seng

_______________________________________________
Ecrit mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ecrit

---

From: "Brian Rosen" <[email-masked]>
Date: Wed, 3 Aug 2005 03:23:22 -0400

In North America, the PSAPs tell us that their priorities are to:
1. Get the call to the right PSAP
2. Get a call back number
3. Get the location of the caller

To the extent that the current PSTN equates "identity" of the caller with
the telephone number, they are getting identity as their second point.

This discussion is more or less out of charter, as the work in ecrit
addresses the first point above.

For ecrit, we did have a discussion on the importance of assuring that the
location provided is the actual location of the caller.  This is actually
the biggest part of addressing prank calls.

As I said in the meeting, the PSAPs I know would accept a call with no
location, no call back and no identity.  They might be VERY suspicious of
such a call, but they will take it, and depending on what the caller said,
they probably will dispatch someone.  At least for the PSAPs I know, while
they will demand a lot of effort to make sure location and call back are
accurate, they will, in fact, accept a call without it.  In that regard, I
think they care about the house on fire first, and the identity second.

Brian

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
James Seng
Sent: Wednesday, August 03, 2005 12:04 AM
To: [email-masked]
Subject: [Ecrit] some observations from yesterday wg meeting

-James Seng

---

From: James Seng <[email-masked]>
Date: Wed, 3 Aug 2005 15:35:59 +0800

That may be the American experience but certainly not mine.

-James Seng

---

From: Andrew Newton <[email-masked]>
Date: Wed, 3 Aug 2005 05:07:09 -0400

> addresses the first point above.

I don't think so.  I think James has made a fairly important point:  
the notion that L2 location must be signed can simply be circumvented  
by an attacker contacting the PSAP's SIP server directly.

-andy

---

From: "Brian Rosen" <[email-masked]>
Date: Wed, 3 Aug 2005 05:20:32 -0400

But that problem is not in our charter.  If an attacker learned a PSAP's SIP
URI from any mechanism, they can mount an attack.

True.

Not in our charter.

Determining that a location represents the location of the caller is within
charter.

I believe identity of caller is NOT a requirement in general, but I think
it's clearly not a requirement in ecrit.

Brian

-----Original Message-----
From: Andrew Newton [mailto:[email-masked]] 
Sent: Wednesday, August 03, 2005 5:07 AM
To: Brian Rosen
Cc: 'James Seng'; [email-masked]
Subject: Re: [Ecrit] some observations from yesterday wg meeting

-andy