Subject: [perpass] India posed to require cleartext, cleartext retention, cipher and backdoor mandates

From: Joseph Lorenzo Hall <[email-masked]>
Date: Mon, 21 Sep 2015 12:45:06 -0400

Obviously, of relevance to those that will be at the IAB MARNEW
workshop this week (although this isn't in any way specific to radio
networks).

* Everyone (all individuals and businesses) using encryption must
store unencrypted content for 90 days
* Government will dictate algorithms and key sizes
* Possibility of a legally mandated backdoor

Article from Daily Dot:
http://www.dailydot.com/politics/india-encryption-backdoors-draft-policy/

Text of the proposal (comments due 16 Oct.):
https://info.publicintelligence.net/IN-DraftEncryptionPolicy.pdf

-- 
Joseph Lorenzo Hall
Chief Technologist
Center for Democracy & Technology
1634 I ST NW STE 1100
Washington DC 20006-4011
(p) 202-407-8825
(f) 202-637-0968
[email-masked]
PGP: https://josephhall.org/gpg-key
fingerprint: 3CA2 8D7B 9F6D DBD3 4B10  1607 5F86 6987 40A9 A871

---

From: Stephen Farrell <[email-masked]>
Date: Mon, 21 Sep 2015 18:07:35 +0100

Sheesh, there is so much wrong in that document. And they
top it off by recommending RC4.

Does anyone know if this is a policy that is likely to be
enforced or one that'd be more honoured in the breach?

S.

---

From: Dan York <[email-masked]>
Date: Tue, 22 Sep 2015 09:57:28 +0000

There was a significant amount of public outcry yesterday within India and the latest news is that the government of India is apparently withdrawing the draft policy:

http://timesofindia.indiatimes.com/tech/tech-news/Government-withdraws-draft-of-encryption-policy/articleshow/49057232.cms

Prior to that the government agency involved had already issued an update saying that the draft policy would NOT apply to TLS in web commerce and social media, messaging, etc.  The update document seems to have been removed, but is captured here by a news site:

http://www.medianama.com/2015/09/223-india-draft-encryption-policy/

Dan

On Sep 21, 2015, at 1:07 PM, Stephen Farrell <[email-masked]<mailto:[email-masked]>> wrote:

S.

Article from Daily Dot:

_______________________________________________
perpass mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/perpass

--
Dan York
Senior Content Strategist, Internet Society
[email-masked]<mailto:[email-masked]>   +1-802-735-1624
Jabber: [email-masked]<mailto:[email-masked]>
Skype: danyork   http://twitter.com/danyork

http://www.internetsociety.org/<http://www.internetsociety.org/deploy360/>

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 22 Sep 2015 11:19:59 +0100

On 22/09/15 10:57, Dan York wrote:
> There was a significant amount of public outcry yesterday within
> India and the latest news is that the government of India is
> apparently withdrawing the draft policy:
> 

That was quick. Optimistically, it is good to see common sense
breaking out a bit. And that maybe today's widespread use of TLS
for very widely used services sort of protects crypto generally
by making it more obviously a bad idea to muck with the internals.
We here can continue to help improve that last part.

A more pessimistic speculation would be this was a proposal some
local securocrats [1] had sitting in a filing cabinet ready to be
pulled out whenever they figured it was politically opportune. This
time, they forgot to sanity-check that the content was still ok
today before showing it off. Maybe they picked the wrong moment as
well, not sure, but they definitely didn't do the sanity checks.
In that case, they'd likely do better next time.

It'd be mildly interesting if someone were to analyse the content
to estimate when it might originally have been written.

Cheers,
S.

[1] https://en.wiktionary.org/wiki/securocrat

>  Prior to that the government agency involved had already issued an
> update saying that the draft policy would NOT apply to TLS in web
> commerce and social media, messaging, etc.  The update document seems
> to have been removed, but is captured here by a news site:
> 
> On Sep 21, 2015, at 1:07 PM, Stephen Farrell
> <[email-masked]<mailto:[email-masked]>> wrote:
> 
> 
> Sheesh, there is so much wrong in that document. And they top it off
> by recommending RC4.
> 
> Does anyone know if this is a policy that is likely to be enforced or
> one that'd be more honoured in the breach?
> 
> S.
> 
> On 21/09/15 17:45, Joseph Lorenzo Hall wrote: Obviously, of relevance
> to those that will be at the IAB MARNEW workshop this week (although
> this isn't in any way specific to radio networks).
> 
> store unencrypted content for 90 days * Government will dictate
> algorithms and key sizes * Possibility of a legally mandated
> backdoor
> 
> Article from Daily Dot: 
> _______________________________________________ perpass mailing list 
> -- Dan York Senior Content Strategist, Internet Society 
> [email-masked]<mailto:[email-masked]>   +1-802-735-1624 Jabber:
> [email-masked]<mailto:[email-masked]> Skype: danyork
> http://twitter.com/danyork
> 
> _______________________________________________ perpass mailing list 
> [email-masked] https://www.ietf.org/mailman/listinfo/perpass
>

---

From: Joseph Lorenzo Hall <[email-masked]>
Date: Tue, 22 Sep 2015 07:49:09 -0400

I'm not so sure we should take comfort in their withdrawal of the policy as
all reports are that they are revising and reissuing... We'll see what the
next iteration involves!

On Tuesday, September 22, 2015, Dan York <[email-masked]> wrote:

> There was a significant amount of public outcry yesterday within India and
> the latest news is that the government of India is apparently withdrawing
> the draft policy:
>
>
> Prior to that the government agency involved had already issued an update
> saying that the draft policy would NOT apply to TLS in web commerce and
> social media, messaging, etc.  The update document seems to have been
> removed, but is captured here by a news site:
>
> On Sep 21, 2015, at 1:07 PM, Stephen Farrell <[email-masked]
> <javascript:_e(%7B%7D,'cvml',[email-masked]');>> wrote:
>
>
> [email-masked] <javascript:_e(%7B%7D,'cvml',[email-masked]');>
> [email-masked] <javascript:_e(%7B%7D,'cvml',[email-masked]');>
> +1-802-735-1624
> Jabber: [email-masked]
> <javascript:_e(%7B%7D,'cvml',[email-masked]');>
> http://www.internetsociety.org/
> <http://www.internetsociety.org/deploy360/>
>
>
>
>

---

From: Brian Trammell <[email-masked]>
Date: Tue, 22 Sep 2015 14:04:25 +0200

It seems to me in general that this type of policy remains very attractive; governments in particular tend to prize temporary security over essential freedom. This policy was so obviously silly in its technical detail that it would inevitably need to be withdrawn, though I was impressed by the speed and openness with which that was done here. 

But in general, playing whack-a-mole takes a lot of energy especially when the policies themselves are largely copypasta. Perhaps we should put together an IAB/program form letter ("So You've Decided to Ban Crypto, Here's Why That Won't Work") that we can quickly tailor to the details in order to be able to make constructive public comments *before* the withdrawal happens next time? :)

Cheers,

Brian

> On 22 Sep 2015, at 13:49, Joseph Lorenzo Hall <[email-masked]> wrote:
> 
> I'm not so sure we should take comfort in their withdrawal of the policy as all reports are that they are revising and reissuing... We'll see what the next iteration involves!
> 
>> On Sep 21, 2015, at 1:07 PM, Stephen Farrell <[email-masked]> wrote:
>> 
>> 
>> [email-masked]
> [email-masked]   +1-802-735-1624
> [email-masked]

---

From: Hugo Maxwell Connery <[email-masked]>
Date: Tue, 22 Sep 2015 12:17:19 +0000

Hi,

Back in August was the process of BCP'ing RFC1984. (Subject: Recognising RFC1984 as a BCP).

If this has been completed, it could act as an 'attachment' or compliment in some way the form letter which Brian suggests below.

I repeat that I think the reuse of RFC1984 at this time is an excellent strategy as it clearly states "we've been here before, and the arguments still hold".

Regards,
Hugo Connery
--
Head of IT, DTU Environment, http://www.env.dtu.dk
________________________________________
From: perpass [[email-masked]] on behalf of Brian Trammell [[email-masked]]
Sent: Tuesday, 22 September 2015 14:04
To: Joseph Lorenzo Hall
Cc: perpass; Dan York; Stephen Farrell
Subject: Re: [perpass] India withdraws encryption policy - Re: India posed to require cleartext, cleartext retention, cipher and backdoor mandates

Cheers,

Brian

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 22 Sep 2015 13:25:41 +0100

On 22/09/15 13:17, Hugo Maxwell Connery wrote:
> If this has been completed, it could act as an 'attachment' or
> compliment in some way the form letter which Brian suggests below.

That has been completed [1] so RFC1984 is now an IETF BCP.

I'm not sure how long the RFC editor will need before this
is visible as BCPnnn but it shouldn't be too long, some weeks
maybe. (It's an odd case though changing status on a 1996 RFC,
so some tooling might break or something;-)

S.

[1]
https://mailarchive.ietf.org/arch/msg/ietf-announce/FXpz3-UELhF7S5kBxXvTrRDXSgs

> 
> I repeat that I think the reuse of RFC1984 at this time is an
> excellent strategy as it clearly states "we've been here before, and
> the arguments still hold".
> 
> Regards, Hugo Connery -- Head of IT, DTU Environment,
> http://www.env.dtu.dk ________________________________________ From:
> perpass [[email-masked]] on behalf of Brian Trammell
> [[email-masked]] Sent: Tuesday, 22 September 2015 14:04 To: Joseph
> Lorenzo Hall Cc: perpass; Dan York; Stephen Farrell Subject: Re:
> [perpass] India withdraws encryption policy - Re: India posed to
> require cleartext, cleartext retention, cipher and backdoor mandates
> 
> It seems to me in general that this type of policy remains very
> attractive; governments in particular tend to prize temporary
> security over essential freedom. This policy was so obviously silly
> in its technical detail that it would inevitably need to be
> withdrawn, though I was impressed by the speed and openness with
> which that was done here.
> 
> But in general, playing whack-a-mole takes a lot of energy especially
> when the policies themselves are largely copypasta. Perhaps we should
> put together an IAB/program form letter ("So You've Decided to Ban
> Crypto, Here's Why That Won't Work") that we can quickly tailor to
> the details in order to be able to make constructive public comments
> *before* the withdrawal happens next time? :)
> 
> Cheers,
> 
> Brian
> 
> 
>> I'm not so sure we should take comfort in their withdrawal of the
>> policy as all reports are that they are revising and reissuing...
>> We'll see what the next iteration involves!
>> 
Prior to that the government agency involved had already issued an
update saying that the draft policy would NOT apply to TLS in web
commerce and social media, messaging, etc.  The update document seems to
Dan
>>> <[email-masked]> wrote:
>>> 
>>> 
>>> Sheesh, there is so much wrong in that document. And they top it
>>> off by recommending RC4.
>>> 
>>>> Obviously, of relevance to those that will be at the IAB
>>>> MARNEW workshop this week (although this isn't in any way
>>>> specific to radio networks).
>>>> 
>>>> * Everyone (all individuals and businesses) using encryption
>>>> must store unencrypted content for 90 days * Government will
>>>> dictate algorithms and key sizes * Possibility of a legally
>>>> mandated backdoor
>>>> 
>>>> Article from Daily Dot: 
>>> perpass mailing list [email-masked] 
>> [email-masked]   +1-802-735-1624 Jabber: [email-masked] Skype:
>> danyork   http://twitter.com/danyork
>> 
>> -- Joseph Lorenzo Hall Chief Technologist Center for Democracy &
>> Technology 1634 I ST NW STE 1100 Washington DC 20006-4011 (p)
>> 202-407-8825 (f) 202-637-0968 [email-masked] PGP:
>> https://josephhall.org/gpg-key fingerprint: 3CA2 8D7B 9F6D DBD3
>> 4B10  1607 5F86 6987 40A9 A871
>> 
>> 
>> 
>> _______________________________________________ perpass mailing
>> list [email-masked]

---

From: Michael Richardson <[email-masked]>
Date: Tue, 22 Sep 2015 08:47:48 -0400

Brian Trammell <[email-masked]> wrote:
    > Crypto, Here's Why That Won't Work") that we can quickly tailor to the
    > details in order to be able to make constructive public comments

Sure, seems like a good idea.
One of those fill in the multiple-choice letters, like you get from
the school nurse :-)

I say this in jest, yet, I'm actually quite serious.

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: Joseph Lorenzo Hall <[email-masked]>
Date: Tue, 22 Sep 2015 11:18:34 -0400

I had started to draft something India-specific in the IAB Privacy and
Security Program last night before this withdrawal came up. I'll see
what we can do to pivot...