Subject: Re: [sidr] two stranded docuemnts - stake time

From: Stephen Kent <[email-masked]>
Date: Mon, 1 Aug 2016 08:42:57 -0400

Tim,

>
> Although I appreciate that Randy is trying to explain the case in 
> terms anyone can understand, it would be preferable to keep it general.
agreed.
>
>> (Including a parenthetical note about the historical precedent of a 
>> Dutch court order involving RIPE is relevant and might be included.)
>
> If there was such a precedent, but there isn't. I have raised this 
> before, but again...
I am familiar with the incident. While it is true that the court did not 
order RIPE to do anything with RPKI data, the precedent it set has often 
been cited as an indication of what might happen in the future. That's 
why the adverse actions document identifies the following cause for some 
types of actions:

    There is also the possibility that a CA or repository operator may
    be subject to legal measures that compel them to generate "bogus"
    signed objects or remove legitimate repository data.

This is the sort of more formal language I have encouraged Randy to use 
in the LTA use cases doc, to no avail.

Steve

---

From: Tim Bruijnzeels <[email-masked]>
Date: Mon, 1 Aug 2016 16:34:02 +0200

Steve,

> On 01 Aug 2016, at 14:42, Stephen Kent <[email-masked]> wrote:
> 
> Tim,
> 
> 
>> 
>> Although I appreciate that Randy is trying to explain the case in terms anyone can understand, it would be preferable to keep it general.
> agreed.
>> 
>>> (Including a parenthetical note about the historical precedent of a Dutch court order involving RIPE is relevant and might be included.)
>> 
>> If there was such a precedent, but there isn't. I have raised this before, but again...
> I am familiar with the incident. While it is true that the court did not order RIPE to do anything with RPKI data, the precedent it set has often been cited as an indication of what might happen in the future. That's why the adverse actions document identifies the following cause for some types of actions:
> There is also the possibility that a CA or repository operator may be subject to legal measures that compel them to generate "bogus" signed objects or remove legitimate repository data.
> This is the sort of more formal language I have encouraged Randy to use in the LTA use cases doc, to no avail.

You will notice that I did NOT object to this being raised as a possibility as such.

I object to presenting a different case altogether as a precedent to support the impression that it's not a question of if, but when this will happen.

This is not constructive.

It would be lot more constructive to explain to law enforcers how such an action would be ineffective, and ultimately counter productive. Wording like this might help:

    Law enforcement would be ill-advised to take this cause of action as it will degrade the trust that
    operators place in the global RPKI. Not only can operators use local policy to circumvent the "bogus"
    objects - making it an ineffective measure, abuse of this power will also lead to operators choosing
    not to use RPKI at all. This in turn will mean that critical internet infrastructure will remain
    vulnerable to hijacks.

In short it should be made clear to "law enforcement" that there is no precedent, and that this is very much against their own interests. If they want to ban some traffic, there are much more reliable methods at their disposal, with much less collateral damage.

Tim

---

From: Stephen Kent <[email-masked]>
Date: Mon, 1 Aug 2016 12:33:18 -0400

Tim,

I agree that the preferred approach is to persuade law enforcement folks 
to not view the RPKI as a new tool for taking down sites. However, I 
have already encountered folks in the law enforcement community who 
viewed it as such. I have argued that this wold be bad, but ...

Given the nature of the cited court case I think it's hard to argue that 
a CA in the RPKI will _never_ be compelled to take action by law 
enforcement (or by national intelligence agencies, etc.). Thus I fear it 
really is a case of when, not if.

Steve

---

From: Randy Bush <[email-masked]>
Date: Tue, 02 Aug 2016 01:40:42 +0900

you may, or may not, notice that the current i-d does not mention
ripe/ncc

randy

---

From: Tim Bruijnzeels <[email-masked]>
Date: Tue, 2 Aug 2016 10:21:40 +0200

Hi Randy,

I did. Thank you very much.

Do you think that a notice to law enforcement about how this action would be ineffective and counter-productive has a place in your analysis? Something along the lines of what I suggested earlier:

I never denied that there will be some in LEA that look at RPKI as a knob to control routing. But rather than raising this as a given and misquoting a different incident as legal precedence (which again it just isn't in the legal sense - freezing contact data is a far cry from changing routing), it would be much better if the analysis made it very clear to LEAs that this is a very bad idea in the first place.

They really should care more about protecting critical infrastructure, governmental, military and civil - where a lot more is to be lost in security and economic damages if the technical community turns away from this technology, than there is to be gained by black-holing some traffic - ineffectively and temporarily.

And to operators it should be clear that the use of local policy or exceptions (e.g. SLURM) can be used to easily circumvent such actions.

Tim

> On 01 Aug 2016, at 18:40, Randy Bush <[email-masked]> wrote:
>