Subject: [p2p-sip] FCC on VOIP and SIP

From: dean.willis at softarmor.com (Dean Willis)
Date: Fri Sep 2 01:34:10 2005

I have it on good authority that Juha has been retained as a 
communications security consultant by the Department of Homeland 
Security, reporting at the highest levels of the Bush administration. 
Welcome to Washington, Mr. Heinanen!

On Aug 29, 2005, at 11:52 AM, Juha Heinanen wrote:
>>
>
> so far, but considering the recent past history, i would not be
> surprised if fcc or some other u.s. agency would issue regulation that
> makes it illegal to have ANY KIND of communication over the internet
> unless the parties positively identify themselves and route all
> signalling and media traffic via a government proxy.
>
> the next step is that every u.s. citizen must record all conversations
> they have at home, at office, on the street, etc. and submit the data
> once per day to a government agency unless they arrange a direct feed
> from their home or via mobile on the road.
>
> you see, once you start to obey these kind of fcc or other agency rules
> and start building protocols to support them, there is no limit on how
> far they go.  there is always the next requirement on their list once
> they have gotten the previous one.  so it is a high time to act now or
> your privacy is lost forever.
>

---

From: dean.willis at softarmor.com (Dean Willis)
Date: Fri Sep 2 01:40:29 2005

> The FCC specified in an August 5 release that VOIP providers that
> interconnect with the PSTN must facilitate wire taps within 18 months 
> of the
> release of the order. So at least the PSTN-connected "SkypeOut" 
> portion of
> Skype's business appears to be on the hook for compliance under the 
> CALEA
> laws.
>
The point is that true peer-to-peer isn't something one gets from a 
"VoIP provider". One gets an Internet connection, which is under an 
entirely different intercept regime, and then uses P2P-SIP over that, 
much as one might use a web browser or DDNS or IRC over that same 
connection.

When you start connecting through a centralized resource to the PSTN 
(aka "SkypeOut") it arguably isn't P2P anymore.

So, I'd argue that the aspects of things that are not P2P are not 
within the scope of discussion of the p2p-sip list. Unless they're just 
humorous, of course.

Now, if you want to talk about mechanisms that allow "sharing" of the 
phone-interconnects of everybody within the P2P community, then we 
might have something. It'd probably be something that would drive the 
enforcement authorities batty, but it might be in-scope for this list.

--
dean

---

From: kumarb at research.panasonic.com (Brijesh Kumar)
Date: Fri Sep 2 10:40:27 2005

Dean:

My information was primarily for providing information as to what is
required by law for VoIP communication (with SIP/P2P SIP or 
otherwise.)

Now - the legal requirements may not have any implications for the design
of protocols, but you would agree that they do have implications for those
that aim to deploy them for offering commercial services. If the P2P VoIP 
encrypts media end to end by default- that is the end story as far 
as meeting FCC  provision is concerned. I suppose that is one more less
use case (revenue stream to some) to deal with ;-) .  

cheers,

--brijesh

---

From: dean.willis at softarmor.com (Dean Willis)
Date: Mon Sep 12 15:53:24 2005

> required by law for VoIP communication (with SIP/P2P SIP or

I read your requirements as what applies to services offered by service 
providers. But the point of P2P is that the P2P function is mostly 
independent of the service-provider offering.

When Alice talks to Bob, neither the signaling nor the media traverse 
the "server platforms" of the P2P system. At most, we have a 
location-resolution operation that could be centrally logged.

Consequently, there are no and cannot be CALEA constraints for the 
service. At most, a subset of a "pen register" report on 
location-resolution operations could be provided.

Any actual intercept would have to be executed by the ISP at one end or 
the other, which is probably NOT the same party as the P2P organizer.

> use case (revenue stream to some) to deal with ;-) .

Sure, commercial services are going to have to have an understanding of 
this characteristic, but I don't believe we're going to change the way 
the protocols are specified so that they require the existence of an 
operator with strong CALEA responsibilities (a "telco").

--
Dean