- NANOG - lists.nanog.org

RE: [Fwd: [IP] Feds: VoIP a potential haven for terrorists]
by Hannigan, Martin 20 Jun '04

20 Jun '04

> -----Original Message----- > From: Sean Donelan [mailto:sean@donelan.com] > Sent: Saturday, June 19, 2004 8:39 PM > To: Hannigan, Martin > Cc: North American Noise and Off-topic Gripes > Subject: RE: [Fwd: [IP] Feds: VoIP a potential haven for terrorists] > > > On Sat, 19 Jun 2004, Hannigan, Martin wrote: > > Sean, the capacity requirements aren't as straightforward as you > > are interpreting them. > > You are absolutely correct, they are not that straightforward. You > should consult a telecommunications attorney with expertise > in this area > for legal advice. It's a law that has technical requirements co mingled so you need both lawyers and engineers. > > If you are a CLEC and you cover a full five state > > area in the Northeast, you probably are subject to a county > aggregate > > of a capacity requirement of 1500. > > No. The FBI is very clear, if you are a CLEC and cover a > full five state > area in the Northeast, you are subject to the CUMULATIVE > capacity require > for every county in those five states. > > See the www.askcalea.com web site for full details. I have. And I continue to disagree. [snip] > Individual carriers must provide sufficient capacity so that law > enforcement has the ability to simultaneously conduct any number of > call content interceptions, pen registers, and trap and > trace devices, > not to exceed the estimated actual and maximum > requirements (which are > based on historical interception activity) at any location within a > county. > Appendix A of the Final Notice of Capacity (63 Fed Reg 12217, > 12238) Which is what I defined. Sufficient capacity with capability to increase if needed. > > However, there is an exception, no single switch is required > to support > more than 386 simultaneous pen registers and trap and trace devices or > 75 simultaneous call content interceptions. What is a "switch?" That's what the federal register notice I pointed you at said. And in come cases, a single switch can carry a five state area. Softswitch comes to mind. > > http://www.askcalea.com/docs/capsecg.pdf > > Individual carriers can take the legal gamble and use other network > deployment strtegies, such as making assumptions of how many pen > registers, trap and trace and intercepts will occur on their network > versus a competitors network. Assume 95% of the court orders will go > to your competitors, so you only need to provide 5% of the capacity > in the county. But you can't escape the penalties by depending on your > competitor's capacity. You can't service a competitors legal orders so I'm not sure what you're getting at. You're almost saying "every carrier should have one DS0 for every single dialup user". > > The obligation to satisfy the capacity requirements in a > cost-effective andreasonable manner is the responsibility > of all carriers that operate within a given geographic area. > > How often do you see all the competitors in an industry sit down in a > room and decide how they will divide up the costs and > establish pricing? What has pricing intercepts have to do with concurrent intercepts? CLECS are not going to make money servicing legal orders. I doubt RBOCS make money doing it either. > > It's complicated, but noone is subject to a straight 1200+ capacity > > required. There were 1,442 NON FISA oral and electronic > intercepts in > > the entire United States last year.[2] > > Actually, they are expected to provide far more than that. They're expected to have the capability. So let me rephrase. They are subject. The actual and historic are relevant. > As you know, > the Wiretap report does not include pen registers. There is no public > source for the number of pen registers in the US, but some industry > sources estimate it at 70,000 to 75,000 per year. I'll check on the pen-register comment. You keep saying talk to a lawyer, but quoting legalese. Are you an attorney? Not being smarmy. Just curious. Hypothetical. How many bankrupt CLEC's do you expect to see this year complying with CALEA and providing, as an example, a fully loaded 1200 concurrent session infrastructure in a < 100 a year historically survielled area? N0TE: I am speaking from experience on the LEC side, nowhere else.

1 0

RE: [Fwd: [IP] Feds: VoIP a potential haven for terrorists]
by Hannigan, Martin 20 Jun '04

20 Jun '04

Sean, the capacity requirements aren't as straightforward as you are interpreting them. If you are a CLEC and you cover a full five state area in the Northeast, you probably are subject to a county aggregate of a capacity requirement of 1500. You would then look at your historicals, refer to the Federal Register for the actual maximum, and adjust your capacity as required to meet your own historicals and averages -- that also should take into consideration other RBOCs/CLECs operating in the same five state region as the orders will more than likely be broken out by access line % per carrier unless a single carrier dominates in a traditionally active area. In New York City and Los Angeles, the two most active areas, there was a mean average of .035 active electronic/oral intercepts per day. It's complicated, but noone is subject to a straight 1200+ capacity required. There were 1,442 NON FISA oral and electronic intercepts in the entire United States last year.[2] I have the Federal Register Notice if you want a copy. Let me know. [1] Federal Register Volume 63, No. 48 - March 12, 1998 NOTICE 12231 [2] 30 APR 2004 Press Release, Admin office of US Courts -M -- Martin Hannigan (c) 617-388-2663 VeriSign, Inc. (w) 703-948-7018 Network Engineer IV Operations & Infrastructure hannigan(a)verisign.com > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of > Sean Donelan > Sent: Saturday, June 19, 2004 4:24 PM > To: Steven M. Bellovin > Cc: North American Noise and Off-topic Gripes > Subject: Re: [Fwd: [IP] Feds: VoIP a potential haven for terrorists] > > > > On Sat, 19 Jun 2004, Steven M. Bellovin wrote: > > There's a lot more to it than that -- there's also access without > > involving telco personnel, and possibly the ability to do many more > > wiretaps (have you looked at the capacity requirements lately), but > > funding is certainly a large part of it. From Section (e) of > > http://www4.law.cornell.edu/uscode/18/2518.html : > > > > Any provider of wire or electronic communication service, > > landlord, custodian or other person furnishing such facilities > > or technical assistance shall be compensated therefor by the > > applicant for reasonable expenses incurred in providing such > > facilities or assistance. > > That is not part of CALEA. > > Carriers found to be covered by CALEA must provide certain > capabilities > to law enforcement. For telecommunication equipment, facilities or > services deployed after January 1 1995 the carrier must pay > all reasonable > costs to provide the capabilities. > > The capacity requirements are interesting. In some cases, > the carrier is > required to have more law enforcement tapping capacity than customer > capacity. The government sets the capacit requirements without any > regard for the cost of maintaining the capacity. If there > are multiple > competitive carriers in the same area, all of the carriers > must have the > same capacity. If you have a single customer in Los Angeles, you must > provide the capacity for at least 1,360 simultaneous > interceptions. How > many SPAN ports do you have? > > As I mentioned, the wiretap acts and CALEA are really independent. >

2 1

Re: Verisign vs. ICANN
by Paul Vixie 19 Jun '04

19 Jun '04

> Just curious. How much would it differ from > > http://www.amazon.com/exec/obidos/redirect?tag=icannwatch-20&path=tg/detail… > > and > > http://www.law.miami.edu/~froomkin/articles/icann.pdf as i said, it can't be written by an ambulance-chaser or nobody will pay attention.

1 0

RE: [Fwd: [IP] Feds: VoIP a potential haven for terrorists]
by Hannigan, Martin 19 Jun '04

19 Jun '04

It's not just a funding bill. It provided $500MM for carrier network upgrades and for switch software compliance. That fund has been exhausted from what I have been told. It also clearly defined technical expectations that carriers and manufacturers have to live up to. All that being CALEA compliant means is that you are capable, as required, to provide service to a legal order i.e. pin register, trap, trace, DTMF extration, flash hook operations ala three way calling, CALLER ID, and voice intercept. There's no "secret sauce" to CALEA. CALEA doesn't expand LEA's authority, it puts them on an even playing field with suspected criminals with regards to access. -M -- Martin Hannigan (c) 617-388-2663 VeriSign, Inc. (w) 703-948-7018 Network Engineer IV Operations & Infrastructure hannigan(a)verisign.com > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of > Sean Donelan > Sent: Saturday, June 19, 2004 1:49 AM > To: Stephen Sprunk > Cc: North American Noise and Off-topic Gripes > Subject: Re: [Fwd: [IP] Feds: VoIP a potential haven for terrorists] > > > > On Fri, 18 Jun 2004, Stephen Sprunk wrote: > > I'm told that most CALEA warrants only authorize a pen > register, not an > > CALEA and wiretaps are independent subjects. You can have CALEA > obligations even if you never, ever implement a single wiretap. On > the other hand you may need to implement many wiretaps even though > you have no CALEA obligations. > > For example, hotels and universities have traditionally been > considered > not to have CALEA obligations. However, both hotels and > universities must > comply with court orders if law enforcement wants to wiretap > one of their > phones. Should CALEA be extended to hotels and universities? > Are hotels > and universities broadband Internet providers when they offer Internet > service in student dorm rooms or hotel rooms? > > In reality, CALEA is a funding bill; it has very little to do with > technology. Imagine if law enforcement thought DNA testing was too > expensive, so Congress passes a law requiring all doctors to purchase > DNA testing equipment and provide free DNA tests to law enforcement. > DNA is a complicated subject. Few police officers are qualified to > analyze DNA. Instead law enforcement pays for professional DNA testing > when it needs DNA testing. > > The FCC comment period has closed. Everyone had an > opportunity to submit > comments on the topic to the FCC. > > Consult your own attorney if you want real legal advice. >

1 0

Re: Verisign vs. ICANN
by Peter H Salus 19 Jun '04

19 Jun '04

I will admit to only thinking about this for a few days. However, it seems to me that the Harvard material is rather narrowly focussed both on a temporal and on a topical level. I am an admirer of Froomkin's essays, and have published at least one of them (in the distant past when Matrix News was published). I haven't really looked at Ruling the Root, because I was turned off by Dave Crocker's review in IPJ. But, anyway, as it appeared in 2002, I imagine it contains little of the recent Verisign/Netsol "business." However, I should most likely give Mueller more leeway, as I really liked his telephony book. Peter

1 0

Re: Verisign vs. ICANN
by Peter H Salus 19 Jun '04

19 Jun '04

Paul (et al.), If you can find a willing publisher and an organization able to supply some funds, I would be delighted to work on a "real" history of Internet "governance" since RFCs 881-883. (Most of the funds would be for travel, Xeroxing, etc.) Peter --------------------------------------------------------- Peter H. Salus, Ph.D. 40 IH 35 N #4A3 Austin, TX 78701 consultant & author peter(a)netpedant.com +1 512 478-7562

3 2

ARIN whois server offline ?
by Mike Tancsa 19 Jun '04

19 Jun '04

Reachability to the network seems OK, but the server seems to time out. marble% whois -h whois.arin.net 220.175.8.27 whois: connect(): Operation timed out marble% marble% traceroute whois.arin.net traceroute to whois.arin.net (192.149.252.43), 64 hops max, 44 byte packets 1 iolite4-fxp2 (199.212.134.10) 0.114 ms 0.105 ms 0.090 ms 2 tor-hespler-360-mica (64.7.143.42) 3.105 ms 3.365 ms 3.691 ms 3 h66-59-189-97.gtconnect.net (66.59.189.97) 4.509 ms 4.644 ms 3.871 ms 4 216.18.63.93 (216.18.63.93) 15.021 ms 14.774 ms 15.044 ms 5 POS4-0.PEERA-CHCGIL.IP.GROUPTELECOM.NET (66.59.191.86) 14.175 ms 14.009 ms 14.556 ms 6 p4-6-2-0.r01.chcgil01.us.bb.verio.net (129.250.10.97) 14.892 ms 14.477 ms 14.667 ms 7 p16-2-0-0.r01.chcgil06.us.bb.verio.net (129.250.5.70) 14.680 ms 14.497 ms 14.477 ms 8 POS5-2.BR3.CHI2.ALTER.NET (204.255.174.233) 15.266 ms 15.298 ms 14.956 ms 9 0.so-5-2-0.XL2.CHI2.ALTER.NET (152.63.68.6) 15.469 ms 14.989 ms 15.546 ms 10 0.so-0-0-0.TL2.CHI2.ALTER.NET (152.63.68.89) 15.618 ms 15.804 ms 16.736 ms 11 0.so-3-0-0.TL2.DCA6.ALTER.NET (152.63.19.170) 34.436 ms 34.240 ms 34.352 ms 12 0.so-7-0-0.CL2.DCA1.ALTER.NET (152.63.32.181) 34.680 ms 35.498 ms 35.267 ms 13 194.ATM5-0.GW4.DCA1.ALTER.NET (152.63.37.65) 35.113 ms 35.455 ms 35.452 ms 14 arin-gw2.customer.alter.net (65.207.88.74) 110.848 ms 37.177 ms 38.229 ms 15 *^C marble% -------------------------------------------------------------------- Mike Tancsa, tel +1 519 651 3400 Sentex Communications, mike(a)sentex.net Providing Internet since 1994 www.sentex.net Cambridge, Ontario Canada www.sentex.net/mike

1 0

where is whois.arin.net?
by Jon Lewis 19 Jun '04

19 Jun '04

whois.arin.net appears to have been down for at least the past hour or two. Anyone know what happened or an ETR for it? ARIN seems to block ping/traceroute at their border, but www.arin.net is still usable. The web frontend to whois at www.arin.net seems nonfunctional at this time as well. ---------------------------------------------------------------------- Jon Lewis | I route Senior Network Engineer | therefore you are Atlantic Net | _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________

1 0

Network Performance Testing Equipment
by Vicky 19 Jun '04

19 Jun '04

Hi there, Just wondering what folks out there have used or are using (such as smartbits, etc) for measuring the performance (benchmark) limits for engineering and qa testing. I'm looking at doing end-to-end performance testing to monitor throughput for networking gear. Any insight to this topic will be appreciated. regards, /vicky

4 3

Re: Verisign vs. ICANN
by Gordon Cook 18 Jun '04

18 Jun '04

>Anything I/we can do to help the cause? > >Bob Martin yes..... I almost missed this one. There are few entities for which i have more contempt than ICANN. But verisign heads the more contempt than ICANN list by several orders of magnitude. in my estimation it would like to control telecom by control of the numbers associated therewith. In addition to the present issue which owen de long described here masterfully last fall, verisign's alliance with EPC global at some point in the future could give it huge power in supply chain rfid numbering systems. Finally there is something doing in the voip area that i am not clear on at all but which i didn't like the sound of when i read the description. I am tying to stay away from this cesspool. It brings no income - only grief. But, knowing what i know, i am remiss if i don't stick my head up here. I go waaayyyy back with network solutions to 1994 actually and i keep damned good archives. If I can assist Paul or the anti-verisign part of this case in building the details of the history of who did what to whom, I gladly will do so > >Quoted from different thread: > >>(note that verisign has amended their complaint against icann (since the >>court dismissed the first one) and i'm now named as a co-conspirator. if >>you reply to this message, there's a good chance of your e-mail appearing >>in court filings at some point.) >>-- Paul Vixie -- ============================================================= The COOK Report on Internet Protocol, 431 Greenway Ave, Ewing, NJ 08618 USA 609 882-2572 (PSTN) 703 738-6031 (Vonage) Subscription info & prices at http://cookreport.com/subscriptions.shtml Report on economic black hole of best effort networks at: http://cookreport.com/13.04.shtml E-mail cook(a)cookreport.com =============================================================

3 3