Re: [ga] is your Internet connection secure from surveilance?

[Joe Baptista <baptista@dot-god.com>]

On Tue, 10 Sep 2002, Joop Teernstra wrote:

> On 12:28 p.m. 9/09/2002 -0400, baptista@dot-god.com said:
> >I have attached a draft PDF file addressed to Canada's privacy and
> >information commissioners which outlines my concerns respecting privacy
> >issues in root operations.
>
> Joe,
>
> With your letter to the Canadia authorities, did you not just commit a
> major violation of the privacy of those trusting Dieboldt customers?
> There is a major principle involved with your argument that the Romans knew
> as: "Nemo auditur turpitidinem suam allegans".

No .. not at all.  The running of a root server is a position of trust.  I
understand that perfectly.  And since PCCF never accepted by contract or
word to be put in a position of trust we don't consider this a privacy
violation.  You might say trust was forced upon us and we acted in the
best interests of the users.

The reason this happened was mainly due to diebold.  Diebold ran the root
servers without obtaining our permission.  Thats the first critical issue.

Everyone who operates a root knows roots are mapped via IPv4 numbers.
Therefore it is critical that root operators platform themselves on secure
infrastructure.  This is not an option - this is the rule.

Since we were not in a position to gurantee a secure infrastructure the
only means by which we could eliminate liability was to flush the root.
Which is what we did.

We explained this to diebold and we attempted to get their co-operation.
They had no interest.  back then diebold was a mess - probably still is.
and the problems were mainly internal - fighting between departments - so
the users were of no concern to them.

If diebold had acted then the logs would never of been made.  They exist
for legal reasons.  I'm sure being a lawyer you can figure out the rest.

> I.e. how do you expect internet users  to follow your logic and *trust*
> ,say, Mr Pacificroot, if you have just shown them what such unaccountable
> rogues can do with private individuals' data?

as far as i know pacroot operates roots on their own infrastructure.  the
diebold root was an orsc root server.  So the incident has no relationship
to pacroot.

> I'm not saying that they can trust Verisign or the USG.
> I'm saying that they can only trust those who offer them a mechanism of
> accountability.

I agree.  thats the whole point I'm trying to make.  trust is critical in
root operations.

regards
joe

--
This message was passed to you via the ga-full@dnso.org list.
Send mail to majordomo@dnso.org to unsubscribe
("unsubscribe ga-full" in the body of the message).
Archives at http://www.dnso.org/archives.html