IETF Chair's Statement On Security, Privacy And Widespread Internet Monitoring

By Dan York

This weekend Jari Arkko, Chair of the Internet Engineering Task Force (IETF), and Stephen Farrell, IETF Security Area Director, published a joint statement on the IETF blog titled: "Security and Pervasive Monitoring”. They begin:

The Internet community and the IETF care deeply about how much we can trust commonly used Internet services and the protocols that these services use. So the reports about large-scale monitoring of Internet traffic and users disturbs us greatly. We knew of interception of targeted individuals and other monitoring activities, but the scale of recently reported monitoring is surprising. Such scale was not envisaged during the design of many Internet protocols, but we are considering the consequence of these kinds of attacks.

They go on to outline some of the IETF's general principles around security and privacy as well as some of the new developments. They also point out a vigorous (and still ongoing) discussion within the IETF around how to improve the security of the Internet in light of recent disclosures. They state:

As that discussion makes clear, IETF participants want to build secure and deployable systems for all Internet users. Indeed, addressing security and new vulnerabilities has been a topic in the IETF for as long as the organisation has existed. Technology alone is, however, not the only factor. Operational practices, laws, and other similar factors also matter. First of all, existing IETF security technologies, if used more widely, can definitely help. But technical issues outside the IETF's control, for example endpoint security, or the properties of specific products or implementations also affect the end result in major ways. So at the end of the day, no amount of communication security helps you if you do not trust the party you are communicating with or the devices you are using. Nonetheless, we're confident the IETF can and will do more to make our protocols work more securely and offer better privacy features that can be used by implementations of all kinds.

So with the understanding of limitations of technology-only solutions, the IETF is continuing its mission to improve security in the Internet. The recent revelations provide additional motivation for doing this, as well as highlighting the need to consider new threat models.

Jari and Stephen then provide several examples of ongoing work to improve Internet security and mention that the upcoming IETF 88 meeting in Vancouver in November will provide a dedicated time to address these issues. They also mention several open mailing lists to which anyone can subscribe, including the new "perpass" mailing list focusing specifically on this issue of privacy and pervasive monitoring.

I want to highlight one part of their post in particular (my emphasis added):

The security and privacy of the Internet in general is still a challenge even ignoring pervasive monitoring, and if there are improvements from the above, those will be generally useful for many reasons and for many years to come. Perhaps this year's discussions is a way to motivate the world to move from "by default insecure" communications to "by default secure". Publicity and motivation are important, too. There is plenty to do for all of us, from users enabling additional security tools to implementors ensuring that their products are secure.

Perhaps indeed we can move to communications "secure by default"! Please do read Jari and Stephen's post and please do consider how you can join in to helping improve the security of the Internet.