I don't think I've made my point, so let me try again. On Mon, Dec 16, 2013 at 09:32:29PM +0000, Stephen Farrell wrote: > And don't forget that we are not here saying that all IETF > protocols MUST be proof against pervasive monitoring - email > for example isn't and we're not going to stop sending mail. Right, but the very same technical acts against an email stream are either an attack or a service, depending on the stuation from the POV of the users. For instance, many businesses scan all mail that comes and goes through the corporate servers in order to ensure certain legal compliance requirements are satisfied. The same style of scanning can be applied in an effort to look for "terrorists" or whatever. I claim that the first of these is not one of the forms of "attack", as long as the users affected know that this is happening (because, for example, the existence of the tool is disclosed as part of the corporate policies). When governments or $bigprovider or whoever does it without the user knowing, then it's an attack. But as written, the draft currently classifies the first of these cases as an attack also. I think that strains even the constrained meaning of "attack" as used in this draft. (I could equally be persuaded that the document just needs to embrace this odd consequence of the definition, and call it out.) Best regards, A -- Andrew Sullivan ajs@xxxxxxxxxxxxxxxxxx