Subject: Re: Last Call: <draft-allen-dispatch-imei-urn-as-instanceid-10.txt> (Using the International Mobile station Equipment Identity(IMEI)URN as an Instance ID) to Informational RFC

From: S Moonesamy <[email-masked]>
Date: Mon, 22 Jul 2013 10:42:00 -0700

At 07:35 19-07-2013, The IESG wrote:
>The IESG has received a request from an individual submitter to consider
>the following document:
>- 'Using the International Mobile station Equipment Identity(IMEI)URN as
>    an Instance ID'
>   <draft-allen-dispatch-imei-urn-as-instanceid-10.txt> as Informational
>RFC
>
>The IESG plans to make a decision in the next few weeks, and solicits
>final comments on this action. Please send substantive comments to the
>[email-masked] mailing lists by 2013-08-16. Exceptionally, comments may be

Section 4 describes the 3GPP use case as:

   "The mobile device includes its IMEI in the SIP REGISTER request
    so that the registrar can perform a check of the Equipment Identity
    Register (EIR) to verify if this mobile device is allowed or barred
    from accessing the network for non-emergency services"

The draft then argues that non-REGISTER requests except in case of an 
emergency.

In Section 5:

   'A UAC MUST NOT include the "sip.instance" media feature tag
    containing the GSMA IMEI URN in the Contact header field of non-
    REGISTER requests except when the request is related to an emergency
    session.  Regulatory requirements can require the IMEI to be provided
    to the Public Safety Answering Point (PSAP).  Any future exceptions
    to this prohibition require a RFC that addresses how privacy is not
    violated by such a usage.'

My reading of the above is there is a privacy violation but that 
violation is considered acceptable in the use case mentioned 
above.  Any other use case requires a RFC to be published.  There is 
an additional requirement; the RFC has to address how privacy is not 
violated.  It is an unusual requirement in a RFC.

 From Section 9:

   'In particular, the "sip.instance" media feature tag containing the
    GSMA IMEI URN MUST NOT be included in requests or responses intended
    to convey any level of anonymity.'

The above can be interpreted in various ways.  The problem might be 
that the draft builds upon RFC 5626 which states that "some other 
privacy concern requires that the UA not reveal its identity".  It 
may be better to state that there is a violation of privacy.

The draft does not discuss about the weakness of the mechanism or how 
what it proposes can be used for wiretapping.

Regards,
S. Moonesamy