A Briefing On Public Policy Issues Affecting Civil Liberties Online
from
The Center For Democracy and Technology
(1) CDT Report Analyzes Public Policy Concerns About ENUM Technology
(2) What is ENUM, and Has It Been Deployed Yet?
(3) Policy Issues Raised by ENUM
(4) Recommendations for ENUM Implementations
ENUM, a technology protocol that may provide a critical tool in the more widespread adoption of "voice over the Internet" services, also poses risks to privacy.
CDT's Standards, Technology & Policy Project has issued a report analyzing a range of privacy and other public policy concerns raised by the ENUM protocol. The report sets out detailed policy recommendations that should be followed by national governments and service providers in any implementation of ENUM.
"ENUM: Mapping Telephone Numbers onto the Internet -- Potential Benefits With Public Policy Risks" is available at http://www.cdt.org/standards/enum/ [HTML] and http://www.cdt.org/standards/enum/030428analysis.pdf [PDF].
Additional information about CDT's Standards Project is available at http://www.cdt.org/standards/.
ENUM is a protocol that allows the translation of normal telephone numbers into a format that can be used to store and retrieve Internet addressing information, which can in turn be used to route communications over the Internet. With ENUM and "Voice over Internet Protocol" ("VoIP") technology, an increasingly amount of voice communications can be carried over the Internet instead of over the traditional telephone network. Initially, ENUM is likely to be deployed by corporations and other large institutions that seek to reduce their use of traditional telephone services (especially international and other long distance service). This technology has the potential to allow users -- corporations and individuals -- to save money and increase the choices they can exercise in their communications.
ENUM will facilitate the routing of telephone calls over the Internet, in a manner that is seamless to the end users. To place a call with ENUM, (1) a person dials a standard phone number on a normal telephone (or on a telephone-like device connected to a computer), (2) the computer or telephone system uses ENUM to check if the called number can be reached over the Internet using VoIP technology, (3) if the number can be reached, a VoIP call is initiated, and (4) if the number cannot be reached over the Internet, the call is routed to the traditional telephone network.
ENUM-compliant technologies and implementations are still in the development and testing stages. A number of nations around the world have initiated formal ENUM "test bed" implementations. The United States Department of Commerce has endorsed the U.S.'s participation in ENUM, and set out a series of guidelines to be met before formal tests or government-sanctioned implementations can proceed. Commercial deployment of ENUM services is likely to take place by the end of 2004.
ENUM's potential benefits also bring risks in terms of privacy and other public policy concerns. The simplest implementation of ENUM envisions that individuals' personal contact information (such as telephone numbers and e-mail addresses) will be stored in special records located in the Domain Name System (or DNS) of the global Internet. Because the DNS is publicly available, ENUM could significantly compromise the privacy of its users, and could lead to additional spam and other problems.
A more complex use of ENUM (in conjunction with a device called a "proxy server"), however, offers the opportunity to gain the benefits of ENUM without sacrificing control over personal information. To minimize the potential harmful effect of ENUM on privacy, it is vital that this second, more complex approach to ENUM be permitted and available in the marketplace.
Other important issues turn, for example, on (a) how much information individuals or companies will be required to provide in order to take advantage of ENUM, and (b) how much of that information will be revealed in a public database (similar to the "whois" database which reveals information about domain name holders).
In a different vein, ENUM raises a range of policy issues about how closely "ENUM numbers" should be tied to existing traditional telephone numbers.
One critical aspect of the global public policy issues surrounding ENUM is the fact that ENUM will, for the most part, be implemented within each country by the telephone authorities or companies that operate within that country. Thus, many critical decisions (for example, about how much information will be required to obtain an ENUM number) will be made on a country-by-country basis. It is critical that within each country, the relevant telephone authorities must closely consult with the public interest and civil society sector, the communications industry, and the computer industry.
To ensure that users can take advantage of ENUM without sacrificing privacy, any implementation of ENUM should follow a number of guidelines to ensure that there is a diversity of ENUM service providers and that those providers will be able to offer privacy-protecting ENUM options. CDT's report on ENUM details 14 specific policy recommendations. Among the specific recommendations are:
CDT's report on ENUM also provides a bibliography of references and links to ENUM resources and analyses.
Detailed information about online civil liberties issues may be found at http://www.cdt.org/.
This document may be redistributed freely in full or linked to http://www.cdt.org/publications/pp_9.09.shtml.
Excerpts may be re-posted with prior permission of ari@cdt.org
Policy Post 9.09 Copyright 2003 Center for Democracy and Technology
