December 2003 - cypherpunks-legacy

Feasibility of censoring and jamming pronography and racism in informatics
by 3umoelle＠informatik.uni-hamburg.de 17 Dec '03

17 Dec '03

A European parliament study evaluating `Feasibility of censoring and jamming pronography and racism in informatics': "SUBSCRIBER PROTECTION: In this scenario [...] it would be necessary for access providers to use firewall and PICS technology (in some instances implemented with in proxy applications) to implement a management regime consistent with provisions for protection of society as in other media, ie media parity. Implementation on this basis would be necessary to ensure subscribers could not tamper with management settings. The impact of implementing the necessary technology on the operating economics of access providers appears to be small. That technologies of these types have already been employed by access provider organisations [...] could potentially be considered to confirm this." From: kris(a)koehntopp.de (=?ISO-8859-1?Q?Kristian_K=F6hntopp?=) Newsgroups: de.soc.zensur Europarl: STOA Homepage http://www.europarl.eu.int/dg4/stoa/en/default.htm Europarl: STOA Publications http://www.europarl.eu.int/dg4/stoa/en/publi/publi.htm Europarl: STOA Workplan 1996 http://www.europarl.eu.int/dg4/stoa/en/wp96.htm A. Information and telecommunications policy options A.LP.2 INTERNET AND MULTIMEDIA IN THE INFORMATION SOCIETY (In cooperation with the specific research programme of DGIV: REX/Internal Market/New technology/STOA) Sub-projects: (iv) Technical feasibility of jamming or censoring pornography and racism in informatics - Civil liberties ------------------------------------------------------------------------------ STOA European Parliament * Batiment Schuman Bureau 4/82 L-2929 Luxembourg Luxembourg Phone: +352 4300-2511 Fax: +352 4300-2418 * Batiment Eastman Bureau 113 B-1047 Brussels Belgium Phone: +322 284-3747 Fax: +322 284-9059 Email the STOA Team in Luxembourg at _STOA(a)europarl.eu.int_ Email the STOA Team in Brussels at _ksercu(a)europarl.eu.int_ ------------------------------------------------------------------------------ This document is a working Document for the 'STOA Panel'. It is not an official publication of the STOA. This document does not necessarily represent the views of the European Parliament. Feasibility of censoring and jamming pronography and racism in informatics ***DRAFT*** Final Report Luxembourg, May 1997, PE number: 166 658 <del del del> 7 Conclusions 7.1 Technical Feasibility 7.1.1 The central question posed to this study is whether it is technically feasible to use the content managment technology to censor and jam pornography and racism on the Internet. 7.1.2 It is concluded that available technology does no and is not likely to provide any satisfactory means for automatically classifying such material. Such judgements will therefore have to be made by humans. 7.1.3 Once such judgements are made, however, technology provides for these judgements to be distributed and used by content managment systems to make the following content managment actions feasible (in principle) to a high degree: - subscriber choice, in that individuals can choose the extent to which they permit or exclude such material on their own behalf or on behalf of others for whom they have responsibility; - subscriber protection, in that precautions against unintentional or unsolicited exposure to such material can be implemented as defined by statute or other form of code or regulation; - prevention of Internet abuse, in that it is possible to detect the exchange of such material within closed groups of offenders to a very substantial extent; - detection of offenders, in that offenders can be identified when offences have been detected or notified involving sites and services where the user has explicitly authenticated identity; - flexible and multi-cultural implementation of content management, in that content management policies can be defined: - to meet the requirements of very small subscriber groups, eg. selected subscribers or a selected group of terminals; - differentially for different types of Internet service, eg Web access and e-mail; - to meet the needs of one culture with respect to the material originating from another without the cooperation of the originator; 7.1.4 The principal technical limitations in these capabilities are: - automated content classification systems can not, because of the complexity of legal definitions, identify Internet content to be racist, pornographic, illegal or harmful - hence this classification must be made by human judgement; - the potential flexibility and coverage offered by the technology can not be achieved in full, at present, because - currently implementations of the key technology (PICS) in Internet applications is incomplete and hence the ratings information can not yet be used to manage all types of Internet content explicitly; - ratings databases are currently incomplete in terms of the types of service they consider and the full range of Internet services available; - it can not be absolutely guaranteed that Internet anonymity services can not be used to frustrate detection of offenders in certain circumstances. 7.1.5 The principal practical issues involved in implementing these technologies are: - defining rating systems which are sufficiently explicit regarding content managment requirements to allow automatic content management whilst still being: - practical to apply to large volumes of information; - meaningful outside the culture in which they are originally applied; - funding the large effort required to categorise the huge and growing volumes of Internet content. 7.2 Implications of policy scenarios 7.2.1 The study investigated the following policy scenarios: Subscriber choice 7.2.2 In this scenario, essentially the status quo, subscribers would either coose to exercise explicit controls over their Internet experience, eg through the use of parental control software, or not. Potentially, subscribers could elect to implement management regimes consistent with privision for protection of society as in other media, ie to provide media parity, but this could not be enforced. 7.2.3 Currently, the technical capability of these products is increasing as vendors invest in the development of new facilities. In the longer term, however, it is not clear that the current subscriber uptake of such tools (on a purely discretionary basis) will sustain their development or the maintenance of databases upon which they depend on a long term basis. 7.2.4 The principal social objection to this policy scenario is that it does not in any way act to reduce abuse either on the Internet or in the 'real' world. The principal legal issue which arises is that it does not provide for media parity. Subscriber protection 7.2.5 In this scenario, subscribers would continue to have the option to exercise management controls accordings to their preferences - potentially including screening unsolicited communications from 'strangers' or anonymous sites. In addition, however, it would be necessary for access providers to use firewall and PICS technology (in some instances implemented with in proxy applications) to implement a management regime consistent with provisions for protection of society as in other media, ie media parity. Implementation on this basis would be necessary to ensure subscribers could not tamper with management settings. 7.2.6 The impact of implementing the necessary technology on the operating economics of access providers appears to be small. That technologies of these types have already been employed by access provider organisations (without discernible impact on end-user charges) could potentially be considered to confirm this. 7.2.7 The principal legal issues which arise in this scenario are: - the liabilities of those who apply labels to content provided by others; - the liabilities of those who are charged with implementing content management on the basis of labels applied by others; - the potential for content labelling providing a legal obstacle to free trade. 7.2.8 These legal issues potentially have substantial social impact in that: - if liabilities are potentially large, those who accept them, either through compiling ratings databases or providing Internet access service, are likely to be very conservative with respect to the material with which they will deal; - international e-commerce in certain services may be compromised by nations exploiting differences in ratings procedures as a pretext for blocking material originating from other countries. Preventing Internet abuse 7.2.9 It is concluded that only implementation of the most intrusive surveillance technology could be exspected to impact heavily upon abuse of the Internet on committed offenders (because of their ready access to strong encryption and covert communication technologies). To enable this policy scenario, it would be necessary for access providers to constrain the equipment used by subscribers to access the Internet to be such that: - no content could be removed; - all content and processing could be subject to automatic and manual surveillance. 7.2.10 The technical and economic feasibility of the necessary technology is evidenced by the emergence, with purely commercial motivations, of technical systems which privde the basic facilities required to implement the necessary measures. It is notes that this coincidental emergence of such systems may raise siginificant privacy issues outside of the scope of this study. The economics of manual surveillance, however, can not be assessed. 7.2.11 This technical approach is, however, completely non-specific in the terms of the subject of censorship which could be implemented and in the scope of (potentially private) material to which surveillance access would be required. It therefore seems highly unlikely that, when the commercial implications, legal obstacles and social objections are considered, application of this technology in this way can be considered a proportionate general response. 7.2.12 Finally, it seems highly probable that the principal of impact of implementation of these measures, if they were to be implemented generally and were found to be effective, would be to displace abuse to other communications means. Detecting offenders 7.2.13 If access providers and service providers maintain proper subscriber authentication systems and system management environments, offending actions at the site to which the subscriber authenticates can be traced to the offender. Detection of offenders committing offences 'at a distance' (ie a subscriber in a country committing an offence in another), however, would require: - access and service providers to take steps to ensure subscriber identity information is carried in their transmissions; - monitoring of services provided on the Internet to prevent subscribers misusing anonymity services to remove such information. 7.2.14 Whilst a variety of means exist to attach identity information, detection of anonymity services is not straightforward. However, monitoring such services would be exspected to limit the number available for overt, eg to transmit offensive material to innocent parties, offensive use. 7.2.15 Legally, handling offences detected through voluntary authentication would be relatively straightforward as the offending subscriber would be resident in the country where the offence was committed. However, offences can only be detected through forced identification, ie those committed 'at a distance', would currently be subject to extradition arrangements and it is not clear that new opportunities for prosecution would arise in practice. Meanwhile, it may be that the social implications of forced and general identification of Internet subscribers would leave subscribers open to a variety of forms of intrusion on privacy and discrimination. 7.3. Options for action at Member State level 7.3.1 It is concluded that, in technical terms, Member States could implement combinations of the technical measures identified in this report according to their own perceptions of harm and proportionality of response in accordance with principles of media parity. This could, technically, be achieved without the cooperation of any external party and provide for different levels of content management according the requirements/vulnerabilities of individual subscriber groups. 7.3.2 The principal potential implications for a member state adopting measures at variance with international norms would be: - obtacles to free trade, including possible infringement of Single Market requirements; - reduced availability of Internet content; - having to bear the costs of maintaining classifications of Internet content alone. 7.4 Options for action at European level 7.4.1 It is concluded that cooperation at the European level could mitigate the implications of uni-lateral action by Member States if action were taken to establish a common content management system. This would comprise: - technical standards in the definition of rating systems to minimise costs of researching Internet content and spread them over the largest possible population; - regulations for harmonisation in the application of agreed standards to ensure that their use did not lead to artifical obstacles in trade; - technical standards in the implementation of content selection mechanisms in Internet applications to ensure that ratings information can be used in a consistent and appropriate way.

3 2

Re: Why Key Escrow (GAK) is So Bad
by goedel＠tezcat.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >At 10:22 9/7/95, Timothy C. May wrote: >>(Ironically, I just heard about a case in Texas where a judge ordered a >>mother to stop speaking in Spanish to her child at home, calling it "child >>abuse." The implications of this are self-evident.) > >You have the facts slightly wrong. The order was no to stop talking Spanish >and to use English but only to Not use Spanish EXCLUSIVELY but to also use >English (so as to allow the Child to Grow up in a Bilingual Environment). >Waiting until the child was old enough to go to school would put the Child >at a disadvantage in learning English since the window of Chance for >Language Skill Pickup would have closed. (drifting wildly off topic...) Consider me exhibit A that speaking only German in the home until age 17 does not diminish ones language skills. In fact, (drifting...) it was only until I began speaking English to the exclusion of German that my language skills began to decline. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBgAwUBMFAVMnIf3YegbdiBAQGHEQJWLnmpNDvyxYnj92AB+nQXcR3ys0TorYVQ EoIAJAi+hyARme8291R7Ky6PeCdGNXOlEVpdVchh2MO/rpgI/Zn1OwjaPMpFrFZd 1ph7 =M/sp -----END PGP SIGNATURE----- Dietrich J. Kappe | Red Planet http://www.redweb.com/ Red Planet, L.L.C.| "Chess Space" /chess 1-800-RED 0 WEB | "MS Access Products" /cobre Web Publishing | PGP Public Key /goedel/key.txt

1 0

Key Escrow Papers via FTP
by Alan Olsen 17 Dec '03

17 Dec '03

The papers on Key Escrow scanned by John Young are available for FTP from: ftp://ftp.teleport.com/pub/users/alano/nist.zip They have been seperated into seperate text files (7 in all). I will have an HTML version available from my web page soon. (I am in the process of converting the text to something HTMLlike.) Comments/flames/etc can be sent my way, to John Young (jya(a)pipeline.com) and/or to /dev/null (davenull(a)netscape.com) Enjoy! | Visualize whirled keys | alano(a)teleport.com | |"It's only half a keyserver. I had to split the | Disclaimer: | |other half with the government man." - Black Art | Ignore the man | | -- PGP 2.6.2 key available on request -- | behind the keyboard.| | http://www.teleport.com/~alano | <fnord> |

1 0

Legality of Cash Transactions
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 12:05 AM 9/8/95, Tobin T Fricke wrote: >>letting it happen, and using cash instead of credit, is the smart answer > >I'm somewhat surprized at how much of an issue this is. The >federal government prints up nice green paper for us to pay for >things with. It's annonymous (to a large extent), univerally >accepted (most of the time), fairly untracably (unless you >really want to), easily available, doesn't collect interest, >free to use, etc. No one is forcing anyone to use credit >cards, etc.. Then again, being a kid, I have never bought >anything with anything other than cash on the spot... I agree with what I think your sentiment is, but bear in mind that "cash transactions" are in fact limited by various laws and regulations about reporting cash payments. Try buying a car with cash, especially a car costing over $10,000. Black Unicorn posted an account a while back (sometime last year) of his efforts to pay cash for a new car. The restrictions on cash are mostly oriented toward ostensibly stopping "drug profits" from being used to buy expensive items. The usual cash figure that invokes special laws is $10,000, with "structuring" of sub-$10K cash transfers an additional issue. I foresee more restrictions coming, not fewer. Several of us have written extensively on this subject. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1

VOLUNTEERS NEEDED for keying in Bernstein docs
by Stanton McCandlish 17 Dec '03

17 Dec '03

Our copies of the Bernstein case docs are too low-quality to scan, so we're asking for volunteers to help key them in. Most of you all can type fast and could probably spare a few minutes. If you'd like to help with a page or more please drop me a line and tell me how many pages you'll do, and I'll assign you some page numbers. We have images of the docs from a captured fax at http://www.eff.org/bernstein/Legal/970825_decision.images/ and http://www.eff.org/bernstein/Legal/970827_stay_motion.images/ Thanks for any help! -- Stanton McCandlish mech(a)eff.org Electronic Frontier Foundation Program Director http://www.eff.org/~mech +1 415 436 9333 x105 (v), +1 415 436 9333 (f) Are YOU an EFF member? http://www.eff.org/join

1 0

NIST notes available
by pfarrell＠netcom.com 17 Dec '03

17 Dec '03

Thanks to John Young, I have placed the test of the handouts from Wedensday's and Thursday's meetings on my Nist pages. url: http://www.isse.gmu.edu/~pfarrell/nistmeeting.html It is my belief that this meeting was a staged presentation. Nearly every industry representative said that this was a fatally flawed idea. It was "a non-starter." The government representatives said that they heard the comments, but insisted on proceeding. The most depressing presentation was Thursday morning, made by a high level Dept of Justice flack. I'll have to dig out my notes, his name was Geoff G... He presented the usual drug dealer, pedophile and terrorist line, and added corrupt government officials. He pretended to talk about foriegn bad guys. Nearly all were domestic. He clearly wants weak GAK so that he can decrypt anything domestically that he wants. It is clear to me that the government intends that industry provide crippled encryption "for export" with the never stated expectation that since industry has repeatedly said that they want only one version of products, capable of being sold worldwide, that Domestic products will be crippled. It is equally clear from representatives of IBM, Compaq, DEC, Lotus, and others that I talked to, that crypto product development will simply move offshore. Ireland, Israel, and Germany already have significant experience in developing commercial software. It is depressing to hear our Commerce department chasing technology and jobs overseas. GAK is bad enough. Weak GAK makes me gag. Pat Pat Farrell grad student http://www.isse.gmu.edu/students/pfarrell Infor. Systems and Software Engineering, George Mason University, Fairfax, VA PGP key available via finger or request #include standard.disclaimer

1 0

Re: fast modular reduction (proof?)
by danisch＠ira.uka.de 17 Dec '03

17 Dec '03

Oops, sorry for sending it twice. After the first mail I got an error message which said the mail wasn't delivered because it contained control characters. I thought the first mail didn't go out. Hadmut :-(

1 0

Want to help put Judge Patel's decision on the web?
by John Gilmore 17 Dec '03

17 Dec '03

We tried running it through OCR software and the results were worse than just typing it in. So we're asking for your help. Please pick a random page of the document and type it in as ordinary text. We'll proofread it and fix up the strange characters and such. Mail the result to me (gnu(a)toad.com) and post a one-line note to cypherpunks that says "Patel decision page XX handled". If a few get typed twice, it'll be useful for proofreading anyway. The document is on the Web at http://www.eff.org/pub/Legal/Cases/Bernstein_v_DoS/Legal/970825_decision.im… We reworked the original fuzzy images so they're much easier to read now. But that's still no substitute for real, searchable, small, ordinary text. Please type it like this: * Break the lines in the same place as in the original text. * That funny "S-like" squiggle translates as "Sec." (for section). * That funny "P-like" squiggle translates as "Para." (for paragraph). * Any other stuff you don't understand, do your best, then add "XXX", which we'll search for and fix up. Thanks to everyone who helps! John

3 13

Cypher Rant II: Why Private Cryptography should not be regulated.
by Paul Elliott 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- CypherRant V2: Reasons why private cryptography should not be regulated. Paul Elliott is solely responsible for this document. Please distribute widely. FBI director Freeh has been going around pushing his stupid plans for cryptography regulation. Usually, these plans take the form of some kind of mandatory key escrow. Mandatory key escrow schemes are requirements that encryption keys be given to government agencies with the promise that the keys will not be used without a warrant. Now let me give some reasons why Freeh's requests should be ignored. 1) It is unconstitutional! a) First amendment. Electronic communications are a form of speech and the cryptography regulations try to regulate this speech to a form the government understands. Congress shall make NO LAW ....or abridging the freedom of speech or of the press; ... They really meant it! b) Second amendment. Cryptography is arms. Even U.S. government ITAR regulations admit this. Therefore cryptography is protected by Second amendment. c) Ninth & tenth amendments. Article I section 8 does not give congress the power to tell us what computer software we can run on our computers. Therefore that power remains with us, and we should be able to run whatever cryptography software we want the displeasure of congress not withstanding. d) The power to search, if a warrant exists, which is mentioned by the fourth amendment, does not grant the government the right to succeed in finding what the it is looking for. In other words the power to search, is not a power to guarantee a successful search. It is not a power to require citizens to run their lives in such a manner that any government search will be successful. For more information on this, see the following World Wide Web url: http://www.clark.net/pub/cme/html/avss.html Since all Senators and Congressmen take an oath to preserve and defend the constitution of the U.S., this should be the end of the argument. However, watching some of the stupid laws that have come out of congress in past years, tells me I should supplement the above with additional argument. I am not a lawyer and I am not trying to be one. I have no opinion as to whether private cryptography regulations will be found unconstitutional. There are a number of cases where out courts have made decisions which do great violence to the plain meaning of the text of our constitution. Knowing what the courts will actually do is the business of lawyers. Understanding the constitution so that one may know what the courts should do should be the business of every citizen. 2) The excellent NRA argument "when guns are outlawed only outlaws will have guns" applies with equal force to cryptography! Professional criminals will circumvent with ease any government regulations on cryptography. Billions of bytes travel the internet yearly. The techniques of steganography make it absolutely trivial for any motivated person to conceal any encrypted messages. The Big Brother cryptography regulations will affect only ordinary citizens. 3) Cryptography is already in use by legitimate business. Any government regulation of cryptography will probably cost huge amounts of money for software and hardware costs for existing systems to be changed to a form that the government approves. The existing ITAR regulations probably cost the U.S. economy large amounts of money because U.S. companies can not market cryptography software internationally. For information, see: http://www.eff.org/pub/Crypto/ITAR_export/tis_walker_export_101293_hr.testi… By discouraging private cryptography, the ITAR regulations probably enables a large amount of computer crime since it makes it difficult for people to protect themselves. The ITAR regulations have not and can not prevented strong cryptography from making it outside the U.S. How many tons of cocaine illegally enter the U.S. every year? Yet the government ITAR regulations propose to regulate the export of software that can fit in a shirt pocket, or travel by wire concealed with billions of bytes of data that leave the U.S. every year. It is time for the U.S. government to start living in the real world! According to an article in the August 17, 1995 Wall Street Journal, ITAR regulations have required Netscape to use inferior encryption methods in the international version of its World Wide WeB browser software. This inferior encryption method has actually been broken by a French Hacker! Because of its computational intensity, this weakness in the encryption method does not represent an immediate danger. However as more powerful computers continue to develop, this and similar vulnerabilities will present a danger for those who wish to use the internet for commerce. For more information, see: http://pauillac.inria.fr/~doligez/ssl/ 4) These regulations make it impossible for an individual to have greater privacy than the U.S. government. The Adlrich Ames case makes it clear that the U.S. is incompetent to keep a secret. 5) The proposed regulations require the American people trust the government, but on the contrary, the government should be required to trust the American people. Recent news stories (Waco ect.) make it clear that it is common for government agents to lie to get a search warrants. Government should be viewed as George Washington did as "a fearful servant and a dangerous master". A recent poll conducted by the Americans Talk Issue Foundation said 76% of the people questioned responded that they rarely or never trust "government to do what is right". This mistrust is well founded. At the same time as administration sources were saying that key escrow schemes would remain voluntary, FBI, NSA, and DOJ experts were saying that the schemes must be made mandatory if they were to be at all effective. If the government is willing to lie to establish a key escrow key system, what makes us believe that the government will not lie when applying for warrants to use that system? For more information on this, see: http://www.efh.org/pgp/fbilie.html If any key escrow system is adopted, the secret FISA court will undoubtedly be given the power to issue warrants for decryption keys. The FISA court has granted over 7,500 wiretap requests in complete secrecy with only one refusal. The secrecy of this court creates a great opportunity for abuse. If the court is lied to, the lie is not exposed, because the people with an interest in exposing the lie do not know the lie exists. If the court grants legally unwarranted warrants, there is no one to appeal or to try to stop the practice, because no one knows about the problem. For information, see: http://MediaFilter.org/MFF/CAQ/caq53.court.html 6) It is too humiliating to require a free people to participate in the establishment of their own surveillance prisons. This is what key escrow requires. Consider the words of our revolutionary heritage: Those who would sacrifice essential freedoms for temporary safety deserve neither. Benjamin Franklin If ye love wealth greater than liberty, the tranquility of servitude greater than the animating contest for freedom, go home from us in peace. We seek not your counsel, nor your arms. Crouch down and lick the hand that feeds you; and may posterity forget that ye were our countrymen. Samuel Adams Do you think that these men would approve the government's key escrow requests? This information can also be found at the following url: http://www.efh.org/pgp/rant.html - -- Paul Elliott Telephone: 1-713-781-4543 Paul.Elliott(a)hrnowl.lonestar.org Address: 3987 South Gessner #224 Houston Texas 77063 -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBMFA5K/BUQYbUhJh5AQGOjAP+OyDEtAJGL32S8IK+HGAfaOTkpCI18SCL QvSTaknPd5J2m+yzamGD88Z2YJKwW1M+2GgqGqsclCpI+KCvSp2Z9h1KXWT6ANGR MXTuK3fjVmlvp5lqZAwHb133qL97e60MIq+5lK26FPaGzBCr7ckPMF0cvM+mm4dW dyc1uuXaZg0= =bVzd -----END PGP SIGNATURE-----

2 1

Day 2, nist GAK meeting
by pfarrell＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Date: Fri, 8 Sep 1995 09:32:43 -0400 (EDT) From: "Pat Farrell" <pfarrell(a)127.0.0.1> To: cypherpunks(a)toad.com Cc: BCc: Subject: Day 2 NIST meeting notes X-NUPop-Charset: IBM 8-Bit Thursday's GAK Export meeting started with reports from the prior afternoon's breakout meetings. I reported on the session I was in, saying what I posted to the list yesterday (about National Semi's product, etc.) The other breakout groups reported their problems with the criteria, again asking that #9 be dropped, longer, keys, etc. The presentation for Group "A" was different. It was a speach. It asked that the process be stopped to let industry develop market-driven solutions. It was greeted by applause from the vendors and privacy advocates, with no reaction from the government representatives. Randy Williams of Commerce, and Dan Cook of State, described the current export approval process. Lots of talk of jurisdictions and types of liscenses. I quickly got lost in the jargon. The moderator wisecracked that the official language of the session was English. You couldn't tell from some of the exchanges. They were questioned on import restrictions. Both Williams and Cook said that there are no import restrictions into the US. They also pointed out that Treasury, not State or Commerce, has jurisdiction over imports. An engineer from Compaq asked a question: He said that his company buys liscenses to software, and bundles it as "value added" to their systems. They are interested in bundling in security features. He asked if his computers would then be subject to export restrictions. The answer was yes. He asked if he could purchase security software overseas and import it. The answer was again yes. He asked if he could install that software on his computers, again yes. And export the computers, NO. They didn't even seem to think that this was illogical. So Commerce, State, and the rest of the government are activly encouraging the development of competing software industries in Israel, Germany and other counrties. I hate to think what they'd do if they tried to hurt US industry. And interesting tidbit came up after the session. In an offline conversation, the topic of "personal use export" came up. A reliable source said that revised regulations are being developed, and will, be avaialble soon. I explicitly asked if this meant "PGP on a notebook computer" and was told, Yes, that will be allowed; with the usual rules that it can't be for export, you can't be attempting to sell it, etc. Personal use, carry out and carry back. The "source" was asked if they had read Matt Blaze's personal use disaster story. The name didn't ring a bell, but the story was well know and considered a nightmare. Penny Brummitt of NSA was to talk about Clipper's key escrow agents, but called in sick. I didn't catch the name of the replacement. He talked about Clipper's process, not as an example of what will be required for GAK agents, but as an "existance proof" that some agents can be found. The essence was that Clipper escrow facilities are strong, and staffed with people cleared to the "Secret" level. They also tosed out the phrase "US Person" in regard to the corporate entity that is responsible for the contract. Geoff Greiveldinger, of the US Department of Justice, gave a frequently inaudible recounting of the evils of strong encryption in the war on D, P, & T, and also corrupt mayors. He was very personable. He also sounded like a fascist. Throughout the meeting, all sides tried to have a civil discussion, even though we disagreed. It was impossible to stay civil through his drivel. Ruby Ridge and Furman had been unmentionable up until his speach. Mr. Greiveldinger said that acceptable escrow agents will be in the US. This caused considerable concern among vendors trying to sell in the International market. Dan Weitzer of CDT (the EFF spinoff) gave a short, rousing speach. It was a call to arms. He said that since NIS&T was ignoring the consistant input from industry to stop this silly and stupid GAK, that we need to immediately contact our congresscritters. Ken Mendelsen [sic?] of TIS gave a great speach. He suggested that the critera for escrow agents be the same as the form to export tanks and other munitions. Then he showed the one page form used by State. He argued that legislative solutions to the escrow agent approval process will take too long and kill the effort. I'll try to get copies of his presentation. F.W. Gerbracht, Jr a VP Merril Lynch, represented the Securities Industry Association. He said that they are willing to work with the government, but they need long keys, strong ciphers, and international escrow agents. He used the phrase "unlimited algorithms and keyspace" as a requirement. They also need buy in from their regulators, and presented a long list of SEC, CFT, NYSE, NASDealers, and 50 state regulators, all who have to sign off. Nanette DiTosto of Bankers Trust gave a short, to the point presentation. She said that BT has a commercial key escrow service, but that was not what she wanted to get accross. She said that multinational banks demand strong encryption and non-US escrow agents. And that they would settle for nothing less. A speaker from VTW gave a nice presentation. VTW is something like voter's telecommunications watch. They have a mailing list, at listproc(a)vtw.org. He said that escrow was doomed to failure. That there is no middle ground. I'll try to get his slides too. Jack Wack of TECSEC gave a pitch for his shrinkwrapped product. He said it is exportable now, they've jumped through all the hoops. He also gave a great crack from his son. It want roughly like: "Dad, if you own the data before you encrypt it, how come the government says you don't own it after you encrypt it?" It brought down the house. (if someone has a more accurate quote, please let me have a copy). Professor Hoffman of George Washington gave a great speach. He listed the Al Gore to Maria Cantwell letter's criteria, as a matrix. He then filled in the matrix with the Export GAK's criteria. It was painfully obvious that the NIST/NSA propsal didn't come close. He recommended that they focus closly on the Gore criteria, and come up with an approach that meets all the the criteria. While I planned on staying for the remainder of the meeting, a crisis came up at my day job. I can't say I was looking forward to more, a day and a half was enough for me, and I wasn't the only person leaving early. Attendance was down visibly Thursday relative to the first day Pat -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAwUBMFBGEbCsmOInW9opAQEfQgP+P/P0MRGe3EOElzM0UPQy+xce0XGe3wex gfQdTrGWhL+FbYt/7taj6jgtcRg9zih1yQ3W+kN/VUXY9J4I1b6dw+j0sb6MkCjT pShnflDI5OPQmmUq9KZlmy50u2yXuBqfWSdXd9NypjDsh7XDrWIqvqIcuT1cc/di quNZ3u7aymw= =oJC7 -----END PGP SIGNATURE----- p.s. please let me know if this one's pgp sig is better than yesterday's Pat Farrell grad student http://www.isse.gmu.edu/students/pfarrell Infor. Systems and Software Engineering, George Mason University, Fairfax, VA PGP key available via finger or request #include standard.disclaimer

1 0