December 2003 - cypherpunks-legacy

Re: Statistical analysis of anonymous databases
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"alanh(a)infi.net" "Alan Horowitz" 29-MAY-1996 19:09:26.68 >I would ask, is there any known medical gain that has resulted from >such a data-base correllation. >I do not accept a researcher's own statements as to the utility of the work >(S)he's done with someone's funding. Seen too much of it at close >quarters... Nor do I accept reeports in the lay press - these are >nothing more than re-gurgitated press releases from PR depts of institutions. Medical gain? I was doing some research a bit back (paid for out of my own pocket, thank you very much) that involved such correlations. We've used them to revamp some allergy skin testing so that patients don't have to suffer so many tests. -Allen

1 0

NSA's role in Digital Telephony bill...
by Robert Hettinga 17 Dec '03

17 Dec '03

C'punks, I had dinner with another cypherpunk, Peter Cassidy, and he said that he just finished something for the Sacremento Bee's "Forum" section, which talks about the NSA's involvement in the Digital Telephony bill. Those of you who get the Bee might want to fill us in on the details, whenever the article. He said that the article might go to the wires, so we might see it elsewhere... Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "If they could 'just pass a few more laws', we would all be criminals." --Vinnie Moscaritolo The e$ Home Page: http://www.vmeng.com/rah/

1 0

Re: [crypto] crypto-protocols for trading card games
by Gary Howland 17 Dec '03

17 Dec '03

David F. Ogren wrote: > Cards are not transferrable. In order to make cards transferrable the > game company must be able to invalidate cards which have been traded > to others. In other words if Alice wants to give a cards to Bob she > must: > > 1. Contact the game company and tell them she wants to give the card > to Bob. 2. The game company must issue a new card to Bob with a new > serial number and with Bob's public key rather than Alice's. 3. The > game company must invalidate Alice's old card. Since there is no way > that the game company can make sure all copies of the card have been > destroyed it must create a "invalid serial number list" and have the > players dial into that list everytime the game is played. This is the double spending problem. > Since step 3 is so costly to implement, I think it is unlikely that a > cryptography-based trading card game will have tradable cards. Given that untraceability of tradable cards is less of an issue than with e-cash, why not have a central registry of the owners of the cards (which would consist of the card details paired with the public key of the owner)? Admittedly this means the players must be on line, but then we all know how difficult off line detection of double spenders is. For anyone who is _serious_ about starting work on such a game system, I have a few pieces of Perl and Java code that would really get you on your way - let me know if you are interested. Gary -- pub 1024/C001D00D 1996/01/22 Gary Howland <gary(a)systemics.com> Key fingerprint = 0C FB 60 61 4D 3B 24 7D 1C 89 1D BE 1F EE 09 06

1 0

NRC Cryptography Report: One More Recommendation
by John Gilmore 17 Dec '03

17 Dec '03

Sigh. Add one more Recommendation. It wasn't on the summary page of the fax copy I got, but it was in the text of the Report, and is in the Web page: Recommendation 6: The U.S. government should develop a mechanism to promote information security in the private sector. John

1 0

Policy Post 2.21 - Your Privacy Online: CDT Unveils Demo & Clearinghouse
by editor＠cdt.org 17 Dec '03

17 Dec '03

----------------------------------------------------------------------------- _____ _____ _______ / ____| __ \__ __| ____ ___ ____ __ | | | | | | | | / __ \____ / (_)______ __ / __ \____ _____/ /_ | | | | | | | | / /_/ / __ \/ / / ___/ / / / / /_/ / __ \/ ___/ __/ | |____| |__| | | | / ____/ /_/ / / / /__/ /_/ / / ____/ /_/ (__ ) /_ \_____|_____/ |_| /_/ \____/_/_/\___/\__, / /_/ \____/____/\__/ The Center for Democracy and Technology /____/ Volume 2, Number 21 ---------------------------------------------------------------------------- A briefing on public policy issues affecting civil liberties online ---------------------------------------------------------------------------- CDT POLICY POST Volume 2, Number 21 May 30, 1996 CONTENTS: (1) Your Privacy Online - CDT Unveils Demonstration and Clearinghouse (2) Join Rep. White Wed 6/5 At HotWired to Discuss the Internet Caucus, the CDA, and other Internet Policy Issues (3) Subscription Information (4) About CDT, contacting us ** This document may be redistributed freely with this banner in tact ** Excerpts may be re-posted with permission of <editor(a)cdt.org> ----------------------------------------------------------------------------- (1) Your Privacy Online - CDT Unveils Demonstration & Clearinghouse Many people surf the World Wide Web with an illusion of anonymity, believing that their activities are unobserved and that they can explore the Internet without leaving a trail. In reality, this is not the case. During the normal course of using the Internet, a great deal of personally revealing information is routinely generated, collected, and stored. Most of this information is collected for purposes of system maintenance, billing, or other necessary functions. But a sophisticated marketer, determined hacker, or law enforcement official can put together a detailed profile of your online activities, personal tastes, interests, habits and vices with relative ease. Today, the Center for Democracy and Technology unveiled an interactive privacy demonstration and privacy policy clearinghouse on our World Wide Web site. The demonstration is located at http://www.cdt.org/privacy/ The goals of the demonstration are two fold: 1. To educate the public about the extent to which personal information is automatically revealed online, and 2. To begin to make available examples of privacy and information usage policies that give people greater knowledge of and control over the personal information revealed online. The current focus of this "Privacy Clearinghouse" is centered on commercial online service providers (ie, America Online, CompuServe, Prodigy, Microsoft). Future updates of the clearinghouse will include information on Internet Service Providers, content providers, and web browser software. Future updates will also explore the extent that users can employ various technological solutions to control the collection and disclosure of personal information. FEDERAL TRADE COMMISSION TO HOLD HEARINGS ON ONLINE PRIVACY On June 4 and 5, the Federal Trade Commission (FTC) will hold hearings to explore online privacy issues. The FTC is particularly interested in exploring privacy protecting technologies which empower users to exercise more control over the collection and use of personally identifiable information online. CDT has been invited to present testimony at the hearings. Testimony and other background information on the FTC hearings will be available at CDT's web page at the end of next week. Details on the hearings are available at http://www.ftc.gov/. WHY SHOULD NETIZENS CARE ABOUT THIS ISSUE? Although it may not seem like it, someone is following you through cyberspace. Every time you retrieve a file, view an image, send an email message or jump to a new web site, a record is created somewhere on the Net. While much of this information may never be used, it can be, and you have little control over it. In the hands of a marketer with a powerful computer, or the government, it is possible to build a detailed profile of your tastes and preferences by monitoring your online activities. The information can be used to send you unsolicited email or snail mail, to call you, or to even put you on a list of people likely to support a particular political candidate. A single piece of information about you can support a tremendous range of activities. For example, if your repeated visits to web sites containing information on cigarettes results in free samples, coupons, or even email to you about a new tobacco product, you may not be concerned. However, if your visits to these web sites result in escalating insurance premiums due to categorization as a smoker - now you're beginning to get concerned. HOW PERSONAL INFORMATION IS COLLECTED ONLINE Web sites and Web browsers -------------------------- Your personal information (including your hobbies, political and product interests and ways to contact you, such as your email address) can be collected by web sites in two ways: directly or indirectly. * PASSIVE RECORDING OF TRANSACTIONAL INFORMATION: The transactional information revealed in the normal course of surfing the net reveals a great deal of information about your online activities. When you visit a particular web site, for example, the webmaster can determine what files, pictures, or other information you are most interested in (and what you ignored), how long you examined a particular page, image or file, where you came from, where you went to. Web servers collect transactional information in order to allow the system operator to perform necessary system maintenance, auditing, and other essential system functions. However, when correlated with other sources of personal information, including marketing databases, phone books, voter registration lists, etc, a detailed profile of your online activities can be created without your knowledge or consent. * COOKIES: Additionally, many web browsers contain a feature called "cookies," or client-side persistent information. Cookies allows any web site to store information about your visit to that site on your hard drive. Every time you return to that site, "cookies" will read your hard drive to find out if you've been there before. (The Privacy Demonstration has a link to a site that utilizes cookies.) * DIRECT DISCLOSURE OF PERSONAL INFORMATION: A growing number of web sites offer users the ability to register with the site. In many cases, registration brings real, important benefits, such as access to special areas, timely information, discounts, etc. While registration or other mechanisms by which users divulge personal information to a web site provide some obvious benefits to a users, it also provides the site's operator with a detailed picture of how you use the site. Regardless of how the information is obtained, a great deal of personally identifiable information is revealed in the normal course of surfing the web. Commercial Online Service Providers ----------------------------------- Commercial online service providers are configured in a variety of ways, but generally, little personally identifiable information is revealed to Internet sites visited directly from an online service. If you subscribe to a commercial online service, your service provider has access to lots of information about your online activities. These records are generated in the normal course of using the service, and are important for billing and maintenance purposes. However, not all services treat the use and disclosure of this information the same way. Please visit The Center for Democracy and Technology's Clearinghouse on Privacy Policies (http://www.cdt.org/privacy/) for a detailed description of the information practices of the major commercial online services. Future updates of the clearinghouse will focus on other Internet entities, such as browsers, content providers, and Internet service providers. ------------------------------------------------------------------------ (2) JOIN CONGRESSMAN RICK WHITE (R-WA) LIVE ONLINE TO TALK ABOUT THE INTERNET CAUCUS, THE CDA, AND TAKE YOUR QUESTIONS Congressman Rick White (R-WA) will be live online at HotWired on Wednesday June 5 at 9:00 pm ET to discuss his efforts to encourage better communication between members of Congress and the Internet community, his plans for the Congressional Internet Caucus, and other topics. Representative White will also answer questions from Netizens. DETAILS ON THE EVENT * Wednesday June 5, 9 - 10 pm ET (6 pm Pacific) on HotWired URL: http://www.hotwired.com/wiredside/ To participate, you must be a registered HotWired member (there is no charge for registration). You must also have RealAudio(tm) and a telnet application properly configured to work with your browser. Please visit http://www.hotwired.com/wiredside/ for information on how you can easily register for Hotwired and obtain RealAudio. Wednesday's forum is another in a series of planned events, and is part of a broader project coordinated by CDT and the Voters Telecommunications Watch (VTW) designed to bring the Internet Community into the debate and encourage members of Congress to work with the Net.community on vital Internet policy issues. Transcripts from last week's discussion with Senator Leahy are available at http://www.cdt.org/crypto/. Events with other members of Congress working on Internet Policy Issues are currently being planned. Please check http://www.cdt.org/ for announcements of future events ------------------------------------------------------------------------ (3) SUBSCRIPTION INFORMATION Be sure you are up to date on the latest public policy issues affecting civil liberties online and how they will affect you! Subscribe to the CDT Policy Post news distribution list. CDT Policy Posts, the regular news publication of the Center For Democracy and Technology, are received by more than 9,000 Internet users, industry leaders, policy makers and activists, and have become the leading source for information about critical free speech and privacy issues affecting the Internet and other interactive communications media. To subscribe to CDT's Policy Post list, send mail to policy-posts-request(a)cdt.org with a subject: subscribe policy-posts If you ever wish to remove yourself from the list, send mail to the above address with a subject of: unsubscribe policy-posts ----------------------------------------------------------------------- (4) ABOUT THE CENTER FOR DEMOCRACY AND TECHNOLOGY/CONTACTING US The Center for Democracy and Technology is a non-profit public interest organization based in Washington, DC. The Center's mission is to develop and advocate public policies that advance democratic values and constitutional civil liberties in new computer and communications technologies. Contacting us: General information: info(a)cdt.org World Wide Web: URL:http://www.cdt.org/ FTP URL:ftp://ftp.cdt.org/pub/cdt/ Snail Mail: The Center for Democracy and Technology 1634 Eye Street NW * Suite 1100 * Washington, DC 20006 (v) +1.202.637.9800 * (f) +1.202.637.0968 ----------------------------------------------------------------------- End Policy Post 2.21 5/30/96 -----------------------------------------------------------------------

2 1

NRC Cryptography Report: The Text of the Recommendations
by John Gilmore 17 Dec '03

17 Dec '03

Recommendation 1: No law should bar the manufacture, sale, or use of any form of encryption within the United States. Recommendation 2: National cryptography policy should be developed by the executive and legislative branches on the basis of open public discussion and governed by the rule of law. Recommendation 3: National cryptography policy affecting the development and use of commercial cryptography should be more closely aligned with market forces. Recommendation 4: Export controls on cryptography should be progressively relaxed but not eliminated. 4.1 -- Products providing confidentiality at a level that meets most general commercial requirements should be easily exportable. Today, products with encryption capabilities that incorporate 56-bit DES provide this level of confidentiality and should be easily exportable. 4.2 -- Products providing stronger confidentiality should be exportable on an expedited basis to a list of approved companies if the proposed product user is willing to provide access to decrypted information upon legally authorized request. 4.3 -- The U.S. government should streamline and increase the transparency of the export licensing process for cryptography. Recommendation 5: The U.S. government should take steps to assist law enforcement and national security to adjust to new technical realities of the information age. 5.1 -- The U.S. government should actively encourage the use of cryptography in nonconfidentiality applications such as user authentication and integrity checks. 5.2 -- The U.S. government should promote the security of the telecommunications networks more actively. At a minimum, the U.S. government should promote the link encryption of cellular communications and the improvement of security at telephone switches. 5.3 -- To better understand how escrowed encryption might operate, the U.S. government should explore escrowed encryption for its own uses. To address the critical international dimensions of escrowed communications, the U.S. government should work with other nations on this topic. 5.4 -- Congress should seriously consider legislation that would impose criminal penalties on the use of encrypted communications in interstate commerce with the intent to commit a federal crime. [Page 28 of the "Overview and Recommendations". There's a lot more discussion of each of these in the whole overview, which should be up on the web late today at www2.nas.edu/cstbweb/.]

6 5

Re: Asendmail Status & Politikal Rant
by - 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Ben Holiday wrote: <Asendmail Status report deleted> >On to politiks: > >I understand that the entire concpet of this program is a bit >controversial, and I can accept that. Personnaly I am not certain exactly >how to feel about it. I suppose that I am not thrilled about the idea of >cloaking the mailer this way, but at the same time I perceive it as an >evil of requirement. Yes. Yet another example of Unintended Consequences. I seem to be hearing that meme more-and-more these days. >I beleive very strongly that remailers SHOULD exist, >whether or not the CoS, or the FBI agree; and I am willing to be a bit >impolite if thats what needs to be. My only hesitation is that I'm afraid >now might be to soon. Absolutely, I think no fair observer could say that "we" [I know, "there's no 'we'"] "started it." Your concern is valid, IMO, but it should be balanced with the equally-valid fear that later might be too late. I have said this many times, both privately and in public, but it bears repeating: "Things are likely to be worse after the election." Like many here, I am surprised, and somewhat happy [easy issue for my political party] that the administration is making GAK3 noises now, and still trying to Newspeak it into the word "escrow." <"Escrow"-rant resisted to save bandwidth> ... >Anyway, someone raised the argument that the problem was political, and >that a technical solution would do more harm than good - maybe you're >right, I can't see the future, But it seems to me that I read somewhere >that "Cypherpunks Write Code". This statement is amazingly profound in its >implications. You are right, but it all interacts, IMO, in a "team effort." cypherpunks DO write code, and politico-crypto-punks like me admire your work greatly.We also talk about it, and try to spread it around in order to "protect" it. Users are far better off if someone besides me writes their software, :) but I can help them install PGPetc. without too much trouble. [Besides, 2/3 of the Cybergate-cypherpunks seem to write excellent code. I could never compete!] >Anonymous communication on the net depends on the technical solutions >embodied in the current remailing software, and cryptography applications. >If, years ago, the cypherpunks had decided that a publicity campaign, >political lobbying, and apologizing were the right course of action, >anonymous speach on the internet would be virtually non-existant today. If >the cypherpunks decide today that coding is not the answer, where will >free speach on the net be in 5 years? I think it is very naive to beleive >that the world is going to change enough, quickly enough, that remailers >will become accepted, and protected, methods of speaking - no matter how >politically correct we try to be. Sadly, despite my and others' political work to make this statement untrue, I must again agree with Ben Holiday. >Why do we see big business and big government launching a full frontal >assault on the remailers, while the mailing lists continue to operate >without incident? Because the enemy's of free speach recognize where the >true threat to their opression lies. Relying on politics to preserve our >rights is like throwing down your gun and asking the bear to please not >eat you. Agreed. >The powers that be want us to shut up. The programs that we write are the >weapons that will defend our right to speak. Yes, and many like you fill another important function for us, a function for which many of you take personal risks and spend a lot of unpaid time (and I thank you). Without comparing the particular goals, individuals, or any other aspects of earlier movements to the "Internet Privacy movement" of today, I see examples from recent history of how we interact without always knowing it. First, and despite current anti-gun sentiments among many of the same people, I think that the Civil Rights movement in the '60s _would_ have suffered more brutality from law enforcement and the KKK were it not for the armed Black Panthers, who had a diametrically opposed strategy. Second, the more recent "environmental" movement has profited by continuously spinning off more radical factions of itself [ex. "Earth First!"] to make its positions seem more reasonable and reduce the chances of compromise. The key to success seems more to be the capability of more radical action, and yet avoidance of violence or even the advocacy of violence among the mainstream to maintain either good PR, principles, or both, while continuing the political- legal fight. The "threat" of a technical solution "weapon" forces any political opponents to show their cards before they play (or just lie) and ideally involves (because it requires) *no* physical violence whatsoever. Despite opinions to the contrary, "war is [still] the health of the state." -- I forget who said that, sorry. JMR Regards, Jim Ray -- DNRC Minister of Encryption Advocacy "Why is it that hundreds of government and university machines can operate what amount to anonymous remailers, and no one pays any attention, and yet cypherpunks are threatened with jail time for what is essentially the same thing?" -- Ben Holiday ___________________________________________________________________ PGP id.E9BD6D35 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 <liberty(a)gate.net> http://www.shopmiami.com/prs/jimray ___________________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh. iQCVAwUBMa3D7G1lp8bpvW01AQEzawP/VhP+EU1hk5aniN3IZ7cGkn5joUFA9dhj yC/D67wj68pfsTQZNOvRsVpEiapfc2OB3INVnjJroLY3i4r7ebiCoowTl+TF6NR+ MtheZ+mkyclpG832cJQLkWI5C61Lk1M5nNRNZ4blR3Gr07Ip5ku0RVovS0Qo8qyi V9KzwwveO48= =mydx -----END PGP SIGNATURE-----

1 0

Re: NRC crypto policy report to be released Thursday
by frantz＠netcom.com 17 Dec '03

17 Dec '03

The San Jose Mercury News has the top business section article: ON-LINE SECRECY WINS BACKING Without it there could be havoc, panel says Basically the report says the US will get more protection by using strong crypto to secure its networks and systems than by keeping week crypto and allowing LEAs to read comm. The report describes GAK as "an untested, unproven technology that should not be foisted on the public until it is proven in extensive field use by the government." A quote: "We believe government policy should support the broad use of cryptography." ... "We believe it presents problems for the legitimate concerns of national security and law enforcement. But we also point out that strong cryptography is needed because of the proliferation of computer-based crimes, that it would deal with national security issues by protecting vital public networks." - Kenneth W. Dam, Chairman ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Your experiences with CFS
by ichudov＠algebra.com 17 Dec '03

17 Dec '03

Hello, Does anyone have any real experience running CFS under Linux (1.2.13)? I was planning to start using it, but am concerned about its reliability. Has anyone experienced any glitches with CFS? How does CFS behave in case of a sudden power loss? Have you tried to use CFS under pre2.0 versions of linux? Thanks! - Igor.

1 0

NRC's CRISIS report: Chairman's opening statement
by Jim Gillogly 17 Dec '03

17 Dec '03

OPENING STATEMENT KENNETH DAM Max Pam Professor of American and Foreign Law University of Chicago Law School and Chair, Committee to Study National Cryptography Policy News Conference on Cryptography's Role in Securing the Information Society National Press Club Washington, D.C. May 30, 1996 *** Good morning. In this age of telecommunications and lightning-speed advances in computing, keeping private information private gets tougher all the time. Without proper safeguards, personal financial transactions, medical records, corporate secrets such as bidding information and proprietary research reports may be compromised by criminals and corporate spies. Without proper safeguards, crucial information systems such as those of the banking system and the public switched telecommunications network may be vulnerable to intrusion by terrorists, curious computer hackers, and unfriendly foreign governments. One of the best ways to protect electronic information is through encryption, which is the use of mathematical formulas to scramble information into digital codes. Once of concern only to spies and the military, cryptography has now become a vital tool for protecting the legitimate interests of the nation's businesses and the privacy of its citizens. This change has created a dilemma for the U.S. government because encryption also can be used in a wide range of illegitimate activities. Drug dealers, terrorists, and other criminals can use cryptography to thwart even legally authorized search and surveillance by law enforcement officials; foreign governments can encrypt information that the U.S. needs to protect its national security. Now the federal government -- which in the past has sought to restrict the spread of encryption -- must weigh the pros and cons of promoting broader use of cryptography. The National Research Council was asked by Congress to provide policy makers with guidance in making this assessment. Our study committee was made up of individuals with expertise in many relevant fields: technical expertise in computers, communications, and cryptography; policy experience in law enforcement, intelligence, civil liberties, national security, diplomacy, and international trade; business experience in telecommunications and computer hardware and software, as well as in protecting information in the for-profit and not-for-profit sectors. It was formed to examine the appropriate balance among various national security, law enforcement, business, and privacy interests. Our committee's broad conclusion is that the advantages of cryptography in safeguarding information outweigh the possible disadvantages of making apprehension and prosecution of criminals more difficult. Thus, we believe that federal policies should promote rather than discourage the use of encryption. For example, current export controls impede the use of strong encryption by U.S. firms with foreign customers and suppliers as well as reducing the availability of strong encryption domestically. The government needs to make it easier for U.S. companies operating internationally to use strong encryption, and for U.S. technology vendors to develop and sell cryptography products both in this country and abroad. Indeed, maintaining world leadership for U.S. information technology vendors is an important contribution to national security, as well as being important to the economy. Furthermore, the development of products with encryption should be driven largely by market forces rather than by government-imposed requirements or standards. There are no legal limits on the kinds of encryption that presently can be sold in the United States and we strongly endorse the idea that no law should bar the manufacture, sale, or use of any form of encryption within the United States. We do not believe that by adopting such a course the government would necessarily be choosing the interests of business and individuals over those of national security and law enforcement. We say this for two reasons. First, availability of encryption technologies will benefit law enforcement and national security. Here's how: by making economic espionage more difficult, cryptography supports law enforcement. By protecting elements of the civilian infrastructure such as banking, telecommunications, and air traffic control networks, cryptography safeguards national security. The second reason is that current national policy -- which discourages the use of cryptography despite its many valuable applications -- can at most delay encryption's spread. Already, the use of such technologies is growing, and in the long run, we believe widespread non-governmental use of cryptography in the United States and abroad is inevitable. The government should recognize this changing reality and help law enforcement and national security authorities develop the new technical capabilities they will need to conduct investigations and surveillance in a world in which information will be more protected and even unencrypted communications will be harder to read. Our report also urges that the government should explore escrowed encryption rather than the aggressive promotion that is the case today. Encrypted information is unintelligible to anyone lacking the keys to unlock the digital code. In escrowed encryption, the decoding key would be held by a trusted third-party organization or institution. This is attractive to law enforcement agencies because with a court order, they could obtain the key and unlock even the most unbreakable code. However, escrowed encryption is relatively untried and many unresolved issues remain, ranging from the liability of these third parties to the magnitude of the risk incurred by companies trusting these third parties with the keys to their sensitive business plans and trade secrets. Rather than aggressively promoting escrowed encryption, our committee believes that the government should explore escrowed encryption for its own purposes as a way of gaining operational experience with this technology and making it more useful to the commercial sector. Even when that occurs, we say that adoption of escrowed encryption or of any other specific technology or standard by the commercial sector should be voluntary and based on business needs, not government pressure. To make it easier for U.S. companies with foreign customers and suppliers to protect their information with the best encryption technologies, the committee believes that export controls should be progressively relaxed, though not eliminated. Right now federal law makes it hard to export strong encryption technology. This helps protect the government's ability to gather foreign intelligence. However, it also makes it more difficult for U.S. technology vendors to produce and sell cryptography products both here and overseas, and it limits what's available here because software companies are reluctant to develop different products for U.S. and foreign markets. And we call on the executive and legislative branches to develop national cryptography policy on the basis of open public discussion. In the past, government officials have treated many aspects of cryptography policy as "top secret," to be discussed only behind closed doors. This has led to considerable public distrust and resistance, which makes it impossible to achieve consensus. In our report we point to a number of specific areas such as telecommunications and banking where the government should actively promote the adoption of encryption. For example, the privacy of the cellular phone and the security of the nation's telecommunications networks should be enhanced through the use of cryptography. In the case of the cellular phone many people have at home, the digital signals sent between the cell phone and the cell's ground station could be encrypted. This would prevent eavesdroppers from listening in on conversations. Overall, we believe that adoption of our recommendations would lead to enhanced protection and privacy for individuals and businesses in a many areas, while also bolstering the international competitiveness of U.S. companies. My colleagues and I will now entertain questions from the media. Before asking a question, please step to an aisle microphone and state your name and affiliation. ----------------------------------------------------------------------------

1 0