- cypherpunks-legacy - lists.cpunks.org

White House crypto proposal -- too little, too late
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Tue, 1 Oct 1996 14:56:21 -0700 (PDT) From: Declan McCullagh <declan(a)well.com> To: fight-censorship(a)vorlon.mit.edu Subject: White House crypto proposal -- too little, too late I just got back from the White House, where Gore's office held a roundtable plugging the administration's long-awaited and already widely-derided Return of Clipper proposal. Gore announced that jurisdiction over crypto exports would move to the Commerce Dept; that the export embargo on 56-bit DES would be lifted in part for two years only; that to be approved for export firms must submit a detailed proposal describing how they will move towards key escrow; that the new regulations would go into effect on January 1. The true problem with this plan is that 56-bit DES is woefully inadequate. But much of the media coverage I've read of the plan doesn't even mention that. Take Elizabeth Corcoran's article, which ran above the fold on the front page in today's Washington Post. (It's what almost certainly prompted Gore's office to move the announcement to today rather than hold it later this week.) The thrust of the article is that the administration's new proposal balances the needs of privacy, business, and law enforcement. But it doesn't. The Feds, foreign governments, and determined attackers can crack anything encrypted with 56-bit DES -- the strongest crypto that can be exported under the plan. This vital fact appears nowhere in the Post article. That's why Bruce Schneier, author of Applied Cryptography, recommends against using DES in favor of a more secure algorithm. According to Schneier: "A brute-force DES-cracking machine [designed by Michael Wiener] that can find a key in an average of 3.5 hours cost only $1 million in 1993." More recently, in January 1996 an ad hoc group of renowned cryptographers including Matt Blaze, Whitfield Diffie, Ronald Rivest and Schneier, released a report going even further. They said: "To provide adequate protection against the most serious threats - well-funded commercial enterprises or government intelligence agencies - keys used to protect data today should be at least 75 bits long. To protect information adequately for the next 20 years in the face of expected advances in computing power, keys in newly-deployed systems should be at least 90 bits long." What's even more disturbing is what the administration might do next. After the roundtable broke up, I chatted with Michael Vadis, one of the assistant deputy attorneys general who oversees national security issues. He said an international consensus is forming that terrorists can use crypto; therefore crypto must be controlled. The U.S. is certainly pushing this line at the OECD talks. "But it just takes one country to decide to export strong crypto," I said. "You're missing something," said Vadis. "What?" I asked. "Unless you're talking about import restrictions." "Exactly," he said. -Declan ******* Some background: Linkname: Brock Meeks on White House plan -- 6 Sep 96 Filename: http://www.muckraker.com/muckraker/96/36/index4a.html ******** http://www.washingtonpost.com/wp-srv/WPlate/1996-10/01/041L-100196-idx.html U.S. TO EASE ENCRYPTION RESTRICTIONS Privacy Advocates Wary of Proposal For Software Exports By Elizabeth Corcoran Washington Post Staff Writer Tuesday, October 1 1996; Page A01 The Washington Post The Clinton administration is cutting off an emotional four-year-old debate with the computer industry over the export of information-scrambling technology with a plan that it says will help U.S. companies boost sales overseas and still allow law enforcement agencies to unscramble messages, officials said yesterday. President Clinton has decided to sign an executive order that changes the rules restricting the overseas sale of the technology, the officials said. Although the full details of the plan had yet to be revealed, privacy advocates and some industry executives contended that it would be difficult to put into practice. Under current rules, companies can sell only relatively easy-to-crack scrambling technology. Under the plan, they would get permission to export somewhat more sophisticated versions of the software and hardware, which prevents eavesdroppers from looking at information. The issue has caused enormous friction between the government and computer industry and privacy groups, which contend that keeping any restrictions in place will harm the protection of personal information everywhere and slow the development of on-line commerce, which relies on keeping credit card numbers and other sensitive information secure. The administration counters that it has come a long way in meeting such objections. However, last night some companies and privacy advocates were still worried that the constraints will leave U.S. companies at a disadvantage abroad and will not ensure that individuals will be able to protect their communications. The government's plan preserves what has been its unnegotiable cornerstone since the debate began in the early day of the Clinton administration -- that law enforcement officials must have the means for peeking at encrypted information when they are properly equipped with court authorization. Earlier versions of the plan tightly limited what kinds of technology could be sold abroad. They also called for makers of encryption technology to deposit "keys" with approved third parties so that law enforcement authorities could decode material. The new plan doesn't specify who would have the keys. Last night, several companies, led by International Business Machines Corp., said they have a technical plan that they believe could comply with the new rules on keys. [...] Industry officials say they ultimately want to be able to use the most sophisticated encryption technology available. "It's really critical to doing business around the world," said an IBM source. "But governments exist. It's a balancing act . . . to satisfy the needs of the governments and make sure that markets and individuals trust the integrity of what's being sent over the networks." [...]

8 7

FBI Sued on CALEA
by John Young 17 Dec '03

17 Dec '03

NYT's John Markoff reports today on a suit to be filed today by the cellular phone industry against CALEA regs on wiretapping -- alleging improper FBI guidelines under the legislation. A lead on getting a copy of the filing would be appreciated; U.S. District Court in Washington DC is the venue.

1 0

Cutoff Date
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

ftp://billstatus.ls.state.ms.us/1998/HB/0100-0199/HB0196IN.htm MISSISSIPPI LEGISLATURE 1998 Regular Session To: Judiciary A By: Representative Moak House Bill 196 AN ACT TO AUTHORIZE THE REMOVAL OF A BODY PART IN LIEU OF OTHER SENTENCES IMPOSED BY THE COURT FOR VIOLATIONS OF THE CONTROLLED SUBSTANCES LAW; AND FOR RELATED PURPOSES. BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MISSISSIPPI: SECTION 1. In lieu of any other penalty prescribed by law, the court may allow any person who is convicted for a violation of the Controlled Substances Law to have a body part removed. The convicted person and the court must agree on which body part shall be removed. SECTION 2. This act shall take effect and be in force from and after July 1, 1998.

1 0

Re: Programmers flee Y2K problem -- and we're spooked too
by John Young 17 Dec '03

17 Dec '03

Didn't Hal Finney recently debunk Y2K apocalyptic millenarianism? Or is Y2K-mongering now competing with the elint industry for more domestic preparedness for techno-seancing, tap, tap, tap? Pray 00-00-00 unplugs the global Echelons.

1 1

Can we kill single DES?
by Peter Trei 17 Dec '03

17 Dec '03

Since it looks like the US government will be allowing the export of 56 bit espionage-enabled software, it's time to kill single DES. As some of you will recall, a while back I wondered aloud about the feasibility of brute-forcing DES on general purpose machines, ala the RC4-40 crack last year. Unlike many cypherpunks, I actually write code (:-). I took Phil Karn's DES386 as a starting point, and modified it to run effiiciently on the Pentium. The code I've written will run 14 round DES (all that is required for a key test app) at 254,000 crypts/sec on a 90 MHz Pentium. Allow about 10% overhead for key scheduling (there are some tricks to speed this up), and we're still at about 250,000 keys/sec on a 100MHz Pentium (I'm using a nominal 100 MHz Pentium as my 'unit' of cpu power). On a Pentium, it runs entirely in the L1 cache. The code will also run on a 486, but at less than half the number of crypts/sec for the same clock speed. On this type of processor, it would still take 9133 years to exhaust a 56 bit key space. On the other hand, on 20,000 processors of this power it would take less than 6 months. If the target is encrypted in a chaining mode with an unknown 8 byte IV, the time more than doubles. Clearly, this goes far beyond the number of cpus available to the members of this list (though well within the power of most governments and many corporations) The best idea I've heard for recruiting this many cpu cycles is to create a screen saver which does DES-cracking while machines are idle. Another incentive is to offer a cash prize to the person(s) who find the key. Yes, I KNOW that a hardware based cracker is a LOT more efficient, but between the up-front cost and the difficulty of design and production, it's less likely to get done. (Still if someone wants to buy me a nice FPGA board, I'll see what I can do). If you're interested in volunteering machines to do a key search, please read to the end. Questions for general discussion: 1. Is this a good idea? What will happen if DES becomes perceived as insecure? 2. What is the probability of success required to make it worth doing? 3. What would be the consequences of failure? 4. What other platforms than NT/Win95/Pentium should be considered? I could write a Unix demon version, but unless it's tailored for the cpu, a lot of efficency is lost (The aggregate number of idle cycles available for testing is the crucial number). 5. What's a good target? Ideally, we need a plaintext/ciphertext pair, encrypted in Single DES ECB mode. Preferably from a commercially available program, in which a single key is used for a great deal of traffic over a long period. I would strongly prefer, however, that the target key be a *test* key - I don't want to compromise anyone's actual security. We need a target which is both convincing and realistic. 6. What other incentives can be used to recruit machines? ------------------------------ If you're interested in volunteering cycles: RESPOND ONLY TO ME (trei(a)process.com) NOT TO THE LIST. The last thing we need is a hundred 'I'll help' messages on the list. Assume that the program will be a Win95/NT screen saver or Unix deamon. Think about how many machines you could get it to run on (maybe you can talk other people into installing it as a screen saver or background task) I have not written the screen saver yet. I will not do so unless it looks like we'lll get enough machines, so nothing is likely to happen for a couple of months at least. I need to estimate how many cpu cycles will be available: Calculate: Number of Pentiums * Hours available/week * MHz + (Number of 486's * Hours available/week * MHz * 0.30) For, Alphas, MIPS, Motorola, PowerPC etc, running UN*X, MAC, etc, just report how many cpus, their speed, and OS - I'll need help to get versions for other platfoms. 64 bit processors like the Alpha can run this stuff *fast*. Send the aggregate numbers to me. I'll also need to know how many machines are directly on the Internet and could thus query a key-space server, and how many would need some other mechanism to get keyspace and report results. If you're volunteering machines which are outside of the US/Canada, please note the fact: ITAR may be an issue here. I'll summarize to the list. Peter Trei trei(a)process.com

4 5

[NEWS] Crypto-relevant wire clippings
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

News Release (Smart Card Forum): Friday, September 27, 1996 Consumers Can Be Confident in Smart Card Security TAMPA, Fla. -- Two scientists at Bellcore announced a theoretical model for penetrating the security of smart cards and other tamperproof devices. It is important to point out that this is just a mathematical theory. The Smart Card Forum does not believe that this theoretical attack presents a real-world risk. Multiple techniques are used together to make the entire system secure. And good systems are designed so that they cannot be attacked successfully at a single point. Even if a single card could be compromised, though unlikely, it would not compromise an entire system nor allow the production of counterfeit cards. That is not to say that Bellcore's work is not useful. In fact, the Smart Card Forum encourages this type of healthy speculation because of the importance of ensuring that all security issues be considered, analyzed and resolved as early in the product design as possible. For a smart card product to be successful, consumers must have confidence in its security. The Bellcore research should not be perceived in any way as diminishing the security of smart card products consumers are now using. The smart cards used in North American stored value trials today are not vulnerable to this theoretical attack. The Smart Card Forum The Smart Card Forum is a non-profit, multi-industry membership organization promoting the widespread acceptance of multiple application smart card technology in North America. Its primary mission is to bring together in an open forum, leaders from both the private and public sectors to address topics associated with the development and evolution of smart card technology applications. The Forum was established in September 1993 and currently has more than 225 corporate and government members including: Chase Manhattan, Citibank, Bellcore, MCI, MasterCard, Visa, IBM, Microsoft, Mobil Oil, Schlumberger, Gemplus, Delta Airlines, U.S. Postal Service, the Federal Reserve, U.S. Department of Treasury and U.S. Department of Defense. Dow Jones: Friday, September 27, 1996 Chase Says Findings Won't Halt NYC Smart Card Plan A potential security flaw in electronic cash cards found by Bellcore scientists will have no effect on a pilot program to test the cards in New York City early next year, a leading bank involved in the program said. Chase Manhattan Corp. (CMB) spokesman Ken Herz - speaking on behalf of a consortium that includes Citicorp (CCI), Visa International and MasterCard International Ltd. - said Bellcore's warnings won't hinder the roll-out of the pilot program. ''The industry is well aware of the vulnerabilities of the system,'' Herz said, adding that the consortium members have discussed the potential problems ''for months now.'' Herz said the consortium is planning to test the cards during the first quarter of 1997 with about 50,000 Chase and Citicorp customers on the Upper West Side of Manhattan. American Banker: Friday, September 27, 1996 Why Intuit Pulled Plug on Home Banking Processing By DREW CLARK Intuit Inc., which boasts of being able to turn on a dime, proved it could with its decision to get out of the processing of home banking transactions. An acquisition that looked so smart just two years ago turned into an albatross. When 40 top executives gathered at Mountain View, Calif., headquarters last month to determine the fate of Intuit Services Corp., the answer quickly became evident. As was announced last week, Checkfree Corp. agreed to buy the unit for $228 million in stock. "We have always anticipated this change, but we did not anticipate that it would come so fast," said Intuit executive vice president William H. Harris. Intuit bought the Downers Grove, Ill., processor, then known as National Payment Clearinghouse Inc., for $6.8 million in 1994. Overnight, Intuit established itself as the leader in handling transactions emanating from PC-based financial management programs. By this year, though, bankers have been complaining loudly about service quality and worrying aloud that Intuit wants to control their relationships with users of its popular Quicken software. Complicating matters for Intuit, as it was dealing with rapid growth in transaction volume this year, was a flurry of new entrants -- banks as well as software companies -- into the home banking market. The Intuit executives knew they had to take action. Should they add to the more than $30 million already spent on Intuit Services, or cut their losses and refocus on the core software business? "We put up on a board a list of the highest priorities that we wanted to address," Mr. Harris said. "The list was overwhelming." Besides home banking and bill payment, the company envisioned itself connecting customers to mutual funds, insurance, and tax preparation as well as facilitating bill presentment and electronic commerce. It became obvious to the executives that ownership of Intuit Services was not helping them to meet those priorities. "By the end of the process, there was close to complete unanimity," said Mr. Harris, who reports to chief executive William V. Campbell. "A number of people changed or modified their points of view. There were those who argued we could innovate faster by continuing to do every part of the chain." Once they decided to sell Intuit Services, the software company's leaders moved on the issue of openness. "We needed many people to help us," Mr. Harris said, "and one of the ways to get other people to help us was to open up our system." Along with the announcement of the sale, Intuit said it would decouple its financial software from the back-end processing network to be owned by Checkfree. No longer would banks be forced to use the facility for back-end processing and bill-paying work. Under a new regime called OpenExchange, Intuit promised to release software specifications by the end of the year. Banks and other financial institutions will be able to offer customers on-line access to Intuit products regardless of their payment processor. Mr. Harris said the decision "frees us up to concentrate on the front-end software and allows us to find appropriate partners" for back-end processing. But he added, "one of the disadvantages of an open approach is that you depend upon your partners." "This decision underscores the trend toward open standards in on-line financial services," said Marc Singer, a consultant with McKinsey & Co. in San Francisco. "It also illustrates the importance of collaborating to compete. In an uncertain environment you have to stake out positions and continually revisit them." Securities analysts also praised the evaluation of Intuit Services Corp. as "a drag on earnings. Intuit wants to hold on to the lead, and this will make Intuit more appealing to the large banks," said Steve Higgens of Bear Stearns & Co. in San Francisco. Although Intuit's move toward open software came just a week after the bank-owned Integrion Financial Network emphasized its own "open standards," Intuit officials insisted that the timing was coincidental. Quicken 6.0 for Windows is scheduled for release in October. The 1997 version will be the first to comply to the OpenExchange standard, Mr. Harris said. "We've done a lot in a hurry." He expressed no regret about the company's two-year experiment in payment processing, saying Intuit technicians had learned much by establishing back-end connections to banks and bringing many customers into the home banking field. "When we purchased National Payment Clearinghouse, the only viable way to connect securely with large numbers of consumers was through a private network and on a central hub," said Mr. Harris. "That was true one year ago, and probably even six months ago," he added. "It was now time for us to adjust our connectivity strategy and embrace the open approach." Intuit now hopes OpenExchange will be its gateway to the Internet. The company plans to implement Internet connections for on-line investment activities next spring and for on-line banking and bill payment next fall. "Today," said Intuit chairman Scott Cook on the day the sale and OpenExchange were announced, "rapid advances in safety and reliability of the Internet make it the central focus of our overall connectivity and business strategy." OpenExchange is akin to other protocols being developed by Intuit competitors. But unlike Microsoft Corp.'s Open Financial Connectivity and Visa Interactive's ADMS (Access Device Message Specification), OpenExchange will also transmit nonbanking financial information. Intuit hopes thereby to encourage sales of its investment, tax, payroll and accounting software. American Banker: Monday, September 30, 1996 Bad News for High-Tech Lending: Borrowers Prefer People By Edward Kulkowsky About 97% of all homeowners prefer to apply for mortgages in person, according to a survey by the Mortgage Bankers Association. The finding suggests that there might be tough sledding ahead for lenders considering alternative marketing channels for mortgages, such as the Internet, phone, and video conferencing. The survey uncovered other consumer preferences that could be useful to lenders. "The findings are expected to help mortgage lenders more precisely target current homeowners to refinance, as well as help them retain their own current borrowers," said David Lereah, the MBA's chief economist. "Further, the information contained in the study provides investment bankers and institutional investors with an analysis of which types of mortgages are likely to refinance, in order to better predict prepayment speeds on mortgage-backed securities." The MBA said the final report and a data tape of the complete study, "Mortgage Refinancing Practices and Decision-Making Dynamics," is available for purchase. The tape provides extensive demographic data that can be sorted and stratified by 169 fields, according to the announcement. All 1,500 respondents originated or refinanced a loan between January 1991 and March 1996. The survey found that borrowers had limited loyalty to their current lender. About three-quarters of the 1,500 respondents to the survey were willing to consider lenders in addition to their present provider. About 80% of those who plan to remain in their homes more than five years said they would refinance if rates fell by one to two percentage points. More than half reported having refinanced their original mortgages, motivated primarily by attractive rates and lower fees. Other key findings: * Some 80% of those who refinanced now have fixed-rate loans. * About three-quarters of those who did not refinance already had fixed- rate loans, and two-thirds have loans with rates of 6.6% to 8%. * About a third of those who refinanced took out loans larger than their outstanding balances. * About half of the respondents said "too much paperwork" was the major difficulty in the refinancing process. The study was sponsored by the MBA, Citicorp Mortgage Inc., First Union Mortgage Corp., First Chicago NBD Mortgage and Norwest Mortgage Inc. and was conducted by R.S. Carmichael & Co., a market research company. News Release (Microsoft): Monday, September 30, 1996 Survey Shows Americans Struggle with Financial Fitness Experts look to PCs and Personal Finance Software for Better Money Management Results from the recent Money '97 Financial Fitness Survey reveal the average American's state of financial fitness falls well below expert guidelines. Microsoft Money '97 personal finance software commissioned the telephone survey of more than 1,000 respondents, in conjunction with the release of the latest version of the software package, to gain a better idea of how Americans are currently managing their personal finances. Some financial experts point to the online revolution as a promising part of the solution to America's woes. Studies show that over 750,000 households are already using online banking, with projections for a staggering 13 million by the year 2000. Computers and personal finance software are dramatically improving America's potential to gain control of their money management. For so long, so many have struggled to face the numbers, dreaded the monthly reconciliations and wondered whether they were really saving enough. But help is here in a way generations before never imagined. With a PC and personal finance software, people can now sit in the comfort of home and use online banking to pay bills electronically, reconcile check registers, transfer funds, and so much more. This new technology opens up a whole new world of financial ease and control for household money managers. Survey Reveals Persistent Trouble Spots Conducted by Opinion Research Corporation of Princeton, NJ, the Microsoft Money '97 Financial Fitness Survey compares American's personal finance management practices with the advice of leading personal finance experts in four key areas: 1) Budgets, Tracking & Categorizing; 2) Savings & Investments; 3) Credit Cards & Banking; 4) Retirement & Big Ticket Items. In all four fitness categories, the survey shows that many Americans struggle with common problem areas. For example: On Budgeting Experts say a solid, categorized budget is the foundation for financial fitness, however: * only 37% of Americans follow a categorized spending plan, while 42% simply pay bills and allocate what's left. Another 17% say they just don't budget at all. On Saving The advice "Pay yourself first!" is a familiar battle cry among financial experts, however: * more than half the Americans surveyed (56%) admit they do not set aside a fixed amount or percentage from each paycheck. Regarding those all-important personal emergency funds, experts say we should have a minimum of two months living expenses on hand, however: * among households with children between 12-17 years, a distressing 51% have either no funds tucked away or only enough to cover 2-4 weeks in a crisis. On Credit Paying high interest on credit card debt can negate gains of other good investments, however: * among the 76% who have credit cards, more than half don't pay off their balance each month, needlessly incurring finance charges and further debt. Planning for the Future It's important to know early on what we'll need for the big ticket items like college or our own retirement fund. However: * on college tuition, among households with children under 12 yrs, a surprisingly high 71% could not correctly estimate the cost of sending a child to one year of state university 15 years from now ($22,000). * on inflation, only 18% of Americans were able to correctly identify how much today's dollar will be worth in 20 years (38 cents). The Easy Way To Manage Money "The Money '97 survey does signal some troubling financial fitness problems," says personal finance expert and best-selling author Neale S. Godfrey ("Money Doesn't Grow On Trees," "A Penny Saved," "From Cradle to College"), "But it's my job to tell people, 'it's okay,' and where to go from here." Godfrey and other experts advise would-be money managers to start by getting the right tools and getting organized. Says Godfrey, "I use Microsoft Money to help people manage their money on a day-to-day basis and to see their complete financial picture. Then, they continue using it to keep finances in shape." Jack B. Root, President of Successful Money Management Seminars (SMMS) notes, "By computerizing personal finances, the formerly unfit will soon be able to determine exactly where their money's going. They'll have the understanding needed to set long term goals, make strategic decisions and stay in control." Microsoft Money '97 is an excellent task-based tool for tackling the most common financial fitness problems. Money '97 is quick and simple to learn, and helps the user work from categorized budgets, track finances, easily manage accounts and pay bills electronically (no more checks!). Even for the well-disciplined home finance manager, the online banking feature of Microsoft Money '97 can be a real time-saver and expand options. The user can easily download statements, balance accounts and transfer funds from home. In the Money '97 Financial Fitness Survey, nearly a quarter (22%) of respondents admit they reconcile their checking account to a bank statement (when notified of insufficient funds) only occasionally or never. But even for the many who reconcile regularly, studies show all but one percent are doing it the tedious manual way. Online banking allows people to access statements and reconcile checks at the touch of a button. Money '97 Launches National Financial Fitness Campaign To help America set out on the road to recovery, Money '97 is launching a national Financial Fitness Campaign. The multi-tiered program kicks off with free, open to the public Financial Fitness Events in New York, Chicago and San Francisco. Regional survey results and Money '97's campaign for change led the mayors of all three cities to declare "Financial Fitness Day" on the date the event comes to town. Participants will have a chance to take a financial fitness test, have their most pressing fitness problems diagnosed, and meet with financial experts for advice and information. The Money '97 training team will also be out in full force helping event-goers learn how to computerize their finances. Download Trial Version of Money '97 Free at MoneyZone Americans will have easy access to the tools needed to get started on their own financial fitness program. Beginning September 30th you can download a trial version of Money '97 for free (connect charges apply). Just go to Microsoft MoneyZone on the World Wide Web at www.microsoft.com/moneyzone. MoneyZone also links users to product support, a complete list of Money '97 ONLINE bank partners and a wealth of other personal finance management information. Additionally, working with Money '97, Successful Money Management Seminars (SMMS), will conduct ongoing seminars across the country to help Americans improve their financial management skills. Founded in 1975, Microsoft (Nasdaq: MSFT) is the worldwide leader in software for personal computers. The company offers a wide range of products and services for business and personal use, each designed with the mission of making it easier and more enjoyable for people to take advantage of the full power of personal computing everyday. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

White House Statement on Clipper 3.11
by abd＠cdt.org 17 Dec '03

17 Dec '03

Included below for your viewing pleasure is the Administration's latest encryption proposal, released at a White House briefing this afternoon. This statement, and more information including CDT's forthcoming analysis of the proposal, are available at: http://www.cdt.org/crypto http://www.crypto.com Alan Davidson, Staff Counsel 202.637.9800 (v) Center for Democracy and Technology 202.637.0968 (f) 1634 Eye St. NW, Suite 1100 <abd(a)cdt.org> Washington, DC 20006 PGP key via finger ---------------- THE WHITE HOUSE Office of the Vice President FOR IMMEDIATE RELEASE CONTACT: 456-7035 TUESDAY, October 1, 1996 STATEMENT OF THE VICE PRESIDENT President Clinton and I are committed to promoting the growth of electronic commerce and robust, secure communications worldwide while protecting the public safety and national security. To that end, this Administration is consulting with Congress, the information technology industry, state and local law enforcement officials, and foreign governments on a major initiative to liberalize export controls for commercial encryption products. The Administration's initiative will make it easier for Americans to use stronger encryption products -- whether at home or abroad -- to protect their privacy, intellectual property and other valuable information. It will support the growth of electronic commerce, increase the security of the global information, and sustain the economic competitiveness of U.S. encryption product manufacturers during the transition to a key management infrastructure. Under this initiative, the export of 56-bit key length encryption products will be permitted under a general license after one-time review, and contingent upon industry commitments to build and market future products that support key recovery. This policy will apply to hardware and software products. The relaxation of controls will last up to two years. The Administration's initiative recognizes that an industry-led technology strategy will expedite market acceptance of key recovery, and that the ultimate solution must be market-driven. Exporters of 56-bit DES or equivalent encryption products would make commitments to develop and sell products that support the key recovery system that I announced in July. That vision presumes that a trusted party (in some cases internal to the user's organization) would recover the user's confidentiality key for the user or for law enforcement officials acting under proper authority. Access to keys would be provided in accordance with destination country policies and bilateral understandings. No key length limits or algorithm restrictions will apply to exported key recovery products. Domestic use of key recovery will be voluntary, and any American will remain free to use any encryption system domestically. The temporary relaxation of controls is one part of a broader encryption policy initiative designed to promote electronic information security and public safety. For export control purposes, commercial encryption products will no longer be treated as munitions. After consultation with Congress, jurisdiction for commercial encryption controls will be transferred from the State Department to the Commerce Department. The Administration also will seek legislation to facilitate commercial key recovery, including providing penalties for improper release of keys, and protecting key recovery agents against liability when they properly release a key. As I announced in July, the Administration will continue to expand the purchase of key recovery products for U.S. government use, promote key recovery arrangements in bilateral and multilateral discussions, develop federal cryptographic and key recovery standards, and stimulate the development of innovative key recovery products and services. Under the relaxation, six-month general export licenses will be issued after one-time review, contingent on commitments from exporters to explicit benchmarks and milestones for developing and incorporating key recovery features into their products and services, and for building the supporting infrastructure internationally. Initial approval will be contingent on firms providing a plan for implementing key recovery. The plan will explain in detail the steps the applicant will take to develop, produce, distribute, and/or market encryption products with key recovery features. The specific commitments will depend on the applicant's line of business. The government will renew the licenses for additional six-month periods if milestones are met. Two years from now, the export of 56-bit products that do not support key recovery will no longer be permitted. Currently exportable 40-bit mass market software products will continue to be exportable. We will continue to support financial institutions in their efforts to assure the recovery of encrypted financial information. Longer key lengths will continue to be approved for products dedicated to the support of financial applications. The Administration will use a formal mechanism to provide industry, users, state and local law enforcement, and other private sector representatives with the opportunity to advise on the future of key recovery. Topics will include: evaluating the developing global key recovery architecture assessing lessons-learned from key recovery implementation advising on technical confidence issues vis-a-vis access to and release of keys addressing interoperability and standards issues identifying other technical, policy, and program issues for governmental action. The Administration's initiative is broadly consistent with the recent recommendations of the National Research Council. It also addresses many of the objectives of pending Congressional legislation.

1 0

Secure your E-mail with your Digital ID
by VeriSign Customer Service 17 Dec '03

17 Dec '03

Dear VeriSign Digital ID Holder: We hope that you have been enjoying the security and convenience of your Trial Digital ID. Our records indicate that your Digital ID will expire in 7 days. If you haven't already, please visit http://www.verisign.com/renewal to get a new ID to enjoy uninterrupted security. By upgrading to a Full Service Digital ID, you not only have the ability to digitally encrypt and sign your e-mail messages for privacy over the Internet, but also receive the following premium benefits: - Provides $1000 of NetSure(sm) protection for online commerce transactions - Allows for ID cancellation and reissuance in case of loss or overwriting on your computer - Inclusion in online ID directories, allowing friends and colleagues to send you encrypted e-mail Thanks again for choosing VeriSign. We look forward to serving your future electronic commerce and communications needs. VeriSign Customer Service

1 0

Press Release
by Peter D. Junger 17 Dec '03

17 Dec '03

Press Release Plaintiff Seeks Summary Judgment in Cleveland Case Challenging Licensing of ``Exports'' of Cryptographic Information Government Argues That Law Professor Cannot Challenge Regulation Requiring Him to Get Permission Before Teaching and Publishing Because He Did Not Apply for That Permission Oral Argument in Junger v. Christopher Set for Wednesday, November 20 Cleveland, Ohio, Tuesday, October 1, 1996 For Immediate Release For More Information Contact: Raymond Vasvari (216) 522-1925 Gino Scarselli (216) 291-8601 Or see URL: http://samsara.law.cwru.edu/comp_law/jvc/ Cleveland, Ohio, Oct. 1 -- Lawyers for Professor Peter D. Junger today filed a brief and a motion for summary judgment in Junger v. Christopher, the case challenging the licensing of the communication of ``cryptograhic software'' that is pending before Judge Donald C. Nugent in the Federal District Court here. Junger seeks an injunction against the enforcement of provisions of the International Traffic in Arms Regulations that require him to get the permission of the State Department's Office of Defense Trade Controls (the "ODTC") before he can communicate information about cryptographic software to foreign persons, ``whether in the United States or abroad.'' The penalty for failing to get such permission before disclosing the information can be as great as a fine of one million dollars and imprisonment for ten years. These provisions effectively prevent Junger from admitting foreign students to the course that he teaches about Computers and the Law at Case Western Reserve Law School in Cleveland, Ohio, and keep him from publishing his course materials and articles containing cryptographic software, or explaining what it does, how and where to get it, and how to use it. The challenged licensing scheme threatens the long-run viability of the United States software industry and, according to a blue-ribbon panel of the National Research Council, already costs that industry at least ``a few hundred million dollars per year ..., and all indications are that this figure will only grow in the future.'' The regulations have been extensively criticized by industry and bills to repeal or limit them are now pending in Congress. Junger's legal challenge is not based, however, on the economic damage that the ITAR's cryptographic licensing scheme imposes on the software industry and the nation's economy, but rather on the unconstitutional restraints that it imposes on anyone who wants to speak or write publically about any computer program that has, in the words of the ITAR, the ``capability of maintaining secrecy or confidentiality of information or information systems.'' Junger does not challenge the constitutionality of requiring one to get a license before exporting a physical cryptographic device: ``It isn't unconstitutional for the Office of Defense Trade Controls to damage the computer industry and our economy by requiring export licenses for cryptographic hardware, but information about cryptographic software is, as the National Research Council has pointed out, `pure knowledge that can be transported over national borders inside the heads of people or via letter.' Requiring the permission of the government before one can communicate knowledge is unconstitutional. Such a prior restraint is, in fact, the paradigmatic example of a violation of the First Amendment.'' THE GOVERNMENT ARGUES THAT PLAINTIFF MUST APPLY FOR PERMISSION TO SPEAK BEFORE HE CAN CHALLENGE THE REQUIREMENT THAT HE APPLY FOR SUCH PERMISSION In motions and briefs submitted August 21st, the government has asked the court to dismiss the lawsuit, or in the alternative, to grant the government judgment prior to trial. The government makes the initial argument that Junger lacks standing to claim that the provisions of the ITAR requiring him to get a formal license or other permission from the ODTC before he publically communicates information about cryptographic software, including the contents of the software itself, are unconstitutional. And it also argues that that claim is neither ``ripe'' nor ``colorable'', because Junger has not applied to the ODTC for such permission. Junger takes the position that as a law teacher who venerates the First Amendment it would be as improper for him to request the federal censors for permission to speak and publish as it would be for him openly violate the law. As he puts it: ``My duty is to challenge these unconstitutional regulations, not to give in to them nor to violate them in an act of civil disobedience.'' His lawyers point out in their briefs that few propositions of constitutional law are better established than the rule that a plaintiff does not have to submit to an unconstitutional restraint on speech and on the press before challenging it in court. ``Those arguments by the government are rather strange,'' says Gino J. Scarselli, one of Junger's lawyers, ``they seem to be based on their argument that cryptographic software is actually hardware because it is functional.'' And then he adds, ``Of course, that argument is also rather strange.'' THE GOVERNMENT ARGUES THAT SOME OF THE MATERIAL AT ISSUE IS EXEMPT UNDER THE ITAR The government also contends that some of the information at issue may be exempt from the ITAR's licensing requirements as technical data that is in the ``public domain'' because it is available to the public through ``fundamental research in science and engineering'' or through ``sales at newsstands and bookstores.'' ``That hardly is a defense,'' says Scarselli, ``since it is quite clear that the government will not concede that all of the information that Professor Junger wants to be able publish and discuss is in the public domain. And to make matters worse, the only way that Professor Junger can actually find out whether the government will treat particular information as being exempt from the formal licensing requirements is to apply to the ODTC for it calls a Commodity Jurisdiction Determination, which in reality is just another form of license.'' ``It is not as if I am engaged in fundamental research in science and engineering.'' Junger adds. ``What I want to publish and discuss has to do with the political and legal issues that are raised by computer technology, including, of course, cryptography. ``For just one example, since lawyers have a legal and ethical duty to protect the confidences of their clients, I am convinced that lawyers who use electronic mail or other computer technologies to communicate with their clients, or to store information supplied by their clients, are in some circumstances ethically, and perhaps even legally, required to use cryptography to maintain the confidentiality of that information. And yet I cannot publically explain to law students and lawyers--and lawyers cannot publically explain to their clients--how to obtain and use effective cryptographic software without first getting the government's permission to disclose that information. And, of course, if the cryptographic software really is effective, then there is little or no chance that the government will permit its disclosure.'' THE GOVERNMENT ARGUES THAT CRYPTOGRAPHIC SOFTWARE IS NOT PROTECTED BY THE FIRST AMENDMENT BECAUSE IT IS FUNCTIONAL There is no law in the United States that forbids or regulates the use of cryptography. Yet the government argues that the information in texts containing cryptographic software, including recipes for creating such software, can be used in a computer to preserve secrecy and confidentiality, and concludes that cryptographic software is ``conduct'' and ``functional'' and is thus not a text that is constitutionally protected as speech. Junger's lawyers, on the other hand, say that his claims do not relate to the conduct of running a cryptographic program on a computer--conduct that is not regulated by the ITAR, after all--and that he only challenges the restraints that the ITAR impose on the communication of information about how to carry on such legal conduct. ``Expressive conduct is exactly what is protected by the First Amendment,'' says Raymond Vasvari, another of Junger's lawyers. ``And if that expression were not functional, if it were not effective, there would be no need to protect it. The government's argument turns two hundred years of First Amendment jurisprudence on its head.'' ``The government's arguments about software being conduct and functional are striking examples of the sort of confusion that pervades the whole area of Computers and the Law,'' Junger says. ``Trying to clear up such confusion is my major goal in my course in Computers and the Law. In fact, when I started teaching that course in 1993, I wrote some cryptographic software to assist my students in grasping the distinction between software as a text that can be communicated, and that is protected by copyright law and the First Amendment, and software as a process that runs in a computer's central processor that can be protected by patents, but not by copyrights. If it weren't so frustrating, it would almost be funny that I cannot publish that software because of the prior restraints imposed by the defendants' interpretation of the ITAR, even though it is perfectly legal for me, or for any one else, including `foreign persons,' to actually run such software on a computer. The government's confusion is so extensive that an agent of the ODTC has actually told me that software, cryptographic software, is actually hardware.'' ``It is quite clear to me,'' Junger adds, ``that the State Department and the National Security Agency and other elements in the executive branch of the government are attempting to restrain the communication of information about cryptographic software not only abroad, but also within the United States, because they do not want us actually to be able to use cryptography to preserve the privacy of our thoughts and our communications. It is as if the government required one to get a license before explaining how to make or use an envelope, even though it did not forbid the use of envelopes themselves. After all, all that cryptographic software is is a way of making electronic envelopes.'' ORAL ARGUMENT SCHEDULED Junger v. Christopher has been placed on a fast track by Judge Nugent. On September 5 he established a briefing schedule: the plaintiff's brief was due and was filed today and the government's response is due on Friday, October 18. Oral argument is scheduled for Wednesday, November 20. Judge Nugent's decision is expected before the first of the year. BACKGROUND ON THE LITIGATION Litigation is expensive. Professor Junger and his volunteer lawyers were only able to bring the suit because of a generous gift by an anonymous donor of $5,000 that was used to create the ITAR Legal Attack Fund. Additional donations by Professor Junger and others have increased that fund to more than seven thousand dollars. Scarselli and Vasvari are lawyers in private practice in Cleveland who have dedicated much of their professional lives to the protection of First Amendment freedoms. The third lawyer on the team is Kevin O'Neill, a law professor at Cleveland State University and the former legal director of the Ohio Chapter of the American Civil Liberties Union. --30-- -- Peter D. Junger--Case Western Reserve University Law School--Cleveland, OH Internet: junger(a)pdj2-ra.f-remote.cwru.edu junger(a)samsara.law.cwru.edu URL: http://samsara.law.cwru.edu

1 0

Reality $trikes $BIG$
by Greg McCollum 17 Dec '03

17 Dec '03

Are you ready for this? $9,742 in One Week IS a Reality in REAL, HONEST, and PRACTICAL business! Take 30 seconds and change your life! You'll be on your way to Financial Freedom and peace of mind in minutes..... http://www.moneymania.com/madpack.htm Enjoy the ride! Call anytime 808 263-6954! Greg

1 0