- cypherpunks-legacy - lists.cpunks.org

Re: PC Expo, Mac World, Comdex, etc... (fwd)
by eileen＠photon.poly.edu 03 Mar '94

03 Mar '94

Also Sprach Arsen Ray Arachelian: > > >I LOVE IT! LET'S DO IT!!!!!!! > > Disks are dirt cheap. $0.39 per disk in 150 packs. > If we could get a few people to chip in $20, we can > buy quite a lot, over a hundred. The hard part is > duplicating them. (BTW: those disks come preformatted > for DOS. This is from MEI Microcenter.. 800-634-3478) What we need are people to take a portion of them and format them for Unix and Macintosh and any other versions of PGP that are there. Can the Unix version of PGP fit on a single disk? Also, we have to have the sort of people involved who won't just take the disks and walk with them. > The hardest part is printing labels that look > professional enough to prevent most of the yuppies > from being suspicious about a few kids handing out > disks. Piece of cake. My lover has his own desktop publishing buisness. With an HPLJ4 at home. No problem. We can make professional-looking handouts too. (We'll have to wear suits too in order to > not get them scared off... Sad, but effective..) You have to wear a suit (or at least reasonably dressy clothing) to be taken seriously at any Expo at all. One concern I have - did Zimmerman sell out to RSA yet? He was being sued as I recall, and the latest info I have is that he watered down version 2.3 to shut them up temporarily. What is the latest on that, and is 2.3 still the latest version of PGP? -- Eileen Tronolone | internet: eileen(a)photon.poly.edu | EARTH System Administrator | usenet: redsonja(a)olias.linet.org | JUICE! Polytechnic University | voice: (718) 260-3846 | -- RTF Brooklyn, NY 11201 | Self possession is 9/10 of the law.|

1 0

Re: spooks
by cfrye＠ciis.mitre.org 03 Mar '94

03 Mar '94

>If there are any spooks on this list aren't they required by law to say that >they are if somoeon asked if anyone on on th list was employed by CIA, DOD, FBI >or NSA? Hardly. The intel folks don't have to say diddley and might be prohibited by law from saying anything, the FBI probably doesn't need to since there's no criminal investigation under way (or is there?), and why in hell would DOD employees need to reveal their presence? We encourage open, anonymous

1 0

archive send: prescription
by rre-request＠weber.ucsd.edu 02 Mar '94

02 Mar '94

File: prescription BEGIN---------------cut here------------------ Date: Fri, 18 Feb 94 15:33:43 +0000 From: G.Joly(a)cs.ucl.ac.uk (Gordon Joly) Subject: MICE Seminar for February 22 at 14:00 GMT. Newsgroups: dec.mail.lists.rem-conf You are invited to the next MICE International Seminar which will take place next week. Please limit traffic for two hours from 14:00 GMT on Tuesday, February 22. This seminar will be transmitted on the usual multicast addresses (please see the sd entry), and will be advertised in sd from Tuesday morning. Further information of this and future seminars is kept in the URL http://www.cs.ucl.ac.uk/mice/seminars.html Bruno Struif (GMD) speaking from Darmstadt, Germany will give a presentation on: "The Privacy Enhanced Electronic Prescription". Abstract -------- In Germany, more than 500 millions prescriptions are issued per year. Normally, the patient receives the prescription in the doctor's practice and takes it to a pharmacy where he gets his medicaments. From the pharmacy, the prescription is physically transported to a pharmacy computer center where it will be processed in different ways. Finally the patient health insurance gets this prescription with listings containing the result of the processing in the pharmacy computer center. Since the prescription is a paper document, the processing is difficult, time-consuming and cost-intensive. The introduction of the health insurance card in Germany will improve the technological environment in the doctor's practices.The prescriptions will be produced in the future by using the health insurance card, a personal computer and a printer. The model presented shows that the electronic presentation of the prescription produced in the doctor's PC can be maintained so that the difficult and expensive way of processing paper prescriptions in the pharmacy, the pharmacy's computer center and finally by the health insurance can be avoided. The solution described and already implemented at GMD is - to sign the electronic prescription by the doctor with its physician smartcard capable to compute digital signatures - to write the electronic prescription in the patient's smartcard - to prove the authorization of a pharmacist for the access to the patient's smartcard by using a pharmacist smartcard - to electronically transmit the electronic prescription together with pharmacy information (name of the pharmacy, prescription cost etc) to the pharmacy computer center or the health insurance computing center where it can be automatically processed. The patient gets therefore two representation forms of the prescription, the electronic form and the paper form. The paper form is still necessary in the relationship doctor/patient/pharmacist, since - the patient has a right to look on the issued prescription, - in case of malfunction of the patient's smartcard in the pharmacy the delivery of the medicaments has still to be possible and - the assembly of the medicaments is easier with a paper form in the hand. In the new release of the electronic prescription model a step in the direction of data privacy has been made. The personal data of the patient and the doctor are replaced by digital pseudonyms in a way that the pharmacy computing center and the health insurance can verify only certain characteristics, e.g. that the prescription has been issued by a registered doctor and that the related patient is a member of the respective health insurance. In special cases, a re-identification of the doctor or the patient is possible by using re-identification smartcards. Gordon Joly Phone +44 71 380 7934 FAX +44 71 387 1397 Email: G.Joly(a)cs.ucl.ac.uk UUCP: ...!{uunet,uknet}!ucl-cs!G.Joly Comp Sci, University College, London, Gower Street, LONDON WC1E 6BT WWW WWW WWW http://www.cs.ucl.ac.uk/mice/gjoly.html WWW WWW WWW END-----------------cut here------------------ -- Stanton McCandlish * mech(a)eff.org * Electronic Frontier Found. OnlineActivist F O R M O R E I N F O, E - M A I L T O: I N F O @ E F F . O R G O P E N P L A T F O R M O N L I N E R I G H T S V I R T U A L C U L T U R E C R Y P T O

1 0

Re: lists of U.S. cypherpunks and tentacles (fwd)
by eileen＠photon.poly.edu 28 Feb '94

28 Feb '94

Also Sprach Arsen Ray Arachelian: > > I thought you might get a kick out of this one: > > > Tentacle(a)medusa.conspiracy.org wrote: > > > > >> Does there exist lists of Tentacles and CypherPunks who > > >> are U.S. citizens with U.S. email addresses? ROTFL!!!!!!!!!!!! (A filk to "Baby Face!) tentacle, you've got the cutest little tentacle I ate some stamps and now my life's not dull, tentacle you're an anarchist medusa I use crypto to confuse ya tentacle! your headers bouncing through my sendmail-dot-c-f! we do not see your puss 'cos you're anon-y-mous with your little tentacle! tentacle, you've got the cutest little tentacle in fact I see you've got your hands quite full, tentacle as the newsgroups I see you fill I would hate to get your phone bill tentacle! typing on fifteen keyboards, seen in 50 states! Rick Wakeman envies you! Wave hi to Elvis too, with your little tentacle! feel free to repost to crypto-toads/alt.filk or whatever that is! >;-7 -- Eileen Tronolone | internet: eileen(a)photon.poly.edu | EARTH System Administrator | usenet: redsonja(a)olias.linet.org | JUICE! Polytechnic University | voice: (718) 260-3846 | -- RTF Brooklyn, NY 11201 | Self possession is 9/10 of the law.|

1 0

FLASH: FBI's Draft Digital Telephony Bill: EFF Summary and Analysis
by djw＠eff.org 23 Feb '94

23 Feb '94

Electronic Frontier Foundation Statement on FBI Draft Digital Telephony Bill EFF has received a draft of the FBI's new, proposed "Digital Telephony" bill. After initial analysis, we strongly condemn bill, which would require all common carriers to construct their networks to deliver to law enforcement agencies, in real time, both the contents of all communications on their networks and the "signalling" or transactional information. In short, the bill lays the groundwork for turning the National Information Infrastructure into a nation-wide surveillance system, to be used by law enforcement with few technical or legal safeguards. This image is not hyperbole, but a real assessment of the power of the technology and inadequacy of current legal and technical privacy protections for users of communications networks. Although the FBI suggests that the bill is primarily designed to maintain status quo wiretap capability in the face of technological changes, in fact, it seeks vast new surveillance and monitoring tools. Among the new powers given to law enforcement are: 1. Real-time access to transactional information creates the ability to monitor individuals in real time. The bill would require common carrier network (telephone companies and anyone who plans to get into the telephone business, such as cable TV companies) to deliver, in real time, so called "call setup information." In the simplest case, call setup information is a list of phone numbers dialed by a given telephone currently under surveillance. As we all come to use electronic communications for more and more purposes, however, this simple call setup information could also reveal what movies we've order, which online information services we've connected to, which political bulletin boards we've dialed, etc. With increasing use of telecommunications, this simple transactional information reveals almost as much about our private lives as would be learned if someone literally followed us around on the street, watching our every move. We are all especially vulnerable to this kind of surveillance, because, unlike wiretapping the *content* of our communications, it is quite easy for law enforcement to get permission to obtain this transactional information. Whereas courts scrutinize wiretap requests very carefully, authorizations for access to call setup information are routinely granted with no substantive review. Some federal agencies, such as the IRS, even have the power to issue administrative subpoenas on their own, without appearing before a court. The real impact of the FBI proposal turns, in part, on the fact that it is easy to obtain court approval for seizing transactional data. The change from existing law contained in the FBI proposal is that carriers would have to deliver this call setup information *in real time*, directly to a remote listening post designated by law enforcement. Today, the government can obtain this information, but generally has to install a device (called a 'pen register') which is monitored manually at the telephone company switching office. 2. Access to communication and signalling information for any mobile communication, regardless of location allows tracking of an individual's movements. The bill requires that carriers be able to deliver either the contents or transactional information associated with any subscriber, even if that person is moving around from place to place with a cellular or PCS phone. It is conceivable that law enforcement could use the signalling information to identify that location of a target, whether that person is the subject of a wiretap order, or merely a subpoena for call setup information. This provision takes a major step beyond current law in that it allows for a tap and/or trace on a *person*, as opposed to mere surveillance of a telephone line. 3. Expanded access to electronic communications services, such as the Internet, online information services, and BBSs. The privacy of electronic communications services such as electronic mail is also put at grave risk. Today, a court order is required under the Electronic Communications Privacy Act to obtain the contents of electronic mail, for example. Those ECPA provisions would still apply for the contents of such messages, but the FBI bill suggests that common carriers might be responsible for delivering the addressing information associated with electronic mail and other electronic communications. For example, if a user connects to the Internet over local telephone lines, law enforcement might be able to demand from the telephone company information about where the user sent messages, and into which remote systems that user connects. All of this information could be obtained by law enforcement without every receiving a wiretap order. 4. The power to shut down non-compliant networks Finally, the bill proposes that the Attorney General have the power to shut down any common carrier service that fails to comply with all of these requirements. Some have already called this the "war powers" provision. Granting the Department of Justice such control over our nation's communications infrastructure is a serious threat to our First Amendment right to send and receive information, free from undue government intrusion. ******************************** The posting represents EFF's initial response to the new FBI proposal. Several documents, including the full text of the proposed bill and a more detailed section-by-section analysis are available by anonymous ftp on EFF's ftp site. This docuemnt is digtel94.announce The documents can be located via ftp, gopher, or www, as follows: ftp://ftp.eff.org/pub/EFF/Policy/Digital_Telephony/digtel94_bill.draft ftp://ftp.eff.org/pub/EFF/Policy/Digital_Telephony/digtel94_analysis.eff ftp://ftp.eff.org/pub/EFF/Policy/Digital_Telephony/digtel94.announce for gopher, same but replace first part with: gopher://gopher.eff.org/00/EFF/... for WWW, same but replace first part with: http:/www.eff.org/ftp/EFF/... ******************************** Press inquiries, contact: Jerry Berman, Executive Director <jberman(a)eff.org> Daniel Weitzner, Senior Staff Counsel <djw(a)eff.org> +1 202-347-5400 ************************************************************************** "I believe in markets doing what they do well, which is to develop technology, and letting citizens do what they ideally do well, which is to set policy." -Esther Dyson, President, EDventure Holdings, Inc. The Electronic Frontier Foundation is working to protect your privacy. To help stop Clipper and eliminate export controls on cryptography, support a bill introduced in the House of Representatives, HR 3627. To support the bill, send email to <cantwell(a)eff.org>. ...................................................................... Daniel J. Weitzner, Senior Staff Counsel <djw(a)eff.org> Electronic Frontier Foundation 202-347-5400 (v) 1001 G St, NW Suite 950 East 202-393-5509 (f) Washington, DC 20001 *** Join EFF!!! Send mail to membership(a)eff.org for information ***

1 0

Digital Telephony Bill 1994 (Draft)
by Mike Godwin 23 Feb '94

23 Feb '94

103rd Congress Draft 2/9/94 2nd Session S. _____ [H.R. _____] IN THE SENATE IN THE HOUSE OF REPRESENTATIVES M. __________ introduced the following bill; which was referred to the Committee on __________ A BILL To ensure continued law enforcement electronic surveillance access to the content of wire and electronic communications and call setup information when authorized by law, to improve communications privacy protection, and for other purposes. By it enacted by the Senate and House of Representatives of the United States of America in Congress assembled, SEC. 1. SHORT TITLE. This Act may be cited as the "Digital Telephony and Communications Privacy Improvement Act of 1994." SEC. 2. PURPOSE. The purpose of this Act is to clarify and define the responsibilities of common carriers, providers of common carrier support services, and telecommunications equipment manufacturers to provide the assistance required to ensure that government agencies can implement court orders and lawful authorizations to intercept the content of wire and electronic communications and acquire call setup information under chapters 119 and 206 of title 18 and chapter 36 of title 50. Otherwise, except for the provisions in section 4, nothing in this Act is intended to alter any provision contained in the Federal electronic surveillance, pen register, or trap and trace statutes, or those of any state or other jurisdiction. In particular, nothing herein is intended to enlarge or reduce the government's authority to lawfully intercept the content of communications or install or use pen register or trap and trace devices, or to increase or decrease any criminal penalties for unlawfully intercepting the content of communications or installing or using pen register or trap and trace devices, or to alter the provisions regarding service provider assistance, payment for assistance, causes of action, civil liability, or good faith defenses. The Act is further intended to improve communications privacy protection for cordless telephones, certain radio-based data communications and networks, communications transmitted using certain privacy-enhancing modulation techniques, and to clarify the lawfulness of quality control and service provision monitoring of electronic communications. SEC. 3. COMMON CARRIER ASSISTANCE (a) _New section_. Chapter 109 of title 18, United States Code, is amended by adding the following new section: "Sec. 2237. Common carrier assistance to government agencies. "(a) Assistance requirements. Common carriers shall be required to provide forthwith, pursuant to court order or lawful authorization, the following capabilities and capacities in order to permit the government to conduct electronic surveillance and pen register and trap and trace investigations effectively: "(1) The ability to execute expeditiously and simultaneously within a common carrier's system all court orders and lawful authorizations for the interception of wire and electronic communications and the acquisition of call setup information related to the facilities or services of subscribers of such common carrier; "(2) the ability to intercept the content of communications and acquire call setup information concurrent with the transmission of the communication to or from the subscriber's facility or service that is the subject of the court order or lawful authorization, to the exclusion of any wire or electronic communication or call setup information of any other subscriber, notwithstanding the mobile nature of the facility or service that is the subject of the court order or lawful authorization or the use by the subscriber who is the subject of the court order or lawful authorization of any features offered by the common carrier; "(3) the ability to intercept the content of communications and acquire call setup information unobtrusively and with a minimum of interference with any subscriber's telecommunications service; and "(4) the ability to receive, in a generally available format, the intercepted content of communications and acquired call setup information at a location identified by the government distant from the facility that is the subject of the interception, from the interception access point, and from the premises of the common carrier (except where emergency or exigent circumstances such as those described in 18 U.S.C. 2518(7), 2518(11)(b), or 3125, or in 50 U.S.C. 1805(e), necessitate monitoring at the common carrier's premises). "(b) Systems security. The government shall notify a common carrier of any interception of wire or electronic communications or any acquisition of call setup information that is to be effected within the premises of such common carrier pursuant to court order or lawful authorization. After notification, such common carrier shall designate an individual or individuals to activate such interception or acquisition forthwith. Such individual(s) shall be available at all times to activate such interceptions or acquisitions. Such interceptions or acquisitions effected within the premises of a common carrier may be activated only by the affirmative intervention of such individual(s) designated by such common carrier. "(c) Compliance date. To the extent that common carriers providing service within the United States currently cannot fulfil the requirements set forth in subsection (a) of this section, they shall fulfil such requirements within three years from the date of enactment of this Act. "(d) Cooperation of support service providers and equipment manufacturers. Common carriers shall consult, as necessary, in a timely fashion with appropriate providers of common carrier support services and telecommunications equipment manufacturers for the purpose of identifying any services or equipment, including hardware and software, that may require modification so as to permit compliance with the provisions of this Act. A provider of common carrier support services or a telecommunications equipment manufacturer shall make available to a common carrier on a timely and priority basis, and at a reasonable cost, any support service or equipment, including hardware or software, which may be required so as to permit compliance with the provisions of this Act. "(e) Enforcement. The Attorney General shall have authority to enforce the provisions of subsections (a), (b), (c), and (d) of this section. The Attorney General may apply to the appropriate United States District Court for an order restraining or enjoining the provision of service of any common carrier who violates subsection (a), (b), (c), or (d) of this section. The District Courts shall have jurisdiction to issue such restraining order or injunction. The Attorney General may also request the Federal Communications Commission to assist in enforcing the provisions of this Act. "(f) Penalties. Any common carrier that violates any provision of subsection (a) of this section shall be subject to a civil penalty of $10,000 per day for each day in violation. The Attorney General may file a civil action in the appropriate United States District Court to collect, and the United States District Courts shall jurisdiction to impose, such penalties. After consultation with the Attorney General, the Federal Communications Commission may also impose regulatory sanctions or fines otherwise authorized by law. "(g) Consultation. The Attorney General is encouraged to consult with the Federal Communications Commission and common carrier representatives and to utilize common carrier standards bodies, associations, or other such organizations to discuss details of the requirements, such as those related to capacity, in order to facilitate compliance with the provisions of this Act. "(h) Funding. Notwithstanding any other provision of law, the Federal Communications Commission shall implement promptly methods and procedures that allow each common carrier to be remunerated by the Federal Government for all reasonable costs incurred in the course of complying with the requirements of this Act. "(i) Definitions. -- As used in this Section -- (1) 'common carrier' means any person or entity engaged as a common carrier for hire, as defined by section 3(h) of the Communications Act of 1934, and includes a commercial mobile service or interconnected service, as defined in section 6002(b) of Public Law 103-66; (2) 'provider of common carrier support services' means any person or entity who provides services to a common carrier that are integral to processing, directing, forwarding, or completing telephone calls or electronic communication transmissions; (3) 'wire communication' shall have the same meaning as set forth in subsection 2510(1) of title 18, United States Code; (4) 'electronic communication' shall have the same meaning as set forth in subsection 2510(12) of title 18, United States Code; (5) 'intercept' shall have the same meaning as set forth in subsection 2510(4) of title 18, United States Code, except that with regard to a common carrier's transmission of a communication encrypted by a subscriber, the common carrier shall not be responsible for ensuring the government agency's ability to acquire the plaintext of the communications content, unless the encryption was provided by the common carrier and the common carrier possesses the information necessary to decrypt the communication; (6) 'concurrent with the transmission of the communication,' as used in section 3(a)(2) of this Act, means contemporaneous with the transmission; but it shall include, with regard to electronic communications, the ability of a government agency to acquire such communications at the conclusion of the transmission, and, with regard to call set up information, the ability to acquire such information either before, during, or immediately after the transmission of the communication; (7) 'call set up information' shall mean the information generated which identifies the origin and destination of a wire or electronic communication placed to, or received by, the facility or service that is the subject of a court order or lawful authorization, including information associated with any telecommunication system dialing or calling features or services; and (8) 'government' means the Government of the United States and any agency or instrumentality thereof, the District of Columbia, any commonwealth, territory or possession of the United States, and any state or political subdivision thereof authorized by law to conduct electronic surveillance." SEC. 4. COMMUNICATIONS PRIVACY IMPROVEMENT AND MONITORING CLARIFICATION. Chapter 119 of title 18 is amended by making the following changes: (1) Cordless telephones. (a) _Definitions_. - Section 2510 of title 18, United States Code, is amended - (1) in paragraph (1), by striking ", but such term does not include" and all that follows through "base unit"; and (2) in paragraph (12), by striking subparagraph (A) and redesignating subparagraphs (B) through (D) as subparagraphs (A) through (C), respectively. (b) _Penalty_. - Section 2511 of title 18, United States Code, is amended - (1) in subsection (4)(b)(i), by inserting "a cordless telephone communication that is transmitted between a cordless telephone handset and the base unit," after "cellular telephone communication,"; and (2) in subsection (4)(b)(ii), by inserting "a cordless telephone communication that is transmitted between a cordless telephone handset and the base unit," after "cellular telephone communication,". (2) Radio based data communications. Section 2510(16) of title 18, United States Code, is amended by striking the word "or" at the end of subparagraph (D) and inserting an "or" at the end of subparagraph (E) and adding the following new subparagraph: "(F) an electronic communication;". (3) Penalties for monitoring radio communications that are not scrambled, encrypted, or non-public. Section 2511(4)(b) of title 18, United States Code, is amended by deleting the phrase "or encrypted, then--" and inserting the following: ", encrypted, or transmitted using modulation techniques whose essential parameters have been withheld from the public with the intention of preserving the privacy or such communication, then--". (4)Technical correction. Section 2511(2)(a)(i) of title 18, United States Code, is amended by striking out "used in the transmission of wire communication" and inserting in lieu thereof "used in the transmission of a wire or electronic communication.".

1 0

Another Brick in the Wall
by farber＠central.cis.upenn.edu 23 Feb '94

23 Feb '94

CyberWire Dispatch//Copyright (c) 1994 Jacking in from Another Brick in the Wall Port: Washington, DC -- The White House is being heavily lobbied by law enforcement agencies and national intelligence agencies to make the use of the government designed Clipper Chip mandatory in telephones, fax machines and cable systems, according to classified documents obtained by Dispatch. When the Administration announced on February 4th that it was endorsing the controversial Clipper Chip program, it asserted that any use of the chip would be voluntary. But the White House carefully hedged its bet: Buried deep in the background briefing papers that accompanied the announcement was the Administration's official policy that U.S. citizens weren't guaranteed any constitutional right to choose their own encryption technologies. Government officials have brushed aside concerns from civil liberties groups and privacy advocates that sporadic adoption of Clipper would eventually spawn a mandatory use policy. To try and forestall that, however, the government has instituted a subtle coercion tactic: You can't do business with Uncle Sam unless your products are "clipper equipped," according to National Institute for Standards and Technology Assistant Deputy Director Raymond Kammer. The Administration's desire for industry to sign-on as an early Clipper "team player" was so overwhelming that it bribed AT&T into agreeing to publicly support the idea, according to classified documents obtained by Dispatch. On the same day last April when Clipper was first unveiled, AT&T publicly proclaimed it would be installing the chip in its encryption products. A classified April 30, 1993 memo from the Assistant Secretary of Defense says: "[T]he President has directed that the Attorney General request that manufacturers of communications hardware use the trapdoor chip, and at least AT&T has been reported willing to do so (having been suitably incentivised by promises of Government purchases)." The government says "incentivised" while prosecuting attorney's all over the country say, "bribed." You make the call. Take Your Privacy and Shove It ============================== That same memo says the Clipper proposal is a "complex set of issues [that] places the public's right to privacy in opposition to the public's desire for safety." If "privacy prevails... criminals and spies... consequently prosper," the memo says. What's the answer to such freeflowing privacy? The memo says law enforcement and national security agencies "propose that cryptography be made available and required which contains a 'trapdoor' that would allow law enforcement and national security officials, under proper supervision, to decrypt enciphered communications." The operative word here is "required." Two Track Dialog ================ While Clinton's policy wonks wring their hands over such issues as universal access to the National Information Infrastructure, law enforcement and national security officials couldn't care less, frankly. The Working Group on Privacy for the Information Infrastructure Task Force was told in clean, cold language that the desire of law enforcement is to "front load" the NII with "intercept technologies." Under the guise of "do it now or we'll catch less bad guys." It's all black or white to these guys. Other classified Dept. of Defense documents chime on this debate: "This worthy goal (of building the NII) is independent of arguments as to whether or not law enforcement and national security officials will be able to read at will traffic passing along the information superhighway." This is not science fiction. The Clipper chip is like a cancer that has eaten into the fabric of all levels of government, including the military. Classified DoD documents state that a "full-scale public debate is needed to ascertain the wishes of U.S. citizens with regard to their privacy, and the impact on public safety of preserving privacy at the expense of wiretapping and communications intercept capabilities of law enforcement and national security personnel." In other words, they don't think you know what you want. To them, it's a kind of tradeoff, a twisted sort of privacy auction. What do you bid? Your privacy for two drug lords, a former KGB spy and a pedophile. What's the price? Your government wants to know. Honest. The jury's still out, according to these classified documents: "It is not clear what the public will decide." But you can rest safely, the Pentagon does. Why? Again from a secret memo: "In the meantime, DoD has trapdoor technology and the Government is proceeding with development of the processes needed to apply that technology in order to maintain the capability to perform licit intercept of communications in support of law enforcement and national security." Meeks out...

1 0

FIPS 185 - EES
by jet＠nas.nasa.gov 23 Feb '94

23 Feb '94

[From the NIST Computer Security Bulletin Board] FEDERAL INFORMATION PROCESSING STANDARDS PUBLICATION 185 1994 February 9 U.S. DEPARTMENT OF COMMERCE/National Institute of Standards and Technology ESCROWED ENCRYPTION STANDARD CATEGORY: TELECOMMUNICATIONS SECURITY U.S. DEPARTMENT OF COMMERCE, Ronald H. Brown, Secretary NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY, Arati Prabhakar, Director Foreword The Federal Information Processing Standards Publication Series of the National Institute of Standards and Technology (NIST) is the official series of publications relating to standards and guidelines adopted and promulgated under the provisions of Section 111(d) of the Federal Property and Administrative Services Act of 1949 as amended by the Computer Security Act of 1987, Public Law 100-235. These mandates have given the Secretary of Commerce and NIST important responsibilities for improving the utilization and management of computer and related telecommunications systems in the Federal Government. The NIST, through the Computer Systems Laboratory, provides leadership, technical guidance, and coordination of Government efforts in the development of standards and guidelines in these areas. Comments concerning Federal Information Processing Standards Publications are welcomed and should be addressed to the Director, Computer Systems Laboratory, National Institute of Standards and Technology, Gaithersburg, MD 20899. James H. Burrows, Director Computer Systems Laboratory Abstract This standard specifies an encryption/decryption algorithm and a Law Enforcement Access Field (LEAF) creation method which may be implemented in electronic devices and used for protecting government telecommunications when such protection is desired. The algorithm and the LEAF creation method are classified and are referenced, but not specified, in the standard. Electronic devices implementing this standard may be designed into cryptographic modules which are integrated into data security products and systems for use in data security applications. The LEAF is used in a key escrow system that provides for decryption of telecommunications when access to the telecommunications is lawfully authorized. Key words: Cryptography, Federal Information Processing Standard, encryption, key escrow system, security. FIPS PUB 185 Federal Information Processing Standards Publication 185 1994 February 9 Announcing the Escrowed Encryption Standard (EES) Federal Information Processing Standards Publications (FIPS PUBS) are issued by the National Institute of Standards and Technology (NIST) after approval by the Secretary of Commerce pursuant to Section 111(d) of the Federal Property and Administrative Services Act of 1949 as amended by the Computer Security Act of 1987, Public Law 100-235. Name of Standard: Escrowed Encryption Standard (EES). Category of Standard: Telecommunications Security. Explanation: This Standard specifies use of a symmetric-key encryption (and decryption) algorithm (SKIPJACK) and a Law Enforcement Access Field (LEAF) creation method (one part of a key escrow system) which provides for decryption of encrypted telecommunications when interception of the telecommunications is lawfully authorized. Both the SKIPJACK algorithm and the LEAF creation method are to be implemented in electronic devices (e.g., very large scale integration chips). The devices may be incorporated in security equipment used to encrypt (and decrypt) sensitive unclassified telecommunications data. Decryption of lawfully intercepted telecommunications may be achieved through the acquisition and use of the LEAF, the decryption algorithm and the two escrowed key components. One definition of "escrow" means that something (e.g., a document, an encryption key) is "delivered to a third person to be given to the grantee only upon the fulfillment of a condition" (Webster's Seventh New Collegiate Dictionary). The term, "escrow", for purposes of this standard, is restricted to this dictionary definition. A key escrow system, for purposes of this standard, is one that entrusts the two components comprising a cryptographic key (e.g., a device unique key) to two key component holders (also called "escrow agents"). In accordance with the above definition of "escrow", the key component holders provide the components of a key to a "grantee" (e.g., a law enforcement official) only upon fulfillment of the condition that the grantee has properly demonstrated legal authorization to conduct electronic surveillance of telecommunications which are encrypted using the specific device whose device unique key is being requested. The key components obtained through this process are then used by the grantee to reconstruct the device unique key and obtain the session key which is then used to decrypt the telecommunications that are encrypted with that session key. The SKIPJACK encryption/decryption algorithm has been approved for government applications requiring encryption of sensitive but unclassified data telecommunications as defined herein. The specific operations of the SKIPJACK algorithm and the LEAF creation method are classified and hence are referenced, but not specified, in this standard. Data for purposes of this standard includes voice, facsimile and computer information communicated in a telephone system. A telephone system for purposes of this standard is limited to a system which is circuit switched and operating at data rates of standard commercial modems over analog voice circuits or which uses basic-rate ISDN or a similar grade wireless service. Data that is considered sensitive by a responsible authority should be encrypted if it is vulnerable to unauthorized disclosure during telecommunications. A risk analysis should be performed under the direction of a responsible authority to determine potential threats and risks. The costs of providing encryption using this standard as well as alternative methods and their respective costs should be projected. A responsible authority should then make a decision, based on the risk and cost analyses, whether or not to use encryption and then whether or not to use this standard. Approving Authority: Secretary of Commerce. Maintenance Agency: Department of Commerce, National Institute of Standards and Technology. Applicability: This standard is applicable to all Federal departments and agencies and their contractors under the conditions specified below. This standard may be used in designing and implementing security products and systems, which Federal departments and agencies use or operate or which are operated for them under contract. These products may be used when replacing Type II and Type III (DES) encryption devices and products owned by the government and government contractors. This standard may be used when the following conditions apply: 1. An authorized official or manager responsible for data security or the security of a computer system decides that encryption is required and cost justified as per OMB Circular A- 130; and 2. The data is not classified according to Executive Order 12356, entitled "National Security Information," or to its successor orders, or to the Atomic Energy Act of 1954, as amended. However, Federal departments or agencies which use encryption devices for protecting data that is classified according to either of these acts may use those devices also for protecting unclassified data in lieu of this standard. In addition, this standard may be adopted and used by non-Federal Government organizations. Such use is encouraged when it provides the desired security. Applications: This standard may be used in any unclassified government and commercial communications. Use of devices conforming to this standard is voluntary for unclassified government applications and for commercial security applications. Implementations: The encryption/decryption algorithm and the LEAF creation method shall be implemented in electronic devices (e.g., electronic chip packages) which are protected against unauthorized entry, modification and reverse engineering. Implementations which are tested and validated by NIST will be considered as complying with this standard. An electronic device shall be incorporated into a cryptographic module in accordance with FIPS 140-1. NIST will test for conformance with FIPS 140-1. Conforming cryptographic modules can then be integrated into security equipment for sale and use in a security application. Information about devices that have been validated, procedures for testing equipment for conformance with NIST standards, and information about approved security equipment are available from the Computer Systems Laboratory, NIST, Gaithersburg, MD 20899. Export Control: Implementations of this standard are subject to Federal Government export controls as specified in Title 22, Code of Federal Regulations, Parts 120 through 131 (International Traffic of Arms Regulations - ITAR). Exporters of encryption devices, equipment and technical data are advised to contact the U.S. Department of State, Office of Defense Trade Controls for more information. Patents: Implementations of this standard may be covered by U.S. and foreign patents. Implementation Schedule: This standard becomes effective thirty days following publication of this FIPS PUB. Specifications: Federal Information Processing Standard (FIPS 185), Escrowed Encryption Standard (EES) (affixed). Cross Index: a. FIPS PUB 46-2, Data Encryption Standard. b. FIPS PUB 81, Modes of Operation of the DES c. FIPS PUB 140-1, Security Requirements for Cryptographic Modules. GLOSSARY: The following terms are used as defined below for purposes of this standard: Data - Unclassified voice, facsimile and computer information communicated over a telephone system. Decryption - Conversion of ciphertext to plaintext through the use of a cryptographic algorithm. Device (cryptographic) - An electronic implementation of the encryption/decryption algorithm and the LEAF creation method as specified in this standard. Digital data - Data that have been converted to a binary representation. Encryption - Conversion of plaintext to ciphertext through the use of a cryptographic algorithm. Key components - The two values from which a key can be derived (e.g., KU1 ~ KU2). Key escrow - The processes of managing (e.g., generating, storing, transferring, auditing) the two components of a cryptographic key by two key component holders. LEAF Creation Method - A part of a key escrow system that is implemented in a cryptographic device and creates a Law Enforcement Access Field. Type I cryptography - A cryptographic algorithm or device approved by the National Security Agency for protecting classified information. Type II cryptography - A cryptographic algorithm or device approved by the National Security Agency for protecting sensitive unclassified information in systems as specified in section 2315 of Title 10 United States Code, or section 3502(2) of Title 44, United States Code. Type III cryptography - A cryptographic algorithm or device approved as a Federal Information Processing Standard. Type III(E) cryptography - A Type III algorithm or device that is approved for export from the United States. Qualifications: The protection provided by a security product or system is dependent on several factors. The protection provided by the SKIPJACK algorithm against key search attacks is greater than that provided by the DES algorithm (e.g., the cryptographic key is longer). However, provisions of this standard are intended to ensure that information encrypted through use of devices implementing this standard can be decrypted by a legally authorized entity. Where to Obtain Copies of the Standard: Copies of this publication are for sale by the National Technical Information Service, U.S. Department of Commerce, Springfield, VA 22161. When ordering, refer to Federal Information Processing Standards Publication 185 (FIPS PUB 185), and identify the title. When microfiche is desired, this should be specified. Prices are published by NTIS in current catalogs and other issuances. Payment may be made by check, money order, deposit account or charged to a credit card accepted by NTIS. Federal Information Processing Standards Publication 185 1994 February 9 Specifications for the ESCROWED ENCRYPTION STANDARD 1. INTRODUCTION This publication specifies Escrowed Encryption Standard (EES) functions and parameters. 2. GENERAL This standard specifies use of the SKIPJACK cryptographic algorithm and a LEAF Creation Method to be implemented in an approved electronic device (e.g., a very large scale integration electronic chip). The device is contained in a logical cryptographic module which is then integrated in a security product for encrypting and decrypting telecommunications. Approved implementations may be procured by authorized organizations for integration into security equipment. Devices must be tested and validated by NIST for conformance to this standard. Cryptographic modules must be tested and validated by NIST for conformance to FIPS 140-1. 3. ALGORITHM SPECIFICATIONS The specifications of the encryption/decryption algorithm (SKIPJACK) and LEAF Creation Method 1 (LCM-1) are classified. The National Security Agency maintains these classified specifications and approves the manufacture of devices which implement the specifications. NIST tests for conformance of the devices implementing this standard in cryptographic modules to FIPS 140-1 and FIPS 81. 4. FUNCTIONS AND PARAMETERS 4.1 FUNCTIONS The following functions, at a minimum, shall be implemented: 1. Data Encryption: A session key (80 bits) shall be used to encrypt plaintext information in one or more of the following modes of operation as specified in FIPS 81: ECB, CBC, OFB (64), CFB (1, 8, 16, 32, 64). 2. Data Decryption: The session key (80 bits) used to encrypt the data shall be used to decrypt resulting ciphertext to obtain the data . 3. LEAF Creation: A Family Key (e.g., KF-1) shall be used to create a Law Enforcement Access Field (LEAF) in accordance with a LEAF Creation Method (e.g., LCM-1). The security equipment shall ensure that the LEAF is transmitted in such a manner that the LEAF and ciphertext may be decrypted with legal authorization. No additional encryption or modification of the LEAF is permitted. 4.2 PARAMETERS The following parameters shall be used in performing the prescribed functions: 1. Device Unique Identifier (UID): The identifier unique to a particular device and used by the Key Escrow System. 2. Device Unique Key (KU): The cryptographic key unique to a particular device and used by the Key Escrow System. 3. Cryptographic Protocol Field (CPF): The field identifying the registered cryptographic protocol used by a particular application and used by the Key Escrow System (reserved for future specification and use). 4. Escrow Authenticator (EA): A binary pattern that is inserted in the LEAF to ensure that the LEAF is transmitted and received properly and has not been modified, deleted or replaced in an unauthorized manner. 5. Initialization Vector (IV): A mode and application dependent vector of bytes used to initialize, synchronize and verify the encryption, decryption and key escrow functions. 6. Family Key (KF): The cryptographic key stored in all devices designated as a family that is used to create a LEAF. 7. Session Key (KS): The cryptographic key used by a device to encrypt and decrypt data during a session. 8. Law Enforcement Access Field (LEAF): The field containing the encrypted session key and the device identifier and the escrow authenticator. 5. IMPLEMENTATION The Cryptographic Algorithm (i.e., SKIPJACK) and a LEAF Creation Method (e.g., LCM-1) shall be implemented in an electronic device (e.g., VLSI chip) which is highly resistant to reverse engineering (destructive or non-destructive) to obtain or modify the cryptographic algorithm, the UID, the KF, the KU, the EA, the CPF, the operational KS, and any other security or Key Escrow System relevant information. The device shall be able to be programmed/personalized (i.e., made unique) after mass production in such a manner that the UID, KU (or its components), KF (or its components) and EA fixed pattern can be entered once (and only once) and maintained without external electrical power. The LEAF and the IV shall be transmitted with the ciphertext. The specifics of the protocols used to create and transmit the LEAF, IV, and encrypted data shall be registered and a CPF assigned. The CPF (and the KF-ID, LCM-ID) shall then be transmitted in accordance with the registered specifications. Various devices implementing this standard are anticipated. The implementation may vary with the application. The specific electric, physical and logical interface will vary with the implementation. Each approved, registered implementation shall have an unclassified electrical, physical and logical interface specification sufficient for an equipment manufacturer to understand the general requirements for using the device. Some of the requirements may be classified and therefore would not be specified in the unclassified interface specification. The device Unique Key shall be composed of two components (each a minimum of 80 bits long) and each component shall be independently generated and stored by an escrow agent. The session key used to encrypt transmitted information shall be the same as the session key used to decrypt received information in a two-way simultaneous communication. The Lead Creation Method (LCM), the Cryptographic Protocol Field (CPF), and the Family Key Identifier (KF-ID) shall be registered in the NIST Computer Security Object Register. This standard is not an interoperability standard. It does not provide sufficient information to design and implement a security device or equipment. Other specifications and standards will be required to assure interoperability of EES devices in various applications. Specifications of a particular EES device must be obtained from the manufacturer. The specifications for the SKIPJACK algorithm are contained in the R21 Informal Technical Report entitled "SKIPJACK" (S), R21-TECH- 044-91, May 21, 1991. The specifications for LEAF Creation Method 1 are contained in the R21 Informal Technical Report entitled "Law Enforcement Access Field for the Key Escrow Microcircuit" (S). Organizations holding an appropriate security clearance and entering into a Memorandum of Agreement with the National Security Agency regarding implementation of the standard will be provided access to the classified specifications. Inquiries may be made regarding the Technical Reports and this program to Director, National Security Agency, Fort George G. Meade, MD 20755-6000, ATTN: R21. -- Stanton McCandlish * mech(a)eff.org * Electronic Frontier Found. OnlineActivist F O R M O R E I N F O, E - M A I L T O: I N F O @ E F F . O R G O P E N P L A T F O R M O N L I N E R I G H T S V I R T U A L C U L T U R E C R Y P T O

1 0

NIST Crypto Update
by jet＠nas.nasa.gov 23 Feb '94

23 Feb '94

[From the NIST Computer Security Bulletin Board] (EMBARGOED FOR RELEASE: 3:00 P.M., Friday, Feb. 4, 1994) Fact Sheet NIST Cryptography Activities Escrowed Encryption Standard On April 16, 1993, the White House announced that the President approved a directive on "Public Encryption Management." Among other items, the President directed the Secretary of Commerce, in consultation with other appropriate U.S. agencies, to initiate a process to write standards to facilitate the procurement and use of encryption devices fitted with key-escrow microcircuits in federal communications systems that process sensitive but unclassified information. In response to the President's directive, on July 30, 1993, the Department of Commerce's National Institute of Standards and Technology (NIST) announced the voluntary Escrowed Encryption Standard (EES) as a draft Federal Information Processing Standard (FIPS) for public comment. The FIPS would enable federal agencies to procure escrowed encryption technology when it meets their requirements; the standard is not to be mandatory for either federal agency or private sector use. During the public review of the draft standard, a group of independent cryptographers were provided the opportunity to examine the strength of the classified cryptographic algorithm upon which the EES is based. They found that the algorithm provides significant protection and that it will be 36 years until the cost of breaking the EES algorithm will be equal to the cost of breaking the current Data Encryption Standard. They also found that there is no significant risk that the algorithm can be broken through a shortcut method of attack. Public comments were received by NIST on a wide range of issues relevant to the EES. The written comments submitted by interested parties and other information available to the Department relevant to this standard were reviewed by NIST. Nearly all of the comments received from industry and individuals opposed the adoption of the standard. However, many of those comments reflected misunderstanding or skepticism about the Administration's statements that the EES would be a voluntary standard. The Administration has restated that the EES will be a strictly voluntary standard available for use as needed to provide more secure telecommunications. The standard was found to be technically sound and to meet federal agency requirements. NIST made technical and editorial changes and recommended the standard for approval by the Secretary of Commerce. The Secretary now has approved the EES as a FIPS voluntary standard. In a separate action, the Attorney General has now announced that NIST has been selected as one of the two trusted agents who will safeguard components of the escrowed keys.Digital Signature Standard In 1991, NIST proposed a draft digital signature standard as a federal standard for publiccomment. Comments were received by NIST on both technical and patent issues. NIST has reviewed the technical comments and made appropriate changes to the draft. In order to resolve the patent issues, on June 3, 1993, NIST proposed a cross-licensing arrangement for a "Digital Signature Algorithm" for which NIST has received a patent application. The algorithm forms the basis of the proposed digital signature standard. Extensive public comments were received on the proposed arrangement, many of them negative and indicating the need for royalty-free availability of the algorithm. The Administration has now concluded that a royalty-free digital signature technique is necessary in order to promote widespread use of this important information security technique. NIST is continuing negotiations with the aim of obtaining a digital signature standard with royalty-free use worldwide. NIST also will pursue other technical and legal options to attain that goal. Cooperation with Industry During the government's review of cryptographic policies and regulations, NIST requested assistance from the Computer System Security and Privacy Advisory Board to obtain public input on a wide range of cryptographic-related issues, including the key escrow encryption proposal, legal and Constitutional issues, social and public policy issues, privacy, vendor and business perspectives, and users' perspectives. The Board held five days of public meetings. Comments obtained by the Board were useful during the government's review of these issues. In addition, NIST met directly with many industry and public interest organizations, including those on the Digital Privacy and Security Working Group and the Electronic Frontier Foundation. As directed by the President when the key escrow encryption initiative was announced, the government continues to be open to other approaches to key escrowing. On August 24, 1993, NIST also announced the opportunity to join a Cooperative Research and Development Agreement (CRADA) to develop secure software encryption with integrated cryptographic key escrowing techniques. Three industry participants have expressed their interest to NIST in this effort; however, the government still seeks fuller participation from the commercial software industry. NIST now is announcing an opportunity for industry to join in a CRADA to develop improved and alternative hardware technologies that contain key escrow encryption capabilities. Additionally, the Administration has decided to strengthen NIST's cryptographic capabilities in order to better meet the needs of U.S. industry and federal agencies. 2/4/94 -- Stanton McCandlish * mech(a)eff.org * Electronic Frontier Found. OnlineActivist F O R M O R E I N F O, E - M A I L T O: I N F O @ E F F . O R G O P E N P L A T F O R M O N L I N E R I G H T S V I R T U A L C U L T U R E C R Y P T O

1 0

Gopher File
by brenner＠netcom.com 16 Feb '94

16 Feb '94

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- =-=-=-=-=-=-Copyright 1993,4 Wired USA Ltd. All Rights Reserved=-=-=-=-=-= -=-=For complete copyright information, please see the end of this file=-=- =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= WIRED 2.04 Electrosphere ************* Jackboots on the Infobahn ^^^^^^^^^^^^^^^^^^^^^^^^^ Clipper is a last ditch attempt by the United States, the last great power from the old Industrial Era, to establish imperial control over cyberspace. By John Perry Barlow [Note: The following article will appear in the April 1994 issue of WIRED. We, the editors of WIRED, are net-casting it now in its pre-published form as a public service. Because of the vital and urgent nature of its message, we believe readers on the Net should hear and take action now. You are free to pass this article on electronically; in fact we urge you to replicate it throughout the net with our blessings. If you do, please keep the copyright statements and this note intact. For a complete listing of Clipper-related resources available through WIRED Online, send email to <infobot(a)wired.com> with the following message: "send clipper.index". - The Editors of WIRED] On January 11, I managed to schmooze myself aboard Air Force 2. It was flying out of LA, where its principal passenger had just outlined his vision of the information superhighway to a suited mob of television, show- biz, and cable types who fervently hoped to own it one day - if they could ever figure out what the hell it was. >From the standpoint of the Electronic Frontier Foundation the speech had been wildly encouraging. The administration's program, as announced by Vice President Al Gore, incorporated many of the concepts of open competition, universal access, and deregulated common carriage that we'd been pushing for the previous year. But he had said nothing about the future of privacy, except to cite among the bounties of the NII its ability to "help law enforcement agencies thwart criminals and terrorists who might use advanced telecommunications to commit crimes." On the plane I asked Gore what this implied about administration policy on cryptography. He became as noncommittal as a cigar-store Indian. "We'll be making some announcements.... I can't tell you anything more." He hurried to the front of the plane, leaving me to troubled speculation. Despite its fundamental role in assuring privacy, transaction security, and reliable identity within the NII, the Clinton administration has not demonstrated an enlightenment about cryptography up to par with the rest of its digital vision. The Clipper Chip - which threatens to be either the goofiest waste of federal dollars since President Gerald Ford's great Swine Flu program or, if actually deployed, a surveillance technology of profound malignancy - seemed at first an ugly legacy of the Reagan-Bush modus operandi. "This is going to be our Bay of Pigs," one Clinton White House official told me at the time Clipper was introduced, referring to the disastrous plan to invade Cuba that Kennedy inherited from Eisenhower. (Clipper, in case you're just tuning in, is an encryption chip that the National Security Agency and FBI hope will someday be in every phone and computer in America. It scrambles your communications, making them unintelligible to all but their intended recipients. All, that is, but the government, which would hold the "key" to your chip. The key would separated into two pieces, held in escrow, and joined with the appropriate "legal authority.") Of course, trusting the government with your privacy is like having a Peeping Tom install your window blinds. And, since the folks I've met in this White House seem like extremely smart, conscious freedom-lovers - hell, a lot of them are Deadheads - I was sure that after they were fully moved in, they'd face down the National Security Agency and the FBI, let Clipper die a natural death, and lower the export embargo on reliable encryption products. Furthermore, the National Institutes of Standards and Technology and the National Security Council have been studying both Clipper and export embargoes since April. Given that the volumes of expert testimony they had collected overwhelmingly opposed both, I expected the final report would give the administration all the support it needed to do the right thing. I was wrong. Instead, there would be no report. Apparently, they couldn't draft one that supported, on the evidence, what they had decided to do instead. THE OTHER SHOE DROPS On Friday, February 4, the other jackboot dropped. A series of announcements from the administration made it clear that cryptography would become their very own "Bosnia of telecommunications" (as one staffer put it). It wasn't just that the old Serbs in the National Security Agency and the FBI were still making the calls. The alarming new reality was that the invertebrates in the White House were only too happy to abide by them. Anything to avoid appearing soft on drugs or terrorism. So, rather than ditching Clipper, they declared it a Federal Data Processing Standard, backing that up with an immediate government order for 50,000 Clipper devices. They appointed the National Institutes of Standards and Technology and the Department of Treasury as the "trusted" third parties that would hold the Clipper key pairs. (Treasury, by the way, is also home to such trustworthy agencies as the Secret Service and the Bureau of Alcohol, Tobacco, and Firearms.) They reaffirmed the export embargo on robust encryption products, admitting for the first time that its purpose was to stifle competition to Clipper. And they outlined a very porous set of requirements under which the cops might get the keys to your chip. (They would not go into the procedure by which the National Security Agency could get them, though they assured us it was sufficient.) They even signaled the impending return of the dread Digital Telephony, an FBI legislative initiative requiring fundamental reengineering of the information infrastructure; providing wiretapping ability to the FBI would then become the paramount design priority. INVASION OF THE BODY SNATCHERS Actually, by the time the announcements thudded down, I wasn't surprised by them. I had spent several days the previous week in and around the White House. I felt like I was in another remake of The Invasion of the Body Snatchers. My friends in the administration had been transformed. They'd been subsumed by the vast mindfield on the other side of the security clearance membrane, where dwell the monstrous bureaucratic organisms that feed on fear. They'd been infected by the institutionally paranoid National Security Agency's Weltanschauung. They used all the telltale phrases. Mike Nelson, the White House point man on the NII, told me, "If only I could tell you what I know, you'd feel the same way I do." I told him I'd been inoculated against that argument during Vietnam. (And it does seem to me that if you're going to initiate a process that might end freedom in America, you probably need an argument that isn't classified.) Besides, how does he know what he knows? Where does he get his information? Why, the National Security Agency, of course. Which, given its strong interest in the outcome, seems hardly an unimpeachable source. However they reached it, Clinton and Gore have an astonishingly simple bottom line, to which even the future of American liberty and prosperity is secondary: They believe that it is their responsibility to eliminate, by whatever means, the possibility that some terrorist might get a nuke and use it on, say, the World Trade Center. They have been convinced that such plots are more likely to ripen to hideous fruition behind a shield of encryption. The staffers I talked to were unmoved by the argument that anyone smart enough to steal a nuclear device is probably smart enough to use PGP or some other uncompromised crypto standard. And never mind that the last people who popped a hooter in the World Trade Center were able to get it there without using any cryptography and while under FBI surveillance. We are dealing with religion here. Though only ten American lives have been lost to terrorism in the last two years, the primacy of this threat has become as much an article of faith with these guys as the Catholic conviction that human life begins at conception or the Mormon belief that the Lost Tribe of Israel crossed the Atlantic in submarines. In the spirit of openness and compromise, they invited the Electronic Frontier Foundation to submit other solutions to the "problem" of the nuclear-enabled terrorist than key escrow devices, but they would not admit into discussion the argument that such a threat might, in fact, be some kind of phantasm created by the spooks to ensure their lavish budgets into the post-Cold War era. As to the possibility that good old-fashioned investigative techniques might be more valuable in preventing their show-case catastrophe (as it was after the fact in finding the alleged perpetrators of the last attack on the World Trade Center), they just hunkered down and said that when wiretaps were necessary, they were damned well necessary. When I asked about the business that American companies lose because of their inability to export good encryption products, one staffer essentially dismissed the market, saying that total world trade in crypto goods was still less than a billion dollars. (Well, right. Thanks more to the diligent efforts of the National Security Agency than to dim sales potential.) I suggested that a more immediate and costly real-world effect of their policies would be to reduce national security by isolating American commerce, owing to a lack of international confidence in the security of our data lines. I said that Bruce Sterling's fictional data-enclaves in places like the Turks and Caicos Islands were starting to look real-world inevitable. They had a couple of answers to this, one unsatisfying and the other scary. The unsatisfying answer was that the international banking community could just go on using DES, which still seemed robust enough to them. (DES is the old federal Data Encryption Standard, thought by most cryptologists to be nearing the end of its credibility.) More frightening was their willingness to counter the data-enclave future with one in which no data channels anywhere would be secure from examination by one government or another. Pointing to unnamed other countries that were developing their own mandatory standards and restrictions regarding cryptography, they said words to the effect of, "Hey, it's not like you can't outlaw the stuff. Look at France." Of course, they have also said repeatedly - and for now I believe them - that they have absolutely no plans to outlaw non-Clipper crypto in the US. But that doesn't mean that such plans wouldn't develop in the presence of some pending "emergency." Then there is that White House briefing document, issued at the time Clipper was first announced, which asserts that no US citizen "as a matter of right, is entitled to an unbreakable commercial encryption product." Now why, if it's an ability they have no intention of contesting, do they feel compelled to declare that it's not a right? Could it be that they are preparing us for the laws they'll pass after some bearded fanatic has gotten himself a surplus nuke and used something besides Clipper to conceal his plans for it? If they are thinking about such an eventuality, we should be doing so as well. How will we respond? I believe there is a strong, though currently untested, argument that outlawing unregulated crypto would violate the First Amendment, which surely protects the manner of our speech as clearly as it protects the content. But of course the First Amendment is, like the rest of the Constitution, only as good as the government's willingness to uphold it. And they are, as I say, in the mood to protect our safety over our liberty. This is not a mind-frame against which any argument is going to be very effective. And it appeared that they had already heard and rejected every argument I could possibly offer. In fact, when I drew what I thought was an original comparison between their stand against naturally proliferating crypto and the folly of King Canute (who placed his throne on the beach and commanded the tide to leave him dry), my government opposition looked pained and said he had heard that one almost as often as jokes about roadkill on the information superhighway. I hate to go to war with them. War is always nastier among friends. Furthermore, unless they've decided to let the National Security Agency design the rest of the National Information Infrastructure as well, we need to go on working closely with them on the whole range of issues like access, competition, workplace privacy, common carriage, intellectual property, and such. Besides, the proliferation of strong crypto will probably happen eventually no matter what they do. But then again, it might not. In which case we could shortly find ourselves under a government that would have the automated ability to log the time, origin and recipient of every call we made, could track our physical whereabouts continuously, could keep better account of our financial transactions than we do, and all without a warrant. Talk about crime prevention! Worse, under some vaguely defined and surely mutable "legal authority," they also would be able to listen to our calls and read our e-mail without having to do any backyard rewiring. They wouldn't need any permission at all to monitor overseas calls. If there's going to be a fight, I'd rather it be with this government than the one we'd likely face on that hard day. Hey, I've never been a paranoid before. It's always seemed to me that most governments are too incompetent to keep a good plot strung together all the way from coffee break to quitting time. But I am now very nervous about the government of the United States of America. Because Bill 'n' Al, whatever their other new-paradigm virtues, have allowed the very old-paradigm trogs of the Guardian Class to define as their highest duty the defense of America against an enemy that exists primarily in the imagination - and is therefore capable of anything. To assure absolute safety against such an enemy, there is no limit to the liberties we will eventually be asked to sacrifice. And, with a Clipper Chip in every phone, there will certainly be no technical limit on their ability to enforce those sacrifices. WHAT YOU CAN DO GET CONGRESS TO LIFT THE CRYPTO EMBARGO The administration is trying to impose Clipper on us by manipulating market forces. By purchasing massive numbers of Clipper devices, they intend to induce an economy of scale which will make them cheap while the export embargo renders all competition either expensive or nonexistent. We have to use the market to fight back. While it's unlikely that they'll back down on Clipper deployment, the Electronic Frontier Foundation believes that with sufficient public involvement, we can get Congress to eliminate the export embargo. Rep. Maria Cantwell, D-Washington, has a bill (H.R. 3627) before the Economic Policy, Trade, and Environment Subcommittee of the House Committee on Foreign Affairs that would do exactly that. She will need a lot of help from the public. They may not care much about your privacy in DC, but they still care about your vote. Please signal your support of H.R. 3627, either by writing her directly or e-mailing her at cantwell(a)eff.org. Messages sent to that address will be printed out and delivered to her office. In the subject header of your message, please include the words "support HR 3627." In the body of your message, express your reasons for supporting the bill. You may also express your sentiments to Rep. Lee Hamilton, D-Indiana, the House Committee on Foreign Affairs chair, by e-mailing hamilton(a)eff.org. Furthermore, since there is nothing quite as powerful as a letter from a constituent, you should check the following list of subcommittee and committee members to see if your congressional representative is among them. If so, please copy them your letter to Rep. Cantwell. > Economic Policy, Trade, and Environment Subcommittee: Democrats: Sam Gejdenson (Chair), D-Connecticut; James Oberstar, D- Minnesota; Cynthia McKinney, D-Georgia; Maria Cantwell, D-Washington; Eric Fingerhut, D-Ohio; Albert R. Wynn, D-Maryland; Harry Johnston, D-Florida; Eliot Engel, D-New York; Charles Schumer, D-New York. Republicans: Toby Roth (ranking), R-Wisconsin; Donald Manzullo, R-Illinois; Doug Bereuter, R-Nebraska; Jan Meyers, R-Kansas; Cass Ballenger, R-North Carolina; Dana Rohrabacher, R-California. > House Committee on Foreign Affairs: Democrats: Lee Hamilton (Chair), D-Indiana; Tom Lantos, D-California; Robert Torricelli, D-New Jersey; Howard Berman, D-California; Gary Ackerman, D-New York; Eni Faleomavaega, D-Somoa; Matthew Martinez, D- California; Robert Borski, D-Pennsylvania; Donal Payne, D-New Jersey; Robert Andrews, D-New Jersey; Robert Menendez, D-New Jersey; Sherrod Brown, D-Ohio; Alcee Hastings, D-Florida; Peter Deutsch, D-Florida; Don Edwards, D-California; Frank McCloskey, D-Indiana; Thomas Sawyer, D-Ohio; Luis Gutierrez, D-Illinois. Republicans: Benjamin Gilman (ranking), R-New York; William Goodling, R- Pennsylvania; Jim Leach, R-Iowa; Olympia Snowe, R-Maine; Henry Hyde, R- Illinois; Christopher Smith, R-New Jersey; Dan Burton, R-Indiana; Elton Gallegly, R-California; Ileana Ros-Lehtinen, R-Florida; David Levy, R-New York; Lincoln Diaz-Balart, R-Florida; Ed Royce, R-California. BOYCOTT CLIPPER DEVICES AND THE COMPANIES WHICH MAKE THEM. Don't buy anything with a Clipper Chip in it. Don't buy any product from a company that manufactures devices with Big Brother inside. It is likely that the government will ask you to use Clipper for communications with the IRS or when doing business with federal agencies. They cannot, as yet, require you to do so. Just say no. LEARN ABOUT ENCRYPTION AND EXPLAIN THE ISSUES TO YOUR UNWIRED FRIENDS The administration is banking on the likelihood that this stuff is too technically obscure to agitate anyone but nerds like us. Prove them wrong by patiently explaining what's going on to all the people you know who have never touched a computer and glaze over at the mention of words like "cryptography." Maybe you glaze over yourself. Don't. It's not that hard. For some hands-on experience, download a copy of PGP - Pretty Good Privacy - a shareware encryption engine which uses the robust RSA encryption algorithm. And learn to use it. GET YOUR COMPANY TO THINK ABOUT EMBEDDING REAL CRYPTOGRAPHY IN ITS PRODUCTS If you work for a company that makes software, computer hardware, or any kind of communications device, work from within to get them to incorporate RSA or some other strong encryption scheme into their products. If they say that they are afraid to violate the export embargo, ask them to consider manufacturing such products overseas and importing them back into the United States. There appears to be no law against that. Yet. You might also lobby your company to join the Digital Privacy and Security Working Group, a coalition of companies and public interest groups - including IBM, Apple, Sun, Microsoft, and, interestingly, Clipper phone manufacturer AT&T - that is working to get the embargo lifted. ENLIST! Self-serving as it sounds coming from me, you can do a lot to help by becoming a member of one of these organizations. In addition to giving you access to the latest information on this subject, every additional member strengthens our credibility with Congress. > Join the Electronic Frontier Foundation by writing membership(a)eff.org. > Join Computer Professionals for Social Responsibility by e-mailing cpsr.info@cpsr .org. CPSR is also organizing a protest, to which you can lend your support by sending e-mail to clipper.petition(a)cpsr.org with "I oppose Clipper" in the message body. Ftp/gopher/WAIS to cpsr.org /cpsr/privacy/ crypto/clipper for more info. In his LA speech, Gore called the development of the NII "a revolution." And it is a revolutionary war we are engaged in here. Clipper is a last ditch attempt by the United States, the last great power from the old Industrial Era, to establish imperial control over cyberspace. If they win, the most liberating development in the history of humankind could become, instead, the surveillance system which will monitor our grandchildren's morality. We can be better ancestors than that. San Francisco, California Wednesday, February 9, 1994 * * * John Perry Barlow (barlow(a)eff.org) is co-founder and Vice-Chairman of the Electronic Frontier Foundation, a group which defends liberty, both in Cyberspace and the Physical World. He has three daughters. =-=-=-=-=-=-=-=-=-=-=-=WIRED Online Copyright Notice=-=-=-=-=-=-=-=-=-=-=-= Copyright 1993,4 Wired USA Ltd. All rights reserved. This article may be redistributed provided that the article and this notice remain intact. This article may not under any circumstances be resold or redistributed for compensation of any kind without prior written permission from Wired Ventures, Ltd. If you have any questions about these terms, or would like information about licensing materials from WIRED Online, please contact us via telephone (+1 (415) 904 0660) or email (info(a)wired.com) WIRED and WIRED Online are trademarks of Wired Ventures, Ltd. =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

1 0