- cypherpunks-legacy - lists.cpunks.org

Re:unSAFE won't pass
by Peter Swire 17 Dec '03

17 Dec '03

At 10:31 PM 9/14/97 -0400, Will Rodger explained his view that: >>It may make for good copy, but I think it's just fantasy to think >the >>>administration or their opponents, for that matter, will get what >>>they want this year. Let them swarm. Who cares. >>> >>>At earliest, August of 1998 before anything passes - and even that >is >>>highly optimistic. In politics, unfortunately, you often have to act *as if* the other side is going to win soon. If you don't, they might. A great example was the 1986 Tax Reform Act. Everyone knew that it was too complicated for Congress to understand. Everyone knew that there were lots of powerful opponents to its elimination of many tax loopholes. But the darn thing passed anyways. Even supporters were shocked. The story is told in a very well-written book, "Showdown in Gucci Gulch." When considering what Congress will do, remember that there are 12,000 bills a year introduced in each chamber. Crypto is only one of many, many issues the Members of Congress need to consider. When things get too complicated, a politician might think it's just easier to go along with law enforcement. How many politicians lose by being tough on crime? As for the 1996 Telecomm Act, it's a bad example of what's likely to happen with crypto. That Act was fought between truly enormous companies -- RBOCS, AT&T, cable, etc. Those companies had enormous Washington offices fighting a life and death lobbying battle for years. In crypto, the good guys have nothing like the same lobbying resources. Unlike Telecomm, the very largest existing companies in the country will not lose billions next year if a bad crypto bill is passed. In short, it is quite possible that nothing will pass before August, 1998. It is quite possible by then that the issue will seem politically hot, and thus be dropped so close to an election. But the FBI position might win if we don't act *as if* mandatory key escrow is a real possibility. Peter Prof. Peter Swire Ohio State University College of Law mailto:swire.1@osu.edu http://www.osu.edu/units/law/swire.htm (revised site now includes publications and Internet Privacy Page)

1 0

Make Money With Your PC
by mailhost＠aol.com 17 Dec '03

17 Dec '03

<HTML><PRE><BODY BGCOLOR="#000000"><FONT COLOR="#00FFFF" SIZE=3> ***************COMPUTER USERS NEEDED*************** $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ Set Your Own Hours. Earn $20,000 to $50,000 per year. $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ If you presently own your own Macintosh or IBM compatible personal computer, this amazing work-at home program may be just for you. First, please understand this is not a get-rich-quick scheme, chain letter scam or anything else that makes the promise of getting something for nothing. However, this is a legitimate program that will reward those who do not mind hard work, with a substantial source of extra income. Our manual, 'Work at Home Using Your Personal Computer (c 1995)' will outline the 27 different areas that are the most needed and requested services. We then put you in direct contact with the actual companies in your local area that are downsizing and offering work. Today, many, many companies are streamlining due to economic pressure and the need for home-based workers is at an all-time high. Basic skills such as typing, data entry or word processing will allow you to earn between $10 and $15 an hour. More advanced skills such as medical billing, database management and bookkeeping earn $20 to $30 per hour and are a common occurence. Those with even greater technical skills, graphic design, desktop publishing, basic programming or web site design can earn between $30 and $45 per hour. This program comes to you with a 100% money-back guarantee. The package we send to you contains everything in writing. You will recieve the easy-to-follow, fact filled manual and software package only if you act now! This program is the perfect solution for housewives, students, the home-bound, as well as those seeking a solid second career. The easy-to-follow manual and software package comes to your for only $49.95 ---------------------------------------------------------------------- Look below to see how you can save $15 today! ---------------------------------------------------------------------- IMS 5201 Kingston Pike Suite 6-216 Knoxville, Tennessee 37919 YES, please rush the 'Work at Home Using My Personal Computer (c 1995) manual! ___________ I have enclosed $49.95 plus $4.95 shipping and handling. ($54.90 total) ___________ I want to save $10.00! I am ordering within 24 hours - I have enclosed $39.95 plus $4.95 shipping and handling. ($44.90 total) ___________ Please RUSH my order - add an additional $15.00 (OPTIONAL) I have enclosed (Check One): _____ Cashiers Check _____ Money Order _____ Personal Check SHIPPING INFORMATION Name:__________________________________________________ Telephone:_______-______-____________ Physical Street Address (NO PO BOXES please)__________________ _______________________________________________________ City:___________________________________________________ State:_________ ZIP:____________________________________ Your E-Mail Address (Needed for order confirmation)____________________________ $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ SAVE AN ADDITIONAL $5.00!!! FAX YOUR ORDER NOW! Please tape your completed and signed check in the space below and fax to IMS. That facsimile number is 1-423-681-6520. ************************************* FAX: 1-423-681-6520 PLEASE TAPE YOUR CHECK HERE Please SIGN you check ************************************* Thank You For Your Order 2156887000908001546877 </FONT><FONT COLOR="#000000" SIZE=3>

1 0

Re: unSAFE won't pass?
by Will Rodger 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Peter asked me to forward this. Here he makes a valuable point on political organization - something which helps explain why some people are more dire in their tone regarding the state of things here in Washington. Below's what he wrote. W. At 10:31 PM 9/14/97 -0400, Will Rodger explained his view that: >>It may make for good copy, but I think it's just fantasy to think >the >>>administration or their opponents, for that matter, will get what >>>they want this year. Let them swarm. Who cares. >>> >>>At earliest, August of 1998 before anything passes - and even that >is >>>highly optimistic. In politics, unfortunately, you often have to act *as if* the other side is going to win soon. If you don't, they might. A great example was the 1986 Tax Reform Act. Everyone knew that it was too complicated for Congress to understand. Everyone knew that there were lots of powerful opponents to its elimination of many tax loopholes. But the darn thing passed anyways. Even supporters were shocked. The story is told in a very well-written book, "Showdown in Gucci Gulch." When considering what Congress will do, remember that there are 12,000 bills a year introduced in each chamber. Crypto is only one of many, many issues the Members of Congress need to consider. When things get too complicated, a politician might think it's just easier to go along with law enforcement. How many politicians lose by being tough on crime? As for the 1996 Telecomm Act, it's a bad example of what's likely to happen with crypto. That Act was fought between truly enormous companies -- RBOCS, AT&T, cable, etc. Those companies had enormous Washington offices fighting a life and death lobbying battle for years. In crypto, the good guys have nothing like the same lobbying resources. Unlike Telecomm, the very largest existing companies in the country will not lose billions next year if a bad crypto bill is passed. In short, it is quite possible that nothing will pass before August, 1998. It is quite possible by then that the issue will seem politically hot, and thus be dropped so close to an election. But the FBI position might win if we don't act *as if* mandatory key escrow is a real possibility. Peter Prof. Peter Swire Ohio State University College of Law mailto:swire.1@osu.edu http://www.osu.edu/units/law/swire.htm (revised site now includes publications and Internet Privacy Page) -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQA/AwUBNB1kfNZgKT/Hvj9iEQK7AgCePoF1G6fB1GhTTinh5U5pa1Q+t48An2gk RFszr9K29WkugUzhmyitgTG1 =Y4HO -----END PGP SIGNATURE----- Will Rodger Voice: +1 202-408-7027 Washington Bureau Chief Fax: +1 202-789-2036 Inter@ctive Week http://www.interactiveweek.com A Ziff-Davis Publication PGP 5.0: 584D FD11 3035 0EC2 B35C AB16 D660 293F C7BE 3F62 PGP 2.6.2: D83D 0095 299C 2505 25FA 93FE DDF6 9B5F

1 0

Re: Real issue of crypto controls: security or taxation loss?
by Dan Geer 17 Dec '03

17 Dec '03

as you say, Sun Tsu (from memory): select the battleground where you are strongest and the enemy is weakest. which is good advice. i recall Tzu also saying that you need to use the enemy's momentum to your advantage, the principle of judo if you will. in parallel, revolutionaries of many stripes have found that "heightening the contrast" is necessary if you mean for real change to occur. which brings me to ask, rhetorically i suspect, how we might heighten the contrast. i'd suggest delegating to some of us a support-the-bill effort complete with a detailed description of how the transmorgrified proposal that makes illegal all sorts of now ordinary acts. * you can't talk on the phone in a language the surveillance folk don't know (witness Compuserve's prohibition of Welsh on their otherwise monitored bulletin boards) * cryptographic door locks are now illegal without escrow (witness the SecurID-equipped door knob) * contracts that are transmitted over electronic means including facsimile must not be encrypted unless the keys are made available (witness the proliferation of safe fax machines) * no end-to-end encrypting cellular telephones may be used even if you are talking to someone in an otherwise hostile country (witness the formal industrial espionage of some countries) * passwords that map directly to encryption keys must therefore be escrowed (witness nearly everything but start with all the Kerberos derivatives including new NT stuff) * banks have to ensure that encrypted materials put into their safety deposit boxes are escrowed (sue somebody for the keys in their box naming the bank co-defendant for failure to escrow) * the attorney client privilege will not apply to my whispering my key to him/her, i.e., if i tell my attorney my key they are now my escrow agent even if it means violating the sanctity of the private conversation (witness i-don't-know-what but call Kevorkian to enlist him) * outlaw anonymous trading and the firms that provide it on the grounds that these represent encryption-of-names (witness the rules requiring such trading under some circumstances and the convention for others) in other words, shift the weight of who is radical to them. wrap ourselves in the flag deep within the big-government-sucks camp. march on the capital dressed as skin heads demanding the end of privacy for some sorrowful group or other. send the kind of letters that get you into trouble with the Secret Service but send them encrypted in Bill's private key (which you can issue him whether he likes it or not). mau-mau the flak catchers... --dan

3 2

American Banker - National ID - addendum
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text X-Sender: rhornbec(a)counselpop.com Mime-Version: 1.0 Date: Thu, 25 Sep 1997 05:59:31 -0500 Reply-To: Digital Signature discussion <DIGSIG(a)VM.TEMPLE.EDU> Sender: Digital Signature discussion <DIGSIG(a)VM.TEMPLE.EDU> From: Rick Hornbeck <rhornbec(a)COUNSEL.COM> Subject: American Banker - National ID - addendum To: DIGSIG(a)VM.TEMPLE.EDU Either the Temple listserve is automatically limiting the length of my posts (<gr>) or I discovered a new e-mail bug. Here is the balance of the excerpt from the American Banker article I intended to post earlier. ==================== What actions should a certificate authority be required to take in this imperfect system to certify that X's public key actually is being used by X? To allow the electronic marketplace to operate effectively and efficiently, at a minimum certificate authorities must be able to achieve some level of certainty that if they have prudently conducted the due diligence required, they cannot be held responsible for fraud or malfunctions. National Identification Verification Standards-NIVS-would underscore that there should be only a limited range of actions for which a certificate authority should be held responsible in an electronic transaction. These standards eventually would need to be truly universal because of the globality and borderlessness of cyberspace. Moreover, such standards could level the playing field vis-a-vis the different levels of trust that might otherwise be accorded certificate authorities of various sizes, financial capacity, name recognition, and national origin. What should the elements of these national verification standards be? The more that the system relies on primary "root" documentation (paper or electronic) certified by the originator, the greater the certainty, albeit imperfect, that the certificate authority can achieve. The adoption of an integrated certification data base accessible to all certificate authorities must also be explored. A network that will allow each certificate authority to cross-reference digital certificates and confirm the issuance of multiple certificates to the subscriber will allow the digital signature market to function more efficiently and safely. >From a legal point of view, a digital certificate is a form of warranty. Warranties ascribe and allocate rights in a transaction, a business that commercial banks happen to understand quite well. But a digital certificate is not meant and should not be viewed as unlimited insurance for the use of the certificate or the successful completion of an electronic transaction facilitated by that certificate. In that regard, the adoption of these standards might facilitate the development of a national market for certificate authority errors-and- omissions insurance. It might also facilitate the creation and operation of what one observer has called "cybernotaries." Without uniformity in the authentication process, the efficiencies of certificates and the effectiveness of electronic commerce will be undercut. Richard N. Hornbeck Electronic Commerce Services "The most important step in arriving at the right answer, is asking the right question." Albert Einstein ("Al"). --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

1 0

Re: Assume the worst, make lemonade?
by Black Unicorn 17 Dec '03

17 Dec '03

At 01:37 PM 9/15/97 -0400, Donald Weightman wrote: >Well, I'm as angry as anyone about last week's developments, but there's >work to do ... > >Suppose that there is only a 12 - 30 month window for distributing strong >crypto. If there is a grandfather clause at the end, then would it make >sense to approach Chaum or other holders of potentially mission-critical or >roadblock patents, and ask whether they want to revisit the terms of >potential licenses, in view of the storm clouds over the political >landscape? It would seem better to get something *out* rather than wasting >the narrow time window trying to negotiate past impasse. Then why bother talking to patent holders? Just release it on the sly and damn the patent holders. I mean, if your intent is to get the stuff out there, and your essentially going to be committing a felony anyhow in a few years, who cares about a stupid patent suit? What really needs attention is getting key lengths and stego such that they are prepared to endure 20 years of crypto-freeze and Moore's law. That is if, and please understand my examination of the issue to be academic- not advisory, you want it out there in the "underground." >The only time I met him, Chaum seemed to be expressing political views >which might make him sympathetic to such an approach. Chaum is Jurassic CryptoSuit. He waited, and he's about to lose all the cookies because DigiCash did such a bang up job at accomplishing nothing with extremely promising technology. (RSA without the bravado). Placing bets on Chaum for the purposes of getting the technology out is silly. (They just got another $25m and they still only boast something like 2,500 customers in the entire U.S.) Placing bets on Chaum, however, for the purposes of usurping the technology with the hope that it may be legal once again to use it without handing government the key, that might be a worthwhile approach. Perhaps the patents look cheap right now, but if the administration bill flops (don't hold your breath from what I hear), they might get real valueable real quick. That's more like the market savvy approach this group should be taking.

1 0

Re: Emphasizing a point by Donald Eastlake re key recovery
by Peter Trei 17 Dec '03

17 Dec '03

> Date: Wed, 24 Sep 1997 10:15:45 -0400 > To: Ross Anderson <Ross.Anderson(a)cl.cam.ac.uk> > From: Carl Ellison <cme(a)cybercash.com> > Subject: Re: Emphasizing a point by Donald Eastlake re key recovery > Cc: cypherpunks(a)toad.com, Ron Rivest <rivest-only(a)theory.lcs.mit.edu>, > cme(a)cybercash.com > Reply-to: Carl Ellison <cme(a)cybercash.com> > -----BEGIN PGP SIGNED MESSAGE----- > > At 09:34 AM 9/23/97 +0100, Ross Anderson wrote: > >There is also the point that the vast majority of encryption keys are > >actually used for authentication rather than confidentiality. The keys > >that encrypt your bank card PIN en route from the ATM to the bank, the > >keys in your satellite TV decoder, the keys in your gas meter and your > >postal meter - in fact the majority of all DES keys in use - are about > >authentication. In theory most of them could be replaced by digital > >signature mechanisms but given the size of the installed base, it > >won't happen anytime soon. > > For what it's worth, I once got an opinion from NSA's export control office > that I could use any kind of crypto I wanted (e.g., even triple-DES) if all > I'm doing is protecting a channel carrying a password (like the PIN), > because that's an authentication function and therefore to be encouraged. I > didn't get this in writing, however, so I'd have to go for it again. > > - Carl Well, I dunno. About 18 months ago, I was involved with the negotiations over the exportability of an SSL equipped web server I had helped develop. The export model used 40 bit RC4 and 512 bit keys. The initial version used 3DES to encrypt stored private keys, and this was turned down. I modified it to use single DES, and it passed. Note that this was for secret key storage only. Peter Trei trei(a)Process.com

1 0

Re: Federal motivation
by Anonymous 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Martin Minow wrote: >Anonymous, signing as Monty Cantsin, Editor in Chief of Smile Magazine >quotes my Cypherpunks summary's quote of Eric Hughes: >>Martin Minow wrote: >>> EH: Why do the Fed's want access to plaintext? The motivation has >>> not been made clear. Policy goals are stated in technological terms, >>> not in policy terms. >> >>Perhaps we can elaborate on this. Judging from their actions, what >>they want is a full blown police state. They've seen the product, now >>they want one of their own. This is obvious to everybody on this >>list, but sometimes people are coy about it, probably in an effort to >>appear to be "legitimate". > >Sorry, it isn't obvious to me. The most paranoid I can work myself >up to is to assume that some (not all) of our leaders want to restore >their half-remembered 1950's Dick-and-Jane, big car, Eisenhauer suburbian >childhood; and are afraid that letting absolute privacy loose will >be the end-of-civilization-as-we-know-it. The discussion is encryption, not absolute privacy. It will still be possible to inexpensively bug homes, offices, computers, etc. Mass surveillance is only required for a police state, not to protect the suburbs, not to protect children, not to catch real criminals. So, when a secret police agency wants to set up a mass surveillance system, what is the likely motivation for their action? >This parallels the battles that were waged in the early 1960's, as >the civil rights movement (and the Pill) shattered the myth of >suburbia. The police and FBI felt, quite sincerely, that they were in >the midst of a revolution and had to take "necessary measures" to >save America. What concerns me is what they will do, not their mental state when they are doing it. Even torturers believe they are doing the right thing. So what? BTW, institutional loyalty does not require every member of the armed services or secret police agencies to be fully cognizant of what they are doing. They just have to buy into the plan. The leaders probably don't believe in Santa Claus, though. >The new cryptography makes the Internet safe for child pornographers, >for revolutionaries, for criminals, as well as for human rights >workers, for religious missionaries in unfriendly countries, and >multinational corporations. Yeah, last I checked, books were still safe, too. >The message I read from the attempt to criminalize strong >cryptography is that the risk of damage from the pornographers (etc.) >is so great that we must restrict cryptography and trust the national >leadership to respect the rights of the good guys. Unfortunately, one >country's human rights worker is another country's dangerous >revolutionary. You would benefit from a study of the activities of the Federal government over the last sixty years. Pay particular attention to the seedy political activities of the FBI and don't forget to cover CIA assassination and torture programs. Then come back and tell us whether you still think they really care about children or whether this is just a reason given to cover their actual activities. (And please explain why organizations which traditionally are not involved with protecting children suddenly find it in their charter when mass surveillance is on the table.) For that matter, study the history of communications systems. Why do you suppose it is that governments have traditionally taken control of postal systems? Do you suppose it could have anything to do with control? Bill Frantz wrote: >At 6:54 PM -0700 9/14/97, Martin Minow wrote: >>Remember, the Martin Luther King who was thrown in jail in Alabama >>in the early 1960's was the same Martin Luther Kings who received >>the Nobel Peace Prize a few years later, and who was killed for >>his revolutionary activities just a few years after that. Whether >>he was a hero or villian depends on who writes the history book >>and it is, ultimately, our responsibility to make sure that many, >>conflicting, history books can be written. > >Most particularly remember that the director-for-life of the FBI used >telephone intercepts in an attempt to get this Martin Luther King to commit >suicide. Good example. This is one of many well documented examples of FBI misbehavior throughout its entire history and even its pre-history. (Hoover was involved with the Palmer Raids following World War I when hundreds of people were arrested and thrown into makeshift prisons without trials. Some were kept there for years.) In the case of MLK, his father and his grandfather were under surveillance by the Federal Government since about WWI. What crime was being investigated? None. They weren't well liked in official circles. Thomas Junker wrote: >This stuff is serious. This pattern is not new -- it is just new >*here*, a development of the last 20 years. Similar slippery slopes >have been traveled in other countries, in other times. These times >are getting way too interesting for comfort. You're on the right track, but the FBI has been a menace to the United States since its inception. Now, however, people are willing to let them get away with more and some truly scary technologies exist. And, they are making their play. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNB19+ZaWtjSmRH/5AQF3tgf9GGK7MZQx0hPBDmAFWqK3AfYzJT3vmRg5 Klas//yGEolw7HeTDnpE0GEXucetx5nyp/5REJqQbYuYizj3DX6r4zDrKE/GXZNB fbiT6+ZCGXbOk1EbLZZCgVwKeRfqN9aaBcCvu45iGH2rFlkKkmmOz+2lQqGEMHIy n9WJpL4BtRXureSTi1xOKk4c5ixTcSVnETLDcr0zE75WX72QD96ZbK1a8cNW9CVV ow+r29BOZPKsLLsMHikC5kIjbA61TOn65I3AzUm8S5LIneHiKWos6NOonFoXPqLI kuKerqPFlP1szWIasI1+qorw6qYgIXKRusNL5+onsNvZSt7S9u3IeA== =Ji8m -----END PGP SIGNATURE-----

1 0

Feinstein in S J Mercury (and my reply) ...
by Ernest Hua 17 Dec '03

17 Dec '03

Feinstein answers her critics in the usual way slimy politicians answer critics: Dodge the crucial details and make broad, sweeping, feel-good but substance-less statments. http://www.sjmercury.com/business/feinstein091597.htm Here is my reply via a letter to the editor: > Date: Mon, 15 Sep 1997 13:31:10 -0700 (PDT) > From: Ernest Hua <hua(a)chromatic.com> > To: letters(a)sjmercury.com > Subject: Feinstein's ignorance on encryption ... > > As with the previous Mercury interview with William Reinsch, > I am extremely disappointed with this interview with > Feinstein. There was absolutely ZERO attempt to ask > Feinstein to answer the tough policy questions in an open > forum where ALL facts are present (not just the distorted > information presented by the FBI in classified meetings). > > Look at these examples of the same tired arguments from the > FBI and the NSA, now being spewed by a senator who openly > admitted that she does not know much about the issue: > > > Q: Doesn't government control of encryption technology used > > by American citizens infringe on their constitutional > > rights? > > > > A: No one is talking about intrusion on privacy rights. That > > is important. I would not support an intrusion of privacy. > > Everyone outside the law enforcement and the intelligence > agencies ARE talking about privacy; that is why everyone > wants strong encryption. > > When some of the most vocal groups fighting for encryption > rights include privacy and civil liberty groups, I really > wonder where Feinstein gets her information. Is this just > ignorance, living in denial, or "spin"? > > > ... When law enforcement authorities ... obtain a court > > order, there should be some ability to act on behalf of > > public safety. > > In fact, there is, but the entire focus as been on > encryption, as if, in case that door were closed off, law > enforcement and intelligence agents would be completely shut > out. > > Technology has enabled strong encryption, but technology has > also left a huge and UNENCRYPTED audit trail giving > significant clues to what the user has been doing. San Jose > Mercury has even reported on one of the up and coming > companies taking advantage of these hidden and very > revealing trails of information to significantly boost a > civil or a criminal investigation. > > Law enforcement is not crippled by encryption. They just > have to keep up with technology, which has offered them more > advantages than they've ever had before. > > > Encryption is already being used by criminals, terrorists > > and drug cartels. ... Imagine the tragedies that might not > > be prevented if law enforcement officials are unable to > > decode encrypted files ... > > Law enforcement lobbyists like to paint this picture that > strong encryption is some sort of technological guarantee of > absolute secrecy which has crippled their investigations. > In fact, the FBI, when forced by court order to reveal the > facts, admitted that no investigations to date were really > obstructed. Dorothy Denning, the only pro-law-enforcement > academic on this issue, confirmed this in her recent study. > > No wonder the FBI fought tooth and nail to keep their > internal memos from the public. > > > People's safety must keep pace with new developments in > > technology, or we will live to regret it. ... In this > > case, the industry is being asked to put people's safety > > ahead of their bottom line. > > This is the sort of bogus public safety reasoning that the > FBI has been promoting. There is not one single expert > outside law enforcement that believes criminals will > actually use any kind of government-mandated encryption. > > This is not 1960's. Back then, strong encryption could not > possibly be in the hands of individuals because they require > very sophisticated computers to run. Programming these > systems were considered black magic. The few experts on the > topic were strongly censored by the NSA. > > Today, the same computing power is available in everything > from a personal computer to a smart toaster. You can buy a > powerful chip for under $2.00 from Fry's. Every > engineering, math and science graduate today must have > programming skills to be an effective employee. Encryption > books are widely available, and the Department of State > admitted as much that they could no longer censor these > books, even from export to unfriendly nations. > > If a terrorist can build a bomb from a $5 watch, he can type > in a program to encrypt his plans. So which nasty criminals > can the FBI really snoop on? Certainly not the ones > building bombs from everyday appliances. > > > ... You replied that ``it seems to me that nothing but some > > sort of mandatory key recovery does the job.'' Why? > > > > A: There needs to be some means, within the strict confines > > of due process of law, for recovery of encrypted information > > Feinstein is obviously not a Constitutional scholar here. > Where in the constitution does it say that law enforcement > must be GUARANTEED the means to eavesdrop in ANY > circumstance? This sort of "make it up as it is convenient" > attitude is why many people have long questioned her ability > to genuinely protect civil rights. > > > Q: The National Research Council ... concluded that ... [the > > risk of] ... unlimited encryption was outweighed by the > > positive aspects of unlimited encryption, because that > > provides the best opportunity for government, corporate > > and individual computer users to protect themselves from > > computer crime. > > > A: ... encryption ... already is being used in some of the > > most serious crimes. ... Law enforcement officials must > > maintain the ability to pierce encrypted communications in > > these kinds of criminal operations. > > This is another dodge of the real question: Most of the > members of the NRC panel ALSO got the classified briefing. > These are the technical and policy experts (that's why they > are on the panel in the first place). What makes Feinstein > think she is so much smarter than these experts, despite her > claims of ignorance on the matter? > > Let's be realistic: > > 1. Feinstein has a very warped view of the Bill of Rights > because she has been the target of, among other things, a > letter bomb. She is running scared, and will demand nothing > short of a crack down from law enforcement, so we cannot > expect her to side with anyone AGAINST the wishes of law > enforcement. (Just look at her stance on the issue of > freedom of speech on the Internet.) > > 2. Feinstein has clearly stated in previous senate hearings > that she is ignorant on this matter, and that she will > definitely defer judgement to the law enforcement agencies. > Well, she has once again proven her ignorance, but at least > she's admitted it in the past. The trouble is that she goes > on to take significant policy positions on the matter > anyway. Why speak up so strongly on a topic where she's so > clueless? > > 3. Feinstein, like many politicians, does not want to deal > with the details of issues because it would mean that she > would have to make some very TOUGH questions and decisions. > The high tech industry is absolutely against encryption > regulations, so she is in a tight spot. No wonder, in that > same senate hearing, she left the room before her > constituents showed up to testify. > > It's difficult to force a coward face reality and answer to > real world concerns, and let us keep in mind that the FBI > and the NSA have insisted on secret meetings rather than > open discussions on this issue. They simply do NOT want to > have to face open scrutiny. No matter how big a favor they > THINK they are doing for us, they must be reminded that this > is an open and democratic society, and that they may not > choose to have a secret meeting just because they cannot win > in open debate. > > ---- > > Ernest Hua, Software Sanitation Engineer > Chromatic Research, 615 Tasman Drive, Sunnyvale, CA 94089-1707 > Phone: 408 752-9375, Fax: 408 752-9301, E-Mail: hua(a)chromatic.com

1 0

Access to Plaintext: An Obvious Consequence
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text From: Somebody Date: Tue, 16 Sep 1997 10:12:47 -0400 (EDT) To: rah(a)shipwright.com Subject: Access to Plaintext: An Obvious Consequence Bob, If no encryption product can be sold that can't decrypt everything it encrypts, then no public key systems can come to market. That would effectively eliminate the entire range of encryption products of interest to you. Surely, this is clear? <Somebody's .sig> --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

1 0