-----BEGIN PGP SIGNED MESSAGE----- attila in --with both feet. starting with the premise that a corporation has a fundamental legal right to review all work and communications of any employee, and "acknowledging" that the employer is virtually required to maintain access to documentation to service the regulations of the government, the courts, and the LEAs, the issue is simply HOW? 1. I personally include my own public key in every encrypted message --if I consider the contents important enough to warrant encrypting, not just signing, I consider it important enough not to maintain a plaintext copy. 2. If I consider the contents more than just important -eg: critical, I use one of my unpublished public keys for the file copy. this version, including the encryption software and key library, are kept on a separate ZIP disk from the standard version ZIP disk. as a matter of reference, all temporary space is maintained on the ZIP drive. the major insecurity is the swap space which is maintained on a separate partition which is fully purged at boot time --which is not often enough. I have written secure swappers, or maybe I should say secure except for the transitory time the information may have been swapped out. this can be made further secure by preventing swap for the encryption engine if the system permits it, or even better, use semiconductor memory which leaves no magnetic media residuals to be analyzed 500 levels down by the Feds. From a mechanical standpoint there is no difference when you apply the same methods to the corporate environment. Again, the issue is HOW it is implemented. 1. if a corporate entity uses a single private-public keypair for each and every employee, that is their own stupidity as this is insecure, both internal and external. Too many hands on the private key. 2. ideally, each employee should be given a separate corporate public key. at the very least the key can represent a department or work group. 3. using the scenario in 2, specific projects can use a second corporate key which permits group leader management control. Therefore: Is this GAK? unfortunately, yes. By tolerating the use of unfortunately, yes. corporate GAK are we setting ourselves up to accept personal GAK? why? individuals will be desensitized to defending the absolute importance of maintaining our Constitutional rights, what few the Supreme Court has not yet denigrated. can we avoid this result? YES! GAK for businesses is a slam dunk, eg: if business has it, LEA, etc. can get it. desensitization can be minimized by pressuring professional associations to keep the issue of _personal_ privacy on the hot burner; this is the only issue. our mission must be to keep the fire out front so Americans will not stand for the total loss of privacy, etc. that F[reeh,uck] is hawking to our government; F[reeh,uck] sings the siren song of anti-terrorism, anti-anarchy, and all that good stuff government wants to suppress in violation of the Constitution. if the general public is fully aware of the implication, there is a chance to lead the rabble with the the chant: hell no, we wont dump our crypto! Now that the NYTimes has seen the light and is joining the battle against the forces of encryption denial, the mainstream press may make some effort in the cause, but we must keep the pressure on high. CDT, EPIC, and the rest of them are funded by business, big business, all of whom have a vested interest in selling product. they are the employers of the inside-the-beltway whores ...pardon me: lobbycritters; and they will compromise our individual rights in the corporate interests of the almighty dollar; in fact, corporate managers and beancounters will violate the privacy of their employees faster than the US spooks, both on and off the job --they have little if any concept of personal Constitutional privacy rights corporate officers are clueless on personal privacy. we face a two edged sword. if we encourage the expanded use of encryption in business, it will spread much more readily to the private sector --knowing full well the corporate users will be subjected to GAK. If business units are smart, they will implement the multi-target encryption and fight like hell against what F[reeh,uck] really wants: on-the-fly, real-time trapdoor cleartext --just like clipper. If F[reeh,uck] gets what he wants, why should he ask a court for approval to decrypt when he can already glean the information in the same way POTS taps are real time. if we rant and rave against the multi-public key encryption system, we risk facing the far more Draconian demands of F[reeh,uck]. The multi-public key system has been in use since the first time the ability to use multi-keys for multi-recipients was included. there is nothing we can do in the courts to prevent corporations processing encrypted mail through servers for verification, or even content scanning. business has this right --unfortunately, the government can compel the business to exercise this "right" and therefore government potentially does have real-time access. THE FOCUS: All efforts need to be directed to prevent the inclusion of master keys in hardware and/or software and the mandating of universal usage of the government system. there is little difference in what F[reeh,uck] is proposing and Clipper --and the same arguments can challenge F[reeh,uck] and friends. Let's not waste time hashing and rehashing business practices we have long since been forced to accept; and stay away from politics: FOCUS on our Constitutional rights. death is inevitable --an action we all face; some things are worth dying early defending --my personal privacy rights and the sanctity of my intellectual processes or whatever I wish to cogitate or regurgitate is one of them. For the masses: '54-40 OR FIGHT' or any number of us will die martyrs; STAND UP AND BE COUNTED; dont be government wimps, snitches, and shills like Hallam-Baker. attila on the way out ______________________________________________________________________ "attila" 1024/C20B6905/23 D0 FA 7F 6A 8F 60 66 BC AF AE 56 98 C0 D7 B0 -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: latin1 Comment: No safety this side of the grave. Never was; never will be iQCVAwUBNDhTsb04kQrCC2kFAQGD0wP+JJ6GvszXDmBJcyTaGy9nbXSQb5y0kKUW NgZZHQDJlsVGdU4zPWl3HX7QClpjCBWEucWHiZa9BlyyMA55ngAYJiLv6+EzGZCi AuFYjJBbHin8krgauM/iy4Pj1aXZcIMorWEUYJsfRoHEWCtwPikrwCNCBqzj/N+6 3CpuA31WeeQ= =Cg9I -----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE----- At 12:06 PM 10/5/97 -0700, Tim May wrote:

...

Claiming that they are doing the work of Big Brother is a cheap-shot and uncalled for.

(Ironic coming from a frequent issuer of cheap shots.)

It is the work of Big Brother, as Garfinkel, Zimmermann, and I agree, when it becomes a default that additional recipients are automatically copied on encrypted mail. It may be useful to companies, but it's still dangerous.

Look a bit closer at the announcments: I believe they said that they would compile a new version for each key that they used. So it's not even likely that this could become a widespread feature. For this to be useful for GAK, you'd have to change all copies in existence to encrypt for this key. (And of course, then you'd have a very simple key- id to search for in the executable and modify, say to encrypt back to yourself, and you'd have circumvented this little problem) If you want PGP to get into widespread use in business, you have to provide features that they will require. Frankly, this is good for encryption, to provide features that business needs. With this, hopefully the business lobby will fall in line with the no-regulation-on-crypto lobby, and get all of us the results we want. Phil is never going to release a copy of PGP that has built-in GAK. We know that. This is MAK (Management Access...) in a secure manner, which is better than the other methods of internal escrow. -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQCVAwUBNDf6czc3ytqHnNyNAQF80AP/Vm5uO8nLqnDShxu6/o9HArZNgvb8txoR JV3ANvTd7fHjpCMHEzSdUgyEYspX8uRP6D6qR2nAt3KgLwlVpNcLgQO6mUd4E9av naGgt7jHPcJ1tvFu8yr6mUFtXZ7yvROnOpkRXTv7HR4vaPvOS5Z8G60WZXhJRw3S FkFh7ADJiRk= =PafJ -----END PGP SIGNATURE----- ----------------------------------------------------------------------- Ryan Anderson - <Pug Majere> "Who knows, even the horse might sing" Wayne State University - CULMA "May you live in interesting times.." randerso@ece.eng.wayne.edu PGP Fingerprint - 7E 8E C6 54 96 AC D9 57 E4 F8 AE 9C 10 7E 78 C9 -----------------------------------------------------------------------

At 11:46 AM 10/5/97 -0500, William H. Geiger III wrote:

-----BEGIN PGP SIGNED MESSAGE-----

In <v03102800b05d58dd0280@[207.167.93.63]>, on 10/05/97 at 08, Tim May <tcmay@got.net> said:

...

Let's hope PGP, Inc. comes to their senses and stops doing the work of Big Brother.

This is really silly Tim,

The ability to encrypt using multiple keys has been a feature of PGP since day one. All the Business Edition is doing is automating the process. Despite the flawed news reports on this matter (who would have guessed) their is nothing covert about it. The user is both informed that this is being done and there is a way for the user to disable it in the client.

I guess the real question is whether the messages/files generated just add an extra key or if they leak the key through some harder to identify method. The current version of PGP no longer shows you the list of recipients, so it is more difficult to determine if extra keys are added. Is the method they are using for this new version to "escrow" the keys obvious to the recipient or not? --- | "That'll make it hot for them!" - Guy Grand | |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano@teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.ctrl-alt-del.com/~alan/ |alan@ctrl-alt-del.com|

An article in today's (Fri, Oct 3) New York Times (CyberTimes) ... describes the new release of "PGP for Business Security 5.5," which contains mechanisms that incorporate key recovery mechanism that can either be volontary or be enforced by using PGP's software for controlling a company's SMTP server -- the server can verify that all encrypted messages include the corporate public key (or conform to other corporate policies):

Alex Le Heux <alexlh@xs4all.nl> noted: |> Keep in mind that this is the 'PGP for Business'. Companies often |>operate on the principle that email that's sent and received from |>their machines is the company's, not the employee's. This is actually |>reasonable business practice. Specially when encryption enters the |>picture. The employee could walk under a bus, and leave some vital |>but encrypted emails in his mailbox. This could be a real problem for |>corporations. William H. Geiger III <whgiii@invweb.net> brushed aside PGP Inc's critics to complain:

...

This has been discussed before on this list and others, and few have disagreed, that a company has a legitimate need to be able to access its encrypted data. If employees want to send love letters or whatnot then they should not be doing it on company time using company resources.

If a corporation wishes to establish a company policy that all correspondence be encrypted with the companies master key it is their right to do so and IMNSHO it would be foolhardy for them to do otherwise.

Claiming that they are doing the work of Big Brother is a cheap-shot and uncalled for.

With respect, Gentlemen, I think you are missing the point. There is no corporate demand for a key-recovery mechanism which allows Management immediate real-time access to all encrypted electronic communications. This new PGP facility is analogous to key-escrow or key-recovery for session keys; in essence, it's a backdoor to the session. Here in the US, FBI Director Louis Freeh has been pointed in his comments about the distinction between key-recovery for stored data and key-recovery for transient electronic communications. Key-recovery for encrypted stored data, Freeh noted, serves a sensible and pragmatic business need. Corporations will do it because it's a necessary part of their Disaster Planning. But, as Freeh noted several times in Congressional testimony, there are few if any business requirements for surreptitious, real-time, access to online communications, so businesses (unless forced by legislation, argued Freeh) simply won't do it. It is police agencies, not Management, which seek real-time access to all encrypted e-mail. No one but the Govt wants it. Management, at least in the US, doesn't need this sort of evidentiary data. Management has an employee who can be required to keep a copy of all business e-mail for Management review; or required to cc his or her boss on all e-mail to a customer -- or even forbidden to use e-mail for anything other than business mail cced to the boss. And, of course, the employee can be fired if he/she doesn't comply. But the truth is: Managment doesn't need the aggravation and -- while the standard of managment oversight is more lenient, at least for professional staff -- no company can keep talented employees if it treats them this way. Surreptitious universal access to an employee's encrypted e-mail _is_ like sound and video pickups in the bathrooms. Vastly intrustive; humilating; diminishing. Far more intrustive than is useful or necessary for conventional management needs. It is the work of Big Brother, sadly. GAK-enabled PGP, plain and simple! As Director Freeh noted, it's only LEAs who need and want this. The likely early victims of such a draconian oversight will probably be the long-suffering US government employees. With no evidence to support my supposition, I'll bet the GAKed-crypto strategists are once again offering the federal workforce as the sacrificial lambs, as they did with Fortezza. Trying (again!) to use the bulk federal purchasing power to establish a defacto product standard. Watch over the next six months. I think they used the new -- "post-Fortezza," pre-PKI -- prospect of huge '98-'99 federal purchases of COTS crypto for non-classified DoD and civilian agency e-mail to lure Mr. Zimmerman, major stockholder, into swallowing the words of Feckless Phil, the wild and wooly free-crypto rebel. Anyone wanna wager that this "design option" evolved concurrent with a quiet MOU-structured review of the New Improved PGP by the X Organization at Ft. Meade? Nor, I fear, will this be the last enhanced cryptographic communications app to come out of vendors active in the NSA's new Commercial Liaison initiative. Big federal market. Big lure. Hard not to give the Customer what he wants. Still, it's sad. (I, btw, am moderating a panel on the "Prospects for Government Control of the Internet" at the NSA/NIST-sponsored NISSC in Baltimore this week. Among my panelists are David Herson, the top pro-GAK policy maven for the European Commission; Tom Black of Smith System Engineering, the network specialists commissioned by the European Parlament to figure out how to enforce content regulation; Patricia Edfors, the Chair of the federal PKI Steering Committee and the Security Champion on GITS; Dave Farber of UPenn, the Internet Society, and EFF; and Danny Weitzner of CDT. Powerful and articulate voices from all sides of the Question. Thoughtful and non-obvious suggestions for questions to the Panel would be welcome -- to the List or in private e-mail. TIA.) _Vin Vin McLellan + The Privacy Guild + <vin@shore.net> 53 Nichols St., Chelsea, MA 02150 USA <617> 884-5548 -- <@><@> --

Adam Back wrote:

Tim May <tcmay@got.net> writes:

...

I agree that an employer has a "right" to read employee mail, sent on company time with company resources. ... Further, while businesses have every right to monitor their workers (Hey, I'm not saying I _like_ this, just that the alternative of banning such monitoring would be abusive to a property owner's rights)...

I hate to inject too strong a note of reality into arguments that I would like to agree wholeheartedly with, but I believe that there has been so much thievery of both property and rights (individual and corporate) that it is extremely difficult to make a strong case for any pure argument any more. First, the federal government gives a business confiscated land to support a failing industry, the state gives them huge tax breaks to move from elsewhere, the city does the same, while taxing you even more to support the grand growth schemes that the mayor and council members are getting rich on, and then the company announces that you can 'choose' not to work there if you don't like their rules.

Your "choice" not to work for a company which uses software like pgp5.5 is likely to become ever more limited if corporates adopt this type of policy. They will be conditioned to expect this. Governments will of course encourage corporates to use such software.

In Canada, one could 'choose' not to work for Safeway Stores, but the chain would come into a community and undersell everyone until the locals were run out of business, then raise prices dramatically. In theory, you could choose to *not* work for Safeway, but in reality, there was no one else left *to* choose to work for in the grocery business. TruthMonger

William H. Geiger III wrote:

TruthMonger <tm@dev.null> said:

...

In Canada, one could 'choose' not to work for Safeway Stores, but the chain would come into a community and undersell everyone until the locals were run out of business, then raise prices dramatically. In theory, you could choose to *not* work for Safeway, but in reality, there was no one else left *to* choose to work for in the grocery business.

If they didn't buy products from the Safeway or WalMart then you wouldn't have the "problem" above. Economics 101; the people are voting with their wallets.

This is a prime example of the basis of socialism; envy. The socialist are envious of the rich as they are a constant reminder of "what could have been".

The socialist never thinks of the hard work and personl sacrfise that goes into creating a "Safeway" or "KMart" or "Walmart". Such companies are not created by an act of GOD but through hard work and long hours by their founders.

Nothing personal, shit-for-brains, but this sounds like the 'standard speech' you have prepared, waiting only for a 'trigger' before you fire it off... I was making reference to the simple fact that 'Caveat Hemptor' still rules, but does so with the backing of men who can afford to hire thugs called policemen to back their action. My point is that Safeway has every right to bring their competition to financial ruin, just as Nestle's has every right to give away their baby formulae for free in impoverished countries, just long enough for the mother's milk to dry up, at which time their babies die if they can't afford to buy Nestle's product. I reserve the right, however, to whack their sorry asses out if I decide that my world will be a better place without their scheming for their own profit at the expense of those who believe the fairy tales they tell while planning to buttfuck the people all along. The rest of your post is proof that one should not read Ayn Rand while high on acid, but I'm glad you could get all of that off your chest, just the same. The point I was making, if you care to respond to it once the buzz wears off, is that the 'playing field' has been twisted so far out of askew that it is difficult to make any judgements about capitalism versus socialism, etc., since the world is standing on its head. I sincerely doubt that 'capitalists' getting paid 'not to grow' cotton/corn/whatever, are a far cry different from the socialists getting paid 'not to go to work.' There are no longer any capitalists or socialists, there are only people projecting images with political rhetoric and ten-second sound-bytes. I am beginning to think that the *only* way to level the playing field is with a nuclear grader. (If only I could figure out where this damn yellow wire goes...) TruthMangler

After years of hard work, when the founders are finaly able to reap the fruits of their toil, the socialist will step up and say: "I want what you have, you can't have that because I don't" even though the socialist has done nothing to earn it.

This is the true evil of socialism: "Equiality of Outcome". While the socialist will make a big show of his desire for "equal opertunity" it is really "equal outcomes" that he desires. It is like the story of the grashopper and the ant. Both have the "equal opertunity" durring the summertime to store up for the winter. The ant choses the path of the capitalist and works hard all sumer long while the grasshopper choses the path of the socialist and wastes the days away in play and folly. When wintertime comes along the ant is well prepaired while the grasshopper is without. While the capitalist will see the grasshopper getting his just rewards for his foolhardy behavior the socialist will cry foul, seeing this as unjust that the ant should have so much and the grasshopper so little and demaniding that the ant give a portion of his "wealth" (a large portion no doubt) to the grasshopper thus achiving his desired "equality of outcome" even the grasshopper has done nothing to deserve such an outcome.

- -- - --------------------------------------------------------------- William H. Geiger III http://www.amaranth.com/~whgiii Geiger Consulting Cooking With Warp 4.0

Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html - ---------------------------------------------------------------

-----BEGIN PGP SIGNATURE----- Version: 2.6.3a Charset: cp850 Comment: Registered_User_E-Secure_v1.1b1_ES000000

iQCVAwUBNDkgOY9Co1n+aLhhAQFmCwQAzll6zhks8izWPkVgCENJ+/CTuMbQqlDA cFKsMT4gX0OdqPVuFdjewVsLxTGFcKr2nkLxjWmp62ypH6Nn/uL/R3CPJ6Bsmzzc EVDI0HZOnHUirlOm1c/zz13jGihzLXww1RIcamkixnbWnXH3WPVank1ZQMyBsCab 6k9jTZmbY2w= =vHjj -----END PGP SIGNATURE-----