Regarding the topic of a 15-year prison term for receiving broadcasts one is not supposed to, Steve Bellovin wrote:

I'm not defending a 15 year sentence; it's far too harsh. But I strongly disagree with ``why outlawing it in the first place? What is crypto for?'' By analogy, why outlaw burglary? After all, what are safes and alarms for?

The purpose of a civilized society is precisely to avoid this sort of ``arms race'' between bandits and those who pay for services. Even libertarians generally agree that theft is wrong, and theft of service is just as wrong as theft of tangible objects; otherwise, there is

As a libertarian, I disagree that thefts of services are the same as thefts of tangible objects. Consider some possible "thefts of services": - I'm tuning my radio, listening to what is freely available on my property, and I hear something that helps me in some way. Have I broken any law, plausibly? - I find a number which looks to be compressed or encrypted. I fiddle around with it and manage to decrypt it, and it turns out to be a useful to me (and possibly harmful to others). What law have I broken, plausibly? - I'm a 15th-century blacksmith. I use the new technology of printing to help people learn to do basic home-blacksmithing. The Blacksmith's Guild claims I have deprived them of business and have violated their rights. Etc. The "listening to the radio" and "decrypting a number" are both similar situations. (I threw in the last point to make a slightly different point, about the collapse of guilds and the parallels to what is now happening with corporations.) If I overhear someone talking in a restaurant, is this criminal? Does it matter if I learn something of commercial value or not? The common sense response is that those who don't want to be overheard should either keep their voices down or speak in a kind of code. Talking about trade secrets of business deals where conversations can be overheard, and then claiming "theft of services" is an abuse of the law. And impossible to enforce, as the current scanner laws are. The issue of "spaces" also comes up. Personal, local spaces (such as houses, offices, etc.) are protectable, and a thief who enters can be captured, shot, etc. But extending this idea of a personal space to include things spoken in public places, or broadcast for hundreds of miles with radio or television transmitters, is a terrible idea. Let those who speak in a public place--restaurants, the airwaves--but wish not be understood by outsiders choose a technology which supports this. Don't ask me, or other taxpayers, to prosecute those who happen to hear and understand what was said. (There are more interesting digressions into privately-produced law, into haow insurance companies would charge to insure against such cases, etc.) I know of very few libertarians who support the idea of criminalizing the hearing of broadcast messages, let alone who would criminalize mere possession of certain kinds of radios (scanners). --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay@netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

Now, a prudent service provider may wish to invest in crypto as a way to prevent fraud, just as many homeowners invest in alarm systems. But failure to do so doesn't make either sort of theft correct.

This is precisely the sort of argument that makes the least amount of sense to those who are looking for a justification of some sort to continue to rip "them" off. After all, "they" are rich, so what's it hurt? I am currently employed as an information management security consultant for a rather large telecommunications company subsidiary (no, not Bell, but you're close). A discussion arose the other day between myself and another consultant as to the ethics of theft. If one steals a pen from work, is that "really" theft? Is stealing a box, or a truckload? You might be surprised to learn how many people think stealing a pen is OK, but stealing a truckload is not OK. Just because someone doesn't say explicitely "don't steal this pen" some people think it's OK to steal it. But it's an ethics problem, and I feel a failure at the deepest levels of our society that says that stealing in any form is OK. As for "stealing" radio signals that happen to stray onto your property, my position is that it's not theft - any more than it's theft to read a paper one finds in the restroom while sitting on the throne ;) The Communications Act of 1934 spelled this out explicitly. But the fools in Washington let special interest $$$ seduce them into doing something utterly foolish. Again. If it comes within my purview, then it's mine - and if I choose to spend the time and effort it takes to decrypt it, well, tough for the satellite TV industry. I don't see them going after folks without decryption gear, which is what they'd have to do if they really wanted to make their position even marginally tenable.

Steve Bellovin writes:

I'm not defending a 15 year sentence; it's far too harsh. But I strongly disagree with ``why outlawing it in the first place? What is crypto for?'' By analogy, why outlaw burglary? After all, what are safes and alarms for?

I concur with Tim May's comments that a service is not the same thing as property. Nor, going further, is physical property the same as intellectual property. We have a long legal tradition of protecting physical property. It's the kind of thing people can clearly understand, morally and legally. Intellectual property is often more nebulous. Protecting new kinds of services at the whim of a business (such as, for example, defining some string of bits as an "access code" and instituting stiff penalties for "unauthorized use" of that code, which ends up meaning whatever the offended party wants it to mean) is a going way too far, putting all of us at risk of extreme legal jeoapady at the whim of bureaucrats, lawyers, and jurors who couldn't tell an access code from a mail header. For a business to lobby that some new and flawed system be protected at taxpayer expense is a gross abuse of the law. To criminalize an entire group of people, such as hackers, is morally bankrupt and turns the law into an illegitimate farce. We have quite enough crimes on the books that are hardly being enforced right now; the last thing we need is to define new crimes out of thin air because some jerks couldn't be bothered to take the precautions necessary for the success of their business. Criminalization of business intelligence is a great recipe for destroying our civil rights and bankrupting the government. Jim Hart chaos.bsu.edu

The purpose of a civilized society is precisely to avoid this sort of ``arms race'' between bandits and those who pay for services. Even

This "arms race" would not have been necessary had the vendors and cellular carriers not been so short sighted as to not put meaningful cryptographic security into their system at the very beginning. All of the technology necessary to prevent the now-rampant snooping and replay of ESNs already existed in the early 1980s when AMPS was being deployed. It certainly exists now. Unfortunately, the TIA seems to be just as incompetent now as they were back then. The cellular industry is as bad as the credit card industry. Both claim that cryptographic security mechanisms are not "economically viable", but if you look more closely you'll discover this conclusion is based solely on their own direct costs. They ignore the consequences of bad security borne by others: the mail-order merchant stuck with a bad debt, the honest customer with a credit rating destroyed by a stolen card number, the taxpayers who have to pay the police, courts and prisons to investigate, prosecute and punish credit card and cellular fraud, and of course every customer who pays a higher price to subsidize fraud. As long as the credit card and cellular carriers don't have to carry these costs themselves, they don't give a damn. And I can't get too sympathetic when I see them trying to heap even more of the consequences of their laziness on the legal system. Phil