I am not sure how serious the proposed FBI-backed bill is. It may just be intended as a bargaining chip. Or perhaps its sponsors are as clueless about contitutional law as they are about cryptography and how computers work. It is conceivable that the courts might uphold (a carefully drafted) law regulating the _use_ of cryptographic software, but the proposed bill does not do that. Instead it provides: (b) As of January 1, 1999, it shall be unlawful for any person to manufacture for sale or distribution within the U.S., distribute within the U.S., sell within the U.S., or import into the U.S., any product that can be used to encrypt communications or electronic information, unless that product: (1) includes features, such as key recovery, trusted third party compatibility or other means, that (A) permit immediate decryption upon receipt of decryption information by an authorized party without the knowledge or cooperation of the person using such encryption product; and (B) is either enabled at the time of manufacture, distribution, sale, or import, or may be enabled by the purchase or end user; or (2) can be used only on systems or networks that include features, such as key recovery, trusted third party compatibility or other means, that permit immediate decryption by an authorized party without the knowledge or cooperation of the person using such encryption product. But notice that the ``products'' that are described here are actually software, are computer programs. (I suppose that some products could be physical devices with the programs hard-wired or in firmware, and to the extent that there are such devices the following analysis may not be applicable.) Now, although it is possible that Judge Freeh and Senator Feinstein are not aware of the fact, computer programs are written and published, and they certainly are not ``manufactured'' in any accepted meaning of that word, and their writing and publication is---as Judge Patel just held once again---protected by the First Amendment to the United States Constitution like any other writing or publication. It may, as I said, be possible under the Constitution to regulate the use of cryptographic software, but to forbid the publication (distribution, sale, or import) of software because its content is unpleasing to the government is a blatant violation of the First Amendment. Yet the draftsmen of the Bill do not purport to regulate the use of cryptographic software, they only purport to forbid its publication. Which I find strange. What I also find strange is that the ardent opponents of the CDA do not seem much disturbed by such a proposed violation of the First Amendment, or by the present constitutional violations embodied in the ``export'' regulations on encrption software that are being challenged in the _Bernstein_ and _Junger_ cases. Somehow those who care about the right of programmers to express their ideas and to publish the software that they write have failed miserably in explaining to the public, including those organizations that have traditionally been concerned with protecting civil liberties, that programs are written and published like any other text. Part of the problem may be that those who publish software commercially would rather be thought of---and regulated as---manufacturers. The last thing that they want is for people to start claiming a first amendment right to read their programms and to copy the ideas, or criticize the expression of the ideas, that are buried there. To the software moguls ``free speech'' must sound an awful lot like ``free software''. And, however distasteful they may find the proposed legislation, it at least has the virtue of making it illegal to import or distribute Linux. And the nice thing about regulations of the sort proposed is that they raise insurmountable barriers for any competitor who hopes to enter the market place for computer software. Another reason that there may not be so much concern among traditional civil libertarians about the First Amendment implications of this proposed crypto legislation or of the export regulations on encryption software is that---as hard as it may be for the denizens of this list to comprehend---they are simply not interested in cryptography. But the constitutional issues raised by the proposed bill and the export regulations on cryptographic software implicate all software, not just encryption software. For whatever else it may be, all software is functional, and the government's argument comes down to the claim that they can censor software because it is functional and that ``functionality'' is not protected by the First Amendment. Thus, according to the arguments that have been made by the President himself, it would be perfectly constitutional for the government, in order to encourage efficiency and interoperability, to forbid the publication of any software that does not comply with the Windows 95 ``standard''. Here is what President Clinton had to say when he transferred the regulation of cryptographic software from the Department of State to the Department of Commerce: Because the export of encryption software, like the export of other encryption products described in this section, must be controlled because of such software's functional capacity, rather than because of any possible informational value of such software, such software shall not be considered or treated as ``technology,'' as that term is defined in section 16 of the EAA (50 U.S.C. App. 2415) and in the EAR (61 Fed. Reg. 12714, March 25, 1996)[.] Don't you find that rather frightening? -- Peter D. Junger--Case Western Reserve University Law School--Cleveland, OH EMAIL: junger@samsara.law.cwru.edu URL: http://samsara.law.cwru.edu NOTE: junger@pdj2-ra.f-remote.cwru.edu no longer exists

(b) As of January 1, 1999, it shall be unlawful for any person to manufacture for sale or distribution within the U.S., distribute within the U.S., sell within the U.S., or import into the U.S., any product that can be used to encrypt communications or electronic information, unless that product:

(1) includes features, such as key recovery, trusted third party compatibility or other means, that

(A) permit immediate decryption upon receipt of decryption information by an authorized party without the knowledge or cooperation of the person using such encryption product; and

Translation: If I whisper in someone's ear in cyberspace, and I do not immediately provide a transcript of the conversation to the government, I am in violation of the law, and subject to whatever penalties it specifies.

(B) is either enabled at the time of manufacture, distribution, sale, or import, or may be enabled by the purchase or end user; or

This is stupid. Do Freeh & Co. really think any self-respecting pedophile or terrorist is going to use GAKed crypto products, or that if GAK can be disabled, that people won't disable it? I predict that this section is going to quietly disappear from the final version of the bill.

(2) can be used only on systems or networks that include features, such as key recovery, trusted third party compatibility or other means, that permit immediate decryption by an authorized party without the knowledge or cooperation of the person using such encryption product.

This is stupid also. If my ISP uses GAKed crypto protocols, can I use PGP 5.0? Freeh & Co. can immediately decrypt the packet stream. Am I jailbait if all they get is "--------Begin PGP Message--------"? What about encrypted .wav stego? Tim May allegedly said:

The Anti-Terrorism Act of 1995, though apparently not being used in any significant way (yet), would have done some of the same sorts of things. If an organization was declared to be a terrorist-supporting organization, various sanctions would have applied to those who contributed money or certain other types of aid to such organizations. As others have noted, the Bureau of Thought Crimes has not yet issued a list of which organizations are considered terrorist.

(One of my fondest hopes is that the Cypherpunks group makes this list. I'm hoping that enough support of various types provided to freedom fighters in the ZOG sections of Palestine will get us on this list. I'm itching for a confrontation with the jack-booted thugs, as you may know.)

I'm sure that the opposition to GAK expressed by most posters to the list will be sufficient without our buying any Russian suitcase nukes for Hezbollah. However, I would caution you re provoking a confrontation with the JBT's. From a propagandist's perspective, they can smear your reputation much more easily if you have a history of provocative actions (like Jim Bell's stink bomb). If you have never threatened anyone in your life (even people who richly deserve it) and several armed individuals kick in your door and you shoot them, you can look much more righteous in the media than if you are constantly calling for the death of thousands. OTOH, if the situation is not avoidable, then "Give me liberty or give me death!" (In either case, pass the ammo.) Jonathan Wienke What part of "the right of the people to keep and bear Arms, shall not be infringed" is too hard to understand? (From 2nd Amendment, U.S. Constitution) They came for the pedophiles using crypto, and I said nothing, because I am not a pedophile. They came for the drug dealers using crypto, and I did nothing, because I am not involved with drugs. They came for the proponents of AP, and I did nothing, because I hoped that political change could still be effected at the ballot box. They banned non-GAK crypto, and I purchased my quota of ammunition, because the Constitution guarantees freedom of speech, the right to keep and bear arms, and protection against unreasonable search and seizure. They came for the users of non-GAKed crypto, and I became the poster boy of a propaganda campaign denouncing right-wing cryptolibertarians with guns. PGP 2.6.2 RSA Key Fingerprint: 7484 2FB7 7588 ACD1 3A8F 778A 7407 2928 DSS/D-H Key Fingerprint: 3312 6597 8258 9A9E D9FA 4878 C245 D245 EAA7 0DCC Public keys available at pgpkeys.mit.edu. PGP encrypted e-mail preferred. Get your assault crypto before they ban it! US/Canadian Windows 95/NT or Mac users: Get Eudora Light + PGP 5.0 for free at http://www.eudora.com/eudoralight/ Get PGP 5.0 for free at http://bs.mit.edu:8001/pgp-form.html Non-US PGP 5.0 sources: http://www.ifi.uio.no/pgp/ http://www.heise.de/ct/pgpCA/download.shtml ftp://ftp.pca.dfn.de/pub/pgp/V5.0/ ftp://ftp.fu-berlin.de/pub/pc/win95/pgp ftp://ftp.fu-berlin.de/pub/mac/pgp http://www.shopmiami.com/utopia.hacktic.nl/pub/replay/pub/pgp/pgp50/win/ RSA export-o-matic: print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`