EC isn't great for privacy either...
Wow! And "Gulp." I may have to get my European Community passport sooner than I had planned. Does Martinique have a Net connection?
Don't rush out to get your EC passport yet. Below I have included some exerpts from the EC Information Technology Security Document (ITSEC, aka Green Book). The referenced sections are from the "Confidentiality" section. I have put "..."'s where I have skipped over material and all upper case words are emphasis that I have added. For those who don't want to read it all, the gist of it is that the EC folks are also interested in maintaining the government's ability to intercept private communications. There is also talk about licensing businesses to use good confidentiality services. Btw. There is also a mention of PGP which I have left. Its the paragraph right before the one that mentions Clipper! --Begin Enclosure \subsection{Privacy enhancement issues} \subsubsection{Perception of requirements for privacy enhancement} \SeiLa{Issue} Confidentiality is, at times, essential for the good functioning of administrations, business and human relations. ... Most business and private users of communication systems are aware of the conflict between their confidentiality requirements and national security issues which require the possibility to intercept the communication in a way regulated by national laws. They accept the national authorities ability for this interception provided there are adequate safeguards to prevent unauthorised interception even by government employees. ... {\bf Service provision} The extent to which confidentiality services are provided for a specific business or citizen could depend on a system of LICENSES or certificates. A particular business might qualify for a CONFIDENTIALITY LICENSE depending on its internal procedures and activities. A general (minimum) level of confidentiality could be provided to all users. It should be possible for certain user groups or businesses to use other confidential services (egproprietary) than the standard ones provided. There are strong indications of emerging ``bottom up'' solutions for these needs (eg the Pretty Good Privacy offering on Internet, beginning 1993). Other initiatives (eg the announcement of the ``Clipper Chip'', 16 April 1993) illustrate the growing awareness of governments of the needs of their citizens for confidentiality services. ... If a public confidentiality scheme is offered, organised crime could also subscribe to such a scheme, but as it would include provisions for legal intercept, it would hardly be attractive. One would expect that such users would continue to find their own solutions as will the classified domain. An open and public service offering a credible level of confidentiality would therefore provide for the honest user, while not worsening the situation with respect to public order or national security. The combination of international communication and national security regulations require a common framework for confidentiality services, which on the one hand interoperate within all Community Member States as well as with countries outside the Community which themselves may establish their confidentiality services. This requires either an overlay approach or gateways which link the different national or regional services. These gateways are only required where multinational agreements for co-operation on national security concerns is not yet established. In this case these gateways may provide at least an interim solution. --End Enclosure
[anonymously quoted EC policy proposal]
A particular business might qualify for a CONFIDENTIALITY LICENSE depending on its internal procedures and activities. A general (minimum) level of confidentiality could be provided to all users.
THE HORROR! *this* is Orwellian. *this* is how to outlaw cryptography. we need some ECypherpunk infiltrators ASAP! Whoever posted this -- can you post more information on where it was contained to sci.crypt or alt.privacy.clipper, so that we can get a wider audience? there are probably plenty of Europeans who don't know about this but should! We need a contact to report to the list! I speculated on the list some time ago the efforts by NSA to get Clipper to be an *international* standard. I suggested that the Britain GCHQ would be the first to endorse it publicly. Sounds like the EC may beat them to the punch. Was NSA lobbying involved here, or did they just pick up on this great idea <smirk>? Also, where was it [Norway?] that lady posted from saying that their national secret service was pushing a proposal for cryptographic use similar to Clipper? In one word, YIKES
[anonymously quoted EC policy proposal]
A particular business might qualify for a CONFIDENTIALITY LICENSE depending on its internal procedures and activities. A general (minimum) level of confidentiality could be provided to all users.
THE HORROR!
*this* is Orwellian. *this* is how to outlaw cryptography.
we need some ECypherpunk infiltrators ASAP!
I would be interested in knowing which EC document is being referred to. You may perhaps be interested to know that the 14JUL93 Draft 3.6 of the "Green Book on the Security of Information Systems" (from CEC DGXIIIB) addresses the issue that "strong information privacy may also be used to escape investigation by law enforcement". It identifies some related requirements: "an effective, internationally agreed, economic, ethical, and usable solution to meet business, administration, and personal needs including mechanisms for authorised interception and reporting the incidents and crimes adjusted to the conditions of the Internal Market, and to include the necessary equipment and software, but also an infrastructure of Trusted Third Parties. This will discourage "home made" or other solutions." As its name suggests, the Green Book isn't an agreed policy, but is an intermediate step in the process of constructing and Action Plan for EC information security. As such, the current text might be interpreted as a recommendation for EC adoption of a Clipper-style solution, but this is by no means the only (or even the best) way to meet these requirements. Personally I would favour a framework which encouraged strong cryptography, and assumed that criminals will tend to ignore the law, so therefore didn't burden the law-abiding 99% with pointless constraints. This would require an adjustment to the current Green Book requirements, which I, at least, will be suggesting.
participants (3)
-
L. Detweiler
-
P.V.McMahon@rea0803.wins.icl.co.uk
-
remail@tamsun.tamu.edu