At 04:43 PM 11/7/96 -0800, Tim May wrote:

* Intent. It's hard to imagine someone being imprisoned for using cryptography, except perhaps in wartime conditions. I may be wrong. Also, there are deep Constitutional issues we haven't been much discussing.

One change I suspect we'll see sooner or later on the Federal side is an amendment of the Sentencing Guidelines to include an upward adjustment for the use of encryption to frustrate law enforcement efforts. This wouldn't be a conviction for using crypto, but would result in harsher penalties for people convicted of other crimes where they happened to use crypto in a way connected with the crime. (Keeping child porn or records of a forbidden business on an encrypted disk volume, using PGPfone to conspire across long distances, etc.) As an example, less than a year ago, Congress directed the Sentencing Commission (a sub-branch of the federal Judiciary) to amend the guidelines to enhance the penalties by at least two levels for using a computer to advertise or "ship" a visual depiction of child porn. Pub. L. 104-71, Sec. 2 (12/23/95). Sentences for felony and some misdemeanor convictions in Federal court are usually based upon a payoff matrix, where a crime is assigned a "base offense level" (higher levels indicate more serious crimes), which is then adjusted upwards for aggravating factors (like the use of a gun, or an elderly victim, or prior convictions) and mitigating factors (like admission of responsibility or cooperating with law enforcement) to arrive at a final score, which indicates a relatively narrow range of potential sentences. Adding an enhancement for crypto use seems like an easy way for legislators to "get tough on crypto" while avoiding Constitutional issues. (It also strikes me as pointless; I have yet to run across anyone who doesn't work in criminal law (or isn't in a federal pen) who seems to have any idea that the sentencing guidelines exist, much less take them into account when planning crimes. They're pretty complex.) I feel a little wary about saying this because I haven't heard anyone mention it before. I have no secret insider knowledge. But I think a step like this is probably transparent to the folks in the Justice Dept who work on computer crime and crypto stuff, so I'm probably not giving anyone any ideas. I hope not. Federal court is tough enough for defendants already. Folks who want to know more about the Sentencing Guidelines might take a look at <http://www.ussc.gov>. They've done a nice job of putting everything on the web, so you can scratch your head in puzzlement at home, instead of at the law library. Many states also use a similar system for sentencing in criminal cases, but they may not be crypto-savvy enough to think of adding extra penalties for crypto use. -- Greg Broiles | "In this court, appellant and respondent are the gbroiles@netbox.com | same person. Each party has filed a brief." http://www.io.com/~gbroiles | Lodi v. Lodi, 173 Cal.App.3d 628, 219 Cal. | Rptr. 116 (3rd Dist, 1985)