Re: So, what crypto legislation (if any) is necessary?
At 4:14 PM 3/25/96, Simon Spero wrote:
If the Leahy bill is unacceptable, what legistlation is necessary? I can't see how the use of cryptography in the commission of a crime needs to be a separate offence, but I could see how it could be treated as a special circumstance - that doesn't really needed a new law though.
I don't see any compelling need for U.S. legislation. And given the pressures to attach all sorts of language to bills, I think it best that no legislation happen. Consider a few areas in turn: * DOMESTIC USE OF ENCRYPTION: Currently, no restrictions whatsoever. No laws saying messages can't be encrypted, no laws saying keys must be escrowed, no laws about permissable strength of ciphers, no special laws covering disclosure of keys. Just silence, blessed silence. The Constitution says there shall be no laws about permissable speech (what language one speaks in, or writes in), and other provisions about compelled testimony seem adequate. * EXPORT OF CRYPTO BEYOND U.S.: This is indeed a thorn in the sides of U.S. companies, but is not _per se_ an issue I worry about. So long as I have strong crypto, I don't really care too much about export. It would be nice to get the ITARs modified, but not at the risk of adding language (such as Leahy did) making use of encryption a possible crime (we've debated this, so I won't elaborate here). Besides, I think the best way to overturn the ITARs is through a court challenge; as I have noted, even the NSA's lawyers felt that the ITARs would not withstand court scrutiny. * KEY ESCROW: A matter of contract law, nothing more. If I want to give a copy of my key to my lawyer, fine. If I want to give a copy to Vince's Offshore Key Repository, no current U.S. laws stops me from doing so, and I can even get it to him securely without violating any ITARs by using the cipher that _he_ uses and then importing it here! (Michael Froomkin speculated in one of his articles, I don't recall which, that there might need to be certain guidelines or laws if a key escrow protocol were to invoke the U.S. court system. Maybe. But I think ordinary contract law, about what a contract says and what it means, is adequate. If I pay Joe's Key Warehouse a fee to store my key and it loses it, or gives it to another party, then damages can be collected.) IMPORTANT NOTE: It is often said, in a correct interpretation I think, that a third party holding a key (Joe's Key Warehouse) is _not_ covered by the 5th Amendment's protections against self-incrimination, and so must honor a subpoena. Sounds accurate to me. However, what if Joe is _also_ one's lawyer? Does attorney-client privilege apply here? Perhaps. A better solution is also fully legal at this time: use only offshore key storage. A U.S. subpoena to Vince's Offshore Key Repository will carry no weight in Anguilla. (Can I be compelled to ask Vince to send my key? Sure. But Vince and I could have a stipulation that such "duress requests" will not be honored, no matter how loudly I squawk.) * DIGITAL MONEY. Well, this is such a confusing muddle of competing systems, unclear interpretations, and hyped claims, that I won't address it. Nor do any of the current bills being considered address it. In conclusion, things are fine as they are. I see no compelling need to write a special law confirming the rights we already are enjoying. If the Congress wants to relax the ITARs (fat chance), they can direct that the language of specific sections be redrafted. (I'm not even sure when and how the original language was crafted, though it is part, I believe, of the ancient Munitions Act and/or Trading with the Enemy Act. The enabling legislation for the ITARs, and especially for the specific items actually ON the "Munitions List" could be trivially changed. Were this Leahy's intent, an easy thing to write a bill for. I doubt this was his intent, however. Last point:
I do feel that it should be possible for courts to sub poena crypto keys, but that doesn't really need new law either (4th and 5th ammendments become _really_ important though (hmmm- there advantages to writing down a constitution after all :)
I agree that subpoenas for keys are legit. While I may dislike giving up my key, in a criminal matter it seems like "just another document." If they can subpoena my diary, my phone records, my dentist bills, why not another this document? Nothing in the Constitution giving it special status. Still, one can store spare copies of keys with one's lawyer, which _may_ protect it against retrieval by subpoena, and one can store spare copies of keys in foreign jurisdictions, which almost certainly will protect against the retrieval (unless an international treaty on such things is passed!). Obviously things get more complicated when a private key or set of keys "is one's identity." That is, at some future time, when a key or set of keys is literally the key to one's identity, then this document is no longer "just another document." A law enforcement agency or court that obtains these keys could do much damage, beyond just the matter being investigated or tried in court. The release of the key cannot be undone. A thorny problem. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay@got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."
TCM:
* EXPORT OF CRYPTO BEYOND U.S.: This is indeed a thorn in the sides of U.S. companies, but is not _per se_ an issue I worry about. So long as I have strong crypto, I don't really care too much about export. It would be nice to get the ITARs modified, but not at the risk of adding language (such as Leahy did) making use of encryption a possible crime (we've debated this, so I won't elaborate here). Besides, I think the best way to overturn the ITARs is through a court challenge; as I have noted, even the NSA's lawyers felt that the ITARs would not withstand court scrutiny.
hmmmm, I don't recall you saying that. would love to hear more about "NSA's lawyers feeling the ITAR cannot withstand court scrutiny". I have been ranting at a lot of people in the companies that are showing no spine and adhering to the odious NSA laws (thereby increasing their legitimacy) to just SUE THE GOVERNMENT. but of course they all retort that "gosh, we are just following the laws, we don't really have any choice, we are doing the best we can, blah blah blah". (this as they have armies of lawyers that they don't hesitate to unleash on their competitors) frankly I think the lack of a legal challenge to the ITAR crypto laws by a large company by this date is very suspicious. I am starting to wonder if whenever something like this starts to suggest itself, the NSA agents hurriedly run to a company and make some deals & promises. (note I am aware of the Bernstein case-- this is just too tiny to ever have any significance imho). if big software companies think the ITAR is not acceptable and is costing them bigtime, let's see them put their lawyers where their mouths are. I fully agree with the above that the ITAR is unlikely to withstand a *serious* court challenge, assuming the courts have not gone totally comatose. the ITAR amounts to the following: a legitimate law that says, "munitions cannot be exported. the list of munitions is maintained by the DoJ" (or somebody-or-other). now, somebody-or-other (obviously the NSA, through their various front agencies, the @#%^&^*& spooks love this kind of subterfuge to circumvent the law and pretend they are doing things legitimate) could add "twinkies" to the list of "export controlled items". in fact, I wish they would. they have come pretty darn close. it turns out that MS has been convinced that mere "export" of digital SIGNATURES is prohibited. I can't believe there is not more uproar here or elsewhere about this outrageousness. frankly, I think the american public & software companies are getting exactly what they have earned. "eternal vigilance is the price of freedom". instead we have endless spinelessness as the response to increasing tyranny.
On Mon, 25 Mar 1996, Timothy C. May wrote: [...many things including...]
(Michael Froomkin speculated in one of his articles, I don't recall which, that there might need to be certain guidelines or laws if a key escrow protocol were to invoke the U.S. court system. Maybe. But I think ordinary
It's my clipper article, see the link from my homepage. The claim (disputed, BTW, by many experts) is that it's not obvious that the constitution allows judges to hold keys in the absence of an onging judicial proceeding involving the owner of the key because the separation of powers would classify this action as "executive".
contract law, about what a contract says and what it means, is adequate. If I pay Joe's Key Warehouse a fee to store my key and it loses it, or gives it to another party, then damages can be collected.)
I agree that absent a statute all that is involved is contract law. [...]
IMPORTANT NOTE: It is often said, in a correct interpretation I think, that a third party holding a key (Joe's Key Warehouse) is _not_ covered by the 5th Amendment's protections against self-incrimination, and so must honor a subpoena. Sounds accurate to me. However, what if Joe is _also_ one's lawyer? Does attorney-client privilege apply here? Perhaps. A better
NO IT DOES NOT. Basic rule of thumb: your lawyer can't be used to hide papers someone else can't hide. Ok, at the margin it gets tricky, but bascially the privilege is not going to stretch to your key.
solution is also fully legal at this time: use only offshore key storage. A U.S. subpoena to Vince's Offshore Key Repository will carry no weight in Anguilla. (Can I be compelled to ask Vince to send my key? Sure. But Vince and I could have a stipulation that such "duress requests" will not be honored, no matter how loudly I squawk.)
An interesting issue, likely to be addressed in future judicial assistence treaties... [...] A. Michael Froomkin | +1 (305) 284-4285; +1 (305) 284-6506 (fax) Associate Professor of Law | U. Miami School of Law | froomkin@law.miami.edu P.O. Box 248087 | http://www.law.miami.edu/~froomkin Coral Gables, FL 33124 USA | It's warm here.
On Mon, 25 Mar 1996, Michael Froomkin wrote:
On Mon, 25 Mar 1996, Timothy C. May wrote:
[...many things including...]
(Michael Froomkin speculated in one of his articles, I don't recall which, that there might need to be certain guidelines or laws if a key escrow protocol were to invoke the U.S. court system. Maybe. But I think ordinary
It's my clipper article, see the link from my homepage. The claim (disputed, BTW, by many experts) is that it's not obvious that the constitution allows judges to hold keys in the absence of an onging judicial proceeding involving the owner of the key because the separation of powers would classify this action as "executive".
contract law, about what a contract says and what it means, is adequate. If I pay Joe's Key Warehouse a fee to store my key and it loses it, or gives it to another party, then damages can be collected.)
I agree that absent a statute all that is involved is contract law.
[...]
IMPORTANT NOTE: It is often said, in a correct interpretation I think, that a third party holding a key (Joe's Key Warehouse) is _not_ covered by the 5th Amendment's protections against self-incrimination, and so must honor a subpoena. Sounds accurate to me. However, what if Joe is _also_ one's lawyer? Does attorney-client privilege apply here? Perhaps. A better
NO IT DOES NOT. Basic rule of thumb: your lawyer can't be used to hide papers someone else can't hide. Ok, at the margin it gets tricky, but bascially the privilege is not going to stretch to your key.
solution is also fully legal at this time: use only offshore key storage. A U.S. subpoena to Vince's Offshore Key Repository will carry no weight in Anguilla. (Can I be compelled to ask Vince to send my key? Sure. But Vince and I could have a stipulation that such "duress requests" will not be honored, no matter how loudly I squawk.)
An interesting issue, likely to be addressed in future judicial assistence treaties...
Practally speaking, this is incorrect. While most nations complain about the application of U.S. law abroad in discovery, unless the foreign entity has no U.S. presence what so ever, they are highly vulnerable to subpoenas. Either today or tommorow I'll post a massive article on asset protection to the list which discusses many aspects of international subpoena powers and jurisprudence in relation to bank documents, and in some cases, computer disks and information. It may answer this question more completely.
[...]
A. Michael Froomkin | +1 (305) 284-4285; +1 (305) 284-6506 (fax) Associate Professor of Law | U. Miami School of Law | froomkin@law.miami.edu P.O. Box 248087 | http://www.law.miami.edu/~froomkin Coral Gables, FL 33124 USA | It's warm here.
--- My prefered and soon to be permanent e-mail address: unicorn@schloss.li "In fact, had Bancroft not existed, potestas scientiae in usu est Franklin might have had to invent him." in nihilum nil posse reverti 00B9289C28DC0E55 E16D5378B81E1C96 - Finger for Current Key Information
On Mon, 25 Mar 1996, Timothy C. May wrote: [Damn... I can't find anythig I disagree with... oh, how about this]
Obviously things get more complicated when a private key or set of keys "is one's identity." That is, at some future time, when a key or set of keys is literally the key to one's identity, then this document is no longer "just another document." A law enforcement agency or court that obtains these keys could do much damage, beyond just the matter being investigated or tried in court. The release of the key cannot be undone. A thorny problem.
IMO this is why maintaining separate keys for identity and encryption, as is done by both the MS CryptoAPIVapor and Espionage-Enabled Notes, is such a good idea. The two (or more) keys would sign each other, but they can't take the place of each other. I sorta wish PGP had this feature. Of course you can embed comments into your key ID to specify usage, but it's not quite the same thing. But anyway, just as a tactical matter, I think getting behind the Leahy bill, precisely because it had no chance of passing, would have been the right thing to do (written in past tense because I'm sure it is). The good guys would have had a better chance to appear reasonable and to get their views on the record. -rich
participants (5)
-
Black Unicorn -
Michael Froomkin -
Rich Graves -
tcmay＠got.net -
Vladimir Z. Nuri