Here is an update on recent and past developments. - Why PRZ was not subpoenaed - Clarifications on the NYT article - simultaneous serve dates? - The Grady Ward PGP connection - the Scarlet Letter - Conclusion - EFF and *your* support PRZ unsubpoenaed so far ---- First, in the message I posted to the cypherpunk list that PM transformed into one of the most side-splittingly hilarious, foaming, delirious flames I've ever had the joy to experience, there were some misleading comments, and I'm rather surprised that no one has noticed and chastised me for them, publicly or privately. (In this way PM succeeded precisely in his intent of distracting attention from the actual contents, in a rather pitiably desperate way.) However, I do have to admit that it was probably my weakest posting here on the affair -- nevertheless, I was actually quite dazzled by the ensuing fireworks, which IMHO comprise the most spectacular flame war I've ever seen on the list, and I'd *not* have done anything differently knowing this in retrospect! (And this characteristically prolix commentary is my tribute in response!) Anyway, I've been relying on `cyberspatial connections' (email & the phone, and *many* key people) *intensely* lately as a tool to crystallize my thoughts and further The Cause. Let me post some clarifications. First, I said,

What is the significance that PRZ was not actually cited in any subpoena so far? This is very puzzling. It seems to contradict the theory that the investigation is primarily PGP oriented.

Actually, what I meant was this: why do the subpoenas ask representatives to appear who have very little personal knowledge of the situation: ``how could they *not* query PRZ if they are inquiring on PGP''? The Austin Code Works one is not even directed to anyone in particular (!) but to the `custodian of records'. And as I noted the ViaCrypt one is directed to the president, Leonard Mikus -- who of course would be extremely knowledgeable of the recent ViaCrypt deal, but virtually *entirely clueless* as to the original PGP distribution (happening over 2 *years* ago!). The ViaCrypt subpoena of course *does* mention PRZ repeatedly. Here are the two side by side for comparison. I got this from Current Underground Digest: [Viacrypt]

"Any and all correspondence, contracts, payments, and records, including those stored as computer data, involving international distribution related to ViaCrypt, PGP, Philip Zimmermann, and anyone or any entity acting on behalf of Philip Zimmermann for the time period June 1, 1991 to the present."

[Moby Crypto]

Any and all correspondence, contracts, payments, and record, including those stored as computer data, relating to the international distribution of the commercial product "Moby Crypto" and any other commercial product related to PGP and RSA Source Code for the time period June 1, 1991 to the present.

From the CuD account, I have pieced together the following, which forms

The letter I quoted in my own, from the person describing grand jury investigations, erroneously implied that Phil Zimmermann was subpoenaed, which regrettably my own report above it confused as well. Phil Zimmermann, to this point, has *not* been subpoenaed. I think the simple answer to this curiosity is as follows, and is not idle speculation but cuts to the core of the case and the intentions of those behind it. As indicated, I have heard indications that the subpoenas are only the latest development in a customs investigation that perhaps extends up to many months or even over a *year* in span. Very likely PRZ has been contacted on a previous occasion. The primary focus of these subpoenas is *records*, not *testimony*. Possibly, the investigation has already exhaustively uncovered testimony short of written records. In fact, this suggests a model `ladder of severity' of an investigation of this type, of which there appears to be almost no historical precedent, but this might serve as in the future: (1) start with queries to people involved, with no warrants. Maximize the information obtained. track down all leads to people mentioned freely. (2) When this has been exhausted, possibly, attempt to gain any records available without a warrant. (3) If no directly incriminating evidence has been obtained to this point, but there is still some prod to go further (more on this later), convene the grand jury. (4) subpoena (a) documents and (b) witnesses. Now, in (4), if significant oral accounts had already been obtained *freely*, the former (a) is more important than the latter (b) at that stage. Or, it might be that the investigators thought that a mere subpoena for records would be less explosive than one for documents. Also, it is definitely less of a burden on some people (the Austin Code Works `records custodian' notwithstanding). These are all plausible conjectures of the inquiry situation at this point in the case. NYT article & the simultaneous date? --- part of a letter I hope will be accepted by one of the premier online electronic computer journals (watch for it!):

As reported in many places, such as Current Underground Digest, New York Times (Sept 21) and on AP, subpoenas were served on representatives from the companies ViaCrypt and Austin Code Works for materials related to a grand jury investigation in California associated with the U.S. Customs Office. Both warrants are dated 9 Sept., but were served and received two days apart (contrary to the NYT account), with the ViaCrypt on Tues 14 Sept and ACW on Thur 16 Sept [...]

I've talked to J. Markoff (the NYT writer) and he's indicated that the following statement in the article

The grand jury subpoenas, which the companies *received* Sept. 9

(my emphasis) was based on the date *on* the subpoenas, not their actual `serving time'. (Note: subpoenas are delivered by government agents, not the post office.) Markoff also misspelled Zimmermann's name with one 'n', a pitfall I must confess my own guilt on occasion! Finally, I have to admit now that theories about a `coordinated simultaneous attack' in expectation of the `cyberspatial reaction' are not supported by this datum. This is not to say it was not on the minds of `the powers that be', which I will henceforth coin the PTB, and let it serve as the hypothetical TLA responsible for all *unsolved* conspiracies in existence. (Note that the expression is not my own but the abbreviation is.) The PGP connection --- Finally, I also wrote, an eternity ago in cyberspatial time (EA in CT):

Rumor: Moby Crypto was targeted because G. Ward intended to include PGP on distribution disks. The investigation is primarily PGP oriented, and G. Ward is just a bystander who got caught up. PRZ & PGP is the essential target.

G. Ward has just confirmed this to me directly. Since he's referring to public Usenet postings, I'm going to quote him: Date: Thu, 23 Sep 93 05:50:13 -0700 Message-Id: <9309231250.AA17688@netcom6.netcom.com>

I believe that I did announce on sci.crypt that my Moby Crypto tutorial was to contain a full source to PGP as an excellent example of a full crypto and digital signature application.

Because I do not have a license from PK partners, I was careful to document their patent rights and to only publish the source (and I got two patent attorneys opinions that source is not infringing as long as it wasn't just an attempt at evasion).

also, I asked cypherpunks to find this message. so far, no bites. I would figure it would have *really* stood out, but no one seems to remember it. This is *prime* material for us to pore over. We can determine how fast someone may have reacted if we know the date of his message. Now, call me a conspiracy theorist, but personally, this statement, taken along with the subpoenas and the glaring NSA pokes G. Ward has been the butt end of as reported on Usenet crypto groups and alluded here, is all perhaps the strongest indication I've ever seen that the NSA (the most common PTB) is directly monitoring newsgroups -- not only monitoring, but beginning to respond directly to taunts. The Scarlet Letter --- I'll have much more to say about the latest letter bestowed on Grady later. The major point I want to make here is to tie it in with the current investigation. First of all, it now implicates fairly high levels of the State Department and the Office of Defense and Trade controls as being engaged in all this as well. Secondly, it gives us some EXTREMELY valuable intelligence on which of our interpretations of the ITAR are relevant, and how the PTB (synonymous with The Enemy here) interprets them. There are *direct references* of sections, and I'm just salivating for the next H. Finney posting to rebut their fantasies:

Further, the exemptions listed in 22 CFR # 125.4 for technical data do not apply to cryptographic software and source code.

The most EXTRORDINARY section, upon which Grady Ward bases his claims that this appears to be a DOMESTIC CONSTRICTION of cryptographic knowledge dissemination:

We take this opportunity of advise you that any company or individual who engages in the United State in the business of either manufacturing or exporting defense articles or furnishing defense services is required to register for a fee with the Office of Defense Trade Controls (DTC) pursuant to 22 U.S.C. # 2778(b)(1)(A) and 22 C.F.R. Part 122.

The apparent claim is that mere *U.S. `manufacturing' alone* (*not* any trans-border condition such as export or import) requires `registration for a fee' -- this is tantamount, in the case of cryptography, to PRIVACY LICENSES. HORRORS! This appears to be an extraordinarily audacious, egregious, and perhaps a WHOLLY UNTENABLE interpretation of the ITAR by the PTB. Here G. Ward's comical vision of Cereal Decoder Ring Registration reaches the depths of irony and absurdity -- and the heights of our anxiety and apprehension. BTW, I've come to the conclusion that we could not have *wished* for better `victims' in a lifetime. If we are going to win anything for `the cause' from all this, Phil Zimmerman and Grady Ward are the greatest shining heroes we have to offer in this affair, which is going to turn out, desperately hopefully, as the Two Davids vs. Goliath, and not the latest human sacrifice to the PTB. Conclusion --- What does all this mean to the spread of cryptography? Its far too premature to comment authoritatively. Instead I wrote the `Schneier Satire' because I'm *extremely* concerned by all these recent developments. I think they respresent a desperate struggle by the NSA to minimize the *future* spread of cryptographic ideas and implementations through any government agencies available, particularly in the *domestic* U.S. arena. PGP to this point has been `out of the bag' but not in a potentially enormous *commercial* way. Apparently, the ViaCrypt agreement shifted the `institutional paranoia' into high gear of the extraordinary future potential of PGP and public, widespread cryptography. This represents a fundamental policy change from `benign neglect' to `active harassment' and perhaps, more melodramatically, *attack*. The Zimmermann-Ward affair is going to be a critical keystone to future developments in cryptographic freedom, in either limiting and checking this latest alarming manifestation of the severe, constricting, repressive influence of the NSA, or in heralding a new, basic, bold expansion of it. EFF and *your* support --- It greatly pains me to have to bring this up, but I've received multiple top confirmations that EFF is `less than fully engaged' on this for a variety of practical reasons. In particular, it is not possible for them to provide attorneys or financial support at this early stage. I fully believe they are wholly committed to the overall battle, but have talked to key observers who are disenchanted and even alienated by their lukewarm response so far. I hope something beneficial to everyone and "The Crypto Cause" can stabilize as soon as possible. In the meantime, I'm going to close with H. Kennedy's beconing call in Current Underground Digest: ===cut=here=== Date: Tue, 21 Sep 1993 05:36:08 GMT From: hugh@GARGOYLE.UCHICAGO.EDU(Hugh Miller) Subject: File 1--Phil Zimmerman Comments on Encryption Flap Phil asked me to forward this to the Digest. It points up the problems of keeping _ANYTHING_ secret in the electronic world (unless, of course, it is SECURELY encrypted \;-}). It is more or less self-explanatory. Let me square his remark at the end, though: whatever happens, Phil is facing some pretty vast legal bills. Now is the time for all of us who favor crypto for the masses to pony up and put our wallets where our mouths are. I pledge $100 NOW, and challenge every one of you to match or exceed me. I'll keep it up until Phil's out of the hole. ($100 on a regular basis is a lot of money on an assistant professor's salary with 3 kids.) Examine your conscience and write that check. Pronto. Hugh Miller Asst. Prof. Dept. of Philosophy Loyola University Chicago Date--Sun, 19 Sep 1993 13:38:44 -0500 From--Philip Zimmermann Subject--Zimmermann statement on PGP investigation [...] I understand that the issues involved in this investigation are of the greatest importance and transcend my personal interests. Even so, I would rather not turn an investigation into a full-scale federal prosecution. I ask that everyone keep in mind that the government's resources are limitless and that mine are not. Speaking of resources, many of you have offered help, and I am grateful. Those wishing to contribute financially or otherwise should contact either me or Philip L. Dubois, Esq., at dubois@csn.org or by phone at 303-444-3885 or by mail at 2305 Broadway, Boulder, CO, 80304. Mr. Dubois has just got on the Internet and is still learning how to use it. Donated funds will be kept in a trust account, and all contributions will be accounted for. If this whole thing somehow goes away with money left in the account, the balance will be refunded to contributors in proportion to the amounts of their contributions.