- cypherpunks - lists.cpunks.org

Privacy Respecting Laptops
by Alfie John 20 Sep '15

20 Sep '15

Just saw these this morning: https://www.crowdsupply.com/purism https://puri.sm/ Although a physical switch to kill the webcam and mic seems obvious, this is the first laptop I've seen with them built in. Overall thoughts? Alfie -- Alfie John alfiej(a)fastmail.fm

11 15

Why libressl-2.2.3 and openssl-1.0.1p accept very weak elliptic curves?
by Georgi Guninski 20 Sep '15

20 Sep '15

Summary: libressl-2.2.3 and openssl-1.0.1p appear to accept elliptic curves which might be broken by Pollard's rho DL in O(2^56) or O(2^82) group operations Pollard's rho DL algorithm [1] solves discrete logarithm in O(\sqrt{n}) where n is the group order. Equivalently the complexity is O(2^{(log_2{n})/2}). Both libressl-2.2.3 and openssl-1.0.1p have curves with log_2{n}=112 and NIST curve with log_2{n}=163. Assuming Pollard's rho succeeds, the complexity is O(2^56) and O(2^82) group operations. The first is close to real time on ``nice hardware''. To reproduce: $ ~/inst/openssl-1.0.1p/apps/openssl ecparam -list_curves secp112r1 : SECG/WTLS curve over a 112 bit prime field sect163k1 : NIST/SECG/WTLS curve over a 163 bit binary field $ ~/inst/libressl-2.2.3/apps/openssl ecparam -list_curves|grep -i ' 1' secp112r1 : SECG/WTLS curve over a 112 bit prime field sect163k1 : NIST/SECG/WTLS curve over a 163 bit binary field For reference, http://comments.gmane.org/gmane.comp.security.cypherpunks/6101 Bitcoin networks surpasses 2^80 hashes per week I believe in an Edward model of EC, the group operation on the EC isn't much slower than Bitcoin SHA hash, so someone with such resources might break ...2r1 in nearly real time and ...3k1 in few weeks. This resembles the ``DSA oddity'' of _forcing_ q as low as 160 bits, giving the same level (to ...3k1) of security compared to DSA as shown at [2], search for "160" [1]: https://en.wikipedia.org/w/index.php?title=Pollard%27s_rho_algorithm_for_lo… [2]: https://j.ludost.net/blog/archives/2015/09/05/rfc-2631_fips_186-3_and_opens…

1 0

Hackers Convention, Parallel Polis Congress 2-4.10.2015 in Prague
by wirelesswarrior＠Safe-mail.net 20 Sep '15

20 Sep '15

I am scheduled to speak there on Sunday October 4th http://hcpp.cz/eng/

1 0

The tricky encryption that could stump quantum computers
by Ben Mezger 20 Sep '15

20 Sep '15

http://www.wired.com/2015/09/tricky-encryption-stump-quantum-computers/ + https://docbox.etsi.org/Workshop/2014/201410_CRYPTO/S07_Systems_and_Attacks… http://www.etsi.org/news-events/news/947-2015-03-news-etsi-launches-quantum… https://www.nsa.gov/ia/programs/suiteb_cryptography/ -- Sent with my mu4e

1 0

Re: Darryl W. Perry Calls for Ross Ulbrich to be Pardoned.
by wirelesswarrior＠Safe-mail.net 19 Sep '15

19 Sep '15

Lyn Ulbrich, Ross' mom, will be speaking at the Prague Hacker's Conference in early October http://hcpp.cz/eng/#section2 -------- Original Message -------- From: jim bell <jdb10987(a)yahoo.com> Apparently from: cypherpunks-bounces(a)cpunks.org To: Cpunks List <cypherpunks(a)cpunks.org> Subject: Darryl W. Perry Calls for Ross Ulbrich to be Pardoned. Date: Fri, 29 May 2015 19:20:42 +0000 (UTC) > > > > From: http://www.independentpoliticalreport.com/2015/05/darryl-w-perry-calls-for-… > > > > > Darryl W. Perry Calls for Ross Ulbricht to Be Pardoned > > > Ross Ulbricht > > From Darryl W. Perry’s 2016 presidential campaign website: > > In 2013 Ross Ulbricht was arrested for allegedly operating the black market website Silk Road. In early 2015 he was found convicted in what was essentially a kangaroo trial, where his attorney was prevented from presenting evidence of government corruption in the case, because of an ongoing investigation. Two of the federal agents investigating the case have since been arrested for fraud and money laundering. > Ulbricht’s lead defense attorney Joshua Dratel wrote in a court filing, “In contrast to the government’s portrayal of the Silk Road web site as a more dangerous version of a traditional drug marketplace, in fact the Silk Road web site was in many respects the most responsible such marketplace in history, and consciously and deliberately included recognized harm reduction measures, including access to physician counseling. In addition, transactions on the Silk Road web site were significantly safer than traditional illegal drug purchases, and included quality control and accountability features that made purchasers substantially safer than they were when purchasing drugs in a conventional manner.” > Meghan Ralston, a former harm reduction manager for the Drug Policy Alliance says Silk Roadwas “a peaceable alternative to the often deadly violence so commonly associated with the global drug war, and street drug transactions, in particular.” > Despite the improprieties in the investigation and the trial, and despite the fact that Ross Ulbricht actually made the black market safer, he will be in prison for a minimum of 20 years. The Ulbricht family has said they plan to appeal the conviction, however they shouldn’t need to do so. Ross Ulbricht should be pardoned, as should all non-violent drug offenders! > [end of quote] > > > > > > > > >

2 1

Fwd: Waking up
by Zenaan Harkness 19 Sep '15

19 Sep '15

Here's the full (20min, 60MB interview) youtube link from the bottom of the article below, which is kind of needed since then you can hear the full interview (the questioner and the other side): https://www.youtube.com/watch?v=KmQw6CryE9M USAGov/CIA lies - back then (August 2013) as we see in this interview team USA was saying 'We don't want regime change - we just want a limited (100 frigate-based missiles) strike against key Syria targets to send a message that chemical warfare is not ok', whilst: a) the leaked emails from a few days before the interview already showed that it was not Assad government, but 'terrorist' chemical warfare actions (not Assad govt) which also were a false flag done by CIA, and b) today we see team USA saying 'Assad must go, regime change is required to protect human rights' So team USA says what it wants, when it wants, in order to fuel more war, which in turn funds Lockheed, Raytheon etc. See here: http://www.usatoday.com/story/money/business/2013/03/10/10-companies-profit… "The business of war is profitable. In 2011, the 100 largest contractors sold $410 billion in arms and military services. Just 10 of those companies sold over $208 billion... These companies have benefited tremendously from the growth in military spending in the U.S., ... in 2000 $312 billion ... 2011 $712 billion ... #1 Lockheed Martin notched $36.3 billion in sales in 2011 " Them missiles are expensive, highly profitable. Zenaan ---------- Forwarded message ---------- Date: Thu, 17 Sep 2015 11:53:46 +0000 Subject: Fwd: Waking up Subject: Waking up http://beforeitsnews.com/alternative/2015/09/must-watch-ex-marine-goes-craz… "Ken O’ Keefe is a former US Marine turned anti-war campaigner who appeared on a Press TV debate called Syria: War of Deception, and absolutely owned his opponent in such an awesome way that you’ll be cheering at his every comment. Recorded in August 2013, this interview is now two years old, but in light of the current European refugee crisis it’s more relevant today than ever before. Passionate, articulate and knowledgeable about the subject matter, O’Keefe is the perfect guy to step up and tell these home truths...

4 4

How much/what hardware does the rowhammer DRAM bug affects?
by Georgi Guninski 19 Sep '15

19 Sep '15

This is old, but haven't seen it here. https://googleprojectzero.blogspot.com/2015/03/exploiting-dram-rowhammer-bu… --- Rowhammer” is a problem with some recent DRAM devices in which repeatedly accessing a row of memory can cause bit flips in adjacent rows. It was able to use this to gain write access to its own page table, and hence gain read-write access to all of physical memory. --- There is POC. Variant via javascript: https://github.com/IAIK/rowhammerjs How much/what hardware does this bug affect?

6 22

Re: Microsoft has developed its own Linux. Repeat. Microsoft has developed its own Linux • The Register
by Zenaan Harkness 19 Sep '15

19 Sep '15

On 9/18/15, Robin wrote: > On 18 September 2015 at 16:02, Dave wrote: >> It must be getting a bit chilly down in Hell right now... >> >> http://www.theregister.co.uk/2015/09/18/microsoft_has_developed_its_own_lin… >> >> ...And I see some porcine figures out on the tarmac... > > Oh, and there's Jesus on a pogo stick ... Lucifer just rang his broker demanding a massive short position in Fujitsu Air conditioning, but the picosecond high frequency "liquidity" traders saw the bid and pre-seized all options causing St Peter to chuckle from the perly gates which manifested as a thunderstorm never seen before and lightening from New Zealand all the way to Hades. Lucifer of course figured "well, it might not be molten sodium but a little back to the future is better than nothing I guess," but just then she realised that the news article prompting all these escapades had caused exactly six-nines of all humans to laugh at exactly the same moment and with that the lightning didn't stop before Lucifer's throne, instead slicing her clean in two. As the two Lucifer halves started an eternal fist fight over which would get to mount the other half first, at that moment even God chuckled and the universe accidentally en...

1 0

Re: Fwd: Do ethnic Germans have the right to racial and cultural strength? - was Re: At a Berlin church, Muslim refugees converting in droves.
by Zenaan Harkness 19 Sep '15

19 Sep '15

On 9/10/15, C wrote: > In the face of genetics, which reveals that inter-german variability far > outstrips the genetic basis of what we define as "race", I'd like to see > you define "Ethnicity" meaningfully. What does that matter to the essence of the question? The fundamental question is the same, whatever words we use. A rose is a rose by any other name. Perhaps we could ask "currently franchised (those who may vote) Germans" - the point is, do those who are presently gathered in a current physical 'locality' have the right to protect their current racial/ genetic/ demographic/ cultural/ political/ religious "mix", whatever it is, against dilution from immigration, asylum, "democratic" coup (e.g. Ukraine today) or religious missionaries of any faith? The opium wars in China suggest that trying to infiltrate ones religion into a 'foreign' nation may not be altogether appreciated by the locals - and Islamic Muslims are pretty vehement about this too from what I hear - why shouldn't predominantly Christian (or atheistic, or ...) nations be similarly intolerant to a diluting influx of those of different think? > This is equally topical to the Conch Republic; as others visit and > settle on their soil, how do they defend their innate Conch-ness > ethnicity from outside dilution? I demand answers. Well yes, about a day after the email starting this thread, I sent a similar one modified appropriately for Australians as an on-topic reply to another email about Australia's increase in "Syrian refugees" now also to occur here - but I figured for the purposes of this list that one version of essentially the same email was probably enough :) --- So do we citizens of [pick your nation] have the right to protect the status quo within our nation, to protect it against dilution from immigration or asylum, or must we allow the attractions that our nation presents to would be immigrants (whatever arises in their mind in this regard) to be enough of a test for immigration/ asylum? I.e., do the current locals of Germany/Australia/Hungary/Italy/Greece/Conch Replubic, have a "valid right" to object to their politicians "throwing the doors wide open", as Austria and Germany have recently done? You don't have to be Nazi, to want your racial and cultural strength, however you define that thank you you're welcome. Regards Zenaan

4 5

Fwd: [Cryptography] WashPo: Leaked NSC Memo on Encryption
by grarpamp 18 Sep '15

18 Sep '15

---------- Forwarded message ---------- From: Henry Baker <hbaker1(a)pipeline.com> Date: Wed, Sep 16, 2015 at 8:38 PM Subject: [Cryptography] WashPo: Leaked NSC Memo on Encryption To: cryptography(a)metzdowd.com FYI -- This is my OCR'd version of the National Security Council memo leaked to the Washington Post and available at the link below. The pdf of the original looks like it was typed on a *manual* typewriter -- the NSC clearly following the lead of Russia to avoid being intercepted electronically! [The irony of the NSC using a manual typewriter for a memo on encryption is truly delicious!] http://www.theguardian.com/world/2013/jul/11/russia-reverts-paper-nsa-leaks The most distressing part of this memo is its obscene disregard for the Constitution. The only "stakeholders" -- according to this NSC memo -- in favor of "civil liberties" and "human rights" seem to be organizations -- e.g., the EFF and the ACLU; ordinary citizens are apparently not "stakeholders", and have no "stake" in this discussion. Of course, every time someone uses the term "stakeholder", the only images that come to mind are those scenes from black-and-white horror movies in which the townspeople are chasing a vampire with wooden stakes that they intend to drive through his heart! http://apps.washingtonpost.com/g/documents/national/read-the-nsc-draft-opti… REVIEW OF STRATEGIC APPROACHES Option 1: Disavow Legislation and Other Compulsory Actions Engagement Strategy and timeline Z September: Outreach to foreign allies to signal our strong resistance to efforts to compel access; outreach to U.S. industry, the technology community, and civil society to coordinate messaging; attempt to convince other allies to come out with a similar statement at the same time. Z October: The President issues a statement strongly disavowing legislation or other efforts to compel access and calling on U.S. industry to resist efforts by other nations to compel access; coordinated industry and civil society statements of support; coordinated foreign partner statements of agreement. Z November: Outreach to other governments to bring more allies in alignment with our position; outreach to U.S. industry to build voluntary cooperation in the absence of compulsion; host public discussions and debates on encryption policy with U.S. industry and foreign allies. Top Line Message Z The problem of criminals using strong encryption to frustrate law enforcement's information gathering is a real and growing problem but we have not found a secure, practical solution. Z People around the world rely on the security of U.S. products and services in their daily lives. Mandating the design of those systems to include known vulnerabilities makes all of us less safe and undermines trust in these digital services. Z It is critical that law enforcement be able to access the information that it needs to protect public safety and national security. We will continue to use all of the tools available to us lawfully to keep American citizens safe. Z Overall, the benefits to privacy, civil libertine, and cybersecurity gained from encryption outweigh the broader risks that would have been created by weakening encryption. Z Accordingly, the Administration will not seek legislation that compels providers to design their products to enable government access to encrypted information, even pursuant to lawful process. Z We expect that foreign governments will also take a hard look at this difficult issue, and hope that they will come to the same conclusion. We call on U.S. industry to resist efforts by other governments to mandate such access. Impact on Policy Equities Public Safety and National Security. In the near term, this approach would not provide any relief to law enforcement efforts to counter the increasing use of encryption by criminals, including terrorists. As a result, the public safety drawbacks would be significant, though the precise extent of the drawback versus other proposals is unclear because bad actors will increasingly be able to frustrate law enforcement efforts to access their communications through lawful process. This approach would remove technology companies' most consistent grievance with the Administration, which could improve cooperation across a range of important priorities on technology issues including, but not limited to, encryption. It may also foster better cooperation on information that is not encrypted and will not fracture the Internet products and services market which may also preserve better access to unencrypted information, thus aiding public safety/national security. Cybersecurity. Pro-encryption statements from the government could also encourage broader use of encryption, which would also benefit global cybersecurity. Further, because any new access point to encrypted data increases risk, eschewing mandated technical changes ensures the greatest technical security. At the same time, the increased use of encryption could stymie law enforcement's ability to investigate and prosecute cybercriminals, though the extent of this threat over any other option is unclear as sophisticated criminals will use inaccessible encryption. Economic Competitiveness. This approach could help undercut foreign competitors' criticisms that U.S. companies' products are instruments of U.S. mass surveillance, and would clearly differentiate U.S. policy from moves by China and others to mandate decryption. However, if other markets do not follow our lead, and instead demand access, it is more difficult to assess the impact of this approach. On the one hand, U.S. companies could be forced to avoid those markets or develop access solutions. On the other, the failure of some nations to follow the U.S. lead could bolster the reputation of the United States as a leading source of technically secure products and. services. Civil Liberties and Human Rights. Domestically, many privacy and civil liberties advocates would regard this approach as a significant step in defense of privacy and free expression around the world. If other nations follow our lead or companies successfully resist country demands, this approach could limit repressive regimes' willingness to demand access to encrypted information, which likely would help protect dissidents and other communities in danger of human rights violations. Likely Reaction of Key Stakeholders Industry and Civil Society. This sector would strongly support this approach. Other Governments. Likely to be divided. This position would contradict the stated policy of some allies (e.g., the United Kingdom, France, and the Netherlands) who argue that governments should not allow “safe spaces” for extremists. As a result, those allies could criticize the U.S. position as endangering the safety of their citizens. Other foreign partners that are strong advocates for free expression online and have not argued for government access to encrypted information (e.g., Germany and Estonia) are more likely to support this approach. Pros Z Some in industry have indicated that a strong statement disavowing legislation is a precondition to voluntary cooperation with the United States Government. Since the prospects of legislation are dim, this approach could help build cooperation without limiting broader policy options. Z Counters the narrative that the United States is seeking to expand its surveillance capability at the expense of cybersecurity, and could help repair trust in the United States Government and U.S. companies overseas. Z A strong statement from the United States could make it more difficult for authoritarian regimes to seek compulsory legislation, although working group participants are divided on whether adopting this approach would actually stop such calls. Z May weaken future calls for data localization since it will be harder for other countries to claim they are “protecting” their citizens' data from the United States. Z Could provide some positive benefit for U.S. negotiations on the U.S.-EU Data Protection and Privacy Agreement, Safe Harbor, and Transatlantic Trade and Investment Partnership. Z Is the strongest option for cybersecurity, economic competitiveness and civil liberties and human rights. Cons Z This approach provides no immediate solution to the challenges that the expanding use of encryption poses to law enforcement and national security today and is the weakest option from that perspective. Z Some working group participants argue this approach would remove a key point of leverage -- the threat of legislation in our negotiations with industry (although few, if any, in industry likely find this threat to be credible). Z U.S. providers have not indicated they would be willing to voluntarily modify their systems to enable law enforcement access to encrypted information, even if the government were to eschew legislation, and could result in the United States being isolated in its position. Option 2: Defer on Legislation and Other Compulsory Actions This option could be pursued with two distinct goals in mind. Under option 2(a), the Administration would seek industry's voluntary assistance to modify their technology to address law enforcement's concerns. Under option 2(b), the Administration would accept the current status quo and not seek technical modifications, but would still ask providers to assist law enforcement in any way that they can within their current technological framework. In either case, these calls for assistance could be done publicly or privately, depending on the preferred engagement framework. Engagement Strategy and Timeline Z September: Outreach to foreign allies to assess their positions; signal to allies that the United States does not think legislation is the right way forward at this time; work with other governments to identify voluntary action by industry that would help to mitigate their concerns; outreach to U.S. industry to coordinate messaging. Z October: The President issues a statement disavowing legislation, but acknowledges the serious challenges posed by encryption for public safety and national security; secure coordinated statements of support or agreement from industry, civil society, and partner nations. Z October-November: Outreach to foreign allies in the wake of the statement to bring more allies in alignment with our position; outreach to U.S. industry to build voluntary cooperation in the absence of compulsion; if some allies persist in demanding access, consider whether the United States Government should highlight the difference in positions and the U.S. emphasis on privacy-protections. Z Post-November: Host public discussions on encryption policy with U.S. industry and foreign allies; should foreign allies demand and secure access, consider whether to call upon U.S. industry to provide the same access to the United States Government. Top Line Message Z The United States is not seeking legislation at this time to compel providers to change their products to enable government access to encrypted information pursuant to lawful process. Z At this point, legislation appears neither feasible or easily draftable. We need considerable public discussion before we would be in position to contemplate a legislative solution. Z However, we also cannot ignore the barriers that inaccessible encryption can create to law enforcement's critical need to investigate and prosecute criminals, including terrorists -- and the threat these barriers create for public safety. Impact on Policy Equities Public Safety and National Security. Does not reverse the long- term trend of increasing use of encrypted technologies by criminals, but could open potential avenues for cooperation with industry, without removing all law enforcement leverage (although working group participants disagree on whether calling for legislation will provide meaningful leverage). Some working group participants, however, have indicated they think it unlikely that industry will be willing to voluntarily modify their technology -- even if the threat of legislation is removed. This suggests that Option 2(a), in which the Administration would seek such technical modifications, is unlikely to succeed. However, unlike option 1, it retains flexibility on the approach should the public safety picture deteriorate to overtake competing equities. This approach would also make compromise with foreign governments not currently seeking legislation easier, but would still provide some help in resisting attempts by governments like China to use encryption policies to skew markets or oppress citizens by retaining strong public statements (e.g., “will not seek legislation”). Cybersecurity. Could encourage the use of more encryption, which would likely be good for cybersecurity. If a statement under this approach is perceived as positive but not sufficiently strong, however, this could be less successful in forestalling other nations from pursuing encryption-weakening measures. Also, because any access point to encrypted data increases risk, if government efforts to secure access are successful, this approach would reduce cybersecurity. However, the degree of impact on cybersecurity would vary significantly, and could be great or small, depending on the specific policy and technical decisions. Economic Competitiveness. Could have a positive, though incomplete, effect in removing barriers to Administration engagement with the tech sector on this issue. Removing the prospect of United States Government calls for legislation would likely have positive effects on international competitiveness. If long-term successful in gaining government access, this option would significantly harm economic competitiveness though the harm might be somewhat mitigated if there was broad international success in getting government access. Civil Liberties and Human Rights. Some will be dissatisfied with lack of outright disavowal, but may appreciate the pragmatic recognition of the practical limitations of a mandated approach. However, others almost certainly will continue to have concerns about government access to encrypted information being used to suppress dissident populations. Should some companies cooperate voluntarily and enable government access, the United States Government will need to accept that other nations -- including some repressive ones -- will use this access as well. Likely Reaction of Key Stakeholders Industry and Civil Society. Although industry and civil society may be less positive to this approach than a hardline disavowal, those communities would likely see this outcome as a solid win. However, further government pressure on industry to build access into their products would likely generate negative reactions. Therefore, it is likely that Industry and Civil Society would have a much better reaction to Option 2(b), which does not seek technical modifications, than to Option 2(a), which does. Other Governments. Allied governments that prefer an access regime may push back on the core U.S. message. However, those governments likely would react more positively to this approach than a complete disavowal of government access to encrypted information. Pros Z Responds to a key ask from industry, although industry might prefer a stronger statement. To the extent that industry is satisfied with the strength of the statement, this approach could help build cooperation without limiting broader policy options. Z Could help counter the narrative that the United States is seeking to expand its surveillance capability, and help repair trust in the United States and U.S. companies overseas. Z Could allow the United States to serve as a broker between pro-access allies (e.g., United Kingdom, France, and the Netherlands), and U.S. industry, which could mitigate some demands from foreign partners and ensure U.S. companies do not have to build multiple access regimes. Z If long-term successful in gaining government access, this option would help public safety and national security. Cons Z Could lead to disparate approaches by governments to the encryption issue, leading to more or different compliance regimes that U.S. companies will need to comply with, which could have a negative effect on their economic competitiveness. Z Does not provide an immediate solution to the challenges that the expanding use of encryption poses to law enforcement. Without a disavowal of legislation, many U.S. technology companies in the long term likely will not pursue voluntary design changes in products and services to enable access for law enforcement. Z If long-term successful in gaining government access, this option would harm cybersecurity, economic competitiveness and civil liberties and human rights. Option 3: Remain Undecided on Legislation or Other Compulsory Actions Engagement Strategy and Timeline Z September: Outreach to foreign allies to assess their positions; Private outreach to key industry leaders to argue that we need a more fulsome policy discussion before we decide how to proceed. Z October: Organize or participate in closed-door, small group discussions with U.S. industry to facilitate a more in-depth policy discussion. At the same time, organize bilateral and multilateral conversations with foreign partners to discuss the challenges and how to proceed. Z November: High-level Administration statement highlights initial discussions, outlines key challenges, distills a few key questions and principals, and announces a meeting or series of meetings (potentially both domestic and international) to discuss and debate these key questions. Z December: After the discussions, reassess our position and determine whether to take a position on encryption legislation or to continue to call for discussion. Top Line Message Z The President has said that there is no situation in which you wouldn't want strong encryption. Z At the same time, there are situations in which the government cannot obtain information related to a specific potential national security threat. If there is not a way of accessing that information and protecting the American public, then the Administration believes need to have a public debate. Z Having a broad discussion about this is essential -- over the next several months, [we or several entities] will host discussions on the challenges posed by encryption and how we can best address them. I would urge everyone to participate. Impact on Policy Equities Public Safety and National Security. This approach has, to date, failed to incentivize cooperation with law enforcement. It could in the long-term sway public opinion to create greater responsiveness -- particularly while the government retains the leverage resulting from the threat of legislation. On the other hand, silence on our part could encourage foreign governments to control the agenda. They might pressure U.S. industry to provide lawful access, which, if successful, would make it easier for us to require similar accommodations. This approach could also encourage companies to continue to aggressively pursue developing inaccessible encrypted services, and could make future cooperation significantly more challenging. Therefore, it is hard to predict the impact that this approach would have on public safety. Cybersecurity. Although it would not actively conflict with our message on the importance of encryption to cybersecurity, the uncertainty of public perceptions about the government's position could perpetuate distrust in encryption technologies related to the United States Government, and could undermine the effectiveness of the National Institute of Standards and Technology and other entities at a time when our cybersecurity agenda is already at risk. If long-term successful in gaining government access, this option would harm cybersecurity. - Economic Competitiveness. This approach does little to counter current distrust of the government by industry or foreign competitors. Further, by not taking a position on legislation in either direction, this approach does little to shape the reactions of other governments, increasing the risk that they will splinter into multiple camps, presenting U.S. industry with fractured markets. Therefore, this approach is likely harmful for economic competitiveness. Civil Liberties and Human Rights. Because this approach would likely not stop -- and could encourage -- other nations from demanding access, it is likely harmful for the Administration's efforts on civil liberties. Likely Reaction of Key Stakeholders Industry/Civil Society. Will likely continue to strongly object until the United States Government explicitly eschews compulsory legislation. As time passes, if we continue to fail to take a position, industry and civil society positions will likely harden as people perceive our silence as an implicit endorsement of legislation. As a result, the United States Government risks losing credibility if it fails to participate robustly in a public debate and with a unified voice. There is also a risk that industry chooses not to participate in meetings on the subject and escalates lobbying and public relations efforts. Other Governments. Allied governments that seek access will prefer this approach to either of the approaches that come out against compulsory legislation, and will likely see this as an opportunity for them to press for legislation themselves. Pros Z Provides flexibility to course correct and negotiate with U.S. industry and our foreign allies. Z Retains a key negotiating chip (the threat of legislation) in our engagement with industry (although few, if any, in industry find this threat credible). Z If other governments call for legislation and/or compel companies to change their encryption solutions to enable better access in the meantime, this could provide us with cover to use that same access. Cons Z Delays establishing a coherent Administration position, which could result in: (1) the United States being portrayed as increasingly ineffective/unable to resolve this challenge; (2) disputes among departments and agencies bleeding out into public discussion; (3) U.S. industry continuing to have challenges operating overseas (although it is unclear that a pro-encryption statement would by itself address this challenge); and (4) public and foreign government positions may harden in the absence of an affirmative U.S. position, limiting our ability to influence the global debate. Z Does not provide an immediate solution to the challenges that the expanding use of encryption poses to law enforcement. Moreover, this approach does not resolve the current policy debate. The United States Government likely will be faced with this same discussion again in several months' time. _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography

2 1