NetNews Usenet Archive 1992 #27/NN_1992_27.iso/spool/sci/crypt/4897

Text File | 1992-11-17 | 14.6 KB | 272 lines

Newsgroups: sci.crypt
Path: sparky!uunet!charon.amdahl.com!pacbell.com!sgiblab!spool.mu.edu!agate!doc.ic.ac.uk!aixssc.uk.ibm.com!yktnews!admin!wo0z!lwloen
From: [e-mail] (Larry Loen)
Subject: Re: Demons and Ogres
Sender: [e-mail]
Message-ID: <[e-mail]>
Date: Tue, 17 Nov 1992 00:10:09 GMT
Reply-To: [e-mail]
Disclaimer: This posting represents the poster's views, not necessarily those of IBM
References: <[e-mail]> <[e-mail]>
Nntp-Posting-Host: wo0z.rchland.ibm.com
Organization: IBM Rochester
Lines: 257

In article [e-mail]> Terry Ritter writes:


>Presumably, by the terms "demons" etc., you refer (again without
> quoting, so I can only presume) to my presentation of the child
> molesting issue which started off the original thread (of which
> this is not a part).  (Alas, this is not the only possible
> interpretation.)  As I have explained many times, my intent was
> to demonstrate that *at least some* real law enforcement concerns
> *do* exist with respect to the widespread use of real cryptography.
> Moreover, these concerns are completely separate and distinct from
> the discredited cold-war rhetoric of national security.

Sure, concerns do exist.  Law enforcement has some hard problems.
But, most of the Bill of Rights is _not there_ to make the job of
the cops easy; it is explicitly there to make it harder.  Back in
the good old days of the twelveth century, the cops got to torture
anyone who resisted.  Allowing people the right not to speak to the
cops is very inconvenient.  But, inconveniencing the cops is and
ought not be the sole criteria by which we run society.

> My proposal, which is only a talking point, was intended to show
> how real law-enforcement concerns with cryptography *could* be
> addressed under law with much less than the strict control which
> the government previously enjoyed and may wish to soon regain.
> Real concerns can be addressed in a way which is less onerous than
> prior key registration, since *that* would give the executive
> branch the power to snoop on conversations.  But addressing real
> concerns *could* require that courts have the "right" to breach
> secrecy *after* due process.

Again, why is it our duty to help the cops?  We do not necessarily
have the same interests as they.  For instance, there are a lot of
crimes that are pretty vague and nebulous.  The Wall Street Journal
had a fine article a while back about the currently "useful" crime
called "lying to congress".  It is not at all like perjury according
to this article; it is easy for the government to make the
claim that you lied after the fact by a lot of monday-morning quarterback
style analysis.  The courts slowly, but surely
throw out laws like this, but a lot of folks see jail time first.
And, yes, sometimes the courts forget to throw out the laws.  Nothing
is perfect.

If we are allowed private
cryptography (and, as important, to destroy private communication
before it is subpoenaed whether encrypted or not, something you
don't seem to consider, but has almost all of the same issues),
people can get on with their lives, try
out unsafe thoughts, realize it is probably illegal and unethical,
and then delete it all without going to jail for it.  If all of
my thoughts were available to the government, I'll bet they could
find some conspiracy law or other to put me away for.  It is very
easy to violate some of these laws.

> One thing I have not really addressed is this delusion that for
> some reason cryptography is "beyond government control."  Well,
> with respect to the development of cryptographic science, or other
> nations having strong cryptography, that is true.  It may be true
> for criminals.  But for ordinary citizens (that's us), it is
> definitely *not* true.  If the government regulates the public use
> of cryptography, you will comply or go to jail.  Simple as that.
> (Of course, nobody much cares what you do to your data in your home,
> or with your friends, unless there is a law-enforcement interest.)
> If you believe that there is no way any such law could be: a) passed,
> and  b) upheld in the courts, I have a bridge to sell you.

There's no delusion, here.  Use of cryptography by out-and-out
criminals _is_ beyond government control.  So, why is it that only
law abiding citizens are under the thumb of law enforcement and
only other governments and the mafia get to keep their secrets?
There's lots of thoughts I think that are merely embarassing.
Absent crypto, I keep them in my head.  With crypto, I get to put
them down, first.  Maybe, just maybe, that will let me develop
them and maybe, just maybe, what looked silly will actually move
society somewhere useful.  That happens a lot, after all.  Someone
gets an idea that is initially stupid or even considered "dangerous"
and then later looks indispensible.  Who knows who'll think up the next
one?  But also maybe, government will try and surpress it first.
It is not in _government's_ long term interest to surpress private
thought.  But, government on a day to day basis could care less about
the long run.  Haven't you heard of "thought crime?"  The idea is alive
and well and you seem bound and determined to help government
create and enforce it.

It is probably true that the government can detect my use of crypto
and throw me in jail.  That is a practical reality.  But, hey, no one
ever said that the First Amendment ever came free.  Almost every
freedom we enjoy has and will continue to have a few poor souls going
to jail for it.  Madonna makes millions on what others have spent
jail time defending.  You may not like what she does, but that's
the whole point of a First Amendment -- to protect folks against what the majority
and/or the cops do not like.  Cops don't like cryptography.  That
doesn't mean we have to assent to having the constitution dismantled,
step by step.  Cryptography, in itself, is value-neutral.  It can
protect sublime but minority religious ideas and hard-core pornographic GIFs.
Why should the cops be entitled to assume any encrypted communication
is the latter and not merely some idea I don't feel like revealing yet?

> I guess that some readers may exclaim, "But if crypto cannot be
> controlled for criminals, how could government justify controlling
> it for ordinary citizens?"  But the fact that criminals will *have*
> crypto (available) is hardly the same thing as saying that they can
> *use* crypto widely and publicly.  If use were illegal, any use in
> communications would draw attention to criminal activity.  Besides,
> does government really have to *justify* legislation.

Your argument is really the ancient, flawed, idea that some things are deep,
dark, secrets that we cannot even trust adults to possess.  "Some things
mankind is not meant to know".  Why, if the government cannot look over
our shoulders, we will all become instant criminals.  We might even
decide to stop voting for the current politicians and parties, which
would clearly be considered criminal by some in power.

Besides, you are technically flawed here.  An ordinary GIF or ZIP file
will be totally indistinguishable from an encrypted file if the
government wiretapping machine misses the first few bytes.  And, new
compression schemes are invented every day.  Do you propose that every
implementation of every computer program that compresses data be
registered?  There are lots and lots of programs whose output would
be indistinguishable from an encryption system.  Taken even halfway
seriously, almost any program I can think of would have to be registered with
the government.  Look inside a lot of data files.  You may not see much
ASCII or EBCDIC there.

Besides, I don't have to say the government must "justify" legislation,
the constitution does.  Abortion is legal, for better or worse, exactly
because the government has so far not been able to satisfy the Supreme
Court that it has a legitimate right to do restrict it.  It's an idea
called privacy and the idea the I have the right to be left alone.
In the case of crypto, we might be able to add the idea that the
government is not entitled to assume we are committing crimes merely
because we choose not to tell them what we're saying.  It
must do a fair amount of due-process before it gets to monitor us,
all independent of crypto.  Inconvenient for the cops, but that's
fine with me.  The jails are overflowing; they don't seem to need
much help.

> Now, as far as I can tell, what I am supposed to "answer" is how
> my proposal provides assistance to law-enforcement.  But here's
> the thing:  I've said it all here at least two or three times in
> the past couple of days.  If someone doesn't already know about
> this, they just aren't listening.  Of course, there was nothing
> there about "demons" or "monsters."


> Well, the problem is that cryptography can be used to hide the
> records which establish proof of crimes.  If bank fraud or
> embezzlement were hidden in this way, I doubt that anyone would
> be particularly sympathetic.  And as the society increases its
> dependence on data, the problem is going to get more dramatic.

The telephone can be used to conduct all sorts of conspiracies.
The government has won a limited right to listen in.  But, your
argument is something like we have to agree to record all of our
telephone conversations "just in case" the cops later need them
to justify their claim that we committed some crime or other.
Even if it were constitutional, such an idea would get nowhere
fast.  Even congress could see that one is dumb.  Everyone on this
net may well be using encryption over some link or other without
even knowing it.  Many companies encrypt data fairly routinely.  The
link between the user and the key is not straightforward already in
the real world.  Where did the transmission go?  What session keys
did the system generate for the users?

Your argument boils down to a fact I agree with, though.  People don't
really care for the constitution.  Most people don't even know
what their rights are, and they disagree with most of them on grounds
that they think that only those "other guys, the criminals" ever get
charged.  They have not ever faced a government with an army of
cops, smart lawyers, and (often, if one is doing something merely
unpopular and not truly harmful) and unsympathetic media.

That's why we have a written constitution in the first place.  Our
founding father's weren't dumb.  They knew all about witch hunts;
Europe and Salem, Mass had killed a lot of innocent women and a few
men because the people were ready to put up with any means to get
the "criminals".  Today, the witch hunt is the very symbol of abuse
of authority.  Why do you want to help usher in the next reign of
terror?  Why do you wish to help the government look over my
shoulder?

> My approach would be to require that anyone using cryptography
> be prepared to provide future access to enciphered information
> to a court under due process.  Failure to do so would be a crime.

But, I use cryptography every day and I DON'T CONTROL THE KEY.  My
company does the encryption for me.  So do lots of Bank Officers.
And, so on.  I would be convicted easily of your crime.

Our justice system used to be promolgated on the notion that we will
let lots of guilty folks go so that the innocent can live out their
lives in peace.  That's what is behind the Miranda warnings, the
exclusionary rule, and a host of other things that make folks mad
every time an axe murderer gets off because of them.  However, in a
society that is ever-quicker to politicize law (if you look, you'll
see lots and lots of thought-crimes out there), it is an important
safeguard that John Q. Ordinary needs.

Can the cops "get me" if they want?  Might they get laws of this kind
passed?  Maybe.  But, I feel under no obligation whatever to help them.


> The advantage which this would provide to law-enforcement is that
> criminals hiding evidence of their conduct could be convicted for
> "Failure to Disclose."  Indeed, such a conviction should be pretty
> quick and easy, and, since Justice always has a price, this may be
> a decent law enforcement alternative; much better, for example,
> than "Tax Evasion."  Since conviction on "Failure to Disclose"
> would also be easy to avoid (just reveal the key), it should not
> support much misuse.  Serious cases of accidental loss could be
> addressed by juries as usual, taking into account circumstances,
> background, etc.

In other words, if the government cannot prove a crime happened, they
can "get" you under some technicality or merely for not abjectly
disclosing to them every private thought you ever had.  I agree the
conviction is quick and easy.  Look at what they got Ollie North for.
You may not like him, but I think that the government spent millions
and effectively convicted him of spitting on the sidewalk.  Surely,
what they "got" him for had nothing whatever to do with why he was
originally investigated.  I don't frankly consider that a very good
use of government resources.  They can get us all, my friend, if we
allow that standard to continue.

>
> Clearly, I am suggesting that cryptography be considered *serious
> business*.  Those engaged in that business would be *responsible*
> for archiving keys against the day a court may need those keys.
> This, however, is not particularly different from the sort of
> record-keeping required in other serious businesses like banking.
> Consumer-oriented cryptosystems would also have to retain keys,
> and deactivation of this feature would again be "Failure to
> Disclose."

And I think that "Failure to Disclose", at least the way you describe
it, is just the sort of thing our government already has too much
ability to do and will without doubt lead to actual tyranny.  There
are lots of ideas that are today very popular that tomorrow will seem
as monsterous to convict for as witchcraft does today.  Challenging
them (the ones that are 'thoughtcrimes', I mean) will involve what
will be claimed by the authorities to be "conspiracies" or "violations
of someone else's civil rights" or "harassment" or something where
the violation need not and is not an actual person, but some abstract offence
against society in general or some politically priviledged group.

Does that mean that I may someday have to stick my neck out to keep
my rights?  Well, yes.  If I don't, I suppose one could argue that I
deserve to lose them.

Rights are not free.  They have to be fought for.  Why are you helping
the cops?  Why are you assuming they will win?  Why are you assuming
their interests and yours always coincide?  Or, do you really believe
that cryptography is inherently dangerous?

--
   Larry W. Loen        |  My Opinions are decidedly my own, so please
                        |  do not attribute them to my employer