NetNews Usenet Archive 1992 #27/NN_1992_27.iso/spool/sci/crypt/4943

Text File | 1992-11-17 | 10.3 KB | 167 lines

Newsgroups: sci.crypt
Path: sparky!uunet!charon.amdahl.com!pacbell.com!ames!saimiri.primate.wisc.edu!zaphod.mps.ohio-state.edu!swrinde!gatech!news.ans.net!newsgate.watson.ibm.com!yktnews!admin!wo0z!lwloen
From: [e-mail] (Larry Loen)
Subject: Re: Demons and Ogres
Sender: [e-mail]
Message-ID: <[e-mail]>
Date: Tue, 17 Nov 1992 20:08:39 GMT
Reply-To: [e-mail]
Disclaimer: This posting represents the poster's views, not necessarily those of IBM
References: <[e-mail]> <[e-mail]> <[e-mail]>
Nntp-Posting-Host: wo0z.rchland.ibm.com
Organization: IBM Rochester
Lines: 152

Terry, I won't try a blow-by-blow; too much bandwidth.  Let's try a
different tack and maybe a selective quote or two.

1.  Of course it is possible for cryptography to be abused.  So are
  handguns (pratically unregulated), automobiles (very lightly regulated)
  and a host of other technologies.  So what?  There aren't enough hours
  in the day to think of every law for every imaginable abuse.  The fact
  that some bureaucrat with time on his hands thought of one more is no
  reason to buckle under without even a wimper.

2.  Please come up with some concrete examples of actual use by the
  bad guys.  For that matter, demand them from the cops.  If you are looking
  for an antidote to the Fear/Uncertainty, etc., factor, the best way to go,
  historically, is to demand actual cases.  How many times has a criminal in
  this country "got off" because the FBI could not solve a cryptogram?  How
  many per year?  I'd be astounded if it was over two.  I suspect that even
  a congressman would be impressed by that.  We are chasing shadows and we
  should shine a little light on this issue.  Anyone got a database with
  all the congressman's names on it?  A few intelligent letters on this line
  may go a long way.  My uncle used to work for a congressman and they react
  both to organized form letters and also, once in a while, to a well-written
  letter from a couple of individuals.

3.  It is up to the _cops_ to justify any limits on technology.  At some point,
  it may become practical to compromise and come up with the least-harmful
  answer.  But, I believe your general plan compromises too much, too soon.
  I don't see that the cops and their friends have made a remotely persuasive
  case.  I don't know who is arguing the other side, but it would seem that
  we should start with the idea that we fight it first and then worry about
  any compromise.  Certainly, I see no reason to surrender to hypotheticals.

4.  We have not much discussed the "labelling" problem.  If the cops get the
  right to limit cryptography, count on them trying in the legislature and the
  courts, every year, to have an ever-more expansive definition of what a
  "cryptosystem" is.  If you follow the news at all, you will quickly realize
  that we will have the "catsup is a vegetable" syndrome in short order and
  soon just about anyone who authors a program anywhere will have to have their
  design document ready and available to the government for their perusal.

  After all, the premise is that the cops are finding it too hard to read things.
  Is there as serious difference between a cryptography system and someone's
  customized compression algorithm?  Or, someone's word processor that flips on
  the high order bit?  All the cops will know is that when they do a "type"
  at the DOS prompt, they can't read it.  They will demand to know how.  In
  some cases, it may be as easy as telling them what program to run.  But, what
  if the crook deletes the object code?  Do the cops come after the shareware
  author to get a copy?  To get a description of how to read it?  Will they
  try and make the author of PKZIP an "accessory" to some crime or other
  (say, creating an unregistered cryptosystem) simply because a criminal used
  the product?  Stranger things have happened.

  Ask anyone who uses DES, even for non-crypto purposes, what they have to
  go through today to export their product.  And then tell me that this isn't
  potentially very onerous.  And, that this scenario is not much more likely
  than private cryptography by a child molester or whatever.

5.  If the cops can, as I believe they can, already get a court order to
  force you to reveal your key, what more is needed?  There is no need for any
  new law whatever.  Contempt of court is basically an unlimited jail term,
  if the judge cares enough to enforce it as such.  True, some judges let those
  brave souls who persevere out, but only after a pretty heavy amount of time.

6.  The idea that the cops will not abuse this power flies in the face of
  things I have seen in my lifetime.  Remember Dr. Elseberg's psychiatrist?
  He had his office broken into.  He was not a criminal.  But, he _was_ a
  victim of the government mind-set that says they have a right to your most
  private and secret thoughts and it is up to _you_ to defend your right to
  privacy.  That is nonsense and tyranny.

7.  I am tired of the tired argument that "honest people have nothing to hide."
  Well, maybe there are a few people out there with not a single unconventional
  idea.  I am not one of them.  I have many private ideas that will look anything
  from seditious to just plain cuckoo to a lot of folks.  (Of course, the ideas
  such people put out in public look the same to me).  There have been plenty
  of cases where people's privacy was not respected.  Once your private ideas
  are put into newsprint, you can't retract them EVEN IF YOU ERASED THEM AS
  FOOLISH IDEAS YOURSELF THE FOLLOWING DAY.  The public forever brands you
  and associates you with such thoughts.  People act funny when something shows
  up in cold print.  They automatically assume the fellow was serious when, in
  fact, that individual was just speculating.

  And, you are too quickly dismissive of 'thought-crime'.  In St. Paul, we had
  a law against "hate crimes".  This was not a law designed to punish people
  for doing ill against a person.  This was a law designed to punish anyone who
  used certain symbols that are offensive to a particular group.  A foolish
  young punk burned a cross on a black family's lawn.  Now, I am all in favor
  of arresting the fellow for criminal tresspass, making terroristic threats,
  and probably half a dozen other laws that identify actual, real, undeniable
  harm _to the family involved_.  Throw him in jail, I say.  It could have and
  should have been done.

  Unfortunately, the prosecutor, in love with
  the new law, prosecuted him under the "hate crime" ordinance instead.  The
  Supreme Court, I am glad to say, threw it out.  But, there is probably a
  majority in this country who think we should have laws against "hate crimes".
  So far, all it has done is kept a punk out of jail who should be serving time
  under laws we already have.  But, who knows what the future will hold?
  The prosecutor is trying to dream one up that will pass consitutional muster.
  Politically, the idea is very popular and he personally thinks it is just fine.

  If such laws get enacted (and, they do from time to time; see the "Alien and
  Sedition Act" in your history books), one has the spectre of being under the
  gun for being convicted for your opinions, rather than your actual deeds.  It
  is an important distinction for society and one which I see getting lost.
  Couple that real-world trend with the all-too-real possibility of a government
  fishing expedition through your data sets and I see real threats to ordinary
  individuals whose only crime is thinking thoughts the majority doesn't like.
  I'm not talking about hypotheticals here.  I'm talking about the Elsberg's
  psychiatrist problem writ large.  Hysteria has happened.  Ask the Japanese
  Americans who are old enough.  And, I am not ready to roll over quite so
  quickly and put the infrastructure in place.  A practical protection, then and
  now, is that it is too hard for the government to collect our private thoughts.
  I see no need to make it easy, especially when I consider how illusory the
  benefit is going to be.

8.  I have not seen a compelling argument from anyone that cryptography poses
  a serious threat to anyone.  Where are the cases?  Why should we buckle under
  when the government wants to restrict our rights "just in case" someone,
  somewhere, somehow abuses it?  Under such a scheme, we'd never have any rights
  at all.  Generally, it is not in society's interest to
  pass laws "just in case".  It makes more sense to see actual problems develop
  before one adds burdensome regulations of any kind.  We already have the
  "basics" well covered after 200 years.  Of course, there are lots
  of otherwise idle folks in government who don't see it that way, but
  fortunately, congress is biased toward inaction in the face of conflict.  At
  the least, we should be able to get this whole issue out of the "might
  happens" into the "what actually has happened".

  Cryptography, after all, has
  been legal for 200 years.  DES has been available since at least the early
  seventies.  The republic has not fallen.  I've never heard of a single case
  where private cryptography stopped the government from doing anything it wants
  to do.  So, why buckle under "just in case"?

  I quite frankly do not want to have a state of affairs where it is easy for
  an abusive cop to go on fishing expeditions.  Maybe that wasn't your proposal;
  they all blur together after a while.  But, since I believe point 5 to be
  already true, I don't see why the cops need anything more and would like to
  see this group, if we do anything, frontally ask for the justification.

  Or, at worst, how about this?  No private individual is allowed to encrypt
  a voice conversation that is transmitted over a common carrier (and, under
  appropriate court order, the common carrier is obliged to decrypt, in any
  relevant sense, for the government)?  The cops seem mostly interested in not
  losing the important ability to wiretap.  We shouldn't have let them do that,
  but I don't see how, in practical terms, they need any more than this to restore
  the status quo ante and get 99% of all real life criminals who are already
  too lazy to use cryptography and always will be.

--
   Larry W. Loen        |  My Opinions are decidedly my own, so please
                        |  do not attribute them to my employer