NetNews Usenet Archive 1992 #27/NN_1992_27.iso/spool/sci/crypt/5093

Text File | 1992-11-20 | 9.0 KB | 193 lines

Newsgroups: sci.crypt
Path: sparky!uunet!newsgate.watson.ibm.com!yktnews!admin!wo0z!lwloen
From: [e-mail] (Larry Loen)
Subject: Political Arguments for Private Crypto
Sender: [e-mail]
Message-ID: <[e-mail]>
Date: Fri, 20 Nov 1992 20:24:21 GMT
Reply-To: [e-mail]
Disclaimer: This posting represents the poster's views, not necessarily those of IBM
Nntp-Posting-Host: wo0z.rchland.ibm.com
Organization: IBM Rochester
Lines: 179

Until there is a sci.crypt.politics, here is my summary of arguments
to help us keep crypto legal.

The basic argument against crypto is based on alleged abuse by
criminals.  However, this really boils down to the fact that most
folks aren't familiar with crypto and so things seem worse than they
really are.

Defense 1.
If people see the arguments couched in terms of the many
familiar technologies that they use every day, they will see through
the illogic.

Thus, if one argues that an encrypted file can shield a child molester,
then point out that a match lit against a paper copy can also shield
a child molester.  Drug dealers burn their records all the time.  Shall
we outlaw matches?  What's the difference?

Or, if that's too simple minded, what about a deleted file?  If one can
encrypt a file, one can also delete it.  Shall we pass a law requiring
us to archive all plaintext files with the government, just in case the
file furthers a conspiracy?

Moreover, our examples have focussed far too much on the "warrant" case.
What the government really wants is to be able to do the equivalent of
wire-tapping.  They want to see every conversation flowing over every
switched (or leased) line in the United States if they wish, without our
knowledge.  If they are really serious, there is no serious difference
between what they are asking for and asking for the right to open every
first class letter in the United States.  I think we can get attention
if the argument is couched in those terms.

Defense 2.
Innocent people will be harmed.

An encrypted file can be indistinguishable from a mere garbage file.
Suppose some bit of software produces a garbage file.  The police grab
an alleged felon's computer.  Some files (or, worse, the free space
list) is seen to have what the police officer claims is an encrypted
file.  Now, never mind for a moment if the felon is guilty or innocent
of something else.

Suppose that the police officer is mistaken; it is very easy
to do.  How can the person free themselves from the _false_ charge?
And, what does it mean to the average citizen's freedom if that turns
out to be the _only_ charge that can be proved?

The answer is:  you can't.  It is not just to convict anyone simply
because a cop has an opinion that garbage isn't garbage.  And, point
out that this can happen to completely innocent people, too.

Defense 3.
Privacy.

Suppose you has controversial ideas.  Suppose they are encrypted.  Suppose,
further, that the government suspects this and hates your ideas.  They manage
to get a search warrant for some petty misdemeanor.  They claim your
encrypted files aren't about protected political ideas; they are in
furtherance of some petty crime they claim you've committed.  You now
choose between going to jail and having the cops peruse (and unfairly
leak to the press) your incomplete and controversial ideas for public ridicule.

Or, how about this?  You and your friend bandy those same ideas around.
But, the government taps your line, decrypts your conversation, and
selectively leaks it to the press, who may not care how it was obtained?
(In Minnesota, even though illegal to do under Federal Law,
someone managed to tape a cellular phone conversation that was politically
embarassing; the conversation went through several "cells", so it was clearly
a premeditated act.  The conversation was the source of a big story.
Why do we think this would not be abused?).

Suppose you've seen a psychiatrist or a minister for counselling.
Suppose the President forms a
"Plumber's" unit which hires a few loose screws to
paw through the files of that psychiatrist.  They may be looking to
publically humiliate you; they may be looking to publically humiliate
someone else and find you.  At this point, we can go beyond hypothetical,
we can give actual names.  Like Daniel Elsberg and his psychiatrist.

Suppose you've done something legal, but painful.  Perhaps you are a woman who
was raped by her uncle at 15 and were pressured by your parents to get an
abortion and could not practically refuse.  Years later, you try and decide
if you did the right thing.  About whether you could have lived on the street
or gone on welfare (which would have happened since your parents said they'd
disown you if you kept the baby).

You agonize at length about it on
your computer, encrypting the files.  Your husband does not even
know this history and you sure don't want your kids to know.
Meanwhile, the cops show up to arrest your husband on some offense.
He claims those files are yours.  They don't believe him; they claim
the files are his.  They demand the right to see them.

We can endlessly multiply these three classes of examples.  I think we can
get to plenty that John Q. Citizen can identify with.  And, please notice
that we can cite real examples in the non-crypto cases.

Defense 4.
Demand the numbers

Before the cops outlaw any technology on grounds of abuse, the first question
we should ask is "how often"?

How often do cops encounter encrypted files?  (Crooks are lazy; crooks would
rather commit things to memory anyway).

How often do they fail to get a conviction because of an unpenetrated,
encrypted file (most people don't study cryptology seriously and the
invent something easily solved)?

How often does a criminal investigation _start_ with an encrypted file?
(recall that wiretapping is justified, in part, on the idea that some
investigations must start with the telephone.  By contrast, an encrypted
file would ordinarily be at the end of the chain of evidence).

What are fair and appropriate penalties?  Are they great enough to be
worth the bother?  If not, why are we selling out our privacy to the
cops?  Conversely, if they are great, will we turn petty thieves into
felons needlessly?  And, why is a great penalty justified.  In itself,
the deed hurt no one.

What do we do with people who forget their cipher keys?  Every book
tells people to memorize keys and not write them down.  And, real
people really forget keys.  How can we tell those who are hysterically
intimidated from the criminal justice process or just plain forget from
those shrewdies who merely claim not to remember?

Defense 5
Talk about expansion

Can the government define _and limit the definition of_ an encryption system?
Will they claim that any data compression mechanism is an encryption?  Can
we really be sure the imagination of a prosecutor can be limited?

Will they demand that "objects" in an object-oriented programming system
that are stored in binary form be revealed and "cracked" at will?  Remember,
the government is eager to do the reading _secretly_, not just after getting
a court order to search your apartment for encrypted files.

Can the government slow or stop the introduction of new modems or new
programming technologies unless and until we put in an arbitrary number
of trap-doors so the government can read whatever data it wants?  If we
do, will Japan or Europe win the software and hardware war?  Will we be
unable to import advanced software because the overseas supplier refuses
to accommodate the Justice Department's yen for nosiness?

Defense 6
Is it really feasible?

If the goal is really to continue wiretaps, or expand what is wiretappable,
does it work?  Will we have to give gut-level detailed information about
every major advance to the cops?  Will it have to have the added labor
(and, performance or even feasibility penalties) so that cops can know
"Oh, this is a Borland C++ object coming; I know how to "read" it now).

Remember, we have a lot of software out there that is one, or two, or three
steps away from the enabling technology.  And, the executable that created
the data may no longer be available anyway.  This is true even for the
"warrant" case.  Shall it be a crime to delete 1-2-3 from your system?
To forget someone installed it and used it on a file you never knew you had,
but the cops claim furthers a criminal conspiracy?

Will the cops themselves not drown under a mountain of design specifications?

Overall

The basic strategy is to show that the gains are marginal and the costs
and threats of abuse are very real.  That's how any number of laws
have been beaten.  Certain arms of government have continuously and will
continue to try and get us to voluntarily give up our privacy and our
freedom so they can catch a few more crooks or find a few more spies.

All we need to do is get the privacy arguments removed from the technology so we
can see the freedom and privacy issues inherent in the discussion.  Once we
do, we will win.

--
   Larry W. Loen        |  My Opinions are decidedly my own, so please
                        |  do not attribute them to my employer