NetNews Usenet Archive 1992 #27/NN_1992_27.iso/spool/sci/crypt/5191

Text File | 1992-11-22 | 5.7 KB | 117 lines

Newsgroups: sci.crypt
Path: sparky!uunet!cs.utexas.edu!torn!nott!cunews!csi.uottawa.ca!news
From: [e-mail] (Christopher Browne)
Subject: Re: PGP and real criminals
Message-ID: <[e-mail]>
Sender: [e-mail]
Nntp-Posting-Host: prgv
Organization: Dept. of Computer Science, University of Ottawa
References: <[e-mail]> <[e-mail]> <[e-mail]>
Date: Sun, 22 Nov 92 21:00:11 GMT
Lines: 104

In article <[e-mail]> [e-mail] writes:
>
>I guess this returns to the "is cryptography the gun of the information
>age" question I asked a while back.  Information is not just an intangible
>"essence", it is something we use to make decisions and to record our
>actions, and the means in which we use it will be subject to judgement by
>others.  In some cases the community/society may demand access to that
>information and, while it may take a decision by a judge or court to
>determine whether or not law enforcement officials may obtain access, when
>we create tools that make this task impossible it is a moral imperitive to
>examine the situations that have been discussed in this group recently.
>
>Secure cryptography carries a danger in that it may be used for purposes
>which we feel are immoral or unjustifiable.  By preventing access to
>information it may be used to hide things that a society/community feels it
>has a right to know.  It seems very easy for people to present straw-man
>arguments regarding the dangers we face from the evil government forces
>that are slinking around dark alleys in Washington waiting to impose the
>new fascist police state upon America, but it seems that very few people
>who present these arguments balance them by showing how thier right/need
>for this sort of information protection overrides any possible claim that
>might be made upon this information by the society/community of which they
>are members.

There's nothing that I have recorded on any of my various computer
media that are GREATLY private.  My personal privacy isn't of ALL that
much value - I haven't felt the need to actually use all of the rights
that I have - but that doesn't mean I want to have them taken away.

What if it is an actual question of economics?  If a banking system
depends on the fact that people don't know the decryption keys, and
thus can't introduce spurious transactions into the system, this
places "privacy" into the world of economics.

If "key registration" becomes mandatory, such things as "secure
signatures" and the likes, which could be of non-trivial economic
value, could be rendered impractical, and thus valueless.

Important as personal privacy may be, I would suggest that discussions
move more towards uses of cryptography that are of SPECIFIC value.
People will disagree on the value and importance of personal privacy;
arguments that have CLEARER costs and benefits may be helpful to
clarify the issues.

>I am interested in hearing answers to this question: Why is it necessary for
>citizens to have access to cryptography that prevents _any_ attempts at
>information retrieval by law enforcement agents (assuming they are acting
>on legitimate instructions from the court, or in other ways that society has
>determined to be valid through it's process of making laws and regulations) ?

Because the alternative may be to prevent all access to forms of
information retrieval that are HIGHLY regulated?

It is SO EASY to get access this sort of cryptography due to the power
of computers that nearly the only way to prevent cryptography would be
to prevent access to computers altogether.  The algorithms EXIST.  A
sufficient number of relatively unbreakable cyphers are READILY
AVAILABLE.  If you use PC-Secure (part of PC Tools) to encrypt your
files, probably only the NSA can break it.  And there's probably a
million copies of PC-Secure out there.

If it is virtually impossible to STOP people from using encryption,
which many people around sci.crypt would agree is true, this indicates
that encryption is virtually unregulatable.  It's going to be harder
to regulate encryption than it is to regulate narcotics, because the
DETECTION problem is somewhat more difficult.  Cocaine certainly has
some physical properties that are easy to detect; once you see the
cocaine, it's pretty clear that it's cocaine.  An encrypted file may
look like line noise.

>To further this discussion, perhaps we can try limiting this thread to the
>"real criminals" in the Subject line.  Those who have been convicted or, in
>the case of our "hypothetical example", who actually committed to crimes of
>which they are accused.  A tool may be used for many purposes, do not
>dismiss the immoral ones just because you may not use it in that fashion
>yourself.

The problem isn't all that dissimilar to the "problem" with cash.  I
gather that it has become illegal to carry large sums of cash in the
US, and the authorities are permitted to confiscate such cash, with no
recourse for the individual whose money it was.

The problem wasn't intrinsically with the carrying of cash; that's no
crime by itself.  The problem is that drug-dudes tend to work in cash,
and confiscating the cash was the only thing the LE types could come
up with.

It could be the same thing with crypto.  And by only discussing the
issue of LE, and ignoring other effects of specific regulations of
crypto, other things could be lost.

Privacy.

Opportunity to use new signature techniques.

And probably other things too.



--
Christopher Browne                |     PGP 2.0 key available
[e-mail]           |===================================
University of Ottawa              |  The Personal Computer:  Colt 45
Master of System Science Program  |  of the Information Frontier