🚀 go-pugleaf

=====================================================================
EFFector Online             JULY 29, 1992         Issue  3.1 / Part 2
         A Publication of the Electronic Frontier Foundation         
                           ISSN 1062-9424                            
=====================================================================

[Decrypting the Puzzle Palace by John Perry Barlow - continued - ]

Unable to get anyone presently employed by the NSA to comment on this or
any other matter and with little opportunity to assess the NSA's
congeniality toward domestic law enforcement from the inside, I
approached a couple of old hands for a highly distilled sample of
intelligence culture.

I called Admirals Stansfield Turner and Bobby Ray Inman. Not only had their
Carter administration positions as, respectively, CIA and NSA Directors,
endowed them with considerable experience in such matters, both are
generally regarded to be somewhat more sensitive to the limits of
democratic power than their successors. None of whom seemed likely to
return my calls anyway.

My phone conversations with Turner and Inman were amiable enough, but they
didn't ease my gathering sense that the NSA takes an active interest in
areas which are supposedly beyond its authorized field of scrutiny.

Turner started out by saying he was in no position to confirm or deny any
suspicions about direct NSA-FBI cooperation on encryption, but he didn't
think I was being exactly irrational in raising the question.  In fact, he
genially encouraged me to investigate the matter further.

He also said that while a sub rosa arrangement between the NSA and the
Department of Justice to compromise domestic encryption would be
"injudicious," he could think of no law, including FISA (which he helped
design), which would prevent it.

Most alarmingly, this gentleman who has written eloquently on the hazards
of surveillance in a democracy did not seem terribly concerned that our
digital shelters are being rendered permanently translucent by and to the
government.

He said, "A threat could develop...terrorism, narcotics, whatever...where
the public would be pleased that all electronic traffic was open to
decryption. You can't legislate something which forecloses the possibility
of meeting that kind of emergency."

Admiral Inman had even more enthusiasm for assertive governmental
supervision. Although he admitted no real knowledge of the events behind
the new cellular encryption standard, he wasn't the least disturbed to hear
that it might be flawed.

And, despite the fact that his responsibilities as NSA Director had been
restricted to foreign intelligence, he seemed a lot more comfortable
talking about threats on the home front.

"The Department of Justice," he began, "has a very legitimate worry.  The
major weapon against white collar crime has been the court-ordered wiretap.
If the criminal elements go to using a high quality cipher, the principal
defense against narcotics traffic is gone."  This didn't sound like a guy
who, were he still head of NSA, would rebuff FBI attempts to get a little
help from his agency.

He brushed off my concerns about the weakness of the cellular encryption
standard. "If all you're seeking is personal privacy, you can get that with
a very minimal amount of encipherment."

Well, I wondered, Privacy from whom?

And he seemed to regard real, virile encryption to be something rather like
a Saturday Night Special.  "My answer," he said, "would be legislation
which would make it a criminal offense to use encrypted communication to
conceal criminal activity."

Wouldn't that render all encrypted traffic automatically suspect? I asked.

"Well, he said, "you could have a registry of institutions which can
legally use ciphers. If you get somebody using one who isn't registered,
then you go after him."

You can have my encryption algorithm, I thought to myself, when you pry my
cold dead fingers from its private key.

It wasn't a big sample, but it was enough to gain a better appreciation of
the cultural climate of the intelligence community.  And these guys are the
liberals. What legal efficiencies might their Republican successors be
willing to employ to protect the American Way?

Without the comfortably familiar presence of the Soviets to hate and fear,
we can expect to see a sharp increase in over-rated bogeymen and virtual
states of emergency. This is already well under way. I think we can expect
our drifting and confused hardliners to burn the Reichstag repeatedly until
they have managed to extract from our induced alarm the sort of government
which makes them feel safe.

This process has been under way for some time. One sees it in the war on
terrorism, against which pursuit "no liberty is absolute," as Admiral
Turner put it. This, despite the fact that, during last year for which I
have a solid figure, 1987, only 7 Americans succumbed to terrorism.

You can also see it clearly under way in the War on Some Drugs. The Fourth
Amendment to the Constitution has largely disappeared in this civil war.
And among the people I spoke with, it seemed a common canon that drugs (by
which one does not mean Jim Beam, Marlboros, Folger's, or Halcion) were a
sufficient evil to merit the government's holding any more keys it felt the
need for.

One individual close to the committee said that at least some of the
aforementioned "spook wannabes" on the committee were "interested in weak
cellular encryption because they considered warrants not to be "practical"
when it came to pursuing drug dealers and other criminals using cellular
phones."

In a miscellaneously fearful America, where the people cry for shorter
chains and smaller cages, such privileges as secure personal communications
are increasingly regarded as expendable luxuries. As Whitfield Diffie put
it, "From the consistent way in which Americans seem to put security ahead
of freedom, I rather fear that most of them would prefer that all
electronic traffic was open to government decryption right now if they had
given it any thought."

In any event, while I found no proof of an NSA-FBI conspiracy to gut the
American cellular phone encryption standard, it seemed clear to me that
none was needed. The same results can be delivered by a cultural
"auto-conspiracy" between like-minded hardliners and cellular companies who
will care about privacy only when their customers do.

You don't have to be a hand-wringing libertarian like me to worry about the
domestic consequences of the NSA's encryption embargoes.  They are also, as
stated previously, bad for business, unless, of course, the business of
America is no longer business but, as sometimes seems the case these days,
crime control.

As Ron Rivest (the "R" in RSA) said to me, "We have the largest information
based economy in the world. We have lots of reasons for wanting to protect
information, and weakening our encryption systems for the convenience of
law enforcement doesn't serve the national interest."

But by early March, it had become clear that this supposedly business-
oriented administration had made a clear choice to favor cops over commerce
even if the costs to the American economy were to become extremely high.

A sense of White House seriousness in this regard could be taken from their
response to the first serious effort by Congress to bring the NSA to task
for its encryption embargoes. Rep. Mel Levine (D-Calif.)  proposed an
amendment to the Export Administration Act to transfer mass market software
controls to the Commerce Department, which would relax the rules. The
administration responded by saying that they would veto the entire bill if
the Levine amendment remained attached to it.

Even though it appeared the NSA had little to fear from Congress, the
Levine amendment may have been part of what placed the agency in a
bargaining mood for the first time. They entered into discussions with the
Software Publishers Association who, acting primarily on behalf of
Microsoft and Lotus, got to them to agree "in principle" to a streamlined
process for export licensing of encryption which might provide for more
robust standards than have been allowed previously.

But the negotiations between the NSA and the SPA were being conducted
behind closed doors, with the NSA-imposed understanding that any agreement
they reached would be set forth only in a "confidential" letter to
Congress. As in the case of the digital cellular standard, this would
eliminate the public scrutiny by cryptography researchers which anneals
genuinely hardened encryption.

Furthermore, some cryptographers worried that the encryption key lengths to
which the SPA appeared willing to restrict its member publishers might be
too short to provide much defense against the sorts of brute-force
decryption assaults which advances in processor technology will yield in
the fairly near future. And brute force has always been the NSA's strong
suit.

Whether accurate or not, the impression engendered by the style of the
NSA-SPA negotiations was not one of unassailable confidence. The lack of it
will operate to the continued advantage of foreign manufacturers in an era
when more and more institutions are going to be concerned about the privacy
of their digital communications.

But the economic damage which the NSA-SPA agreement might cause would be
minor compared to what would result from a startling new federal
initiative, the Department of Justice's proposed legislation on digital
telephony. If you're wondering what happened to the snooping provisions
which were in Senate Bill 266, look no further. They're back. And they're
bigger and bolder than ever.

They are contained in a sweeping proposal which have been made by the
Justice Department to the Senate Commerce Committee for legislation which
would "require providers of electronic communications services and private
branch exchanges to ensure that the Government's ability to lawfully
intercept communications is unimpeded by the introduction of advanced
digital telecommunications technology or any other telecommunications
technology."

Amazingly enough, this really means what it says: before any advance in
telecommunications technology can be deployed, the service providers and
manufacturers must assure the cops that they can tap into it. In other
words, development in digital communications technology must come to a
screeching halt until Justice can be assured that it will be able to grab
and examine data packets with the same facility they have long enjoyed with
analog wire-tapping.

It gets worse. The initiative also provides that, if requested by the
Attorney General, "any Commission proceeding concerning regulations,
standards or registrations issued or to be issued under authority of this
section shall be closed to the public." This essentially places the
Attorney General in a position to shut down any telecommunications advance
without benefit of public hearing.

When I first heard of the digital telephony proposal, I assumed it was a
kind of bargaining chip. I couldn't imagine it was serious. But it now
appears they are going to the mattresses on this one.

Taken together with NSA's continued assertion of its authority over
encryption, a pattern becomes clear. The government of the United States is
so determined to maintain law enforcement's traditional wire-tapping
abilities in the digital age that it is willing to fundamentally cripple
the American economy to do so. This may sound hyperbolic, but I believe it
is not.

The greatest technology advantage this country presently enjoys is in the
areas of software and telecommunications. Furthermore, thanks in large part
to the Internet, much of America is already wired for bytes, as significant
an economic edge in the Information Age as the existence of a railroad
system was for England one hundred fifty years ago.

If we continue to permit the NSA to cripple our software and further convey
to the Department of Justice the right to stop development the Net without
public input, we are sacrificing both our economic future and our
liberties. And all in the name of combating terrorism and drugs.

This has now gone far enough. I have always been inclined to view the
American government as pretty benign as such creatures go. I am generally
the least paranoid person I know, but there is something scary about a
government which cares more about putting its nose in your business than it
does about keeping that business healthy.

As I write this, a new ad hoc working group on digital privacy, coordinated
by the Electronic Frontier Foundation, is scrambling to meet the challenge.
The group includes representatives from organizations like AT&T, the
Regional Bells, IBM, Microsoft, the Electronic Mail Association and about
thirty other companies and public interest groups.

Under the direction of Jerry Berman, EFF's Washington office director, and
John Podesta, a capable lobbyist and privacy specialist who helped draft
the ECPA, this group intends to stop the provisions in digital telephony
proposal from entering the statute books.

We also intend to work with federal law enforcement officials to address
their legitimate concerns. We don't dispute their need to conduct some
electronic surveillance, but we believe this can be assured by more
restrained methods than they're proposing.

We are also preparing a thorough examination of the NSA's encryption export
policies and looking into the constitutional implications of those
policies. Rather than negotiating behind closed doors, as the SPA has been
attempting to do, America's digital industries have a strong self-interest
in banding together to bring the NSA's procedures and objectives into the
sunlight of public discussion.

Finally, we are hoping to open a dialog with the NSA. We need to develop a
better understanding of their perception of the world and its threats. Who
are they guarding us against and how does encryption fit into that
endeavor? Despite our opposition to their policies on encryption export, we
assume that NSA operations have some merit. But we would like to be able to
rationally balance the merits against the costs.

We strongly encourage any organization which might have a stake in the
future of digital communication to become involved. Letters expressing your
concern may be addressed to: Sen. Ernest Hollings, Chairman, Senate
Commerce Committee, U.S. Senate, Washington, DC and to Don Edwards,
Chairman, Subcommitee on Constitutional Rights, House Judiciary Committee.
(I would appreciate hearing those concerns myself. Feel free to copy me
with those letters at my physical address, c/o P.O. Box 1009, Pinedale, WY
82941 or in Cyberspace, barlow@eff.org.)

If your organization is interested in becoming part of the digital privacy
working group, please contact EFF's Washington office at: 666 Pennsylvania
Avenue SE, Suite 303, Washington, DC 20003, 202/544- 9237, FAX:
202/547-5481. EFF also encourages individuals interested in these issues to
join the organization. Contact us at: Electronic Frontier Foundation, 155
Second Street, Cambridge, MA 02141,617/864- 0665, eff-request@eff.org.

The legal right to express oneself is meaningless if there is no secure
medium through which that expression may travel. By the same token, the
right to hold certain unpopular opinions is forfeit unless one can discuss
those opinions with others of like mind without the government listening in.
 
Even if you trust the current American government, as I am still largely
inclined to, there is a kind of corrupting power in the ability to create
public policy in secret while assuring that the public will have little
secrecy of its own.

In its secrecy and technological might, the NSA already occupies a very
powerful position. And conveying to the Department of Justice what amounts
to licensing authority for all communications technology would give it a
control of information distribution rarely asserted over English-speaking
people since Oliver Cromwell's Star Chamber Proceedings.

Are there threats, foreign or domestic, which are sufficiently grave to
merit the conveyance of such vast legal and technological might?  And even
if the NSA and FBI may be trusted with such power today, will they always
be trustworthy? Will we be able to do anything about it if they aren't?

Senator Frank Church said of NSA technology in 1975 words which are more
urgent today:

"That capability at any time could be turned around on the American people
and no American would have any privacy left. There would be no place to
hide. If this government ever became a tyranny, the technological capacity
that the intelligence community has given the government could enable it to
impose total tyranny. There would be no way to fight back, because the most
careful effort to combine together in resistance to the government, no
matter how privately it was done, is within the reach of the government to
know. Such is the capacity of this technology."

San Francisco, California
May, 1992

Reprinted from Communications of the ACM, June 1992 
by permission of the author

                        -==--==--==-<>-==--==--==-

                           from THE TAO TE CHIP
                           by Jeffrey Sorrenson
                           sorensen@ecse.rpi.edu
               (with help from Steven Mitchell and Lao Tzu)

               2

When users see one GUI as beautiful,
other user interfaces become ugly.
When users see some programs as winners,
other programs become lossage.

Pointers and NULLs reference each other.
High level and assembler depend on each other.
Double and float cast to each other.
High-endian and low-endian define each other.
While and until follow each other.

Therefore the Guru 
programs without doing anything
and teaches without saying anything.
Warnings arise and he lets them come;
processes are swapped and he lets them go.
He has but doesn't possess,
acts but doesn't expect.
When his work is done, he deletes it.
That is why it lasts forever.

               80

If a system is administered wisely,
its users will be content.
They enjoy hacking their code
and don't waste time implementing
labor-saving shell scripts.
Since they dearly love their accounts,
they aren't interested in other machines.
There may be telnet, rlogin, and ftp,
but these don't access any hosts.
There may be an arsenal of cracks and malware,
but nobody ever uses them.
People enjoy reading their mail,
take pleasure in being with their newsgroups,
spend weekends working at their terminals,
delight in the doings at the site.
And even though the next system is so close
that users can hear its key clicks and biff beeps,
they are content to die of old age
without ever having gone to see it.

                        -==--==--==-<>-==--==--==-

             MEMBERSHIP IN THE ELECTRONIC FRONTIER FOUNDATION
If you support our goals and our work, you can show that support by
becoming a member now. Members receive our quarterly newsletter,
EFFECTOR, our bi-weekly electronic newsletter, EFFector Online (if you
have an electronic address that can be reached through the Net), and
special releases and other notices on our activities.  But because we
believe that support should be freely given, you can receive these
things even if you do not elect to become a member.

Our memberships are $20.00 per year for students, $40.00 per year for
regular members.  You may, of course, donate more if you wish.

Our privacy policy: The Electronic Frontier Foundation will never, under
any circumstances, sell any part of its membership list.  We will, from
time to time, share this list with other non-profit organizations whose
work we determine to be in line with our goals. If you do not grant
explicit permission, we assume that you do not wish your membership
disclosed to any group for any reason.

---------------- EFF MEMBERSHIP FORM ---------------

Mail to: The Electronic Frontier Foundation, Inc.
         155 Second St. #31
         Cambridge, MA 02141

I wish to become a member of the EFF  I enclose:$__________
            $20.00 (student or low income membership)
            $40.00 (regular membership)
            $100.00(Corporate or company membership.
                    This allows any organization to
                    become a member of EFF. It allows
                    such an organization, if it wishes
                    to designate up to five individuals
                    within the organization as members.)

    |     I enclose an additional donation of $___________

Name:______________________________________________________

Organization:______________________________________________

Address: __________________________________________________

City or Town: _____________________________________________

State:_______ Zip:________ Phone:(    )_____________(optional)

FAX:(    )____________________(optional)

Email address: ______________________________

I enclose a check [  ]   .
Please charge my membership in the amount of $_____________
to my Mastercard [  ]     Visa [  ]      American Express [ ]

Number:____________________________________________________

Expiration date: ____________

Signature: ________________________________________________

Date:______________________

I hereby grant permission to the EFF to share my name with
other non-profit groups from time to time as it deems
appropriate   [  ]  .
                       Initials:___________________________

Your membership/donation is fully tax deductible.
=====================================================================
                   EFFector Online is published by
                 The Electronic Frontier Foundation
                155 Second Street, Cambridge MA 02141
             Phone: +1 617 864 0665 FAX: +1 617 864 0866
                    Internet Address: eff@eff.org
 Reproduction of this publication in electronic media is encouraged
             To reproduce signed articles individually,
      please contact the authors for their express permission.
=====================================================================
       This newsletter is printed on 100% recycled electrons.
--
Christopher Davis * ckd@eff.org * System Administrator, EFF * +1 617 864 0665
   ``The First Amendment is often inconvenient.  But that is besides the
  point.  Inconvenience does not absolve the government of its obligation
         to tolerate speech.'' --Justice Anthony Kennedy, in 91-155