🚀 go-pugleaf

In article <1992Nov10.090133.1707@guvax.acc.georgetown.edu> denning@guvax.acc.georgetown.edu writes:
>While I appreciate that some people prefer to answer the question
>"can/should crypto be regulated" with a blanket NO, I prefer to first
>get a better idea of what crypto options might be available and the 
>conditions, if any, under which they might be appropriate.  

I'd word it a little more specifically:

A) Some people prefer to answer the question "Should crypto be
regulated?" with the a blanket NO.

This would certainly leave "crypto options" open, because people will
disagree on the answer for a variety of reasons.

B) Some people feel that the answer to the question "Can crypto be
effectively regulated?" is in fact NO.

Since there's quite a lot of seemingly good crypto software that is
available in an unregulated fashion, (i.e. - It's pretty difficult to
keep copies of PGP out of the hands of people that want it) it looks
like there isn't any way of effectively regulating it.

If crypto is used for some communications that doesn't injure anyone,
then no harm is done.  It doesn't TRULY get involved with crime until
a criminal (doing something ELSE that is against the law) uses crypto,
perhaps to keep from being caught.

The issue is NOT to simply be able to effectively prosecute "average
citizens" for illegal use of crypto.  Any "obvious" sorts of
legislation would probably be quite effective at curbing this use of
crypto.  Unfortunately, this won't, in general, stop very much ACTUAL
crime.

The issue is whether or not use of cryptology in the performance of
CRIMES can be effectively regulated.  And while my OPINION isn't very
important, I don't think that this CAN be effectively regulated.  

If people disagree, then if they want to defend the position, they
should show how specific restrictions on crypto would be likely to
ACTUALLY affect criminals.

Since criminals seem to have a habit of breaking laws, it is not
nearly enough to say "Well, if possession of crypto software is
illegal, people won't use it."  Possession of cocaine is currently
illegal, but that has NOT stopped people from using it.  Cocaine and
crypto aren't terribly similar in either their nature, or their
effects.  I'd prefer them to be dealt with differently by the law, as
well.

>I am also
>not content to let society drift in the direction of completely 
>unregulated crypto without attempting to understand the consequences
>of that from the view of LE as well as the view of protecting privacy
>and proprietary interests.

Fair enough.

>Whatever regulation, if any, might be considered, it would seem that
>it would have to be aimed mostly at crypto products, not use.

Since computers are such powerful machines, it's relatively easy to
make almost ANY computer into a pretty powerful crypto machine.  Given
a half decent C compiler, and a few pages of C code, I can put DES or
IDEA on my computer.

If I wanted to do some "paranoid raving", I'd suggest that a C
compiler is a pretty powerful crypto product, and that the export of C
compilers might be restricted.

Unfortunately for those that would like "crypto products" to be little
black boxes that you can lock away so that people can't get at them,
computers are SO GOOD for cryptography that it's not a bad
generalization to say that EVERY computer is potentially a powerful
"crypto product."

My suspicion is that any regulation that could reasonably prevent
public use of cryptography would have to do it by placing major
restrictions on the USE of computers.  The computers are already out
there - they can't be taken back.

-- 
Christopher Browne                |     PGP 2.0 key available
cbbrowne@csi.uottawa.ca           |===================================
University of Ottawa              |  The Personal Computer:  Colt 45
Master of System Science Program  |  of the Information Frontier