🚀 go-pugleaf

 In <1992Nov17.001009.26363@rchland.ibm.com>
 lwloen@rchland.vnet.ibm.com (Larry Loen) writes:


>Sure, concerns do exist.  Law enforcement has some hard problems.
>But, most of the Bill of Rights is _not there_ to make the job of
>the cops easy; it is explicitly there to make it harder.
>[...]
>But, inconveniencing the cops is and
>ought not be the sole criteria by which we run society.

 OK, but society must still "run."  The possibility exists that the
 new technology may break the system so that society cannot "run"
 very well anymore.


>Again, why is it our duty to help the cops?  We do not necessarily
>have the same interests as they.  [...]

 At the cop vs. criminal level, no.  But in the larger sense, we
 all have to live here.  We all want the best society we can have.
 That does not necessarily mean the most efficient nor the best
 regulated nor the most enforced, but it *does* mean that, as a
 society, we obviously *do* have a "duty to help the cops," or we
 wouldn't employ cops at all.


>[...] Haven't you heard of "thought crime?"  The idea is alive
>and well and you seem bound and determined to help government
>create and enforce it.

 Nonsense.

 First of all, I just made a *proposal*; if you have a better
 one, let's hear it.

 Or, if you have a better approach to arguing for tolerating the
 inevitable misuse of cryptography, let's hear that.

 My proposal was to reveal plaintext *under due process*; if
 the courts can't be trusted to uphold your rights, exactly what
 part of government *will* uphold your rights?


>[...]
>Cryptography, in itself, is value-neutral.

 One can say that *any* technology is "value-neutral."  This turns
 out to be a lot easier *before* we understand the negative social
 effects of that technology.


>[...]Why should the cops be entitled to assume any encrypted communication
>is the latter and not merely some idea I don't feel like revealing yet?

 I doubt that a cop searching your "effects" makes any real
 "assumption" about them.  Cops are *allowed* to search (under
 warrant).  Cryptography has *nothing* to do with this.


>Your argument is really the ancient, flawed, idea that some things are deep,
>dark, secrets that we cannot even trust adults to possess.  "Some things
>mankind is not meant to know".

 On the contrary, I propose that we act to put our own house in
 order, to prevent the possible future loss of general access to
 cryptography.


>Why, if the government cannot look over
>our shoulders, we will all become instant criminals.

 The government *has* an implicit "right" under The Fourth
 Amendment to conduct searches and seizures, provided only that
 they obtain an explicit warrant based on probable cause.  The
 government *has*, and always has had, the "right" to "look over
 our shoulders," and that is enshrined in The Bill of Rights.
 My proposal has *not* created this "right."

 We *can* say absolutely that criminals would *not* want the
 government to "look over their shoulder."


>>If use were illegal, any use in
>> communications would draw attention to criminal activity.

>[...] An ordinary GIF or ZIP file
>will be totally indistinguishable from an encrypted file if the
>government wiretapping machine misses the first few bytes.  And, new
>compression schemes are invented every day.  Do you propose that every
>implementation of every computer program that compresses data be
>registered?

 My proposal, if you would read it, would require *the user* to
 reveal the plaintext.  If the file was GIF or ZIP and *the user*
 could demonstrate that, it would be revealed.  No programs need be
 registered.

 You are right, though, that the transmission of random-like files
 would not be a good indicator of criminal activity.  Naturally,
 if the police had enough evidence to get a warrant to search for
 records of criminal activity, and encountered lots of random-like
 files, they might want to see what those files contained.  If the
 files were innocuous, the defendants would have no reason to
 refuse.

 Certainly, all of your written documents were subject to search
 under warrant *prior* to the advent of generally-available strong
 cryptography; why should this new technology put your records
 beyond the reach of the courts?


>But, your
>argument is something like we have to agree to record all of our
>telephone conversations "just in case" the cops later need them
>to justify their claim that we committed some crime or other.

 Nonsense.  My proposal is that, given the ciphertext, the user
 would be required to make it plain.  This means that there would
 be a responsibility to log old *keys*, not conversations.


>[...]What session keys
>did the system generate for the users?

 Yes, future systems may have to log session keys.


>> My approach would be to require that anyone using cryptography
>> be prepared to provide future access to enciphered information
>> to a court under due process.  Failure to do so would be a crime.
>
>But, I use cryptography every day and I DON'T CONTROL THE KEY.  My
>company does the encryption for me.  So do lots of Bank Officers.
>And, so on.  I would be convicted easily of your crime.

 It certainly is going to be difficult to discuss proposals if they
 must spring full-blown and precisely-worded into being.  It is
 obvious to me that by "anyone using" I mean "whoever is in control
 of such enciphering."  You would not be convicted of "Failure to
 Reveal" unless you were in control and "somehow" failed to log
 your keys.


>In other words, if the government cannot prove a crime happened, they
>can "get" you under some technicality or merely for not abjectly
>disclosing to them every private thought you ever had.

 Failure to keep tax records is not "a technicality"; failure to
 keep cryptographic records could be treated in the same way.


>I agree the
>conviction is quick and easy.  Look at what they got Ollie North for.
>You may not like him, but I think that the government spent millions
>and effectively convicted him of spitting on the sidewalk.  Surely,
>what they "got" him for had nothing whatever to do with why he was
>originally investigated.

 You mean an Executive-branch officer "lying to Congress," had
 "nothing to do" with the Iran-Contra investigation?


>I don't frankly consider that a very good
>use of government resources.

 Yeah, I would have preferred that Congress *not* have granted
 immunity; then there would have been *no problem* getting a
 conviction.

 Any officer of the military who takes the oath to (depending on
 service) "preserve, protect, and defend the Constitution of the
 United States" and as an officer and a gentlemen to "never lie,
 nor tolerate those who do," who then deliberately lies to the
 Representatives of the People of the United States, in my humble
 opinion, deserves a *military* court-martial.  I expect *that*
 would not have lasted very long at all.


>And I think that "Failure to Disclose", at least the way you describe
>it, is just the sort of thing our government already has too much
>ability to do and will without doubt lead to actual tyranny.  There

 It should be easy enough to avoid "Failure to Disclose."

 Just . . . disclose.


>Rights are not free.  They have to be fought for.

 For some reason you apparently feel that *you* can lecture *me*
 on the cost of rights and how they are obtained.  It just might
 be possible that I am *far* more personally aware of the cost of
 rights, and what they mean to us, than you appear to be.


>Why are you helping
>the cops?

 First, I got into this by helping *us*, not the cops.

 Then I found out that the cryptography in which I have become
 so involved can have extremely serious and bad effects.

 Last, why are you *not* "helping the cops"?  You are, of course,
 helping to pay for them.


>Why are you assuming they will win?

 Our *problem* is that ordinary people can be swayed by heinous
 cases, and we have very few arguments which would convince
 ordinary people that other ordinary people should have
 unrestricted access to cryptography.  Does that sound to you
 like a prescription for legislative success?

 If it fell to you to argue the proposition, we could absolutely
 *guarantee* "they" would win.  I hope we can improve our odds
 by developing arguments of somewhat higher caliber.  So far,
 we have not had much success, however.


>Why are you assuming
>their interests and yours always coincide?

 Nonsense.  It is precisely *because* our interests differ that I
 seek a defensible position.  Completely unregulated cryptography
 may not be defensible.


>Or, do you really believe
>that cryptography is inherently dangerous?

 I believe that the completely unregulated and absolutely free
 use of cryptography may indeed be dangerous for society.

 I am more than willing to be shown wrong.

 ---
 Terry Ritter   ritter@cactus.org