🚀 go-pugleaf

I think Ed Hall, edhall@rand.org, makes a good point when he writes:

>Arguments
>like "should terrorists, child-molestors, and other evil-doers be allowed
>to use encryption to evade justice?" have a lot more impact with John Q.
>Public.  The answer to "do you trust the government?" might well be "no",
>but if the question is the government versus evil-doers, people are
>generally going to support the government, even if they mistrust it in
>other ways.
>[...]
>Let's say that a suspected child-molestor gets arrested.  As is all too
>often the case, there isn't enough admissible evidence to convict him.
>However, since he was encrypting his diary, illegal crytographic programs
>were found on his computer.  So the prosecutor is able to get him put
>away for a while even though he won't decrypt the diary.  Anti-cryptography
>laws will join tax laws and other such legal weapons used to lock up
>evil-doers who are otherwise too slippery to catch.

I think Ed is right.  The anti-cryptography laws have to have enough
"teeth" so that the people who are committing these heinous crimes, the
crimes which the public is going to care about, can't just hide behind
their encrypted files.

That means that illegal use of cryptography must be punished by a prison
sentence.  That's the only way these criminals can be gotten off the
streets despite their encryption, which is the whole purpose of the
proposed laws.

Think about that.  We're not just talking about a fine, or even a night
in jail.  We're talking about locking someone up for months or years,
just because they encrypted a file and would not (or could not) produce
the plaintext in response to a court order.  We're talking about a very,
very serious punishment for this crime.  For the first time, it would be
possible to face a prison term simply by running a forbidden program on
your computer.

This is a good thing.  It weakens the case of the people who want to
propose these laws.  There is a basic legal principle that a punishment
should be proportional to the crime.  How can the simple act of
manipulating some personal data on your own computer be a crime serious
enough to merit a prison term?  What about someone who legitimately
forgot his encryption password?  (It's happened to me!)  How can we put
someone in prison for something like this?  It's completely
disproportionate to the crime.

So, those calling for these restrictions face a dilemma, it seems to
me.  On the one hand, crypto can prevent terrible criminals from being
convicted, and it's exactly these cases, which everyone views with
horror, which will be most effective with the public.  On the other
hand, the only useful penalty in these same terrible cases is a prison
sentence, which is an extremely strong penalty, one which is totally
inappropriate for the general case of illegal use of cryptography.

Strategically, then, we have a response to the proponents of
restrictions.  If they call for moderate penalties, like a fine or even a
short jail term, we simply point out that this will have no effect on the
international terrorists and child molestors who were used to argue for
these restrictions.  Fanatics like these will laugh at such minor
inconveniences.  If they instead call for the severe penalties needed to
really stop such criminals, we point out that in and of itself illegal
use of cryptography, which is basically a matter of manipulating numbers
on your own personal computer in certain "forbidden" ways, is easy and
harmless, and it's totally disproportionate to attach felony-class
penalties to such a "crime".

John Q. Public may not fear government wiretaps, and he may not care a
whit about email privacy, but he doesn't want to spend years in prison
just because he ran the wrong program on his computer.

--
Hal Finney
hal@alumni.caltech.edu