🚀 go-pugleaf

In article <1992Oct27.143737.1574@guvax.acc.georgetown.edu>, denning@guvax.acc.georgetown.edu writes:

|> 1.  The government is not taking any action to curb crypto and is 
|> unlikely to take any such action in the near future.

That's very nice to hear (:-).   They just want to be able
to listen to what we want to be private, that's all...


|> No proposal has
|> been made and no government agency that I am aware of has plans to
|> make such a proposal. 

How about senator Biden's stuff?

|> 2.  The reason I made the proposal is because I am concerned that we
|> may be facing a major crisis in law enforcement.  

I'm amazed there still are people who believe in solving
problems via legislation.   [But when people with 
technical degrees start heading that way - it's
really scary.]

And what makes you think criminals will let you know their
keys?  Isn't this similar to gun control laws, when honest
citizens must undergo complicated background check and  in
many places wait from two weeks to 8 months (in NY state),
while criminals buy their  unlicensed unregistered guns on
the black market and couldn't care less about your 
legislation?

Gun control laws are getting more and more restrictive,
while violent crimes with guns are increasing in almost
geometrical proportion... Makes one think... 


|> Electronic surveillance has been an essential tool in preventing 
|> serious crimes such as terrorist attacks and destabilizing organized crime.

Well, I don't recall any reference to that in the media recently.
Or are the crimes, the ways they were discovered, and the trials
all secret?   

Would you care to post the information about those serious 
crimes prevented?   


|> The economic benefits alone are estimated to be in the billions.  

Benefits? To who?!  To a competitor who could bribe an official
to get access to a secret key of his rival company, and enjoyed
watching their proprietary information in clear? Yeah, maybe...


|> This issue is not about snooping on innocent citizens but about 
|> doing what we can do prevent major crimes that could seriously 
|> disrupt other liberties.  

So far the crimes prevented, that could disrupt our liberties,
are yet to be found.   But the liberties themselves are
deteriorating quickly, thanks to you and others...


|> The problem is likely to get even worse if criminals know
|> they use the telecommunications systems without any chance of getting
|> caught.

Worse? Really?  Oh my!  Thrills!

Tell me this: drugs are outlawed,  but criminals still get/sell/use
them. Unregistered guns are outlawed,  but criminals still get/sell
and use them. Crimes are outlawed, but criminals still do them (and
more and more).

And to assume, that inner cities can get any worse than they
are now - ...

Now you propose to remove yet one more liberty and disclose some
secret information - in other words prohibit "unregistered, 
unexposed to the gov't encryption".  If you seriously
believe, that it can have better effect than
control over other "controlled" things -
your students have my pity.


Tomas Jefferson said:  "SOCIETY, THAT TRADES LIBERTY FOR SECURITY,
WILL HAVE NO SECURITY AND NO LIBERTY, AND IT DOESN'T DESERVE ANY".


[If my quote is not exactly accurate - please correct. I'm sure
 I expressed his idea correctly.]



|> 3.  My proposal was to register your private key with a trustee, 
|> different from the government.  

My, thanks!

|> The key would be encrypted under some
|> other public key so the trustee couldn't decrypt it.  I have suggested
|> it be the key of the DOJ, but it could be another independent trustee.

Well, there's a problem with trustees these days - not too many to
be trusted with secrets... (:-)

And it was never heard of information leaks from government places,
and of government abuses of their power... 

[Soooo... Bribe somebody at DOJ to get their key, then break into
 that trustee's database and start forging checks... :-]

|> I believe this would provide acceptably good protection since someone
|> would need to get a court order and then the cooperation of 3 agencies
|> to get at your communications: the telecommunications provider (to get
|> the bit stream), the first trustee (to get the encrypted key), and
|> the second to decrypt it.  Experience with the telecom providers has
|> been that they are very fussy about court orders -- you have to get
|> the semicolons right!

And what's then, once the key is exposed?   And in digital world
one doesn't need to bring the wire to your door - it's easier to
intercept and process the whole trunk... Also, do you personally
have that experience with telecom providers? 


|> You can get even more security by using Silvio Micali's "fair 
|> public-key cryptosystem" approach.  Called "fair" because it is 
|> designed to strike a balance between the needs of the Government and
|> those of the citizens.  With his approach, you would break your key
|> up into 5 parts and give it to different trustees.  

And how does having 5 trustees instead of one or three, "strike the 
balance"?  For me the question is:  is your key known to you ALONE, 
or there's somebody else,  who can has your key?  That's all...  So 
now Joe Bad has to bribe 5 officials instead of one... Big deal...

And from the moment person's secret key is exposed, EACH of his
previous digitally signed documents can be disputed!

So, PLEASE, "search" my traffic the next day after I signed a
loan agreement and got the money! (:-)


|> 4.  Someone suggested that law enforcement routinely taps without
|> court order.  This is an ungrounded claim for which I have never
|> seen any evidence.  

You mean, all the stuff  Mr. Bamford described in his book,
with almost every page documented, is just a fiction? Fruit
of imagination?

BTW, ever heard of operation Minaret? (I'm not sure I remember
the name correctly, sorry.)

I'm not concerned [at this time] about my local cop nosing
around and tapping my phone.  I'm concerned about bigger
[and more powerful] things.


|> Regardless, their ability to do this is 
|> disappearing with the new digital based technologies.  They need the
|> help of the service providers, who in turn ask for court orders.
|> Court orders are not all that easy to get as law enforcers have to
|> document why other approaches have failed etc.

You mean long-distance telephone calls aren't going through
microwave channels any more? And some agencies stopped
monitoring them? How nice!

[Does this mean that the house of (former) Soviet Ambassador
 is on sale now? The one at Long Island? :-]


|> 5.  Many people have noted that you could not enforce key 
|> registration.  They may be right, but I am not throwing in the towel
|> yet.  

You can enforce whatever you wish ON HONEST LAW_ABIDING CITIZENS.
You can't do a blessed thing with those who spit on you and your
laws. 


|> Let's take phones, which is what law enforcers are most 
|> interested in.  Products are emerging that you can attach to your
|> phone and that will do DES encryption.  
|> The products could be designed so key registration
|> would essentially be part of the sales process.

And there will be a black market "not type-accepted" product,
which will cost a lot (so that only "real" serious criminals
will afford it), which will have none of those limitations.

And if you can crack on the black market -  why not do it
now with guns and drugs? When you succeed - get back with
your "proposal".

Some questions for you: 
	a) can a student make DES VLSI chip during his 
	   undergrad studies?   
	b) can you convert your 486-DX66 with a modem into 
	   a fairly powerful online DES encryption device?
	   [If not - resign immediately! :-]
	c) can "organized crime" personnel afford some
	   PCs with modems?
	d) how's that for "commercially available" products?

|> Criminals and everyone
|> else are most likely to use commercial products -- easiest to
|> get and cheapest. 

Excuse me, but the size of your delusion is enormous.
[Or are you an "expert" in criminal science as well?]

Of course everyone else  IS most likely to use commercial 
products -  normal citizens  often don't even know how to 
approach the black market, to say nothing about affording
it's prices. 

But criminals use the cheapest ONLY WHEN IT SUITES THEIR NEED!
And weren't you saying, that it's against "serious" criminals?
"Organized crime"?  Since when do they have lack of money?  Or
hesitate to use them?

How easy is it for you to get fully automatic submachine gun?
Apparently, criminals have no problems with it.  Unregistered
"untraceable" gun?  Can you get one? "Easily"?  Criminals can
and do, as a routine.

What's easiest to get for YOU, isn't necessarily the easiest
(or acceptable) for a CRIMINAL. 

But in case of cryptography,  price doesn't seem to be
a major issue...   Any subnotebook of tomorrow will do 
the job, and some notebooks of today too (oh, only the
ones with two serial ports -  so outlaw them, while it
isn't too late! :-).


|> There can be social benefit to government regulation even when 
|> regulation is not 100% successful. None of our laws prevent the
|> acts they outlaw.  But this does not mean we should get rid of
|> all laws.  

No, only of the most stupid laws...  Unfortunately, those are
with the longest life-span... [And if we could get rid of
the lawyers, who propose and sponsor those laws...]


|> 6.  Some people have said we should not give up our privacy to the
|> government. But the constitution does not give us absolute privacy.

No, just the "privacy", ma'm.... Your "proposal" will leave us NO
privacy. 


|> Do we really
|> want a society where electronic communications cannot ever be broken
|> when there is good reason to believe some major threat against society
|> is being planned?  

This society ALREADY EXISTS!  Let's wake up and look around.

And again, please, could you name a couple of "major threats"
against society, which were discovered and prevented through
your "surveillance?   [BTW, the term "crime against society" 
was one of the most used  by communists during their purges. 
It's refreshing to see it surfacing here. You're heading the
right way.]


|> We are protected from unreasonable searches and seizures, but not
|> reasonable ones in response to "probable cause" of crime.  In all
|> areas of our lives, the government can invade our privacy if they
|> have good reason to believe we are engaged in major criminal activity.
|> They can break into our homes, our safes, and so on.  

Again and again. There is no way to enforce this law. Thefore only
"small" people will be subjects of it, while those who can afford
real privacy, will have it.

Only in hopelessly totalitarian societies one might expect to be
able to enforce such laws - but even there life proved their
utter failure!
-- 
Regards,
Uri.		uri@watson.ibm.com
------------
<Disclaimer>