18 September 1999
From: staym@accessdata.com
Date: Fri, 17 Sep 1999 14:26:57 -0600
To: Greg Broiles <gbroiles@netbox.com>
Cc: Russell Nelson <nelson@crynwr.com>, cryptography@c2.net,
cypherpunks@cyberpass.net
Subject: Re: Why did White House change its mind on crypto?
Our company works with the FBI a lot. We provide the software they
actually use to recover passwords.
The majority of software out there uses access-denial: the encryption /
ofuscation doesn't depend on the password. But to be acceptable in
court, you have to prove that you didn't change a single bit of
evidence. That's why all our software recovers passwords instead of
simply removing the protection.
If the [CESA] law passes, we'll probably end up providing them with trojan
horses & stuff. Basically, they're going to be glorified keyboard
sniffers, because the courts (no matter what the law says--they get to
interpret the law) aren't going to accept that a message wasn't faked
unless the prosecutor can prove that it is the decryption of a
ciphertext. To do that, all they need is a password that works, so
that's what they'll focus on capturing.
--
Mike Stay
Programmer / Crypto guy
AccessData Corp.
mailto:staym@accessdata.com
Date: Fri, 17 Sep 1999 10:37:36 -0700
From: Greg Broiles <gbroiles@netbox.com>
To: Russell Nelson <nelson@crynwr.com>
Cc: cryptography@c2.net, cypherpunks@cyberpass.net
Subject: Re: Why did White House change its mind on crypto?
On Fri, Sep 17, 1999 at 11:05:37AM -0400, Russell Nelson wrote:
> What's the difference between that, and someone claiming that a
> certain piece of text decrypts to a sinister message?
>
> Seems to me like the best defense against that is mass-market crypto.
> Because if the TLA claims that something decrypts to something, and I
> can use the mass-market crypto to have it decrypt to something else,
> the TLA has a credibility problem.
>
> Or is this not why you're scared?
What scares me is the possibility that there won't even be an argument
about whether or not a particular clump of ciphertext decodes to a
particular bit of plaintext because I don't think it'll be possible to
cross-examine prosecution witnesses about the way that they came into
possession of what's purported to be plaintext. They won't need to say
how they came into possession of the plaintext, because that would
reveal their methods - if you know what ciphertext they used (especially
if you're seeing it as an email message (perhaps with Received lines
intact), or as the output of tcpdump) you probably know how it was
intercepted, and that's something they want to keep secret.
The scenario I'm concerned about is a simple swearing/credibility
contest - the prosecution witness asserts that the defendant was the
author of a particular (plaintext) communication which is either a
crime, or admits to committing a crime. The defense can now choose
between offering no response, or having the defendant deny authoring the
communication (under oath, waiving their right against
self-incrimination, including related to collateral matters). The
defense won't have a meaningful opporunity to question the technical
correctness nor the constitutional/legal appropriateness of the access
to the text, because it's not possible to meaningfully explore those
issues without revealing the government's methods.
It's difficult to imagine that the Clinton administration, in light of
recent weeks' revelation about misconduct, hidden information, and
perjury which occurred regarding the conduct of federal law enforcement
officers at Waco, is proposing new legislation which limits instead of
expanding access to information about law enforcement techniques and
behavior. It's likely that a number of criminal convictions were
obtained against the survivors of the burned church building because of
the information which was hidden from the defense and the jury by
prosecutors and law enforcement agencies. That information is now coming
to light as a consequence of a later, civil suit regarding the burning
.. but would we ever have learned it if a statute prohibiting disclosure
of law enforcement methods were in effect? The current CESA draft only
applies to law enforcement methods used to gain access to electronic
information - but if the public swallows that bitter pill, we should
expect it to spread to a general prohibition about questioning the
tactics of the government in all venues.
--
Greg Broiles
gbroiles@netbox.com
Date: Fri, 17 Sep 1999 09:18:24 -0400
To: politech@vorlon.mit.edu
From: Declan McCullagh <declan@well.com>
Subject: FC: Why did White House change its mind on crypto? Here's an
answer...
http://www.wired.com/news/news/politics/story/21810.html
Decoding the Crypto Policy Change
by Declan McCullagh (declan@well.com)
3:00 a.m. 17.Sep.99.PDT
Why did the Clinton administration cave
on crypto? What caused the nation's top
generals and cops to back down this
week after spending the better part of a
decade warning Congress of the dangers
of privacy-protecting encryption
products?
Why would attorney general Janet Reno
inexplicably change her mind and embrace
overseas sales of encryption when as
recently as July she warned Congress of
the "rising threat from the criminal
community of commercially available
encryption?"
It can't simply be that tech firms were
pressing forward this fall with a House
floor vote to relax export rules. National
security and law enforcement backers in
the Senate could easily filibuster the
measure. Besides, Clinton had threatened
to veto it.
It could be the presidential ambitions of
Vice President Gore, who just happened
to be in Silicon Valley around the time of
the White House press conference
Thursday. Still, while tech CEOs can get
angry over the antediluvian crypto
regulations Gore has supported, they
regard Y2K liability and Internet taxation
as more important issues.
Another answer might lie in a
little-noticed section of the legislation the
White House has sent to Congress. It
says that during civil cases or criminal
prosecutions, the Feds can use
decrypted evidence in court without
revealing how they descrambled it.
[...]
--------------------------------------------------------------------------
POLITECH -- the moderated mailing list of politics and technology
To subscribe: send a message to majordomo@vorlon.mit.edu with this text:
subscribe politech
More information is at http://www.well.com/~declan/politech/
--------------------------------------------------------------------------