26 January 1998: Link to Peter Gutmann's latest version
24 June 1997
Source: Mail list cypherpunks@cyberpass.net
To: aba@dcs.ex.ac.uk, cypherpunks@cyberpass.net
From: pgut001@cs.auckland.ac.nz (Peter Gutmann)
Date: Wed, 25 Jun 1997 08:10:07 (NZST)
Subject: Re: spook pressure on crypto exports (was Re: cypherpunks coding challenge)
Adam Back <aba@dcs.ex.ac.uk> writes:
>Bill Stewart <stewarts@ix.netcom.com> writes:
>>(Though actually SSLeay has been very useful to a lot of the
>>world's free cryptography, and has prompted the US spooks
>>to pressure the Australian spooks into restricting crypto exports,
>>just as they've pressured the NZs into restricting them for
>>Peter Gutman, and have been trying to work on the Irish...)
>Could you elaborate on these. I caught Peter Gutmann's comments on the
>hassles a company he did some work for were having with the NZ spooks. (The
>spooks intercepted their mailed disk, plus some other cloak and dagger
>spookish stuff).
Nothing was intercepted. They (the GCSB, NZ subsidiary of the NSA) came up
with some phony story about NZ customs intercepting a shipment of
military-grade encryption (or something similar) which they fed to the
Australian spooks (DSD). NZ Customs knew nothing of this, and the DSD were
apparently also considerably surprised by it. As far as I can tell it was a
very amateurish attempt to intimidate one of the companies involved
(frighteningly amateurish in fact - a single phonecall was enough to confirm
that they'd invented the whole incident themselves, the only real effect it
had was to get them a front-page story in the National Business Review and
(presumably) piss off the DSD for sending them on a wild goose chase and
risking media exposure).
>Is this still going on, was it ever resolved? Can the next version of
>cryptlib be exported legally? Or are we relying on Peters bravery?
It can be legally exported. Although the people pulling the strings are the
GCSB, the group enforcing it is the Ministry of Foreign Affairs and Trade
(MFAT)'s export control group, who are idiots (I can elaborate on this in
great detail at some point, preferably over a beer). I have several written
statements from them that I can freely export it electronically (along with
all sorts of bogosities such as a letter signed by the minister in which the
first sentence of the second paragraph says exactly the opposite of the last
sentence in the paragraph, and other, similar gems). At one point I was
firing off one letter after another to them just to see how silly they would
get, but it got boring after awhile. I'll put these letters online at some
point for people to have a laugh at.
I should also clarify a point about the online writeup of my experiences,
which imply that the NSA was active in directing the GCSB over export
controls. I'd had some feedback from a high-level US spook source that this
wasn't quite the case, but the source has some rather unusual opinions on
spooks and their activities (something along the lines of "Civilization would
collapse tomorrow if it wasn't for the fine efforts of the CIA and NSA") which
made me somewhat suspicious about the accuracy of the information. Anyway,
what this source said (and this bit I can believe) was that NZ was completely
out of its depth with this (which was obvious from the way it was handled) and
was terrified of offending the US. According to the source, the NSA was
exerting a *moderating* influence on the whole thing, and that any progress
made was because the NSA told the GCSB to back off. This would indicate an
interesting case of the NSA exerting very strong indirect influence on
determining crypto policy. The GCSB knew the NSA didn't want crypto being
distributed, and when they heard of the export they went into overdrive to
show the NSA what good boys they could be and how keen they were to help the
US by enforcing US policy for NZ crypto.
This interpretation is believable, NZ is very much a junior member of the
UKUSA alliance and really doesn't want to do anything which might offend the
other partners. They knew the US didn't want crypto being made available, so
they went out of their way to try to show the NSA that they could be trusted
to do their bit in restricting crypto (I'm certain that something as
amateurish as the NZ Customs story didn't come from the NSA, even the DSD
seemed unaware of it).
This means that it doesn't actually require any direct intervention from the
USG to control crypto policy, the mere knowledge that the NSA doesn't like
something is enough to make the local spooks (who, in NZ's case, rely on the
NSA for much of their hardware and training) do whatever they think will keep
the NSA happy. It's perfect for the NSA I guess, because they get complete
deniability (Just yell "Will noone rid me of this troublesome crypto" and sit
back and wait).
Peter.