From: pat@rwing.UUCP (Pat Myrto)
Subject: Re: Once tapped, your code is no good any more.
Article-I.D.: rwing.2073
Distribution: na
Organization: Totally Unorganized
Lines: 202

In article <1993Apr17.061326.16130@clarinet.com> brad@clarinet.com (Brad Templeton) writes:
>In article <tcmayC5M2xv.JEx@netcom.com> tcmay@netcom.com (Timothy C. May) writes:
>>Getting the court order to reveal the key *also* makes decipherable
>>all *past* conversations (which may be on tape, or disk, or whatver),
>>as I understand the proposal. I could be wrong, but I've seen no
>>mention of "session keys" being the escrowed entities.
>
>True in theory.  In practice?  The technology of cellular phones will
>probably be spread spectrum and quite difficult to record the crypttext
>without the key.  If the frequency path depends on they key, as I
>understand it to, it *could* be made effectively impossible to record.

I am not an expert in the cryptography science, but some basic things
seem evident to me, things which this Clinton Clipper do not address.
The all pertain to opportunites for abuse, and conclusions based on what
I have seen the membership of this group (except for two notable persons)
agree to.  If anything bad is possible by the government in theory, it
almost always ends up happening in fact.  So the key is to make abuse
IMPOSSIBLE.  Question authority, and remember power DOES corrupt.

I think one has to regard this whole idea in the sense that it WILL be
expanded to include other data forms, such as data transfer and stored
data. and as such should be treated as if it were expanded (or such
expansion will be almost impossible to stop, using Clipper as a precident).
There was a hint of that in the proposal, remember.  That said, please
bear with me, I am not very articulate, so I take more words to say
what others could say much more briefly.  Thank you.

>Once it hits land you can record it if you have telco access.  The
>telco isn't supposed to give that without a warrant.  That's the rule
>today.

As I suggested this is NOW.  The hint is in the proposal that this or
similar proposals are being considered for other forms of encryptions
such as data transfer, data files, and such, largely dependent on how
this thing is accepted or flies.  I think one would be wise to treat
this in the manner one would when (not if) it gets expanded to other
areas than cellular phones.  I think this is guaranteed to happen, if
this proposal gets by.  Salami politics.  It has been and is used in
several other areas, it is certain to be used here.  Government is not
going to easily give up on the idea that they should be able to eavesedrop
whenever they want to.  'Court order required' has proven to be a rather
flimsy guarantee.  If the case warrants, they can always sieze the
material, and force one to give the key, or sit in jail forever on
periodically renewed contempt charges.  So it is not denying the justice
system the information, nor the ability to lock someone up if guilty
(or refuses to divulge the means to access the info - this is not
protected under the Fifth - one can be forced to perform ACTS that would
result in divulging incriminating evidence).  So, blocking restrictions
on private encryption is not preventing LEGITIMATE law enforcement - it
does make ILLEGITIMATE law enforcement a bunch more difficult.  Especially
fishing expeditions without the target's knowlege.  Don't give up the
right to be safe from that - that should be non-negotiable, and Clinton
and Co. know it (which is probably why they quietly developed this thing,
figuring if they get it this far, they can ram it on through).  How come
those consulted could be roughly described as "us insiders"?  They cannot
quietely IMPLIMENT it though, when they ban other schemes to ensure its
exclusive use.  Hence the nice PR document to try and reassure everyone.
Don't buy into it.  Has government really earned that kind of trust,
past or future?  To be secure and free, one must keep government honest
and the only way to do that is to make abuse IMPOSSIBLE, not 'unlikely'
or 'difficult'.

>But even so, the evidence would not be admissible, I think, unless the
>judge so ordered.  I think that even interception of the crypttext
>without a warrant would be illegal.   Cops can't record today's plain
>cellular calls and then ask a judge, "Hey, can we have permission to
>listen to those tapes?" can they?

So what?  One could use information gained by re-use of the keys (saved
after the last case was finished) or other means (master key, backdoor,
easily broken algorithm) to find other evidence which, given to a judge,
would authorize a tap which wouldn't have been possible otherwise.  This
has been the more common manner of abuse of wiretaps in the past...  For
local cops, this might be workable to keep them honest, but the Feds
have a workaround somehow, BET on it.  Does anyone really believe
for example, that the government will use a scheme NSA cannot listen
in on scanning for keywords - either easily defeated in realtime or
via a 'master key'?  I sure don't.

This whole thing sounds like something to eliminate the need to use
old-fashioned police work to build a case.  In the past, eavesdropping
was rather easy (with or without a court order).  I think the Law
Enforcement community has become a bit spoiled, and will resist changes
that require them to revert to using old-fashioned detective work.  I
just find it somewhat surprising coming from a bunch that cares so much
about civil and individual rights, that "puts people first".  The question
is "put people first" to WHERE?

With the innards not being revealed, how is one to be sure there DOESN'T
exist a 'master key' for use by NSA, etc (so they can do their keyword
scan, etc on conversations they routinely monitor, without a specific
court order)?   Remember, the cellular phone limitiation is only TEMPORARY.
Bet on it.  And so far I have not heard about police telling people that
they have been tapped and nothing incriminating was found.  What is to
keep them from simply keeping the keys on file for 'next time'? After
awhile, they would have quite a collection.  Kept especially for folks
they deem 'disruptive'.  And if they get only one key, that would
reduce the search space a lot, unless it is an RSA scheme.  Remember
Nixon years?  Need for court orders really slowed them down, didn't it?

And unless the escrow accounts are not government controlled (fat chance!
I see one ending up being under, say Treasury, the other under Justice
:-)) it could be worth some serious bucks to some folks to get keys to
a competitor's Clinton Clipper (or descendent when this idea is expanded
to be used for all non-government encryption).  Enough bucks would get
one the keys or the innards for this algorithm.  Perhaps not an important
concern, but given past government behavior and the other problems...

>>worse, of course, if the government then uses this "Clinton Clipper"
>>to argue for restrictions on unapproved encryption. (This is the main
>>concern of most of us, I think. The camel's nose in the tent, etc.)
>
>Yes, that is a major concern, but I think that they think they can
>win just by having 99.5% of the USA use this system.  They don't even
>have to care about the cautious .5% that's left.  They don't catch the
>really smart crooks anyway.   John Gotti, who would have to be retarded
>not to realize he was likely to be wiretapped, glibly chatted away
>on his tapped phone about murder plans.  That's why he's in jail now.
>Hard to believe, but true.

What will one do when it is expanded to data storage encryption?  You
can BET that if Clipper is accepted, that will be next on the agenda.
It is even hinted at in the proposal - read it carefully...  Expect the
argumet "well, if you got nothing to hide..."  Fine. Then using that
argument, one should not object to video cameras being installed in
every room of one's home.  Granted - an exteme expansion of the idea but
the principle holds.  Private stuff should remain private, even from a
govt fishing expedition.  And laws/rules may change in the future as
to 'safeguards'.  When it comes to the Fed Government, safeguards are
pretty meaningless, if they want to do/get something.

Don't work so hard to give up some rather treasured rights, or establish
bad precidents, please.  The price could be hell to pay, later.

>This scheme can succeed without laws forbidding more, which people would
>fight a lot harder.  They like this enough that they are dropping the so
>called "Digital Telephony" proposal, according to rumours.  However the
>meaning of that is complex, since they still want to get at the crypttext
>on telco systems, and that requires a bit of work.

People would fight laws forbidding more NOW, but in, say two years,
because we have this 'crisis' situation which MUST be addressed by some
'drastic action', just this added reasonable restriction will only bother
those who have someting to hide... etc.  Please don't buy into it.

If the Clinton Clipper is so very good, why not make its algrithm public
so many people can exchange ideas and examine it, rather than a few
isolated 'respected experts' (respected by whom?  for what?  Perhaps a
certain professor who likes key banks would be one of the selected
experts... this does seem to expand on some ideas the person was
advocating, if I recall :-).  How would anybody know that what the
experts examine is the same as what will end up being used in the Clipper
Chip, if it is kept secret?   Perhaps the Clipper will use a crippled
version (with a 'master key' provision), or features not present in the
version subjected for study and evaluation by the experts.  And who
chooses the expertes?  The government?  No conflict of interest there...
:-)

And isn't it a REQUIREMENT for any decent encryption scheme that it NOT
have its effectiveness reduced by having the algrorithm widely known?
I was lead to believe that one should assume the other side has everything
you have, except for the key(s)... I recall ideas presented to this
group are rejected if a requirement exists the algorithm be secret...

Another question - since it is a safe bet this Clipper thing would not
be used for government security, they are regarding it as not real secure
but "good enough" for common folk.  I think I would like to see a full
description (not a PR non-statement) of just what "good enough" means?
I think when saying how strong it is, "good enough" really means "not
very".  The excuse that other countries have these restrictions is not
acceptable:  Other countries do not have our Bill of Rights and
Constitution (which the people, not the governments, of those other
countries often regard with envy - what we have as rights they have as
revokable privileges).  And if we expect to retain those rights and
protections, we must not allow them to be gutted because we just GOTTA
have this thing to 'fight crime'.  We have allready have our Bill of
Rights pretty much torn to shreds.  We should not permit more weakining
for yet another 'noble cause', instead we should be trying to repair
the damage.  Our crime problem may have a number of causes, but "too
many rights and safeguards" is not a signifigant one.  A broken court
system and poor police work are a much more signifigant cause as having
"too many rights" (disregarding addressing the root causes for crime,
etc).

BTW - those who suggest that this is just an attack on Clinton, believe
this:  I would be going ballistic reagardless WHO seriously proposed
this thing.  It is just another step in a gradual erosion of our rights
under the Constitution or Bill of Rights.  The last couple of decades
have been a non-stop series of end-runs around the protections of the
Constitution.  It has to stop.  Now is as good a time as any, if it
isn't too late allready.

>-- 
>Brad Templeton, ClariNet Communications Corp. -- Sunnyvale, CA 408/296-0366


-- 
pat@rwing.uucp      [Without prejudice UCC 1-207]     (Pat Myrto) Seattle, WA
         If all else fails, try:       ...!uunet!pilchuck!rwing!pat
WISDOM: "Only two things are infinite; the universe and human stupidity,
         and I am not sure about the former."              - Albert Einstien
