Hackers Underworld 2: Forbidden Knowledge/Hackers Underworld 2: Forbidden Knowledge.iso/LEGAL/EFF505.TXT

Text File | 1994-07-17 | 28KB | 541 lines

·  Newsgroup: comp.org.eff.talk
· Message-ID: <[e-mail]>
·    Subject: EFFector Online 5.05

                  -==--==--==-<>-==--==--==-
                        In this issue:
          Keys to Privacy in the Digital Information Age
        What's Important About the Medphone Libel Case?
                   -==--==--==-<>-==--==--==-

          Keys to Privacy in the Digital Information Age
              by Jerry Berman and Daniel J. Weitzner

   With dramatic increases in reliance on digital media for
communications, the need for comprehensive protection of privacy in
these media grows.  For many reading this newsletter, the point may
seem trite, but the scope of the digital communications revolution (of
which we only stand at the very beginning), poses major new
challenges for those concerned about protecting communications
privacy.  Communication carried on paper through the mail system,
or over the wire-based public telephone network, is relatively secure
from random intrusion by others.  But the same communication
carried, for example, over a cellular or other wireless communication
system is vulnerable to being intercepted by anyone who has very
inexpensive, easy-to-obtain, scanning technology.  If designed and
deployed properly, communications technology has the potential to
actually support and enhance the level of privacy that we all enjoy.
But if, in the design process, privacy concerns are slighted, whether
consciously or not, privacy may be compromised.

   Public policy has a critical impact on the degree of privacy
protection afforded by the new communications systems now being
designed and deployed for public use.  Two ongoing public policy
issues present the challenges of digital privacy protection in sharp
relief.  In the first case, government policy seeks to limit the
introduction of robust encryption technologies.  Motivated by
national security concerns, the National Security Agency is using
export control regulations to discourage the widespread foreign and
domestic adoption of strong encryption systems.  The NSA's
reasoning is if uncrackable encryption is available, the NSA will be
powerless to intercept the communications of foreign espionage
agents operating in and around the United States.  However, the
NSA's restriction on the use of powerful encryption systems limits
the ability of all who rely on electronic communication systems to
protect their privacy.

   Second, on the domestic front, the FBI has proposed a
comprehensive licensing regime that would require all new
communications systems to be certified as "wire-tappable" before
their introduction into the market.  This proposal threatens to force
the widespread use of communications systems that have "back
doors" in them that make them inherently insecure and to expand
the scope of the FBI's wiretapping authority to an unspecified degree.
Although these two proposals are now being pursued in independent
policy arenas, it is critical to view them together in order to
appreciate the full implications for privacy.

Encryption Policy
   For the individual who relies on digital communications media,
reliable privacy protection cannot be achieved without the protection
of robust encryption technology.  While legal restrictions on the use
of scanners or other technology that might facilitate such invasions of
privacy seem to be attractive preventative measures, these are not
lasting or comprehensive solutions.  We should have a guarantee --
with physics and mathematics, not only  with laws -- that we can
give ourselves real privacy of personal communications through
technical means.  We already know how to do this, but we have not
made encryption technology widely available for public use because
of public policy barriers.  The actual debate going on involves both
the National Security Agency and the National Institute of Standards
and Technology.  They are in the process of deciding what version of
a particularly strong type of encryption system ought to be promoted
for public use.  Called Public Key Encryption systems, these coding
systems derive their strength, in part, from the size of the ╥key╙ used
to encrypt the message.

   In examining discrete issues such as the desirability of various
cryptography standards, we take a comprehensive view of "digital
privacy" policy as a whole.  Such a comprehensive view requires a
clear vision of the underlying civil liberties issues at stake:  privacy
and free speech.  It also requires looking beyond the cryptography
questions raised by many to include some of law enforcement's
recent concerns about the pace of digital infrastructure innovation.
For the sake of promoting innovation and protecting civil liberties,
we must also bear in mind the principle that computer security
policy is fundamentally a concern for domestic, civilian agencies.

   Inasmuch as digital privacy policy has broad implications for
constitutional rights of free speech and privacy, these issues must be
explored and resolved in an open, civilian policy context.  This
principle is clearly articulated in the Computer Security Act of 1987.
These questions are simply too important to be decided by the
national security establishment alone.  The structure of the Act arose,
in significant part, from the concern that the national security
establishment was exercising undue control over the flow of public
information and the use of information technology.  When
considering the law in 1986, the Congress asked the question,
"Whether it is proper for a super-secret agency [the NSA] that
operates without public scrutiny to involve itself in domestic
activities...?"  The answer was a clear no, and the authority for
establishing computer security policy was vested in NIST (then the
National Bureau of Standards).

   In this context, we need a robust public debate over our
government's continuing heavy-handed efforts to control
commercially developed cryptography.  It is no secret that
throughout the cold war era, the Defense and State Departments and
the National Security Agency have used any and all means, including
threats of prosecution, control over research and denial of export
licenses, to prevent advanced secret coding capabilities from getting
into the hands of our adversaries.  NSA does this to maximize its
ability to intercept and crack all international communications of
national security interest.

   Now the Cold War is over, but the practice continues.  In recent
years, Lotus, Microsoft, and others have developed or tried to
incorporate powerful encryption means into mass market software to
enhance the security and privacy of business, financial, and personal
communications.  In an era of computer crime, sophisticated
surveillance technologies and industrial espionage, it is a laudable
goal.

   Although NSA does not have the authority to interfere with
domestic distribution encryption systems, its licensing stranglehold
over foreign distribution has significant domestic consequences.
United States firms have been unable to sell competitive security and
privacy products in international markets.  More important, because
the cost of producing two different products is often prohibitive, NSA
policy encourages firms to produce a single product for both
domestic  and worldwide use, resulting in sub-standard privacy and
security  for users both here and abroad.

   While we all recognize that NSA has legitimate national security
concerns in the post cold war era, this is a seriously flawed process.
Foreign countries or entities who want to obtain advanced encryption
technology can purchase it through intermediaries in the United
States or from companies in a host of foreign countries who are not
subject to US export restrictions.  By taking a page out of the
Emperor's New Clothes, NSA opts to act as if the process works by
continuing to block export.

   In order to get some improvement in mass market encryption, the
computer industry had to resort to using the threat of legislation to
get