From: gardner@convex.com (Steve Gardner)
Subject: Re: Demons and Ogres
Organization: CONVEX Computer Corporation, Richardson, Tx., USA
Date: Tue, 17 Nov 1992 16:24:45 GMT
X-Disclaimer: This message was written by a user at CONVEX Computer
              Corp. The opinions expressed are those of the user and
              not necessarily those of CONVEX.

In article <1992Nov17.065526.15487@cactus.org> ritter@cactus.org (Terry Ritter) writes:
>>[...] Haven't you heard of "thought crime?"  The idea is alive
>>and well and you seem bound and determined to help government
>>create and enforce it.
>
> Nonsense.
>
> First of all, I just made a *proposal*; if you have a better
> one, let's hear it.
	Yeah.  My proposal is to allow completely unfettered
	cryptography by citizens.  The alternative is to propose
	laws that are:
		1. not enforceable against those they claim to limit
		2. unduely restrictive of personal freedom (privacy)
		3. contributing to widespread disregard for the law
	Copyright laws had to be relaxed because of new technology.
	What you are proposing is analogous to tightening up laws
	"broken" by technology.  It won't work and you don't seem
	to be able to accept that.  
	

> Or, if you have a better approach to arguing for tolerating the
> inevitable misuse of cryptography, let's hear that.
	If you have a better approach to arguing for tolerating
	the inevitable misuse of computers lets hear that.
	Don't you see they are equivalent?  The only difference
	being that more people would realize immediately that you
	were on a fool's errand if you proposed that computers be
	registered like firearms.  I can't believe that people have
	taken this proposal as seriously as they have.  It is one of
	the most patently absurd proposals since the Indiana legislature
	decided to mandate PI.


> My proposal was to reveal plaintext *under due process*; if
> the courts can't be trusted to uphold your rights, exactly what
> part of government *will* uphold your rights?
	Now you're cooking.  NO PART!  The unconscionable war on (some)
	drugs has almost totally corrupted the government.  We now have
	a situation where your property can be seized without due
	process by the government.  That has corrupted both federal
	and local Law Enforcement agencies to an extent unheard of 
	before.  Law enforcement agencies on all levels routinely
	STEAL cash from individuals and yet file no charges against
	them.  This is patently unconstitutional but the courts have
	done nothing to prevent it.  We are well on our way to a 
	confrontation with a police state.  Why do people never see
	it until it begins to carry them off to the camps.  Germany didn't
	wake up one morning with crematoria.  It started slowly and the
	rights of the german people were slowly eroded by people
	CLAIMING to act in their interests.  There are always Quislings
	who want to compromise with those who would crush us beneath
	their jackboots.  There is no compromise possible with those
	that would establish a police state.

>This turns
> out to be a lot easier *before* we understand the negative social
> effects of that technology.
	The luddites rear their heads once again.  Where do you get
	this fear of the social consequences of technology?

> The government *has* an implicit "right" under The Fourth
> Amendment to conduct searches and seizures, provided only that
> they obtain an explicit warrant based on probable cause.  The
> government *has*, and always has had, the "right" to "look over
> our shoulders," and that is enshrined in The Bill of Rights.
> My proposal has *not* created this "right."
	The Bill of Rights was enacted to LIMIT government authority
	not enshrine it.

> My proposal, if you would read it, would require *the user* to
> reveal the plaintext.  If the file was GIF or ZIP and *the user*
> could demonstrate that, it would be revealed.  No programs need be
> registered.
	Have you considered how the user might do this?  Suppose he
	needs to tinker a bit because his program to reveal the
	text is parameter driven?  Or buggy? Is he allowed to?  Is this
	really practical?  Would the government really allow him
	to work on his system to get it to reveal the plain text?
	Have you thought very much about the mechanics of this
	proposal?

> You are right, though, that the transmission of random-like files
> would not be a good indicator of criminal activity.  Naturally,
> if the police had enough evidence to get a warrant to search for
> records of criminal activity, and encountered lots of random-like
> files, they might want to see what those files contained.  If the
> files were innocuous, the defendants would have no reason to
> refuse.
	"If you have done nothing wrong then you have nothing to hide"
	Right.  Suppose that someone who is accused of a crime has
	embarrassing things but not criminal things encrypted on his
	disk?  Does he have to reveal steamy love letters to
	prove he is not a criminal?  

> Nonsense.  My proposal is that, given the ciphertext, the user
> would be required to make it plain.  This means that there would
> be a responsibility to log old *keys*, not conversations.
	This is totally impractical.  Think about it.  What if I
	have some old mail that I wish to erase but don't erase
	completely and the police use disk sector scavenging to get them?
	I throw the key away because I am through with the mail.
	I don't need it anymore so I destroy the key and delete the
	file.  I cannot be compelled (it is not just my will but my
	capability that is at question now) to reveal what I don't
	know.  There is no way for the government to know whether
	I am sincere in my ignorance.  Your proposal is utterly unworkable.  

> Yes, future systems may have to log session keys.
	Right.  And what if the disk goes down with no backup?
	How could a computer professional propose such a patently
	silly "solution".  

> It certainly is going to be difficult to discuss proposals if they
> must spring full-blown and precisely-worded into being.  It is
> obvious to me that by "anyone using" I mean "whoever is in control
> of such enciphering."  You would not be convicted of "Failure to
> Reveal" unless you were in control and "somehow" failed to log
> your keys.
	How will the authorities know the difference?  Think about
	it.  This idea is totally without merit.  

> For some reason you apparently feel that *you* can lecture *me*
> on the cost of rights and how they are obtained.  It just might
> be possible that I am *far* more personally aware of the cost of
> rights, and what they mean to us, than you appear to be.
	If so, you don't show it.
	What's more, you seem to feel that *you* can lecture *us*
	on what our responsibilty is as citizens and computer
	professionals is.  If you think about it, that is both our
	rights.  Welcome to the land of free speech.  You find my
	positions offensive and I find yours offensive.  The marketplace
	of ideas will judge, hopefully on the merits.

>>Why are you helping
>>the cops?
>
> First, I got into this by helping *us*, not the cops.
	That is patently absurd.

> Our *problem* is that ordinary people can be swayed by heinous
> cases, and we have very few arguments which would convince
> ordinary people that other ordinary people should have
> unrestricted access to cryptography.  Does that sound to you
> like a prescription for legislative success?
	You steadfastly refuse to listen to people who tell you that
	legislation of the form: "Pi will be legislated to be equal
	to 22/7 by force of law" is not only silly but unworkable.
	It matters not whether it is popular or not.  Widespread
	xerography broke copyright law not vis-versa.  Keep that
	in mind.  You will not conquer the power of technological
	change with mere legislation, no matter how popular and
	emotional the appeal.  


> If it fell to you to argue the proposition, we could absolutely
> *guarantee* "they" would win.  I hope we can improve our odds
> by developing arguments of somewhat higher caliber.  So far,
> we have not had much success, however.
	You refuse to regard any position that says that your
	proposal is not needed as a valid position.  


> Nonsense.  It is precisely *because* our interests differ that I
> seek a defensible position.  Completely unregulated cryptography
> may not be defensible.
	Will you listen to what people are saying?  Regulated
	cryptography is NOT POSSIBLE without instituting a police
	state.  

> I believe that the completely unregulated and absolutely free
> use of cryptography may indeed be dangerous for society.
	Then all is lost because neither you nor congress can stop
	the march of progress in this area.  

> I am more than willing to be shown wrong.
	When?  I thought you already had been.


						smg