From: karn@servo.qualcomm.com (Phil Karn)
Subject: Re: RSAREF and RIPEM now available via anonymous FTP
Organization: Qualcomm, Inc
Date: Sat, 9 Jan 1993 10:33:03 GMT

In article <1993Jan8.165638.12844@netcom.com> strnlght@netcom.com (David Sternlight) writes:
>First, there are congressional oversight committees, and believe me
>they take their job very seriously. A complaint to the right committee
>will get a decision reviewed by them. It will be done in secret, since
>the issues are classified, and one may hear only the result, but it
>will be done.

No doubt the members of those congressional intelligence committees
have as much technical expertise and computer experience as the rest
of US industry and academia put together, so the quality and
thoroughness of their reviews of highly technical issues would be of
the same high caliber as a completely public forum, right?

Okay, so maybe I'm overstating this a little. But the cornerstones of
our democracy are government accountability and vigorous public debate
of the issues. And even you must admit that congressmen are
politicians, first and foremost.  Most are lawyers by training. Few,
if any, are engineers. How many do you think have a solid enough grasp
of the technical issues to be able to draw their own conclusions?
Face it, in any technical investigation they'd be forced to take the
word of publicly anonymous experts. And in a case involving
cryptography, these experts would almost certainly be employees of
NSA.

>Second, there are standing oversight committees reporting to the
>President. A former boss of mine who in a previous life was an expert
>in NSA policy issues in the Pentagon, was made a member of the NSA
>oversight board when he went back to civilian life (he was a political
>appointee while in the Pentagon, and part of civilian oversight--see
>below).  He watched over just such issues as those we're discussing,
>closely.

This is what's become pejoratively known as a "revolving door".  I
hope you'll understand if I express just a few qualms about the
impartiality of such a person.

>Third, there is a vigorous "Inspector General" program in the
>intelligence agencies, and enough bureaucratic in-fighting and
>difference of opinion about just such issues as those we're discussing
>that one can expect some informal regulatory process here.

Aren't Inspector Generals nominally in charge of such issues as fraud
and misuse of government funds?

>Fourth, the intelligence and military communities are intensely
>integrated with civilian oversight--not only the heads of agencies,
>but also many key policy makers and administrators. Most are
>"political appointees" responsible to the President in power. In
>particular, the head of the CIA is a civilian Presidential appointee,
>and the NSA is controlled both by the head of the CIA (through the
>Intelligence Community mechanism) by a civilian policy maker at
>Assistant Secretary level in the Pentagon, and by the Defense
>Secretary. All are Presidential appointees, confirmed by the Senate
>after careful hearings.

Right. And when Richard Nixon was President, what happened? The CIA
and NSA became the implements of his personal crusade against his
political enemies. Please explain to me how this "civilian oversight"
mechanism will keep these abuses from happening again when the next
Richard Nixon becomes President.

You'll forgive me if I prefer to trust my personal privacy to the laws
of physics and mathematics than to the integrity of any "civilian
oversight" mechanisms in the Executive Branch.

>It's not at all monolithic, and attempts to demonize the NSA or the
>Government, just because one doesn't understand what's going on are
>extremely wrong-headed.

Agreed. Some of my best friends are NSA employees. :-)

>Having said that, I also agree that strong public scrutiny of current
>and proposed laws and regulations is essential to the democratic
>process, as is vigorous defense of civil rights. My own rule of thumb
>here is Mark Twain's old aphorism: "Trust everyone and always cut the
>cards."

Thank you. I'll "cut the cards" by encrypting my communications with
the strongest ciphers I can find. And by defending my rights by
exercising them. Frequently.

>The U.S. is not the former USSR, and such comparisions are odious.

Why? We belong to the same species, and there's no law of nature that
says what happened there can't happen here. It's only a matter of
degree.

>My point is that the Government isn't monolithic, and that there are
>people in the decision-making apparatus that are concerned about the
>same issues as you and I, and in similar ways.

Quite true. But the institution has a life of its own, quite aside
from the individuals within it. Those individuals may privately agree
wholeheartedly that the policies of the institution are asinine. But
somehow those policies continue. What are we to do about it?

Phil