In article <1993Apr17.061326.16130@clarinet.com> brad@clarinet.com (Brad Templeton) writes: >In article <tcmayC5M2xv.JEx@netcom.com> tcmay@netcom.com (Timothy C. May) writes: >>Getting the court order to reveal the key *also* makes decipherable >>all *past* conversations (which may be on tape, or disk, or whatver), >>as I understand the proposal. I could be wrong, but I've seen no >>mention of "session keys" being the escrowed entities. > >True in theory.  In practice?  The technology of cellular phones will >probably be spread spectrum and quite difficult to record the crypttext >without the key.  If the frequency path depends on they key, as I >understand it to, it *could* be made effectively impossible to record.  I am not an expert in the cryptography science, but some basic things seem evident to me, things which this Clinton Clipper do not address. The all pertain to opportunites for abuse, and conclusions based on what I have seen the membership of this group (except for two notable persons) agree to.  If anything bad is possible by the government in theory, it almost always ends up happening in fact.  So the key is to make abuse IMPOSSIBLE.  Question authority, and remember power DOES corrupt.  I think one has to regard this whole idea in the sense that it WILL be expanded to include other data forms, such as data transfer and stored data. and as such should be treated as if it were expanded (or such expansion will be almost impossible to stop, using Clipper as a precident). There was a hint of that in the proposal, remember.  That said, please bear with me, I am not very articulate, so I take more words to say what others could say much more briefly.  Thank you.  >Once it hits land you can record it if you have telco access.  The >telco isn't supposed to give that without a warrant.  That's the rule >today.  As I suggested this is NOW.  The hint is in the proposal that this or similar proposals are being considered for other forms of encryptions such as data transfer, data files, and such, largely dependent on how this thing is accepted or flies.  I think one would be wise to treat this in the manner one would when (not if) it gets expanded to other areas than cellular phones.  I think this is guaranteed to happen, if this proposal gets by.  Salami politics.  It has been and is used in several other areas, it is certain to be used here.  Government is not going to easily give up on the idea that they should be able to eavesedrop whenever they want to.  'Court order required' has proven to be a rather flimsy guarantee.  If the case warrants, they can always sieze the material, and force one to give the key, or sit in jail forever on periodically renewed contempt charges.  So it is not denying the justice system the information, nor the ability to lock someone up if guilty (or refuses to divulge the means to access the info - this is not protected under the Fifth - one can be forced to perform ACTS that would result in divulging incriminating evidence).  So, blocking restrictions on private encryption is not preventing LEGITIMATE law enforcement - it does make ILLEGITIMATE law enforcement a bunch more difficult.  Especially fishing expeditions without the target's knowlege.  Don't give up the right to be safe from that - that should be non-negotiable, and Clinton and Co. know it (which is probably why they quietly developed this thing, figuring if they get it this far, they can ram it on through).  How come those consulted could be roughly described as "us insiders"?  They cannot quietely IMPLIMENT it though, when they ban other schemes to ensure its exclusive use.  Hence the nice PR document to try and reassure everyone. Don't buy into it.  Has government really earned that kind of trust, past or future?  To be secure and free, one must keep government honest and the only way to do that is to make abuse IMPOSSIBLE, not 'unlikely' or 'difficult'.  >But even so, the evidence would not be admissible, I think, unless the >judge so ordered.  I think that even interception of the crypttext >without a warrant would be illegal.   Cops can't record today's plain >cellular calls and then ask a judge, "Hey, can we have permission to >listen to those tapes?" can they?  So what?  One could use information gained by re-use of the keys (saved after the last case was finished) or other means (master key, backdoor, easily broken algorithm) to find other evidence which, given to a judge, would authorize a tap which wouldn't have been possible otherwise.  This has been the more common manner of abuse of wiretaps in the past...  For local cops, this might be workable to keep them honest, but the Feds have a workaround somehow, BET on it.  Does anyone really believe for example, that the government will use a scheme NSA cannot listen in on scanning for keywords - either easily defeated in realtime or via a 'master key'?  I sure don't.  This whole thing sounds like something to eliminate the need to use old-fashioned police work to build a case.  In the past, eavesdropping was rather easy (with or without a court order).  I think the Law Enforcement community has become a bit spoiled, and will resist changes that require them to revert to using old-fashioned detective work.  I just find it somewhat surprising coming from a bunch that cares so much about civil and individual rights, that "puts people first".  The question is "put people first" to WHERE?  With the innards not being revealed, how is one to be sure there DOESN'T exist a 'master key' for use by NSA, etc (so they can do their keyword scan, etc on conversations they routinely monitor, without a specific court order)?   Remember, the cellular phone limitiation is only TEMPORARY. Bet on it.  And so far I have not heard about police telling people that they have been tapped and nothing incriminating was found.  What is to keep them from simply keeping the keys on file for 'next time'? After awhile, they would have quite a collection.  Kept especially for folks they deem 'disruptive'.  And if they get only one key, that would reduce the search space a lot, unless it is an RSA scheme.  Remember Nixon years?  Need for court orders really slowed them down, didn't it?  And unless the escrow accounts are not government controlled (fat chance! I see one ending up being under, say Treasury, the other under Justice :-)) it could be worth some serious bucks to some folks to get keys to a competitor's Clinton Clipper (or descendent when this idea is expanded to be used for all non-government encryption).  Enough bucks would get one the keys or the innards for this algorithm.  Perhaps not an important concern, but given past government behavior and the other problems...  >>worse, of course, if the government then uses this "Clinton Clipper" >>to argue for restrictions on unapproved encryption. (This is the main >>concern of most of us, I think. The camel's nose in the tent, etc.) > >Yes, that is a major concern, but I think that they think they can >win just by having 99.5% of the USA use this system.  They don't even >have to care about the cautious .5% that's left.  They don't catch the >really smart crooks anyway.   John Gotti, who would have to be retarded >not to realize he was likely to be wiretapped, glibly chatted away >on his tapped phone about murder plans.  That's why he's in jail now. >Hard to believe, but true.  What will one do when it is expanded to data storage encryption?  You can BET that if Clipper is accepted, that will be next on the agenda. It is even hinted at in the proposal - read it carefully...  Expect the argumet "well, if you got nothing to hide..."  Fine. Then using that argument, one should not object to video cameras being installed in every room of one's home.  Granted - an exteme expansion of the idea but the principle holds.  Private stuff should remain private, even from a govt fishing expedition.  And laws/rules may change in the future as to 'safeguards'.  When it comes to the Fed Government, safeguards are pretty meaningless, if they want to do/get something.  Don't work so hard to give up some rather treasured rights, or establish bad precidents, please.  The price could be hell to pay, later.  >This scheme can succeed without laws forbidding more, which people would >fight a lot harder.  They like this enough that they are dropping the so >called "Digital Telephony" proposal, according to rumours.  However the >meaning of that is complex, since they still want to get at the crypttext >on telco systems, and that requires a bit of work.  People would fight laws forbidding more NOW, but in, say two years, because we have this 'crisis' situation which MUST be addressed by some 'drastic action', just this added reasonable restriction will only bother those who have someting to hide... etc.  Please don't buy into it.  If the Clinton Clipper is so very good, why not make its algrithm public so many people can exchange ideas and examine it, rather than a few isolated 'respected experts' (respected by whom?  for what?  Perhaps a certain professor who likes key banks would be one of the selected experts... this does seem to expand on some ideas the person was advocating, if I recall :-).  How would anybody know that what the experts examine is the same as what will end up being used in the Clipper Chip, if it is kept secret?   Perhaps the Clipper will use a crippled version (with a 'master key' provision), or features not present in the version subjected for study and evaluation by the experts.  And who chooses the expertes?  The government?  No conflict of interest there... :-)  And isn't it a REQUIREMENT for any decent encryption scheme that it NOT have its effectiveness reduced by having the algrorithm widely known? I was lead to believe that one should assume the other side has everything you have, except for the key(s)... I recall ideas presented to this group are rejected if a requirement exists the algorithm be secret...  Another question - since it is a safe bet this Clipper thing would not be used for government security, they are regarding it as not real secure but "good enough" for common folk.  I think I would like to see a full description (not a PR non-statement) of just what "good enough" means? I think when saying how strong it is, "good enough" really means "not very".  The excuse that other countries have these restrictions is not acceptable:  Other countries do not have our Bill of Rights and Constitution (which the people, not the governments, of those other countries often regard with envy - what we have as rights they have as revokable privileges).  And if we expect to retain those rights and protections, we must not allow them to be gutted because we just GOTTA have this thing to 'fight crime'.  We have allready have our Bill of Rights pretty much torn to shreds.  We should not permit more weakining for yet another 'noble cause', instead we should be trying to repair the damage.  Our crime problem may have a number of causes, but "too many rights and safeguards" is not a signifigant one.  A broken court system and poor police work are a much more signifigant cause as having "too many rights" (disregarding addressing the root causes for crime, etc).  BTW - those who suggest that this is just an attack on Clinton, believe this:  I would be going ballistic reagardless WHO seriously proposed this thing.  It is just another step in a gradual erosion of our rights under the Constitution or Bill of Rights.  The last couple of decades have been a non-stop series of end-runs around the protections of the Constitution.  It has to stop.  Now is as good a time as any, if it isn't too late allready.  >--  >Brad Templeton, ClariNet Communications Corp. -- Sunnyvale, CA 408/296-0366