From: gnu
Date: Sun, 27 Feb 94 00:21:52 PST
To: smb@research.att.com
Subject: Re: I have FOIA'd the Clipper Key Escrow databases
In-Reply-To: <9402252135.AA04902@toad.com>
Message-ID: <9402270821.AA02821@toad.com>
MIME-Version: 1.0
Content-Type: text/plain


> I confess -- I expect one of two outcomes.  First, they may say that
> the database is classified, if only at the level of ``For Official
> Use Only''.

`For Official Use Only' is not a valid classification.  A document
with this marking cannot be withheld under FOIA exemption 1.  You have
to read the Executive Orders on classification -- this category got
cleaned up a LONG time ago.

The current Executive Order gives particular criteria for classifying
things.  If this database doesn't fit any of those criteria, it can't
legally be classified.  I don't believe that this database is covered.
And a judge in a FOIA case can do a "de novo" (from scratch) review of
whether the material is legally classified, by examining it himself in
private -- we don't have to take the agency's word that "there really
is some reason it is classified".

Also, giving classified information to unauthorized people is a major
offense.  They threatened me with that offense one time, over texts
that I found in a library.  If the keys in the database are
classified, they can't give them out to cops.  FOIA requires that they
"segregate" any classified part and give me the rest of what's there,
so if they claim that "well, one key isn't classified, but ten or a
thousand of them are classified", I bet we can (1) get some keys out,
(2) challenge this idea in court.  In particular, it should be
possible to record the LEAF from a particular chip (whether you own
it, or not!) and send it to them in a FOIA request asking for the
matching unit key.  They clearly can map a LEAF to a key (they do it
for cops), and FOIA only requires that you "reasonably describe" the
records you want.  Given their mapping capability, the LEAF is a
reasonable description of the record you want.

> Second, maybe they will release it -- but remember that
> the keys are stored encrypted.  Can you file an FOIA request for the
> key, too?

Either I can get the key, or I can get them to decrypt it for me.  If
they could hold arbitrary government records in secret by simply
encrypting them and classifying the keys, FOIA would be entirely
thwarted; the courts wouldn't let them get away with it.

By the way, I did request the keys:

> This request includes your database of the escrowed key
> components.  This request also includes any ancillary information
> about the database, such as data formats, procedures, standards,
> access methods, memos and documents about its use, access
> software, plans, etc.  If the database itself is stored in encrypted
> form, then this request also includes the computer programs and
> keys required to access it. 

	John