From: jim bell <jimbell@pacifier.com>
Date: Wed, 20 Mar 1996 18:23:49 +0800
To: Declan McCullagh <cypherpunks@toad.com
Subject: Re: Dorothy Denning attacks Leahy's crypto bill
Message-ID: <m0tzIxu-0008yqC@pacifier.com>
MIME-Version: 1.0
Content-Type: text/plain


At 09:45 PM 3/19/96 -0800, Declan McCullagh wrote:
>I may have to adjust my position on Leahy's bill. Any legislation that
>Dorothy Denning attacks so virulently must be worth passing. 


That position would be a serious mistake.  Denning knows that she is a 
negative barometer:  Her position will be looked on with contempt by most of 
us.  That, ironically, makes her "useful" to the government should they want 
to sneak one past us.  I think we've already established that this bill 
sucks, although it could become good with major repairs.  Problem is, 
nothing that Denning wants to do to the bill constitutes an improvement, 
except not passing it in the first place!

-----------------------------------------------------------------

>
>Date: Tue, 19 Mar 96 14:53:35 EST
>From: denning@cs.cosc.georgetown.edu (Dorothy Denning)
>To: farber@central.cis.upenn.edu
>                                                   March 14, 1996
>                                        
>The Honorable Patrick Leahy
>United States Senate
>Russell Building, Room 433
>1st and C Streets, NE
>Washington, DC 20510
>
>Dear Senator Leahy:
>
>As author, scholar, lecturer, researcher, and consultant to the
>government and industry in cryptography and information security, I am
>concerned that S.1587, the "Encrypted Communications Privacy Act of
>1996," is not in balance with society's needs.  By removing practically
>all export controls on encryption, the bill will make it far easier for
>criminals, terrorists, and foreign adversaries to obtain and use
>encryption that is impenetrable by our government.

"Far easier"?  That's an odd statement, because the export of encryption is 
easy with or without restrictive laws.  How much trouble is a "criminal or 
terrorist" going to risk by violating a few measly export laws?  Besides, 
Denning hasn't established that encryption will be any better inside the 
country than without; this means that export controls will have no effect 
even in the most optimistic scenario.

>The likely effect
>will be to erode the ability of our law enforcement and intelligence
>agencies to carry out their missions. 

Since when is this news?  Freedom costs.  But it also pays.

> This is not consistent with your
>own findings in the bill which recognize the need for a "national
>encryption policy that advances the development of the national and
>global information infrastructure, and preserves Americans' right to
>privacy and the Nation's public safety and national security."
>
>I am concerned that the proposed legislation responds only to a loud
>cry for assistance and is not the reasoned and practiced position of
>our multinational corporations.

Of what significance is the "practised position of our multinational 
corporations"?  They'd sell us out if it preserved THEIR rights.  I'm more 
concerned with the rights of the individual.


> At the International Cryptography
>Institute, which I chaired in September 1994 and 1995, our discussions
>did not find that this unrestricted distribution of encryption
>technology was required to satisfy business objectives. 


Notice that we've already established that this bill in no way produces an 
"unrestriction distribution of encryption technology."  Wish it did, but it 
doesn't.


[much Denning-crap deleted]


>The Commerce/NSA study did acknowledge that the existence of foreign
>products claiming strong encryption could have a negative effect on
>U.S. competitiveness.  However, by allowing encryption services to be
>sold separately from the applications software that uses them, CAPIs
>will make it extremely unlikely that general-purpose software will be
>substantially effected by export controls.

That's odd.  Most people around here seem to be of the opposite opinion:  
CAPI's seem to be used by the government to justify controls even on 
software that has no encryption capability.


  Even security-specific
>products, which are a growing industry, can use CAPIs to separate out
>the encryption component from the main product (e.g., firewall).
>Moreover, if keys can be held in other countries under appropriate
>bilateral agreements as noted earlier, export controls need not
>substantially impact encryption products.

Notice that she seems to be making policy for the government, yet again.


>
>Export controls are often blamed for the lack of security in our public
>infrastructure.  The Commerce/NSA study found "little evidence that
>U.S. export controls have had a negative effect on the availability of
>products in the U.S. marketplace," although they "may have hindered
>incorporation of strong encryption algorithms in some domestic
>mass-market, general-purpose products."  There are many factors which
>have played an even larger role in the general lack of security we find
>on the Internet: the high cost and low demand for security, the
>difficulty of designing systems that are secure, pressure to bring new
>products to market before their security implications are understood,
>the willingness of users to take risks in favor of acquiring new tools
>and services, and lack of a public key infrastructure to support
>encryption on a national and international basis.  Many systems are so
>riddled with security holes that any would-be attacker can gain access
>to the system itself, and from there access to plaintext data and
>keys.  Malicious code can be injected into a victim's system through
>electronic mail, documents, images, and web browsers; once there, it
>can transmit sensitive data back to its owner.  Keyboard sniffers can
>capture a user's keystrokes before they are ever encrypted.  Thus,
>while export controls have played a part in the slow integration of
>strong encryption into software and systems, they are not responsible
>for most of the security vulnerabilities we see today.  Moreover, most
>of these vulnerabilities are remedied with non-cryptographic controls
>(e.g., process confinement, trusted systems engineering, biometrics,
>and location-based authentication) or with cryptographic techniques for
>authentication, data integrity, and non-repudiation, which are exempt
>from State Department export controls.  I do not mean to suggest that
>encryption is not important.  In fact, it is essential to protect
>against certain threats.  However, it must be kept in perspective.  The
>use of encryption for confidentiality protection is but one small,
>albeit important, piece of an information security program.
>
>The provisions is S.1587 regarding trusted key holders could have the
>benefit of increasing public trust in key holders.  However, I have
>some concern that the current provisions may be overly restrictive.
>Thus far, we have practically no experience with the operation of third
>party key holders and the circumstances under which they will be called
>upon to provide keys or decryption assistance.  It will be extremely
>important that the provisions allow enough flexibility to accommodate
>legitimate use of the data recovery services of key holders for
>criminal investigations, civil litigation, and intelligence
>operations.  The liability risks to key holders should not be onerous.
>The definition of key holder and exact wording in the bill may also
>need some refinement in order to accommodate existing and proposed
>methods of trusted third party encryption.
>
>Encryption policy is a difficult and often emotional issue. 

It's only emotional because of malicious and counter-productive efforts by 
government, and government suck-ups like Denning.

 It is
>important that Congress work closely with the Administration, industry,
>and other interested parties to develop the best legislative strategy
>for promoting information security on the national and global
>information infrastructure without diminishing the ability of our law
>enforcement and intelligence agencies to protect the public safety and
>national security.  Export liberalization should proceed cautiously,
>tied to key escrow or other methods that accommodate the needs of the
>government as well as those of users and industry.  The
>Administration's plans to liberalize export controls on software key
>escrow is a good next step.  As trust and confidence in key escrow
>grows, the export of virtually unlimited strength encryption systems
>may be possible.  Because export controls are our only lever for
>controlling the spread of encryption, they should be used to their full
>advantage.  Decisions to liberalize these controls must be fully
>informed by classified national security information as well as by
>economic analysis and market studies.
>
>Law enforcement agencies are encountering encryption with ever greater
>frequency. 

Excellent!  It means they're being held back!

> Within a few years, the successful execution of practically
>all court-ordered intercepts and searches and seizures is likely to
>depend on their ability to decrypt communications and stored
>information.  If the encryption cannot be broken, it could be
>impossible to successfully investigate or prosecute those cases.

Bullshit!


[more Denning-shit deleted]

>I will be pleased to meet with you and the committee for comment and
>questioning, or to assist in any way I can with the development of a
>balanced approach to encryption legislation.
>
>Yours respectfully,
>
>Dr. Dorothy E. Denning
>Professor of Computer Sciences
>Georgetown University
>denning@cs.georgetown.edu
>http://www.cosc.georgetown.edu/~denning


I refuse to be used by Denning.  If we make the mistake of supporting this 
bill merely because she claims to oppose it, we would merely be falling into 
her (and the government's) trap.