From: declan@well.com (Declan McCullagh)
Date: Fri, 18 Oct 1996 14:12:09 -0700 (PDT)
To: cypherpunks@toad.com
Subject: Brock Meeks on NSA domestic codebreaking, from Muckraker
Message-ID: <v01510101ae8c60523b1c@[204.62.128.229]>
MIME-Version: 1.0
Content-Type: text/plain


This is Brock's unedited Muckraker that's up at HotWired today
(http://www.muckraker.com). Forwarded with permission. --Declan

**********

Crypto Mission Creep
By Brock N. Meeks (brock@well.com)

The Justice Department has, for the first time, publicly acknowledged
using the code-breaking technologies of the National Security Agency, to
help with domestic cases, a situation that strains legal boundaries of
the agency.

Deputy Attorney General Jamie Gorelick admitted in July, during an open
hearing of the Senate's Governmental Affairs permanent subcommittee on
investigations, that the Justice Department:  "Where, for example, we
are having trouble decrypting information in a computer, and the
expertise lies at the NSA, we have asked for technical assistance under
our control."

That revelation should have been a bombshell.  But like an Olympic
diver, the revelation made hardly a ripple.

By law the NSA is allowed to spy on foreign communications without
warrant or congressional oversight.  Indeed, it is one of the most
secretive agencies of the U.S. government, whose existence wasn't even
publicly acknowledged until the mid-1960s.   However, it is forbidden to
get involved in domestic affairs.

During the hearing Sen. Sam Nunn (D-Ga.) asked Gorelick if the President
had the "the constitutional authority to override statutes where the
basic security of the country is at stake?"  He then laid out a
scenario:  "Let's say a whole part of the country is, in effect,
freezing to death in the middle of the winter [because a power grid has
been destroyed] and you believe it's domestic source, but you can't
trace it, because the FBI doesn't have the capability.  What do you do?"

Gorelick replied that:  "Well, one thing you could do -- let me say
this, one thing you could do is you could detail resources from the
intelligence community to the law enforcement community.  That is, if
it's under -- if it's -- if you're talking about a technological
capability, we have done that."   And then she mentioned that the NSA
had been called on to help crack some encrypted data.

But no one caught the significance of Gorelick's' statements.  Instead,
the press focused on another proposal she outlined, the creation of what
amounts to a "Manhattan Project" to help thwart the threat of
information warfare.  "What we need, then, is the equivalent of the
'Manhattan Project' for infrastructure protection, a cooperative venture
between the government and private sector to put our best minds together
to come up with workable solutions to one of our most difficult
challenges,'' Gorelick told Congress.  Just a day earlier, President
Clinton had signed an executive order creating a blue-ribbon panel, made
up of several agencies, including the Justice Department, the CIA, the
Pentagon and the NSA and representatives of the private sector.

Though the press missed the news that day; the intelligence agency
shivered.  When I began investigating Gorelick's statement, all I got
were muffled grumbling.   I called an NSA official at home for comments.
"Oh shit," he said, and then silence.   "Can you elaborate a bit on that
statement?" I asked, trying to stifle a chuckle.  "I think my comment
says it all," he said and abruptly hung up the phone.

Plumbing several sources within the FBI drew little more insight.   One
source did acknowledge that the Bureau had used the NSA to crack some
encrypted data "in a handful of instances," but he declined to
elaborate.

Was the Justice Department acting illegally by pulling the NSA into
domestic work?   Gorelick was asked by Sen. Nunn if the FBI had the
legal authority to call on the NSA to do code-breaking work.   "We have
authority right now to ask for assistance where we think that there
might be a threat to the national security," she replied.  But her
answer was "soft."   She continued:  "If we know for certain that there
is a -- that this is a non-national security criminal threat, the
authority is much more questionable."  Questionable, yes, but averted?
No.

If Gorelick's answers seem coy, maybe it's because her public statements
are at odds with one another.   A month or so before her congressional
bombshell, she revealed the plans for the information age"Manhattan
Project" in a speech.   In a story for Upside magazine
<http://www.upside.com/online/columns/cybersense/9607.html#one>, by
old-line investigative reporter Lew Koch, where he broke the story,
Gorelick whines in her speech about law enforcement going through "all
that effort" to obtain warrants to search for evidence only to find a
child pornography had computer files "encrypted with DES" that don't
have a key held in escrow.  "Dead end for us," Gorelick says.  "Is this
really the type of constraint we want? Unfortunately, this is not an
imaginary scenario. The problem is real."

All the while, Gorelick knew, as she would later admit to Congress, that
the FBI had, in fact, called the NSA to help break codes.

An intelligence industry insider said the NSA involvement is legal.
"What makes it legal probably is that when [the NSA] does that work
they're really subject to all the constraints that law enforcement is
subject to."    This source went on to explain that if the FBI used any
evidence obtained from the NSA's code-breaking work to make it's case in
court, the defense attorney could, under oath, ask the NSA to "explain
fully" how it managed to crack the codes.  "If I were advising NSA today
I would say, there is a substantial risk that [a defense attorney] is
going to make [the NSA] describe their methods," he said.  "Which means
it's very difficult for the NSA to do its best stuff in criminal cases
because of that risk."

Some 20 years ago, Sen. Frank Church, then chairman of the Senate
Intelligence Committee, warned of getting the NSA involved in domestic
affairs, after investigating the agency for illegal acts.  He said the
"potential to violate the privacy of Americans is unmatched by any other
intelligence agency."   If the resources of the NSA were ever used
domestically, "no American would have any privacy left . . . There would
be no place to hide," he said.  "We must see to it that this agency and
all agencies that possess this technology operate within the law and
under proper supervision, so that we never cross over that abyss.  That
is an abyss from which there is no return," he said.

And yet, the Clinton Administration has already laid the groundwork for
such "mission creep" to take place, with the forming of this "Manhattan
Project."

But if the Justice Department can tap the NSA at will -- a position of
questionable legality that hasn't been fully aired in public debate --
why play such hardball on the key escrow encryption issue?

Simple answer:  Key escrow is an easier route.  As my intelligence
community source pointed out, bringing the NSA into the mix causes
problems when a case goes to court.   Better to have them work in the
background, unseen and without oversight, the Administration feels. With
key escrow in place, there are few legal issues to hurdle.

In the meantime, the Justice Department has started the NSA down the
road to crypto mission creep.  It could be a road of no return.

Meeks out...