From: Greg Broiles <gbroiles@netbox.com>
Date: Fri, 8 Nov 1996 00:20:50 -0800 (PST)
To: "Timothy C. May" <tcmay@got.net>
Subject: criminalizing crypto use
Message-ID: <3.0b28.32.19961108001437.00701700@mail.io.com>
MIME-Version: 1.0
Content-Type: text/plain


At 04:43 PM 11/7/96 -0800, Tim May wrote:

>* Intent. It's hard to imagine someone being imprisoned for using
>cryptography, except perhaps in wartime conditions. I may be wrong. Also,
>there are deep Constitutional issues we haven't been much discussing.

One change I suspect we'll see sooner or later on the Federal side is an
amendment of the Sentencing Guidelines to include an upward adjustment for
the use of encryption to frustrate law enforcement efforts. This wouldn't
be a conviction for using crypto, but would result in harsher penalties for
people convicted of other crimes where they happened to use crypto in a way
connected with the crime. (Keeping child porn or records of a forbidden
business on an encrypted disk volume, using PGPfone to conspire across long
distances, etc.)

As an example, less than a year ago, Congress directed the Sentencing
Commission (a sub-branch of the federal Judiciary) to amend the guidelines
to enhance the penalties by at least two levels for using a computer to
advertise or "ship" a visual depiction of child porn. Pub. L. 104-71, Sec.
2 (12/23/95). 

Sentences for felony and some misdemeanor convictions in Federal court are
usually based upon a payoff matrix, where a crime is assigned a "base
offense level" (higher levels indicate more serious crimes), which is then
adjusted upwards for aggravating factors (like the use of a gun, or an
elderly victim, or prior convictions) and mitigating factors (like
admission of responsibility or cooperating with law enforcement) to arrive
at a final score, which indicates a relatively narrow range of potential
sentences. Adding an enhancement for crypto use seems like an easy way for
legislators to "get tough on crypto" while avoiding Constitutional issues.
(It also strikes me as pointless; I have yet to run across anyone who
doesn't work in criminal law (or isn't in a federal pen) who seems to have
any idea that the sentencing guidelines exist, much less take them into
account when planning crimes. They're pretty complex.) 

I feel a little wary about saying this because I haven't heard anyone
mention it before. I have no secret insider knowledge. But I think a step
like this is probably transparent to the folks in the Justice Dept who work
on computer crime and crypto stuff, so I'm probably not giving anyone any
ideas. I hope not. Federal court is tough enough for defendants already. 

Folks who want to know more about the Sentencing Guidelines might take a
look at <http://www.ussc.gov>. They've done a nice job of putting
everything on the web, so you can scratch your head in puzzlement at home,
instead of at the law library. Many states also use a similar system for
sentencing in criminal cases, but they may not be crypto-savvy enough to
think of adding extra penalties for crypto use. 


--
Greg Broiles                | "In this court, appellant and respondent are the
gbroiles@netbox.com         |  same person. Each party has filed a brief."
http://www.io.com/~gbroiles |  Lodi v. Lodi, 173 Cal.App.3d 628, 219 Cal.
                            |  Rptr. 116 (3rd Dist, 1985)