From: Hal Finney <hal@rain.org>
Date: Tue, 19 Nov 1996 08:56:02 -0800 (PST)
To: cypherpunks@toad.com
Subject: Re: Rogue Governments Issuing Policy Tokens
Message-ID: <199611191649.IAA00949@crypt.hfinney.com>
MIME-Version: 1.0
Content-Type: text/plain


From: "Timothy C. May" <tcmay@got.net>
> The problem (for GAK) of "rogue governments" is this: a government such as
> Libya or Panama, henceforth to be known as "Rogueitania," issues policy
> cards to all of its citizens, and to all those visiting Rogueitania, and
> perhaps through the mail to anyone who pays some fee.

I don't think this would happen.  Some kind of secret information or
hardware is going to be needed to create policy tokens.  (Otherwise
anybody could make one.)  That means that HP, and therefore ultimately
the U.S. government, is going to have to approve those governments which
are allowed to issue such tokens.  HP will have to provide them some
special hardware or something to make them.  The tokens will only be
accepted if they have proper secrets inside them.

I can't see the U.S. allowing Libya and similar countries to create policy
tokens.  The whole point of this exercise is to prevent these countries
from being able to use strong crypto.  So they will certainly not be on
the approved list.

Does this represent an attempt to establish a de facto U.S. hegemony over
the world, where the U.S. government gets to decide which other governments
have access to crypto?  Not necessarily; other countries will still have
the option to use computers made outside the U.S.  The fact of international
competition will still exist.

If the HP initiative does become a widespread standard (which I think is
unlikely at this point) then we will see the same sorts of flight towards
non U.S. computers that we now see towards non U.S. crypto companies.
Why should an Israeli company buy an American computer with a policy chip
that is ultimately under the control of the U.S. government when they
can get one locally made which has no such restrictions?

And of course all this focus on hardware tokens ignores the fact that
the alternative of software-only crypto will still be present, both for
the domestic market and for the international market where the products
don't come from the U.S.  This will represent additional competition
which the HP proposal must face.

For these reasons I don't think the HP idea solves the export problem
for U.S. hardware and software makers.  And the response by opinion leaders
has ranged from ho-hum to negative, despite the self-serving cheerleading
by HP management.  Companies which try to sell computers with these chips
in them risk getting a "big brother inside" (to use Tim's very effective
slogan) reputation.  I think this initiative is going nowhere.

Hal