From: harka@nycmetro.com
Date: Sat, 12 Apr 1997 00:21:33 -0700 (PDT)
To: cypherpunks@toad.com
Subject: german crypto laws
Message-ID: <199704120722.DAA05153@linux.nycmetro.com>
MIME-Version: 1.0
Content-Type: text/plain



-----BEGIN PGP SIGNED MESSAGE-----

This is a press release of the german Forum of Computer
Professionals for Peace and Social Responsibility (FIfF). It
discusses the crypto-proposals of the german government, which are
similar to the UK and US proposals.
Please note, that this is my own "unofficial" translation of it. All
phrases in [] are either my additional comments or are phrases, that
I couldn't translate directly.
If you want the original german text, e-mail me.

Ciao

Harka

====================================================================
                         P R E S S  R E L E A S E
                    of the Forum of computer professionals for
                         peace and social responsibility
                              Bonn, in April, 1997

     Cryptography proposals reverse constitutional rights

The Forum of computer professional for peace and social
responsibility declare the following to the recently made-public
plans and intentions to regulate cryptography internationally and
nationally:

Very obvious are the efforts to the regulation of cryptography.
After several tries guide lines to crypto-politics were worked out
at the end of march by the OECD[1]. Almost simultaneously plans from
the United States[2] and the United Kingdom[3] for new
national crypto regulations became public. Further developments
suggest, that also the [german] Federal Government has worked out
specific plans to regulate cryptographic technology in Germany.


On the current level of planning the [german] Federal Government is
considering three variations of regulation[5]:

1. A key-escrow-solution, in which providers of cryptographic
   services have to provide the keys of customers to
   law-enforcement, if necessary.

2. A key-escrow-solution, in which only federally licenced
   providers of cryptographic services are permitted to operate.

3. A key-escrow-solution with simultaneous prohibition of all not
   federally permitted technologies.

The FIfF is seeing herein a serious threat to the developement of
society, that is increasingly dependent on information transfer.
Not only is the protection of privacy now ranking below federal
surveillance wishes, but also the protection of all interactions
and transactions, that happen on electronic networks. This not
acceptable interferance [with privacy] is for technical reasons not
even accompanied by any plus sides for federal investigators.


The planning of crypto regulations make clear not only the complete
neglect of civil rights in our [german] constitution. It is
becoming a symbol for the huge deficits in understanding the
problems, possibilities and challenges of [...] an information
society.


The FIfF sees five areas, where arguments for the damage of crypto
regulations can be made:

I. Crypto regulations as last building block of surveillance

Why does cryptography have to be regulated by law? From the official
side a crypto regulation in Germany is necessary, because it's the
last missing piece to surveillance of [long distance] information
traffic. The law for "Long-distance information traffic
surveillance" (FUeV)[6] forces providers of information traffic
installations to provide the clear-text of monitored traffic to law
enforcement. This can be avoided by end-to-end cryptography by
single users. Since telefone and fax [communication] are rarely
encrypted, a regulation of cryptography would mainly affect users
of electronic networks, who can ensure the postal privacy only
through encryption.


It's underlying suggestion is, that encrypted data traffic of
suspects [of crime] in electronic networks is the norm and can't be
under surveillance. This is not true.


The current laws and regulations are forcing providers of electronic
networks to guarantee a surveillance of law enforcement and
intelligence services; this is already happening[7]. Up until now no
case is known, where the investigation of a crime was made
impossible through cryptography. Nevertheless vague threat-scenarios
are mentioned, to make an increased surveillance of information
traffic more plausible.


In Germany though it's hard to observe an under-development in
surveillance. While in the United States and it's 240 million
citizens 1229 telefone surveillance requests were granted in 1995,
Germany with 80 million citizens had in the same time 3667 requests
granted[8] - per citizen 6 times as many surveillance activities as
in the USA. In 1996 the number of granted requests increased again
175 percent to 6428 [9]. No comparison of the crime rates in
Germany and the USA can possibly explain these differences [...].
In which way these methods [of surveillance] have contributed to
crime investigation is not known, since here a control of the
[surveillance] activities is not done, as opposed to the USA.


Although deficits [in surveillance] aren't noticable, the Great
Listening Attack and crypto law are to open new fields for
surveillance. Through that basic civil rights are increasingly
limited.


II. Basic rights are reversed


The protagonists of a crypto law say, that such a regulation would
be nothing new, but only a adaption of [existing] info surveillance
to technical developments. This is wrong.


Outlawing all not licenced crypto technology is reversing current
principles of civil rights. The limitation of postal secrecy is
only permitting the control of sendings. There are no forced ways
of writing, nor are certain languages or ways of expression
prohibited. No law is prohibiting to write with secret ink or to
use any other means to make messages secret. Somebody opening
letters has to do all work of analysis himself - no sender has to
help him with a [correct] letter written according to law. A
prohibition of cryptography, despite all current systems of law,
would throw the law-conform electronic communication under the
dictat of governmentally sanctioned syntaxes. No dictatorship in
Germany has ever demanded that.


III. After all, it's your money....


Electronic networks are transporting not only letters, even the
politicians got that. Using cryptographic technologies therefore is
not limited only to postal secrecy, but also other things worthy of
protection.


Those who make crypto laws also want the control over the electronic
variants of transactions, that are currently under special privacy
protection rights. The electronic service law of the IuKDG makes it
obvious by stating explicitly electronic banking as an electronic
service. For users of online-banking, online-work and
online-medicine the bank-, service-, and medical secrecy gets
reduced to the information traffic secrecy [law]. Thus the
information traffic secrecy [law] is becoming a strategic basic
[constitutional] right. A crypto law would not only undermine this
basic right, but many others as well. Such a law is a trojan horse
[for the democratic state] in an information society.


IV. Additional problems in reality


Let's assume, a crypto law would be formulated. How would it be
[constitutional] and would it be practicable? To note is a law to
digital signatures in the IuKDG, that indicates [a limitation of
asymmetric] cryptography technologies. This leads to characteristic
problems.


1. A handing-over of an escrowed key to law-enforcement means with
currently available systems, that a unlimited surveillance of the
key-owner is possible, as long as he uses the same [unchanged] key.
This is even in the practice of surveillance an un-precedented
limitation of citizens-rights, which [out-of-proportion nature] is
also clear to cryptography experts and supporters of a [crypto] law:
No one less than Otto Leibrich, Ex-President of the Federal Agency
of Information Technology Security (BSI), publicized, how through
introducing a time-variable in cryptography technologies timely
limits should be set to surveillance[10]. But could the security
agencies have an interest in [such] a lawful technology, that could
not be decrypted anymore, when users could prevent investigation
already through a changed system date?


2. The [available to law-enforcement] private key of a suspect makes
only his incoming data traffic readable, but not his messages to
third persons. In respect to the nature of asymmetric crypto
technologies [...] proofs for an communicated agreement with third
persons to commit a crime are only to be won, if also the keys of
his communication partners are available, and beyond that in certain
circumstances even their partners. The result is a tendency of an
exponential increase of the [circle of] suspects, the surveillances
and the work-load for the investigators. Here is no proportionality
anymore nor effective Investigation.


3. Due to the lack of competent institutions, the federal
government will not be able to avoid using the infra-structure,
that it's currently creating for introducing and issuing digital
signatures, to control crypto keys as well. No law will balance the
loss of trust, when one one side the institution has to hand over
private keys to law-enforcement and on the other hand guarantees
for the security of the digital signature. Would the digital
signature get into the wrong hands, any document could be lawfully
signed. The fear of citizens is understandable, to be [powerless]
to manipulations of federal key mighties. With such a loss of trust
the federal government and companies [that support the digital
signature] shouldn't even bother [to set up the infra-structure].


4. A national crypto law is not able to adress accordingly the
problems of international traffic typical for electronic networks.
To get the crypto keys of a "Mafia Organization", the agencies of
several countries would have to be mobilized. Are the supporters of
a crypto law really serious, that an international co-operation in
getting escrowed keys would function better than the current bad
co-operation in investigating crimes, where electronic networks
were used?


5. Compared to that it's almost neglectable, how such a crypto law
would make harder the life of the software industry. To guarantee a
relation of crypto key and user on the grounds of the law, the
makers of Internet-browsers, for example, [...], would have to
refrain from distributing their products in Germany via the
Internet and instead sell software packages only [in stores] to
persons with ID. Such an effort is affordable only for a few and
wouldn't necessarely strengthen the position of the legal use of
secure systems. When beyond that different and technically
incompatible national regulations were enacted, the much cheered
upon global Electronic Commerce would remain an illusion.


V. A crypto law doesn't make the investigators smarter either


Nobody can overlook this fact: a crypto law can be easily [routed
around]. A legal cryptographic system can be used several times on a
message, in fact, a with an illegal technology encrypted message
could be "packed" in a legal system. Also a crypto law can be
avoided, so that nobody knows: Steganography and other means to use
covert channels hide messages in plain-text files, for example, and
put a veil around the very existence of an encrypted message.


- From the routing around of the crypto law, the federal security
experts hope to actually gain advantages, because out of the circle
of users of illegal crypto technologies, they could win worthy
hints about the organizational structure of the suspected circle of
people.


With the use of steganography such a group of persons is never to
become known [to law-enforcement]. But what would be won, even if a
group of people would be found, that uses the same illegal crypto
system? Their communication would not be decryptable, thus has to
be won through other means. As investigators today are already
sinking in a mountain of papers with protocols of phone
surveillances, in the future they will have to spend even more
effort to investigate groups, who have done nothing wrong but to
use an non-permitted crypto system and communicate incidently with
people, who are suspected of something. Such an effort can't even
be justified by employment-market reasonings. To stamp the users of
non-permitted cryptography automatically to suspects would be
therefore even from an investigative perspective nothing but
nonsense.


- From a technical and practical perspective, a crypto law is nonsense
and un-enforcable. [Some] lawyers though have the opinion, that
independent from the enforcement the law has to be obeyed in any
case. But such a dogmatic viewpoint is hard to balance with a
democratic society.


VI. Conclusion


The FIfF has the opinion, that a crypto law would even more
increase the already not shyly used surveillance of information
traffic in Germany. It reverses constitutional rights and
principles. It threatens drastically the constitutionally protected
citizens-rights in electronic transactions and interactions. It
would lead in practicality to severe additional problems with laws
and will certainly not make the work for investigators any easier.
The problems that come with such a regulation will also not be
solved through law-dogmatism. The severe damage for civil rights,
democracy, but also economical interests, are opposed by a very
thin advantage. With that background, every rational analysis would
therefore have to come to the conclusion, to avoid a regulation of
cryptography.


That the federal government is not doing that, despite
consultations with acknowledged experts over several years, is
either a proof for lack of knowledge or the willing neglect of the
consequences.


The very similar regulations of the OECD, Great Britains, the USA
and the West-German plans are out-of-sync with the visions of a
global, democratic information society.


VII. Demands

Instead of a limitation of cryptography it is according to the FIfF
necessary to:

1. increase the availability and use of cryptography,

2. not hinder the use of cryptography through limitations or
   prohibitions,

3. make the free choice of crypto systems possible,

4. support the development of secure crypto systems,

5. increase the protection for electronic transactions and
   interactions,

6. evaluate the use of federal surveillance of communication
   regularly, independently and in-depth.

              --------------------------
1 Cryptography Policy Guidelines; Recommendation of the Council,
http://www.oecd.org/dsti/iccp/crypto_e.html
2 http://www.cdt.org/crypto/admin_397_draft.html
3 Minister for Science and Technology: Licensing of Trusted Third
Parties for the Provision of Encryption Services;
http://www.cl.cam.ac.uk/users/rja14/dti.html
4 Presserklaerung des forschungspolitischen Sprechers von
Buendnis 90/Die Gruenen, Dr. Manuel Kiper:
http://www.gruenebt.de/aktuell/pm/indizes/in970236.htm
5 am konkretesten: C. Schulzki-Haddouti: Kanthers Kurs auf das
Kryptoverbot; in: http://www.heise.de/tp/te/1146/fhome.htm
6 vgl. die Stellungnahme des FIfF zur FUeV unter
http://hyperg.uni-paderborn.de/0x83ea6001_0x0036ce9
7 Erste Faelle einer Ueberwachung von Internet-Accounts wurden
bekannt in: 30.000 Telephonate mitgehoert; in: Sueddeutsche
Zeitung, 2.12.96, S. 15
8 USA: Newsweek 20.5.96, Bundesrepublik: Bt-Drs 13/3618
9 Bt-Drs. 13/7341
10 Otto Leiberich: Verschluesselung und Kriminalitaet II, in:
BSI-Forum der KES 1/95

* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
Forum InformatikerInnen fuer Frieden und         FFFF I  fff  FFFF
gesellschaftliche Verantwortung (FIfF) e.V.      F    I  f    F
Reuterstr. 44, D-53113 Bonn                      FFFF I  fff  FFFF
E-mail: fiff@fiff.gun.de                         F    I  f    F
Tel.:xx49-228-219548  Fax: -214924               F    I  f    F

CL/GRUPPEN/FIFF   und
http://hyperg.uni-paderborn.de/~FIFF
forum computer professionals for peace and social responsibility
* * * * * * * * * * * * * PGP-Key on request  * * * * * * * * *

====================================================================


/*************************************************************/
/* This user supports FREE SPEECH ONLINE     ...more info at */
/* and PRIVATE ONLINE COMMUNICATIONS! -> http://www.epic.org */
/* E-mail: harka(at)nycmetro.com (PGP-encrypted mail pref'd) */
/* PGP public key available upon request.  [KeyID: 04174301] */
/* F-print: FD E4 F8 6D C1 6A 44 F5  28 9C 40 6E B8 94 78 E8 */
/*<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>*/
/* May there be peace in this world, may all anger dissolve  */
/* and may all living beings find the way to happiness...    */
/*************************************************************/

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQEVAgUBM08quzltEBIEF0MBAQEn1gf/Ww87W3y3SrI6bK6Qg9iCgC6E40HSCkrB
2tFV3Zy+k7KtegHPrLikKhX1inJ+vEYPadHLhH1K45eGRJ/4lr4G3Pg+ozYNRalQ
KAIeoD4XQNY4nOvm6+vMlg5lOhkObB5z4pf7H5P6j48c0HSKEITPk5ExBo7g5Hcv
gl+yOrXYioEbSEScFkGYjvTh6zPNEqsr7Ma7nucON5OlqRe71Rdtn9FiGWSkxgTZ
rRg1bnB6geksL/OeKz6neYXIfWuyFEoHs19sLo7gqGcCaib6nn+bs+qrWikJeY5L
dWNzpoeqUSW46mZtUwC3IastDE2YhKuh7ffYPCG1v5AvaBG0NCZ4Sg==
=fpKk
-----END PGP SIGNATURE-----


If encryption is outlawed, only outlaws will have encryption...