From: Ernest Hua <hua@chromatic.com>
Date: Mon, 28 Apr 1997 11:27:37 -0700 (PDT)
To: Declan McCullagh <shamrock@netcom.com>
Subject: No Subject
Message-ID: <199704281827.LAA27404@server1.chromatic.com>
MIME-Version: 1.0
Content-Type: text/plain



> From: jimbell@pacifier.com (Jim Bell)
>
> > can't have everything OUR way, the FIRST time around.  Washington
>
> I think you misunderstand the situation.  The government is in somewhat of a
> disadvantage by virtue of the fact that there is relatively little
> pro-censorship and anti-encryption legislation.  Absent such legislation,

Here is where I don't agree on the merits ...

1.  Pro-censorship agendas does not need much legislative momentum
because it does not take much P.R. on a child-molestation-murder
incident on some little caucasian girl from a motherhood-and-apple-pie
Small Town, U.S.A. to drum up the sentiments to censor.

2.  Anti-encryption has been well guarded by the NSA/CIA/FBI/DoD for a
long time using the semi-legitimate veil of national security.  In
fact, in some senses, there ARE legislative support, even if
unconstitutional when evaluated in the bright light of day.  The
problem is that you'll fight for years JUST TO GET A CHANCE to
evaluate the law itself.

Yes, some of the current legal battles are on their way there, but
it's been a LONG time, and every decision/every appeal takes months to
years, and it's clear that the NSA is hoping that in 2 years, they can
sign up enough pro-key-recovery companies to make the legal battles
moot.  2 years is pretty short compared to the time scales on these
battles, and the NSA is counting on just that.

To me, the time-to-market is just as important as the purity of the
products (the proposed legislations).

> the status-quo moves in a relatively free fashion, which is why the
> Internet is mostly unregulated today.

I don't think anyone will be willing to genuinely export encryption
(in a real commercial product) while directly flaunting the NSA's
implicit/explicit authority on this matter.  Corporations are too
concerned with the short term bottom line to care about more long term
goals like have freedom to export anything it wants.  I already know
of several instances at various companies where designs were
deliberately altered to NOT give the appearance of designing a product
with specific encryption/decryption capabilities, even though that is
what the product must support, fundamentally speaking.  Therefore, I
must conclude that the NSA is definitely winning some battles on their
2 year schedule already.

> From: Declan McCullagh <declan@well.com>
>
> The question is: Do we want to give up any domestic freedom in exchange
> for a relaxation of export controls? (Congress is, after all, built on
> compromises between warring factions.)
>
> My instinct is to say "No." Let the courts strike down ITAR, EAR, and its
> progeny, while we keep our freedoms domestically.

I really don't think we are disagreeing here.  I would not support any
restrictions on domestic usage, nor would I support any restrictions
on what non-governmental institutions may use.  I still believe we
should push for all we can get because that is the way the
legistlative process works, and that is the game the other side is
playing.  However, we shouldn't place unrealistic constraints on our
supporting legislators such as taking an "all or nothing" attitude.

Even if all we can get is 56-bit or 64-bit export legalization, it is
a HUGE chip away from the NSA rock because their "2 years free for key
recovery" plan is just that much weaker.  I would rather see, of
course, 128-bit/168-bit be liberalized, because that would essentially
mean that everything is liberalized, because the NSA has been playing
this "56-bit is too strong" charade, and losing 128-bit/168-bit is
essentially losing their argument, unless they want to risk coming to
the security committees admitting that they have lied.

> From: Lucky Green <shamrock@netcom.com>
>
> > Let's let the legislative process (whatever you think of it) take its
> > course.  I'll be happy even if they sneak some screwy secret committee
> > on the final bill, as long as we are not subject to that committee or
> > any other governmental body just because we allow ftp of C source code
>
> I think this is a dangerous position to take... make that fatal. The
> code is already being ftp'ed out of the US. The law would gain you
> little.

Well, we're not talking about the realities of the massive
semi-underground activities.  We're talking about the U.S. Government,
(which often has poor notions/understandings of reality), corporations
(which often must obide by the laws and regulations, however poor,
crafted by the U.S. Gov.), and genuine consumer applications (which
are significantly driven by the products produced by these
corporations).

> But the new restrictions/enhanced penalties, which will
> inevitably be included in any crypto bill that might become law,
> will set us back severely.  Personally, I hope that none of the
> crypto bills pending gets passed.

Of course, I don't like any of them, especially if there are still
secret committees with very real control written into the legislation.
If the NSA/FBI can call up Robert Allen to stall a secure phone
product line, they already have enough power outside the legal process
that they don't need any real committees to help them out.  However,
NSA will clearly deny having this level of influence to the security
committees, and they will most likely accept the NSA's word.

Ern

-- 
Ernest Hua, Software Sanitation Engineer/Chief Cut And Paste Officer
Chromatic Research, 615 Tasman Drive, Sunnyvale, CA 94089-1707
Phone: 408 752-9375, Fax: 408 752-9301, E-Mail: hua@chromatic.com