From: geeman@best.com
Date: Fri, 27 Jun 1997 14:43:13 +0800
To: cypherpunks@Algebra.COM
Subject: Rep. Lofgren on McCain/Kerrey (good. long.)
Message-ID: <3.0.32.19970626233120.006c04f4@best.com>
MIME-Version: 1.0
Content-Type: text/plain



[Congressional Record: June 25, 1997 (Extensions)]
[Page E1320]
>From the Congressional Record Online via GPO Access [wais.access.gpo.gov]
[DOCID:cr25jn97-18]

 
               ENCRYPTION BILL: AN EXERCISE IN DECEPTION

                                 ______
                                 

                            HON. ZOE LOFGREN

                             of california

                    in the house of representatives

                        Wednesday, June 25, 1997

  Ms. LOFGREN. Mr. Speaker, last week the Senate Commerce Committee 
reported a bill, S. 909, sponsored by Senators McCain and Kerrey, which 
largely embodies the latest administration proposals to deal with 
encryption technology. This misguided legislation (S. 909) would be a 
great leap backward in the effort to reform current American export 
restrictions on encryption and remove serious impediments to the 
competitiveness of our Nation's high-tech industry.
  In addition, by proposing unprecedented domestic controls on the use 
of encryption, the McCain-Kerrey bill also poses serious threats to 
fundamental civil liberties and privacy rights. I believe that the 
Senate effort is propelled largely by a lack of understanding of both 
the worldwide prevalence of strong encryption and the technical 
challenges posed by the massive key recovery-escrow infrastructure 
envisioned in the bill.
  Earlier this week, Mr. Dan Gillmore, columnist for the San Jose 
Mercury News discussed the problems with S. 909 and strongly urged a 
rejection of the McCain-Kerrey approach. I submit his column into the 
Congressional Record.

            [From the San Jose Mercury News, June 23, 1997]

          Encryption Bill: Federal Exercise in Self-Deception

                            (By Dan Gillmor)

       As a bill bearing his name zipped last week through the 
     Senate Commerce Committee he heads, Arizona Republican John 
     McCain said, ``This bill carefully seeks to balance the 
     concerns of law enforcement with individual privacy 
     concerns.''
       The legislation, co-sponsored by Nebraska Democrat Bob 
     Kerrey and two other Democrats, was the latest futile attempt 
     in Congress to achieve the impossible: compromise on an issue 
     that fundamentally has no middle ground.
       The issue is encryption, the scrambling of digital 
     information. Try as they might, lawmakers must eventually 
     understand the reality. When it comes to the privacy of 
     personal information in the digital age, we have two simple 
     choices. Either we allow people to encrypt their messages, 
     using scrambling and unscrambling ``keys'' to which only they 
     have access, or we do not.
       Governments are certain that bad people will use encryption 
     to help achieve bad ends. They're right. But their cure would 
     shred our basic liberties.
       So the Clinton administration and its allies--the McCain-
     Kerrey legislation is widely viewed as an administration-
     approved plan--are pushing a policy that would force us to 
     put descrambling keys in the hands of third parties. Then, 
     when law enforcement people wanted to see our communications, 
     they'd simply get the keys from that third party.
       The McCain-Kerrey bill pretends to stop short of that. It 
     would force government agencies to use only electronic 
     hardware and software that included this key-recovery scheme. 
     It would also require the same system for anyone using a 
     network that is funded in any way by federal funds, including 
     virtually all university networks.
       While one section calls the system ``voluntary'' for 
     private individuals, the rest of the legislation would make 
     it all but impossible to resist. Hardware and software 
     companies, which so far have resisted the government's moves, 
     will be much more likely to simply give in and build this 
     key-recovery method into all of their products if they have 
     to build it into ones bought by the government. Consumers 
     need options, not monolithic products.
       Another section of the bill would, in effect, require even 
     private citizens to use such software--and therefore give 
     their keys to the third parties--if they want to buy anything 
     online. People tend to use what they have in front of them.
       There's nothing wrong with the idea of letting a third 
     party hold onto a descrambling key in certain cases. As 
     former White House official Jock Gill noted recently on an 
     Internet mailing list, all government communications should 
     use such a system so the public can keep an eye on what the 
     government is doing in our name and with our money. We'll 
     need to create a system, of course, where such oversight 
     doesn't end up forcing the public to use exactly the same 
     technology for its own encryption needs--or at least keep 
     private keys out of the hands of centralized third parties.
       Companies, meanwhile, will need to hold onto the business-
     related keys of employees, so that vital records won't be 
     lost when someone leaves or dies. But I can't think of many 
     companies that will be happy about giving the vault keys to 
     third parties they can't control.
       Private citizens also should consider giving their keys to 
     trusted third parties, just as they give their house keys to 
     neighbors when on vacation trips. I intend to do just that--
     but it's none of the government's business who gets my 
     personal encryption key. I need strong encryption, as the 
     digital age arrives, because more and more of my life will 
     exist on these public networks.
       The practical difficulties of setting up a centralized key-
     recovery system are immense. Even if it could be done, I 
     would never trust such a government-run system to be even 
     remotely secure from corruption. I remember the Social 
     Security employees who sold personal information to 
     outsiders. I've also seen too much evidence that governments 
     tend to abuse liberties when they have too much power--and 
     the McCain-Kerrey bill would allow virtually anyone at any 
     level of law enforcement to have access to private 
     information on the flimsiest pretext, not even requiring a 
     court order.
       Kerrey's participation in this latest travesty is sad. He 
     needs no lessons in courage. He lost part of a leg in 
     Vietnam. Later, as he stood up to the know-nothings who would 
     ban flag-burning, he noted that our strength comes partly 
     from our ability to express ourselves even in ways that 
     offend many others.
       Now, however, Kerrey is aligning himself with a much more 
     dangerous crowd of know-nothings: those who'd ban our right 
     to keep private information private. He may believe this is 
     about finding common ground; if so, someone has fed him 
     falsehoods. His proposal, if enacted, would create the worst 
     invasion of our fundamental liberty in many decades.
       If you care even slightly about your privacy in the future, 
     pick up a pen today and write your Senators and member of the 
     House of Representatives. Tell them to reject the Clinton-
     McCain-Kerrey approach. Tell them you value your privacy and 
     won't give it up without a fight. And remind them that you 
     vote.

     

                          ____________________