From: Robert Hettinga <rah@shipwright.com>
Date: Sun, 21 Sep 1997 05:24:50 +0800
To: cypherpunks@toad.com
Subject: Guardian: Screw the Internet
Message-ID: <v03110707b049ebbe74b4@[139.167.130.248]>
MIME-Version: 1.0
Content-Type: text/plain




--- begin forwarded text


X-Authentication-Warning: fma66.fma.com: majordomo set sender to
owner-espam@lists.espace.net using -f
X-Orig-From: rah-web <rah@shipwright.com>
X-e$pam-source: Various
X-Sender: rah@pop.sneaker.net
Mime-Version: 1.0
Date: Sat, 20 Sep 1997 14:15:00 -0400
To: espam@intertrader.com
From: Robert Hettinga <rah@shipwright.com>
Subject: Guardian: Screw the Internet
Sender: owner-espam@lists.espace.net
Precedence: bulk
Reply-To: e$@thumper.vmeng.com

---------------------------------------------------------------------
This mail is brought to you by the e$pam mailing list
---------------------------------------------------------------------

From: rah-web <rah@shipwright.com>
Reply-To: rah@shipwright.com
MIME-Version: 1.0
To: Robert Hettinga <rah@shipwright.com>
Subject: Guardian: Screw the Internet

http://go2.guardian.co.uk:80/theweb/874505219-crypt.html

 Content-Type: text/plain; charset=us-ascii; name="874505219-crypt.html"
 Content-Disposition: inline; filename="874505219-crypt.html"
 X-MIME-Autoconverted: from 8bit to quoted-printable by lbo.leftbank.com id
 LAA08197


    [Image]

   Spooks on both sides of the Atlantic are intent on retaining their
   power to monitor the world's telecoms traffic, writes Duncan Campbell
   Screw the Internet

      INTELLIGENCE AGENCIES in the US have stepped up their campaign to
      control the flow of information over the Internet, counterattacking
      an unholy alliance of civil libertarians and business chiefs who back
      the introduction of secure encryption technologies to protect
      personal privacy and commercial data online. Last Thursday in
      Congress, lobbying by the FBI and the National Security Agency won
      amendments to a draft pro-encryption law known as Safe (Security and
      Freedom through Encryption). The House Intelligence Committee
      replaced rights to sell effective encryption systems to the world
      with regulations to ban even US citizens from using them. The
      agencies and their political backers are now demanding that any
      American whose electronic communications cannot immediately be read
      by US intelligence should, after January 2000, face up to five years
      imprisonment. Furthermore, they want the US to use its political and
      industrial power to force the rest of the world to follow suit.

      Battle resumes in Washington a week today, when the likely more
      sympathetic House Commerce Committee will provide its review of the
      Safe law for Congress to consider. That done, Congessional leaders
      and the White House will have to negotiate which version of the Safe
      bill is to be taken ahead. If the new version of the bill succeeds,
      it will be illegal in the US to make or sell encryption systems
      unless the government can break the code and have "immediate access"
      to the contents of messages or phone calls.

      In Britain, the new government has soon to decide what line to take
      in this little-understood war that has almost paralysed the
      development of electronic commerce. Under pressure to formulate
      standards, New Labour has to decide if it wants to face the economic
      penalties of giving in to the spooks. If the secret agencies win, the
      losers will also be ordinary users of electronic commerce or e-mail.
      Without encryption to scramble the contents of messages, reams of
      Internet traffic can be read easily, not just by intelligence
      agencies, but by miscreants with direct access to the Net through
      routers or local area networks.

      E-mail is less secure than an ordinary telephone call, since ordinary
      telephone calls are connected "point to point" by a precise route
      rather than being broadcast between routers and into networks.
      Without encryption, e-mail containing sensitive private information
      or financial details, such as credit card numbers, can be read at
      numerous points as messages pass through the Net.

      This complex but fundamental issue for everyone in the information
      society has been made politically more difficult by an initiative
      launched in the dying days of the last government. Just before the
      election was called, the Department of Trade and Industry unveiled
      its version of the US system for ensuring that the government could
      read everyone's private communications.

      The DTI's version is a network of licensed agencies that would
      provide (and keep copies of) everyone's encryption codes, or keys. If
      sent a warrant, these Trusted Third Parties, or TTPs, would hand over
      keys at one hour's notice - a less demanding requirement than the
      latest US plans, but no less absurd or impossible to engineer, say
      Internet specialists. Plans to hold everyone's keys in central
      registries have also been slammed for creating a huge security
      threat, because everyone would be at risk if crooks were able to get
      into the central database.

      DTI officials were unprepared for the torrent of protest, abuse and
      reasoned objection that has arrived on their desks since early this
      summer. The former government's proposals have, it is understood,
      attracted not a single unqualified supporter. They were condemned out
      of hand by industry leaders, academics and civil libertarians alike.
      David Svendsen, head of Microsoft in the UK, says that "the DTI's
      plans are unworkable, unwieldy and unacceptable. Setting up a
      bureaucratic structure to regulate encryption services will isolate
      the UK from global electronic commerce. It will force us all to look
      elsewhere for barrier-free encryption technology, while UK plc will
      foot the bill."

      The battle in the US Congress follows setbacks for the intelligence
      agencies, which have been fighting to stop effective encryption
      systems from being exported. Classifying encryption software as
      "munitions", the US government banned the export of systems with key
      lengths (see Cracking the code, opposite) long enough to make them
      uncrackable. Thus, while Americans who use Web software browsers to
      make "secure" credit card purchases benefit from built-in encryption
      with strong 128-bit keys, Europeans have until now been permitted to
      use only weakened and insecure 48-bit keys.

      In August, the US government gave in to commercial pressure to relax
      restrictions, and non-US users of software to browse the Internet are
      already being offered upgrades to provide full 128-bit security. The
      catch, which is not being advertised, is that the licencees must
      provide the US government with backdoor access to the new systems.

      The extent to which this area of information technology has been held
      back is already remarkable. It's now 20 years since fundamental
      advances in mathematics created unique but simple new ways of
      encoding messages, known as public key cryptography, that did away
      with the need to exchange keys or codebooks before encrypted messages
      could be sent. In 1977, long before the Net reached its modern form,
      three mathematicians - Rivest, Shamir and Adelman - showed how to
      implement this revolution.

      Their RSA algorithm allows users to create separate "public" and
      "private" keys. To use a public key crytopgraphy system to, say, send
      a private message to OnLine, you would first obtain OnLine's
      published key. Many Net users (but not yet OnLine) publish such keys
      on their Web sites or in directories. You then scramble the message
      using the public key, and send it. The message can be decoded using
      only a matching private key, which only Online would have.

      The RSA algorithm is available for use on the Net, or for file
      protection, using a program called Pretty Good Privacy, or PGP, whose
      inventor, Colorado computer consultant Phil Zimmermann, is a Net
      legend. His reward for inventing PGP was not scientific accolade, but
      arrest and prosecution by the FBI. For having created PGP, he was
      accused of exporting munitions. Charges against Zimmermann were
      dropped only last year.

      Recognising that there could never be uniform international agreement
      to lock away cryptography as nuclear weapons are locked away,
      governments and information acquisition agencies have tended instead
      to attempt covertly to regulate encryption. This has taken the form
      of patent secrecy orders, attacks on research funding, the
      undermining of the international standardisation of cryptography, the
      harassment of inventors and commercial organisations, and legislative
      campaigns to restrict their work.

      In the shadows behind these events hide communications intelligence
      agencies - the US National Security Agency and Britain's Government
      Communications Headquarters (GCHQ). For 50 years, they have harvested
      intelligence from monitoring the world's international communications
      network. This activity is threatened by large-scale encryption.
      Historically, huge codebreaking resources have been used to try to
      break the codes of hostile states. But to use the same methods and
      resources against the mass of ordinary international communications
      would be costly and futile.

      The scale of NSA operations is staggering. Tens of billions of
      messages are intercepted every year. All international communications
      by satellite or undersea cable, and many domestic communications can
      be collected by taps or via satellite interception stations. GCHQ's
      interception station at Morwenstow near Bude, Cornwall, was built
      almost 30 years ago to spy not on the Soviets but on the West's
      international communications satellites, Intelsat.

      NSA's and GCHQ's electronic tentacles still reach round the world,
      and into the heart of Western policy making. Within the DTI, the
      director of technology policy and innovation, David Hendon, makes no
      secret that a substantial input to his work comes from GCHQ. At the
      European Commission, a former official of GCHQ's Communications
      Electronic Security Group, David Herson, has been steering EU policy
      on information security. Critics such as Ross Anderson, the computer
      security specialist based at Cambridge university, have accused them
      of being stooges for NSA.

      The DTI has hired consultants to summarise the responses to their TTP
      proposals, and hope to publish a summary in the autumn, together with
      policy proposals. The risk is that officials are still locked into
      the same Neanderthal security agenda that once branded the Home
      Secretary a subversive threat to the nation.

      Advice to ministers trying to understand this most complex part of
      the IT brief will need to balance the UK's national economic interest
      against the concerns of security officials anxious to maintain the
      intelligence service's "special relationship" with the US. Until last
      week's events, US attempts to control strong encryption had faced
      setbacks.

      Three weeks ago, a federal judge in San Francisco ordered the US
      government not to take action against Chicago academic Daniel
      Bernstein if he published encryption software on the Net. Export
      restrictions, said Judge Marilyn Patel, violated Bernstein's
      constitutional right to free speech. And US attempts to lobby the
      European Union and the OECD into backing an international system of
      cryptographic controls have failed. Despite US support from Britain
      and France, both organisations have backed and encouraged open use of
      cryptography (albeit with qualifications).

      The continued campaign against effective cryptography is still being
      fuelled by the raising of alarms about the potentially antisocial use
      of the Net, including those which Net enthusiasts cynically dub the
      "Four Horsemen of the Infocalypse": terrorists, drug traffickers,
      paedophiles and organised crime. But the argument is specious.
      Forcing honest individuals and companies to turn over their keys or
      to use only licensed keys will not prevent criminals from using
      strong encryption outside of the mandatory system. Labour's policy,
      formulated before the election, had it right : "It is not necessary
      to criminalise a large section of the network-using public to control
      the activities of a very small minority of law-breakers."
      (http://www.labour.org.uk/views/info-highway/content.html)

      Last year, EU adviser and ex-GCHQ official David Herson was
      astonishingly candid about the real reason for playing on

      fears about the Net activities of terrorists and paedophiles. "Law
      enforcement is a protective shield for all the other governmental
      activities," he told two European journalists. "We're talking about
      foreign intelligence . . . that's what this is all about. Law
      enforcement is a smoke screen."

      If New Labour sticks to the policy adopted before the election, it
      should have little difficulty reaffirming its view that attempts to
      control the use of encryption technology are "wrong in principle,
      unworkable in practice, and damaging to the long-term economic value
      of the information networks". But if intelligence agency dinosaurs
      get their way, they will jeopardise not just personal privacy but the
      economic rewards of Net commerce.

      The winners will be those countries, such as Germany and many of
      those in Asia, that by rule of law or through commercial instinct
      stay resistant to NSA's and GCHQ's intelligence imperatives.

      [Duncan Campbell is a freelance writer and broadcaster, and not the
      Guardian's crime correspondent of the same name]

      17 September 1997


---------------------------------------------------------------------
Where people, networks and money come together: Consult Hyperion
http://www.hyperion.co.uk                    info@hyperion.co.uk
---------------------------------------------------------------------
Like e$? Help pay for it!  See <http://www.shipwright.com/beg.html>
Or, for e$/e$pam sponsorship, <mailto:rah@shipwright.com>
---------------------------------------------------------------------

--- end forwarded text



-----------------
Robert Hettinga (rah@shipwright.com), Philodox
e$, 44 Farquhar Street, Boston, MA 02131 USA
"... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'
The e$ Home Page: http://www.shipwright.com/