From: Dave Emery <die@pig.die.com>
Date: Mon, 6 Jul 1998 11:43:02 -0700 (PDT)
To: John Young <jya@pipeline.com>
Subject: Re: Gov Access to Key Strokes
In-Reply-To: <199807061450.KAA11968@camel14.mindspring.com>
Message-ID: <19980706144246.A3940@die.com>
MIME-Version: 1.0
Content-Type: text/plain


On Mon, Jul 06, 1998 at 10:46:27AM -0400, John Young wrote:

> 
> Could this technology to be covertly placed in all keyboards 
> for activation say, by remote control, or via a program/device 
> on the Internet?
> 
> Recall the various proposals for putting hardware encryption 
> in keyboards, with the possibility of covert GAK.

	John, I have on occasion mentioned on the net the possibility of
doing this via secret back doors in Microsoft OS kernels (W98/NT),
backdoors hidden by encrypted code (and that damn new WIPO treaty) that
would only be decrypted inside the CPU using a chip key not available to
the user.  Given passage of WIPO I fully expect such technology to
become common as a means of copyright protection with very severe
penalties for those who would chose to peek inside the "technological
means" or alter it in any way.  And once one has created this secret
space inside the core OS and protected it by draconian criminal laws, it
doesn't take much for someone to add a little extra feature in there
that logs and transmits back to Big Brother user keystrokes or keys used
with the encryption routines or other such privilaged and private user
information.  This could be added by the FBI or by Microsoft under
federal pressure (which they certainly are).   And interfering with or
disconnecting this nice little brother feature might well be considered
to be tampering with a "technological means" of copyright protection and
subject the user to 5 years in prison. Certainly public dissemination of
tools and information (such as code listings) that would allow access to
and alteration of this secret space would very likely result in criminal
prosecution, even if such legal action was not common for individual users.

	In fact, under WIPO it would already be illegal to just
disassemble and debug the relevant part of the OS to check to see if
there was code in there to log and report keystrokes even if it was not
encrypted or otherwise protected.  And no doubt at all but that the
rights enforcement software will be encrypted and otherwise protected
just to make sure that anyone tampering with it or even just examining
it for security flaws (such as keystroke recorders) would clearly be
flagrantly violating WIPO in an unambiguous as possible way.

	What this means is that due to well meaning anti piracy measures
carried to extremes - WIPO , it is likely to be impossible for a user of
standard shrink wrapped commercial software to legally vet that software
to  determine that it does not contain deliberate (courtesy the FBI)
means to grossly compromise the security of information on his computer
system.  He will have no legal recourse but to trust the provider of the
software, as even the analysis required to prove such a deliberate
security hole exists would be serious federal felonies...

	One wishes that Congress would see the light and allow 
circumvention of copyright protections for legitimate security analysis
and audits (and for any purpose which would be construed as fair use
under copyright law), but so far this hasn't happened.

-- 
	Dave Emery N1PRE,  die@die.com  DIE Consulting, Weston, Mass. 
PGP fingerprint = 2047/4D7B08D1 DE 6E E1 CC 1F 1D 96 E2  5D 27 BD B0 24 88 C3 18