From: Jim Gillogly <jim@acm.org>
Date: Thu, 17 Dec 1998 03:34:17 +0800
To: cypherpunks@cyberpass.net
Subject: Network Associates' KRA Partner status
Message-ID: <3677FD28.F7BAB298@acm.org>
MIME-Version: 1.0
Content-Type: text/plain



Bruce Schneier said in the "News" section of Crypto-Gram:
>> Okay, I finally got the story right about Network Associates Inc. and the
>> Key Recovery Alliance.  (Last month I pointed to a Wired News story that
>> they quietly rejoined.)  The story is wrong.  They never left the KRA.
>> Since its inception, Trusted Information Systems was a big mover and shaker
>> in the KRA.  When NAI bought TIS in May 1998, TIS's membership transferred
>> to NAI.  NAI resigned the leadership posts that TIS had held in the
>> Alliance and stopped attending its meetings, but never left the KRA.  So,
>> NAI is a member of the KRA, and has been since it bought TIS.
>> http://www.wired.com/news/print_version/technology/story/16219.html

Someone responded:
> When NAI bought PGP, in late 1997, Phil Zimmermann found out about NAI's
> membership, and he was able to persuade management to withdraw from
> the KRA.  This is why it is wrong to say that NAI never left the KRA.
> See http://www.news.com/News/Item/0,4,17112,00.html.

I remember hearing this at the time.  The cited article (8 Dec 1997) has
supporting quotes from NAI's Gene Hodges.  In addition, Dave Del Torto
wrote to the secretary of KRA last month and got a response from
secretariat staffer Michael LoBue on 20 Nov 1998 that addresses this
point in passing:

    Indeed, some of this current 'public debate' about NAI's
    relationship with the KRA goes back to their public statement
    that they 'withdrew' from the organization. The fact of the matter
    is that they simply did not choose to become an actual member at the
    time the organization was formally constituted. When it was reported
    that they withdrew, there was in fact no entity from which to withdraw.

While the actual status of KRA is interesting, the relevant point is
that NAI did indeed say they were withdrawing, and they did withdraw
from participation in the nascent organization.

> NAI bought TIS a few months later.  TIS was a member and in fact a leading
> member of the KRA.  By purchasing TIS, NAI inherited its membership in
> the KRA, and so NAI was once again a member.

It was more explicit than this.  Michael LoBue said further:

    Concerning Network Associates membership in the KRA, in response to your
    question I have verified that our files contain an executed Membership
    Agreement for Network Associates (dated July 2, 1998), as well as a properly
    completed Application for Membership of that same date. 

This is not just accepting the existing membership status of TIS.  It's
reversing NAI's non-membership status and explicitly joining.

DDT's message and KRA's response were posted to several lists on 22 Nov 1998.

Somebody'd better write this all in a physical book before the wrong version
gets scribbled into history.  Webbage is nice, but is regrettably transient.
-- 
	Jim Gillogly
	26 Foreyule S.R. 1998, 18:06
	12.19.5.13.19, 5 Cauac 12 Mac, Ninth Lord of Night