Subject: Re: [Raven] Anonymous taps

From: "Richard Payne" <[email-masked]>
Date: Fri, 29 Oct 1999 09:33:36 -0400

chefren wrote:

>>
>> > Fire arms are regulated and encryption should be
>> > accordingly. No assault weapons and no free fully
>>
>> a) Crypto is not an offensive weapon.
>
>A bullet without a gun or vice versa eighter.

which I don't understand. Is it an assertion that crypto _is_ an offensive
weapon? I guess someone could be bludgeoned with the PGP source ;-)

chefren also wrote:

>> The logical outcome and implementation
>> of "no private conversations" is "all conversations, even face-to-face,
must
>> be monitored". I'm sure you don't mean that.
>
>That's NOT the logical outcome and that's typically not
>what regulation is about. Regulation is always done with
>best wishes and had probably never in history had a 100%
>impact nor were 100% of offenders brought to justice.
>Regulation is about keeping things in check for the society
>that has come up with the rules/laws. In check at an
>acceptable level.

which is avoiding dealing with the issue. If you truly believe that private
conversations over a network are so bad that they must be regulated, how do
you avoid the conclusion that people shouldn't be able to talk privately in
person? I'd really like to know.

I've asked a couple of times whether chefren truly believes that strong
crypto can in fact be regulated by governments, without getting a straight
answer. I believe this is a critical issue, for chrefren, Brian Rosen, and
all the telco people out there.

If the public has access to strong crypto in at least the G-7 countries,
then the argument for tapping is substantially weakened, since it will
eventually become obsolete. Anyone with a brain in their head will be
encrypting their transmissions. Why design a tap-box if the output is of no
use to you?

Finally, chefren wrote:

>> Just a reality check...
>
>
>So you try to tell me your "reality" is more true or
>interesting than my "reality"?

An interesting philosophical point, but as a semi-naive realist, I believe
we inhabit the same reality. I was trying to draw attention to certain facts
that suggest strong crypto is, in the long run, impossible to regulate.

Richard Payne

_______________________________________________
raven mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/raven

---

From: "chefren" <[email-masked]>
Date: Fri, 29 Oct 1999 19:07:38 +0200

> weapon? I guess someone could be bludgeoned with the PGP source ;-)

Probably everything can be used for offence or defence.

> conversations over a network are so bad that they must be regulated,

Nope I have nowhere stated private conversations should be 
regulated. I just state that if law enforcement realy has 
no chance to listen in on those conversations there would 
be places for organized crime to hide. So we just cannot 
allow too much privacy there as strong encryption gives and 
thus regulation should be in place there.

> how do

I don't want to prevant that at all. History has proven 
that there aren't any more measures necessary than already 
taken. Internet+ strong encryption gives too much chances 
for criminals. Unacceptable chances.

> crypto can in fact be regulated by governments,

Of course it can. Like they regulate murder. Don't expect 
100% effectivity but give law enforcement means to do 
something.

> without getting a straight answer.

Really sorry to read that. I try to be as open as possible 
about this.

..
 
> eventually become obsolete.

Why? I think I will never use strong crypto myself and I 
know of lots of people who think so too. I have nothing to 
hide for law enforcement.

> Anyone with a brain in their head will be encrypting
> their transmissions.

I don't think so and I don't see much increase of use of 
PGP although it's far simpler to use now than some years 
back. And again: I have nothing to hide, let them tap me 
and their research is finished in little time against low 
costs. People who do use stongcrypto and for sure if they 
regularly post to usenet: Nobody can prove they aren't 
orchestrating cocaine transports on the other side of the 
world.

> Why design a tap-box if the output is of no use to you?

You think it's of no use, others do think it will be 
usefull. There are definitely enough people who will use it 
so a good standard will be important. IETF can do something 
here.
 
> that suggest strong crypto is, in the long run, impossible to regulate.

It isn't according to your standards, law's never have 100% 
coverage.

If strong encryption is regulated, it will (and should!) be 
used by communication providers to protect privacy of their 
customers. It will be used by banks, for authentication and 
lots of other places but not for private communication. 
That's covered by the communication providers who have to 
lift it in case of law enforcement emergencies.

+++chefren

=Large signature follows=

I think we need a simple architecture for a point
to point tap interface that has strong provisions
against misuse.

On one side the communication provider who only
starts tapping a specific customer or IP number
with proper warrants.

On the other side the approved tapping room.
Everything should be organized by the central
"tapping office". This office should provide
keys for strong encryption to both communication
provider and tapping room.

Law and technology should both provide as
much checks and balances as we can come up
with. Law can provide good procedures,
technology can provide technical means to
check them or force them.    

=Large signature ended, please comment me
off-line to make it better=