Subject: Re: [Raven] Three Questions and Some Examples

From: Vernon Schryver <[email-masked]>
Date: Wed, 17 Nov 1999 11:49:32 -0700 (MST)

> > As we all know, words by themselves are often not sufficient to send
> > someone to jail, at least in the U.S.  It's better to find evidence of a

> 	Not true.  Look at the criminal conspiracy and RICO statutes.  People
> can be sent to jail for conspiring to commit a crime, even if the crime is
> never comitted.

Yes, I've heard of the conspiracy monster, but no, what I wrote is
accurate.  Words by themselves are "often not sufficient."  It is "better"
to find evidence more than mere words.  That's true in part because people
"with something to hide" often don't say things that are sufficiently
unambiguous to convince juries.

> 	Declan McCullough can also give information on a case where the
> contents of a cypherpunks list discussion resulted in jailtime for someone.

Wasn't that who this morning forwarded the familiar (at least to some
of us) newspaper account of how the Los Angeles police used wiretaps to
obtain convictions that nominally had nothing to do with wiretapping?

In other words, RICO and criminal conspriacies are powerful tools, but
not as powerful as literal smoking guns.  Taps can lead to things that
can be presented in court as smoking guns.

Vernon Schryver    [email-masked]

_______________________________________________
raven mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/raven

---

From: "Thomas Junker" <[email-masked]>
Date: Thu, 18 Nov 1999 02:48:12 -0600

On 17 Nov 99, at 19:35, chefren wrote:

> On 17 Nov 99, at 9:45, Vernon Schryver wrote:
> 
> > It is intellectually dishonest propose technical mechanisms while lacking
> > the vaguest idea of the technical facts.  It is dishonest to persisently
> > propose an "auditable tcpdump" without knowing even the least bit of how
> > TCP/IP works.  The talk about an "auditable tcpdump" is either dishonest
> > because it is based on willful ignorance or it is dishonest because it is
> > known to be nonsense.
> 
> I still don't think so and I shall repeat some old input:

You either don't listen or you just plain don't 
understand, and you keep repeating your same lines over 
and over again in a list that was *not* created as a forum 
for wiretap proposals or, for that matter, any other 
proposals.

> If communication providers by law have to encrypt

The IETF does not make law.

> the data 
> they exchange it's nearly impossible to inject TCP 
> segements there. So the vulnerable place is within the 
> technical rooms of the communication provider. And those 
> should thus be "sealed". Most of them I know of are more or 
> less sealed already but I do believe international 
> standards can help here.

The IETF does not make standards for the sealing of rooms. 
There are probably security organizations that do exactly 
that, among other standards, but they do not make law, 
either.

If this were a USENET group or a less important mail list 
I would merely filter you directly to the garbage folder 
and ignore your off-topic posts.  This is, though, the 
list created to discuss a specific question posed by the 
IESG to the IETF, and can be presumed to be widely read as 
well as archived for who-knows-how-many future readers.  
Your insistence on discussing an imaginary "proposed 
standard" and virtual spamming of the list with your theme 
have seriously distorted the discussion, driven off almost 
all of those with anything to say about the charter 
question, and have already demonstrably confused a number 
of latecomers to the list who failed to inform themselves 
of the list's charter or who assumed that the topic had 
legitimately drifted into discussion of your favorite 
theme.

I have said it before and I will try once more:  what you 
propose belongs in another forum.  Even in a proper forum 
it suffers from a very serious flaw:  it is based on 
*legal* mechanisms wholly outside the scope and influence 
of the IETF.  Coming from the IETF, should it ever be so 
silly as to do so, your ideas would be tantamount to 
suggesting that every firearm be imprinted with the words, 
"Only for use against lawbreakers."  Not only could the 
IETF not make it happen, the words would be ineffective 
even if imprinted.

Let me say that I agree that wiretapping, when and where 
conducted, *should* be conducted under stringent 
conditions that reduce as much as possible the opportunity 
for tampering with the intercepted traffic, and should 
only have access to such traffic as the law explicitly 
requires.  None of that, however, has anything to do with 
IETF standards, since stringent conditions (whatever they 
may be, and they needn't be protocol-based), punishments 
for tampering, requirements for verification and 
validation, are all matters of law, not protocol 
standards.  Your starting place for your campaign is not 
here, but in the legislatures.  You are seeking *legal* 
standards, not technical standards.  If, some day, there 
are legal standards for such objectives, then technical 
standards will follow quite naturally, although perhaps 
even then not from the IETF.  If there are no legal 
standards for the conduct of wiretaps, technical standards 
are meaningless and unenforceable.

Regards,

Thomas Junker
[email-masked]

---

From: "Richard Payne" <[email-masked]>
Date: Wed, 24 Nov 1999 15:19:59 -0500

ch*fr*n wrote:

>> Wasn't the previous ch*fr*n position something like "if a democracy does
it,
>> it's right"?
>>
> Yes, still is, we have not choice. Democracy is a one way
> street. If democracy states the work you do know is illegal
> and you go on you have to face a penalty.
>
> The only allowed way to change things is voting on better
> politicians or let others vote you.

which is truly amazing, since it implies that there is nothing (_nothing_)
that is forbidden to a democracy, and that oppression of 49% of the
population by 51% can commence. All is in the hands of the government.

<joke> Golly, how wise they must be! </joke>

<bigjoke> Do People's Democracies count too? </bigjoke>

Most people would agree that some things (e.g. your choice [or not] of
spouse, your choice [or not] of religion, your expression of your opinions)
are not legitimate areas for popular vote. These are called rights or
freedoms: they are things you get to decide yourself. You don't pick a
politician to get these rights: most people would treat the rights as more
primary than the politicians.

If there are such things as rights then there are some things that
democracies may _not_ do, even if "authorized" by a 99-to-1 vote in favor.

Many people on this list think that freedom to communicate privately is in
the same category of things you get to decide yourself. I agree with them.

Separately, given the potential for misuse of surveillance technology by bad
governments and rogue cops, I _have_ to agree with them because of the
potential consequences. A point that many people have made is that getting
this wrong would be remarkably difficult to recover from.

Richard Payne

---

From: "Richard Payne" <[email-masked]>
Date: Thu, 25 Nov 1999 17:35:59 -0500

ch*fr*n wrote:

> Richard. IF you would agree with tapping, I know that's a
> pretty big IF, so just in that hypothetical case, would you
> be for audited taps, for unaudited taps or perhaps a third
> option?

I don't agree with tapping. Additionally, I don't believe that your approach
to audited tapping, well-intentioned as it might be, would actually keep bad
governments/cops/crackers from doing bad things. There is no way for
hardware to tell the ethics of the person using it, and there is no way to
ensure that an ethical third party ever sees the audit trace, assuming it's
turned on in the first place.

In short, I think the right answer to your question is to avoid asking it,
by using tap-resistant protocols.

ch*fr*n also wrote:

>> >It won't. And our more and more open society will prevent
>> >Hitlers from standing up so quickly.
>> >
>> >We have seen ultra-nationalists here in The Netherlands. The
>>
>> which of course claims precognition,
>
>Just an example.

We both know you can't prove something won't happen by citing an instance
where it didn't. I think it is more likely that a government will become
oppressive if it has extensive means of surveillance, you think it's not. I
would prefer not to put it to an experimental test because if I'm right, I
don't get to end the experiment. Clear?

ch*fr*n also wrote:

>> and limits the scope to the Netherlands: a fine country,
>> no doubt, but not the world. Think China, Russia, and
>> some of the African countries.
>
>Pretty primitive countries with more serious excesses. We
>had our last real war only 55 years ago. Most of those
>countries at most 5 years.

which seems short-sighted to me. Chinese pro-democracy (there's that word
again) dissidents are being sentenced to 10-12 years in jail for
unauthorized email contact with the outside world. They need strong
end-to-end crypto, not an infrastructure that makes it easier for the
government to spy on them. Politics in the other countries being what they
are, I think this argument generalizes pretty easily to them.

The fact that they've had evil and murderous leaders up until now (with some
exceptions) tilts the balance away from allowing more state surveillance,
don't you think?

Richard Payne