Subject: [Raven] ch*fr*n's position: a summary

From: "Richard Payne" <[email-masked]>
Date: Mon, 1 Nov 1999 17:42:34 -0500

Call me Sisyphus. Call ch*fr*n the Energizer Bunny. <sigh>

A person hailing from the Netherlands, whom I will not name, advocating a
wire-tapping standard, wrote some things that make me wonder whether there's
a logic course one of us should be taking. For example:

> > 1) Private possession of strong crypto should be illegal.
>
> =NO= It should be regulated. For example not for use within
> a country with proper and responsible communication
> providers and between countries with such providers.

Now if that doesn't mean making it illegal in the "not for use" zone, what
exactly would? Using "regulation" as a euphemism for "making illegal" may
fool a few people, but surely not too many. I won't even ask who gets to
decide who has proper and responsible communication providers - I'm sure
that countries will just be lining up to declare themselves full of
_improper_ and _irresponsible_ communication providers.

This change would have the effect of making many protocols (e.g. SSL)
unusable by anyone who wasn't a responsible communication provider - I'd
call this a noticeable side effect, since it would wipe out e-commerce in
one shot.

For extra amusement value, note that this approach is almost exactly the
opposite of how U.S. and Wassenaar treatment of crypto works - it's ok
inside "good" countries and for export to "good" countries. See "regulation
of crypto", below.

This same person wrote, as their entire response to my pointing out a few
slight difficulties with getting the crypto genie back in the bottle at this
late date:

> Yuck!

which is certainly succinct. An expansion of this argument might be in
order. I really can't see how it can be done without confiscating all the
computers and lobotomizing all the mathematicians and programmers. The
argument that most people would obey a law making private use of crypto
illegal is extremely dubious: the whole rationale for such a law would be to
catch criminals, who are notorious law-breakers in the first place.

And then there was:

>> 3) You must prove your innocence to police, rather than them proving your
>> guilt.
>
> Thats about dishonest. I just stated that with free
> encryption you will get precisely that, 1+1=2.
> First signs are there. Reno stated already things in that
> direction.

In this unnamed person's posts there has been a repeated stress on the
importance of a user being able to demonstrate their innocence, either by
submitting to taps, by not using crypto, by revealing their keys, or some
combination of these. Although this may make sense under the Dutch legal
system, it does not elsewhere.

In countries with legal systems descended from the English common-law
system, the basic principle of criminal law is "innocent until proven
guilty". I do not believe that Janet Reno can change that principle in the
U.S. (pesky Supreme Court), and for those of us outside the U.S., it doesn't
really matter.

The gem:

> 128bit key's aren't exported.

which I take to mean that cryptographic software using 128 bit symmetric
keys cannot be exported, is just plain false.

A number of Wassenaar-signatory countries (e.g. Canada) are developing or
have developed general licenses permitting 128-bit exports after a one-time
review - and of course not all countries are Wassenaar signatories. Of
course, I am also certain that every programmer in every country fully
understands their export control obligations and would especially never
share work on an open-source OS like Linux that might have crypto
components. ;-)

Finally, we come to:

> Please try writing without names into it, it will help you
> to get better letters.

No sooner said than done. Notice the improvement?

Richard Payne

_______________________________________________
raven mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/raven

---

From: "Lyal Collins" <[email-masked]>
Date: Tue, 2 Nov 1999 17:23:48 +1100

I'm disturbed that there is a consistence impression of some list members
have that regulation is inherently bad.

Where would medicine, cars, and elelctrical applicances be if regulations
didn't ensure a consistent outcome?
Drugs that don't heal but produce profits, cars that have no safety
features, and appliacnes that are potentially lethal (literal pun intended).

A thought in this debate is that a lack of self regulation on IP based
communication means that anyone (including Pat the Policeman and Harry the
Hacker) can monitor to their heart's content today.

There is no consistent toolset being used, or indeed available to either
preclude monitoring at all, or permit audited monitoring under appropriate
checks and balances.

The small pools of IPSec, Skip, S/Wan, S/MIME, and SSL traffic do not make
much difference, overall.

Perhaps the discussion can move to one of "how do we build a common, privacy
oriented, toolset that everyone uses?", preferably with audited access
capability where required by domestic laws.

Regards,
Lyal

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On Behalf Of
> Richard Payne
> Sent: Tuesday, 2 November 1999 9:43
> To: [email-masked]
> Subject: [Raven] ch*fr*n's position: a summary
>
>

---

From: "Thomas Junker" <[email-masked]>
Date: Tue, 2 Nov 1999 01:18:06 -0600

> have that regulation is inherently bad.

Some of us are no doubt disturbed by views that regulation is inherently good.

> didn't ensure a consistent outcome?

With a functioning tort system, possibly a lot better than they are now.  In 
the common law countries, regulation has risen in apparent value in direct 
proportion to the undermining of rational tort law.

> Drugs that don't heal but produce profits

We seem to have plenty of those *with* regulation...

> cars that have no safety features

We seem to have cars with safety features that *kill*.

> and appliacnes that are potentially lethal (literal pun intended).

Everything is potentially lethal.  For an especially scary example, see:

    http://www.dhmo.org/facts.html

> capability where required by domestic laws.

Perhaps not, because that is not the issue before the group.  Specifically, 
since some seem to have become confused about the issue, the questions posed 
to the IETF by the IESG were:

>   "should the IETF develop new protocols or modify
> existing protocols to support mechanisms whose primary
> purpose is to support wiretapping or other law
> enforcement activities" 

To which I say, "No."

>  and 
> 
>  "what should the IETF's position be on informational
> documents that explain how to perform message or
> data-stream interception without protocol
> modifications".   

To which I say, "They have no place in the literature sanctioned, 
promulgated or disseminated by the IETF."

> In addition to the general questions identified above,
> we believe it would be helpful for mailing list comments
> to address the following more specific questions: 

>   Adding wiretap capability is by definition adding a
> security hole. Considering the IETF's commitment to
> secure protocols, is it a reasonable thing to open such
> a hole to meet these requirements? 

To which I say, "No."

>   Should the IETF as an international standards
> organization shape its protocols to support
> country-specific legal requirements? 

To which I say, "Definitely not."

>   If the companies who employ the IETF participants and
> deploy the IETF's technology feel that having wiretap
> capability is a business necessity due to the
> regulatory requirements in the countries where they
> want to sell their products, would that make a
> difference to the IETF position on this subject? 

To which I say, "No, it should not."

>   What is the appropriateness or feasibility of
> standardizing mechanisms to conform to requirements
> that may change several times over the life cycle of
> equipment built to conform to those standards?  

To which I say, "None."

>   When IPv6 was under development, the IETF decided to
> mandate an encryption capability for all devices that
> claim to adhere to those standards.  This was done in
> spite of the fact that, at the time the decision was
> made, devices meeting the IPv6 standard could not then
> be exported from the U.S. nor could they be used in
> some countries. Is that a precedent for what to do in
> this case? 

To which I say, "Yes, if the precedent implied in the question is that of 
setting the most secure standards possible without regard to local laws."

>   Could the IETF just avoid specifying the part of the
> technology that supports wiretapping, presumably
> assuming that some industry consortium or other
> standards organization would do so?  Would letting that
> responsibility fall to others weaken the IETF's control
> over its own standards and traditional areas? 

To which I say, "Who cares?"

>   If these functions must be done, is it better for the
> IETF to do them so that we can ensure they are done in
> the most secure way and, where permitted by the
> regulations, to ensure a reliable audit capability? 

To which I say, "No.  No such assurance can be provided by protocols, since 
reliable audit is an administrative and legal mechanism, not a protocol 
mechanism."

>   What would the image of the IETF be if we were to
> refuse to standardize any technology that supported
> wiretapping? 

To which I say, "Commendable, by any sane standard."

> In the Internet community? 

To which I say, "I believe most of the Internet community would applaud a 
refusal by the IETF to be drawn into facilitating invasions of privacy and 
persecuting people around the world."  

> In the business community? 

To which I say, "Mixed, but by and large also a positive image."

> To the national regulatory authorities? 

To which I say, "Who cares?  Why make them any gifts?"

So, did you see anywhere in there a question from the IESG like, "How do we 
build a common, privacy oriented, [wiretapping] toolset that everyone uses?"  

I didn't think so.

Any questions?

Regards,

Thomas Junker
[email-masked]

The Unofficial Wang VS Information Center
http://www.phoenix.net/~tjunker/wang.html

The Live VS Web Server
http://www.tjunker.com

---

From: Sandy Harris <[email-masked]>
Date: Tue, 02 Nov 1999 06:18:45 +0000

Lyal Collins wrote:

> oriented, toolset that everyone uses?",

The largest obstacle to that is various governments' attempts to block
effective privacy measures via crypto export laws, "law enforcement
access" requirements, key length limits, mandatory key escrow, ...

So maybe the discussion should move to how we deal with such gov't
policies? No need; that's been clearly stated in RFC 1984.

---

From: Paul Ferguson <[email-masked]>
Date: Tue, 02 Nov 1999 07:12:21 -0500

>much difference, overall.

Don't make any difference? I beg to differ. Just with SSL alone,
e-commerce on the Internet this year has claimed how many billions
of dollars in transactions?

That bus has already left the station....

- paul

---

From: "chefren" <[email-masked]>
Date: Tue, 2 Nov 1999 16:06:18 +0100

> regulation is inherently good. 

It isn't. Probably exactly as much as democracy isn't 
inherently good.

..

> proportion to the undermining of rational tort law.

A talks about medicine, B thinks it's appropriate to start 
about torture???

This is like what in electronics sometimes is called a 
"bang bang" control.

Everything should be 100% good or 100% bad?

NONSENSE.

..

>     http://www.dhmo.org/facts.html

This clearly demonstrates a total absense of how the 
majority of your fellow citizens are organized, live and 
think and how they resolve conflicts.

..

> > purpose is to support wiretapping or other law

Wiretapping is just an means to get evidence. The quality 
of the evidence can be improved with good standards.

It's not reasonable to obstruct the quality of evidence in 
courts.

..

+++chefren

= =
Verdien 100 Euro bij aanbrengen van een nieuwe
klant voor een website: http://www.ii.nl/premie

---

From: "Lyal Collins" <[email-masked]>
Date: Wed, 3 Nov 1999 06:43:09 +1100

Regards,
Lyal
> Some of us are no doubt disturbed by views that regulation is

So am I.
Carefully crafted regulation can have positive benefits that outweigh the
negatives.
Lyal

---

From: "Lyal Collins" <[email-masked]>
Date: Wed, 3 Nov 1999 07:03:46 +1100

Agreed, I wouldn't see crypto export as an inhibitor either.

Perhaps the single area of market equality in regionally sourced technology
products is crypto.  I'm sure there are others - I am just unfamilar.
The majority of everything else in software and hardware (ie common tools,
operating systems etc) comes from the US (a non-US perspective)

The presence of a standard does not stop local development efforts - which
happens locally with PGP, SSL, S/MIME, Linux and "crypto aware Smartcards"
product lines.

Changing the approach  from "use crypto if you want" to one of "use crypto
unless you choose not to"  appears to be widely supported on this list.

Regards,
Lyal

> Sandy Harris
> Sent: Tuesday, 2 November 1999 17:19
> To: [email-masked]
> Subject: Re: [Raven] ch*fr*n's position: a summary
>
>
> Lyal Collins wrote:
>

---

From: "Lyal Collins" <[email-masked]>
Date: Wed, 3 Nov 1999 06:53:29 +1100

> of dollars in transactions?

Have you thought how much ecommerce occurs without SSL?
On personal experience, at least 20% of web-based ecommerce uses no
encryption at all, neglecting email.  Some slightly differnet stats at
http://www.abanet.org/scitech/abaacca.html
Almost 100% of non-ecommerce traffic uses no encryption at all, despite the
fact it _could_.

Making a defacto version of email, http, ftp etc that always uses encryption
would probably be preferable, from the discussion to date.

Lyal

---

From: "Thomas Junker" <[email-masked]>
Date: Wed, 3 Nov 1999 01:28:57 -0600

> A talks about medicine, B thinks it's appropriate to start 

If you wish to participate in a discussion taking place in English, kindly 
*learn* English.  "Tort" has nothing to do with "torture."  Essentially, a 
"tort" in Anglo-American law is an injury, and "tort law" is the body of law 
dealing with injured parties holding those responsible for the injuries 
accountable for damages and other penalties in a civil action.  When the tort 
system functions well, parties who injure others find themselves held 
accountable, just as when the criminal justice system works well, criminals 
find themselves held accountable.  A good tort system provides significant 
disincentives to carelessly or willfully cause harm or damage to others, since 
there will probably be a hefty price to pay.  A hacked up, crippled tort 
system such as we have had for years allows the reality and the appearance of 
a lack of recourse, which encourages people to seek "inspection" and 
"prevention," which intrude on privacy and rights generally while a system of 
accountability does not.

As accountability diminishes, calls for regulation (inspection and control 
intended to be preventative) increase.  As a society gives up on 
accountability, it surrenders to boundless regulation.

Buy a dictionary.

> think and how they resolve conflicts.

I have no idea what you are trying to say.  How do your words relate to the 
link I offered you?

> of the evidence can be improved with good standards.

That's not the issue.  The IESG did not ask us what we think about quality of 
evidence.  The IESG asked us to discuss answers to several specific questions 
bearing on policy.

> It's not reasonable to obstruct the quality of evidence in 

Nor is "obstruction" the issue.  Neither the IESG nor the IETF has any 
obligation to do anything special to facilitate wiretapping, nor even to 
recognize that many governments engage in wiretapping of one shade of brown to 
another.  Not doing something one is not obligated to do does not constitute 
"obstruction."  If I want to travel to Chicago and chefren ignores my wish 
instead of helping me plan how to get there, is chefren "obstructing" my 
travel to Chicago?  Of course not.

There is no general moral or legal obligation to gratuitously help the police 
or the courts improve the quality of evidence presented in courts.  Gathering 
evidence is the responsibility of the police.  Judging the admissibility of 
evidence is usually the responsibility of the courts.  Setting the ground 
rules for both police and courts is usually the responsibility of the 
legislature.  In a structure such as the constitutional, representative 
republic of the U.S., all three branches of government have defined powers 
delegated to them by "the people" and may not legitimately overstep the bounds 
of those powers.  What happens in actual practice is no more a definition of 
the principles than the victimization of someone by a criminal is the 
definition of the law.

My comment, way up there near the top of this message, was addressed to Lyal's 
assertion that regulation is necessary and produces good results.  It is 
difficult to see what mechanisms would be at play and what results would be 
produced were regulation *not* in place, because regulation suppresses other 
mechanisms and makes comparison impossible.  This is related to the thesis of 
"That Which Is Seen, And That Which Is Not Seen."  Frederic Bastiat, 1850.

    http://www.freedomsnest.com/fn/bastiat.html

Regards,

Thomas Junker
[email-masked]

---

From: "Ge' Weijers" <[email-masked]>
Date: Wed, 3 Nov 1999 07:55:30 -0700

> system, it does not elsewhere.

Of course it does not make sense under Dutch law, but you have to bend
the truth to fit your beliefs :-( According to current Dutch law a
suspect can't be asked to provide decryption keys, for instance. And
the last attempt to 'regulate' encryption met with so much resistance
it was quickly shelved. NL has its own Louis Freehs and Janet Renos,
but their arguments have not impressed too many people yet, except
maybe some participants in this discussion.

Unnamed person gave us one more argument to always design perfect
forward secrecy into protocols, to make legal coercion to provide your
keys a moot point.

Ge'

-- 
-
Ge' Weijers                                Voice: (614)326 4600
Progressive Systems, Inc.                    FAX: (614)326 4601
2000 West Henderson Rd. Suite 400, Columbus OH 43220

---

From: Mark Atwood <[email-masked]>
Date: 04 Nov 1999 16:21:19 -0800

> A talks about medicine, B thinks it's appropriate to start 

While you're statement may be sickenly funny to someone who
has endured being sued, maybe you should break out an English
dictionary and look up "tort".
> It's not reasonable to obstruct the quality of evidence in 

Not only is it reasonable, it the system that is used to
keep the courts and the police in check.

-- 
Mark Atwood               | 
[email-masked]             | 
http://www.pobox.com/~mra |