Subject: Re: Clipper Overseas

From: [email-masked] (Christopher Davey)
Date: 21 Feb 1994 02:40:47 GMT

Christopher Zguris <[email-masked]> writes: I haven't seen
    this discussed so I'm going to ask. What are the implications for
    Clipper's use on communications between US and foreign countries
    and companies? If company A in the US is communicating with Company
    B is some other part of the world over a Clipper-encrypted data
    link couldn't the NSA legally monitor and decode the communition if
    they chose to do so? It's a given that the NSA monitors a lot of
    data communications, and I remember reading about the monitoring of
    US communications using NSA equipment in foreign countries thereby
    by avoiding the issue of monitoring on US soil, so couldn't the
    same trick be used to monitor communications in foreign countries
    that would also include US links? If we're talking about a
    world-wide link than a monitoring link in a foreign node could give
    access to the whole thing.  How does key escrow affect potential
    international users?  Anybody care to shed some light on this
    subject?

I read a article in the "Independant on Sunday" last weekend, which that
a senior NSA official, James Hearn was in London "with the task of selling 
the 16 governments of the European Union and European  Free Trade 
Association on the virtues of a controversial electronic scrambling 
technology" - ie Clipper.

The question in my mind is, are the governments of these independant 
countries going to adopt Clipper, if they do not have the ability to
decrypt it ? No way ! And I bet they don't have to go through the escrow
agencies in the US either.  In which case, the whole thing seems wide open.

-- 
Chris Davey                       Internet: [email-masked]
Quay Financial Software           Phone   : +353 1 6612377 Fax: +353 1 6607592

---

From: [email-masked] (Todd Jonz)
Date: 21 Feb 1994 02:40:49 GMT

Christopher Zguris ([email-masked]) writes: If company A in
    the US is communicating with Company B is some other part of the
    world over a Clipper-encrypted data link couldn't the NSA legally
    monitor and decode the communition if they chose to do so?

Sure, assuming that they had the private keys for both companies.  But
this would mean that the escrow mechanism for these keys wasn't worth a
damn.  That's what's so scary about the whole Clipper proposal.

Imagine if one of the conditions of securing a federally funded home
loan were that you make a copy of your front door key and entrust it to
your local police department for the duration of the loan.  Even
assuming that you trust your local police department implicitly as an
organization, if there's even one individual in its employ with access
to that key who can be compromised, you might as well just leave your
front door open.

    How does key escrow affect potential international users?

It seems to me that the biggest threat to international users would be
the potential for Clipper to become ubiquitous in the U.S.  One
objective of the Clipper proposal is to discourage the private sector
from bringing competitive systems to market.  If this tactic is
successful, it would mean that foreign companies wishing to do business
with U.S. firms would have little choice but to jump on the bandwagon.