Subject: Re: Campaign and Petition Against Clipper (RISKS-15.48 and 15.50)

From: [email-masked] (Dorothy Denning)
Date: Fri, 11 Feb 1994 14:09:16 -0500 (EST)

The following comments are in response to responses posted in RISKS-15.50
on my earlier comments in RISKS-15.48:  

>From Marc Rotenberg:
> 
> The NSA is responsible for foreign signal interception.  It has no legal
> authority to conduct wire surveillance.  What are the NSA's "national
> security" interests in domestic wire surveillance?

I do not believe that NSA has any particular interest in domestic wire
surveillance.  I expect their concern is that if a product with a very
strong algorithm such as SKIPJACK were to be manufactured without keys
being escrowed, then such products would be very attractive on the
foreign black market (presumably, such products would not be
exportable) where they could interfere with foreign intelligence.

> The FBI made certain claims that cryptography was impeding criminal
> investigation conducted by wiretap.  CPSR investigated the FBI's claims by
> filing a Freedom of Information Act suit to obtain the relevant documents.
> The documents provided to us by the Department of Justice revealed that none
> of the FBI field officers had encountered any obstacles.  The Department of
> Justice has just informed us that they provided to us all relevant documents
> concerning the Clipper proposal.

In testimony before the Computer Systems Security and Privacy Advisory
Board (CSSPAB) at NIST, James Kallstrom of the FBI said that encryption
was stymying the effort in more than three but less than ten of ongoing
cases.  The FBI does not give details of ongoing investigations, so this
information would not be available through FOIA.

> There is one reported case where cryptography made it difficult for law
> enforcement to obtain evidence. That case concerned reading the contents of a
> file on a hard disk after it was seized.
> 
> If this is the problem that the Clipper proposal is intended to solve, then
> the key escrow scheme must be extended to every single encrypted file -- not
> just encrypted communications -- everywhere in the world.

I've heard of 3 cases now where encrypted files could not be decrypted, 
but law enforcers seem to be much more concerned about communications
than stored files.  Clipper does not address file encryption.

> An FBI legislative proposal now under consideration at the White House would
> mandate a Clipper-like scheme. That proposal is backed by fines up to $10,000
> per day and jail time.

Everything I've seen has said Clipper is voluntary.  Quoting from the standard:
"This standard does not mandate the use of escrowed encryption devices by
Federal government agencies, the private sector or other levels of government."
Dept. of Commerce, NIST, Docket No. 930659-4017, RIN 063-AB19, Approval
of FIPS 185, Escrowed Encryption Standard (EES).

> >  I support this objective.  Unfortunately, it is not 
> >  possible for most of us to be fully informed of the 
> >  national security implications of uncontrolled 
> >  encryption.  For very legitimate reasons, these cannot 
> >  be fully discussed and debated in a public forum.  
> 
> This assertion has never been supported by evidence.  It has been used simply
> to stifle criticism.

Certain information relating to foreign intelligence operations is
classified.  Are you saying that decisions should not be based on
classified information or that foreign intelligence information should
not be classified? 

> CPSR did not participate in the inter-agency policy review. Our position from
> the very beginning is that these decisions must be made openly.

As part of the inter-agency review, the CSSPAB was asked to sponsor hearings
on the proposal.  These were held in June.  The testimony that was presented
was given to the government.  Marc gave a presentation at those hearings, as
did David Banisar of CPSR.  Several people in the government who have been
participating in the inter-agency review were present at the hearings.  There
have been several other forums as well, including one sponsored by CPSR last
June.  Again, several people participating in the inter-agency review were
present.

> >  In the absence of understanding 
> >  the national security issues, I believe we need to 
> >  exercise some caution in believing that we can 
> >  understand the full implications of encryption on society.
> 
> This premise, if accepted, would mean that people in the United States would
> have no right to express political views when the government claimed "national
> security." Certainly, there are matters of national security that must be

I did not mean to suggest that people should not express their views.  Being
cautious is different from being silent.

>From George Talbot:
> 
> Second, law enforcement needs to get a court order to intercept phone
> communications.  I know of no such need to get a court order to intercept
> communications on a high speed network w.r.t. Capstone.  The current
> administration proposal does not require a court order to get the escrowed
> keys themselves.

You need a court order to intercept any electronic communications, including
those on high speed nets.  You need a court order to get keys.  Although the
court order is not given to the escrow agents (to protect the identity of
those under investigation), certification that one was obtained must be
presented to the escrow agents.  In addition, this certification must be
confirmed by an attorney associated with the U.S. Attorney's office (for a
Title III federal wiretap) or an attorney associated with the DOJ Office of
Intelligence Policy and Review (for a FISA wiretap).  For a local wiretap, the
certification must be submitted by the principal prosecuting attorney of the
state or political subdivision thereof.

Fred Cohen wrote:
> 
> >Hundreds of people is hardly overwhelming in a population of 250 million ...
> 
> Do you claim to believe that the great silent majority is in favor of Clipper?

No I do not.  I was merely attempting to point out what I believed was RISKy
logic.
> 
> In the light of 5,000 years of cryptographic history where experts claimed
> that systems were very strong only to find them broken soon after, I find it
> hard to trust the hand picked committee of 5 so-called experts who are given
> money and time to pass judgement on a technology that is so weak that they are
> afraid to expose it to the light of day.  If it is so strong, why not let the
> rest of the world review it? The German experts said the same thing about

We were not paid.  The main reason for not making the algorithm public
is that one could build inter-operable products that bypassed key
escrow, but that took advantage of the very strong algorithm.
> 
> Why is it that you think you understand more about the implications of
> cryptography on national security than the rest of us? This elitist crap has
> got to end.  It is bad for our country to have elitists who believe they know
> more than the rest of us dictating how we will live our lives.  It is bad for
> our country that the esteemed members of this forum do not have access to your
> rational in order to openly discuss your points of view.  It is bad for our
> country that professors at universities tell their students and the public not
> to think about the issues, but to trust that the professors know best.  If you
> want to serve the national interest, get the debate out in the open!
> 
I did not mean to suggest that I understood the national security issues.
I do not.  Nor did I mean to suggest that people should not think or
talk about the issues.

Dorothy Denning