Re: Schneier's source code

[Phil Karn <karn@qualcomm.com>]

As you can tell from John Gilmore's files
(ftp://ftp.cygnus.com/pub/export) I filed my original request, for the
book itself, by fax on Feb 12.  The letter in response was dated March
2, but I didn't receive it in the mail until March 8. That puts it
within their 15 business day limit if you don't count the mail delay.

My second request (for the floppy containing exactly what was in the
book) was filed by fax on March 8. I had to revise the title, so the
actual filing date is more like March 10 (that's the date you get if
you call up their automatic license status system and punch in the
case number). That makes it 7 weeks, well over their 3-week (15
business day) limit.

Odd that it should take so long to clear information that has previously
been cleared on another medium, eh?

Yes, I think they're clearly stalling since either way they rule
they're putting themselves in a tough spot. That was exactly my
intention.  As to what to do next, I don't know. I don't think the
15-day rule is binding in the sense that 10 days is binding under the
FOIA (not that that makes any difference, of course). They say that CJ
requests normally take upwards of two months, and could claim that the
15-day rule is something they advertise without actually promising to
meet it. Just like 2-day priority mail.

It has occurred to me that it wouldn't hurt for others to file CJ
requests for other cases of published cryptographic source code, to
help build up a foundation of these things. There are plenty of
examples to choose from. For a list, see
http://www.quadralay.com/www/Crypt/DES/source-books.html. Filing CJ
requests is actually quite easy; see John's "CJR kit" (in the
aforementioned FTP directory on ftp.cygnus.com) for all the details.

If you do file a CJ request, be sure to send a copy to John so he
can include it in the files.

Phil