Re: Crypto Exports, Europe, and Conspiracy Theories

[tcmay@got.net (Timothy C. May)]

At 4:12 AM 1/25/96, Michael Froomkin wrote:
>On Wed, 24 Jan 1996, Timothy C. May wrote:
>[...]
>>
>> Specifically, I believe--though obviously cannot prove, given the nature of
>> time--that a cryptographically strong version of Netscape developed outside
>> the borders of the U.S. would not be freely importable into the U.S. I
>
>Nope. Nope. Nope. Nope.  Donuts to dollars that it's freely importable.

First of all let me say that I take no offense at Michael's "Nope. Nope.
Nope. Nope." opening. This is the kind of interesting debate we need to
have!

But let me address a specific question first:


>> don't know what form such a law would take, to answer the point raised in
>> another post by Peter Junger. Nor am I saying either State or NSA passes
>> the laws...the ITARs have worked largely because they have never been
>> challenged; if they were to be successfully challenged and stricken, as
>> even some folks inside the NSA think is likely if tested in a proper case,
>> then a Four Horseman-scared Congress will likely step in with some
>> restrictions.
>[...]
>
>OK, Tim, what am I missing?  How will Enhanced-crypto-Netscape match
>remailers for their ability to keep TLAs up at night?

Once one has good encrypted links, including access to a variety of
offshore sites,  remailers cannot be stopped. The TLAs may not like them,
and the courts may rule that a remailer site is strictly liable for
misdeeds which impinge on its remailers (I'm not convinced this is so, but
no matter), but what do U.S. courts have to say about Dutch remailer sites?
What will the Fifth Circuit be able to do to hactic.nl? Or chains of
remailers that pass through Norway, Japan, Estonia, Italy, and Lower
Slobovia?

We've already got that with PGP, of course, so it's to some extent moot.

All of the mentions recently about strong crypto built into Netscape,
Mosaic, AOL, etc., have to do with the _popularity_ and _ease of use_
issues, not the existence proof. That is, having strong crypto built in to
Netscape will not give us a capability we don't already have, just give it
to more people and more conveniently.

Back to the issue of remailers and anonymous servers as choke points. I
agree. These are the real threats to traffic analysis, which is of course
why I have so emphasized them in my own writings for so many years!!

I take it as a given that no remailer services will operate for profit,
publically, and with support built in to Netscape, at least not openly and
identifiably within the U.S....it is too controversial. (I don't mean that
most of the remailers are not U.S., now, I mean after the heat gets turned
up, after the next "Oklahoma City bomber" is found to have been
communicating with remailers! An awful lot of remailer sites will vanish
overnight. In act, evidence that remailers are being used may be
manufactured.)

Fortunately, and I keep coming back to this, the beauty of PGP is that the
encryption is in the text blocks within mailers, browsers, etc., and little
or no hooks to external programs are needed. (We often moan about this, and
wish for PGP 3.0 or 4.0 to have all kinds of hooks, but there is a certain
elegance about a text-block-centric program, with hooks made later on an ad
hoc basis....it is so terribly difficult to control what's in a text block
that suppression of PGP is very hard.)

--Tim May

Boycott espionage-enabled software!
We got computers, we're tapping phone lines, we know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay@got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Higher Power: 2^756839 - 1  | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."