No Subject

["A. Padgett Peterson P.E. Information Security" <PADGETT@hobbes.orl.mmc.com>]

>Yet if I read you correctly earlier, you don't think the USG has the right 
>to regulate those communications. Why the distinction ?

Okay, obviously I need to drop down a gear & explain *my* feelings:

Part of the definition of a "sovereign nation" is to define and carry
out both high and low justice over it's domain - the absolute right
of a sovereign. Is not mentioned in the US constitution because it 
was a given. Further, the purpose of the US Constitution is to:
a) define what the sovereign was (three branches - rock, scissors, & paper)
b) set forth certain limitations on that sovereign ("Congress shall make
   no law...")
c) define certain duties of the sovereign (regulation of foreign commerce...)

(am simplifying so please bear with me)

There are some things which for which the rationale is not apparent since
the times have changed ("corruption of blood" is a "Congress shall not"
that related back to English law of the time). What "Attainder" was
is not mentioned since it was well understood.

No this gets us back to the question: to me, "regulation of foreign commerce"
has two elements - one is to prevent illegal commerce or traffic in goods 
that are contrary to "the public good". The other is to promote American
trade and intrests overseas. The two go together and is the point I made
at the NIST gathering in December. Quid pro quo.

"Free speech" means that a citizen is free to speak (communicate) anthing,
anytime, anywhere. This is the right guarenteed by the first amendment. This
does not relieve the individual from being liable for the consequences of 
the exercise of "free speech".

However, the government is under no obligation (though in the silly seventies
it seemed that we were going that way) to aid or abet in the exercise of
free speech. If it were properly and legally decided that communications 
with anon.penet.fi is against "national interest" then the sovereign has 
not only the "right" but the *duty* to block/monitor such communications.

Now as to the second part of the question, I have never said that the 
conditions mentioned above could not legally exist (though I have my
doubts about legality internally and between citizens - is part of the
reasons American Corporations have never had a problem getting a license
for use with foreign offices). What I said was that any such regulation
would be impossible to enforce for two reasons:

1) While current crypto advertises its presence, crypto exists which
   is indestinguishable from random noise and would be impossible to
   prove was used. Further it would be necessary to specify what was
   not crypto (and the law frowns on negatives). Navaho, Basque, PKZIP,
   and EBCDIC are examples that fall readily to mind.

2) The second objection is more obscure but should be considered in places
   that lack our constitutional protections: given a message, any message,
   I can demonstrate a OTP or algorithm that will turn that into any
   message desired. Therefore just the existance of a message and a
   decrypt would be insufficient to prove the "chain" that one led from/to
   the other.

Thus in the one case, I referring to the obligations/limitations that our 
constitution places on the US government (is what it is really about). In
the other I was referring to what it is *possible* for the government to 
do without considering legality (if they can't, does not matter if legal). 
Does this clear up the confusion ?

						Warmly,
							Padgett

ps just to add some more wood "any law that can not be demonstrated to be
   universally enforceable with the resources allocated should be repealed".