How to fight GAK by obeying the law

[Ernest Hua <hua@chromatic.com>]

It seems that the best method for fighting GAK is to accelerate
wide-spread domestic use of freely redistributable non-GAK crypto.

The Lynux automatic firewall concept that John Gilmore is pushing is a
great idea, but it is still brewing, and he's shooting for developing
an exportable ... er ... importable version.  That will take much time
to develop, and time is what we don't have much of.

We need to work on applications, API's, flexible software modules, etc.
and the primary reason we cannot do it so easily is because we cannot
redistribute the software so easily.

First thing we definitely need is a way to determine with fairly good
accuracy, whether a host is in the U.S.  This MUST be an automagic
mechanism ...  no person involved so there is little delay in getting
the goodies.  The best implementation would automatically set the
group of an incoming anonymous FTP session daemon to a special group
if there is a high degree of certainty that the originating host is
within the U.S.

Second thing we definitely need is a convenient way and universal way
to clearly notify the recipient of the current export restrictions of
such software, so that the recipient knows what he/she is in for.

Basically, we have to do our best to NOT violate the law, no matter
how much we hate it.  What the government wants to happen is that
everyone will get hooked on GAK, and it will be too inconvenient to
use something else.  A good counter-strategy is to get everyone hooked
on the good stuff.

Right now, the FBI/NSA is looking for an excuse to prosecute anyone
not jumping on their bandwagon.  We have to avoid give them an excuse
to prosecute us while still enabling rapid application development.

Communication and distribution are key.

Ern