[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
(INFO) Leahy/Goodlatte introduce crypto bill
========================================================================
__ _________ __
\ \ / /_ _\ \ / / Voters Telecommunications Watch (VTW)
\ \ / / | | \ \ /\ / / (We're not the EFF)
\ V / | | \ V V / URL:http://www.vtw.org/
\_/ |_| \_/\_/ Mar 5, 1996 (expires Apr 5, 1996)
SEN. LEAHY (D-VT) AND REP. GOODLATTE (R-VA) INTRODUCE
"ENCRYPTED COMMUNICATIONS PRIVACY ACT"
TO THWART CLINTON ADMINISTRATION'S FLAWED CLIPPER PLAN
Please widely redistribute this document with this banner intact
________________________________________________________________________
CONTENTS
The Latest News
Analysis of Leahy bill
What You Can Do Now
Chronology of Leahy bill
Press Contact Information
A few questions and answers
Our policy on financial donations
________________________________________________________________________
THE LATEST NEWS
In the opening round of what promises to be a no-holds-barred fight
with the Clinton Administration and the Intelligence community over
cryptography policy, Senator Patrick Leahy (D-VT) and Representative
Robert Goodlatte (R-VA) presented bills today that intend to:
-decontrol the export restrictions on mass-market and publicly
available software such as Phil Zimmerman's "Pretty Good Privacy"
(PGP),
-affirm Americans' right to use cryptography of their own choosing,
-affirm Americans' right to *not* use key escrow systems,
-make it a crime for an authorized key escrow agent to disclose a
key recklessly or intentionally, and
-create a crime of using cryptography while committing a felony
for the express purpose of thwarting an investigation.
The topic of cryptography exports is crucial to the continued growth
and security of the Internet and online commerce. The success of the
information economy in many cases hinges on the ability to employ
strong encryption techniques to protect confidential data.
The two bills come at a crucial time after the Clinton Administration
has put forth two flawed encryption proposals, Clipper and Son of
Clipper. A third plan, this time in the form of legislation, is in the
works if one is to believe the rumors in the press. So far the only
reason the Clinton Administration's flawed "Clipper" plans have been
paid any attention to at all is because they offer relaxed export
controls in return for storing your keys with government agencies or
quasi-government agencies. The best part of the Leahy bill, though, is
that you can use the encryption export provisions without ever thinking
about using escrow.
Leahy's bill will ensure that few consumers, if any, ever consider another
Clinton-mandated encryption scheme ever again.
The Leahy/Goodlatte bill allows the export of most of the cryptographic
products you and I would would like to use, without any of the Clipper
requirements. Without the lure of relaxed export for "Clippered"
products, nobody will pay attention to Clipper products. This will
surely be the deadly blow to all present and future "Clipper" plans
that rely on the Clinton Administration's strongarm export policy
tactics.
A new Clinton proposal on encryption is rumored to be in the works.
However, judging from the way they've bungled the first two proposals,
VTW believes the newest Clinton proposal will be created with a similar
process, with little regard for the concerns of business, industry and
the public.
One thing is certain; there will be movement on encryption policy this
year. It may be legislative or it may be regulatory; we're in a far
better position driving legislation we endorse, rather than lobbing
bombs at legislation being driven past us.
VTW believes this legislation is an excellent initiative. We have long
advocated the decontrol of cryptography export laws based on the
following principles:
-The public and businesses have the right to use the strongest
cryptographic products they (not the government) feel are necessary
to ensure the confidentiality of their private communications.
-The public and businesses should never be compelled to use software
with escrow functionality, escrow agents, nor escrow agents that
do not have the public's confidence.
-If the public and business should choose to use escrow agents,
the agents' primary responsibility should be to key owners, not to
law enforcement. They should be mostly unregulated, and in an
ideal world, there should be hundreds, if not thousands to choose
from.
-Current export controls are outdated, don't work, are endangering
the worsening the problem of security of the Internet, and are
damaging the competitiveness of US companies in the global
marketplace.
The way Leahy/Goodlatte addresses export of cryptography is consistent
with our principles. VTW will keep you informed of its progress. As
anyone familiar with the legislative process knows, a bill rarely ever
looks the same at the end of the process as it did at the beginning.
This bill is good for the Internet, and we intend to monitor it like
the watchdogs you expect us to be, to ensure that it does not
significantly deviate from the basic principles outlined above.
In doing this, it will be crucial for the Internet community to speak
up. Big business will weigh in on this bill to protect their rights to
sell products with encryption in them. However nobody will speak up
for your right to have a private conversation except you.
We're counting on you to find that voice, and use it over the next few
months to ensure that your present right to use encryption *of your
choice* isn't amended out of the bill. There are some powerful forces
out there that will be lobbying heavily on this legislation. The White
house is rumored to have their bill ready. The law enforcement and
intelligence communities, who would rather you couldn't use strong
encryption, will be employing their usual scare tactics. Worst of all,
the Clinton Administration, particularly Vice President Al Gore, who
should be a voice of reason for these issues, will, if the example of
Clipper and Son of Clipper is any indication, pander to law enforcement
and the anti-crime vote in an election year.
We predict that the White House will do everything in their power to
prevent Senator Leahy from liberating PGP. He will need your help to
push forward.
Over the next few months, VTW will be coordinating a coalition of
names, many of which are already familiar to you. This coalition will
ask you to call and write to Congress, expressing your opinion, and
threatening to back it up with the ultimate legitimate weapon of
democracy, your vote in this election year.
We're counting on you; we know you're up to it.
We urge you to visit our homepage at http://www.vtw.org/, where we'll
keep you updated on current events involving the bill. If you haven't
already, you may want to subscribe to our vtw-announce list, no
discussion, low-volume email messages that will keep you updated
directly as we issue alerts and newsletters. In the wake of the
Telecomm Bill protests, over 3,000 of you have subscribed in less than
a month. Use the one-line form on our home page.
P.S. We don't count our WWW page hits; we have better things to do.
________________________________________________________________________
ANALYSIS OF ENCRYPTED COMMUNICATIONS PRIVACY ACT
The Leahy and Goodlatte bills are not exactly alike. For the moment,
we will concentrate on the Leahy bill for purposes of analysis. We
find it to be fleshed out in many areas.
AFFIRMS OUR RIGHT TO USE CRYPTOGRAPHY OF OWN CHOOSING
The bill affirms that "Americans should be free lawfully to use
whatever particular encryption techniques, technologies, programs, or
products developed in the marketplace they desire in order to interact
electronically worldwide in a secure, private, and confidential
manner". The bill also affirms our right to use cryptographic products
that do not have key escrow functions in them, or to choose not to use
such functions. If we do choose to use escrow holders, the bill
affirms our right to use key holders of our own choosing.
DEREGULATION OF PUBLICLY-AVAILABLE CRYPTOGRAPHIC TECHNOLOGY
The bill addresses the "PGP problem" by making software that is
"generally available", "publicly available", or "public domain"
exportable with NO LICENSE REQUIRED, unless it is "specifically
designed for military use".
CREATES CRIMINAL PENALTIES FOR MALICIOUS KEY HOLDERS
If I designate a local business to be my key holder, it is important
that they take that responsibility seriously. The bill creates
criminal penalties for key holders that behave recklessly with my
decryption keys.
Recently the Administration suggested that such individuals must be
licensed by the US Government, and in some cases, be required to
possess security clearances. This would make them little more than
puppets of law enforcement. The bill creates criminal penalties with
monetary fines if a key holder releases a key recklessly or
inappropriately. Reasonable rules for an escrow agents conduct are
described in the bill. These are discussed further below.
RAISES THE STANDARD FOR A COURT TO OBTAIN YOUR DECRYPTION KEY
Currently a court needs to only issue a simple search warrant to obtain
a copy of your key for decryption of your communications. This bill
raises the requirement to be equivalent to that of a court-ordered
wiretap.
ENCOURAGES KEY HOLDERS TO SERVE THE INTERESTS OF KEY OWNERS WHEN
PRESENTED WITH A COURT-ORDER
If you have chosen to use a key holder, they may find themselves in a
curious predicament if presented with a court order at some point in
the future. They really don't want to simply hand over your decryption
key, since once it is divulged, it might be used to decrypt more
information than what is required under the court order.
The bill instructs a key holder to provide law enforcement with as
little information as possible, in order to satisfy a warrant request,
while still protecting as much of the key owner's confidentiality as
possible.
The bill accomplishes this by instructing a key owner to attempt to
deliver decrypted communications only for the times specified by the
warrant to law enforcement as a first step. If the key holder is
unable to produce the decrypted communication for law enforcement, only
then, as a last resort, should a key holder relinquish your key.
This allows a key holder to work to protect the confidentiality of your
decryption keys, while still fulfilling both the spirit and letter of
the court order.
DISCOURAGES THE USE OF ENCRYPTION TO THWART A FELONY INVESTIGATION
This is probably the one provision we wouldn't have put in the bill,
were we drafting it. Clearly added to appease law enforcement, it
creates a new crime to "willfully" attempt to thwart a law enforcement
investigation by using encryption. VTW feels that such a crime is
unnecessary, but we're happy to see this is a fairly narrowly-tailored
statute. It only applies to individuals who are engaging in a felony
and using encryption to communicate information while in the commission
of the felony, and whose intent, in using encryption, is to foil a law
enforcement investigation.
If you and a friend are talking with an encrypted phone, and you
mention that you think some mutual friend is cheating on their taxes,
you are not liable under this provision. If you are planning the
Million Man March using encrypted email, and fear that you may be
investigated because your cause in unpopular in some law enforcement
circles, you are not liable because you are not committing a felony,
even though law enforcement may find it annoying that they cannot read
your mail.
This provision only applies to you if you are using encryption to
specifically foil a law enforcement investigation AND the communication
relates to a felony AND you are using the communication to commit the
felony. VTW feels this is a fairly narrowly drawn statute that is not
likely to be easily abused.
Although this bill is the best thing we've seen in Congress on this
issue since ex-Rep. Maria Cantwell's (D-WA) export-of-encryption bill
was introduced to the 103rd Congress two years ago, there are still
some issues in the bill that bear further examination. Let it be
understood that we think the balance of this bill right now will help
the net far more than hurt it and the net should step forward and help
Leahy and Goodlatte in their fight against the Administration over this
issue. Nevertheless, our suggestions for tuning this bill are included
below.
BILL SHOULD INCLUDE AN EXPLICIT SUPPRESSION PROVISION
Although the Fourth Amendment is the law of the land, it is important
to note that it a applies to communications decrypted after an
erroneous warrant has been issued. VTW feels that such a provision
should be enumerated in the bill, just to clarify any concerns a court
might have about such evidence. It is also clear, however, that such a
provision is nearly impossible to obtain in the current Congressional
climate, though we will continue to urge the bill's sponsors to add
it.
THE BILL SHOULD CLEARLY INCLUDE ENCRYPTION PRODUCTS FOR STORED DATA
The bill addresses encryptions products used for wire or oral
communications, per the Electronic Communications Privacy Act. Since
many encryption products are built for just this purpose, it includes
many of them. However, we think it is appropriate to specifically
include products that are used only for encrypting stored data.
THE BILL SHOULD INSTRUCT ESCROW AGENTS TO REPORT DISCLOSURES AS WELL
The bill currently requires law enforcement to notify the Office of the
Courts as to the number of court orders served on key holders and for
what crimes the court orders were obtained. The Office is required to
make this information public annually.
VTW feels that accountability should never be in short supply.
Requiring key holders to notify the Office of the Courts whenever they
are ordered to disclose a key will allow the public yet another way of
making sure that appropriate procedures are being followed to protect
the public.
We suggest an inexpensive reporting method such as registered mail so
as not to burden key holders needlessly. Presumably, when the Office
of the Courts totals up its numbers every year, the number of
disclosures reported by law enforcement will add up to the SAME number
reported by key holders themselves. Should there be a discrepancy, the
public will be grateful for the additional accountability.
NEW CRIMES ARE NEEDED TO DISCOURAGE MISREPRESENTING YOURSELF TO A KEY HOLDER
Currently the bill relies on existing laws that cover police
misrepresentation to punish law enforcement officials that misrepresent
themselves to a key holder with an improper or forged warrant to obtain
a key or a decrypted communication.
The majority of law enforcement officials are good people that would
never consider such an act. Consequently, they should have nothing to
fear from such a statute.
VTW believes that a new statute is needed to dissuade those few
over-zealous law enforcement officials from violating the public's
trust in these matters.
On the whole, we believe that this bill is a win for the Internet
public and Internet businesses that require strong market-driven
cryptography. VTW urges you to become familiar with it and support
Leahy and Goodlatte in their efforts.
________________________________________________________________________
WHAT YOU CAN DO NOW
1. It's crucial that you familiarize yourself with this bill. You can
find links to it at http://www.vtw.org/ If you are an ISP or run a
WWW page, we urge you to place a pointer to the bill on your homepage
or in your message of the day. Here's a sample paragraph you can use:
A bill has been introduced in Congress today that will decontrol
many types of encryption products so they may be sold abroad,
including the world-famous PGP. To learn more about this
legislation, see VTW's home page at http://www.vtw.org/
Please remove this notice after a few days.
2. If you are an Internet Small Business, signon to VTW's Internet Small
Business Coalition at http://www.vtw.org/help/ We'll likely be
assembling a coalition of Internet small businesses in the next few
weeks and will solicit your input on ways of carrying your message to
Congress.
3. Join our vtw-announce mailing list by sending mail to [email protected]
or by signing up straight through our WWW page at http://www.vtw.org/.
We'll be following this issue closely in the coming months. Note that
vtw-announce is not a discussion list. It's VTW announcements, with
little repeat content from other sources.
________________________________________________________________________
CHRONOLOGY OF THE 1996 LEAHY/GOODLATTE CRYPTO BILLS
Feb 26, '96 Sen. Leahy (D-VT) and Rep. Goodlatte (R-VA) introduce
the Encrypted Communications Privacy Act. Cosponsoring
this legislation on the Senate side at Sen. Burns (R-MT)
and Sen. Murray (D-WA). On the House side are the
following cosponsors: DeLay, Campbell, Eshoo, Moorhead,
Doolittle, Barr, Ewing, Mica, Everett, Bono, Lofgren, and
McKeon.
________________________________________________________________________
A FEW QUESTIONS AND ANSWERS
Q: Does this require, or even urge individuals to use third parties to
hold their decryption keys?
A: No way. You can use the liberal export provisions in this bill with
out ever allowing your keys to leave your "cold dead fingers".
Q: Does this advance the Clinton Administration's Clipper scheme in any way?
A: No, in fact this bill cuts out the very heart of the Clipper program.
The two Clipper programs had the potential to be adopted because Clipper
products were intended to receive preferential export treatment. This
allows the export of non-Clipper products. In the global marketplace,
the Clipper products will not be able to compete. This bill is probably
the final nail in the coffin of the Administration's flawed Clipper
proposals.
Q: Bills change during Congressional deliberation. Could this bill
change in such a way that VTW would no longer support it?
A: Absolutely. In fact, we consider it our mission to monitor the
legislation to ensure that it isn't amended to act against the right
of Internet users and businesses.
Q: Wasn't Goodlatte one of the bad guys on the Communications Decency Act?
Why is he sponsoring this bill, and can we trust him?
A: Goodlatte did indeed introduce the fatal amendment that made the House
version of the Telecomm Bill unsupportable. Nevertheless, VTW has found
that a Congressperson's vote on one sort of bill is little indication of
his or her stand on others. VTW wil closely examine any change in the
language of the bill throughout its Congressional life.
Q: Does this create a requirement for key holders to exist, or for me to
use programs that store keys with third parties?
A: No. The bill affirms your right to use encryption without such a feature,
and if you do use software with such a feature, to self-escrow the keys.
In fact, key holders can exist today.
Q: Does this create a new obligations for key holders to disclose keys that
they wouldn't have to comply with before?
A: No. In fact, this bill makes it harder for a law enforcement official to
retrieve a key from a key holder, by requiring a wiretap request instead
of a simple search warrant.
________________________________________________________________________
PRESS CONTACT INFORMATION
BY EMAIL (if your deadline is more than 24 hours away)
Send mail to [email protected] with "press deadline" in the subject line if
you are on a deadline.
BY PHONE (if your deadline is in less than 24 hours)
Call 718-596-2851 and follow the directions for contacting Steven Cherry
or Shabbir J. Safdar quickly.
________________________________________________________________________
OUR POLICY ON FINANCIAL DONATIONS
We do not accept unsolicited financial donations for our work. If you
want to help further VTW's work, we urge you to register to vote. Check
the Blue Pages of your local phone book for "Board of Elections". You
should be able to obtain voter registration forms from them.
________________________________________________________________________
Copyright 1994-1996 Voters Telecommunications Watch. Permission is granted
to copy and distribute this document for non-commercial purposes only,
provided that the above banner and this copyright notice appear in all
copies. For other uses, see our Copyright Policy at
http://www.vtw.org/copyright.html
========================================================================